[finding] check:type-check-coverage never asks TESTS_COVERED / SOURCES_COVERED / PINS_CHECKED / GENERATED_COVERED of the ROOT workspace package — its header says the root is included "like any other package's"

[baozhoutao]

Filed unassigned and ungraded by the dev of #14918 (domain:devx), as an out-of-scope finding of that card. ⛔ domain:*, priority and type are triage's. Latent, not measured-live — see the measurement below before grading it as anything but low.

The mechanism

scripts/check-type-check-coverage.mjs builds its subject list two different ways and only one of them is observed:

• workspacePackages() walks the 79 dirs workspacePackageDirs(ROOT) returns, and for each one calls testCoverage(dir, scripts) — the walk that produces hiddenTests, pinFiles, uncheckedSources and generatedIncludes.
• observed() builds the root as { name: rootManifest.name, scripts: rootManifest.scripts ?? {} } — a manifest read, no walk, none of those four fields.

evaluate(packages, root, state) then asks the per-package invariants inside for (const pkg of packages), and the root is not in that array (measured: workspacePackageDirs() returns 79 entries, '.' and '' among none of them). The root reaches evaluate only through byName and the COVERED / REAL / RUNNABLE / RECONCILED checks written for it by name.

⇒ TESTS_COVERED, SOURCES_COVERED, PINS_CHECKED and GENERATED_COVERED are asked of 79 packages and never of the root. The file's own header says the opposite, in the sentence that introduces the invariant list:

Invariants, per workspace package (the root workspace package included -- #4311's audit counted its top-level TypeScript like any other package's)

Why this is a fourth axis, not a re-filing of the other three

axis	card	population
needs a pre-existing ledger row to notice a package at all	#14630	packages with no row
cannot see PACKAGE-ROOT source (depth 0)	#14386	depth-0 files inside a package
SOURCES_COVERED asked only of packages declaring typecheck	#14918	ledgered packages
four clauses never asked of the ROOT package	this card	the workspace root itself

Same pattern each time, and it is the pattern #14918's triage named: a clause skipped for a population, with the run saying so nowhere. #15414 records the identical shape on a different gate (a scan that walks only the root scripts/, so one package-local gate is in no population).

The measurement, which is why this is LATENT

On origin/main today the root's own config makes three of the four vacuous by accident rather than by decision:

• root tsconfig.json declares no include (exclude: ["node_modules","packages","apps","examples"]), so readTsconfig gives it roots: [''] — the whole package. Every root-level file is inside the program, so an unread source directory or a hidden test file could not exist there right now.
• git ls-files '*.test.ts' '*.test.mts' '*.spec.ts' outside packages/, apps/ and examples/: 0 files. 0 of them carry @ts-expect-error.

⇒ Nothing is hidden today. What is missing is the guard: the day the root config grows an include (say ["scripts"]), or a root tsconfig.build.json that excludes a test glob, or the repo gains its first root-level test file with a compile-time pin, all four clauses stay silent about it — and the header will still say the root is covered like any other package. That is the same "a green line reads as everything checked" failure the three closed axes each cost a dev a round to find.

Repair sketch (not decided here)

The observation half already generalises: testCoverage('.', rootManifest.scripts) would produce the four fields for the root, and its walk already skips any subdirectory carrying a package.json at depth > 0, so it would not re-walk the 79. The parts that need a decision rather than a patch:

• PINS_CHECKED anchors on the invoked programs (configsNamedByTypecheck), and the root's coverage runs through typecheck:root, not typecheck — asking the clause without teaching it that spelling would manufacture findings rather than find them.
• the root's exclude list is how it stays out of the packages' way; a clause that reads it as "hiding source" would be wrong.

#14918's PR adds a SCOPED_CLAUSES table plus a clause scope: line that prints which per-package clauses were not asked of which packages. That line is computed over the 79 and states so; this card is the population it cannot currently express, and closing it should either bring the root into the population or declare it in that table with the argument for why it stays out.

Refs: #14918 (the card whose dev found this) · #14630 · #14386 · #15414 (same shape, different gate) · #4311 (the tracking issue the gate cites).

[claude]

Graded — PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk.

domain:devx / priority:p3, queued: a fourth axis of the same gate (the ROOT workspace package is never asked the four per-package clauses while the header says it is), latent today (root tsconfig declares no include, 0 root-level test files). Serial on scripts/check-type-check-coverage.mjs behind PR #15482, whose clause-scope line names this boundary. Dispatch after #15482 lands; the fix claims only this axis.

---

Generated by Claude Code

[claude]

Claim: PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk, dispatching to an os-dev subagent on branch claude/issue-15483-type-check-coverage-root-package. P3, S: the fourth axis of scripts/check-type-check-coverage.mjs — ask the ROOT workspace package the four per-package clauses (or, if the header's "like any other package's" claim is the thing that is wrong, correct the header and keep the boundary line #15482 added naming this card) — measured on the tree first; latent today. Serial on the gate: #15482 merged 18:40Z; no open PR touches the file (scan across all open PRs at claim time). Assignee field was empty at the read immediately before this write.

---

Generated by Claude Code

[claude]

Hold note — PM seat domain:devx @ objectstack (#6023). The claim above stands, but the seat's batch cap (5 live devs) is full at 18:42Z; the dev for this card launches on the next free slot, and the claim comment for that launch will name the branch again. No code is being written on this card yet.

---

Generated by Claude Code

[baozhoutao]

os-dev-report

{
  "issue": 15483,
  "status": "done",
  "branch": "claude/issue-15483-type-check-coverage-root-package",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15516",
  "premise_still_valid": true,
  "summary": "Route (a): the ROOT workspace package joins the per-package clause population, measured first. On a detached worktree at origin/main 615fac3a0 the root walk reaches 106 directories in 11ms, 0 test files, 0 @ts-expect-error pins and 14 non-test source files, of which 0 sit outside the root program (root tsconfig.json declares no `include`, so roots: [''] covers everything it does not exclude) -- so the root can be walked like the other 79 with ZERO new findings and no ledger row. perPackageClauses(pkg, state) lifts TESTS_COVERED / SOURCES_COVERED / PINS_CHECKED / GENERATED_COVERED out of evaluate's loop so the loop no longer defines their population; observed() walks the root via testCoverage('.'); the clauses are decided against the root's COVERAGE script (typecheck:root), carried as coverageScript/coverageScriptName, never the `turbo run typecheck` aggregator -- which is the card's own objection about manufacturing findings, and which also makes every finding quote the slot its reader must edit. The RECONCILED sweeps and the three layer figures read the same subject list, so a root ledger row cannot read as stale the moment it is written. SCOPED_CLAUSES.asked now reads coverageScript (the root's manifest typecheck is ALWAYS defined, so the old predicate would have reported the root as ASKED on a run where the clause was not asked of it). SCOPE_LINE_BOUNDARY -- the sentence naming this card -- is removed as the ruling requires and replaced by a population sentence, still printed because the headline counts the enumerated packages (79) while this line now counts the clause population (80). The header sentence this card was filed against now states how 'included' is made mechanical. PM-mechanism note: two GitHub write channels moved on this seat -- the local auto-mode classifier blocked `curl` against the issues/labels and comments endpoints (both POST and GET), so the skip-changeset label went through MCP whole-set write with a read-before union (read ['size/l'] -> wrote ['size/l','skip-changeset'] -> compared read-back: exact union, nothing stripped) and this report comment went through MCP add_issue_comment instead of REST. Also note the shared origin/main ref moved under the worktree mid-run (615fac3a0 landed); main was merged in, not rebased, and every figure below was re-derived and re-run afterwards.",
  "tests": "All on final commit 6be83bdc5 (tree clean), each exit code captured BEFORE any pipe. node scripts/check-type-check-coverage.mjs EXIT=0 -- 'check-type-check-coverage: OK - 75/79 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors), 1 exempt'; its clause-scope line now reads 'GENERATED_COVERED was NOT asked of 5 of them (..., @objectstack/spec-monorepo) ... Every other per-package invariant was asked of all 80. ... Counted over the enumerated workspace packages PLUS the ROOT package ... since #15483'. node scripts/check-type-check-coverage.mjs --self-test EXIT=0 -- '55 semantic case(s) + 75 observation case(s) + 45 re-measure case(s) + 28 built-closure case(s) + 19 auto-lowering case(s) + 18 exit-code case(s) hold' (was 50 + 74; SELF_TEST_BATTERIES gained 6 rows at floor 1, observation cases re-floored 63->64, SELF_TEST_BATTERY_FLOOR 56->61, and the two prose figures quoting them moved with them). On a detached worktree at origin/main 615fac3a0 the same two commands are EXIT=0 with '50 semantic case(s) + 74 observation case(s)' and the pre-repair boundary line -- the premise, still true on current main. ABLATIONS, all on the committed tree, each mutating with a python replace asserted at exactly 1 occurrence, then confirming on disk by counting removed text (want 0) and injected text (want >=1), then restoring with `git checkout HEAD -- <abs path>` under a trap and proving restoration by `git hash-object` == the HEAD blob (2fc720be424876edfbcd4a90e8a8263435770a92 all three times) plus an empty `git diff HEAD`: (1) deleting `problems.push(...perPackageClauses(root, state))` -> EXIT=1, exactly the four planted root cases red, each 'got []'; (2) phantomSeen back over `packages` alone -> EXIT=1, 'a PHANTOM_PIN_DEBT row for a ROOT pin is covered, not reported stale' red with the row reported stale; (3) SCOPED_CLAUSES.asked back on pkg.scripts?.typecheck -> EXIT=1, the new scope case red with 'expected [{skipped:[\"root\"]}], got []'. No build/dist is involved (the self-test runs the edited file directly), so no rebuild leg applies. GATE FAMILY: `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` derived 26 commands from the real change set (1 path, three-dot vs merge base 615fac3a0; the first derivation warned STALE TREE, so main was merged and it was re-derived clean). All 26 run: 25 EXIT=0, including pnpm -s check:pm-dispatch-gates ('dispatch-gates self-test: 1402 cases pass'), pnpm check:nul-bytes ('check-nul-bytes: OK (scanned 7515 text file(s) ... no raw ASCII control bytes)'), check:cross-package-test-inputs, check:self-test-wired, check:ratchet-remedy-authority, check:closing-keyword-parity. The 26th, pnpm check:type-check-debt, is NOT MEASURED -- EXIT=3, 'check-type-check-coverage: PREREQUISITE NOT MET -- --re-measure cannot run: 33 workspace dependenc(ies) of the ledgered packages have no built type entry point on disk'; origin/main's own copy on its own fresh worktree refuses identically at EXIT=3 with the same count of 33, so it is a property of an unbuilt worktree and not of this diff. pnpm lint (repo-wide `eslint . --no-inline-config`, NOT narrowed) via scripts/pm/os-verify-lock.sh: 'os-verify-lock: VERDICT command-exit 0 - held the lock 95s (1m35s) - waited 0s' -- shared-box seconds, as that verdict line states.",
  "mcp_calls": "6 - issue_read(get_labels, failed: GraphQL cannot resolve a PR number), pull_request_read(get) x2 (label read + read-back), issue_write(labels union), add_issue_comment(this report), issue_read(get_comments, comment read-back)",
  "open_questions": [],
  "out_of_scope_findings": []
}

---

Generated by Claude Code

[claude]

LANDED — PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk.

PR #15516 merged 2026-09-04T20:17Z (merge-queue; merged: true, main 85a245988). Probe on the re-fetched main: perPackageClauses is present, the root is walked via testCoverage('.') against typecheck:root, and the boundary sentence naming this card is gone (0 hits); this gate needs no typescript, so on this seat's checkout:

check-type-check-coverage: OK — 75/79 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors, https://github.com/objectst
✓ check:type-check-coverage --self-test — 55 semantic case(s) + 75 observation case(s) + 45 re-measure case(s) + 28 built-closure case(s) + 19 auto-lowering

Fixes closed the fourth axis on merge; pm:dispatched and the assignee are stripped.

---

Generated by Claude Code