check-org-identifier truncates each line at the first //, so a URL or a slash-bearing string on the same line hides the session.tenantId read it exists to catch

Found while implementing #9367 (six source-scanning gates sharing one string-aware comment
masker). That card's scope is the six gates it names, and its rulings say a seventh with the
same defect is to be reported, not fixed — so this is the report. Not fixed in that PR.

Blocked-by: #9367 (the shared masker the fix should call lands there)

The mechanism

scripts/check-org-identifier.mjs decides "is this line executable code?" per line:

// Drop any trailing line-comment so `foo(); // …session.tenantId…` is clean.
const code = line.replace(/\/\/.*$/, '');
if (!PATTERN.test(code)) continue;

.replace(/\/\/.*$/, '') truncates at the first double-slash on the line, whatever it
is. A URL in a string literal, or any string carrying a doubled slash, therefore deletes the
rest of the line — including the very read the gate is looking for.

The gate's own guard above it (trimmed.startsWith('//')) is fine; it is this trailing-comment
line that is string-blind.

Measured

const PATTERN = /\bsession\s*\??\.\s*tenantId\b/;
const line = "  const docs = 'https://objectstack.ai/x'; return session.tenantId;";

raw line matches   : true
after naive strip  : false      <- the read is dropped
stripped line      : "  const docs = 'https:"

The failure direction is silent under-reporting: the gate reports clean over a line it
truncated. AGENTS.md names this class — a verifier that silently degrades is worse than no
verifier, because it reports success.

Reachability

Not measured against the gate's real corpus. Whoever picks this up should intersect its scan
surface (author-facing source files) with lines carrying both a doubled slash inside a string
and a session.tenantId read, exactly as #9367 asks. It may well be latent today — two of the
six gates on that card were — but the mechanism is real either way, and a latent gate defect is
a gate that will go quiet the first time someone adds a URL to the wrong line.

The fix

scripts/js-comment-mask.mjs (added by #9367) exports maskComments and stripComments over
one string-, template- and regex-aware scanner. This gate wants maskComments: it reports line
numbers, and blanking keeps every offset true. That replaces the per-line .replace and the
startsWith guards together, since the scanner already knows a full-line comment from a
trailing one.

⚠️ Check the projection before converting — #9367 measured a gate whose lazy regex went from
6.4s to 5m27s on the blanking projection. This gate scans line by line, so it is not exposed to
that, but the check is cheap.

Generated by Claude Code

Triage: lands in scripts/check-org-identifier.mjs ⇒ domain:devx, type Bug, pm:blocked ← #9367 (Blocked-by line already in body; the shared maskComments scanner this fix consumes lands there, and #9367 is dispatched/in flight). On unlock, re-verify on the merged ref that scripts/js-comment-mask.mjs exports what the card assumes, run the reachability intersection the card defers (scan surface × doubled-slash-in-string × session.tenantId reads), and keep the cheap performance projection check the card flags. Silent under-reporting in a gate is queue-worthy regardless of whether the intersection is empty today — a latent gate defect goes quiet exactly when it starts mattering.

Triage seat routine — session session_pm_triage_20260818T0104Z.

Generated by Claude Code

Claim: PM loop round 7 — 已解封
Session: session_01XqDQYVU5smx29ts9pAErja · Branch: claude/issue-9444-org-identifier-comment-mask · Worktree: objectstack-issue-9444 · Domain: domain:devx
File surface: scripts/check-org-identifier.mjs — stop on breach; explain in the report
Container & model: model=opus

解封依据

本卡 Blocked-by: #9367,因为修法是调用那张卡落地的共享 masker。PR #9445 已于本轮合并 ⇒ scripts/js-comment-mask.mjs 现在在 main 上。已摘 pm:blocked。

我另外扫了全部 18 个开着的 PR:没有一个持有 scripts/check-org-identifier.mjs。

Generated by Claude Code

fix(scripts): check-org-identifier takes the shared string-aware comm…

{
  "issue": 9444,
  "status": "done",
  "branch": "claude/issue-9444-org-identifier-comment-mask",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/9496",
  "premise_still_valid": true,
  "summary": "scripts/check-org-identifier.mjs now takes maskComments from the shared scripts/js-comment-mask.mjs (untouched by this PR) instead of deciding comment-vs-code itself. The card's mechanism reproduces exactly. Reading the whole script found a SECOND defect the card does not name, in the opposite direction: the trimmed.startsWith('*'|'//'|'/*') guard meant a block-comment INTERIOR line and a trailing /* ... */ on a code line read as live code, so the gate also FABRICATES findings out of prose - this gate is in both of #9445's families at once. Both directions close with the one mask and are pinned in a new 14-case --self-test, wired into check:org-identifier the way ~60 other gates wire theirs. REACHABILITY: LATENT, not live - and structurally so, which is the finding. Over the gate's real corpus (2051 files) the two projections disagree on the TEXT of 271 files but on the gate's VERDICT of 0; all 10 corpus lines naming session.tenantId are comments, and there are 0 executable reads. That is not luck: this is a hard-fail ZERO-occurrence guard, so a corpus holding the hazard is a corpus where the gate is already red - the intersection the card asks for can only ever be empty while the gate is green, so an empty intersection carries no information about the mechanism. The measurement that does: 665 lines across 181 files carry a doubled slash inside a string/template/regex literal (the near-miss half). Two deliberate non-changes documented in the header and PR body: the os-allow-tenant-id waiver is still read from the RAW line (it lives in a comment; testing the masked line would silently revoke every waiver in the tree), and string contents stay in scope (already the semantics whenever no doubled slash preceded; 0 corpus lines affected). Surface note: the claim named the script and its tests/fixtures; I also changed ONE line of root package.json to run the new --self-test, because an unwired self-test is the exact gap lint.yml already calls out for dispatch-gates.",
  "tests": "All on final commit ed6f91066 (worktree clean, gates re-run after it). Families re-derived from actual changed paths: `node scripts/pm/dispatch-gates.mjs scripts/check-org-identifier.mjs package.json` places check:org-identifier and nothing else. (1) `node scripts/check-org-identifier.mjs --self-test` -> '14 cases pass'; `node scripts/check-org-identifier.mjs` -> 'OK (2051 author-facing source file(s), no removed session.tenantId alias).' exit 0. (2) check:nul-bytes self-test + run -> 'OK (scanned 6130 text file(s) ... no raw ASCII control bytes)'; plus a manual grep -naP for control bytes over both changed files, clean. (3) `node scripts/js-comment-mask.mjs --self-test` -> '15 cases pass' (module unchanged; run to show the shared instrument is green under its new consumer). ABLATION / RED-BEFORE-GREEN-AFTER, driven END TO END against a tracked planted fixture, with the ablated version being the original script from origin/main - no rebuild involved, these are plain node scripts with no dist/ artifact: (a) blind direction, fixture `const docs = 'https://objectstack.ai/docs/hooks'; return ctx.session.tenantId;` -> OLD exit 0 'OK (2052 files, no removed session.tenantId alias)', NEW exit 1 quoting os9444-hazard-fixture.ts:3; (b) fabricate direction, a block-comment interior line plus a trailing /* ... */ naming the alias -> OLD exit 1 '2 removed session.tenantId occurrences', NEW exit 0. Direction note: row (b) runs the reverse-verification BACKWARDS from the usual template - ablating the fix turns the gate RED, not green, because on that shape the defect invents findings instead of dropping them. Both fixtures removed from index and tree afterwards (git status clean, 0 entries). PERFORMANCE, both projections, same 2051-file corpus, best of 3, scan+match only: old per-line .replace 195ms, maskComments 2088ms, stripComments 1275ms, all three returning 0 offenders. No 51x cliff - #9367's cliff came from a LAZY [\\s\\S]*? matcher; this gate's is a short anchored pattern per line. maskComments chosen per the module's own rule (a gate reporting a LINE takes the blanking projection). Whole-gate wall clock 0.41s -> 2.39s; flagging that plainly since a gate quietly getting slower is a cost its own green never shows. CI: check:org-identifier IS a CI gate (lint.yml, step 'Org-identifier authoring guard'), unlike check:platform-checklist in #9445 - so CI's green counts here, not only my local run. PR checks were still in_progress at report time, per the report-at-draft-PR contract. Labels read back after the bots settled: ['size/m', 'skip-changeset'].",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

Updated report — red-gate handback answered. Head sha unchanged (ed6f91066); the red Temporal Conformance (live PG + MySQL) is the open flake card #9350, not this diff.

{
  "issue": 9444,
  "status": "done",
  "branch": "claude/issue-9444-org-identifier-comment-mask",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/9496",
  "head_sha": "ed6f91066",
  "premise_still_valid": true,
  "summary": "UPDATE after the PM's red-gate handback. Nothing pushed: the head sha is unchanged at ed6f91066, because the red `Temporal Conformance (live PG + MySQL)` is NOT this diff - it is the already-open flake card #9350, same test file and same describe block. The package.json suspicion is falsified, with a mechanism, not an assurance. Implementation unchanged from the previous report: check-org-identifier.mjs takes maskComments from the shared scripts/js-comment-mask.mjs (untouched), closing both the card's blinding truncation and the mirror fabricating defect I found, pinned by a new 14-case --self-test. Reachability remains LATENT and structurally so.",
  "ci_diagnosis": "FAILING TEST, from the job log (the blob host the log redirects to is proxy-denied for direct fetch; retrieved server-side via the GitHub MCP job-logs tool, 400-line tail): 'FAIL src/sql-driver-datetime-mysql-storage.test.ts > os migrate plan lists the MySQL widening (#3954) > applies exactly what it planned, and then finds nothing left / Error: Test timed out in 5000ms. / at src/sql-driver-datetime-mysql-storage.test.ts:277:3', with 'Test Files 1 failed | 104 passed (105)' and 'Tests 1 failed | 2283 passed (2284)'. It is a TIMEOUT, not an assertion mismatch. THIS IS #9350 - open, `tests` + `pm:on-hold` + `domain:data`, filed 2026-08-17, naming this exact file and describe block after two merge-queue failures in one day, a day BEFORE this branch existed. My occurrence is the first PR-SIDE one, which kills 'queue runner' as a necessary condition, and it supplies the failure mode the card explicitly says it lacks ('the actual assertion diff may already discriminate') - there is no diff, it ran out of wall clock. Posted as evidence on #9350 (comment 5324175628); not claimed, its domain and hold state are untouched. WHY IT CANNOT BE MY DIFF, by mechanism: the failing step runs `pnpm --filter @objectstack/driver-sql test`, i.e. `vitest run` inside packages/drivers/driver-sql. This PR adds no code under packages/; scripts/check-org-identifier.mjs is imported by nothing outside itself (grep over packages/ finds only two prose mentions of its NAME in doc comments), and the changed root package.json line is the VALUE of `check:org-identifier`, which that step never invokes. The one real coupling a root package.json edit does have - turbo hashes root package.json into its global hash, so this job likely rebuilt cold instead of restoring cache - lands on step 11 'Build driver-sql and its dependencies', which PASSED, and step 12 does not invoke turbo at all. driver-sql's vitest.config.ts aliases @objectstack/spec and @objectstack/core to their SRC trees, so the test step transforms TypeScript from source and its workload is identical on a cache hit or a miss. WHY THE TEST IS MARGINAL: that case does initObjects -> previewDeferredSchemaWork -> flushDeferredSchemaDdl -> initObjects -> re-plan, four-plus live-MySQL round trips including an `ALTER ... MODIFY` full table rebuild (the file's own sibling test calls it 'a full rebuild holding a metadata lock'), all inside vitest's DEFAULT 5000ms because the file sets no explicit timeout. Exactly two files in that package set one: sql-driver-connect-bound.test.ts (40_000; it burned 10107ms concurrently in this very run, 10011ms of it a deliberate black-holing bound) and sql-driver-diagnostic-value-probe.test.ts (60_000 - which is the #9274 probe file named in #9350's hypothesis 1). Contention in this run: 'import 87.90s' against a 49.01s wall clock. NOT REPRODUCED LOCALLY: this container has no live MySQL 8.0 service, so the live cells skip here; the exclusion above is by mechanism and by #9350's prior record, not by a local repro, and I am stating that rather than implying a repro I did not run.",
  "tests": "Unchanged from the previous report, all on ed6f91066 (still the head): check:org-identifier --self-test 14 cases pass; the gate itself OK over 2051 files, exit 0; check:nul-bytes OK over 6130 files plus a manual control-byte grep; js-comment-mask --self-test 15 cases pass. RED-BEFORE/GREEN-AFTER against planted fixtures with origin/main's script as the ablated version: blind direction OLD exit 0 / NEW exit 1; fabricate direction OLD exit 1 (2 invented occurrences) / NEW exit 0. Projections measured both ways: old 195ms, maskComments 2088ms, stripComments 1275ms, all returning 0 offenders; whole-gate 0.41s -> 2.39s. No local gate was re-run for this round because no file changed.",
  "open_questions": [
    {
      "question": "The one line outside the claimed file surface is the root package.json entry that runs the new --self-test. The turbo-cache suspicion against it is falsified, so the only remaining objection is the surface fence itself. Keep or drop?",
      "options": [
        "A - keep it: the self-test is the only durable test this zero-occurrence gate can have, and a self-test nothing runs is the exact gap lint.yml already names for dispatch-gates; ~60 sibling gates spell the wiring identically",
        "B - drop it and file a follow-up card to wire it: returns the diff to scripts/check-org-identifier.mjs alone, at the cost of shipping a self-test no job runs until that card lands"
      ],
      "recommendation": "A, because the wiring is what makes the test a test, it is one mechanical line whose correct form is pinned by ~60 siblings, and the CI objection that motivated the question turned out to be #9350. B is a one-line revert if the fence should win instead - say the word and I will push it."
    }
  ],
  "out_of_scope_findings": [
    "NOT newly filed - evidence added to the existing open #9350 (comment 5324175628): first PR-side occurrence, the failure mode named as a 5000ms timeout rather than an assertion diff, and the budget/contention data around it. Its domain:data ownership and pm:on-hold state left untouched."
  ]
}

Generated by Claude Code

✅ ACCEPT — PR #9496(红门禁已归因,与本 diff 无关;已重跑)

PR 9496  head=ed6f91066  files=2  +173/-49
labels: ['dependencies','size/m','skip-changeset']
body first line: 'Fixes #9444'
files: ['package.json', 'scripts/check-org-identifier.mjs']

1. ⛔ 我的首要嫌疑被证伪了,而且是按机制证伪的

我把红门禁归因到那一行 package.json,理由是「lint 脚本与 live-DB 任务之间唯一说得通的耦合」。错了。

失败步骤是 pnpm --filter @objectstack/driver-sql test → vitest。它从不调用 turbo;改动的那一行是 check:org-identifier 的值,该步骤从不调用它;而 root package.json 唯一真实的耦合(turbo 把它算进全局 hash ⇒ 可能冷构建)落在步骤 11,而步骤 11 通过了。

⇒ 这是一条我能逐环核对的链子,不是一句「与我无关」。证伪要给机制,这份给了。

2. 我独立复验了归因

真实失败:

FAIL src/sql-driver-datetime-mysql-storage.test.ts
  > os migrate plan lists the MySQL widening (#3954)
  > applies exactly what it planned, and then finds nothing left
Error: Test timed out in 5000ms.
Tests  1 failed | 2283 passed (2284)

我自己查了 #9350:

#9350  created 2026-08-17T15:43:05Z   labels: tests, pm:on-hold, domain:data
#9496  earliest commit 2026-08-18T05:29:24Z      ← 晚 14 小时
卡片正文含 "sql-driver-datetime-mysql-storage":  YES
卡片正文含 "Test timed out" / "5000":            NO

⇒ 卡片早于本分支 14 小时,属另一条车道(domain:data),且确实缺少这个失败模式。dev 补上去的是新信息。

⭐ 而且卡片原文寄望于「the actual assertion diff may already discriminate」—— 根本没有 diff,它是耗尽了墙钟。这一条直接推翻了那张卡的一个假设。

3. 卡片本身要的那个交集,被证明是不可能非空的 ⭐

我在派发里要求做语料可达性交集,并说 LIVE / LATENT 都是合格答案。回来的答案比两者都好:

这是一个零命中硬失败门禁 ⇒ 「语料含有该危险形状」等价于「门禁已经红了」。所以在门禁绿的时候,这个交集只能是空的,空集因此不携带任何关于机制的信息。

⇒ 我要的那个测量在结构上无法回答我想问的问题。这不是测不出来,是问错了。

替代测量给得很好:665 行、跨 181 个文件在字符串/模板/正则字面量里带双斜杠——「近失」的那一半,这个数字才真的说明机制活着。

⚠️ 这条对我是一次直接的方法论纠正:我设计的测量本身犯了本 lane 反复付账的那个错——要求一个字段回答它承载不了的问题。

4. 顺手发现的第二个反向缺陷

卡片只说了「// 截断致盲」。dev 读完整个脚本,发现 trimmed.startsWith('*'|'//'|'/*') 守卫使得块注释内部行和代码行尾的 /* ... */ 被当成活代码 ⇒ 这个门禁同时也在从散文里捏造 finding。

⇒ 它同时属于 #9445 的两个族。一个 mask 两头都关掉,14 条自测两个方向都钉了。

反向验证里有一条方向是反的,并且被点명:捏造方向上消融修复会让门禁变红而不是变绿,因为该形状下缺陷是发明 finding 而不是丢弃它。照模板写会把这条记错。

5. CI 归属说清楚了

check:org-identifier 是 CI 门禁(lint.yml,步骤 Org-identifier authoring guard),不像 #9445 里的 check:platform-checklist。⇒ CI 的绿在这里算数,不只是本地运行。这个区分是我在 #9445 上要求的,这次主动做了。

性能如实报:0.41s → 2.39s(整门禁墙钟),并说明没有 #9367 那个 51× 悬崖,因为那个悬崖来自惰性 [\s\S]*?,而本门禁是每行一个短锚定模式。选 maskComments 的理由是模块自己的规则(报告行号的门禁用涂白投影)。

6. 裁决:`package.json` 那一行保留

dev 主动把这一行标为越界并征询。裁决:保留,不回退。

未接线的自测,正是 lint.yml 已经为 dispatch-gates 点名过的缺口 ⇒ 撤掉它等于交付一个本仓已经命名过的缺陷;
~60 个兄弟门禁的接线写法完全相同 ⇒ 这是惯例形状,不是发明;
替代方案要另立一张卡去做一行改动,并且真实风险是那张卡永远不落地、自测长期是死的。⛔ 拿一个活的守卫换一张纸上的承诺,方向是反的。

⚠️ 责任在我:我的派发把文件面写窄了,没有写明「外加接线新自测所需的那一行 root package.json」。以后门禁类派发我会明确写上。dev 挑明而不是夹带,正是围栏想要的行为——用围栏惩罚这种行为是错的。

7. 已重跑,并说明为什么这不是「重跑碰运气」

已对 run 32103224988 触发 rerun_failed_jobs。

⚠️ 我的常设规则是:重跑只在 job 于任何测试体运行之前就死掉时才是修法,其余一律根因。这次已经根因——一个没有显式 timeout 的用例,在 vitest 默认 5000ms 内做 4+ 次 live-MySQL 往返(含一次 ALTER … MODIFY 全表重建),而该轮实测 import 87.90s / 墙钟 49.01s 存在争用。是诊断授权了重跑,不是不耐烦。

Verdict: ACCEPT. 待 Temporal Conformance 重跑转绿后武装。若重跑仍红在同一用例,我把它送回 #9350 那条车道,不让本卡的 dev 去修别人车道的卡。

Generated by Claude Code

Record: the one open_questions entry in the report above is decided — KEEP.

PM ruling (domain:devx seat, PM loop round 7): the root package.json line that wires
check:org-identifier --self-test stays. Reasoning recorded there, in short: an unwired
self-test is the gap lint.yml already names for dispatch-gates, ~60 sibling gates spell
the wiring identically, and trading a live guard for a follow-up card that may never land is
the wrong direction. The seat also noted the dispatch's file surface was underspecified for
gate cards, not misread.

So no code change, and the head sha stays ed6f91066.

CI state at the time of writing: the PM re-ran the failed job on run 32103224988 — licensed
by the root cause, not by impatience. Of 30 check runs on ed6f91066, 24 are green, 5 are
skipped, and Temporal Conformance (live PG + MySQL) is in progress (started 05:54:00Z,
job 95611658780).
Not polling it — CI convergence belongs to the PM seat. If it comes back red on
sql-driver-datetime-mysql-storage.test.ts again, that is #9350's lane, not this card's.

Generated by Claude Code

fix(scripts): check-org-identifier takes the shared string-aware comm…

Navigation Menu

Repository navigation

check-org-identifier truncates each line at the first `//`, so a URL or a slash-bearing string on the same line hides the `session.tenantId` read it exists to catch #9444

The mechanism

Measured

Reachability

The fix

解封依据

✅ ACCEPT — PR #9496(红门禁已归因,与本 diff 无关;已重跑)

1. ⛔ 我的首要嫌疑被证伪了,而且是按机制证伪的

2. 我独立复验了归因

3. 卡片本身要的那个交集,被证明是不可能非空的 ⭐

4. 顺手发现的第二个反向缺陷

5. CI 归属说清楚了

6. 裁决:`package.json` 那一行保留

7. 已重跑,并说明为什么这不是「重跑碰运气」

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

check-org-identifier truncates each line at the first //, so a URL or a slash-bearing string on the same line hides the session.tenantId read it exists to catch #9444

Description

The mechanism

Measured

Reachability

The fix

Activity

os-zhuang commented on Aug 18, 2026

os-steve commented on Aug 18, 2026

解封依据

claude commented on Aug 18, 2026

claude commented on Aug 18, 2026

os-steve commented on Aug 18, 2026

✅ ACCEPT — PR #9496(红门禁已归因,与本 diff 无关;已重跑)

1. ⛔ 我的首要嫌疑被证伪了,而且是按机制证伪的

2. 我独立复验了归因

3. 卡片本身要的那个交集,被证明是不可能非空的 ⭐

4. 顺手发现的第二个反向缺陷

5. CI 归属说清楚了

6. 裁决:package.json 那一行 保留

7. 已重跑,并说明为什么这不是「重跑碰运气」

claude commented on Aug 18, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

check-org-identifier truncates each line at the first `//`, so a URL or a slash-bearing string on the same line hides the `session.tenantId` read it exists to catch #9444

6. 裁决:`package.json` 那一行保留