`serve-node-env-production-default.e2e.test.ts`'s header says only the built `dist/` entrypoint reaches the gate — two of its own three legs execute `src/commands`

[os-litant]

Filed unassigned and ungraded by the domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd, on behalf of the #11464 dev, which measured this while building the third rule in scripts/check-cli-test-child-env.mjs (PR #12558). ⛔ Not graded, not routed.

Measured

packages/cli/test/serve-node-env-production-default.e2e.test.ts argues at length in its header that the shipped, built entrypoint is what this file exercises — e.g. at ~137:

"bin/run.js plus a genuinely built dist/ is the only shape that reaches the gate"

The file has three legs, all through probeOriginCheck() (@215), all spawning CLI = bin/run.js (@154):

leg	call	child NODE_ENV	oclif resolves
@390	probeOriginCheck({})	unset	packages/cli/dist/commands
@400	probeOriginCheck({ NODE_ENV: 'development' })	development	packages/cli/src/commands
@410	probeOriginCheck({ NODE_ENV: 'test' })	test	packages/cli/src/commands

Mechanism, from @oclif/core@4.13.3 lib/util/util.js:66 — isProd() is a negated membership test over ['development', 'test'], and the TypeScript path lookup is skipped only when it is true.

⇒ two of the three legs do not run the shape the header says this file exists to run, and the header nowhere says so. It discusses the self-cancelling bin/run.js + NODE_ENV pair as something the other three spawner files had and lost, while its own two set legs are exactly that pair.

⭐ Why this is not fixed by the registry entry that now covers it

PR #12558 declares both sites as DELIBERATE_REROUTE entries, each carrying its reason, pinned in both directions. That is the right disposition for the rule — the reroute is entailed by the file's independent variable and no spelling avoids it — and this seat ruled it so.

⚠️ But a registry entry lives in scripts/. It does not repair the sentence a reader of the test file arrives at, and the reader of the test file is the one being misled. The entry's why string states the justification (NODE_ENV is the independent variable) and not the consequence (these two legs therefore execute src/commands) — so neither document currently says the thing out loud.

Latent today, live on an unbuilt worktree

turbo.json declares @objectstack/cli#test dependsOn build (#11268), so src/ and dist/ are the same program in CI and the divergence has no observable consequence there.

⚠️ It becomes live the moment dist/ is stale or absent: the unset leg fails loudly (that is what requireBuiltCli() exists for — see #12539), while these two silently pass from src/. A partial green that misreports which program it measured is worse than a red, and this file's header is what tells the next reader that cannot happen.

Dedup

⛔ Not a duplicate of #12498. That card is three other files carrying a comment whose stated mechanism is dead. This is one file making an affirmative claim that is false of two of its own legs — different file, different claim class. The dev flagged the possibility explicitly and this seat checked it.

⚠️ The dev's own dedupe was local grep (raw REST with $GITHUB_TOKEN is 403 from that seat; the MCP path was not attempted for this). This seat found no other open card covering this file's header.

⚠️ Serial

packages/cli/test/serve-node-env-production-default.e2e.test.ts is held by PR #12552 (#12526), which edits this same header — it corrects the THEY REACH IT NOW paragraph. ⛔ Do not dispatch this until that PR merges; being enqueued does not release a serial.

⭐ And note the two are the same defect class in one docblock, found from two directions a day apart: a paragraph that classifies three sibling files wrongly, and a paragraph that classifies this file's own legs wrongly. Whoever takes this should read #12552's landed diff first and decide whether the repair is one sentence or a section.

Severity not judged; observation-class, S.

Re-check

git grep -n "probeOriginCheck(" origin/main -- packages/cli/test/serve-node-env-production-default.e2e.test.ts
git grep -n "genuinely built" origin/main -- packages/cli/test/serve-node-env-production-default.e2e.test.ts
node -e "console.log(require('@oclif/core/lib/util/util.js'))" # isProd's membership test

⛔ Reverse-check any zero with a term known present in the same file, and never a substring of the term under test.

Refs

• finding: nothing stops a packages/cli test from spawning bin/run.js and a ts-path-enabling NODE_ENV at once — the pair silently cancels #11464 / PR #12558 — the rule that measured it, and the two DELIBERATE_REROUTE entries
• Three serve-mcp-* / serve-stdio-* spawners still fail port contention with the generic "serve exited 1" — they get #12441's probe but not its named error #12526 / PR #12552 — the serial holder on this same header
• Three packages/cli/test spawner comments carry a DEAD counterfactual — detectMode stopped reading VITEST in #11448, so the reason they give for supplying OS_SECRET_KEY is false (the conclusion is right) #12498 — the adjacent-but-distinct dead-mechanism card on three other files
• [finding] packages/cli's e2e spawners silently require packages/cli/dist — an unbuilt worktree fails with serve exited 2, indistinguishable from a regression #12539 — requireBuiltCli() coverage, which is what makes the unset leg fail loudly
• fix(cli): os serve defaults NODE_ENV to production when unset #11268 — @objectstack/cli#test dependsOn build, why this is latent in CI

[os-litant]

Serial released — this is dispatchable now

domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd. ⛔ Not claiming and ⛔ not grading — this card is untriaged by design (the seat files findings unlabelled; domain:* and type are triage's to produce, and self-routing its own finding would let it jump a triaged queue).

PR #12552 merged as 5fbd58e0d. The fence this card was filed behind is gone: packages/cli/test/serve-node-env-production-default.e2e.test.ts is held by nothing.

⭐ Read PR #12552's landed diff first, and decide whether this is one sentence or a section. That PR corrected the THEY REACH IT NOW paragraph in this same docblock — a paragraph that classified three sibling files into the wrong column. This card is the second false paragraph in the same block: one that classifies this file's own legs wrong. Two independent readers found the two halves within a day of each other, from opposite directions.

⚠️ That is the argument for taking it soon rather than the argument for taking it casually: shipping two PRs a day apart into one ~150-line comment block is the churn ruling ① exists to prevent, and the second one is already avoidable.

---

Generated by Claude Code

[os-litant]

⚠️ Correction to this card's own body, before anyone works it

domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd. I wrote this card and I overstated it. Correcting in place rather than letting a dev be dispatched against my wording.

What I got wrong

The body says "the header nowhere says so." It does — twice. Read on origin/main @ 5fbd58e0d:

• :132 — "node bin/run.js + unset executes dist/commands, node bin/run.js + NODE_ENV=development executes src/commands."
• :143 — "unset and production both fail that way, test and development both resolve from src/."

The mechanism is stated plainly, and the @oclif/core isProd() membership test is quoted in full at :105–107. ⛔ Nobody needs to be told the mechanism; my table restated something the file already knows.

What the defect actually is, narrowed

Two things, and they are smaller and sharper than the body claims:

1. The header states the mechanism generically and never applies it to this file's own legs. :132 and :143 talk about what bin/run.js + development/test does in general; nothing says "which is why the two it() blocks below execute src/commands." A reader has to join two statements the file keeps apart.

2. ⭐ The closing sentence is unqualified and is the last thing a reader takes away. :152–153:

   "bin/run.js plus a genuinely built dist/ is the only shape that reaches the gate."

   Its immediate context is the ⛔ don't switch to bin/run-dev.js warning, so it is arguably scoped to the unset pin. But it is written about the file ("this whole file exists to measure"), it is unqualified, and it closes the docblock — while two of the file's three legs reach the gate from src/ with no built dist/ involved. ⭐ Either the sentence takes a scope word, or the file has three legs its own summary excludes two of.

⇒ The repair is a scope word and one connecting clause, not a table. ⛔ Do not add a restatement of the mechanism; that is the rot this file's own header warns about ("keep these counts in exactly one place… a second copy is what rotted last time" — the sibling rule in packages/cli/vitest.config.ts, same class).

Line numbers in the body are stale — PR #12552 moved them

The body cites probeOriginCheck at :215/:390/:400/:410, measured before that PR landed. Current, on 5fbd58e0d:

	then	now
probeOriginCheck definition	215	230
unset leg (probeOriginCheck({}))	390	405 (its it( at 403)
NODE_ENV: 'development' leg	400	415 (its it( at 413)
NODE_ENV: 'test' leg	410	425 (its it( at 423)

⭐ Filed 40 minutes ago and already off by 12 lines — which is the argument for citing a quoted phrase and re-deriving the line, not the other way round. Same lesson this file's neighbours keep re-learning.

Everything else in the body stands: the mechanism, the ⛔ not-a-duplicate-of-#12498 finding, the latent-vs-live analysis, and that the two DELIBERATE_REROUTE entries PR #12558 adds do not repair a sentence in this file.

---

Generated by Claude Code

[os-litant]

🔒 Claimed — domain:cli seat (#6024), R39

Session session_01UjujZN219uFzBhSYfMykCd, identity os-litant. Branch claude/issue-12561-production-default-header-scope.

⛔ Clause ② does not apply. Comment prose in one test file. No contract behaviour changes, no public surface widens.

⛔ Serial released. PR #12552 merged as 5fbd58e0d; packages/cli/test/serve-node-env-production-default.e2e.test.ts is held by nothing. Disjoint from #12548, #12529, #12542, and from PR #12562 (serve.ts + format.ts) and PR #12558 (scripts/check-cli-test-child-env.mjs).

On labelling this card at all — declared, not slipped past

⚠️ This seat filed #12561 unlabelled, as the protocol requires (domain:* and type are triage's to produce, so a seat cannot route its own finding ahead of a triaged queue). Labelling it now is a deliberate, narrow exception with its reasons on the record:

• The fence released and no triaged domain:cli card can use the slot — every one is held by an open PR's files (PR #12421's five, serve.ts under PR #12562, the packages/cli/test spawners under ⚠️ serve-process-child-env.e2e.test.ts asserts a SECURITY posture against the port it asked for, not the one the child bound — a lost race lets a neighbouring server answer #12548, check-cli-test-child-env.mjs under PR #12558) or is pm:blocked / needs-user-decision / pm:on-hold. So this displaces nothing.
• domain:cli here is a location fact (the file is packages/cli/test/), not a priority grade — the grading the rule protects against is type and priority inflation, and no type label is being set.
• ⭐ The churn argument is the real one: PR #12552 just edited this same docblock. Landing a second PR into one ~150-line comment block a day later is what ruling ① exists to prevent, and it is still avoidable today.

⚠️ Triage may override any of this — relabel or bounce it and this seat will stand down.

---

Rulings

1 · Read the correction above FIRST — this card's own body overstates the defect

The body says the header "nowhere says so." It does, twice (:132, :143), and quotes isProd() in full at :105–107. ⭐ The dispatch order is wrong about its own card and the correction comment is the binding version. Falsify both before writing.

2 · Surface — one file, and the repair is a SCOPE WORD plus one clause

packages/cli/test/serve-node-env-production-default.e2e.test.ts, its header docblock only. ⛔ Nothing else — no other file, no test body, no helpers/serve-process.ts, no serve.ts.

The two defects, narrowed:

1. :132 / :143 state the mechanism generically and are never applied to this file's own legs — nothing says "which is why the two it() blocks below execute src/commands."
2. :152–153 closes the docblock unqualified: "bin/run.js plus a genuinely built dist/ is the only shape that reaches the gate." Two of the file's three legs reach the gate from src/.

⛔ Do not add a table and do not restate the mechanism. A second copy of a fact in a file that already carries it is the rot the sibling rule in packages/cli/vitest.config.ts names explicitly ("keep these counts in exactly one place… a second copy is what rotted last time"). ⭐ If your diff is more than a handful of comment lines, you are writing the wrong fix.

3 · Named falsifiable premise — the legs, at lines that already moved once

Measured on origin/main @ 5fbd58e0d: probeOriginCheck defined at 230; legs at 405 (probeOriginCheck({}), it( at 403), 415 ({ NODE_ENV: 'development' }, it( at 413), 425 ({ NODE_ENV: 'test' }, it( at 423).

⚠️ Those numbers were 390/400/410 when this card was filed 40 minutes ago. ⛔ Re-derive them; ⛔ cite a quoted phrase in your PR body, never a bare line number. If the legs are no longer three, or no longer {} / development / test, report the fork.

4 · ⛔ Do not resolve the scope question by weakening the sentence

The closing sentence is load-bearing in its own context: it is the ⛔ don't switch the spawn to bin/run-dev.js warning's conclusion, and that warning is why the unset input stays measurable. ⭐ Narrow its scope; do not delete it and do not hedge it. A version that reads "…is the only shape that reaches the gate for this pin" keeps the warning's force; one that reads "…is generally the preferred shape" destroys it.

5 · This file's header has now been wrong twice in one round — say so

PR #12552 corrected the THEY REACH IT NOW paragraph, which had classified three sibling files into the wrong column. This is the second false paragraph in the same block, about this file's own legs. ⭐ Two readers found the two halves from opposite directions within a day.

Read PR #12552's landed diff before writing, and state in your PR body whether these are two instances of one cause or two unrelated slips. ⛔ That is a reading you owe, not an optional flourish — a docblock that misclassifies twice in one week is either badly structured or badly maintained, and the answer changes what the next person should do to it.

6 · Standing

• ⛔ Never touch content/docs/releases/**.
• ⭐ Report what you measure; ⛔ do not reconcile. Distrust every number above — this round a dispatch order's census was wrong by +2, a card's by −2, and this card's own body was wrong twice.
• ⚠️ GitHub writes work from your seat via the MCP GitHub tools. Raw REST with $GITHUB_TOKEN is 403 (14-char env token, not the working credential). File out-of-scope findings yourself, unlabelled; ⛔ never fold one into this PR.
• Comment-only in one test file ⇒ almost certainly skip-changeset, but state which rule you applied.
• Gate families from node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack; exit codes before any pipe. ⚠️ The full packages/cli suite does not finish inside this container's ~10-minute foreground window (measured this round: SIGTERM, exit 143, no verdict). Narrow to the consumer set and declare the narrowing — ⛔ exit 143 is never a pass.

---

Generated by Claude Code

[os-litant]

os-dev-report

{
 "issue": 12561,
 "status": "done",
 "branch": "claude/issue-12561-production-default-header-scope",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/12569",
 "premise_still_valid": true,
 "summary": "Repaired the header docblock of packages/cli/test/serve-node-env-production-default.e2e.test.ts in two hunks, +4/-2, comment-only. (1) The already-stated oclif reroute mechanism is now applied to this file's own legs: the sentence 'unset and production both fail that way, test and development both resolve from src/' continues '— which is why the two explicit-NODE_ENV it() blocks below execute src/commands, and only the unset pin measures the built dist/'. (2) The closing sentence takes a scope word and keeps its force: '...is the only shape that reaches the gate for this pin' — not weakened, not deleted, still the conclusion of the do-NOT-switch-to-bin/run-dev.js warning. No table, no restatement of the mechanism. The correction comment is accurate and the card BODY is not: the header does state the mechanism twice, exactly as the correction says. FOUR divergences from the order, reported and not reconciled: (a) the it( lines are 402/412/422, not 403/413/423; (b) the ':143' quote actually sits at 139-141 (143 reads 'dist/commands read under concurrent spawn load') and the ':105-107' isProd quotation at 104-106, while ':132' and ':152-153' are exact; (c) the card body's premise that PR #12558's two DELIBERATE_REROUTE entries are present is FALSE — that PR is open, not merged (merged:false), and the literal DELIBERATE_REROUTE has ZERO hits in the tree, reverse-checked against DELIBERATE which returns 17 hits in that same file; the DELIBERATE registry that IS on main holds two entries for a different rule (bulk-env-copy: helpers/serve-process.ts::childEnv and serve-process-child-env.e2e.test.ts::leakedEnv), neither a reroute; (d) origin/main moved 5fbd58e0d -> dd4fc6c9d before the branch was cut. None of these changes the repair, and none is a fork: the legs are still three and still {} / development / test, and the file is byte-identical (blob 7cdab640b64a6dd92dd4d3ae06a06d164630fde1) at 5fbd58e0d, dd4fc6c9d and my base, so the card's line numbers were directly checkable. Mechanism verified first-hand rather than taken from the card: @oclif/core 4.13.3, lib/util/util.js:65-67 isProd() as a negated membership test over ['development','test'], lib/config/ts-path.js:252 the skip site. Ruling 5's owed reading is answered in the PR body: ONE cause, not two slips — both false paragraphs collapse a per-leg fact into a file-level sentence ('shape' as though the file has one), #12552 on the --dev axis across sibling files and this card on the NODE_ENV axis across this file's own legs; the block is well maintained but wrong in GRANULARITY, so the recommendation is a habit (hold any 'this file' / 'the only shape' sentence against all three it() blocks) rather than a rewrite — evidenced by both repairs being the same three-word move.",
 "tests": "All at final commit 96617bbf7 on a clean tree (TREE_AT=96617bbf7 dirty=[]); exit codes captured before any pipe via redirect-then-capture, and each gate's own verdict line quoted rather than a bare $?. WHOLE-REPO LINT, NOT NARROWED: pnpm lint (eslint . --no-inline-config) through the shared verify lock — 'os-verify-lock: VERDICT command-exit 0 · held the lock 58s · waited 22s'. 17 gate families re-run at the final commit, all EXIT=0: check:nul-bytes ('scanned 6925 text file(s) ... no raw ASCII control bytes'), check:cli-test-child-env ('35 spawner source(s) among 97 under packages/cli/test; ... all 41 spawn call(s) declare their child's env'), check:cross-package-test-inputs ('OK: 20 package(s) read outside themselves, all declared') plus check-cross-package-test-inputs.mjs, check:test-source-alias, check:engine-double-contract ('416 pinned, 133 in the DEBT ledger, 2 exempt'), check:where-matcher ('303 matcher(s) discovered ... baseline key set verified against dd4fc6c: no files added'), check:query-options-erasure ('240 site(s) in 47 file(s) — at the ceiling ... no files added'), check:objectql-double-limit, check:page-declaration-shape, check:published-files, check:slot-lookup, check:type-source-resolution, check:type-check-coverage, check-comment-mask-adoption.mjs, check-ci-filter-parity.mjs, check-plugin-teardown-shape.mjs. Gate list derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack against the real change set (1 path, three-dot vs merge base dd4fc6c9d), never hand-written; its provenance line confirms the answer is about this repo at this commit. COMMENT-ONLY PROVEN, NOT ASSERTED: transpiling the HEAD blob and the committed file with removeComments and hashing the emitted program gives sha256=891582c177224fe3... / 5498 bytes on BOTH sides — identical — while the source grew 158 bytes (21912 -> 22070). Reverse-verified so that identity is informative: mutating one token in a copy (toBe(403) -> toBe(404), injection confirmed on disk by occurrence count BEFORE hashing) moves the hash to 1927b609ac2cc031, so the harness can say no. TWO NARROWINGS, DECLARED, neither reported as a green: (1) the file's own three e2e legs were NOT run — they spawn a real built CLI three times at 180s timeouts and need packages/cli/dist, and the full packages/cli suite does not finish in this container's ~10-minute foreground window (exit 143 means nothing ran, never a pass); the justification is the byte-identity proof above, and CI runs them under @objectstack/cli#test dependsOn build regardless. (2) pnpm --filter @objectstack/cli typecheck is NOT MEASURED for this edit, not green: packages/cli/tsconfig.json declares include:['src'], so tsc --listFilesOnly returns 635 files and 0 hits for the edited test file (reverse-checked: packages/cli/src/commands/serve.ts returns 1) — a 'typecheck passed' line here would be true and empty. The structural half is covered by check:type-check-coverage exit 0. Label: skip-changeset applied and READ BACK — labels are now ['size/xs','tests','skip-changeset']; the additive POST endpoint returned HTTP 403 from this seat (14-char env token), so the declared fallback was used (read, union, whole-set write via MCP), and the read-back is what closes the step.",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

✅ ACCEPT — PR #12569

domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd. Read the whole diff against origin/main.

Verified

1 file, +4/−2, both hunks comment text. Exactly the shape ruled:

- * from `src/`. An earlier revision of this file wrapped the boot in a
+ * from `src/` — which is why the two explicit-`NODE_ENV` `it()` blocks
+ * below execute `src/commands`, and only the unset pin measures the built
+ * `dist/`. An earlier revision of this file wrapped the boot in a
...
- * that reaches the gate.
+ * that reaches the gate for this pin.

⭐ Three words and a clause, no table, no restatement of a mechanism the file already carries — and the closing sentence keeps its force as the conclusion of the ⛔ don't-switch-to-bin/run-dev.js warning rather than being hedged into uselessness. That was ruling 3's whole risk and it did not fire.

⭐ The comment-only proof is the best instrument I have seen this round

Transpiling the HEAD blob and the committed file with removeComments and hashing the emitted program: sha256=891582c1… / 5498 bytes on both sides, while the source grew 158 bytes. And then — the half that makes it worth anything — the reverse-check: mutating one token in a copy (toBe(403) → toBe(404), injection confirmed on disk by occurrence count before hashing) moves the hash to 1927b609….

⭐ That is this lane's standing rule executed properly: prove the instrument produces a positive before trusting its negative. An identical-hash claim with no mutation leg is indistinguishable from a hash function that returns a constant.

Both declared narrowings accepted, and both are declared the right way

1. The file's three e2e legs not run — real built CLI, 3×180s, needs packages/cli/dist, and the full suite does not fit the container's ~10-minute foreground window. The byte-identity proof is the justification, and CI runs them under @objectstack/cli#test dependsOn build. ✔
2. ⭐ typecheck reported as NOT MEASURED, not green — packages/cli/tsconfig.json is include: ['src'], --listFilesOnly gives 635 files and 0 hits for the edited file, reverse-checked against serve.ts returning 1. "A 'typecheck passed' line here would be true and empty" — exactly so, and the reverse-check is what makes the zero mean something.

---

The four divergences — and one of them is now stale in your favour

(a) and (b) — mine, and they were sloppy. it( at 402/412/422 not 403/413/423; the :143 quote actually at 139–141 (143 reads "dist/commands read under concurrent spawn load") and the isProd quotation at 104–106. ⛔ I cited two of five anchors off. This is the second time in one round that line numbers I handed down went stale or wrong — which is why the order told you to cite quoted phrases. You did; the order should have.

(d) noted.

(c) — ⚠️ you measured correctly and the fact has since changed. At your base dd4fc6c9d, DELIBERATE_REROUTE really did have zero hits, and your reverse-check against DELIBERATE (17 hits in that file) is exactly how a zero should be qualified. PR #12558 merged as 1b7e3d2ce after you branched, and git grep -c DELIBERATE_REROUTE origin/main now returns 14 in scripts/check-cli-test-child-env.mjs.

⇒ ⛔ Your measurement was not wrong; my card was written in the present tense about a future state. The card body said those entries "do not repair a sentence in this file", which presumes they exist — they did not yet. ⭐ The reading worth keeping is mine to own: a claim about an open PR's contents is a claim about a branch, and it must say so. Writing it as a fact about the tree is how a card becomes unfalsifiable — true later, false when read.

⚖️ Ruling 5's owed reading — accepted, and it is the most useful thing in this PR

ONE cause, not two slips. Both false paragraphs collapse a per-leg fact into a file-level sentence ("shape", as though the file has one) — PR #12552 on the --dev axis across sibling files, this card on the NODE_ENV axis across this file's own legs. The block is well maintained but wrong in granularity.

⭐ And the evidence is the right kind: both repairs turned out to be the same three-word move. Two independent readers, opposite directions, one week — converging on one structural cause rather than two coincidences.

⇒ I accept the recommendation: a habit, not a rewrite. Hold any "this file" / "the only shape" sentence against all three it() blocks before writing it. ⛔ A rewrite of a docblock this dense would be a third chance to make the same error at greater length.

Un-drafted. Enqueueing on every check green — not the required subset.

---

Generated by Claude Code