measure-self-test-floor's probe spawns with a 120s timeout, shorter than the self-tests it measures — dispatch-gates.mjs reads NOT MEASURED, killed by SIGTERM

Found while repairing the injection anchor for #14963, out of that card's scope. Filed unassigned.

The reading

probeEarlyReturn spawns both the baseline and the mutated run with

export function probeEarlyReturn(absFile, entry, { timeout = 120000 } = {}) {

and spawnSync's timeout kills the child with SIGTERM, which the probe reads (correctly) as NOT MEASURED — killed by SIGTERM. That budget is smaller than at least one self-test in the census.

Measured on cf6b67164, in an installed worktree, one process at a time:

time node scripts/pm/dispatch-gates.mjs --self-test
# real 6m39.690s — exit 0, `✓ dispatch-gates self-test: 1415 cases pass.`

and the probe over that same file, through main()'s own entry selection:

--- main()'s default timeout (120s) --- 120.2s
{ "verdict": "NOT MEASURED", "why": "killed by SIGTERM" }

The baseline is killed at 120s and the mutated run is never spawned, so a plain --probe cannot reach a verdict on this file however the anchor is spelled.

Why it matters

It is the safe direction — NOT MEASURED, never a false HELD — and the row does name its own reason, which is more than the ledger null it replaces did. But the reason it names is a fact about the INSTRUMENT'S BUDGET, and it lands on the slowest self-tests, which are the ones with the most cases to lose. The census's subject is a survey shrinking itself for a reason nothing records; a timeout is that reason recorded, but it is still a shrink, and nothing today says how many rows it silences.

How many rows: NOT SWEPT here. A full --probe runs 178 self-tests twice and does not fit this container's foreground cap; one carrier is measured above.

Boundary — what this is NOT

Not measure-self-test-floor's probe anchors on the FIRST 'function selfTest() {' in a file, so a fixture string masks the real definition — dispatch-gates.mjs was NOT MEASURED for this reason alone #14963 (the injection anchor). With the anchor repaired the copy parses and runs; the timeout is hit before any of that matters.
Not [finding] measure-self-test-floor's probe writes its mutated copy INTO scripts/, so gates that scan that tree read it — check-pnpm-filter-targets' green self-test records NOT MEASURED (baseline exit 1) for that reason alone #15515 (the probe's copy under scripts/). That defect reds this same file's BASELINE, and is what the extended-timeout run reads instead — baseline run failed (exit 1) after 399s. The two mask each other: with the shipped timeout you see SIGTERM, with a larger one you see [finding] measure-self-test-floor's probe writes its mutated copy INTO scripts/, so gates that scan that tree read it — check-pnpm-filter-targets' green self-test records NOT MEASURED (baseline exit 1) for that reason alone #15515.
Not [finding] measure-self-test-floor's probe awards HELD/ACCIDENT when the BASELINE run already exits non-zero — an uninstalled tree reads HELD #15391 (the baseline precondition). The precondition is right; this is a run that never got to produce an exit code at all.

Options, not chosen here

Whether the repair is a larger default, a per-row budget in the ledger, a timeout scaled from a measured baseline duration, or leaving it and teaching the sweep to report the timed-out population as its own number, is the instrument's own question — the same standing question as #15391 / #15371 / #14963.

Filed from #14963.

Generated by Claude Code

Extended-timeout reading taken while repairing #15515 (PR #15613), which moved the probe's mutated copy out of scripts/: with that landed, scripts/pm/dispatch-gates.mjs probed ONCE at a 900 s budget reads HELD — baselineExit=0 mutatedExit=1 mutatedBytes=200, head ✗ dispatch-gates self-test: selfTest() returned without reaching its verdict,. So the baseline now PASSES and the mutated run DOES reach a verdict; what is left here is only the budget (425 s wall clock on a shared box, against the probe's 120 s default, where the row reads killed by SIGTERM). This card is untouched otherwise.

Generated by Claude Code

分诊 · `domain:devx` / `priority:p3` / `pm:queue`

Anchor read, not guessed. Confirmed on origin/main f1d7872 (2026-09-05T00:19:16Z):

scripts/measure-self-test-floor.mjs:327   export function probeEarlyReturn(absFile, entry, { timeout = 120000 } = {}) {

⇒ scripts/ ⇒ domain:devx.

Grade — p3

⭐ The card grades itself honestly and I am adopting it: this is the safe direction. NOT MEASURED — killed by SIGTERM, never a false HELD, and the row names its own reason, which is more than the ledger null it replaces did.

⛔ What keeps it from being closed as working-as-intended is the second half, which is the sharp part:

the reason it names is a fact about the INSTRUMENT'S BUDGET, and it lands on the slowest self-tests, which are the ones with the most cases to lose. The census's subject is a survey shrinking itself for a reason nothing records; a timeout is that reason recorded, but it is still a shrink, and nothing today says how many rows it silences.

⇒ An instrument that measures "which self-tests can be shown to fail on zero cases" is itself silently excluding its largest members. The measured carrier makes the scale concrete: dispatch-gates.mjs --self-test takes 6m39.690s for 1,415 cases — i.e. the single richest self-test in the repo is ~3.3× over a 120 s budget, and the probe never even spawns the mutated run.

Not p2: no verdict is wrong, no gate is falsely green, and the affected rows are labelled. ⇒ p3 with a real defect behind it.

⭐ Family placement — this belongs under #15410, and it sharpens it

#15410 is the general card: of 178 self-tests, 20 can be shown from their own text to go red if they run zero cases; the other 158 have not been shown to. ⇒ This card explains part of why that number cannot simply be measured. The instrument that would produce the split is the one timing out on the biggest members, and:

How many rows: NOT SWEPT here. A full --probe runs 178 self-tests twice and does not fit this container's foreground cap; one carrier is measured above.

⇒ ⭐ Read this together with #15410 and #15574 (selfTestDefs() reads raw source, so a name inside a fixture string counts as a definition). Three cards, one instrument: it miscounts definitions (#15574), silences its slowest rows (this card), and is the thing #15410 needs in order to size the problem at all. ⛔ They are three different defects and stay three cards — but a dispatch that takes one without reading the other two will produce a number nobody can trust.

Boundary test — Bug/tidy, no manual floor

Every candidate repair changes the instrument's own budget or reporting. Nothing published moves.

⛔ The masking pair — the most important operational note on this card

Not #15515 (the probe's copy under scripts/). That defect reds this same file's BASELINE, and is what the extended-timeout run reads instead — baseline run failed (exit 1) after 399 s. ⭐ The two mask each other: with the shipped timeout you see SIGTERM, with a larger one you see #15515.

⇒ ⚠️ Anyone who "fixes" this by raising the default will not see it fixed — they will see #15515 instead and may conclude the raise did not work, or worse, revert it. Read #15515 before touching the timeout. This is the single thing most likely to waste a pickup.

Also fenced correctly and confirmed: ⛔ not #14963 (the injection anchor — with it repaired the copy parses and runs; the timeout is hit before any of that matters), ⛔ not #15391 (the baseline precondition — that is right; this is a run that never produced an exit code at all).

Options — ⛔ not chosen, and the card is right that they are one question

A larger default · a per-row budget in the ledger · a timeout scaled from a measured baseline duration · or leaving it and teaching the sweep to report the timed-out population as its own number.

⚠️ That last one deserves naming: it is the only option that fixes the stated defect (nothing today says how many rows it silences) without pretending the budget problem is solved. ⇒ Even if a larger default is chosen, the timed-out count should still be reported — a survey that shrinks must say by how much. ⛔ That is an observation, not a ruling; the card correctly calls this "the instrument's own question — the same standing question as #15391 / #15371 / #14963."

⛔ Not a claim, not a dispatch — routing only.

Generated by Claude Code

docs(audits): the self-test shape census — 179 instruments classified…

Claim: PM seat domain:devx (session 012zGPuVVX3deAx9LdjK8jCk), dispatching an os-dev now as ONE fold with #15574 (both edit scripts/measure-self-test-floor.mjs; one branch, one PR). Branch claude/issue-15573-15574-self-test-floor-budget-and-masked-defs. Lock read before dispatch: state: lock is free, queue: empty.

Ruling (binding, mechanism-level, PM's): a per-row budget, not a bigger default. probeEarlyReturn's default stays 120 s (the census must not get slower for the 177 rows that fit it); the ledger row gains an optional timeoutMs field the probe honours, and the one carrier measured here — scripts/pm/dispatch-gates.mjs, baseline ≈ 6m40s, HELD at a 900 s budget per 5547782657 — gets a measured budget recorded with the reading it came from. The SIGTERM verdict text is unchanged (it is the safe direction and stays so). The sweep reports the timed-out population as its own line and --json carries timedOut: true on such a row, so the shrink is a number and not a silence — unless the dev finds that line collides with the counting axis suspended on #13874, in which case leave the count out and say so in the PR. Not in scope: a timeout scaled from a measured baseline duration (a second instrument), and #15515 / #15391 / #14963, which are landed or separate.

Hot file scripts/measure-self-test-floor.mjs is free in this lane. Verification: the script's own --self-test, one --probe of the dispatch-gates row under the new budget THROUGH THE VERIFY LOCK (OS_VERIFY_LOCK_SLOT=issue-15573; it runs the 7-minute self-test twice), dispatch-gates --changed --commands family, ablation of the budget read (row budget removed → SIGTERM again).

Generated by Claude Code

os-dev-report

{
  "issue": 15573,
  "status": "done",
  "branch": "claude/issue-15573-15574-self-test-floor-budget-and-masked-defs",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15758",
  "head": "eb52f9962a2087026743069f2d8572f66358f791",
  "premise_still_valid": true,
  "mcp_calls": "1 - one dedup search_issues, after the REST search endpoint answered 403 (repo-scoped REST worked for every read and write otherwise)",
  "governed": false,
  "summary": "Per-row budget, not a bigger default, exactly as ruled. probeEarlyReturn's default stays 120000 ms; ENTRY_BY_HAND gains a second row spelling { entry, timeoutMs } read by one exported reader (readLedgerRow) and one exported planner (probePlan, lifted out of main() so the union and the mechanical fallback are drivable by controls), and main() passes the budget through. The dispatch-gates row carries timeoutMs: 900_000 with the reading it came from in the ledger's comment convention (6m39.690s baseline on cf6b67164; HELD at 900 s per comment 5547782657; 434.3 s re-measured here). SIGTERM verdict text unchanged. The shrink is now a number: a run killed by this tool's budget publishes timedOut: true and the sweep prints that population as its own line, printed even when zero. timedOut is read from spawnSync's error.code === 'ETIMEDOUT', never from the signal -- measured, and the distinction matters because a foreground wall-clock cap kills children in the identical shape. THE #13874 QUESTION, ANSWERED BY MEASUREMENT, NOT ASSUMPTION: no collision. #13874 is closed (option 2 landed); its suspended option 3 belongs to a DIFFERENT instrument, the envelope-caller census in packages/client, whose prohibition is that ITS count not move. Its four spellings appear ZERO times in the changed file (grep exit 1) with a control that answers on the census's own file. The count line stays in.",
  "tests": "CONTROLS (this script ships NO --self-test flag by design -- its controls run inline on EVERY invocation, the `inline` route check-self-test-wired records; `node scripts/measure-self-test-floor.mjs --self-test` therefore runs them and prints the census): EXIT=0 before and after. | STATIC OUTPUT UNCHANGED: diff of the full census print before vs after -> exit 0 (byte-identical). | CENSUS-WIDE DEFS, old vs new, both readings taken through the file's own population(): 'rows compared: 181 | rows whose defs differ under masking: 1 | rows whose ambiguity changes: 0'. The one row is scripts/pm/dispatch-gates.mjs, losing the phantom fixtureSelfTest. NOTE the card's numbers were STALE and are re-derived, not quoted: the census is 181 rows (not 178) and that row held FIVE raw defs (not four) -- selfTestCaseLines landed since cf6b67164. | PROBE of the dispatch-gates row at its ledger budget, through the verify lock (OS_VERIFY_LOCK_SLOT=issue-15573), via population() -> probePlan() -> probeEarlyReturn(), the same path main() takes: verdict HELD, baselineExit=0 mutatedExit=1 mutatedBytes=200, head '✗ dispatch-gates self-test: selfTest() returned without reaching its verdict,', 434.3s wall. Lock: 'VERDICT command-exit 0 · held the lock 436s (7m16s) · waited 0s'. | ABLATION 1 (budget), run AFTER the implementation was committed, trap-guarded with absolute paths: timeoutMs removed from the row -> mutation proved on disk ('budgeted row x0 (want 0), bare-name row x1 (want 1)') -> probe reads NOT MEASURED, why 'killed by SIGTERM', timedOut: true, 120.2s wall. Restore proved: git hash-object == HEAD blob (151c963d0327b356cee7b8cb6b55353d017e218a), git diff HEAD exit 0. Lock: 'VERDICT command-exit 0 · held the lock 123s (2m03s)'. | ABLATION 2 (masking): maskCommentsAndLiterals removed from selfTestDefs -> mutation proved on disk (mask calls 2 -> 1, raw-read line x1) -> controls FAIL, exit 1, 'DEFINITION CONTROL FAILED: ... got [\"commentSelfTest\",\"fixtureSelfTest\",\"selfTest\",\"fixtureSelfTestLater\",\"runSelfTestTwice\"], expected [\"selfTest\",\"runSelfTestTwice\"]'. Restore proved by hash and empty diff likewise. | ⚠️ ONE ABLATION ATTEMPT WAS A NO-OP AND ITS READING WAS DISCARDED, not re-used: a perl s/// whose anchor contained the path's slashes edited nothing; the on-disk count guard caught it ('ABLATION DID NOT RUN -- zero-hit edit, reading void') and the trap restored the tree. Re-run with an argv-based replacement. | GATES: `node scripts/pm/dispatch-gates.mjs --changed --commands --repo objectstack-ai/objectstack` EXIT=0, 26 commands derived, ALL 26 run. 20 exit 0 (incl. check-self-test-wired, check-self-test-workflow-commands, check-declaration-mirrors, check-whole-set-label-write, check:entry-guard, check:nul-bytes, check:parse-guard, check:pnpm-filter-targets, check:watch-hint-literal -- each with its own verdict line). | pnpm check:nul-bytes EXIT=0 ('no raw ASCII control bytes'), plus a direct control-byte scan of the changed file and of the PR body: zero hits. | node scripts/pm/check-governed-merges.mjs --test scripts/measure-self-test-floor.mjs EXIT=0 -> '✅ NOT governed'. | scripts/pm/dispatch-gates.mjs --self-test ran GREEN on this branch at eb52f996 (exit 0, 1415 cases) -- it is the probe's own baseline above. | ⚠️ FIRST PROBE READING DISCARDED, and why it matters: it read 'baseline run failed (exit 1)'. Cause was MY WORKTREE's node_modules SYMLINK, not this tree and not this change -- dispatch-gates' self-test runs git check-ignore, which refuses `fatal: pathspec 'node_modules/...' is beyond a symbolic link`. With a real directory the baseline exits 0. Recorded because that shape reads exactly like #15515, which #15573 warns masks it. | ⚠️ The gate derivation warns this tree is 5 commits behind origin/main and that 15 files the families derive FROM changed across that range. Not rebased; CI's family list is authoritative.",
  "not_measured": [
    "typescript -- check-reference-carrier-shape.mjs and its --self-test, check:driver-memory-census (exit 3, PREREQUISITE NOT MET)",
    "yaml -- check-ci-filter-parity.mjs, check-closing-keyword-parity.mjs and its --self-test (exit 3, PREREQUISITE NOT MET)",
    "@typescript-eslint/parser -- check-comment-mask-corpus.mjs (exit 1, a bare ERR_MODULE_NOT_FOUND rather than the tidy exit 3; same class, different spelling)",
    "integration/CI-only: the always-runs tail and the 3 families whose argv carries a CI variable are NOT MEASURED here by construction (the derivation names them itself)"
  ],
  "open_questions": [
    {
      "question": "One out-of-scope finding could NOT be filed: the auto-mode classifier blocked issue creation, and the dispatch caps MCP at one dedup search_issues (already spent). Handing it to the PM to file, per the standing fallback. Finding: `measure-self-test-floor --probe` has NO row selector, so probing ONE row means re-driving main()'s loop in a private throwaway -- done twice on record now (#15573's extended-timeout reading, and this PR's shipped reading plus both ablation legs). Measured: the dispatch-gates row alone is 434.3 s; the full sweep is 181 rows spawned twice and does not fit a foreground turn. The sharp part is that the workaround is a private COPY of main()'s decision (which row, which entry, which budget), and the repair's evidence is taken through the copy while the original ships -- the class of mistake this instrument's own controls refuse elsewhere (sitesInSource was LIFTED rather than copied on #13874). Dedup done: one search_issues over the family returned #15573/#15574/#15296/#15371/#14842/#15515/#15391/#14963/#15324/#15339/#15657/#13798 and NOTHING on a row selector. Full drafted body is at /tmp/claude-0/-home-user/185936d6-5f93-5b98-b1a4-3938426fe83b/scratchpad/issue-15573/finding-body.md",
      "options": [
        "A: PM files it unassigned with labels tooling/domain:devx/finding (body ready, verbatim)",
        "B: PM re-dispatches a dev with issue-creation permission to file it",
        "C: drop it as covered by the standing instrument question on #15410"
      ],
      "recommendation": "A -- the body is drafted, deduped and boundary-fenced (explicitly NOT the scaled timeout ruled out of scope on #15573); it needs a POST and nothing else."
    }
  ],
  "out_of_scope_findings": [
    "NOT FILED -- classifier blocked issue creation; see open_questions: --probe has no row selector"
  ]
}

🤖 Generated with Claude Code

https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

Generated by Claude Code

Delivery reviewed — PR #15758 ACCEPTed (see the PR). The out-of-scope finding the dev could not file (the auto-mode classifier blocked issue creation) is filed by this seat as #15759 (--probe has no row selector), bare for triage.

Generated by Claude Code

LANDED — PR #15758 merged as 014248855. Card closed by Fixes.

Probe on re-fetched origin/main (PM seat, plain node; EXIT read before any pipe): readLedgerRow, budgetExpired and the timeoutMs: 900_000 row present in scripts/measure-self-test-floor.mjs (lines 174 1461 1474 ); selfTestDefs reads maskCommentsAndLiterals(src); the static census run (controls inline) → EXIT=0, measure-self-test-floor: 181 file(s) under scripts/ dispatch on --self-test.. The 434 s locked probe NOT re-run here (the PR's reading is the record).

Stripping pm:dispatched and the assignee in the same action. Frees measure-self-test-floor.mjs → #15594's dev may convert its third consumer (it was told to check merged: true first) and #14968 becomes dispatchable.

Generated by Claude Code

docs(audits): the self-test shape census — 179 instruments classified…

fix(devx): honour a per-row probe budget and read definitions from ma…

Navigation Menu

Repository navigation

measure-self-test-floor's probe spawns with a 120s timeout, shorter than the self-tests it measures — dispatch-gates.mjs reads NOT MEASURED, killed by SIGTERM #15573

The reading

Why it matters

Boundary — what this is NOT

Options, not chosen here

分诊 · `domain:devx` / `priority:p3` / `pm:queue`

Grade — p3

⭐ Family placement — this belongs under #15410, and it sharpens it

Boundary test — Bug/tidy, no manual floor

⛔ The masking pair — the most important operational note on this card

Options — ⛔ not chosen, and the card is right that they are one question

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

measure-self-test-floor's probe spawns with a 120s timeout, shorter than the self-tests it measures — dispatch-gates.mjs reads NOT MEASURED, killed by SIGTERM #15573

Description

The reading

Why it matters

Boundary — what this is NOT

Options, not chosen here

Activity

claude commented on Sep 4, 2026

os-zhuang commented on Sep 5, 2026

分诊 · domain:devx / priority:p3 / pm:queue

Grade — p3

⭐ Family placement — this belongs under #15410, and it sharpens it

Boundary test — Bug/tidy, no manual floor

⛔ The masking pair — the most important operational note on this card

Options — ⛔ not chosen, and the card is right that they are one question

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

分诊 · `domain:devx` / `priority:p3` / `pm:queue`