The read-seam invention rule has no declared failure-propagation vocabulary, so "the catch reported the failure" is uncheckable — the blocker measured under #8845

[os-project-manager]

Restart-when: closed #8895 AND closed #8896 AND closed #8906, then a census re-run over the three scan roots finds a second silent-fall-through cohort

Filed unassigned by the domain:devx seat (#6023) as the measured remainder of #8845. ⛔ No domain:* set — that is triage's single-producer field.

This card exists because #8845 measured its own proposed fix and found it unaffordable, and the reason it is unaffordable is a missing declaration, not a missing criterion. The measurement is already done; what is left is a design act.

The gap

scripts/check-durability-degradation-log-level.mjs holds two rules. The log-level rule has a declared failure-propagation vocabulary — FAILURE_PROPAGATION_CALLEES / FAILURE_PROPAGATION_SITES — so "this catch reported the failure onward" is a declared, checkable fact. The read-seam invention rule has none, and the two share none, on purpose.

⇒ For the read-seam rule there is no sound way to express "this catch degraded, but it told someone". That is what blocks the criterion #8845 set out to add.

The measurement that establishes it (from #8845, origin/main @ 8664a2c)

Census over the three scan roots, narrowing one criterion at a time:

criterion	seams
read seams in scope	66
catch has no return anywhere	46
catch has a valueless exit	41
… and is silent	31
… and that exit is not type-discriminated	25
… and an empty accumulator sits above the try, written inside, read below	15

Against a shrink-only ledger holding one entry today. #6451 — the prior extension, and the template — landed because its true new red set was zero.

7 of the 15 are already correct and would each need a baseline entry. Every one of them does deliver the failure (errors++ into a returned { deleted, errors }, issues.push into a returned probe report, failed.push into a returned envelope, report.unreadableObjects.push in the dangling-reference audit). Baselining seven correct seams to land a criterion is the "baselined into uselessness" outcome, reached in one PR.

Why the cheap exemptions were rejected, with evidence

Recording these so instance #4 is not re-derived from scratch — the same reason the negative result was written into the script's header.

• "The catch WROTE something that is read later" cuts 15 → 7, and is unsound. It is inferred, not declared, which is the one discipline this file holds everywhere; it would become a second de-facto propagation vocabulary drifting alongside the real one; and it clears publishPackageDrafts, whose catch pushes a fabricated revert-plan entry (existedBefore: false, prevVersion: null) after a failed read. ⛔ An exemption that fires on an invention is not an exemption.
• Also exempting a catch whose only statement is a jump cuts the red set to 2, which looks clean and is the trap: it buys the number by exempting three real instances, including cascadeDeleteRelations, where a failed dependents probe skips a restrict guard outright (now ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895). ⛔ Tuning a criterion until only the instance you already knew about is red is how a gate stops meaning anything.
• Even the true positives are flagged for the wrong reason under both variants: findReferencesToMeta's harm lives in out, not the flagged items; cascadeDeleteRelations and checkGovernance have no accumulator at all, only a skipped guard. A message naming the wrong variable teaches the wrong fix.

What the work is

Give the read-seam rule its own declared failure-propagation vocabulary, so "the catch reported it" becomes checkable rather than guessed. With one, the 7 already-correct seams stop being noise and the fall-through criterion becomes affordable on its own terms.

⚠️ Scope warning, load-bearing. The READ vocabulary is the only thing holding the line: drop it and this shape matches 91 of the 314 catch clauses in these three roots. #5186 explicitly defers "evaluate widening as its own issue", so that is the cliff this sits next to. Any design here has to say what keeps the scope narrow, not only what widens the judgement.

Deliberately not in scope

⛔ Do not fix the seams here. They are filed on their own terms and can be fixed without waiting on this: #8895 (cascadeDeleteRelations fails open — the most consequential), #8896 (the remaining five silent fall-through seams plus publishPackageDrafts' fabricated entry), #8897 (collectLoggedLevels only recognises a receiver named logger/log/console, so a genuinely loud catch can read as silent).

⛔ Do not re-open the #8845 decision. Recording the measurement and adding no criterion was the ruled outcome, and PR #8898 landed exactly that, with the census written into the script's header so the numbers are read before this is re-proposed.

For triage

• domain:* — lands in scripts/check-durability-degradation-log-level.mjs, which reads as devx. Deliberately unset.
• Grading note: this is a design act with appetite in it, not a criterion tweak — the dev that measured it said so explicitly and declined to take it inside a dispatch. It may warrant needs-user-decision rather than pm:queue; that judgement is triage's, not this seat's.
• Dedupe performed: is:issue is:open failure-propagation vocabulary read-seam returned 0 at 15:57Z.

---

Generated by Claude Code

[os-project-manager]

Triage: needs-user-decision + domain:devx. Full thread read (0 comments); no prior ruling covers this — #8845's ruling ("record the measurement, add no criterion", landed by PR #8898) explicitly carved this design act out as its remainder, so asking for it is asking for new appetite, which is the maintainer's field. Not auto-adjudicable: this is gate-vocabulary design (feature-shaped), and the prongs split.

The question: invest in a declared failure-propagation vocabulary for the read-seam rule (so "this catch reported the failure onward" becomes a checkable fact, making the fall-through criterion affordable at 15→7-baseline instead of unsound heuristics), or decline and rely on fixing instances as they are found.

Four-prong:

• Platform long-term coherence: a declared vocabulary extends the file's declared-over-inferred discipline and stops the 7 already-correct seams reading as noise; but it is a second propagation vocabulary with its own staleness surface, sitting next to the check:durability-log-level 结构性看不见「读接缝把故障答成空值」这一类 —— #4825 / #5108 全家都在闸门盲区里 #5186 widening cliff (91/314 catches match this shape without the READ scope holding the line). Any approved design must state what keeps scope narrow.
• Measured business pull: indirect. The live instances are already filed and fixable without it (ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895 promoted, Measured set: five read seams answer a failed read from an empty accumulator with no log and no field saying the answer is incomplete #8896 promoted, lifecycle checkGovernance: a failed row-count probe silently drops the object from quota/growth alerting and from nextCounts, losing the next sweep's growth baseline too (split from #8896) #8906 split, [finding] diffMetaItem answers 200 with an empty diff when sys_metadata_history is unreadable — an outage is indistinguishable from "nothing changed" #8833/[finding] getMetaDiagnostics swallows the 503 that #5532 raised — an unreadable metadata store is published as "0 problems", and the type vanishes from the Studio tile counts #8855 in flight); the vocabulary guards future seams. Zero user-facing defect is attributable to its absence per se.
• AI-agent error-resistance: the strongest prong for — silent fail-open/fall-through catches are exactly the class agents introduce and reviews clear ("surveyed, cleared, harmful — the finding(objectql): engine.ts 的 sys_file hydrate 读故障走 catch → return records —— 静默返回裸 id,零日志(#5979 实施期扫出,闸门词表外) #6116 shape"); a checkable propagation fact turns that from judgement into mechanism.
• Startup scope discipline: against now — permanent gate-infrastructure maintenance obligation, and the 2026-08-15 check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 ruling chose restraint on this exact surface hours ago.

Recommendation: defer with a named trigger — hold until the filed seams (#8895 / #8896 / #8906) have landed and a later census finds a second cohort of this shape; at that point the pull prong flips and the design pays for itself. If you prefer building now, scope it to the vocabulary declaration + the fall-through criterion only, nothing from the #5186 widening, dispatched model: fable (gate-semantics design tier). Note #8897 (held) must be decided in the same change whenever this file is edited.

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling (2026-08-16, recorded by PM session session_01NYgmGheCzM6NrHZN436Cxf). The maintainer approved the report's recommendation for the gate-infrastructure group (「主线1 3 4：同意」; this card's recommendation was "defer with a named trigger").

Ruled: defer — decision made, answer is "not now". → pm:on-hold.

Hold record (per the hold-comment discipline):

• Date: 2026-08-16.
• Reason: the live instances are filed and fixable without the vocabulary (ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895 / Measured set: five read seams answer a failed read from an empty accumulator with no log and no field saying the answer is incomplete #8896 / lifecycle checkGovernance: a failed row-count probe silently drops the object from quota/growth alerting and from nextCounts, losing the next sweep's growth baseline too (split from #8896) #8906); the vocabulary only guards future seams; check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845's same-day ruling chose restraint on this exact surface; a new declared vocabulary is permanent gate infrastructure sitting next to the check:durability-log-level 结构性看不见「读接缝把故障答成空值」这一类 —— #4825 / #5108 全家都在闸门盲区里 #5186 widening cliff.
• Named restart conditions (both required): (a) ObjectQL.cascadeDeleteRelations fails OPEN: a failed dependents probe skips the restrict guard entirely, so a delete that should be refused succeeds silently #8895, Measured set: five read seams answer a failed read from an empty accumulator with no log and no field saying the answer is incomplete #8896 and lifecycle checkGovernance: a failed row-count probe silently drops the object from quota/growth alerting and from nextCounts, losing the next sweep's growth baseline too (split from #8896) #8906 have all landed, and (b) a later census over the three scan roots finds a second cohort of the silent fall-through shape (new instances beyond the check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 census recorded in the script header). Either the devx seat's pre-dispatch check or a census re-run may trip it.
• Trigger file (opportunistic-restart clause): any PR touching scripts/check-durability-degradation-log-level.mjs — dispatches whose file surface intersects it must name this card; note check-durability-degradation-log-level: collectLoggedLevels only recognises a logger named logger/log/console, so a catch that reports through an injected logger reads as silent to BOTH rules #8897 (held) must be decided in the same change whenever this file is edited.
• If restarted: scope = the declared vocabulary + the fall-through criterion only, nothing from the check:durability-log-level 结构性看不见「读接缝把故障答成空值」这一类 —— #4825 / #5108 全家都在闸门盲区里 #5186 widening; model: fable (gate-semantics design tier).
• Provenance: maintainer ruling via PM chat, 2026-08-16, approving the inbox report's recommendation.

Labels flipped needs-user-decision → pm:on-hold in the same stroke.

---

Generated by Claude Code