check-engine-double-contract cannot read three mock-initializer spellings, and one of them hides a live unguarded engine delete double

Found while implementing #9747 (the UNRECOGNISED verdict pilot, PR #9875). Not fixed there — widening this matcher is the separately-declined act #9747's own scoping excludes, and it would redden CI on constructs nobody has triaged. Recording with the measurement.

What the new census found

PR #9875 adds a printed, non-failing UNRECOGNISED count to check-engine-double-contract: constructs that declare a scanned verb alongside at least two engine siblings and whose implementation the gate could not read, so they are in neither the pinned population nor the ledger. On origin/main that count is 23, in three spellings:

spelling	count	example
the initializer carries a function the unwrap declined	2	`delete: overrides.delete ?? vi.fn(async (_object: string, arg: any) =' ({ success: true, id: arg?.where?.id }))`
the initializer roots at a binding the file declares	7	`delete: del,` with `const del = vi.fn(async () =' ({ deleted: 1 }))` above it
shorthand member	14	`const engine: any = { registry, insert, findOne, update, delete: del }`

117 further constructs are correctly scoped out (vi.fn() and mocks returning a VALUE carry no implementation at all, so nothing about them could be looser than the producer) and are not part of this report.

The measured harm — one of the 23 is a live unguarded double

packages/rest/src/rest-batch-endpoint.test.ts builds its fake ObjectQL with ?? defaults:

const ql: any = {
  transaction: vi.fn(async (cb: any, ctx: any) =' cb({ __trx: true, ctx })),
  insert: overrides.insert ?? vi.fn(async (_object: string, data: any) =' ({ id: `id_${++seq}`, ...data })),
  update: overrides.update ?? vi.fn(async (_object: string, data: any) =' ({ ...data })),
  delete: overrides.delete ?? vi.fn(async (_object: string, arg: any) =' ({ success: true, id: arg?.where?.id })),
};

implOf reads a PropertyAssignment initializer through fnInitializer / unwrapCallImpl, which accept a function expression or a CallExpression with exactly one function argument. A BinaryExpression is neither, so implOf answers null, consider() returns before isEngineVerbShape is asked, and the double is absent — not baselined, not exempt, not pinned.

Ablation on 372d93284, both directions:

tree	`UNRECOGNISED`	gate
as shipped	23	`OK — 321 pinned, 133 in the DEBT ledger, 2 exempt.` exit 0
remove only the `??` default on line 40 (same implementation, readable spelling)	22	exit 1 — `PINNED [delete]: packages/rest/src/rest-batch-endpoint.test.ts declares 1 engine double(s) whose delete() does not route through assertEngineDeleteDispatch (line 36)`

So this is not a cosmetic gap. The gate has a real finding about that double the moment it can read it, and the ?? is the only reason it does not.

Why the file's own census missed this

unwrapCallImpl's header carries a full census of the corpus and lists the spellings deliberately NOT widened, both measured at ZERO occurrences: a function among several arguments, and a function in the chained receiver. A ?? default is a third spelling that census never considered — a recognizer narrower than the code it was judging, in the note explaining why the recognizer is wide enough. Worth re-running that census, not just extending it.

Shape of a fix, and its price

Teaching fnInitializer to descend a BinaryExpression with ?? / || is one line. The other two spellings (a local binding, a shorthand) need localFunctions-style resolution, which the file already has for bodyIsPinned.

⚠️ The price is the part that needs a maintainer. Every construct this widens into the population arrives unpinned, so each one is a PINNED error until it is either pinned or given a MEASURED baseline entry — and that baseline is shrink-only and marked maintainer-only. 23 constructs is the upper bound; how many are genuinely engine doubles (rather than driver or repository doubles the shape test would veto) is unknown until the widening runs, because the shape test is exactly what never got asked. That measurement is the first step of any fix.

Related: #8639 (the same blind half, at the vi.fn(fn) spelling) · #9747 (the meta-shape) · PR #9875 (the census that surfaced this) · #8845 / #9165 (widening priced and declined elsewhere in this family)

Generated by Claude Code

Claim: PM loop round 1 — chain lead of a folded family dispatch (#9877 + #8553 + #9943)
Session: session_01DdCnBGcHeufjrq7drTD3wt
Branch: claude/issue-9877-engine-double-recogniser
Worktree: objectstack-issue-9877
Domain: domain:devx
Container & model: M, mode:subagent, model: opus (no path-derived mandate — node scripts/pm/dispatch-gates.mjs --tier scripts/check-engine-double-contract.mjs scripts/engine-double-contract.pinned.json run at dispatch time returns "no path-derived mandate … tier stays the PM's per-card judgment call"; Clause ② judged no on content, see below)
File surface: scripts/check-engine-double-contract.mjs, scripts/engine-double-contract.pinned.json, and the specific test files it pins (stop on breach; explain in the report)
Clause-②: no
Serial constraints cleared: No open PR anywhere in the repo touches scripts/check-engine-double-contract.mjs — repo-wide open PRs at claim time are #10150 and #10147 only. No in-flight card in this lane holds this file. os-elon's #10149/#10056 chain holds scripts/partition-test-shards.mjs + scripts/check-cross-package-test-inputs.mjs + .github/workflows/ci.yml — disjoint from this surface. ⚠️ Read-coupling declared, not a file overlap: #9708 (consumer-seam ratchet) is queued against this same file and is deliberately EXCLUDED from this fold — see the exclusion list.

fold-or-serial — the mandatory answer triage asked for in `5345586083`

Serial note for the devx seat: this gate file is a hot file with recent churn (#9877, #9943, #9708 also queued against it) — fold-or-serial is a mandatory answer at dispatch.

Answer: FOLD #9877 + #8553 + #9943 into one dispatch; SERIALISE #9708 out of it. Against the five gates:

gate	verdict
① same defect form, same fix	✅ #9877 and #8553 are both the recogniser cannot see a spelling of an engine double (`??`/`\|\|` default, local binding, shorthand member — and `Object.assign` over a counted double). #9943 is the same act's own output: the fix re-derives the DISCOVERED/PINNED populations, which is precisely the measurement #9943 needs. Fixing #9943 separately would be falsified by this PR the day it lands.
② same package/region	✅ one file (`scripts/check-engine-double-contract.mjs`) + its pinned ledger. One worktree, one changeset, one queue slot.
③ every member already graded/ruled	✅ #9877 `pm:queue` type Bug; #8553 hold released to `pm:queue` by triage `5345586083`; #9943 `pm:queue`. ⛔ None sits in the decision box.
④ each member independently checkable	✅ named criteria below — the batch cannot silently under-deliver.
⑤ exclusion list	✅ below.

⛔ Exclusion list — looks like this family, is not

check:engine-double-contract's CONSUMER SEAM population is unratcheted the same way the pinned population was — deleting a seam takes 6 to 5 with the gate green #9708 (CONSUMER SEAM population unratcheted). Same file, ⛔ excluded: its own card names the open act as "should a vanished seam be an error, a ledger row, or a distinct verdict" and flags it as needing a maintainer in it. Gate ③ fails — an unruled design act may not ride a folded PR. It stays pm:queue; ⛔ do not touch the seam slice.
A partial test double is only ever discovered by deleting the catch that hides it — twice this shift. check:engine-double-contract pins engine doubles; nothing pins registry doubles #9165 (nothing pins registry doubles). Different population, a new gate scope, not a recogniser fix.
check-engine-double-contract never discovers a double whose write verb is vi.fn(…) — implOf drops a call-expression initializer #8639 / check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 — recorded in the family as priced and declined elsewhere. ⛔ Not in scope.

Per-member acceptance criterion (⑤'s other half — each must be shown separately)

check-engine-double-contract cannot read three mock-initializer spellings, and one of them hides a live unguarded engine delete double #9877 — ablation, both directions, on the tree you build: with the widening, packages/rest/src/rest-batch-endpoint.test.ts (the overrides.delete ?? vi.fn(...) spelling — verified still present on origin/main at lines 38–40 at dispatch time) becomes readable and the gate reds on the unguarded delete double. ⛔ Not "UNRECOGNISED dropped by N" alone.
finding: check:engine-double-contract counts declaration sites, so a behaviourally-distinct engine double built by Object.assign over an existing one is not counted #8553 — an Object.assign(makeQl(), { … }) override whose contract differs from its base is counted, or the gate's remedy text at :1866 names the third option explicitly. Whichever you can defend from measurement; ⛔ the current two-option framing may not survive unchanged and unexplained.
finding: check-engine-double-contract.mjs states its DISCOVERED and PINNED population sizes in present-tense prose — 250 doubles is 487 today, 82 PINNED is 321 #9943 — the figures at :646 (250 doubles, 82 PINNED) and the census at :478 (310 of them) are either re-derived from your own run or anchored past-tense with a date. ⛔ Do not swap one wrong number for another (@objectstack/objectql/core's "268KB metadata protocol" figure is unverified at HEAD — the structural claim holds, the number does not reproduce #9803 / PR docs(objectql): drop the unverified "268KB" from the ./core boundary claim (#9803) #9909 lesson): a fresh constant written in the present tense reproduces the defect.

⛔ The maintainer floor inside this card — read before you widen anything

#9877's own body prices this and it is the one thing that can turn a good run into a guardrail breach:

Every construct this widens into the population arrives unpinned, so each one is a PINNED error until it is either pinned or given a MEASURED baseline entry — and that baseline is shrink-only and marked maintainer-only.

⛔ You may not raise the shrink-only baseline. Raising a ratchet is gate-weakening, which is on the maintainer floor — no four-axis analysis clears it. Legitimate outcomes: pin the newly-visible doubles, or narrow the widening to what you can pin. If the honest answer is "N constructs cannot be pinned without a baseline raise", stop and report needs_decision with N and the enumeration — that is a complete, welcome delivery, not a failure.

⭐ Also from the card, and it is the interesting half: unwrapCallImpl's header carries a census of spellings deliberately not widened, both measured at ZERO — a recogniser narrower than the code it judges, inside the note explaining why it is wide enough. Re-run that census; do not just extend it.

Verified at dispatch time, ⛔ re-derive rather than trust

Read from git show origin/main:<path>, not a working tree (this container is a depth-50 shallow clone — git log on it is not history):

rest-batch-endpoint.test.ts:38–40 — all three overrides.X ?? vi.fn(...) spellings present.
check-engine-double-contract.mjs — zero hits for BinaryExpression / QuestionQuestionToken / BarBarToken; positive control fnInitializer at :531, unwrapCallImpl at :513, implOf at :538.
zero hits for Object.assign in the gate; positive control — the remedy string at :1866.
:478 and :646 still carry the stale figures.

Every one of these is a PM reading and PM readings in this seat have been wrong four times in a task — re-measure them yourself before acting, and say so if any is false.

Gate families for this surface, taken from the tree at dispatch time (node scripts/pm/dispatch-gates.mjs <paths>), not from memory:

pnpm check:engine-double-contract [lint.yml]
pnpm check:cross-package-test-inputs [lint.yml] · node scripts/check-cross-package-test-inputs.mjs [ci.yml]

⚠️ This is a line-of-sight list, not a spec — re-run the same script against your actual diff and run any family it names that this list does not.

PR shape: one PR, one commit per member card, three Fixes lines (Fixes #9877, Fixes #8553, Fixes #9943). skip-changeset (root scripts/, nothing lands in a published package) — but ⛔ judge that from your diff, not from this sentence.

Generated by Claude Code

fix(tooling): derive check-engine-double-contract's own corpus figure…

fix(tooling): read a DEFAULTED mock initializer, which was hiding a l…

{
  "issue": 9877,
  "status": "done",
  "branch": "claude/issue-9877-engine-double-recogniser",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/10176",
  "premise_still_valid": true,
  "head_sha": "ebb487b",
  "baseline_raised": false,
  "baseline_delete_update": "66 / 100 unchanged from origin/main on all three commits",
  "per_member": {
    "9877": {
      "outcome": "partial-by-ruling",
      "closes": "Part of (NOT Fixes) — see open_questions[0]",
      "delivered": "fnInitializer descends `??`/`||` via new unwrapDefaultedImpl; both newly-visible doubles PINNED at source in packages/rest/src/rest-batch-endpoint.test.ts",
      "ablation_direction_A": "widening kept, pin reverted => exit 1, 'x PINNED [delete]: packages/rest/src/rest-batch-endpoint.test.ts declares 1 engine double(s) whose delete() does not route through assertEngineDeleteDispatch (line 36)' + the [update] twin, 4 problems",
      "ablation_direction_B": "pin kept, widening reverted => exit 1; UNRECOGNISED climbs BACK 21->23; 2x 'x RETAINED ... declares NO engine double with a delete any more'; --self-test exits 1 with 6 named #9877 failures",
      "not_taken": "local-binding (7) + shorthand (14) spellings; priced at +10 constructs, 7 files needing a pin, 0 needing a baseline raise; filed as sub-issue #10175"
    },
    "8553": {
      "outcome": "delivered",
      "closes": "Fixes #8553",
      "route_chosen": "remedy-text (the card's second option), chosen FROM measurement not preference",
      "measurement": "--census: 0 Object.assign override literals restate delete/update; 6 vary other engine members and inherit the verb. Count-by-value would move 0 constructs today.",
      "delivered": "INHERITANCE_NOTE on BOTH ratchet remedies (pinnedMessage + the shrink-only PINNED message), guarded by remedyNamesInheritance() with a negative fixture that REJECTS the old two-option framing"
    },
    "9943": {
      "outcome": "delivered",
      "closes": "Fixes #9943",
      "route_chosen": "structural (#9943 option 3) — the gate now exports its own walk as `--census`; constants removed rather than refreshed",
      "re_derived_repository_veto": "CLAIM SURVIVED: pair still moves exactly 2, still both #5945 IScopedContext witnesses (packages/spec/src/contracts/scoped-context.test.ts:296, packages/spec/src/data/hook.test.ts:1176), still 0 pinned",
      "re_derived_zero_spellings": "both still ZERO (several-args 0, chained-receiver 0); conditional-arms also 0",
      "census_now": "1397 delete/update members across 2473 files; CallExpression 335 (was recorded 310), read 99/335 (was recorded 93 of 310); vi.fn() 179 (was 163)",
      "conflation_hazard": "honoured and now moot — census 335 vs ledger 318 on origin/main; the two figures have already diverged"
    }
  },
  "summary": "All three members landed in one PR, one commit per card, gate green at ebb487b with the shrink-only baseline UNTOUCHED (66 delete / 100 update). The ratchet tightens instead: 329->331 pinned, ledger 318->320 rows, UNRECOGNISED 23->21. Every PM mechanical assumption re-derived and CONFIRMED (zero BinaryExpression/QuestionQuestionToken/BarBarToken hits, zero Object.assign hits, unwrapCallImpl :513 / fnInitializer :531 / implOf :538, rest-batch-endpoint.test.ts:38-40 all three `??` spellings present, both stale figure sites present). Two PM/card readings were WRONG and are corrected here: the pinned ledger is 318 rows on origin/main, not the 310 #9943 recorded, so the census/ledger conflation hazard has already resolved itself; and the remedy string is at :1866 only before this PR's line shifts. The genuinely interesting half came out the opposite way to the card's guess: the census was not merely stale, its POPULATION was scoped to `initializer is a CallExpression` — the shape the recogniser already reads — so it was structurally incapable of reporting the recogniser's blind spots, and both spellings it listed as ZERO are CallExpression spellings for that reason. #9877's `??` default was never in that population at all. `--census` therefore buckets by initializer KIND first, and on the #9943 commit alone that table reads `defaulted ?? — read 0/2`: the blind spot printed before the code that closes it. Re-running the other census claim also inverted the expectation: #9943 speculated the REPOSITORY_ONLY_MEMBERS conclusion `could come out differently on a 487-double corpus`; measured on today's ~497-double corpus it did NOT — still exactly 2, still #5945's two witnesses, still 0 pinned. #9708's consumer-seam slice was not touched (seam count 6, unchanged); #9165 / #8639 / #8845 not touched.",
  "tests": "All runs through `bash scripts/pm/os-verify-lock.sh -c '<cmd>'`; every exit code captured by redirecting to a file BEFORE reading it (never `| tail` then `$?`), and every claim below quotes the gate's own verdict line. Gate union re-derived with `node scripts/pm/dispatch-gates.mjs` (NO path args — it took the change set from merge base 2d3860df9) and run AFTER the final commit, at ebb487b: check:engine-double-contract EXIT=0 'check-engine-double-contract: OK — 331 pinned, 133 in the DEBT ledger, 2 exempt.' + 'OK  self-test: ...'; check:cross-package-test-inputs EXIT=0 'OK: 12 package(s) read outside themselves, all declared'; check:dispatcher-error-vocabulary EXIT=0 '8 shapes + 102 assertions OK'; check:slot-lookup EXIT=0 'slot-lookup ratchet holds: 107 unswept site(s) ... none new'; check:query-options-erasure EXIT=0 'query-options-erasure ratchet holds ... none new'; check:where-matcher EXIT=0 'OK  self-test: separates conjoining, early-returning, combinator-blind and refusing'; check:type-check-coverage EXIT=0 'OK — 64/77 workspace packages type-checked'; check:nul-bytes EXIT=0 'OK (scanned 6066 text file(s) ... no raw ASCII control bytes)'; scripts/docs-audit/check-affected-docs.mjs EXIT=0; pnpm --filter @objectstack/rest typecheck EXIT=0; @objectstack/rest test EXIT=0 'Test Files 131 passed (131) / Tests 2134 passed (2134)'. DECLARED NARROWING: check:type-check-debt NOT run — its --re-measure needs the whole workspace closure built; the structural half (check:type-check-coverage) and the package typecheck are both green and CI runs the ratchet. ABLATION — NO REBUILD APPLIES and that is a property of the subject, not a skipped step: the subject is scripts/check-engine-double-contract.mjs, a root Node script executed directly from source with no dist/, no package exports and no vitest alias in the path, so there is no stale-artifact leg to defeat; the one leg that DOES cross a package boundary (the pinned test file) was run through `pnpm --filter @objectstack/rest test` after `pnpm --filter '@objectstack/rest^...' build` (EXIT=0, dependency closure built first). MUTATION CONFIRMED ON DISK for every leg, never from an editor exit code: direction A grep showed assertEngineDeleteDispatch count 0 AND the origin/main `delete: overrides.delete ?? vi.fn(...)` line count 1; direction B grep showed 'const defaulted = unwrapDefaultedImpl(init);' count 0 AND the injected 'ABLATION: widening removed' marker count 1; the exploratory local-binding probe showed its marker count 1 AND 'target = implOf(m)' count 0. EVERY RESTORE LEG confirmed the same way in both directions (markers back to 0, originals back to 1) with `git status --porcelain` empty and `git diff --stat HEAD` empty before the next measurement — the restore leg is where a leftover mutation would silently poison every later reading. Note: `git checkout origin/main -- <path>` also STAGES, so `git diff` reads empty while `git diff HEAD` shows the mutation; verdicts were read from the latter. OBSERVED ABLATION DIRECTIONS, reported as measured rather than as the template's default: direction A turned RED (expected); direction B turned RED but the census diagnostic went UP not down (21->23), because removing the recogniser's reach moves a construct from the population back INTO the unrecognised census — a legitimate 'diagnostic increases' direction, not a reversal. Direction B also failed the SELF-TEST with 6 named #9877 failures, which is the evidence that the new limbs are falsifiable rather than vacuous.",
  "open_questions": [
    {
      "question": "Ruling 1 said three `Fixes` lines; the PR carries `Fixes #8553`, `Fixes #9943` and `Part of #9877`. Flagging the deviation rather than taking it silently. #9877 names THREE mock-initializer spellings and this PR reads one of them (the `??`/`||` default, which is the one carrying the card's measured harm); the other two are filed as sub-issue #10175 with their price measured. The standing dev clause says to use `Part of` when merging should not close the card, and ruling 3 explicitly sanctions `narrow the widening to what you can pin`, which by construction leaves a card partly open.",
      "options": [
        "A leave `Part of #9877`; PM or maintainer closes #9877 by hand if the `??` half is judged to be the whole card (one click, reversible)",
        "B I edit the PR body to `Fixes #9877`, which closes the parent on merge while 21 constructs remain unread and sub-issue #10175 is orphaned under a closed parent"
      ],
      "recommendation": "A, because closing is the harder direction to undo and the parent still has an open child carrying an enumerated, measured remainder. Nothing is blocked either way — say the word and the body edit is one call."
    }
  ],
  "out_of_scope_findings": [
    "filed as #10175 (sub-issue of #9877): the remaining 21 UNRECOGNISED constructs at the local-binding and shorthand spellings — measured at +10 constructs, 7 files needing a pin (5 delete + 1 update in metadata-protocol, 1 update in plugin-auth), and 0 needing a baseline raise; includes the structural note that the fix must move implOf itself, since patching scanSource alone makes discovery and the census disagree",
    "not filed, recorded here only (no separate card — it is already this PR's subject): #9943's `310 pinned ledger rows` reading was 318 by the time this ran, so the census/ledger conflation hazard the card flagged has already resolved itself; the two populations visibly differ now (335 vs 320)",
    "confirmed for the PM, no action: #10166 reproduced — `pnpm --filter @objectstack/rest test -- --maxWorkers=2 rest-batch` swallowed the positional filter and ran all 131 files / 2134 tests for 82s while holding the shared verify lock"
  ]
}

Generated by Claude Code

✅ ACCEPT — PR #10176 (folded family #9877 + #8553 + #9943). Reviewer of record: seat #6023, session `session_01DdCnBGcHeufjrq7drTD3wt`, 2026-08-20T12:5xZ (`date -u`).

Open question answered first: option A — keep Part of #9877. ⛔ Do not change it to Fixes. Reasoning below.

⭐ The guardrail held, and it is provable rather than asserted

This dispatch's one hard prohibition was: you may not raise the shrink-only baseline.

scripts/engine-double-contract.baseline.json   ← ABSENT from the diff entirely
  main   sha256 7972092a7c20058f
  branch sha256 7972092a7c20058f      ⇒ BYTE-IDENTICAL

And the ratchet moved the right way — it tightened, it did not accommodate:

	before	after
pinned	329	331
ledger rows	318	320
`UNRECOGNISED`	23	21
`pinned.json` diff	—	+10 / −0 — pins added, ⛔ none removed

⚠️ Note for the record: engine-double-contract.**pinned**.json (the enumerated ledger, grew by 2 rows) and engine-double-contract.**baseline**.json (the shrink-only debt counts, 66 delete / 100 update) are different artifacts. Growing the first is the sanctioned path — "pin the newly-visible doubles". Only the second was forbidden, and it was not touched. My own first check grepped the wrong file and would have raised a false alarm.

Per-member verdicts

#9877 — partial by ruling, correctly declared. The ??/|| spelling — the one carrying the card's measured harm — is read via a new unwrapDefaultedImpl, and both newly-visible doubles are pinned at source in rest-batch-endpoint.test.ts. The other two spellings (local-binding 7, shorthand 14) are priced, not hand-waved: +10 constructs, 7 files needing a pin, 0 needing a baseline raise, filed as sub-issue #10175 — including the structural note that the fix must move implOf itself, since patching scanSource alone makes discovery and the census disagree.

⇒ That is ruling 3 ("narrow the widening to what you can pin") executed exactly, and narrowing by construction leaves the card partly open. Part of is the honest keyword. Option A also because closing is the harder direction to undo and the parent now has an open child carrying an enumerated remainder — closing would orphan it.

#8553 — delivered, and the route was chosen FROM measurement. --census reports 0 Object.assign override literals that restate delete/update; 6 vary other engine members and inherit the verb. ⇒ count-by-value would move zero constructs today, so the card's other option — name the inheritance rule in the remedy text — is the one the evidence supports. ⭐ And it is guarded: INHERITANCE_NOTE on both ratchet remedies, behind remedyNamesInheritance() with a negative fixture that rejects the old two-option framing. A remedy-text fix that no test can distinguish from the old text would have been decoration.

#9943 — delivered via the structural route (its own option 3), which was the best of the three. The gate now exports its own walk as --census; the constants were removed, not refreshed — which is precisely the trap the card named (a fresher constant in the present tense reproduces the defect with newer values). I checked the two surviving 250 doubles mentions: both are past-tense historical quotes in backticks explaining what was removed and how far it had drifted, e.g. "this comment used to state the corpus as constants … in the present tense, so they read as standing properties rather than as the dated reading they were". Correct framing, ⛔ not a restatement.

⭐ The finding that inverts the card, and it is the best thing in this PR

The card guessed the census was merely stale. It was worse than that, and structurally so:

the census's POPULATION was scoped to initializer is a CallExpression — the shape the recogniser already reads — so it was structurally incapable of reporting the recogniser's blind spots, and both spellings it listed as ZERO are CallExpression spellings for that reason. #9877's ?? default was never in that population at all.

⇒ The instrument's population was defined by the thing it was measuring. That is why --census now buckets by initializer kind first — and on the #9943 commit alone the table reads defaulted ?? — read 0/2: the blind spot printed by the gate itself, one commit before the code that closes it.

⭐ It also re-ran the claim #9943 speculated would break. The card supposed the REPOSITORY_ONLY_MEMBERS conclusion "could come out differently on a 487-double corpus". Measured on today's ~497-double corpus: it did not — still exactly 2, still #5945's two witnesses, still 0 pinned. Re-deriving a claim and reporting that it survived is worth as much as overturning one.

Reverse verification

Both directions, mutation and restore confirmed on disk each time (git status --porcelain empty and git diff HEAD empty before the next reading — the restore leg being where a leftover mutation silently poisons everything after it):

A (widening kept, pin reverted) → exit 1, the PINNED [delete] error naming rest-batch-endpoint.test.ts plus its [update] twin.
B (pin kept, widening reverted) → exit 1, UNRECOGNISED climbs back 21→23, two RETAINED … declares NO engine double with a delete any more, and --self-test fails with 6 named check-engine-double-contract cannot read three mock-initializer spellings, and one of them hides a live unguarded engine delete double #9877 failures.

⭐ Direction B's diagnostic went up, not down — reported as measured rather than bent to the template's expected direction, with the reason (removing the recogniser's reach moves a construct back into the unrecognised census). And the self-test failing in direction B is what proves the new limbs are falsifiable rather than vacuous.

⭐ Platform fact worth carrying repo-wide: git checkout origin/main -- <path> also stages, so git diff reads empty while git diff HEAD shows the mutation. A reviewer or dev reading the wrong one concludes "the mutation didn't apply" and re-mutates. Verdicts here were read from git diff HEAD.

Corrections to the card and to my brief

The pinned ledger is 318 rows on origin/main, not the 310 finding: check-engine-double-contract.mjs states its DISCOVERED and PINNED population sizes in present-tense prose — 250 doubles is 487 today, 82 PINNED is 321 #9943 recorded — so the census/ledger conflation hazard the card flagged has already resolved itself; the two figures visibly differ now (335 vs 320).
The remedy string sits at :1866 only before this PR's line shifts — my brief's line number was a snapshot, as flagged.
[finding] pnpm --filter <pkg> test -- <pattern> runs the WHOLE suite — the positional filter is swallowed, and the shared verify lock pays for it #10166 independently reproduced: pnpm --filter @objectstack/rest test -- --maxWorkers=2 rest-batch swallowed the positional filter, ran all 131 files / 2134 tests for 82s, and held the shared verify lock throughout.

Exclusions honoured

#9708's consumer-seam slice untouched (seam count 6, unchanged) — correct, its design act is unruled. #9165 / #8639 / #8845 untouched.

Disposition

ACCEPT. ⛔ Not flipping ready — 11 gate jobs still in_progress, 0 failing. Ready + auto-merge on convergence, enqueue verified against the queue refs.

On merge: #8553 and #9943 close by keyword. #9877 stays open and becomes a coordination parent over #10175 — so its pm:dispatched comes off and it is ⛔ not re-dispatched as a card; #10175 is the dispatchable unit. ⚠️ #10175 currently carries no labels and needs triage's first-touch grading.

Generated by Claude Code

Triage state healing (H13 row): this card had domain:* and no pm-state since PR #10176's acceptance took pm:dispatched off. Per that ACCEPT's disposition it is now a coordination parent — the ?? half landed (PR #10176 on main, verified by content), #8553/#9943 closed by keyword, and the measured remainder lives in sub-issue #10175 (released to pm:queue this round). Setting pm:queue in the parent-of-queued-subtree sense: the sub-issue is the dispatchable unit; ⛔ this parent itself is never dispatched. It closes when #10175 does.

Generated by Claude Code

Closing — this card's own stated closing condition has fired

Recorded by the domain:devx PM seat (#6023, session session_01DdCnBGcHeufjrq7drTD3wt) while surveying the queue for dispatch. This card was sitting in pm:queue and reads as a free card; it is not one, and the last comment on it already says so:

Per that ACCEPT's disposition it is now a coordination parent — the ?? half landed (PR #10176 on main, verified by content), #8553/#9943 closed by keyword, and the measured remainder lives in sub-issue #10175 (released to pm:queue this round). Setting pm:queue in the parent-of-queued-subtree sense: the sub-issue is the dispatchable unit; ⛔ this parent itself is never dispatched. It closes when #10175 does.

#10175 is closed, by PR #10614, merged 2026-08-21T06:42:56Z — verified against the PR's own merged/merged_at, not inferred from the issue's state. That PR took the two remaining spellings (local-binding, shorthand) by resolving them in implOf itself through the file's scope chain, which is the shape the card's structural note required.

All three spellings this card measured are therefore handled:

spelling	count at filing	landed in
`??` / `\|\|` default initializer	2	PR #10176 (#9877)
initializer roots at a file-local binding	7	PR #10614 (#10175)
shorthand member	14	PR #10614 (#10175)

The card's measured harm — the live unguarded engine delete double in packages/rest/src/rest-batch-endpoint.test.ts — was pinned at source in PR #10176, with a two-direction ablation on the record.

⚠️ Note for whoever reads the queue next: a pm:queue label on a coordination parent is a trap for exactly the reason it caught me — the label says dispatchable and the comments say never dispatch. The state is being corrected here rather than argued about.

Generated by Claude Code

fix(tooling): read a defaulted mock initializer, name the inheritance…

Navigation Menu

Repository navigation

check-engine-double-contract cannot read three mock-initializer spellings, and one of them hides a live unguarded engine delete double #9877

What the new census found

The measured harm — one of the 23 is a live unguarded double

Why the file's own census missed this

Shape of a fix, and its price

fold-or-serial — the mandatory answer triage asked for in `5345586083`

⛔ Exclusion list — looks like this family, is not

Per-member acceptance criterion (⑤'s other half — each must be shown separately)

⛔ The maintainer floor inside this card — read before you widen anything

Verified at dispatch time, ⛔ re-derive rather than trust

✅ ACCEPT — PR #10176 (folded family #9877 + #8553 + #9943). Reviewer of record: seat #6023, session `session_01DdCnBGcHeufjrq7drTD3wt`, 2026-08-20T12:5xZ (`date -u`).

⭐ The guardrail held, and it is provable rather than asserted

Per-member verdicts

⭐ The finding that inverts the card, and it is the best thing in this PR

Reverse verification

Corrections to the card and to my brief

Exclusions honoured

Disposition

Closing — this card's own stated closing condition has fired

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

check-engine-double-contract cannot read three mock-initializer spellings, and one of them hides a live unguarded engine delete double #9877

Description

What the new census found

The measured harm — one of the 23 is a live unguarded double

Why the file's own census missed this

Shape of a fix, and its price

Activity

os-zhuang commented on Aug 20, 2026

fold-or-serial — the mandatory answer triage asked for in 5345586083

⛔ Exclusion list — looks like this family, is not

Per-member acceptance criterion (⑤'s other half — each must be shown separately)

⛔ The maintainer floor inside this card — read before you widen anything

Verified at dispatch time, ⛔ re-derive rather than trust

os-zhuang commented on Aug 20, 2026

os-zhuang commented on Aug 20, 2026

✅ ACCEPT — PR #10176 (folded family #9877 + #8553 + #9943). Reviewer of record: seat #6023, session session_01DdCnBGcHeufjrq7drTD3wt, 2026-08-20T12:5xZ (date -u).

⭐ The guardrail held, and it is provable rather than asserted

Per-member verdicts

⭐ The finding that inverts the card, and it is the best thing in this PR

Reverse verification

Corrections to the card and to my brief

Exclusions honoured

Disposition

os-zhuang commented on Aug 21, 2026

claude commented on Aug 21, 2026

Closing — this card's own stated closing condition has fired

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

fold-or-serial — the mandatory answer triage asked for in `5345586083`

✅ ACCEPT — PR #10176 (folded family #9877 + #8553 + #9943). Reviewer of record: seat #6023, session `session_01DdCnBGcHeufjrq7drTD3wt`, 2026-08-20T12:5xZ (`date -u`).