Should `os build` fail by default on the accidental hook-body-lowering class? — deferred until the new lint rule has produced a real population number

[os-steve]

Filed by the domain:cli execution PM seat (#6024), session session_01UngCYXF98BVpYA9hfz6NYk, as the recorded remainder of #13651 / PR #13834. ⛔ Not work today — see the trigger.

The question

#13651 (ask 1) made the accidental hook-body-lowering class loud in os lint: a handler that is expressible as a metadata body but names a module-scope const, helper or import now fails os lint as hook-body/not-lowerable (severity error). ⛔ It deliberately did not change what os build accepts — the fallback-to-bundling catch is kept and pinned.

⇒ Should os build's default eventually fail on that same class?

A	keep os build at warn-and-bundle indefinitely
B	flip the default to fail after a window, once the lint rule has shown a real population
C	flip it now

Implementer's recommendation and mine: B. ⛔ C is unjustifiable on today's evidence, and the reason is the sharpest reading #13651 produced.

⭐ Why the measured zero is not permission to flip

#13651 measured the silent-downgrade population at 0 — 44 callables lowered, 41 bodies extracted, 0 downgraded, across every config in this tree including the reference app.

⚠️ That zero measures avoidance, not absence:

The reference app reads zero BECAUSE IT ALREADY PAID: all 39 callables are written defensively, constants hand-copied into each handler, guarded by eight bespoke pin tests.

And the bound the implementer stated without being asked: a zero inside this tree says nothing about apps outside it, on a published CLI. ⇒ The set the flip would actually affect is precisely the set nobody has measured. Flipping a contract on a number drawn from the wrong population is guessing.

⭐ The lint rule is the instrument that will produce the real number. Deciding before it has reported is the same mistake in miniature that #13411 was dispatched to stop: choosing a repair before the measurement that sizes it.

Restart-when — a predicate, not a reminder

Re-run #13651's own census (the real build path: loadConfig → normalizeStackInput → lowerCallables, classification read off the reason strings extractHookBody actually produced — ⛔ nothing re-implemented) across the measured configs.

This card wakes when silent_downgrade_warnings > 0 in any measured tree — i.e. the lint rule has a population to point at.

⚠️ Two things about that predicate, stated so it is not misread:

• ⛔ It does not wake on "the rule shipped". Shipping is not reporting. The number is the trigger.
• ⚠️ It cannot see downstream apps, which are the population that matters most. If a downstream report arrives by any other route — an issue, a support thread, a dogfood run on a tree outside this repo — that is also a wake, and is worth more than the in-tree number. ⛔ Do not treat the in-tree census as the whole instrument; it is the only half that is automatable from here.

⭐ Re-establish the instrument with the same positive control #13651 used before trusting any new zero: a fixture with three known outcomes must return exactly free-identifiers, forbidden-token and extracted. A zero from an unproven instrument is not a reading.

⛔ What this card is NOT

• ⛔ Not a re-litigation of Hook-body lowering fails OPEN: tryExtractBody swallows extractHookBody's refusal into a warnings array and bundles the closure — make it loud (ask 1; the constant-surface half is split out) #13651's choice. Option 2 (the lint diagnostic) was correct and is landed; this is the next question, not a second opinion on that one.
• ⛔ Not the deliberate-bundle declaration. That was ruled A — leave it on Hook-body lowering fails OPEN: tryExtractBody swallows extractHookBody's refusal into a warnings array and bundles the closure — make it loud (ask 1; the constant-surface half is split out) #13651: two escape channels already exist and are already silent (an explicit body on the hook, or the top-level functions: map, which 3 callables already use warning-free). A new authorable key is packages/spec contract expansion and belongs with Give a lowered hook body a declared constant surface — every shared constant is currently hand-copied into each handler and pinned by a bespoke drift test (8 rows in the reference app) #13718, ⛔ not here.
• ⛔ Not blocking anything.
• ⚠️ A flip would be its own clause-② act with its own decision — os build's accept set is a different contract from os lint's. ⛔ Do not ride it in on another card.

Refs

• Hook-body lowering fails OPEN: tryExtractBody swallows extractHookBody's refusal into a warnings array and bundles the closure — make it loud (ask 1; the constant-surface half is split out) #13651 / PR feat(cli): make the silent hook-body downgrade loud — os lint refuses an accidental scope leak (ask 1) #13834 — the lint rule, the population measurement, and the reasoning this card defers
• Give a lowered hook body a declared constant surface — every shared constant is currently hand-copied into each handler and pinned by a bespoke drift test (8 rows in the reference app) #13718 — the declared constant surface (needs-user-decision, domain:spec); the input it asked for is Hook-body lowering fails OPEN: tryExtractBody swallows extractHookBody's refusal into a warnings array and bundles the closure — make it loud (ask 1; the constant-surface half is split out) #13651's census
• Hook-body build gates: @capabilities override dead through os build; require() pattern dead; default build silently bundles forbidden patterns #10678 — made the default path print the recorded warnings; ⚠️ the reason this is warn-and-bundle rather than literally silent