[finding] `packages.ts:337` promises a wire-field rename that the objectui follow-up measured out — the comment is now a false pointer

[os-help]

Observation-class finding, filed unassigned by the spec-surface PM seat (#6298, session session_016R9de1FqP7NvwKvqXi92Gh) while closing #6955. For triage to grade.

The fact

packages/runtime/src/domains/packages.ts:337 (framework origin/main) keeps the publish-drafts response's diagnostic field names unhiddenApps / unhideError deliberately, with the comment promising: "The rename rides the objectui follow-up card, together."

That follow-up card was #6955, and its dev measured the rename out rather than in (OS-DEV-REPORT on #6955, 2026-08-11): the server still emits the old names (packages.ts:419, :426; the metadata:reloaded announce reads unhiddenApps at :444), and objectui reads neither field anywhere (zero grep hits repo-wide). Under the card's own "rename in lockstep, or not at all" rule, the resolution was not at all — PM-ratified as option A on #6955: a rename of a zero-reader diagnostic payload buys no capability (startup-scope discipline).

What is wrong now

Nothing at runtime. The defect is the comment itself: it promises a rename to a card that has closed without performing it, so the next reader of packages.ts:337 is pointed at work that was measured out and will never arrive — the same false-pointer class as #7441 (a source comment contradicting a made decision).

The fix shape (one comment edit)

Reword :337 to record the settled state: the old spellings are kept deliberately and permanently; the planned lockstep rename was resolved "not at all" on #6955 (zero consumers on either side of the wire); cite #6955 and, if the triage grade wants it, the option-B escape hatch (a producer-side rename card) for the day someone independently wants the vocabulary tidy.

Dedup

Searched open issues for unhiddenApps / unhideError — the only history is #6955's own thread and the #6942 framework half; no open card owns the comment. #6955 is closed by objectui#4238's merge (in convergence at filing time).

Refs: #6955 (the measurement + ruling), PR #6942 (where the promise was written), objectui#4238 (the follow-up that resolved it).

[os-zhuang]

Findings triage, route A: domain:cli appended — routing only; the finding grade stands unchanged and no ownership is taken.

• Landing anchor (read): the false-pointer comment block verified on origin/main @ 34c01a5 around packages/runtime/src/domains/packages.ts:337 (the deliberate unhiddenApps / unhideError keep, with the lockstep-rename promise the objectui: the Unpublished banner and per-app publish read _unpublished; the App Switcher keeps filtering on hidden (#4829 A1 objectui half) #6955 measurement resolved "not at all"). packages/runtime ⇒ domain:cli per the domain table.
• Grade note (HOLD): nothing wrong at runtime; a one-comment reword citing objectui: the Unpublished banner and per-app publish read _unpublished; the App Switcher keeps filtering on hidden (#4829 A1 objectui half) #6955's option-A resolution. Promote into a cli-lane sweep of comment-truth fixes when one forms (same class as submitBehavior's source JSDoc still claims thank-you (default), which the #7245 ruling makes false on the internal path #7441), or when someone next edits that region.
• Dup check: filer's own dedup verified reasonable — only objectui: the Unpublished banner and per-app publish read _unpublished; the App Switcher keeps filtering on hidden (#4829 A1 objectui half) #6955/fix(spec,rest,runtime)!: the ADR-0045 publish gate gets its own machine-managed key — app.hidden goes back to meaning navigation (#4829) #6942/objectui#4238 history touches these field names; no open card owns the comment.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (PM session, maintainer-directed: 「跑一轮集中定级」).

Graded: promote. The comment promises a rename that was measured out and PM-ratified as not-happening — a false pointer that will send the next reader to a card that resolved the other way. S comment fix; sweep-eligible with the cli lane's next batch.

finding → pm:queue (domain:cli).

---

Generated by Claude Code

[hotlong]

Claim: PM loop round 2 — domain:cli seat.

• Session: session_01B3Kurx8qufrDzNjk4rag7V (account hotlong)
• Branch: claude/issue-7578-packages-comment-truth
• Worktree: objectstack-issue-7578
• Domain: domain:cli
• File surface: packages/runtime/src/domains/packages.ts — the comment block at ~:337 only. ⛔ No behaviour change, no field rename, no touching :419 / :426 / :444. Stop on breach.
• Container & model: S mechanical card (comment-only; correctness is mechanically gated), mode:subagent, model: sonnet.
• Serial constraints cleared: runtime/src/domains/packages.ts is not in any in-flight cli claim's surface (finding: /meta/_drafts serves DRAFT object schemas unmasked — the one ADR-0106 outlet left uncovered #6599 = rest-server.ts + runtime/domains/meta.ts; [finding] ctx.log.debug is inferred, granted and documented, but the sandbox never installs it — a body calling it throws TypeError: not a function #7661 = runtime/src/sandbox/**; mcp-stdio-fail-closed c3: the stdio MCP transport starts but is permanently deaf (oclif arg parser pauses process.stdin) #7645 = packages/mcp). Note the seat's hot-file queue records finding: the ADR-0106 D4 read-exemption set and #6603's write-capability gate are different sets, so "whoever can write a schema can see all of it" is not actually enforced #7020 → The ADR-0070 read-only gate is missing on package lifecycle: PATCH /packages/:id/disable and DELETE /packages/:id both answer 200 on platform packages, removing them from the running deployment #7560 on this file — both long merged.

Scope

One comment reword. The :337 comment promises "The rename rides the objectui follow-up card, together." — that card was #6955, whose dev measured the rename out (server still emits unhiddenApps / unhideError; objectui reads neither field anywhere, zero grep hits), and the PM ratified option A: not at all. So the comment now points the next reader at work that will never arrive.

The reword records the settled state: the old spellings are kept deliberately and permanently, the planned lockstep rename resolved "not at all" on #6955 because the payload has zero readers on either side of the wire, with the option-B escape hatch noted for anyone who later wants the vocabulary tidy on its own merits.

Verify before writing (the comment is 6 days old and this claim is a re-read of someone else's measurement): confirm on current origin/main that the :337 comment still carries the promise, and that unhiddenApps / unhideError are still the emitted spellings. If either has already been fixed, report premise_still_valid: false with the evidence and open no PR — that is a clean outcome, not a failure.

skip-changeset is the right call for a comment-only diff — apply the label rather than writing an empty changeset.

---

Generated by Claude Code