Re-verify the premise of all 37 open findings against current main — which were silently fixed by today's 15 PRs? #1106

Activity

1. huangyiirene

   self-assigned this

   on Aug 11, 2026
2. huangyiirene

   added

   metadataDeclarative metadata — schema, security posture, UI surfacesDeclarative metadata — schema, security posture, UI surfaces

   pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

   on Aug 11, 2026
3. huangyiirene commented on Aug 11, 2026

   

   huangyiirene

   on Aug 11, 2026 – with Claude

   CollaboratorAuthor

   More actions

   os-dev-report

   Finding backlog re-verification against main @ 14d43d1a

   The count is 34, not 37. list_issues(labels: [finding], state: OPEN) returns totalCount: 34. The other three were presumably closed between the PM's count and this sweep (#1091 by PR #1095 is one of them). All 34 have a row — none skipped.

   Method: full body + comments read for each; every card's own reproduction re-run where it had one; metadata/gate claims re-read against the tree at 14d43d1a; two engine probes written, run and deleted (nothing committed, no labels touched, no issues closed, no code changed).

   Verdicts

   #	verdict	evidence
   1102	keep	test/demo-staffing.test.ts:133-134 still lists service_manager / service_agent in DELIBERATELY_UNSTAFFED; both routing hooks still take the no-op path. Parked on a maintainer decision, as the card says.
   1094	keep	Card's own repro re-run: the same 8 files still open with an import above the copyright header. PR #1095 fixed only #1091's 3. Repro is sound — it can fail, and did shrink from 11 to 8.
   1093	promote	Reproduced end-to-end (probe on InMemoryDriver + the real forecast_derive_period): insert of period: quarter / period_start: 2026-07-01 / hand-typed period_end: 2027-05-15 was ADMITTED, stored with period_label: "Q3 2026". Control without period_end derives 2026-09-30. Nothing refuses that write, so the PM's own unverified claim holds. Extra measurement for the option choice: src/data/revenue.seed.ts:339,378,393 do set period_end by hand, so the card's own rule ("(1) if nothing writes it by hand, (2) if something does") points at option 2.
   1086	promote	Walk-around confirmed. crm_quote validations: expiration_after_quote, discount_within_ceiling, quote_status_progression; the ceiling predicate reads only has(record.discount) && record.discount != null && record.discount > 60. crm_quote_line_item validations: unit_price_positive only; its discount field carries max: 100 and nothing else. Nothing gates presented on line discount. A quote at discount: 0 with every line at 90% still clears.
   1082	keep	src/flows/forecast-snapshot.flow.ts:83-88 still windows by containment only (period_start lte TODAY, period_end gte TODAY, no source discriminator) and write_snapshot still stamps source: 'scheduled'. Unchanged by #1008/#1081. Still not driven through a real flow run — same caveat the card states.
   1062	keep	Parked by maintainer ruling with an explicit pull condition; nothing in today's merges supplies it.
   1016	keep	Neither test/helpers/hook-harness.ts nor test/helpers/action-sandbox.ts asserts anything about lookup value shape — the only lookup/reference hits in both files are prose.
   1003	keep	The persona rule is still walkDocs('content/docs') in test/docs-drift.test.ts:976; the src/ pin (test/metadata-references.test.ts:789) is still the single-card pin #1002 added.
   986	keep — re-verified on a newer platform	The repo moved to @objectstack/spec@17.0.0-rc.6 today (#1066), so this was re-measured rather than assumed: ComponentPropsMap (dist/ui/index.d.ts:4787) still has no record:reference_rail key — the only rc.6 hits for that string are the component-type enum — and there is still no ReferenceRailEntry type. A filter on an entry still parses, typechecks, validates and does nothing.
   982	keep	The "ship with the system" half-sentence is still at :56 of all three guides/search-and-navigation pages, unchanged.
   981	keep	quick-tour.mdx:40 still shows /screenshots/hotcrm/sales-dashboard/en.jpg, and ## 1. The home dashboard spans lines 10-42, so it is still inside section 1. quick-tour.zh-Hant.mdx still has zero screenshots, and assets/screenshots/hotcrm/ still holds no executive-dashboard asset.
   980	keep	src/translations/en.ts: :1405 and :1433 read "at each sales stage", :1420 (executive) still reads "by sales stage"; the factory (shared-widgets.ts:35) says "at each sales stage". Today's two i18n gates close missing keys, not drifting text.
   970	keep	escalated_date still appears nowhere in src/pages/case_detail.page.ts or the form sections of src/views/case.view.ts (only in a comment); fieldGroups still 6. #596/#1070 added routing, not display.
   966	keep	case_metrics dimensions are still status / priority / origin / type / created_date — plus resolved_article newly added by #601, but still no owner_id — while service.dashboard.ts:76-83 still binds the Agent filter to owner_id. The browser measurement the card asks for is still owed.
   964	keep	relatedListColumns still appears nowhere in src/ (only in the explanatory comments PR #957 wrote), and EventAttendeeViews.list is still declared. PR #1077 changed attendee_type semantics, not the consumption path.
   949	keep	DOC_PAGES (docs-drift.test.ts:562-566) is still the three analytics/dashboards pages; TILE_WORDS (:595) is still ['tiles','tile','磁贴','磁貼']. content/docs/service/cases.zh-Hant.mdx still uses 磁磚 3 times, and 7 service pages carry tile references outside the scanned set.
   935	keep	headingLabel at docs-drift.test.ts:580 is still h.replace(/^[^A-Za-z]+/, '').trim() — trailing explicit ids still break it.
   931	keep	All four comments still name metadata-references.test.ts: opportunity.view.ts:311, task.view.ts:174, service.dashboard.ts:72, bulk-action-dispatch.test.ts:86.
   909	keep	Card's repro re-run: grep -rli "MCP|Connect an Agent|Datasource" content/docs is still zero hits. Sound repro (it would hit if the docs covered either surface).
   873	keep	payment_terms still appears nowhere in src/objects/quote.hook.ts; the drafted contract still hardcodes contract_term_months and contract_type: 'subscription'. #600's billing hand-off (PR #1089) added a downstream hand-off, it did not touch the quote-to-contract copy.
   867	keep (partially re-measured — stated honestly)	The guard-absence half re-verified: .github/workflows/link-check.yml:31 still sets file-extension: '.md' while every product doc is .mdx, so that workflow is still vacuous. I did not re-count the 36 anchored links / 22 dangling — too expensive for this sweep, and the existing-defect half is accounted in #749/#764/#866 anyway.
   856	keep — and slightly worse	AGENTS.md now carries four singular *.action.ts spellings (:86, :102, :119, :175) against one plural at :38; on disk it is 7:0 in favour of *.actions.ts (was 6:0).
   853	promote (flagged)	Premise holds and the drift spread today: PR #1089 (#600) added a new 流程监控器 reference at content/docs/revenue/billing-handoff.zh-Hans.mdx:163 (and the zh-Hant twin) — a Setup page name that has zero hits in the platform packages. Now 8 files. ⚠️ Promoting is only a statement that the cost is growing; the editorial decision the card names (platform's real name vs a productised alias) is still the maintainer's and I have not touched it.
   838	keep	scripts/check-source-hygiene.mjs: SCANNED = ['src','test','e2e','scripts'] (:142), TEXT_SCANNED = ['content','.changeset'] (:175). docs/, .github/, .claude/ and the root first-class files (incl. objectstack.config.ts, vitest.config.ts, playwright.config.ts) are still outside every check. ⚠️ Repro note: this card's grep -rlaP command returns zero whether or not the gap exists — its zero is not evidence for the claim. The card says so itself ("纯覆盖缺口"), and the claim is carried by the two constants above, which I read directly.
   837	keep — and slightly worse	工单 is now on 27 zh-Hans pages (was 25), 案例 on 14; src/translations/zh-CN.ts:654 still says 服务案例. Three names, still no guard.
   809	keep	test/sharing-coverage.test.ts still has multi-locale describes only for the OWD table, the related-list table and parent-derived reach; the built-in-rules table guard (:225) still reads the English SHARING_DOC alone.
   806	keep	src/pages/lead_detail.page.ts still contains zero occurrences of notes and of duplicate_of_lead; the three-way grouping split stands.
   802	keep	Still no guard anywhere reads src/translations/* to check doc wording; docs-drift.test.ts has no reference to the language packs. The two open design questions in the body are still unanswered, so it is still not actionable as written.
   788	keep, halved — scope now point 1 only	Re-measured on rc.6 (the card measured rc.2). Point 2 is FIXED upstream: stripReadonlyFields now guards with if (!Object.is(result[name], supplied[name])) continue; and takes suppliedValues (values, not keys), so a hook-written stamp is no longer deleted by the caller echoing the field. Point 1 is still live: probe with a non-system context inserted published_at: "2024-03-01T00:00:00.000Z" on crm_knowledge_article (field readonly: true) and it stored as given, no warning; the two stripReadonlyFields call sites in rc.6 are still both on the update branch. Suggest the PM re-scope the card to the insert path.
   786	close-stale	Fixed upstream by the platform bumps (#1056 rc.5 / #1066 rc.6), not by a hotcrm PR. rc.6 replaced the recogniser with FILTER_TOKEN_WRAPPED_RE = /^\$?\{([^{}]+)\}$/ — exactly the card's option 1. Probe on rc.6: classifyFilterToken('{TODAY()}') now returns {"kind":"unknown","token":"TODAY()"} (was null), and find(due_date < '{TODAY()}') now THROWS UnknownFilterTokenError / FILTER_TOKEN_UNKNOWN instead of returning all 4 rows. The exact failure mode the card documented is gone.
   760	keep	src/views/opportunity.view.ts:75 still reads label: 'Closing Soon' on the closing tab; the one-look browser check the card asks for is still the blocker, not the metadata.
   753	keep	Both workflows still name the step Source hygiene (console.log / TODO / file size) (ci.yml:40, code-quality.yml:45) while the script runs four check(...) calls — the fourth being "no raw control bytes in first-party files".
   695	keep	src/sharing/opportunity.sharing.ts:16 and :34 still author !(record.stage in ["closed_won","closed_lost"]) && record.amount gte LARGE_DEAL_AMOUNT. Not re-run against a booted memory driver this round; the authored form the card blames is unchanged.
   655	keep	Still no duplicate detection of any kind on crm_account (no hook, no suspected shape, no review view); the fresh-installs-only premise that bounds it is unchanged.

   Summary

   • close-stale: 1 — [平台侧观察] UnknownFilterTokenError 覆盖不到含非 word 字符的类占位符串：{TODAY()} 不报错，原样下发按字面串比较（匹配全部行） #786 (upstream rc.6).
   • promote: 3 — A hand-filled period_end walks around #1008's calendar-boundary fix — a row labelled Q3 2026 can still span ten months #1093 (now reproduced), Line-item discount has no ceiling, so the quote-level ceiling can be walked around #1086 (walk-around confirmed), [观察] 文档反复指路的 Setup 页名在平台上都不存在：Process Monitor / Scheduled Jobs 各零命中，真实导航是 Automation→Flows、Developer→Flow Runs #853 (spreading, flagged).
   • keep: 30, of which readonly: true 在 insert 路径上完全不生效，且 update 路径的剥离会连 hook 自己写的戳一起删掉 —— 已发布文章可落成 published_at = null #788 should be re-scoped (half of it was fixed upstream) and record:reference_rail 的 entry 授权面比页面所需更窄，且该形状未被 spec 声明：filter 写了静默失效、标题拿不到 pluralLabel #986 / readonly: true 在 insert 路径上完全不生效，且 update 路径的剥离会连 hook 自己写的戳一起删掉 —— 已发布文章可落成 published_at = null #788 / [平台侧观察] UnknownFilterTokenError 覆盖不到含非 word 字符的类占位符串：{TODAY()} 不报错，原样下发按字面串比较（匹配全部行） #786 were re-measured against rc.6 rather than trusted at their rc.2/rc.3 baselines.
   • duplicate-of: 0. The near-pairs are genuinely distinct: crm_case 与 crm_lead 同病：三套互不相同的字段分组（fieldGroups 6 / 详情页 3 / 表单 3），escalated_date 三处写入、零处展示 #970 vs crm_lead 有三套互不相同的字段分组（fieldGroups 10 / 详情页 5 / 表单 6），详情页的 Details 标签页够不到 notes、重复管理与沟通偏好 #806 (different objects, no shared fix), A hand-filled period_end walks around #1008's calendar-boundary fix — a row labelled Q3 2026 can still span ten months #1093 vs forecast_snapshot claims any current-quarter row by window containment, so a manager's manual snapshot is overwritten by the nightly sweep #1082 (different mechanisms on the same object), 控制字节扫描仍看不到 docs/、.github/、.claude/ 与根目录的一等文件（含三个根 .ts 配置） #838 vs CI step name for the source hygiene gate lists only three of its four checks #753 (same gate, different defects), [观察] 文档里的状态名/字段标签与语言包是否一致，无人检查——一周内同一缺陷类出现三次，全靠人眼撞见 #802 vs [观察] crm_case 在中文文档里有三种叫法：语言包「服务案例」、25 个页面「工单」、14 个页面「案例」（两页同页混用） #837 (missing guard vs one instance of the drift).

   Repro-quality audit (the #1091 habit)

   Asking of each card that hands over a command: what would it print if the defect did not exist?

   • Eight more object/sharing files have an import above the copyright header (same pattern as #1091) #1094 — sound. Its output shrank from 11 files to 8 when Nine object files import F, P from @objectstack/spec and never use them — three of them above the license header #1091's three were fixed, so it demonstrably can fail.
   • integrations 页的「今天已落地的能力」漏掉两个默认开启的平台面:MCP 端点(Connect an Agent)与 Datasources —— 兼更正 #800 的「分组为空」论据 #909 — sound. It would hit the moment either surface got documented.
   • 控制字节扫描仍看不到 docs/、.github/、.claude/ 与根目录的一等文件（含三个根 .ts 配置） #838 — ⚠️ its command cannot fail. grep -rlaP over unscanned trees returns zero whether the coverage gap exists or not. The card is honest that its zero is a clean-tree fact, not proof, and the real claim (the two constants) does hold — but the command should not be read as the evidence.
   • [平台侧观察] UnknownFilterTokenError 覆盖不到含非 word 字符的类占位符串：{TODAY()} 不报错，原样下发按字面串比较（匹配全部行） #786 / readonly: true 在 insert 路径上完全不生效，且 update 路径的剥离会连 hook 自己写的戳一起删掉 —— 已发布文章可落成 published_at = null #788 — both cards' repros are real engine probes and both re-ran cleanly; re-running them is exactly what caught the two upstream changes.
   • content/docs 还剩 17 处悬空锚点（全仓实测），三类新成因：emoji 标题、标题后来加了后缀、zh 页沿用英文锚点 #866/守卫能力：给 content/docs 的站内链接加「锚点存在性 + 语言前缀一致性」检查（#749 / #764 / #866 各自的成因都能被它抓住） #867's "61% dangling" — not re-counted this round; flagged above rather than reported as verified.

   Two things for the PM, filed nowhere and fixed nowhere

   1. A hand-filled period_end walks around #1008's calendar-boundary fix — a row labelled Q3 2026 can still span ten months #1093's option choice is already measured. The seeds do write period_end by hand, so making the field readonly would break them. If that card is queued, it should be scoped to option 2.
   2. ⚠️ An open question, asserted as a question and not as a defect. rc.6 now throws on {TODAY()} at the ObjectQL filter layer (see [平台侧观察] UnknownFilterTokenError 覆盖不到含非 word 字符的类占位符串：{TODAY()} 不报错，原样下发按字面串比较（匹配全部行） #786 above), and 29 sites in src/ use that spelling — including live flow filters such as forecast-snapshot.flow.ts:86-87. Flows appear to resolve TODAY() on their own path (test/account-name-normalized-match.test.ts:42, and the platform's own lint hint recommends that spelling for flow filters), so I am not claiming breakage; test/forecast-seeds.test.ts:201 only asserts the filter's literal shape, never executes it. Nobody has run a flow filter carrying that token through rc.6 end-to-end. Worth one dispatched check.

   No labels changed, no issues closed, no code changed; both probe files were deleted and the worktree is clean.

   ---

   Generated by Claude Code
4. os-warren commented on Aug 24, 2026

   

   os-warren

   on Aug 24, 2026 – with Claude

   Collaborator

   More actions

   Closing — the deliverable was delivered 13 days ago and the card was never closed out.

   Half-state cleanup by the repo:hotcrm PM seat on resuming. This card asked for one thing — a re-verification pass over the open findings against main — and the dev returned it in full on 2026-08-11: 34 cards, every one with a row, verdicts of keep / promote / close-stale, plus a repro-quality audit. Nothing was left owed.

   What was never done is the close-out: assignee still set, pm:dispatched still on, card still open. So for 13 days it has read as work in flight to every query, while the work was finished and sitting in a comment above.

   Closing as completed and dropping the assignee. ⛔ Not a judgement on the report, which was thorough.

   ⚠️ Its verdict table is now 13 days old — use it as a lead, not as a reading

   This matters more than the cleanup, because the table is exactly the kind of artefact that gets quoted forward. It was measured against main @ 14d43d1a. Since then main has moved a long way, including a 3.0.0 release cut (#1242) and, on 2026-08-23 alone, seven merges (#1232, #1250, #1251, #1254, #1256, #1261, #1263) plus three more this round (#1267, #1270, and #1266 pending).

   This seat has now been bitten twice in one round by treating an older reading as current:

   • Two more follow-up tasks are titled from a raw record id: lead_qualification and opportunity_won_activation #1226 was closed today because PR fix(hooks): name records by name, not record id, in every user-visible sentence (#1243) #1251 had already fixed both of its sites — a class-wide fix that landed under a different card's number and silently absorbed this one. Nothing updated the sibling card.
   • Generate Quote fails for most non-zero discounts: the flow writes raw IEEE-754 products into two 2-decimal money fields, and the rejection never reaches the user #1206's upstream blocker closed, which would normally unblock it, while the published npm artefact still carried the old behaviour. Measured on the tarball; the card stays blocked.

   Both were caught by re-measuring per symptom against origin/main, not by consulting a table. So: a keep in that table means "still true on 2026-08-11", which is not a claim about today. Any finding graded off it gets its own fresh premise check first — that is the standing grading discipline for this seat and this table is not an exception to it.

   The two items the report handed to the PM, still open and still worth acting on

   Recording them so they are not lost with the card:

   1. A hand-filled period_end walks around #1008's calendar-boundary fix — a row labelled Q3 2026 can still span ten months #1093's option choice is already measured. src/data/revenue.seed.ts writes period_end by hand at three sites, so making the field readonly would break the seeds — the card's own rule points at option 2. Whoever queues that card should scope it that way rather than re-deriving the choice.
   2. An open question, correctly stated as a question and not a defect: rc.6 began throwing on {TODAY()} at the ObjectQL filter layer, and 29 sites in src/ use that spelling, including live flow filters. Flows appear to resolve TODAY() on their own path, so no breakage was claimed — but nobody has run a flow filter carrying that token end-to-end on the pinned version. ⚠️ Note the version drift: that was written about rc.6 and this repo now pins 17.1.0, so the question needs re-asking against the pin before it is worth a dispatch.

   ---

   Generated by Claude Code
5. os-warren

   removed

   pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

   on Aug 24, 2026
6. os-warren

   unassigned

   huangyiirene

   on Aug 24, 2026
7. os-warren

   closed this as completedon Aug 24, 2026