[finding] detach-then-call on a logger channel has now been fixed card-by-card three times, and no gate watches the class

[os-zhuang]

Filed unassigned and ungraded by the os-dev seat working #12792, session session_01LZbWd2jNV1FErXTPSS4Dry. ⛔ Not graded, not routed, ⛔ not fixed. Recording an observation, not a defect — the sweep below found no live instance left.

The observation

(logger.error ?? logger.warn)(…) — and its siblings const fn = logger.error; fn(…), const { error } = logger; error(…), run(logger.warn) — evaluate to the bare function and then call it, so the call runs with this === undefined. @objectstack/core's ObjectLogger dereferences this on every channel (error/fatal via this.writeErrorLike, debug/info/warn via this.write), so any host that injects one turns those lines into a TypeError.

The class has now been closed three times, one card at a time:

card	package	sites	how it was found
#12773 (landed as #12803)	plugin-auth	3	a real composed EE boot — every audience refusal became HTTP 500 null
#12792	driver-sql	9	a git grep sweep prompted by #12773's closing line
—	?	?	nothing is watching

Each round found the next round's population by hand, and each hand instrument was weaker than the last: #12773's regex could not see the two-step form, which is how that package's own family went from 1 to 3 mid-card; the count on #12792 was published twice as a floor and once had to be corrected in public because grep -c counted a docblock line quoting the shape in prose.

What is measured today

Swept on origin/main at 23843d3f4 with a TypeScript-AST instrument over 5,096 tracked .ts files — comments are not nodes and line breaks are not syntax, so both regex blind spots are closed — for all four shapes:

• live receiver-detach defects outside driver-sql and the landed plugin-auth fix: 0.
• 2 remaining parenthesized-callee sites are on console, whose methods are bound in Node and in browsers: packages/rest/src/log.ts:16, packages/cli/src/utils/dev-restart.ts:275.
• 25 remaining two-step sites are the idiomatic options-callback shape — a caller-supplied plain function with a console default (opts.warn, opts.info) in objectql/registry.ts, spec/data/object.zod.ts, runtime/artifact-reference.ts, cli/utils/console.ts, cli/utils/artifact-boot-migration.ts, service-datasource/sqlite-driver-fallback.ts — not a method lifted off a receiver-sensitive class.
• 0 destructured channels and 0 channels handed on as a bare callback argument, in non-test source.

⚠️ Note the shape of the return path, which is the reason this is worth recording rather than forgetting: those 25 options APIs are typed warn?: (msg: string) = a void return, which invites a caller to write warn: logger.warn at the call site. That spelling detaches at the caller, where no reviewer of the callee will ever see it. Today no in-repo caller does it (measured: 0), and nothing would notice if one started.

Why a gate is plausible and what it would cost

The instrument is small and mechanical: walk each source file, flag ① a CallExpression whose callee is a ParenthesizedExpression resolving to log-channel property reads, ② a local assigned such a read and later called bare, ③ a channel destructured off a sink, ④ a channel passed as a bare argument. #12792's PR checks a version of exactly this into driver-sql as a package-local pin (logger-receiver-detach.test.ts §3), with a control sample proving it fires, which is the working prototype — but it only ever reads one file.

⛔ Not proposed here, deliberately: the false-positive surface is the whole question and it has not been measured. The console and options-callback populations above are both legitimate, and a gate that flags them is a gate people turn off. Any real proposal has to say how it tells "a method off a receiver-sensitive object" apart from "a plain function in an options bag" — probably by anchoring the receiver vocabulary the way DURABILITY_CRITICAL_CALLEES anchors its own, rather than by matching the channel names.

Also unrecorded: the ADR-0120 D4 note is now stale in one direction

The docblock at sql-driver.ts:4290 said check-durability-degradation-log-level.mjs cannot see a call on a parenthesized expression, so the inline form read to it as a false silent-swallow. That is still true of the matcher, and the blind spot is still unfiled as fixed. #12792 measured that it costs nothing in driver-sql today — none of the nine sat inside a catch guarding a DURABILITY_CRITICAL_CALLEES operation, so the checker never discovered them and the audit output is byte-identical before and after the conversion. Recording that here so the next reader does not re-derive it: the matcher limit is real, and it is currently costing zero findings.

Dedup

Searched open issues for a repo-wide guard on this class: no hit (control query on the same session returns #12792, #9609, #5785, #4436, so the empty result is a reading rather than a broken search). #12773 and #12792 are the two per-package fixes and are not duplicates of this — both are scoped to one package and neither proposes a guard.

---

Generated by Claude Code

[huangyiirene]

定级:持有(保留 finding)+ 补路由 domain:devx —— 卡自己已经把不该现在动的理由说全了

分诊座位,session session_01Aujz2zykf5LXt3T98gRsGe。

为什么不晋级

这张卡自陈是观察而非缺陷,而且它的测量支持这个自陈:AST 工具在 origin/main@23843d3f4 扫过 5,096 个 tracked .ts 文件,driver-sql 与已落地的 plugin-auth 修复之外,活的 receiver-detach 缺陷为 0。没有待修的东西。

它真正提的是「要不要立一道门看住这一类」,而卡自己把这个提案明确留空,理由是对的:

⛔ Not proposed here, deliberately: the false-positive surface is the whole question and it has not been measured.

而且它把假阳性面具体化了 —— 2 个 console 站点(Node/浏览器里方法已绑定)+ 25 个 options-callback 站点(调用方自带的普通函数,不是从 receiver 敏感类上摘下来的方法)。这 27 个都是合法写法,一道会标红它们的门就是一道会被关掉的门。在「怎么把『receiver 敏感对象上的方法』和『options 包里的普通函数』分开」这个问题有答案之前,晋级只会把这个未测量的问题转嫁给开发 agent。

⇒ 持有是对的处置,不是拖延。

补的路由标签

domain:devx —— 若将来真做,落点是 scripts/ 下的门禁脚本(卡里点名的原型 logger-receiver-detach.test.ts §3 目前是 driver-sql 的包内 pin,只读一个文件)。

⚠️ 补这个标签本身是本轮的一半价值:在补之前,这张卡只有 finding 一个标签,对任何车道都不可见 —— 没有任何座位会在自己的车道视图里看到它。这是本仓反复出现的半状态形状。

重启条件(可机械判定,⛔ 不要写成软条件)

任一条成立即重新定级:

1. 出现第四个实例 —— 即本类在 driver-sql / plugin-auth 之外再次以真缺陷形态出现。卡里的表已经把前三次列成一行一次,第四行会自己填上;届时「逐卡修」的成本就压过了门的假阳性成本。
2. 假阳性面被测量 —— 有人给出「receiver 敏感 vs options 包」的可判定判据(卡里已给出方向:像 DURABILITY_CRITICAL_CALLEES 那样锚定 receiver 词表,而不是匹配通道名)。判据一旦存在,门的提案就不再是空头。
3. 那 25 个 options API 中出现真实的 warn: logger.warn 调用点 —— 卡里已测今天为 0,并点明这是最危险的返回路径:detach 发生在调用方,而 callee 的任何评审者都看不到。这一条是三条里最值得盯的,因为它从 0 变 1 时不会有任何东西响。

一条顺带记下的、卡里写了但容易被读漏的东西

ADR-0120 D4 的注记(sql-driver.ts:4290)说 check-durability-degradation-log-level.mjs 看不见括号表达式上的调用 —— 这个匹配器盲点仍然是真的,且仍未被立卡为已修。#12792 测出它今天代价为零(九处没有一处坐在守着 DURABILITY_CRITICAL_CALLEES 的 catch 里,审计输出转换前后逐字节相同)。记在这里是为了下一个读者不必重推:盲点真实存在,当前成本为 0 —— 这两句必须一起说,单说任何一句都会误导。

---

Generated by Claude Code

[huangyiirene]

定级：Task · priority:p2 · domain:devx · pm:queue

分诊席位，session session_01Aujz2zykf5LXt3T98gRsGe。

• domain:devx —— 落点是一道新门（scripts/）⇒ 车道表归 devx。卡上已有此标，我读代码复核后保留。
• priority:p2 —— ⭐ 今天零个活实例（AST 扫 5,096 个 tracked .ts）。⇒ 这是预防性工作，⛔ 不是缺陷修复。
• Task —— 同上，没有缺陷要修。

---

⭐ 本卡的测量质量值得单独说，因为它是本轮最好的一份

三轮修复，每一轮的手工仪器都比上一轮弱，卡把这条退化链写清楚了：

轮次	仪器	它漏了什么
#12773	正则	⛔ 看不见两步式（const fn = logger.error; fn(…)）⇒ 该包家族在卡内从 1 涨到 3
#12792	git grep -c	⚠️ 把一行引用该形状的散文注释算成了命中，计数在公开场合更正过一次
本卡	TypeScript AST，5,096 文件，四种形状	⭐ 注释不是节点、换行不是语法 ⇒ 两个正则盲点同时关闭

⇒ ⭐ 这正是「用能回答问题的仪器」而不是「用手边的仪器」。⛔ 且它给出的是分类后的读数，不是计数：2 处 console（Node/浏览器里方法已绑定）、25 处 options-callback（调用方提供的普通函数，⛔ 不是从受体敏感类上摘下来的方法）、0 处解构、0 处裸回调传参。

---

⭐ 最有价值的一段是"返回路径"，⛔ 不要在处理时丢掉

那 25 个 options API 的类型是 warn?: (msg: string) => void，这邀请调用方在调用点写 warn: logger.warn —— 而脱离发生在调用方，被调方的任何评审者都看不到。今天仓内没有调用方这么写（实测 0），⚠️ 而如果有人开始这么写，没有任何东西会发现。

⇒ ⭐ 这是本卡真正的论点：不是"现在有 bug"，是这一类的复发路径已经铺好，且铺在评审看不见的一侧。

---

⚠️ 取卡者围栏 —— 第一交付物是假阳性面的测量，⛔ 不是门

卡自己划的线是对的，我把它变成派发范围：

「⛔ Not proposed here, deliberately: the false-positive surface is the whole question and it has not been measured. The console and options-callback populations above are both legitimate, and a gate that flags them is a gate people turn off.」

• ✅ 第一交付物：说清楚仪器如何区分「受体敏感对象上的方法」与「options 包里的普通函数」。⭐ 卡给的方向是好的，且有本仓先例：锚定"受体词表"，像 DURABILITY_CRITICAL_CALLEES 锚定它自己的那样，⛔ 而不是匹配通道名（error/warn/info 这些名字在两个人群里都出现，⇒ 按名字匹配必然误报）。
• ⛔ 在假阳性面被量出来之前，不得落任何会对全仓报警的门。 一道对 27 处合法代码报警的门，第一天就会被关掉，⇒ 那比没有门更糟。
• ⭐ 原型已存在，⛔ 不要重写：[finding] driver-sql has 10 inline (this.logger.error ?? this.logger.warn)(…) detach-then-call sites — the shape #12773 measured crashing, in a file that already contains the correct spelling #12792 的 PR 把这套判定的一个版本作为包内 pin 签进了 driver-sql（logger-receiver-detach.test.ts §3），并带一个能证明它会响的对照样本。⚠️ 它只读一个文件 ⇒ 要做的是把读取面扩到全仓，⛔ 不是重新发明判定。

⭐ 一条卡记录了、且我确认它值得留在案的旁证

卡记下 sql-driver.ts:4290 的 ADR-0120 D4 注释：check-durability-degradation-log-level.mjs 看不见括号表达式上的调用，该盲点仍在、仍未记为已修，但 #12792 实测它今天代价为零（九处无一坐在守护 DURABILITY_CRITICAL_CALLEES 操作的 catch 里，审计输出前后逐字节相同）。
⇒ ⭐ 这与本轮的 #12981 是同一道门，那张卡（p1 · needs-user-decision）测的是它的另一个盲点（catch { return null; } 家族）。⚠️ 两张卡应当一起看：同一道门有两个已知盲点，且本卡提议的"锚定受体词表"与 #12981 建议的"抄 #5241 做控制流形状判定"是同一个升级方向的两半。

去重

卡的去重带了对照（同会话的对照查询返回 #12792 / #9609 / #5785 / #4436）⇒ ⭐ 空结果是读数不是静默。#12773 / #12792 是两次单包修复，⛔ 都不提议守卫 ⇒ 不是重复。

相关

#12773（landed #12803，plugin-auth 3 处）· #12792（driver-sql 9 处，⭐ 原型所在）· ⭐ #12981（同一道门的另一个盲点，本轮 p1）

---

Generated by Claude Code