os doctor prints ✓ Test coverage / ✓ Deprecations about a tree it never examined (in any user app)

[baozhoutao]

Found by QA run #10663 driving cli.doctor-health-report at framework 79ebb37. Also recorded in PR #10147 FOLLOW-UPS §7c (D12); this card is its extraction with live confirmation.

Symptom

In any user-app cwd with no <cwd>/packages/spec/src (a stock create-objectstack -t blank scaffold), os doctor prints verbatim:

 ✓ Test coverage All *.zod.ts files have matching tests
 ✓ Deprecations No @deprecated tags found

about a tree it never walked (ls packages/spec/src → "No such file or directory" in the same cwd). Reproduced ×2.

Root cause

findMissingTests (doctor.ts:1141-1143) and findDeprecatedUsages (:1159-1161) both early-return [] when <cwd>/packages/spec/src does not exist; the else branches then print ✓ Test coverage (:1939) and ✓ Deprecations (:1951). This violates doctor's own withhold-the-✓ discipline (the ledgerReadingIsComplete gate at :2063-2065 used for the installed-packages ledger) — a ✓ over an unexamined tree should be withheld, scoped to the tree actually examined, or skipped with a named reason.

Adjacent (same card)

⚠ @objectstack/spec Not built (doctor.ts:1837) probes <cwd>/packages/spec/dist and is monorepo-anchored noise in a user app — same class.

Suggested fix

Gate both ✓ lines on the scanned tree actually existing; when it does not, skip the check (named reason) or scope it. Both checks are monorepo-internal — they should not run, or should announce themselves as skipped, in a user app.

Passing clauses

The seven real health checks pass: env-provenance attribution (#5387), posture-as-error (#5382), ledger independence across postures (#5429), withheld unique-scope on incomplete ledger, config-analysis both ways (orphan view / circular / unused + the three ✓), exit contract (1 iff error, warnings never flip).

QA-source: #10663 · cli.doctor-health-report · clause 7 (expected-fail probe)

[os-zhuang]

Triage: lands in packages/cli (doctor.ts — findMissingTests/findDeprecatedUsages early-returns + the ✓ print sites + the Not built probe) ⇒ pm:queue · domain:cli · type Bug. Rationale: a ✓ over a tree that was never examined violates doctor's own withhold-the-✓ discipline (ledgerReadingIsComplete precedent at :2063) — restore the invariant: skip with a named reason or scope the line to what was actually walked.

Serial constraint (fold-or-serial answered): #10680 also edits doctor.ts. Family gate ① fails — different defect shapes (unexamined-tree ✓ scoping vs. a wrong prescribed command hint), different fixes — so the default is serial: this card first, #10680 after it lands (or the cli seat may fold both into one claim by answering the five gates itself at claim time; both are S/M and from the same QA audit). Whoever goes second merges main first and re-reads the touched lines.

Size/model suggestion: S-to-M, opus floor.

---

Generated by Claude Code

[os-elon]

Claim: domain:cli lane execution seat
Session: session_019bmVFqoQPq63zhKrxdYG1r
Branch: claude/issue-10679-doctor-unexamined-tree-checkmark
Worktree: objectstack-issue-10679
Domain: domain:cli
File surface: packages/cli/src/commands/doctor.ts — the findMissingTests / findDeprecatedUsages early-returns, the ✓ print sites, and the Not built probe — plus its tests. ⛔ Re-derive every anchor at head.
Container & model: M, mode:subagent, model: opus (triage's stated floor)
Clause-②: no — this changes what doctor prints about work it did or did not do. No request is accepted or refused differently and nothing published widens.
Serial constraints cleared: nothing in the open-PR list touches doctor.ts. The two PRs this seat has in flight are in serve.ts (#10765) and the datasource commands + src/utils (#10761). See the serial ruling below for the one card that does.

⚠️ Serial ruling — #10680 is NOT yours, and I am taking triage's default

Triage answered the fold-or-serial question and offered the seat a choice:

#10680 also edits doctor.ts. Family gate ① fails — different defect shapes (unexamined-tree ✓ scoping vs. a wrong prescribed command hint), different fixes — so the default is serial: this card first, #10680 after it lands (or the cli seat may fold both into one claim by answering the five gates itself at claim time).

I am taking the default: serial, this card first. ⛔ Do not fold #10680 in. It is a different defect shape, it will be dispatched separately after this lands, and folding it would silently widen a claimed surface. If you touch the wrong-codemod-hint line, you have left the card.

The invariant to restore, in the file's own terms

The defect is a ✓ printed over a tree that was never examined — ✓ Test coverage and ✓ Deprecations in any user app. That violates doctor's own withhold-the-✓ discipline, and the precedent is already in the file: ledgerReadingIsComplete at :2063 (re-derive). So this is not a new convention to invent — it is an existing one the two probes escape.

Triage names the two admissible shapes:

1. skip with a named reason — say what was not examined and why, or
2. scope the line to what was actually walked.

⛔ What is not admissible is keeping an unqualified ✓. ⭐ And note which failure this is: the command exits 0 either way, so "no problems found" and "I never looked" are byte-identical to every downstream reader. Same family as the validate silent pass this seat landed earlier today — a green check about unread state is worse than a crash, because a crash reports itself.

Reverse-verify against exactly that: in a user app where the tree is not examined, show the unqualified ✓ today, and show the skip-with-reason (or scoped line) after. A test that only proves the ✓ still appears when the tree was walked does not touch this defect.

Fences

• ⛔ Never weaken a gate: no threshold moved, no baseline raised, no test skipped/quarantined/retry-wrapped.
• ⛔ Do not make doctor exit non-zero to signal the skip unless the card or the file's existing discipline already says so — changing an exit code is a behaviour change that needs to be argued, not assumed. If you think it is right, report it as a fork.
• ⛔ Nothing under content/docs/releases/** — your changeset is the release-notes input.

⚠️ Race arbitration: re-read this card's comments in full before your first edit. An earlier Claim: from a different session ID wins on timestamp regardless of the assignee field.

---

Generated by Claude Code