check:test-source-alias still cannot read a `+`-concatenated alias replacement — the #8020 defect one spelling over

[hotlong]

Filing unassigned, observation-class. Found while implementing #8020 (PR #8107) and deliberately not fixed there — that card's ruling scoped the PR to the template-literal form plus the two registry entries it mis-measured, and this is a latent trap with zero occurrences in the repo today, not a live defect. #8020 remains open until its PR lands.

The fact

PR #8107 taught asPath in scripts/check-test-source-alias.mjs to read the template-literal replacement form. The sibling spelling is still unreadable:

replacement: path.resolve(__dirname, '../../spec/src') + '/$1/index.ts'

asPath falls through to the last-string-literal rule and answers /$1/index.ts — no src segment, so pointsAtSource() says no. That is byte-for-byte the #8020 failure mode: a config that aliases every namespace correctly reads to the gate as aliasing nothing, its package gets an over-stated registry entry, and a dev dispatched to remediate finds the alias already correct with the failure text prescribing the alias they already have.

Semantically the two spellings are indistinguishable — both exist to get the $1 back-reference inside the path, which the anchored one-rule-for-all-namespaces subpath alias requires. Only the JS surface differs.

Why it is not urgent

• Fail-closed, like check:test-source-alias cannot read a template-literal alias replacement, so two packages that DO alias spec subpaths to source are still recorded as unaliased #8020: the gate never reads an unaliased package as safe. The cost is an over-stated remediation list and a misleading message, never a false green.
• No config in the repo uses it. Measured on the fix(scripts): read a template-literal alias replacement, and shrink the two entries it mis-measured #8107 branch: grep -rn "replacement:" --include='vitest.config.*' over packages/apps/examples returns 12 replacements in 15 alias-bearing configs — 10 plain path.resolve(…) calls and 2 template literals. Zero +.

So this is real but dormant. It becomes live the first time anyone writes a subpath alias with + instead of a template — and the symptom then is a red gate pointing at the wrong thing, which is exactly the round #8020 cost.

Options

• A — teach asPath top-level +: split the expression on + outside strings/parens, resolve each operand by the existing rule, concatenate. Same shape as the template fix already merged, roughly the same size, and it closes the spelling axis rather than one point on it.
• B — leave it documented: PR fix(scripts): read a template-literal alias replacement, and shrink the two entries it mis-measured #8107 enumerates it in the asPath header under "Spellings that are legal here and still unreadable", so the next reader looks it up instead of rediscovering it. Costs nothing now; pays out only if someone reads the header before writing the config.
• C — reject the spelling: fail loudly on a + in a replacement, prescribing the template form. Turns a silent over-statement into a loud, actionable message without an expression reader.

No recommendation attached — this is for triage, not graded by me. Worth noting that these two packages (plugin-audit, service-knowledge) have now defeated three separate readers of vitest aliases by three different parsing assumptions, so the "close the axis" argument for A has some evidence behind it.

Prior art (searched before filing)

• check:test-source-alias cannot read a template-literal alias replacement, so two packages that DO alias spec subpaths to source are still recorded as unaliased #8020 / PR fix(scripts): read a template-literal alias replacement, and shrink the two entries it mis-measured #8107 — the template-literal form; this is its residual, named in that PR's Scope section.
• A package with unit tests and no vitest.config.ts lets a stale @objectstack/core dist decide its verdicts — #7668 fixed one, nothing stops the next #7849 / PR ci(test-alias): gate that a unit test judges source, not a sibling's dist #7966 — the gate and its shrink-only registry. A package with unit tests and no vitest.config.ts lets a stale @objectstack/core dist decide its verdicts — #7668 fixed one, nothing stops the next #7849 remains open as the tracking anchor.
• attach-requires-parent-edit c3: #4757 multi-delete pin can't execute against the prebuilt @objectstack/core (stale-dist / CI) #7668 / PR test(service-storage): resolve @objectstack/core from source so a stale dist can't decide a pin (#7668) #7778 — the anchored-regex constraint that forces the capture-group-inside-path shape in the first place.

---

Generated by Claude Code

[hotlong]

Finding-grading round: closed, not planned — superseded by its own option B, already shipped.

PR #8107 (5cfbd2a, the #8020 fix) added the asPath header enumerating "Spellings that are legal here and still unreadable" with the +-concatenation form named first — the exact documentation this card asked for. Live count: zero +-concatenated replacements in any vitest.config.* (counter-checked against 16 replacement: rows). Option A's "closes the axis" claim is also refuted by that header: three sibling unreadable spellings survive it, so fixing + alone buys nothing. Fail-closed, zero-pull dormant trap.

---

Generated by Claude Code