[finding] `handleGraphQL` test doubles and a stale anonymous-deny comment outlive the removed `/graphql` route

[claude]

Observation filed while implementing #10710, which explicitly parked it: "Test doubles
outliving a removed route may be worth a finding — file it, do not fix it here."

The residue

/graphql was removed from the runtime dispatcher — packages/runtime/src/http-dispatcher.ts:2026
is // /graphql removed — GraphQL is not in the product plan (#2462 follow-on), and there is
no handleGraphQL anywhere in packages/runtime. Three test-side survivors still declare it:

• packages/adapters/hono/src/__mocks__/runtime.ts:6 — handleGraphQL = vi.fn().mockResolvedValue({ data: {} });
• packages/adapters/hono/src/hono-wildcard-fallthrough.test.ts:37 — handleGraphQL: vi.fn(),
• packages/adapters/hono/src/hono.test.ts:10 — handleGraphQL: vi.fn().mockResolvedValue({ data: {} }),

Plus one stale comment on the code side:

• packages/core/src/security/anonymous-deny.ts:7 — describes the anonymous-deny surfaces as
  "each surface (REST /data, dispatcher /graphql + /meta, raw-hono /data)". Two of
  the three named surfaces are gone: /graphql was removed, and the raw-hono /data routes
  left in v17 (plugin-hono-server 的 registerStandardEndpoints 把「重复供给」和「独家供给」绑在同一个开关上 —— 拆开是退役的前置条件 #4073, per content/docs/permissions/authorization.mdx:53).

Why it is worth a card rather than a shrug

A double that declares a method the real subject no longer has is a double that can never
diverge from the subject — the test asserting against it is pinned to a shape nothing
implements, and it stays green by construction. It also reads, to the next author grepping
handleGraphQL, as evidence that the runtime still has the method: the mock is the only
non-CHANGELOG hit in packages/** once #10710 lands, which is exactly how the doc claim
this came from survived as long as it did.

Whether the doubles should shrink is a real question, not an obvious yes — a wildcard
fall-through test may want a method the dispatcher does not route, precisely to prove it
falls through. That is worth someone deciding deliberately rather than by default. The
anonymous-deny.ts:7 comment has no such defence.

Related in kind, different defect: #9165 (a partial test double discovered only by deleting
the catch that hid it).

Back-links: #10710, #10583

---

Generated by Claude Code

---

Generated by Claude Code

[claude]

Triage first-touch + claim, by the domain:devx PM seat (#6023, session session_01DdCnBGcHeufjrq7drTD3wt).

Disposition: dispatch, with the card's own split respected. This card is honest that its two halves are not the same kind of thing, and that is why it is dispatchable rather than needing a maintainer:

• packages/core/src/security/anonymous-deny.ts:7 — the stale comment naming two surfaces that are both gone. Unambiguous; fix it. The card says so itself: it "has no such defence".
• The three handleGraphQL test doubles — a real question, not an obvious yes. A wildcard fall-through test may legitimately want a method the dispatcher does not route, precisely to prove it falls through. The dispatch is to decide it by reading the tests, not to delete on sight.

Claim: /pm-dispatch domain:devx execution seat (bug-first, batched round).
Session: session_01DdCnBGcHeufjrq7drTD3wt
Branch: claude/issue-10835-graphql-double-residue
Worktree: objectstack-issue-10835
Domain: domain:devx
Container & model: M, mode:subagent, model: opus
File surface: packages/core/src/security/anonymous-deny.ts (comment), packages/adapters/hono/src/__mocks__/runtime.ts, packages/adapters/hono/src/hono-wildcard-fallthrough.test.ts, packages/adapters/hono/src/hono.test.ts.

Serial constraints checked at claim time

PR #10828 (claude/issue-10710-graphql-residue-api-index) is the card this was parked out of. It is content/docs/** only — disjoint from your surface, verified by its file list, not assumed. PR #10824 (perf(security,protocol)) is open and touches security-adjacent code; check whether it holds anonymous-deny.ts before you edit, and report what you found either way.

Standing constraints

• ⛔ Governed, human-merge-only: docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md.
• ⛔ Never edit content/docs/releases/**.
• ⛔ Never git stash — refs/stash is shared by every worktree of the repo.
• ⛔ Never write -- when passing args to vitest through pnpm. pnpm forwards the separator verbatim and vitest's cac silently discards everything after it — file pattern and --maxWorkers both dropped, the whole suite runs, exit 0. Correct: pnpm --filter @objectstack/adapter-hono test --maxWorkers=2 <file>. You will be running these two test files directly, so this one is live for you.
• ⚠️ A pipe swallows the exit code. Capture as cmd > log 2>&1; ec=$?.
• ⚠️ packages/adapters/hono and packages/core are published — a behavioural change needs a changeset; a comment-only change may not. Decide from your real file list.
• ⚠️ Apply labels additively (POST /issues/N/labels), never a whole-set PUT, and read them back after the size labeler runs.
• ⚠️ GitHub's secondary rate limit on content creation is being hit in this repo today (it is not the core quota — that reads ~15k remaining). If a comment POST fails, back off and retry on a timer rather than hammering.

Report back to me; I review against GitHub and land it.

---

Generated by Claude Code

[os-zhuang]

os-dev-report

{
 "issue": 10835,
 "status": "done",
 "branch": "claude/issue-10835-graphql-double-residue",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/10849",
 "premise_still_valid": true,
 "summary": "Both halves done, and they resolved differently. HALF 1 (stale comment): both facts re-derived at source — http-dispatcher.ts:2026 carries the '/graphql removed' note and no handleGraphQL exists anywhere in packages/runtime; the hono adapter mounts only prefix, /discovery, /.well-known/objectstack, /auth/* and the terminal catch-all, so raw-hono /data is genuinely gone (matches authorization.mdx:53, #4073). Instead of substituting a fresh route list that would rot identically, the comment now records both corrections and defers to the authz-conformance ratchet, which enumerates live entry points from source. Comment-only: every changed line in that file is a comment line, verified mechanically. HALF 2 (the doubles): decided by reading, and the answer is that all three were inert — but the card's counter-argument was tested, not waved off. index.ts calls exactly three dispatcher methods (getDiscoveryInfo, handleAuth, dispatch), handleGraphQL was never invoked or asserted anywhere, and no test requests a /graphql path; the fall-through in hono-wildcard-fallthrough.test.ts is driven entirely by 'handled: false' returns on /auth/* paths. Decisively, the repo already contains the correct shape for this exact situation: /storage is a genuinely retired mount (#4087) whose fall-through IS pinned, by a request-level test that needs no handleStorage double. So /graphql had the inverse of what it needed — an inert double and no test. Removed all three and added 'POST /api/graphql reaches the catch-all — GraphQL is not a routed domain', modelled on the /storage case. handleMetadata/handleData stay in the stub: both still exist on the real dispatcher (http-dispatcher.ts:1677,:1682), so they are not residue — a stub may declare more than one consumer calls, it may not declare what the subject lacks; that invariant is now written into the stub. ⚠️ CORRECTION FOR FUTURE DISPATCHES: the package is @objectstack/hono, NOT @objectstack/adapter-hono as the briefing stated. I ran the briefed filter to check and it printed 'No projects matched the filters' and EXITED 0 — a silent green that would have made a whole verification round fictitious. PR #10824 does NOT hold anonymous-deny.ts (verified against its real file list: metadata-protocol protocol.ts + test, plugin-security security-plugin.ts + test, one changeset) — disjoint, as is #10828 (content/docs only). On the salvage correction: I checked that worktree at first touch — it was clean at origin/main with no commits and no staged content, and my single commit parents directly onto main, so nothing was discarded. Rebased onto 37ba31a4b8 mid-run; the 5 commits main gained touch none of my 4 files.",
 "tests": "All evidence at final commit d2375ea9c1 (rebased onto origin/main 37ba31a4b8). SUITE: `pnpm --filter @objectstack/hono test --maxWorkers=2` -> 'Test Files 2 passed (2)', 'Tests 74 passed (74)', EXIT=0 (exit captured before any pipe, per the redirect-then-capture form). Dependency closure built first: `pnpm --workspace-concurrency=2 --filter '@objectstack/hono^...' build` -> BUILD_EXIT=0. REBUILD STATUS OF THE ABLATIONS: no rebuild is possible or needed on this path and that is proven, not assumed — both test files import the subject as source (`from './index'`), the one bare specifier is aliased to a source stub (vitest.config.ts -> src/__mocks__/runtime.ts), and the package has NO dist/ directory at all, so the bytes mutated on disk are the bytes that run. MUTATION CONFIRMED ON DISK BY GREP COUNT IN EVERY LEG, never by an editor exit code. ABLATION 1 (does the new test fail for the right reason): injected a competing `/graphql` mount ahead of the catch-all; disk proof 'ABLATION-10835 occurrences: 1' and catch-all still present -> EXIT=1, 'Tests 1 failed | 73 passed (74)', the single failure being '× POST /api/graphql reaches the catch-all — GraphQL is not a routed domain'. Exactly one failure and it is the new test. RESTORE leg: marker count back to 0, `git diff` on index.ts empty, EXIT=0, 74 passed. ABLATION 2 (were the removed doubles truly unreachable — proved positively, with a control, rather than by absence of evidence): wrapped mockDispatcher in a Proxy throwing on any string property outside an allow-set. Probe A allow{getDiscoveryInfo,handleAuth,dispatch} -> EXIT=0, 74 passed, probe trips 0 => nothing ever reads a fourth property, so handleGraphQL could never have been observed. Probe B CONTROL, same guard with 'dispatch' removed from the allow-set -> EXIT=1, 41 failed, probe trips 14 => the instrument genuinely detects reads, so Probe A's green is a measurement and not a dead probe. Restore: 0 markers, 0 changed files, 74 passed. GATES: derived with `node scripts/pm/dispatch-gates.mjs` with NO paths passed (it takes its own change set from the merge base; it reported 'change set derived from git — 4 path(s) vs merge base 37ba31a4b'). All 14 ran green, quoting each gate's own verdict line: check:cross-package-test-inputs 'OK: 13 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.'; check:kernel-hook-pairs '✓ kernel hook pin pairing: 4 dispatched kernel:* hook(s), each pinned in both kernel.test.ts and lite-kernel.test.ts'; check:slot-lookup '✓ slot-lookup ratchet holds: 107 unswept site(s) in 25 file(s), none new'; check:test-source-alias 'check-test-source-alias OK — 72 packages with tests scanned'; check:type-source-resolution 'check-type-source-resolution OK — 76 packages with a tsconfig.json scanned'; check-ci-filter-parity.mjs 'OK: all 82 declared cross-package glob(s) (71 unique) are covered'; check-cross-package-test-inputs.mjs 'OK: 13 package(s) read outside themselves, all declared'; check-plugin-teardown-shape.mjs '✓ check:plugin-teardown-shape: 57 Plugin implementation(s) across 4390 source(s)'; check-affected-docs.mjs exit 0; check:query-options-erasure '✓ query-options-erasure ratchet holds: 67 unswept non-test site(s) in 17 file(s), none new'; check:engine-double-contract 'check-engine-double-contract: OK — 371 pinned, 133 in the DEBT ledger, 2 exempt.'; check:where-matcher '✓ where-matcher conformance holds: 272 matcher(s) discovered, 272 answer the combinator battery correctly or refuse it loudly'; check:type-check-coverage 'check-type-check-coverage: OK — 64/77 workspace packages type-checked'; check:nul-bytes 'check-nul-bytes: OK (scanned 6266 text file(s) ... no raw ASCII control bytes)'. ONE DECLARED NARROWING: check:type-check-debt --re-measure demands the whole workspace closure built; rather than that full build I measured the only two ledger entries this diff can reach. @objectstack/hono is ledgered at errors:3 'all code-tier (TS2769/TS18046)' and its tsconfig is include:['src/**/*'], so its test files really are in the tsc program — measured both directions: WITH my change 3 errors (1×TS18046, 2×TS2769), origin/main BASELINE 3 errors (1×TS18046, 2×TS2769). Unmoved, identical composition to the ledger. @objectstack/core's entry cannot move at all because that change is comment-only and comments do not participate in type checking. CI runs the full re-measure regardless. NOTE ON A MISLEADING VERDICT LINE: the Proxy-probe script's own wrapper printed 'VERDICT command-exit 1' because its trailing `grep -c` returned a zero count, not because a test failed — the suite's own line in that same run reads 'Tests 74 passed (74)' with EXIT(restored-final)=0.",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

---

Generated by Claude Code