check-durability-degradation-log-level: the read-seam invention rule keys on `return`, so a `catch` that degrades by FALLING THROUGH into an empty accumulator is structurally invisible

[hotlong]

Filed by the triage seat (whole-repo Routine, fire 08:47Z), split out of #8833 so that card can be ruled on its own terms. Unassigned. Not a claim.

#8833's 06:36Z comment recommended this be its own card with its own measurement, and its 07:07Z comment repeated that it is worth filing regardless of how #8833 is ruled. This is that card. ⛔ It is deliberately not a rider on #8833: the gate extension is what stops the class recurring, and it must not be hostage to a response-contract decision on one endpoint.

The blind spot

scripts/check-durability-degradation-log-level.mjs carries the read-seam invention rule (#5186, extended by #6451): a read seam must not invent an unreported answer. packages/metadata-protocol/src is in its scan roots, and it is green on main.

The rule classifies a catch by what it returns. Verified on origin/main @ 6b6b606 — the analysis keys on ts.isReturnStatement at :863 and :893.

So a catch of this shape is invisible to it:

} catch {
 // history table unavailable — fall through with empty list
}

There is no return statement to classify. The accumulator declared above the try stays at its initial [], and the invention happens later, when code below reads that never-filled accumulator as though it were a real answer. The seam is neither baselined nor exempted — the rule simply cannot see it.

The live instance is diffMetaItem in packages/metadata-protocol/src/protocol.ts, which answers 200 with an empty diff when sys_metadata_history is unreadable (#8833). Measured there with a stub engine whose find throws; no log line is emitted either, so the outage leaves no trace on any surface.

Why it is worth a card rather than a note

This is the third recorded instance of the same meta-shape, which is what makes it a pattern rather than a one-off:

• check:durability-log-level 结构性看不见「读接缝把故障答成空值」这一类 —— #4825 / #5108 全家都在闸门盲区里 #5186 — the rule was created because check:durability-log-level structurally could not see "a read seam answers a fault as an empty value";
• finding(devx): #5186 读接缝规则的「编造空答案」词表看不见「原样返回入参」这一形状 —— #6116 是实证样本 #6451 — the rule's own vocabulary could not see "returns the input unchanged" (identity pass-through), added as a criterion after measurement;
• this card — the rule cannot see "returns nothing at all and lets an empty accumulator stand in for an answer".

Each time, a rule written for exactly this harm was green over a live instance of it. The rule is good; its classification surface keeps turning out to be narrower than the harm.

Scope — measurement first, extension only if the red set is controllable

⚠️ The extension is NOT the first step. scripts/check-durability-degradation-log-level.mjs's own header documents the 收窄先行 discipline that #6451 followed, and that header is the authority on it — read it before writing anything.

1. Measure. Across the three scan roots, count catch blocks that are (a) empty-bodied or contain no return, and (b) sit above a read accumulator that is subsequently read as an answer. Report the set and how many are already-correct.
2. Decide from the measurement. If the set is small and mostly-correct, extend the criterion in the finding(devx): #5186 读接缝规则的「编造空答案」词表看不见「原样返回入参」这一形状 —— #6116 是实证样本 #6451 style. If it is large or noisy, ⛔ do not extend — report the false-positive surface and stop. A gate that goes red across dozens of benign seams gets baselined into uselessness, which is worse than the current blind spot.
3. Only if step 2 says extend: add the criterion, with the new red set enumerated in the PR body.

premise_still_valid: false or "measured, extension not advisable" with pr: null is a valid and valuable outcome here. This card is a measurement, not a promised diff.

Explicitly out of scope

⛔ Do not fix diffMetaItem in this card. That seam's disposition is #8833 and is with the maintainer — it has three candidate response contracts and one of them changes a published shape. If the gate extension you build would go red on diffMetaItem, that is the correct outcome and should be reported, not resolved by editing the seam.

Related

• [finding] diffMetaItem answers 200 with an empty diff when sys_metadata_history is unreadable — an outage is indistinguishable from "nothing changed" #8833 — the live instance; needs-user-decision, domain:metadata. Note PR perf(metadata-protocol): drop diffMetaItem's discarded historyMetaItem round trip #8841 (for [finding] diffMetaItem awaits a full historyMetaItem read and discards it — a dead round trip on every live diff request #8798) makes that seam silent for every type, where it previously threw for some.
• check:durability-log-level 结构性看不见「读接缝把故障答成空值」这一类 —— #4825 / #5108 全家都在闸门盲区里 #5186 — the rule's origin card.
• finding(devx): #5186 读接缝规则的「编造空答案」词表看不见「原样返回入参」这一形状 —— #6116 是实证样本 #6451 — the prior extension, and the template for how to measure before extending.

[os-project-manager]

Claim: PM loop round 1
Session: session_011RB4waLuNbdruCo6X9oobm
Branch: claude/issue-8845-durability-catch-fallthrough
Worktree: objectstack-issue-8845
Domain: domain:devx
File surface: scripts/check-durability-degradation-log-level.mjs (incl. its self-test/fixtures) (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus
Serial constraints cleared: none blocking, one interaction declared. Seat post #6023's hot-file queue lists this script against this card only — no prior claim. Batch-mates are file-disjoint: #7529 is in packages/lint/src/{runtime-gate,authoring-rules}.ts + packages/metadata-protocol/src/protocol.ts; #8698 is in scripts/check-cross-package-test-inputs.mjs. ⚠️ Declared interaction: this card reads packages/metadata-protocol/src as a scan root, and #7529 is editing protocol.ts concurrently. That is a read/write overlap on the measurement, not on the diff — see below.

Model tier

opus, not fable. This card does not change any contract's accept/reject behaviour and does not widen a public surface — it decides whether a gate's classification surface should widen, and the card explicitly permits "measured, extension not advisable" as a terminal answer. The mandatory-fable triggers (pm-dispatch skill edits; accept-set narrowing / public-surface widening) do not fire. It is a judgement card, so it is not dropped to sonnet either.

Premise re-check performed before claiming — both hold

card's premise	measured on origin/main @ 15283cf, 2026-08-15T15:2xZ
the rule keys on ts.isReturnStatement at :863 and :893 (card verified @ 6b6b606)	✅ exact — 863: if (ts.isReturnStatement(stmt)) { · 893: if (ts.isReturnStatement(child)) {
the gate script is unmodified since filing	✅ unchanged

⚠️ Both readings came from file content, not from git log — see the hazard below, which invalidates the log-based form of that second check.

⛔ Measurement hazards specific to this card — read before you measure

1. The clone in the PM container is SHALLOW (50 commits; is-shallow-repository = true), and the graft boundary 159e299 reports new file mode for every path. Any git log --since=… -- <path> you run will list 159e299 as a change to your file, and git show 159e299 -- <path> will show the whole file as added. Neither is real. Exclude the boundary (git log origin/main --not $(git rev-list --max-parents=0 origin/main) -- <path>), and ⛔ do not read "no commits touched this" as proof of stability — the window is ~50 commits deep, nothing older is visible. If your worktree is a full clone, verify that first and say so; do not inherit my constraint if you do not have it.
2. Your scan root is moving under you. packages/metadata-protocol/src/protocol.ts has taken 10 real commits since 08-14 (a5262d5 88ef34d fd6bdf8 950bd94 c15eb23 8d017eb add2d19 75e66fc 5047cb8, plus b69d0f5 in packages/metadata) and The metadata door accepts a dashboard widget dataset binding that names nothing — 200 on both save and publish, referential integrity enforced only at runtime #7529 is editing it right now. 950bd94 — "drop diffMetaItem's discarded historyMetaItem round trip" — lands directly on the card's named live instance. ⇒ Record the exact origin/main sha your red-set measurement was taken at, in the PR body. A count with no sha is not reproducible here.

Zone 1 — Constraints. ⛔ Not negotiable.

• ⛔ 收窄先行 (narrow-first) is the discipline, and the script's own header is its authority — read the header before writing anything. finding(devx): #5186 读接缝规则的「编造空答案」词表看不见「原样返回入参」这一形状 —— #6116 是实证样本 #6451 is the template.
• ⛔ Measurement is step 1 and the extension is NOT the first step. Count catch blocks that are (a) empty-bodied or contain no return and (b) sit above a read accumulator subsequently read as an answer, across the three scan roots. Report the set and how many are already-correct.
• ⛔ If the red set is large or noisy, DO NOT EXTEND. Report the false-positive surface and stop. A gate that goes red across dozens of benign seams gets baselined into uselessness — worse than the current blind spot. premise_still_valid: false or "measured, extension not advisable" with pr: null is a valid and valuable terminal outcome. This card is a measurement, not a promised diff.
• ⛔ Do not fix diffMetaItem. Its disposition is [finding] diffMetaItem answers 200 with an empty diff when sys_metadata_history is unreadable — an outage is indistinguishable from "nothing changed" #8833, needs-user-decision, with the maintainer — three candidate response contracts, one of which changes a published shape. If your extension goes red on diffMetaItem, that is the correct outcome: report it, do not resolve it by editing the seam. ⚠️ And do not edit it "just to get CI green" — that is the same act wearing a different hat.

Zone 2 — PM mechanism assumptions. Measure; falsifying these is a good run.

• That the catch-fallthrough shape is structurally invisible rather than merely unbaselined. The card asserts the seam is "neither baselined nor exempted". Verify — if it turns out to be exempted somewhere, the whole card changes shape.
• That this is genuinely the third instance of one meta-shape (check:durability-log-level 结构性看不见「读接缝把故障答成空值」这一类 —— #4825 / #5108 全家都在闸门盲区里 #5186 → finding(devx): #5186 读接缝规则的「编造空答案」词表看不见「原样返回入参」这一形状 —— #6116 是实证样本 #6451 → this). If your measurement says the finding(devx): #5186 读接缝规则的「编造空答案」词表看不见「原样返回入参」这一形状 —— #6116 是实证样本 #6451 criterion already covers some of it, say so.

Zone 3 — Suggested route. Optional; measurement wins.

• If you do extend, enumerate the new red set in the PR body, and mark each entry as a first measurement, ⛔ not as a raised ratchet.
• Changeset: root scripts/ is not a published package ⇒ skip-changeset is very likely correct here. Confirm against what you actually touch.

---

Generated by Claude Code