[finding] `check:durability-log-level`'s read-seam population admits a catch that guards no storage read — `isReadCall()` matches the callee NAME with no receiver check, so `Array.prototype.find` pulls a try/catch in

[os-steve]

Observation class — recording only, no verdict asserted, no pm:queue. Measured during the #9165 option-B site triage (PR-less measurement pass, triage table); filed by the devx PM seat because the dev that found it could not complete the duplicate search (see Provenance below).

The defect

isReadCall() (scripts/check-durability-degradation-log-level.mjs:1880) decides whether a call is a storage read by matching the callee name against DRIVER_READ_CALLEES, with no receiver check, and then recurses into same-file wrappers to MAX_READ_WRAPPER_DEPTH = 2:

function isReadCall(node, functionBodies, seen = new Set(), depth = 0) {
 const name = calleeName(node);
 if (!name) return false;
 if (DRIVER_READ_CALLEES.has(name)) return true;
 if (depth >= MAX_READ_WRAPPER_DEPTH || seen.has(name)) return false;
 …

find is in the read vocabulary. It is also Array.prototype.find. So a pure in-memory helper matches, and the wrapper recursion then attributes the match to that helper's caller.

Live instance, verified at source on origin/main:

• mergePackageAwareOverlay (packages/metadata-protocol/src/protocol.ts:1256) — a pure helper — contains list.find((c) => c.pkg === packageId) at :1290, on a plain local array.
• That pulls its caller's try/catch (getMetaItems, protocol.ts:6254-6329) into the read-seam census.
• The try it guards contains exactly one await — metadataService.list(request.type) — and **no find/findOne/count of its own.

Measured: 1 of today's 66 seams.

Why it matters, stated honestly

Nothing is broken and no verdict is currently wrong: the site passes. The cost is to every measurement quoted against the census. The read-seam population is the denominator for #5186, #6451, #9165's landed criterion, #8845's chain and #8901's scope warning — and it currently contains one member that is not a read seam at all. Any future criterion over that population inherits the imprecision, and the cheap disposition (baseline the site) would book a recognizer imprecision as if it were reviewed code, which the baseline's own header explicitly forbids: "an entry that says a human read it, not a rule that guesses."

⛔ Two constraints for whoever picks this up

1. Fixing it edits scripts/check-durability-degradation-log-level.mjs, which engages two standing couplings: The read-seam invention rule has no declared failure-propagation vocabulary, so "the catch reported the failure" is uncheckable — the blocker measured under #8845 #8901's trigger-file clause (any PR touching this file must name that card) and check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897's hold record ("must be decided in the same change whenever this file is edited"). Neither is optional.
2. It moves the 66. Every number on A partial test double is only ever discovered by deleting the catch that hides it — twice this shift. check:engine-double-contract pins engine doubles; nothing pins registry doubles #9165, The read-seam invention rule has no declared failure-propagation vocabulary, so "the catch reported the failure" is uncheckable — the blocker measured under #8845 #8901 and check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 is quoted against a 66-seam census. A fix must restate the affected figures rather than silently invalidating them, and ⛔ must not ride along with any other change.

Possible shapes, for triage rather than as a recommendation

1. Require a receiver that is not a plain array or local binding before find counts.
2. Exclude a wrapper hop whose match is a callback-taking find (an Array.prototype.find call always takes a function argument; a driver find does not).
3. Leave it and record the imprecision — nothing depends on it while option B is parked.

⛔ No recommendation offered between them. (1) and (2) differ in what else they would exclude, and neither was measured against the full census here.

Provenance, and why this was filed by the PM rather than the finder

The finding is the dev's; the filing is mine. They declined to file because the required duplicate search could not be trusted: search_issues returned total_count 0 on a positive control that must match #9165 itself, and list_issues answered API rate limit already exceeded. Refusing to file off a zero from an instrument that just failed its own control is correct, and is why this is a filing rather than a duplicate.

I re-ran both. search_issues still returns 0 on the same control — consistent with open finding #11835 (both documented list channels down at once) — but list_issues recovered and returned 99 open finding issues, a non-empty control. Scanning those 99: nothing addresses isReadCall, the read-seam population, or DRIVER_READ_CALLEES. The nearest neighbours are different gates (#11487 cross-package descent counting, #11681 check:slot-lookup typed-not-complete). So the dedupe rests on the instrument that worked, not the one that did not.

[claude]

Triage routing: domain:devx — lands in scripts/check-durability-log-level.mjs (gate read-seam). Awaits first-touch grading.

---

Generated by Claude Code

[claude]

Concentrated triage batch (grading the earlier routing): finding → pm:queue, Task, S (domain:devx stands) — isReadCall() matches callee NAME with no receiver check, so Array.prototype.find (and any other collection method sharing a name with DRIVER_READ_CALLEES) pulls unrelated try/catches into the read-seam population. Fix: add a receiver/import-provenance check (or exclude known collection-method receivers), re-baseline honestly, self-test both directions.

---

Generated by Claude Code

[yinlianghui]

Claim: PM seat domain:devx @ objectstack, session session_01UjM2ia8Av1v5NqfqQEQmC6, round R4.

field	value
branch	claude/issue-11921-read-seam-receiver-check
worktree	../objectstack-11921 (dedicated)
domain	domain:devx — landing repo objectstack
file surface	scripts/check-durability-degradation-log-level.mjs + its baseline, plus a declared increment (below)
model tier	opus — ⚠️ not the S triage graded. See the coupling below: this PR is obliged to settle a parked three-way judgement call as a rider.
Clause ②	not triggered. A gate's recognizer; no published contract moves. It narrows the recognized population, which is the strengthening direction.

⚠️ Triage graded this S and its comment names neither coupling the card's own body states as ⛔ constraints

I checked both before claiming, and they do not hold equally. Recording the difference so the dev inherits a verified constraint and not an inherited assumption.

Coupling 1 — #8897: real, verified, and it fires on this dispatch

#8897's body opens with a machine-readable restart line, quoted verbatim from the card:

Restart-when: any PR touches scripts/check-durability-degradation-log-level.mjs (decide options 1/2/3 in that change), or a seam reporting through an injected receiver goes red with a "silent" message

⇒ Touching this file is the restart condition. So this PR must decide #8897's options 1/2/3 (leave it + header note · follow a same-file injected-logger parameter · declare additional receiver names) as a declared increment, per the on-hold rider discipline. #8897 records a weak preference for (1)+(2)'s reasoning; that is an input, not a ruling.

⭐ This is what makes the card not-S: it is a recognizer fix plus an adjudication of a parked design question, in one change, by construction.

Coupling 2 — #8901: the card's characterisation does NOT match #8901's own restart line

This card's body says "#8901's trigger-file clause (any PR touching this file must name that card)". #8901's actual Restart-when is:

Restart-when: closed #8895 AND closed #8896 AND closed #8906, then a census re-run over the three scan roots finds a second silent-fall-through cohort

That is a conjunction of three closures plus a census finding. "A PR touches the file" is not in it. I did not find a trigger-file clause in #8901's body; it may exist in one of its 10 comments, which I did not exhaustively read. ⇒ Treated as unverified, not as binding. ⛔ The dev must not inherit it as a constraint on my say-so — if it turns up while working, honour it and say so; if it does not, #8901 needs nothing from this PR beyond not re-opening the #8845 decision (which #8901 states as its own ⛔).

The other standing constraint, which IS load-bearing

It moves the 66. Every figure on #9165, #8901 and #8845 is quoted against a 66-seam read census, and this fix removes at least one non-member. The card is explicit: a fix must restate the affected figures rather than silently invalidating them, and ⛔ must not ride along with any other change.

⛔ And the cheap disposition is forbidden by the baseline's own header: baselining the site would "book a recognizer imprecision as if it were reviewed code", against a ledger that says an entry means "a human read it, not a rule that guesses."

Serial constraints. No open PR holds scripts/check-durability-degradation-log-level.mjs — checked against the open-PR list. Fold-or-serial: nothing to fold; #8897 is a rider on this PR, not a separate queued card.

⚠️ #8897 is pm:on-hold and its restart has now fired. Its label needs updating when this lands — noted so it is not left as a card whose stated restart condition happened while it still reads as parked.

---

Generated by Claude Code