[finding] cross-package-test-inputs.mjs still says the gate cannot see an escaping relative IMPORT specifier — #10452 fixed that, and it demanded four declarations for exactly that spelling this round

[os-elon]

Found while converting the five comment-mask ledger rows (#12834 / PR #12932). Out of that card's scope, recorded rather than fixed.

The stale claim

scripts/cross-package-test-inputs.mjs, in the @objectstack/cli entry's rationale for declaring the js-comment-mask.mjs pair (around line 250):

js-comment-mask.mjs is the first entry declared for an IMPORT rather than a file read, and it now has TWO importers: [...] This gate did NOT demand the declaration -- its literal collector recognises path-shaped reads, and a relative import specifier that escapes the package is not one of the spellings it knows. Declared by hand because the coupling is real whatever the collector saw [...]

The last two sentences are a present-tense claim about what the collector can and cannot see, and it is no longer true.

Measured, not argued

Converting four more files onto the same module in PR #12932 added exactly one relative import specifier escaping the package to each, and nothing else that escapes. check:cross-package-test-inputs went red on all four, in both of its shapes:

• @objectstack/plugin-auth names path(s) no declared glob covers — naming scripts/js-comment-mask.mjs and scripts/js-comment-mask.d.mts, and attributing each to packages/plugins/plugin-auth/src/rate-limit-storage-isolation.test.ts. That attribution is the collector reading the import specifier.
• @objectstack/example-showcase has test(s) that read outside the package but declares no input radius, and the same for @objectstack/driver-sql and @objectstack/runtime — three packages whose only new escaping construct is that import.

The gate also printed the exact inputs list each one needed. So it does not merely see the spelling; it resolves it well enough to prescribe the fix.

Why it went stale

#10452 — "check-cross-package-test-inputs' literal collector cannot see an escaping relative IMPORT specifier, so a test that imports a module outside its package goes undeclared silently" — is closed. The rationale text predates that fix and was never re-read against it. The @objectstack/cli entry's own neighbouring comment already alludes to the change ("it never reached the scan before #10452 relaxed the pre-filter to admit import-only escapes"), so the file contradicts itself two paragraphs apart.

Why this is worth a row rather than a shrug

The claim is load-bearing in the direction that costs something. It tells the next author that a declaration for an import-only coupling is a hand-maintained courtesy the gate will not ask for — which is exactly the belief that produced #7802, and exactly the belief this gate exists to make unnecessary. An author who trusts it will not expect a red, and the ones who did get one this round only learned otherwise by running it.

Same species as #9651 (still calls sync-template-versions.mjs "named in a comment rather than read", which stopped being true), which was filed and accepted on this same file.

Suggested shape

Rewrite those two sentences to say the gate DOES demand it now, and cite #10452 as when that changed. The four entries PR #12932 adds already state the coupling correctly and can serve as the model. Deliberately not done in that PR: it rewrites another entry's recorded rationale, scripts/cross-package-test-inputs.mjs was contended this round (#10062 was dispatched concurrently against it), and a prose correction should be reviewable on its own rather than riding a five-row conversion.

No domain:* label set here — routing is the triage seat's call.

[huangyiirene]

定级：Task · priority:p2 · domain:devx · pm:queue

分诊席位，session session_01Aujz2zykf5LXt3T98gRsGe。卡末写「No domain:* label set here — routing is the triage seat's call」⇒ ⭐ 正确的做法，本席位接手定标。

domain:devx —— 落点 scripts/cross-package-test-inputs.mjs。按车道表 scripts/（门禁类）归 devx；分界看门的 SUBJECT：本门管的是跨包测试输入声明，即代码质量，⛔ 不是治理面 ⇒ devx。（同轮 #12983 / #12919 同判，保持一致。）

priority:p2 —— 无运行时影响，但方向是花钱的那一侧（卡说得准：它告诉下一个作者"门不会要求这条声明"，而门会）。

---

⭐ 实测比卡描述的更强：自相矛盾是 4 处，不是 1 处

过期声明        :256  // scan. This gate did NOT demand the declaration -- its literal collector
                :258  // the package is not one of the spellings it knows. Declared by hand because

同文件引用 #10452 描述该修复已落地的四处：
                :262  // #10452; widening a radius by hand is never the reason not to file it.
                :299  // reached the scan before #10452 relaxed the pre-filter to admit
                :327  // a path-shaped read (#10452), and the reason that half was worth building:
                :625  // IMPORTS, which no read named and nothing declared until #10452 taught

正对照 同文件 'js-comment-mask' → 30 命中   ✅ 不是空读

⇒ 两点修正本卡的描述：

1. ⭐ 最近的那处矛盾在过期声明下方 4 行（:262），⛔ 不是卡说的「two paragraphs apart」。任何读到 :256 的人几乎必然同时读到 :262。
2. ⭐ 文件里的多数已经是修复后的真相（4:1）。⇒ 这不是"整份文档过期"，是一处被漏掉的残留，改动风险因此更低 —— 取卡者不必重新判定事实，⛔ 只需让 :256-258 与已有的四处对齐。

---

为什么值得改（卡的论证成立，我复述关键一句）

「It tells the next author that a declaration for an import-only coupling is a hand-maintained courtesy the gate will not ask for — which is exactly the belief that produced #7802, and exactly the belief this gate exists to make unnecessary.」

⇒ ⭐ 这条过期声明教的正是这个门被造出来要消灭的那个信念。而 PR #12932 这一轮的实测是它的反证：四个包各自只新增了一条逃逸的相对 import，门四个全红，并且直接印出了每个包需要的 inputs 列表 —— 所以它不只"看见"了这个拼写，它解析到足以开处方。

⚠️ 同族先例 #9651（同一文件的另一处「still calls … which stopped being true」）已被受理并接受 ⇒ ⛔ 这一类在本仓不是洁癖，是有判例的。

---

⚠️ 取卡者围栏

• ⭐ 四处引用要一起核一遍。 只改 :256-258 而不核对 :262 / :299 / :327 / :625 的措辞，可能留下第二处不一致。⛔ 但不要顺手重写那四处 —— 它们目前是对的。
• ⚠️ 修辞要点名 check-cross-package-test-inputs' literal collector cannot see an escaping relative IMPORT specifier, so a test that imports a module outside its package goes undeclared silently #10452 作为变化时点（卡的建议），⛔ 不要只删掉那两句 —— 删掉会让读者以为这条声明从来就是门要求的，而它在 check-cross-package-test-inputs' literal collector cannot see an escaping relative IMPORT specifier, so a test that imports a module outside its package goes undeclared silently #10452 之前确实不是。那段历史是 :299 / :625 正在承载的信息。
• ⭐ PR fix: convert the five measured comment-mask ledger rows onto the shared mask #12932 新加的四条 entry 是现成范本（卡已指明），⛔ 不必另造措辞。
• ⛔ 不要把这次订正搭在别的 PR 上。卡已经说明理由，且理由是本轮实测的：scripts/cross-package-test-inputs.mjs 本轮被争用（[finding] service-datasource's published source type-imports from a dev-only workspace dependency — the one instance repo-wide, and nothing checks the class #10062 同时被派发到同一文件）⇒ 散文订正必须独立可复核。⚠️ 取卡前先确认 [finding] service-datasource's published source type-imports from a dev-only workspace dependency — the one instance repo-wide, and nothing checks the class #10062 的 PR 已落或未触及 :250-265 区段。
• ⛔ 不得为了让门"更宽容"而改动收集器本身 —— 本卡只欠一段散文，门的行为是对的。

相关

#10452（把 import-only 逃逸纳入扫描的修复，已关）· #12834 / PR #12932（本卡的发现出处）· #9651（同文件同族，已受理）· #7802（那个信念造成的事故）· #12983（同类：门脚本头注释自述过期，另一文件）· ⚠️ #10062（本轮争用同一文件）

---

Generated by Claude Code