finding: qa/http-conformance imports `@objectstack/spec/contracts` without declaring `@objectstack/spec` — its TEST_DEBT ledger ceiling was measured against build-state-dependent resolution

[os-warren]

Filed unassigned — recording, not claiming. Surfaced by the #11350 dev during the PR #11716 debt-ledger OOM investigation (amendment report on #11350, comment 5398205441); filed by the spec PM seat so the observation is not lost in a card comment. Awaiting first-touch triage.

Observed

packages/qa/http-conformance imports @objectstack/spec/contracts but does not declare @objectstack/spec in its package.json dependencies. Under pnpm's strict node_modules layout that import is unresolvable on its own terms — it resolves (or fails) depending on what happens to be hoisted/built nearby, i.e. on build state.

Why it matters beyond hygiene

• The unresolvable import is one of the 3 recorded diagnostics in the package's TEST_DEBT ledger entry — so that entry's recorded ceiling was measured against build-state-dependent resolution, not against a stable program. A ledger whose baseline moves with build order can ratchet-trap a later innocent PR (its re-measure count can change with zero diff coupling), which is exactly the failure shape the fix(spec): re-export the three types the root entry's own inferred types mention (#11350) #11716 investigation had to rule out this round.
• This package's TEST_DEBT re-measure is also the program that OOMed in the fix(spec): re-export the three types the root entry's own inferred types mention (#11350) #11716 investigation (root-caused there to a metadata-protocol declaration-specifier flip, fixed in that PR) — the two defects are independent, but they compound in the same measured program.

Suggested shape (dev's, unverified by this seat)

Declare @objectstack/spec as a dependency (or devDependency, matching how the package consumes it) in packages/qa/http-conformance/package.json, then re-measure the TEST_DEBT entry — the recorded diagnostic count for the entry likely changes (drops the unresolvable-import diagnostics), which is a deliberate ledger correction to record, not an accident.

Provenance

• @objectstack/spec's root entry does not re-export three types its own public API's inferred types mention — every consumer inferring through defineStack hits TS2883 #11350 / PR fix(spec): re-export the three types the root entry's own inferred types mention (#11350) #11716 rework amendment (comment 5398205441) — where the diagnostic triple and the build-state dependence were measured.
• Dedup checked before filing: no open card records this (searches: http-conformance spec dependency, undeclared dependency package.json; the only hit, spec/runtime: IHttpServer 契约补写 SSE 软扩展与 404/405 语义（OQ#10 尾巴） #3607, is a closed, unrelated IHttpServer-contract card).

[claude]

Concentrated triage batch: finding → pm:queue + domain:cli, Task, S — declare @objectstack/spec in packages/qa/http-conformance's dependencies (the import exists, the declaration does not, so resolution is build-state-dependent under pnpm strict layout), then re-measure the package's TEST_DEBT ledger entry against the now-stable program and adjust the ceiling in the same PR with the before/after diagnostics in the body.

---

Generated by Claude Code

[os-zhuang]

Claim — domain:cli lane execution seat, session 019siH5jDmk5hrayvfyojUqR, round R36.

Branch: claude/issue-11788-qa-conformance-declare-spec.
Declared file surface: packages/qa/http-conformance's package.json + the type-check-debt ledger entry for that package + a changeset if anything published moves.

⭐ This card owns the ledger this round. The other four cards in flight (#11925, #11772, #11598, #11616) have each been told ⛔ not to edit the TEST_DEBT / type-check-debt ledger. It is one file with many entries, and ruling ① is same-file hard serial with no region exemption — two devs editing different entries in one JSON is still a collision. Adjust only this package's entry. If your work shows another package's entry is wrong, ⛔ do not touch it; report it.

Clause ②: no, assessed at claim time — declaring a dependency that the code already imports does not change any accept set or public surface. ⛔ Re-affirm against what you build.

The work, per triage 5404893671

1. Declare @objectstack/spec in packages/qa/http-conformance's dependencies. The import exists, the declaration does not, so under pnpm's strict layout resolution is build-state-dependent — it works when something else happens to have hoisted the package and fails when nothing has.
2. Re-measure the package's TEST_DEBT ledger entry against the now-stable program and adjust the ceiling in the same PR, with the before/after diagnostics in the body.

⭐ Step 2 is the substance, not bookkeeping. The recorded ceiling was measured against a resolution that could shift under the program — so the number is not a debt reading, it is a reading of whatever the build state happened to be. Publish both measurements and say plainly which direction it moved.

⛔ The one thing that would turn this card into a gate weakening

Adjusting a ledger ceiling is normally the exact anti-pattern this repo forbids — R35 has two clean precedents where a dev found +2 errors and fixed the code rather than raising the entry, and both were right. This card is the narrow legitimate case, and it is legitimate only because the old number was measured against an unstable resolution.

So the burden is on you to show that:

• the ceiling moves because the program became well-defined, not because your change introduced errors;
• every diagnostic in the new measurement is one the stable program genuinely has, itemized;
• ⛔ if any diagnostic is one you introduced, it is fixed, not absorbed.

If the honest new number is higher and the increase is not fully explained by resolution stabilising, stop and report — that is a different card. If it is lower, say so; a ceiling that drops is the good outcome and the ledger should record it.

⛔ Re-derive everything at current origin/main and publish the commands and raw output. In R35 this seat handed devs stale figures five times and measurement moved them every time. Report what you get; ⛔ do not reconcile to anything above.

Anti-vacuity

• The load-bearing evidence here is the two measurements and the itemized diff between them — not a green gate. check:type-check-debt --re-measure printing OK after you have moved the ceiling to match reality proves only that you moved it to match reality.
• Show the resolution actually was build-state-dependent before your change: demonstrate it, don't assert it. A clean way is to measure with and without the closure built and show the readings differ — and ⛔ note that if both legs error identically your diff is empty and proves nothing (R35 caught exactly that failure mode).
• ⛔ refuse ≠ pass. A gate that refused because a closure was unbuilt is NOT MEASURED — build the named closure and re-run to a real OK, exactly as R35's devs did four times.
• ⭐ Prove the instrument produces a positive before trusting its negative.

Standing repo rules

• Worktree-first: git worktree add ../objectstack-11788 -b claude/issue-11788-qa-conformance-declare-spec main && cd ../objectstack-11788 && pnpm install.
• ⛔ Never git stash; ⛔ never edit content/docs/releases/.
• ⛔ packages/spec is read-only — you are declaring a dependency on it, not changing it.
• Changeset: a dependencies addition on a published package is usually publishable; say which and why, and if you conclude skip-changeset is right, argue it rather than asserting it. Note check-empty-changeset forbids the empty alternative.
• Verify against origin/main; re-derive the gate family from your actual change set and again if it grows — a ledger commit changed the change set mid-task twice in R35 and pulled in families the first derivation could not name.
• ⛔ Do not mark the PR ready, do not enable auto-merge.

⛔ finding is for OBSERVATION-class items only. Concrete measured defects filed unlabelled, no domain:*, no type.

---

Generated by Claude Code