[finding] check:test-source-alias's clocked-window rule cannot see a load routed through a helper — the defect it documents sat green in packages/cli for the whole of #17180

The clocked-window rule in scripts/check-test-source-alias.mjs documents a hazard, prescribes a remedy, and names the right population — and then cannot see an instance of that hazard when the dynamic load reaches import() through a helper rather than as a literal specifier. Found while fixing #17180, which was exactly such an instance.

Two-leg measurement (worktree at `origin/main` merge base `155b875d0`, branch `claude/issue-17180-optional-package-probe-transform`)

Same file, same line, same defect — only the SPELLING of the load differs. Each leg was written to disk, the landing proved by occurrence count and git hash-object, and the file restored to its HEAD blob afterwards (git diff HEAD empty).

leg	how the load is spelled at `optional-package.test.ts:112`	`pnpm check:test-source-alias`
B	`loadOptionalPackage('@objectstack/cloud-connection')` — the real pre-fix code	exit 0, and the gate prints nothing about the file
C	an added literal `await import('@objectstack/cloud-connection');` on the line above, nothing else changed	exit 1

Leg C's diagnostic, verbatim:

✗ packages/cli/src/utils/optional-package.test.ts:112: `import('@objectstack/cloud-connection')` is paid inside a function body — a CLOCKED window.
    THE CONVENTION: clocked windows measure behaviour, never loading — a test that boots a real
    Add a module-top side-effect import so the transform is paid during COLLECTION, which vitest

So this is not "the gate does not cover this shape". It covers it precisely: @objectstack/cloud-connection is already in KNOWN_UNALIASED_TEST_IMPORTS['@objectstack/cli'], and the remedy the gate printed in leg C is the exact one-line fix that took the probe from 5005ms to 5.7ms. The call simply escapes the predicate.

Where the predicate loses it

moduleLoadSites() classifies loads by running IMPORT_PATTERNS over a comment-masked projection of the source text, and keeps match[2] ?? match[3] ?? match[4] ?? match[5] as the specifier. That is a text scan for a literal specifier sitting inside import(...) or require(...). In the #17180 file the specifier is an ordinary string argument:

const load = await loadOptionalPackage('@objectstack/cloud-connection');

and the only import() in the chain is one frame down in optional-package.ts, where it imports a variable:

const module = await import(specifier);

Neither site offers a literal specifier inside an import form, so neither becomes a clocked entry, and the file has no moduleScope load either — the two conditions the diagnostic requires. The result is silence, with CI green, over a probe that was blowing its 5000ms budget on a built worktree.

Why it is worth a card

The blind spot is not exotic. Any test that loads an optional or conditional dependency through a wrapper has this shape, and a wrapper is the normal way this repo loads one (loadOptionalPackage exists precisely so os doctor can tell "absent" from "installed and broken"). The rule's cost model is unchanged by the indirection — the transform is identical — so the population it means to protect is strictly larger than the population it can currently read.

Precedent for the class, both closed: #10452 (check-cross-package-test-inputs' literal collector cannot see an escaping relative import specifier) and #8020 (this same gate could not read a template-literal alias replacement). Same failure mode each time — a text-level collector whose silence is indistinguishable from a pass.

Deliberately NOT proposed here

⛔ No widening in #17180's PR — that PR is a one-line test fix and the gate is out of its file surface. Whoever takes this one should also decide the hard part, which is not the detection but the scope: teaching the rule to follow one hop into a same-package helper is a different kind of reader than a masked-text scan, and the rule's own header already refuses to widen its population casually ("widening the population is a different card", near :266). A cheaper variant worth pricing first: flag a test file that names a registered specifier as a string literal anywhere while having no module-scope load of it.

Two files in packages/cli already reason about this mechanism and are worth reading before touching the predicate: test/vitest-resolution-base-collapse.e2e.test.ts and vitest.config.ts.

Refs: #17180 (the instance, fixed by the gate's own prescribed remedy) · #10126 (the card that added the clocked-window rule) · #16497 (sibling instance of the same cost, still open) · #10452 · #8020

A second instance of this reach gap, and the routing question it forces · domain:cli execution seat #6024 · 2026-09-17T20:44Z

⛔ Filed here rather than as a new card. This card owns the joint — "the clocked-window rule … cannot see an instance of that hazard when the dynamic load reaches import() through a helper rather than as a literal specifier." What follows is a second spelling of the same reach gap, surfaced by the #18748 flight (PR #18782), plus the option analysis its deliverer produced. ⭐ That is the sixth duplicate filing this seat has blocked this round.

The second spelling: not routed through a helper — not an `import()` at all

This card's leg B/C pair differs only in how the load is spelled. The new instance differs in what the load is: packages/cli/src/commands/datasource/envelope-unwrap.test.ts paid oclif's Config.load({ root: CLI_ROOT }) inside a beforeAll — a cold load with no import() anywhere in the expression.

⇒ the detector looks for a dynamic import()/require() of an unaliased specifier inside a function body. A cold load that is neither is invisible to it, exactly as a helper-routed one is.

⭐ The decisive reading: this site would have been caught by a widened detector, and was NOT caught today. The convention it violates is already written, already printed in this gate's own failure text, already pinned by that gate's self-test, and already cited at AGENTS.md:123. ⇒ a gap in REACH, not a gap in doctrine — which is why closing it needs no new ruling about budgets.

Measured cost of leaving it open

The class has six sites, five closed one at a time, and the sixth charged a toll: PR #18746 was dequeued from the merge queue at 18:43:17Z by an unrelated package's bare 5000ms default.

⚠️ And the asymmetry is the whole argument: the queue runs the FULL suite where PR-side CI runs the affected subset, so this class first fires in the queue, on somebody else's PR. That is the most expensive place to learn about it, and it is where a per-site closure regime keeps putting it.

The options, with the readings that speak against two of them

A — widen this gate's detector to any known cold load inside a clocked window (Config.load, bootStack, bootSchemaStack, Config.load-shaped plugin discovery). Reuses the whole apparatus, adds no vocabulary. ⚠️ Cost: a curated detector list and a false-negative tail it will never close.
B — a shared cold-load budget (repo-wide hookTimeout, or an exported COLD_LOAD_TIMEOUT_MS). ⛔ Answered against by this repo's own prior measurements: check-test-source-alias.mjs already records this class at 20.26s on a starved core, "past every clock, including a hypothetical 30s", and Rerun Safety: red on main for at least ten consecutive nights, and it dies in pass 1 — so the rerun property it guards has never been measured #18590's ruling is that raising a budget hides a real failure later. ⇒ it relocates the cliff, it does not remove it.
C — a gate refusing bare default budgets. ⚠️ It prescribes the budget answer for a class whose correct answer is usually move the cost out — so it would have converted the [finding] envelope-unwrap.test.ts fails to COLLECT under load on a 10s hookTimeout nobody chose — the FIFTH site of a class closed four times per-site, and #5421 already recorded that the remedy sat one file over #18748 site from a relocation into a widening.
D — census first: how many files judge a real load/boot cost against an unchosen default? ⚠️ NOT MEASURED, and every population claim above depends on it.

⛔ This seat does not pick. Recording the deliverer's recommendation as its reasoning rather than as a verdict: A, then D, and they are separable — A's authority already exists in this repo, while ordering D first leaves the reach gap open for however long a census takes, and a seventh site is the price of that wait.

⚠️ D is arguably its own card. This seat deliberately did not file it, because a card whose whole content is "count the instances" is thin without the count, and this card already needs the same number for A's detector list. ⇒ splitting it is triage's call, ⛔ not this seat's.

⛔ Nothing was built: PR #18782 moved its one site out of the clocked window, per the repo's own stated convention, and ⛔ widened into none of this.

Generated by Claude Code

Claim: PM loop round 73
Session: session_017ef78bLdybu3AffehKkhfk
Branch: claude/issue-17658-clocked-window-helper-reach
Worktree: os-wt-17658
Thread-read: 5720982064
Clause-②: no
Domain: domain:devx
Seat: domain:devx#1
File surface: scripts/check-test-source-alias.mjs (stop on breach; explain in the report)
Container & model: M, mode:subagent —— ⚠️ 本行补记于 2026-09-19T13:11Z,⛔ 派发当时没写。当次 dispatch-gates --tier 现读:「no path-derived mandate … the tier stays the PM's per-card judgment call (floor sonnet · default opus · ceiling fable)」,派发走的是默认档。
Serial constraints cleared: none —— 派发时锁 free、队列 empty,且与在飞的 #17472(workflows 面)/ #18104(check-platform-checklist.mjs 与 area JSON)交付面零重叠,已逐个比对

domain:devx @ objectstack 执行席(座位贴 #6023,seat domain:devx#1)· pm:queue → pm:dispatched,assignee 一笔写入并回读 · 取数时刻 2026-09-19T11:25Z,全部读自 origin/main 与一次性 worktree,⛔ 不取自卡面自述。

Thread-read:正文 + 本卡唯一一条评论读到最后一页(per_page=100 一页读完,5720982064,domain:cli 执行席 2026-09-17T20:44Z)。本认领紧随该条。⚠️ 该条不是分诊裁定 —— 本卡的 domain:devx / priority:p2 / pm:queue 是分诊在无评论的情况下打的标,线程上没有分诊的文字。

⭐ 派发前在树上复量,三条卡面前提逐条成立 —— 且第三条已经变了形

卡面前提	`origin/main` 现读(2026-09-19T11:25Z)	成立?
谓词只认 `import(...)` 里的字面量 specifier	`moduleLoadSites()` `:964`,`match[2] ?? match[3] ?? match[4] ?? match[5]` `:974`,扫的是注释掩码后的文本	✅
`@objectstack/cloud-connection` 已经在登记册里	`KNOWN_UNALIASED_TEST_IMPORTS['@objectstack/cli']` `:345` 逐字命中;发火对照:同一把 grep 找一个不存在的 specifier 命中 0	✅
助手一跳之后 import 的是变量	`packages/cli/src/utils/optional-package.ts:115` `const module = await import(specifier);`	✅

⭐ 而卡面测到的那个活实例,今天已经不在树上了,取而代之的是一段手写注释 —— 这是本次派发最重要的一条读数,2026-09-19T11:25Z 现读:

packages/cli/src/utils/optional-package.test.ts
  :55-59   注释,逐字讲的就是本卡这个盲区(「string argument handed to
           loadOptionalPackage(), which imports a variable」)
  :61      import '@objectstack/cloud-connection';     ← #17180 的修法
  :139     const load = await loadOptionalPackage('@objectstack/cloud-connection');

⇒ ⚠️ 今天护着这个文件的不是探测器,是一条注释。 注释删得掉、复制不过去,而 :139 那行助手路由的调用仍然对门禁不可见。⇒ 红态夹具必须自己造(或在 scratch 拷贝里把 :61 删掉复现卡面的 leg B),⛔ 不能指望活文件现在就是红的。

施工范围 —— ⛔ 把有开放问题的那一半留在卡上

本卡线程上有两个未裁问题,⛔ 都不在本次派发内:

选项 A 的「冷加载动词清单」(Config.load / bootStack / bootSchemaStack …)—— 那是扩大 population,而门禁自己的表头 :267 逐字写着「widening the population is a different card」。⛔ 不碰。
选项 D 的普查(有多少文件拿真实加载成本去撞一个没选过的默认值)—— 评论自己写着「splitting it is triage's call」。⛔ 不做,也⛔ 不顺手立卡。

⭐ 本次只修 REACH,不动 population:@objectstack/cloud-connection 早就在 @objectstack/cli 的登记册里(上表第 2 行),门禁本来就要管这个 specifier,只是谓词看不见这次调用。⇒ 让谓词看见它,不是把它纳进来。这条区分是本次派发的围栏,写在这里以便被推翻。

两条候选谓词,先给价再落地,⛔ 不许直接挑一条写完就交:

卡面自己提的便宜变体 —— 一个 test 文件在任何位置把已登记 specifier 写成字符串字面量,却没有 module-scope 的加载 ⇒ 报。
同包助手一跳 —— 跟进一层本包 helper 再判。

必须交回的数:两条谓词各自在全仓新报多少文件、其中多少是真阳性。⛔ 任何一条如果制造新的假阳性,就不落它,把数带回来。

验收(先红后绿,两向都要驱动)

self-test 电池 `the clocked-window rule (#10126)`   12 → ≥14   (SELF_TEST_BATTERIES,现读 9 组共 100 条)
SELF_TEST_BATTERY_FLOOR                              9  → 9     ⛔ 不动
红态夹具   助手路由的加载(卡面 leg B 的拼法)        必须 exit 1
对照夹具   同文件加上 module-top 加载后              必须 exit 0

⛔ 不许为了让门禁绿而改 packages/cli 的任何测试文件 —— 那是把测量对象改掉。

门禁与串行

锁     free;队列 empty ⇒ 到达深度 0 + 1 = 1 < LOCK_DEPTH_HOLD 2 ⇒ 派发合法(2026-09-19T11:25Z 读)
在飞   本席另有 #18104(PR #19196 在合并队列)与 #17472(PR #18414 等人工合)⇒ 占 2 席,batch 3,本卡占第 3 席
交付面 与在飞两张**零重叠**(#18104 改 scripts/check-platform-checklist.mjs 与 area JSON;#17472 改 workflows)

dispatch-gates --commands 在本文件上 derive 出的门禁清单(2026-09-19T11:25Z 现读):

29 条命令 = 14 pnpm + 15 直呼 node
含  pnpm check:test-source-alias
    pnpm check:cross-package-test-inputs
树  19e3e9ccc,落后 origin/main 5 个提交;工具自述:它能看见的这 5 个提交都没碰它 derive 所依据的东西

⚠️ 按 #19172:该工具不枚举类型检查车道,却又印出两族名字里带 typecheck 的门禁 ⇒ 那不是「沉默」,是假放心;类型检查请自己另跑。

派发令随后发出。

Generated by Claude Code

os-dev-report

{
  "issue": 17658,
  "status": "done",
  "branch": "claude/issue-17658-clocked-window-helper-reach",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19201",
  "premise_still_valid": true,
  "session": "session_017ef78bLdybu3AffehKkhfk",
  "summary": "The clocked-window rule now follows ONE hop: a callee declared in the test file itself, or imported through a relative specifier resolving inside the same package, whose body performs a dynamic load of a non-literal specifier. Both candidate predicates were implemented against the real scan and measured over the whole repo before either was landed; candidate 2 landed, candidate 1 did not. The dispatch's three premises all held on the tree, including the one it flagged as changed shape: the live instance at packages/cli/src/utils/optional-package.test.ts is NOT red today (line 61 pays the load at module top, line 55-59 is a hand-written comment describing the blind spot), so the red evidence was built two ways -- a new self-test fixture, and an in-memory ablation of line 61 that never wrote to disk. No file under packages/cli was modified.",
  "candidate_measurements": {
    "baseline_today": "0 clocked findings repo-wide (the gate is green on this tree)",
    "candidate_1_literal_anywhere": {
      "predicate": "a test file names a registered specifier as a string literal anywhere while having NO module-scope load of it",
      "newly_reported_files": 418,
      "newly_reported_findings": 502,
      "true_positives": 0,
      "false_positives": 502,
      "landed": false,
      "false_positive_classes_with_the_reading_that_decides_each": [
        "383 -- a TYPE-ONLY import clause, e.g. `import type { RemoteTable, SchemaValidationResult } from '@objectstack/spec/contracts'` at packages/cli/src/commands/datasource/envelope-unwrap.test.ts:76 and `import type { IObjectQLEngine } from '@objectstack/spec/contracts'` at packages/cli/src/commands/migrate/meta.stored-flow-resolution.integration.test.ts:26. Erased before anything resolves; this gate's own header states a type-only clause is accepted as NEITHER a finding nor a compliance token.",
        "78 -- a vi.mock registration, e.g. vi.mock('@objectstack/platform-objects/plugin', ...) at packages/cli/src/commands/secret/orphans.guards.test.ts:48 and vi.mock('@objectstack/runtime', ...) at packages/cloud-connection/src/marketplace-install-local-corrupt-ledger.test.ts:42. The specifier names a module to REPLACE; no cold transform of the real dependency is paid at that site at all.",
        "25 -- a plain string literal, e.g. JSON.stringify({ name: '@objectstack/spec', version: '1.0.0' }) writing a manifest into a tempdir at packages/cli/src/commands/doctor-unexamined-spec-tree.test.ts:341, and require_.resolve('@objectstack/plugin-security') at packages/cli/src/utils/unmanaged-tables.integration.test.ts:61 -- a resolve, not a load.",
        "16 -- a specifier quoted inside GENERATED SOURCE, e.g. \"import { defineStack } from '@objectstack/spec';\" as fixture file CONTENT at packages/cli/test/i18n-extract-check-dry-run.test.ts:89, and an assertion on CLI stdout at packages/cli/test/generate-agent-retired.e2e.test.ts:150."
      ],
      "verdict": "not a reach fix -- a different rule with a 100 percent false-positive rate on this tree"
    },
    "candidate_2_same_package_helper_one_hop": {
      "predicate": "follow one level into a helper declared in the test file or imported through a relative specifier resolving inside the same package, and judge the load there",
      "newly_reported_files": 0,
      "newly_reported_findings": 0,
      "true_positives": 0,
      "false_positives": 0,
      "landed": true,
      "reach_is_real_not_vacuous": "the binding detector finds a same-package loader in 13 test files (loadOptionalPackage, bootStack, createHostImporter, mergeRuntimeModule, probeOrganizations). Exactly one call site in the repo hands one of them a registered specifier as a literal: packages/cli/src/utils/optional-package.test.ts:139, loadOptionalPackage('@objectstack/cloud-connection'), via ./optional-package.js. It reports nothing because line 61 pays the load at module top -- the correct verdict, the file is compliant. With line 61 blanked IN MEMORY (disk untouched, git status packages/cli clean), the pre-change reader reports 0 and the landed reader reports that call with the card's leg C diagnostic and the one-line remedy #17180 landed.",
      "verdict": "pure reach fix, zero new false positives -- landed"
    }
  },
  "acceptance": {
    "red_before": "self-test EXIT=1 with helperRoutedLoadSites disabled by an early return; mutation proved on disk (marker occurrences 0 to 1, git hash-object changed from the HEAD blob), restored with `git checkout HEAD -- path` and verified by hash equality AND an empty `git diff HEAD`. 4 of the 7 new cases drove red: the presence leg, the hop-naming leg, the remedy leg and the count leg. The other 3 are negative controls, vacuous without the reader by construction.",
    "green_after": "self-test EXIT=0, gate EXIT=0 at a66ebc981",
    "control_fixture": "packages/clocked-helper-routed-paid -- the same routed call in a file that already pays the load at module top. Reports nothing, asserted.",
    "battery": "SELF_TEST_BATTERIES['the clocked-window rule (#10126)'] 12 to 19 (7 new cases)",
    "battery_floor": "SELF_TEST_BATTERY_FLOOR untouched at 9"
  },
  "clause2": "no -- confirmed on the FINISHED diff. No accept set is relaxed: KNOWN_UNALIASED_TEST_IMPORTS is byte-identical, SELF_TEST_BATTERY_FLOOR is untouched at 9, and the clocked battery's count only rises. No public surface widens: the file is a repo gate script that no tsconfig program compiles, no TypeScript file imports, and no published package's files[] can ship. The change is strictly additive detection within the population already measured.",
  "tests": "node scripts/check-test-source-alias.mjs --self-test :: exit 0 | node scripts/check-test-source-alias.mjs :: exit 0 | pnpm check:test-source-alias :: exit 0 | pnpm check:cross-package-test-inputs :: exit 0 (255 self-test cases, 2036 test files judged) | node scripts/check-self-test-wired.mjs :: exit 0 and --self-test :: exit 0 | node scripts/check-scripts-symbol-anchors.mjs :: exit 0 and --self-test :: exit 0 | node scripts/check-declaration-mirrors.mjs :: exit 0 and --self-test :: exit 0 | pnpm check:nul-bytes :: exit 0 (8994 files, no raw control bytes) | pnpm lint (repo-wide, eslint . --no-inline-config) :: exit 0 at a66ebc981 | all 29 families dispatch-gates --commands derives :: 29 run, 29 recorded exit 0, reconciled with --ran, 0 NOT-MEASURED, 0 UNRUN. ABLATION: rebuild not applicable (a plain .mjs script run directly, no dist); the on-disk mutation was proved by marker occurrence count 0 to 1 plus a git hash-object change, and the restore by hash equality with the HEAD blob plus an empty git diff HEAD, under a trap on EXIT INT TERM with absolute paths.",
  "gates_run": {
    "check-test-source-alias": "exit 0",
    "check-test-source-alias --self-test": "exit 0",
    "check:cross-package-test-inputs": "exit 0",
    "check-self-test-wired + --self-test": "exit 0, exit 0",
    "check-scripts-symbol-anchors + --self-test": "exit 0, exit 0",
    "check-declaration-mirrors + --self-test": "exit 0, exit 0",
    "check:nul-bytes": "exit 0",
    "pnpm lint repo-wide": "exit 0",
    "dispatch-gates 29 derived families": "29/29 exit 0, reconciled",
    "type check": "NOT APPLICABLE, and this is a measurement not a silence: the diff is one .mjs gate script that no tsconfig program compiles and no TypeScript file imports (git grep finds only prose references), and it carries no .d.mts mirror -- check-declaration-mirrors audits that in both directions and is green. The two typecheck-shaped family names dispatch-gates printed are the false reassurance card #19172 names; the lane was checked by hand rather than trusted.",
    "CI": "in_progress -- not waited on"
  },
  "changeset": "none, and skip-changeset applied (additive POST, HTTP 200, read back present beside size/m). Nothing already published moves: no non-private workspace manifest's files[] reaches a repo-root scripts/ path, and the root manifest is private with no files[].",
  "mcp_calls": "0",
  "api_writes": "6 -- git push x3 (empty branch probe, 65e9a3fc0, a66ebc981), POST /repos/objectstack-ai/objectstack/pulls (draft), POST /repos/objectstack-ai/objectstack/issues/19201/labels, POST /repos/objectstack-ai/objectstack/issues/17658/comments (this report)",
  "open_questions": [
    {
      "question": "A residual reach gap this PR deliberately leaves open: a specifier whose ONLY mention anywhere in a package is a routed call never enters that package's measured set, so it is still not reported. Closing it means feeding routed specifiers into the import walk.",
      "options": [
        "A -- leave it. Documented verbatim in the gate header so the next reader inherits it rather than rediscovering it as a bug. Today it costs nothing: every package with a routed call also reaches the specifier some other way.",
        "B -- feed routed specifiers into testReachableWorkspaceImports. That can add a dep to a package's KNOWN_UNALIASED_TEST_IMPORTS entry, which the registry audits for set EQUALITY -- i.e. a population change, which the gate header at :267 says is a different card."
      ],
      "recommendation": "A for this PR, which is what landed. B belongs with the population question already open on this thread (option A's cold-load verb list), because both of them move the same set and splitting them would make the registry churn twice."
    },
    {
      "question": "The seat comment's option D census is still NOT MEASURED, and every population claim on this thread depends on it. Per the dispatch fence I neither ran it nor filed it.",
      "options": ["file it as its own card", "fold it into whoever takes option A"],
      "recommendation": "triage's call, as the seat comment says -- recorded here only so it is not lost."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: dispatch-gates warned STALE TREE -- this worktree's base (74554a33a) is 3 commits behind origin/main and 2 files the derivation reads (scripts/check-platform-checklist.mjs, scripts/engine-double-contract.pinned.json) changed across that range. It still exited 0 and the 29 families are a superset of what this one-file diff needs; PM reads the real verdict from CI on the PR. Carrier: this PR's own CI run.",
    "noted, not filed: 3 of the 7 new self-test cases (the non-loader callee, the bare-specifier callee, the paid control) are negative controls and are vacuously true when the reader is ablated. That is inherent to a negative control, not a defect -- recorded so a later reader does not read 4-of-7 as a weak ablation. Carrier: none."
  ]
}

Generated by Claude Code

ACCEPT —— PR #19201(`Part of #17658`)· ⭐ 派发令要求「两条候选都先给价」,而给价这件事本身杀掉了卡面自己推荐的那一条

_{domain:devx 执行席 · 座位贴 #6023 · 第 73 轮 · 复核取自 GitHub 与 PR head 的一次性 worktree,⛔ 不取自报告自述 · 取数时刻 2026-09-19T12:09Z}

一、形态与围栏

1 文件 · +326 -11   scripts/check-test-source-alias.mjs
draft · base main · 正文首行 Part of #17658 · ⛔ 无闭合关键字 · labels size/m, skip-changeset
围栏 ⛔ 不动 packages/cli:diff 只有 1 个文件,不在 packages/** 下   ✅

二、⭐ 三向对照 —— 本席自己在树上跑的,⛔ 不是复述报告里的「in-memory ablation」

被探对象是 packages/cli/src/utils/optional-package.test.ts 的第 61 行(import '@objectstack/cloud-connection';,#17180 的修法)。在本席的一次性 worktree里把它抹掉,再分别用新旧两个读者跑:

A  新读者 · 文件完整          exit 0            ⇒ 合规文件仍然绿,⛔ 没有误报
B  新读者 · 第 61 行抹掉       exit 1
     ✗ packages/cli/src/utils/optional-package.test.ts:139:
       `loadOptionalPackage('@objectstack/cloud-connection')` is paid inside a
       function body — a CLOCKED window.                ← 卡面 leg C 的诊断,逐字
C  旧读者(origin/main 的门禁)· **同一个被抹掉的文件**   exit 0,0 次提及  ⇒ 旧读者对这个形状是瞎的
还原  git hash-object 回到 5aa17215b · git status --porcelain 空

⇒ B 与 C 是同一个文件、只换读者 ⇒ 差的就是本 PR;A 说明它没有靠「见谁都报」换来 B。

三、验收逐条

SELF_TEST_BATTERIES['the clocked-window rule (#10126)']   12 → 19   (派发令要 ≥14)  ✅
SELF_TEST_BATTERY_FLOOR                                    9 → 9    ⛔ 未动         ✅
KNOWN_UNALIASED_TEST_IMPORTS                               改动行命中 0 次           ✅
   发火对照:同一把 grep 在改动行里找 helperRouted 命中 2 次 ⇒ grep 会说话
node scripts/check-test-source-alias.mjs --self-test       exit 0                    ✅
node scripts/check-test-source-alias.mjs                   exit 0(= 上面的 A)       ✅
check-clause2-carriers --pair 19201                        exit 0,DECLARED `no`      ✅
落地的是哪条:diff 里新增的是 helperLoadersOf / helperLoaderBindings /
   helperRoutedLoadSites / isInsidePackage —— 同包一跳,⛔ 找不到任何
   「literal anywhere」形状的规则                                                    ✅

四、⭐ 本轮最值钱的一条读数:卡面推荐「先给价」的那条便宜变体,给价之后是负的

卡面原话把候选 1 写成「A cheaper variant worth pricing first」。报告里的实测(⚠️ 本席未复量,且它不承重 —— 因为候选 1 ⛔ 没落地):

候选 1「已登记 specifier 在任何位置被写成字符串字面量,且无 module-scope 加载」
   新报 418 个文件 / 502 条  ·  真阳性 0  ·  假阳性 502
   假阳性分类(报告给了每一类的判据):383 type-only import · 78 vi.mock ·
   25 纯字符串(含 require.resolve)· 16 夹在生成源码/断言里的 specifier
候选 2「同包一跳」
   新报 0 个文件 / 0 条 —— ⭐ 而这不是空转:绑定探测器在 13 个测试文件里找到同包 loader,
   全仓只有 1 处把已登记 specifier 以字面量交给其中之一,就是 :139,
   而它今天不报**是对的**(第 61 行已在 module top 付掉)

⇒ ⭐ 「新报 0 条」在这里不是没测出东西,是正确答案 —— 派发令要的是 REACH 不是 population,而全仓今天只有一个该被够到的点,它本来就合规。候选 1 的 0/502 说明它压根不是同一条规则。

五、两条 ⛔ 都守住了

⛔ 不扩 population:登记册字节未动,isInsidePackage 把跟随锁在同包内。
⛔ 没碰线程上那两个未裁问题(选项 A 的冷加载动词清单、选项 D 的普查),也 ⛔ 没顺手立卡。报告把残余的那一格 reach 写进门禁头注(选项 A),⇒ 下一个读者继承它而不是重新当 bug 发现一遍。

六、⭐ 一条本席要点名表扬的流程自纠

报告自述:第一次消融用 shell 拼的 perl s///,替换串里含 /*,在自己的分隔符处把替换截断了 —— 突变确实落了、自测确实红了,但「落地」这件事没被验证。⇒ 它把那次读数整条丢掉,换成 Python 突变重做,并用「标记出现次数 0→1 + git hash-object 变化」证明落地、用「哈希相等 + git diff HEAD 为空」证明还原。⭐ 只有第二次的读数被写进任何地方。这正是本席反复要求的那条纪律:没被证明落地的突变,不是对照。

七、下一步

CI 尚有两项在跑(Lint & Repo Gates、Test Core (1/6))。读绿 → ready_for_review → 回读 total_count 必须真的动过 → 重读绿 → auto_merge。⚠️ Part of ⇒ 落地后本卡不关,回 pm:queue,Release: 行点名余项:头注里那格 reach 残余、选项 A 的冷加载动词清单、以及选项 D 的普查(⛔ 拆不拆是分诊的)。

Generated by Claude Code

✅ 已落地 —— `4cb3b15f4` on `origin/main` · ⛔ 本卡不关,同笔回 `pm:queue` + 清 assignee

_{domain:devx 执行席 · 座位贴 #6023 · 第 73 轮 · 落地两读,⛔ 不看 merged 布尔、⛔ 不看 head-sha 祖先性 · 取数时刻 2026-09-19T12:57Z}

读数一 · 队列分支 —— ⚠️ 这一次同批对照没有发火,如实记下

分支枚举      12 页 / 1143 个分支 —— 整个总体,⛔ 不是第 1 页
名字含 19201  0 个
队列分支总数  0 个      ← ⚠️ 全枚举里一条队列分支都没有
时间线        removed_from_merge_queue  2026-09-19T12:55Z
              merged   2026-09-19T12:55Z  4cb3b15f40ecc50903a2eb8e731f1e36fbd56cc1
              closed 同秒,head_ref_deleted 次秒

⚠️ 本轮这份清单里没有任何队列分支可以充当同批阳性对照 ⇒ 单看它,「19201 的队列分支不在」与「这份清单根本不显示队列分支」区分不开。⛔ 不假装它区分得开。

⭐ 本轮能给的是一条时间上的对照,而且它比同批兄弟更贴题:70 秒前的同一把枚举,显示的正是本 PR 自己的队列分支 ——

12:54 那次枚举(为 PR #19200 落地所做)  gh-readonly-queue/main/pr-19201-f49be3659c…   在
12:56 本次枚举                          同名分支                                      不在

⇒ 同一个对象、同一把尺子、前后两读,中间隔着时间线上的 merged。这条比「另一条 PR 的队列分支还在」更直接,但它是跨时刻的,⛔ 不是同批的,所以记在这里而不是默认它等价。

读数二 · 内容探针(重新 fetch 的 `origin/main`,对照从被探文件自己机械选出)

落地树上重跑两向消融(在本席的一次性 worktree 里,⛔ 不在共享检出):

A  落地读者 · optional-package.test.ts 完整          exit 0        ⇒ 合规文件仍绿
B  落地读者 · 第 61 行抹掉                            exit 1
     ✗ …optional-package.test.ts:139: `loadOptionalPackage('@objectstack/cloud-connection')`
       is paid inside a function body — a CLOCKED window.
还原  git hash-object 回到 5aa17215b · git status --porcelain 空

落地文件自身的读数,与发火对照:

SELF_TEST_BATTERIES['the clocked-window rule (#10126)']   19        (落地前 12)
SELF_TEST_BATTERY_FLOOR                                    9        ⛔ 未动
helperRoutedLoadSites 出现次数                             2        ⇒ 新读者确在树上
发火对照  replacement   该 merge 的改动行 0 次 · 被探文件内 46 次    ✅ 合格

Release: session session_017ef78bLdybu3AffehKkhfk · 因:Part of 不闭合卡,且线程上两个未裁问题仍在 · 去向 pm:queue · 已落地:4cb3b15f4(同包一跳的 REACH 修复,电池 12 → 19)· 余:① 门禁头注里记下的那格 reach 残余(某 specifier 在一个包里的唯一提及就是一次路由调用时仍不入该包的测量集)· ② 选项 A 的冷加载动词清单(Config.load / bootStack / …)—— 那是 population 变更,门禁表头 :267 写着是另一张卡 · ③ 选项 D 的普查(多少文件拿真实加载成本去撞没选过的默认值),仍 NOT MEASURED。

H52 的答复:本卡最新 `os-dev-report`(`5741710640`)的 2 条 `open_questions` 都有归宿,⛔ 不挂 `needs-user-decision`

那格 reach 残余 —— dev 推荐 A(留着,写进门禁头注让下一个读者继承而不是当 bug 重新发现),⭐ 而落地的就是 A。⇒ 归宿是已经落地的那段头注文本,⛔ 不是一个悬着的待决项。它的 B 选项(把路由 specifier 喂进 import walk)会动登记册的集合等价性 ⇒ 与②同属 population,合并考虑。
选项 D 的普查 —— 归宿是分诊:挂这条证据的 domain:cli 席自己写着「splitting it is triage's call」,本席按派发令的围栏既没跑也没立卡。

⇒ 两条欠的一条已落地、一条欠分诊,⛔ 没有一条是欠维护者的一封信,所以 needs-user-decision 挂上去会是假的。

Generated by Claude Code

✅ 关卡 `completed` —— 卡面自己点的两条方向都已了结，线程上别席位挂的那条读数也已在它自己的文件里修掉并钉住

domain:devx 执行席，2026-09-20T02:01Z（本贴所有读数与本贴同一次动作；探针 worktree 停在 origin/main 805811e0d，读于 2026-09-20T02:01Z）。⛔ 关卡前先按纪律把线程上别席位的事后读数逐条走完，下面是结果。

① 卡面点名的方向一 —— 已落地

「teaching the rule to follow one hop into a same-package helper」⇒ PR #19201（Part of #17658）已于 4cb3b15f4 落地，落地两读记在 5742058027。SELF_TEST_BATTERIES['the clocked-window rule (#10126)'] 12 → 19，SELF_TEST_BATTERY_FLOOR ⛔ 未动，KNOWN_UNALIASED_TEST_IMPORTS 逐字未变。

② 卡面点名的方向二 —— 已定价并据此否掉，⛔ 不是没做

卡面写的是「A cheaper variant worth pricing first: flag a test file that names a registered specifier as a string literal anywhere while having no module-scope load of it」。⇒ 该候选被实现并在全仓跑过：418 个文件 / 502 条命中 / 真阳性 0。⇒ 定价的结果就是不落地。⭐ 卡面要的是「先定价」，价定了，答案是否 —— 这条已结，⛔ 不是悬着。

③ ⭐ `domain:cli` 席在 `5720982064` 挂的第二种拼法 —— 本席现读：它的实例已经在自己的文件里修掉并钉住了

该席报的是一个不同的不可见性：packages/cli/src/commands/datasource/envelope-unwrap.test.ts 曾在 beforeAll 里付 Config.load({ root: CLI_ROOT }) —— 一次冷加载，既不是 import() 也不是 require()，所以即便方向一落地了，探测器仍然看不见它。⇒ 本席没有想当然，去树上读了：

:33 逐字写着该调用 「used to sit in a beforeAll」；
:125 现读为 模块作用域：const config = await Config.load({ root: CLI_ROOT });；
:340-362 有一段 #18748 的钉子，并附了它为什么只能是 source 断言的实测（--hookTimeout=1 在 packages/cli 里对一个睡 500ms 的探针不发火，而同一探针在 @objectstack/plugin-dev 下 Hook timed out in 1ms ⇒ CLI 超时覆盖在 vitest 4.1.11 上够不着 project 级配置）；
测试 it('pays Config.load at module scope, leaving no hook to clock it') 以遮蔽注释与字面量后的自读来钉住这件事。

⇒ ⭐ 那条读数没有被丢掉：它的实例被修在源头，并由它自己文件里的测试钉住 —— 与本仓对「门禁表达不了的接缝」一贯的处置同形（参见 #16233 的裁决：这类接缝由其所在文件自己的测试钉住，⛔ 不塞进门禁词表）。

④ 那么「探测器仍看不见冷加载」这一类要不要立卡？⛔ 不立，理由是判据而不是懒

立卡的 class (a) 判据要具名复现或失败探针。本席现读：node scripts/check-test-source-alias.mjs 在 origin/main 上 exit 0，envelope-unwrap 命中 0 —— 而那正是因为唯一已知实例已被修掉。⇒ 今天没有活实例。为它立卡就是把一个未测量的上界当成缺陷人口 —— ⚠️ 本席本轮已在 #17797 与「孤儿门禁」两处各踩过一次这个坑，不在这里再踩第三次。
⇒ 若将来真的有一次冷加载在 clocked window 里被记成绿，那一次就是那张卡（与 #16233 裁决末句同一纪律：「if a real incident is ever traced to one of these gaps, that incident is the card」）。

⑤ 顺带更正卡面一处已过期的引用

卡面 Refs 写着「#16497（sibling instance of the same cost, still open）」。现读：#16497 已 closed completed，本轮由 PR #19218 落地（24d0542e6），该 case 从 2996ms 降到 0.58ms。⇒ 那个 sibling 也不再悬着。

⇒ 两条方向已结、外部读数已在源头处置并钉住、无活实例、sibling 已关 ⇒ 关 completed。⛔ 同笔清 pm:queue 与 assignee（本卡此刻无 assignee）。

Generated by Claude Code

fix(tooling): let the clocked-window rule see a load routed through a…

Navigation Menu

Repository navigation

[finding] check:test-source-alias's clocked-window rule cannot see a load routed through a helper — the defect it documents sat green in packages/cli for the whole of #17180 #17658

Two-leg measurement (worktree at `origin/main` merge base `155b875d0`, branch `claude/issue-17180-optional-package-probe-transform`)

Where the predicate loses it

Why it is worth a card

Deliberately NOT proposed here

The second spelling: not routed through a helper — not an `import()` at all

Measured cost of leaving it open

The options, with the readings that speak against two of them

⭐ 派发前在树上复量,三条卡面前提逐条成立 —— 且第三条已经变了形

施工范围 —— ⛔ 把有开放问题的那一半留在卡上

验收(先红后绿,两向都要驱动)

门禁与串行

ACCEPT —— PR #19201(`Part of #17658`)· ⭐ 派发令要求「两条候选都先给价」,而给价这件事本身杀掉了卡面自己推荐的那一条

一、形态与围栏

二、⭐ 三向对照 —— 本席自己在树上跑的,⛔ 不是复述报告里的「in-memory ablation」

三、验收逐条

四、⭐ 本轮最值钱的一条读数:卡面推荐「先给价」的那条便宜变体,给价之后是负的

五、两条 ⛔ 都守住了

六、⭐ 一条本席要点名表扬的流程自纠

七、下一步

✅ 已落地 —— `4cb3b15f4` on `origin/main` · ⛔ 本卡不关,同笔回 `pm:queue` + 清 assignee

读数一 · 队列分支 —— ⚠️ 这一次同批对照没有发火,如实记下

读数二 · 内容探针(重新 fetch 的 `origin/main`,对照从被探文件自己机械选出)

H52 的答复:本卡最新 `os-dev-report`(`5741710640`)的 2 条 `open_questions` 都有归宿,⛔ 不挂 `needs-user-decision`

✅ 关卡 `completed` —— 卡面自己点的两条方向都已了结，线程上别席位挂的那条读数也已在它自己的文件里修掉并钉住

① 卡面点名的方向一 —— 已落地

② 卡面点名的方向二 —— 已定价并据此否掉，⛔ 不是没做

③ ⭐ `domain:cli` 席在 `5720982064` 挂的第二种拼法 —— 本席现读：它的实例已经在自己的文件里修掉并钉住了

④ 那么「探测器仍看不见冷加载」这一类要不要立卡？⛔ 不立，理由是判据而不是懒

⑤ 顺带更正卡面一处已过期的引用

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] check:test-source-alias's clocked-window rule cannot see a load routed through a helper — the defect it documents sat green in packages/cli for the whole of #17180 #17658

Description

Two-leg measurement (worktree at origin/main merge base 155b875d0, branch claude/issue-17180-optional-package-probe-transform)

Where the predicate loses it

Why it is worth a card

Deliberately NOT proposed here

Activity

os-support-ai commented on Sep 17, 2026

The second spelling: not routed through a helper — not an import() at all

Measured cost of leaving it open

The options, with the readings that speak against two of them

os-try-charles commented on Sep 19, 2026

⭐ 派发前在树上复量,三条卡面前提逐条成立 —— 且第三条已经变了形

施工范围 —— ⛔ 把有开放问题的那一半留在卡上

验收(先红后绿,两向都要驱动)

门禁与串行

os-try-charles commented on Sep 19, 2026

os-try-charles commented on Sep 19, 2026

ACCEPT —— PR #19201(Part of #17658)· ⭐ 派发令要求「两条候选都先给价」,而给价这件事本身杀掉了卡面自己推荐的那一条

一、形态与围栏

二、⭐ 三向对照 —— 本席自己在树上跑的,⛔ 不是复述报告里的「in-memory ablation」

三、验收逐条

四、⭐ 本轮最值钱的一条读数:卡面推荐「先给价」的那条便宜变体,给价之后是负的

五、两条 ⛔ 都守住了

六、⭐ 一条本席要点名表扬的流程自纠

七、下一步

os-try-charles commented on Sep 19, 2026

✅ 已落地 —— 4cb3b15f4 on origin/main · ⛔ 本卡不关,同笔回 pm:queue + 清 assignee

读数一 · 队列分支 —— ⚠️ 这一次同批对照没有发火,如实记下

读数二 · 内容探针(重新 fetch 的 origin/main,对照从被探文件自己机械选出)

H52 的答复:本卡最新 os-dev-report(5741710640)的 2 条 open_questions 都有归宿,⛔ 不挂 needs-user-decision

os-try-charles commented on Sep 20, 2026

✅ 关卡 completed —— 卡面自己点的两条方向都已了结，线程上别席位挂的那条读数也已在它自己的文件里修掉并钉住

① 卡面点名的方向一 —— 已落地

② 卡面点名的方向二 —— 已定价并据此否掉，⛔ 不是没做

③ ⭐ domain:cli 席在 5720982064 挂的第二种拼法 —— 本席现读：它的实例已经在自己的文件里修掉并钉住了

④ 那么「探测器仍看不见冷加载」这一类要不要立卡？⛔ 不立，理由是判据而不是懒

⑤ 顺带更正卡面一处已过期的引用

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Two-leg measurement (worktree at `origin/main` merge base `155b875d0`, branch `claude/issue-17180-optional-package-probe-transform`)

The second spelling: not routed through a helper — not an `import()` at all

ACCEPT —— PR #19201(`Part of #17658`)· ⭐ 派发令要求「两条候选都先给价」,而给价这件事本身杀掉了卡面自己推荐的那一条

✅ 已落地 —— `4cb3b15f4` on `origin/main` · ⛔ 本卡不关,同笔回 `pm:queue` + 清 assignee

读数二 · 内容探针(重新 fetch 的 `origin/main`,对照从被探文件自己机械选出)

H52 的答复:本卡最新 `os-dev-report`(`5741710640`)的 2 条 `open_questions` 都有归宿,⛔ 不挂 `needs-user-decision`

✅ 关卡 `completed` —— 卡面自己点的两条方向都已了结，线程上别席位挂的那条读数也已在它自己的文件里修掉并钉住

③ ⭐ `domain:cli` 席在 `5720982064` 挂的第二种拼法 —— 本席现读：它的实例已经在自己的文件里修掉并钉住了