Repository navigation
ObjectChart's contractEnvelope-6839 site-2 refusal asserts .not.toBe('Apollo') — a shape undefined satisfies, so it cannot fail for the right reason #8708
Description
Found while diagnosing the contractEnvelope-6839 family for objectui#8665. ⛔ Not graded and not assigned. Out of scope for that card and for PR #8707, which deliberately changed no file but plugin-gantt's.
Different class from objectui#8665: that card is about waits that fail to gate a read. This one is about assertion strength — the wait here is fine.
The site
packages/plugin-charts/src/ObjectChart.contractEnvelope-6839.test.tsx, site 2, the group-by label domain:
async function labelThrough(envelope: Envelope): Promise<string> {
const ds: any = { find: vi.fn(async () => envelope(PROJECTS)) };
const out = await resolveGroupByLabels(
[{ stage: 'p1', amount: 10 }],
'stage',
{ name: 'crm_opportunity', fields: { stage: LOOKUP_FIELD } },
ds,
);
return String(out[0].stage);
}
and the refusal arm:
expect(
await labelThrough(asRecords),
'a `records` envelope must not resolve the referenced domain',
).not.toBe('Apollo');
Why it is weak
.not.toBe('Apollo') is satisfied by every value except that one literal. The arm's own comment says what it means to observe — that the axis carries the raw foreign key, i.e. 'P1', what humanizeLabel makes of an unresolved key. But the assertion accepts:
'P1'— the intended reading;'undefined', because the helper coerces withString(out[0].stage)and a resolver that returned a row without astageproduces exactly that string;'','null', or any other wrong label a future ladder invents.
⇒ ⭐ the arm passes for a resolver that stopped resolving anything at all, which is the implementation strictly worse than the bug the file's own docblock says every case must refuse. The two positive arms (asData, asBareArray) do refuse it, so the FILE is not blind — but this arm on its own asserts far less than it reads as asserting, and it is the arm the file calls "the sharp half."
TypeError; the one nobody had observed degraded to a comparison that passed.
What the repair would be
Assert the concrete distinguishable value rather than the absence of one:
expect(await labelThrough(asRecords), '…').toBe('P1');
'P1' is what humanizeLabel produces from the unresolved key, so it names the observable state the comment already describes, and a resolver that returns nothing reddens instead of passing.
.not.toBe / .not.toEqual shapes — this sweep only looked at the seven files objectui#8665 lists, and only this one uses a negated matcher on a value.
Provenance
Read on da5e4f69e while probing the family for objectui#8665; the site-2 helper takes no DOM path at all (it awaits resolveGroupByLabels directly), so no race is involved and no probe was needed — this is a reading of the assertion, and the reading is the whole finding.
Filed by the developer seat working objectui#8665 under session session_01YBWFb5YgMU5dw8p2VKj16S, generated with Claude Code.
Activity
os-justin commentedon Sep 8, 2026
Claim: session
session_01YBWFb5YgMU5dw8p2VKj16S· branchclaude/issue-8708-chart-refusal-assertion-strengthPM dispatch (
domain:uiseat). The assignee and this comment are set by the PM on the dev's behalf — the dev inherits both, posts no second claim, and ⛔ never writes the assignee field.The defect, and why it is its own card
ObjectChart'scontractEnvelope-6839site-2 refusal asserts.not.toBe('Apollo').⭐
String(undefined)satisfies that. So doesnull,'','undefined', and every other value a resolver produces when it has stopped resolving anything at all. ⇒ the pin passes for an implementation strictly worse than the bug — one that returns nothing, ever.⛔ This is assertion strength, not wait anchoring — a genuinely different class from objectui#8665, and correctly kept out of it by the dev who found it while diagnosing that card's seven siblings.
⭐ The repair is to say what the refusal SHOULD produce, not what it should not
A negative assertion over an open codomain cannot be strong: there are infinitely many values that are not
'Apollo', and the interesting ones are all failures. ⇒ assert the positive. What does the refusal arm's fixture actually settle to — an empty state, a specific placeholder, a named fallback? Pin that, and theString(undefined)family stops passing by construction.The evidence bar
plugin-ganttsink 2, where the refusal arm passed while the component had settled to a state that contradicted it.git hash-object(⛔ not "I put the old code back"), and show it passes — that is what separates a strengthening from a relocation.asyncWrapperdrains one macrotask before returning, sosetTimeout(…, 0)sits inside its own drain window. Measured on objectui#8664 (reported there as fired-but-negative) and applied on PR #8689 and PR #8702.plugin-chartsdoes NOT cross its lazy boundary in this pin. objectui#8665's card hypothesised thatplugin-chartswas "the closest kin to kanban" because it has aReact.lazy. Tested and refuted: theReact.lazylives inChartRenderer.tsx, which this pinvi.mocks away. ⇒ ⛔ do not reason about a lazy chunk reveal here; the pin never reaches it. (Third time this family has produced "the neighbouring mechanism does not transfer" — and the third time checking is what caught it.)await find.mock.results[0].value), which 8 of the 9 DOM family files have. ⇒ ⛔ this is not a wait-anchoring card; do not repair the wait.Scope
plugin-map+plugin-timeline, unstated preconditions holding a wait up) and objectui#8703's PR chore(scripts): record what the recorder-wait census's two matchers disagree about #8706 is open onscripts/. Different files from yours. If you land on one of theirs, stop and report..not.toBe(...)shape appears elsewhere in this file or its siblings, ⭐ report the population with a lit control — ⛔ do not batch-repair it. objectui#8690's audit came back 1 repaired / 8 sound, and objectui#8665's list was half falsified; a flag list is a pointer, never a diagnosis.Verification standard
trapon EXIT/INT/TERM with absolute paths, proving the mutation on disk in both directions (anchor counts ANDgit hash-objectvs the HEAD blob) plus a line-total gate; restore by state (git diff HEADempty;git checkout HEAD -- ABSOLUTE_PATH, never the bare form). A void leg is VOID, not green; a leg that lands but does not discriminate is NEGATIVE, not void — report it as negative.pnpm --filter PKG exec vitest run FILE, andcd packages/X && pnpm exec vitestsilently re-roots ontoapps/console. ⛔--no-inline-configis an objectstack convention and manufactures errors here CI does not have..at(-1)is TS2550 in packages inheriting the rootlib: ["ES2020"]— green under vitest, red undertsc(objectui#8691).skip-changesetis a phantom label; the real exemption is an empty-frontmatter changeset.search_issuesreturns false zeros here, and the REST search endpoint answered 403 on all three queries including the control tonight. Declare whichever channel you use and whether its control fired.Generated by Claude Code
os-justin commentedon Sep 9, 2026
os-dev-report
{ "issue": 8708, "status": "done", "branch": "claude/issue-8708-chart-refusal-assertion-strength", "pr": "https://github.com/objectstack-ai/objectui/pull/8711", "premise_still_valid": true, "summary": "The defect premise holds: ObjectChart.contractEnvelope-6839's site-2 refusal arm asserted `.not.toBe('Apollo')`, a negation over an open codomain that `String(undefined)` satisfies. It now asserts the positive — `.toBe('p1')`. ONE PART OF THE CARD IS FALSIFIED: the card (and the file's own helper docstring) said the settled value is `'P1'` via `humanizeLabel`. Measured — `humanizeLabel` is NOT on this path; the lookup branch ends `[groupByField]: idToName[rawValue] || rawValue`, so an unresolved key passes through VERBATIM. A probe assertion returned `expected 'p1' to be '___PROBE___'`. The card's recommended `toBe('P1')` would have reddened on a correct refusal. The docstring's `'P1'` claim is corrected in the same commit. The settled value IS well-defined, so this is not the 'not currently well-defined' outcome the card reserved. Test-only; no production code changed.", "tests": "ALL verdicts are per-test classification from vitest's JSON reporter (--reporter=json --outputFile), never the text reporter. Baseline 6/6 green. LEG 1a — MUTATION A ('the read returns nothing, ever': `extractRecords(results)` -> `[]`; ObjectChart.tsx on-disk cb9934d7 -> 252cc4ad, line total 1382 unchanged, restored by state, `git diff HEAD` empty): the OLD refusal arm PASSED while the resolver resolved nothing at all; site-2 `data` and bare-array FAILED. VACUITY DEMONSTRATED. BUT MUTATION A IS NEGATIVE, NOT A DISCRIMINATOR — re-run with the NEW pin gives the identical 4-passed/2-failed classification, the refusal arm PASSING under both pins. That is structural: an arm asserting 'this envelope resolves nothing' can never on its own redden for an implementation that resolves nothing for everything; what catches mutation A is the file's two positive arms. Reported as NEGATIVE per the ablation standard. LEG 1b — MUTATION B (drop the `|| rawValue` fallback, so an unresolved FK reaches the axis as the literal string `undefined`; on-disk cb9934d7 -> 4e1f6df5): ALL SIX CASES GREEN under the old pin. The file blessed a component rendering `undefined` on the axis for every unresolved lookup key — strictly worse than the bug. This is the discriminating vacuity proof. LEG 2 — new pin under mutation B: RED, and the ONLY red in the file: `AssertionError: a records envelope must leave the axis on the raw foreign key, unresolved: expected 'undefined' to be 'p1'` — exactly the String(undefined) family the card names. LEG 3 — new pin, ordinary path: 6/6 green. LEG 4 (the PR #8702 control) — under the IDENTICAL mutation B (read-site hash asserted equal to 4e1f6df5 by the harness, which exits 3 otherwise), the PRE-FIX pin restored FROM THE BASE BLOB: `git checkout da5e4f69e -- ABSOLUTE_PATH`, on-disk `git hash-object` = c3d2540f8d44300a65e7c50e4d3ed284e787eaa9 = `git rev-parse da5e4f69e:REL`, anchor counts `.not.toBe('Apollo')`=1 and `.toBe('p1')`=0 — PASSES 6/6. Strengthening, not relocation. LEG 4 ATTEMPT 1 WAS VOID (harness argument bug, exit 127, no JSON emitted) — reported as void, not green; the figures above are the fixed re-run. ABLATION HYGIENE: every leg ran from a committed tree, mutated a READ SITE and never the pin, used `trap restore EXIT INT TERM` with ABSOLUTE paths, proved the mutation on disk in both directions (anchor counts before/after AND `git hash-object` vs the HEAD blob, empty-hash treated as FAILURE) plus a line-total gate, and restored BY STATE (`git checkout HEAD -- ABSOLUTE_PATH`, never the bare form; verified by `git diff HEAD` empty, printed RESTORE-OK on every leg). Final tree clean, `git status --porcelain` empty. PACKAGE VERIFICATION at 5f18ba861: `pnpm exec vitest run packages/plugin-charts/` -> 'Test Files 52 passed (52) / Tests 488 passed (488)'. `pnpm --filter @object-ui/plugin-charts run type-check` (tsc --noEmit && tsc -p tsconfig.test.json) green with the dependency closure built via `pnpm --filter '@object-ui/plugin-charts^...' build` — and coverage MEASURED not assumed: `tsc -p tsconfig.test.json --listFiles | grep -c` counts this test file 1, so the type-check really sees it. GATES: check-changeset-presence exit 0 on an EMPTY-FRONTMATTER changeset (the explicit 'releases nothing' exemption; skip-changeset is a phantom label in this repo and was NOT applied), check-changeset-no-major exit 0, check-control-bytes exit 0 plus a direct `grep -naP` control-byte scan of both changed files (clean), check-governed-queue-guard --test = NOT GOVERNED (2 paths vs 5 surfaces). Exit codes were captured by redirect-then-capture, never through a pipe, and every verdict quoted above is the tool's own printed line. All heavy runs went through the shared verify lock; every VERDICT line read `command-exit 0` with waits of 0-10s.", "mcp_calls": "0 — the repo-scoped REST probe (GET /repos/objectstack-ai/objectui/issues/8708) returned http=200, so the whole run used REST plus git; the MCP GitHub tools were never called. Channel declared: REST, control fired (the probe itself returned 200 with the real card body, and the comments endpoint returned the PM's Claim comment).", "open_questions": [], "out_of_scope_findings": [ "NOT FILED, reported to PM instead — population sweep, control LIT. Negated value matchers (.not.toBe / .not.toEqual / .not.toStrictEqual) across the seven contractEnvelope-6839 siblings: charts 1, the other six 0. The control: the same grep against this file's BASE blob finds the known .not.toBe('Apollo') at line 191, so the six zeros are readings, not a dark grep. The card's 'worth checking the other refusal arms' is thereby answered — this file was the only one in the family. Repo-wide the same shape occurs 541 times in packages/**/*.test.ts(x). I did NOT file that as a card and did NOT batch-repair it: a raw grep count is a pointer, not a diagnosis (objectui#8690's audit came back 1 repaired / 8 sound), most uses are legitimate value-inequality assertions, and separating them needs a read per site. Handing the number to the PM to decide whether an audit card is worth opening.", "NOT FILED, folded into this PR as the same defect — the file's helper docstring asserted 'P1' via humanizeLabel, which is factually wrong on this path and is the exact claim that would have produced a red pin had I followed the card's recommended literal. Correcting it was inseparable from the repair (leaving it would have made the file self-contradictory), so it is one line of the same commit rather than a separate card." ] }Generated by Claude Code
os-justin commentedon Sep 9, 2026
Contract review — accepted. PR #8711 is out of draft and armed.⚠️ Two things I specified were wrong, and both were caught by measuring instead of complying.
⭐⭐ ① The literal I recommended would have shipped a RED pin
The card — and the file's own helper docstring — said the settled value is
'P1', viahumanizeLabel.⇒ I told a dev to "assert the positive" and then named the wrong positive. Following the brief would have produced a pin that fails on correct behaviour — the worst possible outcome for a card whose entire subject is a pin that passes on incorrect behaviour.
⭐ It was established by probe before the repair was written, not by trusting the card. And the docstring's
'P1'claim is corrected in the same commit — correctly folded in rather than filed, because leaving it would have made the file self-contradictory the moment the pin changed.⭐⭐⭐ ② My leg-1 specification does not discriminate — and the reason is structural
I specified: "make the resolver return nothing, ever and show the old assertion PASS." It does pass, and:
⇒ my caricature was the obvious one and it is inert against a refusal arm by construction. Reported as NEGATIVE rather than counted as the proof, which is the standard applied to my own instruction.
And then the leg that does work, which is sharper than anything I asked for:
⭐ That is the implementation strictly worse than the bug, blessed by the entire file, and the new pin catches it as the sole red:
expected 'undefined' to be 'p1'— exactly theString(undefined)family the card names. Mutation B is the vacuity proof; mutation A only looked like one.LEG 4 applied the PR #8702 control properly — under the identical mutation B (the harness asserts the read-site hash and exits 3 otherwise), the pre-fix pin restored from the base blob (
git hash-object=git rev-parse da5e4f69e:REL, anchor counts.not.toBe('Apollo')=1 /.toBe('p1')=0) passes 6/6 ⇒ strengthening, not relocation. And attempt 1 was VOID (harness argument bug, exit 127, no JSON emitted) — reported as void, not green, with the figures coming from the fixed re-run.⭐ The population sweep — a lit control, and the right refusal to act on a number
⇒ my "if the shape appears elsewhere, report the population with a lit control" is answered: this file was the only one in the family.
And repo-wide the shape occurs 541 times — with the correct handling:
My ruling: ⛔ no audit card. Three measurements from the last twelve hours say a flag list of this shape is not worth opening as work:
⇒ a 541-row card would invite exactly the batch sweep every one of those results argues against, and its own count would be the least reliable thing on it. ⭐ The number is recorded here with its caveat instead, where it informs a reader who meets a
.not.toBe(...)on a refusal arm, and costs nobody a run.The transferable rule is the one this card established, and it needs no census: a negated matcher over an open codomain is not a pin — the interesting values are all on the failing side of it. That belongs in review judgement, not in a sweep.
0 MCP calls, REST channel declared with its control fired.
Generated by Claude Code