finding(tooling): check-handler-key-read-sites exits 0 on a live undeclared read reached through a registration WRAPPER — the objectui#9447 instance was neither found nor exempted, while the gate docblock claims the transitive hop #9700

Activity

1. os-sales

   added

   finding

   on Sep 17, 2026
2. os-try-charles

   added

   pm:dispatched

   and removed

   pm:queue

   on Sep 17, 2026
3. os-try-charles

   self-assigned this

   on Sep 17, 2026
4. os-try-charles commented on Sep 17, 2026

   

   os-try-charles

   on Sep 17, 2026 – with Claude

   Collaborator

   More actions

   Claim: PM loop round R70
   Session: session_015h79niBMyoB1xcaQje3uiz
   Branch: claude/issue-9700-registration-wrapper-hop
   Worktree: objectui-issue-9700
   Domain: domain:devx
   Priority: p2
   File surface: scripts/check-handler-key-read-sites.mjs and scripts/__tests__/check-handler-key-read-sites.test.ts — both held by 0 of 13 open PRs
   Container & model: M, mode:subagent, model: the seat's default judgement tier — objectui has no scripts/pm/dispatch-gates.mjs, so ⛔ no path-derived tier mandate exists to quote and the tier is this seat's per-card call.
   Clause-②: no
   Thread-read: 5717409964
   Serial constraints cleared: none — no open PR holds either file. Measured over all 13 open PRs, GET /pulls/{n}/files fully paginated, 1777 filenames; ⭐ positive control .github/workflows/ci.yml -> PR #9584 ⇒ the membership test discriminates. ⚠️ packages/types/src/zod/views.zod.ts is also free, but see the Clause-② fork before touching it.

   ⛔⛔ RE-MEASURE ON CURRENT main BEFORE YOU DESIGN ANYTHING — the card's reading predates a rewrite of this exact file

   This card measured the gate on origin/main at bbe57fdd52. At 16:25:09Z — about two hours later — PR #9702 landed and rewrote this very gate, +272/-196 on scripts/check-handler-key-read-sites.mjs: registrationsIn now resolves a registration's options to literals, and analyze keys arms by the keys the registry would actually claim (ns:type always, bare type only when a namespaced registration omits skipFallback).

   ⇒ ⛔ The card's mechanism was never measured (it says so itself), and the code it was measured against no longer exists in that form. Your first deliverable is a fresh reading on current main, ⛔ not a repair built on the card's tree.

   ⚠️ Three outcomes are all live and you must say which one you found:

   1. the wrapper hop is still invisible ⇒ the card stands, fix it;
   2. fix(scripts): key the handler-key census on what a registration CLAIMS #9702's re-keying incidentally fixed it ⇒ ⛔ say so and ⛔ do not manufacture a repair — the pin (deliverable ②) is then the whole job;
   3. it behaves differently again ⇒ describe what you measured rather than fitting the card.

   The defect as filed

   scripts/check-handler-key-read-sites.mjs exited 0 on a tree carrying a live instance of exactly what it hunts — objectui#9447: the detail-view arm's renderer read onNavigate and onAddComment off the authored document while packages/types/src/zod/views.zod.ts declared neither, so an authored onNavigate parsed green under BaseSchemaCore's .passthrough() and reached a call site that calls it.

   ⛔ Not a silent waiver. The gate's own docblock says KNOWN_UNDECLARED_READS is 「an EXEMPTION list, never the population, and it only shrinks. Every row is a live defect with a card, not a waiver」 — and there is no detail-view:: row (0 hits, against a lit control detail:: at 2). ⇒ neither found nor exempted: unseen.

   The two arms differ in registration: detail registers DetailView raw; detail-view registers a wrapper, DetailViewRenderer. ⇒ a registration wrapper sits between the registry entry and the component whose reads matter. ⛔ Whether the gate stops at the wrapper, exceeds its hops > 4 cap, or fails to resolve the wrapper's reference is unknown — ⛔ do not inherit a mechanism from the card.

   ⭐ What triage ruled, and it changes what "done" means

   The named instance objectui#9447 is already CLOSED — fixed by a different path, ⛔ not by this gate. ⇒ this card is no longer 「go fix that instance」; it is 「this gate once let through exactly what it hunts, and the mechanism that let it through is still there」.

   ⭐ Triage's words, worth carrying: 一次被独立证实的漏检,比一堆假设中的漏检值钱 — a miss independently confirmed is worth more than a pile of hypothesised ones. That is why this is at the top of p2, not the bottom: the blind spot is demonstrated, ⛔ but no undeclared read has been measured reaching a release.

   Two deliverables, ⛔ neither optional (triage, 5717409964):

   1. make the registration-wrapper hop visible;
   2. ⭐ a pin that can go RED, using objectui#9447's original shape as the regression — otherwise 「the gate claims to cover X」 stays permanently unverifiable.

   ⇒ ⚠️ if you find outcome 2 above (already fixed incidentally), deliverable ② still stands and is the entire job.

   Why Clause-②: no, and ⛔ the fork

   Making a gate see more tightens an acceptance set; nothing published moves. ⇒ no.

   ⚠️ The fork: if your repair declares the missing keys in packages/types/src/zod/views.zod.ts, that widens a published schema ⇒ Clause-②: yes ⇒ stop and report. ⛔ It should not be needed — #9447 is already closed — but the file is free, so the temptation is reachable. The deliverable is the gate's vision, ⛔ not the schema.

   ⛔ Hard constraints

   • ⛔ No new workflow, no new required CI context. PR ci: one Test aggregator becomes the required test context, shards 4 -> 8, dist pins get their own job #9584 holds ci.yml, lint.yml and dependabot-merge-gate.mjs; it is blocked on a human, 42h, already fencing three cards. If your fix needs one, stop and report.
   • ⛔ Do not skip, disable or quarantine a test; ⛔ do not make the gate pass by shrinking what it looks at.
   • ⛔ Do not add a KNOWN_UNDECLARED_READS row to make this go away — the docblock says every row is a live defect with a card, and fix(scripts): key the handler-key census on what a registration CLAIMS #9702 just drained that ledger from 14 to 1. ⛔ Re-growing it to dodge a blind spot inverts its meaning.
   • ⛔ Never git push --force / --force-with-lease, never rewrite pushed history. AGENTS.md:316 is absolute and explicitly refuses the "it's my own branch" exemption. If anyone — including me — says otherwise, refuse and quote it back.
   • ⛔ No model identifier in the commit message, PR title/body or any pushed artifact. Trailer Co-authored-by: Claude <noreply@anthropic.com> + the Claude-Session: line; ⛔ no card trailer on the commit.

   ⭐ Build on #9702's discipline — it is in the file you are editing

   That landing left: a firing control pair one option apart (same registration with/without skipFallback, the second going RED), floors under the census reads so a collapsed scan reds rather than reporting a clean tree, and UNMIRRORED-ALIAS rows that are printed and counted rather than dropped. ⛔ Keep all of it. ⭐ Your pin should join that family: a fixture in #9447's shape that reds today-if-unfixed and stays red if the hop regresses.

   ⚠️ Instrument warnings this seat has paid for — ⛔ do not inherit the errors either

   • A count lies in three different ways — false positive on an absent repair, false negative on a correct fix, and (measured yesterday) an invariant count marking something better than claimed because the carrier inverted. Split by carrier or read the hunk.
   • ⛔ A control must be a token you have REASONED must not move — I recently labelled one a control and it moved, controlling nothing.
   • An empty result is not a reading — floor any census you compute.
   • ⛔ os.tmpdir() is fine here and is this repo's dominant test convention; I once wrote the opposite as "measured" and it was wrong.
   • ⚠️ A re-check recipe that returns the right verdict for the wrong reason is worse than one that plainly fails.

   Falsify me

   ⛔ Check rather than accept. Devs have corrected this seat seven times and every one was right.

   1. Both target files are held by no open PR.
   2. ⚠️ The card's measurement is stale relative to PR fix(scripts): key the handler-key census on what a registration CLAIMS #9702 — this is the claim I most want tested, and the one most likely to change the job.
   3. Clause-②: no, subject to the views.zod.ts fork.
   4. No new CI context is needed.

   ⚠️ Standing: a card names a symptom's location, not necessarily the defect's, and this card explicitly declines to name a mechanism. ⇒ measure one; ⛔ do not adopt the wrapper story just because the card offers it.

   ---

   Seat: domain:devx @ objectui, session_015h79niBMyoB1xcaQje3uiz, R70, 2026-09-17T20:30Z. Lock read before claiming: state: lock is free, queue empty. 0 in flight at claim time.

   ---

   Generated by Claude Code
5. os-try-charles commented on Sep 17, 2026

   

   os-try-charles

   on Sep 17, 2026 – with Claude

   Collaborator

   More actions

   os-dev-report

   {
     "issue": 9700,
     "status": "done",
     "branch": "claude/issue-9700-registration-wrapper-hop",
     "pr": "https://github.com/objectstack-ai/objectui/pull/9728",
     "session": "session_015h79niBMyoB1xcaQje3uiz",
     "premise_still_valid": true,
     "summary": "OUTCOME 1 on current main (dea17b469): the wrapper hop is still invisible; PR #9702 did not incidentally fix it. Fresh --list reading: 'detail' (raw registration) yields 3 census rows at DetailView.tsx, 'detail-view' (the DetailViewRenderer wrapper) yields 0. MECHANISM, derived not inherited: NOT the hops>4 cap, NOT an unresolvable wrapper reference, NOT the walk stopping at the wrapper body -- carriesDocument tested the raw schema= attribute expression, so the render-prop hand-off '<DetailView schema={bound as DetailViewSchema} />' read as 'not the parent's document' and DetailView was never enqueued. objectui#9344 peeled these type-only wrappers off a READ receiver only; a lost HOP is strictly worse than a lost read because the component leaves the census entirely. Repair: peelErasure extracted from erasedReceiverName and shared with carriesDocument. Deliverable 2 landed as well: a 10-leg pin rebuilding objectui#9447's shape, all 10 RED under ablation. Delta 46 -> 49 reachable reads, all three under 'detail-view'; the other 17 elementDataSourceBlock wrappers already hopped, so the class is ONE instance and no sibling sweep is owed.",
     "tests": "pnpm --filter @object-ui/types test -> 203 files / 4757 tests passed. os-verify-lock -c 'pnpm --filter @object-ui/plugin-detail test && pnpm vitest run scripts/__tests__/check-handler-key-read-sites.test.ts' -> VERDICT command-exit 0; 181 files/1742 tests and 1 file/49 tests. pnpm type-check:scripts exit 0 (edited test file IS in that project: tsc --listFiles hit count 1). check:handler-key-reads -> 'OK 105 arm(s), 212 registration(s), 49 reachable handler read(s), 49 judged, 2 exempted by ledger'. Gates all exit 0: control-bytes, new-line-citations, changeset-no-major (0 when run directly; pnpm -s wrapper reported 254 with no output -- a wrapper artefact, not a gate), changeset-claims, pending-changeset-literals, comment-mask-corpus, component-surface-parity, element-data-source-declaration, spec-symbols, registry-bare-names, changeset-presence. check:sdui-registration-pins exits 2 = PREREQUISITE NOT MET ('No console build to weigh at apps/console/dist/assets') => NOT MEASURED, left to CI; this diff adds/removes no registration. eslint targeted: 4 files, 0 errors, 0 warnings -- DECLARED NARROWING with all three pieces: population = eslint's own config, file count read from --format json, invariance = eslint.config.js configures no type-aware linting (no project/projectService), so this diff cannot move any untouched file's verdict; repo-wide lint is CI's run. ABLATION (restore the pre-repair carriesDocument body): mutation proved on disk -- peelErasure call-site count 2 -> 1, pre-fix paren recursion 0 -> 1, blob hash fb8841ce -> b97508be (non-empty, != HEAD); gate exit 1 (staleExemptions reds on the new ledger row), vitest exit 1 with 11 failed | 38 passed (49) -- all ten wrapper legs plus the ledger-honesty leg. Restore via 'git checkout HEAD -- <abs path>' under a trap, verified by hash == HEAD blob AND 'git diff HEAD' empty; repaired tree then re-read 49 passed (49). No dist/build step applies: the gate is a plain .mjs consumed directly by both the CLI and the suite.",
     "mcp_calls": "0 - no MCP GitHub tool was called; every GitHub read and write went through the REST proxy with curl",
     "api_writes": "2 - POST /repos/objectstack-ai/objectui/pulls (draft #9728); POST /repos/objectstack-ai/objectui/issues/9700/comments (this report). No label write was owed: objectui applies PR labels by path labeler, which put 'package: types', 'plugin', 'tests' on #9728 on its own. Plus 2 git pushes (empty-branch routing probe, then the commit).",
     "open_questions": [
       {
         "question": "The repair surfaces one finding, detail-view::DetailViewSchema.onTabChange, and I ledgered it to objectui#7804 rather than declaring it. The dispatch said do not add a KNOWN_UNDECLARED_READS row; I read that as forbidding a row that ledgers the BLIND SPOT, not one that ledgers a defect the blind spot was hiding. Flagging it because it is the one judgement call in the change.",
         "options": [
           "A - ledger the row to objectui#7804 (what landed). It is the SAME read site as the existing detail::DetailSchema.onTabChange row, scored a second time under the other registration that reaches DetailView; the count of live undeclared READ SITES did not move. The gate's own instruction text names this route, and staleExemptions() reds on the row the moment the hop regresses, so it cannot become a silent waiver.",
           "B - declare onTabChange on DetailViewSchema. This widens a published accept set => Clause-2: yes => outside this card, and the disposition is objectui#7804's to decide.",
           "C - do not land deliverable 1 and return needs_decision on the row."
         ],
         "recommendation": "A, because B is the Clause-2 fork the dispatch told me to stop at, C forfeits the deliverable over a row that is welded to the repair, and the ledger's own docblock records the exact precedent: rows enter it when a vision-widening change finds a defect whose fix is a packages/<pkg>/src change the current card is Clause-2 'no' for."
       }
     ],
     "out_of_scope_findings": [
       "noted, not filed: resolveComponent's CallExpression branch returns the first capitalised identifier argument and DISCARDS the wrapper call's own body, so a wrapper spelled block(Inner) that also renders document-carrying JSX around Inner would lose the outer half. Not reachable on this tree -- the one such registration, register('record_picker', elementDataSourceBlock(ElementRecordPickerRenderer)), renders nothing around it, so no undeclared read is exposed. Carrier: none -- no open PR passes scripts/check-handler-key-read-sites.mjs (0 of 13, measured), and it is neither a reproducible defect nor a declared-contract breach. Recorded in the PR's Acceptance notes.",
       "noted, not filed: check:sdui-registration-pins cannot run without a console build (exit 2, PREREQUISITE NOT MET). Pre-existing, not touched by this diff, and CI builds the console. Carrier: every PR that runs the gate locally.",
       "noted, not filed: 'pnpm -s check:changeset-no-major' surfaced exit 254 with empty output while the script itself exits 0 -- a pnpm wrapper artefact that reads as a red gate. Not a defect in the gate. Carrier: none named."
     ]
   }

   ---

   Generated by Claude Code
6. os-try-charles

   closed this as completedin #9728on Sep 17, 2026
7. os-try-charles

   removed

   pm:dispatched

   on Sep 17, 2026
8. os-try-charles

   removed their assignment

   on Sep 17, 2026
9. os-try-charles commented on Sep 17, 2026

   

   os-try-charles

   on Sep 17, 2026 – with Claude

   Collaborator

   More actions

   LANDED — objectui#9700 via PR #9728, merged 2026-09-17T21:30:07Z

   Fixes #9700 ⇒ card auto-closed; half-state cleared at 21:31:10Z, ~1 minute, read back MATCHES.

   ⭐ Errata 62b fired — by ancestry

   M  = 580e5dd946bad8f0d351fd8943584d3f38347a34
   M^ = 2dbb499755d6214578c77448130589017fd3d6db   ← resolved AFTER the merge
   merge-base(head, M^) = dea17b469…   ⇒ M^ is NOT an ancestor of the head ⇒ FIRED
   

   Tally, ⛔ a record and not a pattern: #9669 fired · #9690 no · #9696 fired · #9702 fired · #9707 fired · #9728 fired.

   The probe, pre-validated before the merge — and this time the controls were REASONED

   leg	M^	M
   peelErasure	0	4	✅ the repair is in
   ledger rows	1	2	✅ exactly the one row ruled below
   ⭐ CONTROL carriesDocument	5	5	✅ must not move — the fix shares peelErasure with it rather than renaming or duplicating it
   ⭐ CONTROL function staleExemptions	1	1	✅ must not move — it is what makes the new ledger row self-policing, so its invariance is load-bearing for the ruling

   ⚠️ On the previous landing I labelled a token a control and it moved, controlling nothing. ⇒ a control is a token you have reasoned must not move, and both of these come with that reason stated.

   ⭐ The ruling on the ledger row — and the dev's distinction was sharper than my instruction

   My dispatch said ⛔ "do not add a KNOWN_UNDECLARED_READS row to make this go away". The dev added one and flagged it, reading my rule as forbidding a row that ledgers the blind spot, ⛔ not one that ledgers a defect the blind spot was hiding. Ruled A, after verifying the three things that make it right rather than taking them:

   • The live undeclared read-SITE count did not move. The ledger goes from detail::DetailSchema.onTabChange to that plus detail-view::DetailViewSchema.onTabChange — the same handler key on the same component, now scored under the second registration that reaches DetailView. What grew is how many registrations reach it, which is what widening a gate's vision should produce.
   • The row is self-policing. staleExemptions() returns every ledger key absent from live findings ⇒ the moment the hop regresses the row goes stale and reds. ⛔ It cannot decay into a silent waiver — the entire worry behind my instruction.
   • Declaring the key instead would widen a published schema ⇒ the Clause-② fork the dispatch told the dev to stop at; and refusing the row would forfeit a deliverable over a row welded to the repair. Both rows carry objectui#7804, which owns the disposition.

   ⇒ ⭐ The rule I should have written: ledger what the fix REVEALS; ⛔ never ledger the fix you did not make.

   ⭐ The mechanism was DERIVED — and it is none of the three the card guessed

   The card explicitly declined to name a mechanism and warned against inheriting one. Measured: ⛔ not the hops > 4 cap, ⛔ not an unresolvable wrapper reference, ⛔ not the walk stopping in the wrapper body — but carriesDocument testing the raw schema= attribute expression, so the render-prop hand-off <DetailView schema={bound as DetailViewSchema} /> read as "not the parent's document" and DetailView was never enqueued.

   ⭐ The generalisation worth keeping: objectui#9344 peeled these type-only wrappers off a read receiver only, and a lost HOP is strictly worse than a lost read, because the component leaves the census entirely.

   ⭐ Outcome 1 was established, not assumed: a fresh --list on current main showed detail (raw) yielding 3 census rows and detail-view (wrapper) yielding 0 ⇒ PR #9702 did not incidentally fix it. That was the claim this seat most wanted tested, because the card's own reading predated #9702's rewrite of the same file.

   ⭐ And the class was bounded: the other 17 elementDataSourceBlock wrappers already hopped ⇒ one instance, no sibling sweep owed. ⛔ That is the difference between a fix and an open-ended hunt. Counters moved 46 → 49 reachable reads, all three new ones under detail-view.

   Deliverable ② — the pin that makes the claim checkable

   Ten legs rebuilding objectui#9447's shape, all ten RED under ablation, the mutation proven on disk (blob fb8841ce → b97508be) and the restore proven by hash equality plus an empty git diff HEAD — ⛔ not by an exit code. ⇒ "the gate claims to cover X" is now falsifiable, which was the whole point.

   ⚠️ One reviewer note, ⛔ not a defect

   packages/types/src/zod/views.zod.ts appears in the diff — the file this seat named as the Clause-② tripwire — and it is comment-only: it corrects a docblock that asserted "check-handler-key-read-sites.mjs is GREEN on this key and always was. Its transitive hop stops at the wrapper", a claim this PR falsifies. ⭐ Correct and worth making. ⚠️ But it went unmentioned in the hand-back: a named tripwire warrants a line even when the answer is "comments only", because silence on one costs the reviewer a hard stop.

   ⚠️ Carried forward so it is not lost with the PR

   resolveComponent's CallExpression branch returns the first capitalised identifier argument and discards the wrapper call's own body, so a wrapper spelled block(Inner) that also renders document-carrying JSX around Inner would lose the outer half. ⛔ Correctly not filed — unreachable on this tree (the one such registration renders nothing around it), so no undeclared read is exposed. Recorded in the PR's Acceptance notes.

   ---

   Generated by Claude Code
10. akarma-synetal

    added a commit that references this issue on Sep 28, 2026

    fix(scripts): the handler-key census takes the registration-WRAPPER h…

    ...

    580e5dd