The scoped bare-reference walk in `test/assignment-fanout.test.ts` passes on a real bare reference

[os-warren]

Found while implementing #29. Filed unassigned. No shipped metadata is affected — duly_assignment_fanout is correct today, and #29's test/flow-predicates.test.ts now covers this ground soundly. This is about the older, weaker assertion left behind.

The assertion

test/assignment-fanout.test.ts, in "every predicate qualifies its record reads with record.":

const bare = new RegExp(`(^|[^.\\w])${field}\\b`);
if (bare.test(source)) {
 expect(source, `${where} reads '${field}' bare — write record.${field}`)
 .toContain(`record.${field}`);
}

It detects the bare occurrence correctly, then asks whether the source string contains record.<field> anywhere. Those are different questions. A predicate that reads a field both ways satisfies the toContain and passes:

condition: P`status == "dispatched" && record.status != "cancelled"`

bare.test matches on the leading status, toContain('record.status') is true because of the second clause, and the assertion passes with a genuine bare reference in the predicate. Same for any compound predicate where one clause is qualified and another is not — which is the realistic shape, since a predicate grows a clause at a time and only the new clause gets written wrong.

Two smaller consequences of the same toContain shape:

• It reports at most one field per predicate, so status == "x" && due_date != null is one finding, not two.
• It cannot say which occurrence was bare, so the message points at the predicate rather than the read.

Why it is not urgent

test/flow-predicates.test.ts (#29) checks per-identifier rather than per-source, over dulyFlows rather than one flow, and recurses into region bodies via collectFlowGraphs. It flags the case above:

duly_assignment_fanout · node 'start' config.condition: reads 'status' bare — write record.status

So the repo is covered. What remains is a weaker duplicate assertion sitting next to the strong one, which is a maintenance hazard rather than a live hole: a reader who finds the scoped version first may believe the coverage is thinner than it is, or "fix" a future finding by qualifying one clause.

Suggested fix

Delete the scoped assertion from test/assignment-fanout.test.ts and let test/flow-predicates.test.ts own the rule. It was written before the repo-level walk existed and its own comment says so ("this is the only gate on the house rule"), which is no longer true.

Left alone in #29 deliberately: that card's declared file surface was AGENTS.md and test/flow-predicates.test.ts, and test/assignment-fanout.test.ts belongs to another card's PR.

Note for whoever picks this up: both files go away or shrink when objectstack-ai/objectstack#14089 lands and pnpm validate covers bare identifiers itself.

[os-warren]

Claiming this.

• Session: session_01SqkTcrxUFci7nqXdbBSe2p
• Branch: claude/issue-37-bare-reference-walk

Declared file surface (will amend here if it grows): test/assignment-fanout.test.ts, .changeset/*.md.

---

Generated by Claude Code

[os-warren]

{
 "issue": 37,
 "status": "done",
 "branch": "claude/issue-37-bare-reference-walk",
 "pr": "https://github.com/objectstack-ai/duly/pull/77",
 "premise_still_valid": true,
 "summary": "Confirmed the premise by reproduction, then deleted the scoped bare-reference walk from test/assignment-fanout.test.ts and corrected the file header, which still claimed this file was the only gate on the house rule for flows. test/flow-predicates.test.ts strictly dominates the deleted walk (per identifier vs per source, all of dulyFlows vs one flow, declared-variable exemption, region recursion via the platform's collectFlowGraphs, plus self-tests pinning that it can fail), so no coverage was lost — measured, not assumed. Also checked for sibling copies of the defect: test/task-actions.test.ts:196-207 has a similar walk but asserts bare.test(source) === false per field per source, so it has no toContain escape hatch and does fail on a compound predicate; left alone. NO CHANGESET was added and the dispatch asked for one — this repo has no changeset mechanism to add to (no .changeset/ now or anywhere in git log --all, no @changesets/* dependency, no changeset script, no mention outside node_modules, CI runs only the four gates, and AGENTS.md 'Landing your work' lists those four and never mentions a changeset). Creating the directory would mint a mechanism nothing reads that the next agent would take for real, so I flagged it instead of deciding quietly; the change is test-only with no user-visible surface in any case.",
 "tests": "All four gates green at 0cacc78 (the PR head, tree clean), each exit code captured before any pipe and each verdict quoted from the gate's own output: pnpm validate -> '✓ Validation passed (339ms)', VALIDATE_EXIT=0 · pnpm typecheck -> no output, TYPECHECK_EXIT=0 · pnpm test -> 'Test Files 20 passed (20) / Tests 535 passed (535)', TEST_EXIT=0 · pnpm build -> '✓ Build complete (559ms)', BUILD_EXIT=0. Count moves 536 -> 535: one assertion removed, none broken. REPRODUCTION (before touching the walk), mutating src/flows/assignment.flow.ts start condition to the issue's exact shape `status == \"dispatched\" && record.status != \"cancelled\"`, every mutation and its measurement inside ONE shell call so the restore could not intervene: mutation confirmed on disk by grep -F -c in both directions (old_present=0, new_present=1) plus the git diff of the changed line, never by the editor's exit code; restore by cp from a byte-copy taken before the edit, verified byte-identical with sha256sum and by an empty git status --porcelain. Readings — (A) the walk under test in isolation, `npx vitest run test/assignment-fanout.test.ts -t 'every predicate qualifies its record reads'`: PASSES, EXIT=0, 1 passed | 27 skipped. That is the defect: bare.test matches the leading `status`, then toContain('record.status') is satisfied by the second clause. (B) the realistic form — all four predicates in this flow are also exact-equality-pinned in the same file, so an author who grows a clause updates that literal pin; doing both gives 28/28 PASSED, EXIT=0, with a genuine bare reference shipped. (C) same tree, test/flow-predicates.test.ts: FAILS with `duly_assignment_fanout · node 'start' config.condition: reads 'status' bare — write record.status`. (D) pnpm validate on the mutated tree: EXIT=0, correct per AGENTS.md rule 4 (flow conditions are flattened scope), which is why the repo-local gate is load-bearing on this surface. POST-FIX, same mutation as (B) through the full suite: 'Test Files 1 failed | 19 passed (20) / Tests 1 failed | 534 passed (535)', red through exactly one guard, the right one — what was 28/28 green before the fix. No ablation needed a rebuild: duly's tests import TypeScript sources directly through vitest, there is no dist/ resolution in this repo's test path.",
 "open_questions": [
 {
 "question": "The dispatch required a changeset; duly has no changeset mechanism at all. Should one be introduced, or is the four-gate CI the whole contract here?",
 "options": [
 "A — land as is, no changeset. The change is test-only and non-user-visible; the repo has never had .changeset/ and AGENTS.md's 'Landing your work' lists only validate/typecheck/test/build.",
 "B — create .changeset/*.md in this PR. Mints a directory no tool in this repo reads, which the next agent will read as a live mechanism and start maintaining.",
 "C — adopt changesets properly as its own card: add @changesets/cli, config, a release workflow, and a line in AGENTS.md, then require them."
 ],
 "recommendation": "A for this PR, and C only if the maintainer actually wants release notes compiled here. B is the one to avoid — a mechanism that exists as a convention but not as tooling is how a repo grows a rule nothing enforces, which is the same failure class as the card I just fixed."
 }
 ],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

[os-warren]

os-dev-report

Supersedes the previous comment: the HTML-comment marker on it was eaten by GitHub's body sanitizer after the write landed, so that copy is invisible to a marker scan. Same JSON, unchanged, with the marker as literal text this time.

{
 "issue": 37,
 "status": "done",
 "branch": "claude/issue-37-bare-reference-walk",
 "pr": "https://github.com/objectstack-ai/duly/pull/77",
 "premise_still_valid": true,
 "summary": "Confirmed the premise by reproduction, then deleted the scoped bare-reference walk from test/assignment-fanout.test.ts and corrected the file header, which still claimed this file was the only gate on the house rule for flows. test/flow-predicates.test.ts strictly dominates the deleted walk (per identifier vs per source, all of dulyFlows vs one flow, declared-variable exemption, region recursion via the platform's collectFlowGraphs, plus self-tests pinning that it can fail), so no coverage was lost — measured, not assumed. Also checked for sibling copies of the defect: test/task-actions.test.ts:196-207 has a similar walk but asserts bare.test(source) === false per field per source, so it has no toContain escape hatch and does fail on a compound predicate; left alone. NO CHANGESET was added and the dispatch asked for one — this repo has no changeset mechanism to add to (no .changeset/ now or anywhere in git log --all, no @changesets/* dependency, no changeset script, no mention outside node_modules, CI runs only the four gates, and AGENTS.md 'Landing your work' lists those four and never mentions a changeset). Creating the directory would mint a mechanism nothing reads that the next agent would take for real, so I flagged it instead of deciding quietly; the change is test-only with no user-visible surface in any case.",
 "tests": "All four gates green at 0cacc78 (the PR head, tree clean), each exit code captured before any pipe and each verdict quoted from the gate's own output: pnpm validate -> '✓ Validation passed (339ms)', VALIDATE_EXIT=0 · pnpm typecheck -> no output, TYPECHECK_EXIT=0 · pnpm test -> 'Test Files 20 passed (20) / Tests 535 passed (535)', TEST_EXIT=0 · pnpm build -> '✓ Build complete (559ms)', BUILD_EXIT=0. Count moves 536 -> 535: one assertion removed, none broken. REPRODUCTION (before touching the walk), mutating src/flows/assignment.flow.ts start condition to the issue's exact shape `status == \"dispatched\" && record.status != \"cancelled\"`, every mutation and its measurement inside ONE shell call so the restore could not intervene: mutation confirmed on disk by grep -F -c in both directions (old_present=0, new_present=1) plus the git diff of the changed line, never by the editor's exit code; restore by cp from a byte-copy taken before the edit, verified byte-identical with sha256sum and by an empty git status --porcelain. Readings — (A) the walk under test in isolation, `npx vitest run test/assignment-fanout.test.ts -t 'every predicate qualifies its record reads'`: PASSES, EXIT=0, 1 passed | 27 skipped. That is the defect: bare.test matches the leading `status`, then toContain('record.status') is satisfied by the second clause. (B) the realistic form — all four predicates in this flow are also exact-equality-pinned in the same file, so an author who grows a clause updates that literal pin; doing both gives 28/28 PASSED, EXIT=0, with a genuine bare reference shipped. (C) same tree, test/flow-predicates.test.ts: FAILS with `duly_assignment_fanout · node 'start' config.condition: reads 'status' bare — write record.status`. (D) pnpm validate on the mutated tree: EXIT=0, correct per AGENTS.md rule 4 (flow conditions are flattened scope), which is why the repo-local gate is load-bearing on this surface. POST-FIX, same mutation as (B) through the full suite: 'Test Files 1 failed | 19 passed (20) / Tests 1 failed | 534 passed (535)', red through exactly one guard, the right one — what was 28/28 green before the fix. No ablation needed a rebuild: duly's tests import TypeScript sources directly through vitest, there is no dist/ resolution in this repo's test path.",
 "open_questions": [
 {
 "question": "The dispatch required a changeset; duly has no changeset mechanism at all. Should one be introduced, or is the four-gate CI the whole contract here?",
 "options": [
 "A — land as is, no changeset. The change is test-only and non-user-visible; the repo has never had .changeset/ and AGENTS.md's 'Landing your work' lists only validate/typecheck/test/build.",
 "B — create .changeset/*.md in this PR. Mints a directory no tool in this repo reads, which the next agent will read as a live mechanism and start maintaining.",
 "C — adopt changesets properly as its own card: add @changesets/cli, config, a release workflow, and a line in AGENTS.md, then require them."
 ],
 "recommendation": "A for this PR, and C only if the maintainer actually wants release notes compiled here. B is the one to avoid — a mechanism that exists as a convention but not as tooling is how a repo grows a rule nothing enforces, which is the same failure class as the card I just fixed."
 }
 ],
 "out_of_scope_findings": []
}

---

Generated by Claude Code