fix(service-storage): the storage/test probe cleans up in the store it wrote to

[claude]

Closes#13726

The settings.registerAction('storage', 'test', …) handler writes a probe object, reads it back and deletes it. When the form posts values it builds a temporary adapter first — so an operator can validate credentials that are typed but not yet saved — and probes that adapter instead of the persisted one. Two paths left the probe object behind in whichever store it was actually written to. Both were surfaced by the #12981 batch-7 dev inside the lines that batch edits, and correctly left alone there; re-verified by symbol on this branch's base (46b53a25b), since PR #13725 moved the line numbers.

Defect 1 — the failure cleanup deleted from a store the probe never wrote to

let target: IStorageService = proxy was declared inside the try, so at the catch the only name in scope was proxy, the persisted adapter. On the case the temporary adapter exists for — a failed test with edited credentials — the object leaked in the store that held it while a delete was issued against a store that never did. Deleting an absent key is a no-op on both shipped adapters, so the wrong-store delete "succeeded" and nothing looked wrong.

Repaired by resolving the adapter before the try whose catch has to clean up after it. That makes "the cleanup names the store the upload named" true by construction rather than by two expressions that happen to agree today.

Defect 2 — the content-mismatch return path cleaned up nothing

Reaching the round-trip comparison means the upload already succeeded, so the object is definitely present — and the return walked straight past the delete on the very next line. A guaranteed leak, not a best-effort one, on the one path that by construction only fires when the adapter is misbehaving. It now runs the same best-effort cleanup as the failure path.

The two judgement calls

1. "target may be unassigned, or may be the very thing that threw." The card is right that a delete against a half-built adapter is its own question, and the answer here is that the question is dissolved rather than answered: buildAdapterFromValues already had its own inner catch that returns, so a construction failure never reached the outer catch — but the reader could not see that from the catch, because the declaration was out of scope there. Hoisting the resolution above the try states the invariant where it can be read: past that point target is either proxy or a fully constructed temporary adapter. A construction failure still returns before anything is written, and on that path no cleanup is attempted at all — nothing was written, and a delete would have to name an adapter that does not exist. That decision is pinned (as a declared control, below), so a later "tidy-up" that adds a finally reddens it.

2. Where defect 2 cleans up. A finally was rejected: the success path already deletes on its own line, and its failure IS a probe failure the operator must be told about, so a finally would either delete twice or need a flag to know not to. "Leave it for inspection" was rejected because nothing records the key — it is minted per call from a timestamp and a random suffix — so the object would be un-findable litter rather than evidence. The mismatch path therefore calls the same cleanup helper the catch does, immediately before its return.

Built on batch 7, not over it

#12981 batch 7 made a refused cleanup name the key it left behind. That repair is intact — it moved into the shared removeProbeObject helper, warn level and message text unchanged — and it now covers the mismatch path too, which it could not reach before because no cleanup was attempted there. One pin drives exactly that case.

What did NOT change

No sweep for the __objectstack_probe__/ prefix — out of scope by the card. What the probe reports to the operator is unchanged on every path: the same result shape and the same messages, pinned in every case below. No published surface changes and no accept/reject behaviour moves.

Verification

All numbers from head 11c802f5d.

Pins — packages/services/service-storage/src/storage-service-plugin.probe-cleanup-store.test.ts

Every store in the file is a realLocalStorageAdapter on its own temp directory with exactly one verb replaced (via Object.create, so every other member stays the adapter's own). PUT allowed / GET refused is the ordinary shape of a half-right credential and it is what makes the leak observable: the bytes really land on disk, then the probe really fails. The assertions read the filesystem — what is left under __objectstack_probe__/ when the handler returns — rather than a call counter that could agree with a store nobody wrote to.

case	kind
failed probe with edited credentials leaves nothing in the TEMPORARY store (and the persisted store is neither written to nor asked to delete)	pin
failed probe with no edited credentials leaves nothing in the PERSISTED store	declared control
an adapter that fails to build is reported, and no cleanup is attempted anywhere	declared control
a mismatch on edited credentials leaves nothing in the TEMPORARY store	pin
a mismatch with no edited credentials leaves nothing in the PERSISTED store	pin
a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch	pin

The two controls are green in both directions by construction — with no overrides target === proxy, so the old code deleted from the right store by accident, and the old code also attempted no cleanup after a build failure. They are declared as controls in the file's header and are not ablation evidence; they are there so the pins cannot pass on a handler that deletes from everything, or on one that cleans up after a store it never wrote to.

Ablation

Predicted before the run: reverting only storage-service-plugin.ts reddens the 4 pins and leaves the 2 controls green.

Procedure: the repair was committed first (c80f33a90); the mutation reverted the single file to its pre-fix blob in the worktree only; an EXIT INT TERM trap restored it with an absolute path; the mutation was confirmed on disk before measuring, by blob hash and by marker counts, never by an editor's exit code. No rebuild is in the loop: the pins import the module under test by relative path within the same package, so vitest reads the source .ts, and this package's vitest.config.ts carries no alias that could route it to dist/.

== blobs: HEAD(fixed)=56697fe055842a08f8f46703478e1bfefb57f373 HEAD~1(pre-fix)=51f623729c21dd6824d69cccc3be1b843779f4c7
== markers BEFORE mutation (working tree = the repair)
removeProbeObject: 3
proxy-as-IStorageService-delete: 0
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373
== MUTATE (revert the handler to the pre-fix blob; worktree only, index untouched)
hash-on-disk: 51f623729c21dd6824d69cccc3be1b843779f4c7
removeProbeObject: 0 (expect 0 — the repair's helper is gone)
proxy-as-IStorageService-delete: 1 (expect 1 — the wrong-store cleanup is back)
== MUTATED RUN
mutated-run-exit=1
× … defect 1 … a failed probe with EDITED credentials leaves nothing behind in the TEMPORARY store
✓ … CONTROL: a failed probe with NO edited credentials leaves nothing behind in the PERSISTED store
✓ … CONTROL: an adapter that fails to BUILD is reported, and no cleanup is attempted anywhere
× … defect 2 … a mismatch on EDITED credentials leaves nothing behind in the TEMPORARY store
× … defect 2 … a mismatch with NO edited credentials leaves nothing behind in the PERSISTED store
× … defect 2 … a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch
Test Files 1 failed (1)
Tests 4 failed | 2 passed (6)
== RESTORE
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373 (expect 56697fe055842a08f8f46703478e1bfefb57f373)
removeProbeObject: 3
git diff HEAD -- target: []
git status --porcelain -- target: []
== RESTORED RUN
restored-run-exit=0
Test Files 1 passed (1)
Tests 6 passed (6)

The mutated failures are the leak itself, named on disk:

AssertionError: expected [ '1788193993158-fbkl7y8s' ] to deeply equal []
AssertionError: expected [ '1788193993188-8cske18x' ] to deeply equal []
AssertionError: expected [ '1788193993190-d0e7dm5m' ] to deeply equal []
AssertionError: expected [] to have a length of 1 but got +0 (the refusal warning that is never logged, because no cleanup is attempted)

Direction observed = direction predicted. The restore leg is proven by state — hash back to the HEAD blob, empty git diff HEAD, empty git status --porcelain — and re-measured green afterwards, so no later reading was taken on a mutated tree.

Suites and gates

• pnpm --filter @objectstack/service-storage exec vitest run --maxWorkers=2 — 35 files, 528 tests passed (the whole package, including The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 7's own file).
• pnpm --filter @objectstack/service-storage exec tsc --noEmit — 51 errors, zero of them in either changed file. That is exactly this package's frozen DEBT ledger count, so check:type-check-debt's re-measure cannot move up on this diff. Run with the dependency closure built (pnpm --filter '@objectstack/service-storage^...' build), which is the ledger's own measurement condition.
• Gate family re-derived from the actual diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (both output sections read whole; the family is identical at the final head). All 36 harvested commands run; 32 green, and 4 report PREREQUISITE NOT MET, i.e. NOT MEASURED, never a pass and never a red: check:test-completeness (exit 3 — grades a saved turbo test log, none exists locally), check:dual-build-cjs-loads (exit 3 — needs a full pnpm build), check:i18n and check:type-check-debt (both need a built workspace closure; both refuse rather than measure). CI builds the workspace and runs all four.
• The slot-lookup erasure ratchet did not move; the gate's own verdict line: ✓ slot-lookup ratchet holds: 106 unswept site(s) in 25 file(s), none new, and every file in the population parsed.
• ESLint: declared narrowing to the two changed files rather than the repo-wide pnpm lint, which CI owns and runs regardless. pnpm exec eslint --no-inline-config --format json on both paths — 2 files linted, 0 errors, 0 warnings; both were accepted into eslint's own population rather than ignored (they are returned as results). The narrowing excludes nothing: this repo runs one eslint.config.mjs which never enables type-aware linting for any file (no parserOptions.project, no typed rules — stated and measured in the config's own header), so no rule's verdict on an untouched file is a function of this diff. Independently, check:slot-lookup executes ESLint across all of packages/ with the baseline's ignores lifted, and holds.

Changeset

.changeset/storage-probe-cleanup-target-store.md, patch on @objectstack/service-storage: the behaviour an operator can observe does move — the probe no longer leaves objects in the store it wrote to — even though no API surface does.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4642f4c64c002f94f1d737bbb2a5fc94ae43ddf3 → packageMentionDocs.

[claude]

Closes#13726

The settings.registerAction('storage', 'test', …) handler writes a probe object, reads it back and deletes it. When the form posts values it builds a temporary adapter first — so an operator can validate credentials that are typed but not yet saved — and probes that adapter instead of the persisted one. Two paths left the probe object behind in whichever store it was actually written to. Both were surfaced by the #12981 batch-7 dev inside the lines that batch edits, and correctly left alone there; re-verified by symbol on this branch's base (46b53a25b), since PR #13725 moved the line numbers.

Defect 1 — the failure cleanup deleted from a store the probe never wrote to

let target: IStorageService = proxy was declared inside the try, so at the catch the only name in scope was proxy, the persisted adapter. On the case the temporary adapter exists for — a failed test with edited credentials — the object leaked in the store that held it while a delete was issued against a store that never did. Deleting an absent key is a no-op on both shipped adapters, so the wrong-store delete "succeeded" and nothing looked wrong.

Repaired by resolving the adapter before the try whose catch has to clean up after it. That makes "the cleanup names the store the upload named" true by construction rather than by two expressions that happen to agree today.

Defect 2 — the content-mismatch return path cleaned up nothing

Reaching the round-trip comparison means the upload already succeeded, so the object is definitely present — and the return walked straight past the delete on the very next line. A guaranteed leak, not a best-effort one, on the one path that by construction only fires when the adapter is misbehaving. It now runs the same best-effort cleanup as the failure path.

The two judgement calls

1. "target may be unassigned, or may be the very thing that threw." The card is right that a delete against a half-built adapter is its own question, and the answer here is that the question is dissolved rather than answered: buildAdapterFromValues already had its own inner catch that returns, so a construction failure never reached the outer catch — but the reader could not see that from the catch, because the declaration was out of scope there. Hoisting the resolution above the try states the invariant where it can be read: past that point target is either proxy or a fully constructed temporary adapter. A construction failure still returns before anything is written, and on that path no cleanup is attempted at all — nothing was written, and a delete would have to name an adapter that does not exist. That decision is pinned (as a declared control, below), so a later "tidy-up" that adds a finally reddens it.

2. Where defect 2 cleans up. A finally was rejected: the success path already deletes on its own line, and its failure IS a probe failure the operator must be told about, so a finally would either delete twice or need a flag to know not to. "Leave it for inspection" was rejected because nothing records the key — it is minted per call from a timestamp and a random suffix — so the object would be un-findable litter rather than evidence. The mismatch path therefore calls the same cleanup helper the catch does, immediately before its return.

Built on batch 7, not over it

#12981 batch 7 made a refused cleanup name the key it left behind. That repair is intact — it moved into the shared removeProbeObject helper, warn level and message text unchanged — and it now covers the mismatch path too, which it could not reach before because no cleanup was attempted there. One pin drives exactly that case.

What did NOT change

No sweep for the __objectstack_probe__/ prefix — out of scope by the card. What the probe reports to the operator is unchanged on every path: the same result shape and the same messages, pinned in every case below. No published surface changes and no accept/reject behaviour moves.

Verification

All numbers from head 11c802f5d.

Pins — packages/services/service-storage/src/storage-service-plugin.probe-cleanup-store.test.ts

Every store in the file is a realLocalStorageAdapter on its own temp directory with exactly one verb replaced (via Object.create, so every other member stays the adapter's own). PUT allowed / GET refused is the ordinary shape of a half-right credential and it is what makes the leak observable: the bytes really land on disk, then the probe really fails. The assertions read the filesystem — what is left under __objectstack_probe__/ when the handler returns — rather than a call counter that could agree with a store nobody wrote to.

case	kind
failed probe with edited credentials leaves nothing in the TEMPORARY store (and the persisted store is neither written to nor asked to delete)	pin
failed probe with no edited credentials leaves nothing in the PERSISTED store	declared control
an adapter that fails to build is reported, and no cleanup is attempted anywhere	declared control
a mismatch on edited credentials leaves nothing in the TEMPORARY store	pin
a mismatch with no edited credentials leaves nothing in the PERSISTED store	pin
a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch	pin

The two controls are green in both directions by construction — with no overrides target === proxy, so the old code deleted from the right store by accident, and the old code also attempted no cleanup after a build failure. They are declared as controls in the file's header and are not ablation evidence; they are there so the pins cannot pass on a handler that deletes from everything, or on one that cleans up after a store it never wrote to.

Ablation

Predicted before the run: reverting only storage-service-plugin.ts reddens the 4 pins and leaves the 2 controls green.

Procedure: the repair was committed first (c80f33a90); the mutation reverted the single file to its pre-fix blob in the worktree only; an EXIT INT TERM trap restored it with an absolute path; the mutation was confirmed on disk before measuring, by blob hash and by marker counts, never by an editor's exit code. No rebuild is in the loop: the pins import the module under test by relative path within the same package, so vitest reads the source .ts, and this package's vitest.config.ts carries no alias that could route it to dist/.

== blobs: HEAD(fixed)=56697fe055842a08f8f46703478e1bfefb57f373 HEAD~1(pre-fix)=51f623729c21dd6824d69cccc3be1b843779f4c7
== markers BEFORE mutation (working tree = the repair)
removeProbeObject: 3
proxy-as-IStorageService-delete: 0
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373
== MUTATE (revert the handler to the pre-fix blob; worktree only, index untouched)
hash-on-disk: 51f623729c21dd6824d69cccc3be1b843779f4c7
removeProbeObject: 0 (expect 0 — the repair's helper is gone)
proxy-as-IStorageService-delete: 1 (expect 1 — the wrong-store cleanup is back)
== MUTATED RUN
mutated-run-exit=1
× … defect 1 … a failed probe with EDITED credentials leaves nothing behind in the TEMPORARY store
✓ … CONTROL: a failed probe with NO edited credentials leaves nothing behind in the PERSISTED store
✓ … CONTROL: an adapter that fails to BUILD is reported, and no cleanup is attempted anywhere
× … defect 2 … a mismatch on EDITED credentials leaves nothing behind in the TEMPORARY store
× … defect 2 … a mismatch with NO edited credentials leaves nothing behind in the PERSISTED store
× … defect 2 … a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch
Test Files 1 failed (1)
Tests 4 failed | 2 passed (6)
== RESTORE
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373 (expect 56697fe055842a08f8f46703478e1bfefb57f373)
removeProbeObject: 3
git diff HEAD -- target: []
git status --porcelain -- target: []
== RESTORED RUN
restored-run-exit=0
Test Files 1 passed (1)
Tests 6 passed (6)

The mutated failures are the leak itself, named on disk:

AssertionError: expected [ '1788193993158-fbkl7y8s' ] to deeply equal []
AssertionError: expected [ '1788193993188-8cske18x' ] to deeply equal []
AssertionError: expected [ '1788193993190-d0e7dm5m' ] to deeply equal []
AssertionError: expected [] to have a length of 1 but got +0 (the refusal warning that is never logged, because no cleanup is attempted)

Direction observed = direction predicted. The restore leg is proven by state — hash back to the HEAD blob, empty git diff HEAD, empty git status --porcelain — and re-measured green afterwards, so no later reading was taken on a mutated tree.

Suites and gates

• pnpm --filter @objectstack/service-storage exec vitest run --maxWorkers=2 — 35 files, 528 tests passed (the whole package, including The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 7's own file).
• pnpm --filter @objectstack/service-storage exec tsc --noEmit — 51 errors, zero of them in either changed file. That is exactly this package's frozen DEBT ledger count, so check:type-check-debt's re-measure cannot move up on this diff. Run with the dependency closure built (pnpm --filter '@objectstack/service-storage^...' build), which is the ledger's own measurement condition.
• Gate family re-derived from the actual diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (both output sections read whole; the family is identical at the final head). All 36 harvested commands run; 32 green, and 4 report PREREQUISITE NOT MET, i.e. NOT MEASURED, never a pass and never a red: check:test-completeness (exit 3 — grades a saved turbo test log, none exists locally), check:dual-build-cjs-loads (exit 3 — needs a full pnpm build), check:i18n and check:type-check-debt (both need a built workspace closure; both refuse rather than measure). CI builds the workspace and runs all four.
• The slot-lookup erasure ratchet did not move; the gate's own verdict line: ✓ slot-lookup ratchet holds: 106 unswept site(s) in 25 file(s), none new, and every file in the population parsed.
• ESLint: declared narrowing to the two changed files rather than the repo-wide pnpm lint, which CI owns and runs regardless. pnpm exec eslint --no-inline-config --format json on both paths — 2 files linted, 0 errors, 0 warnings; both were accepted into eslint's own population rather than ignored (they are returned as results). The narrowing excludes nothing: this repo runs one eslint.config.mjs which never enables type-aware linting for any file (no parserOptions.project, no typed rules — stated and measured in the config's own header), so no rule's verdict on an untouched file is a function of this diff. Independently, check:slot-lookup executes ESLint across all of packages/ with the baseline's ignores lifted, and holds.

Changeset

.changeset/storage-probe-cleanup-target-store.md, patch on @objectstack/service-storage: the behaviour an operator can observe does move — the probe no longer leaves objects in the store it wrote to — even though no API surface does.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4642f4c64c002f94f1d737bbb2a5fc94ae43ddf3 → packageMentionDocs.

[claude]

Closes#13726

The settings.registerAction('storage', 'test', …) handler writes a probe object, reads it back and deletes it. When the form posts values it builds a temporary adapter first — so an operator can validate credentials that are typed but not yet saved — and probes that adapter instead of the persisted one. Two paths left the probe object behind in whichever store it was actually written to. Both were surfaced by the #12981 batch-7 dev inside the lines that batch edits, and correctly left alone there; re-verified by symbol on this branch's base (46b53a25b), since PR #13725 moved the line numbers.

Defect 1 — the failure cleanup deleted from a store the probe never wrote to

let target: IStorageService = proxy was declared inside the try, so at the catch the only name in scope was proxy, the persisted adapter. On the case the temporary adapter exists for — a failed test with edited credentials — the object leaked in the store that held it while a delete was issued against a store that never did. Deleting an absent key is a no-op on both shipped adapters, so the wrong-store delete "succeeded" and nothing looked wrong.

Repaired by resolving the adapter before the try whose catch has to clean up after it. That makes "the cleanup names the store the upload named" true by construction rather than by two expressions that happen to agree today.

Defect 2 — the content-mismatch return path cleaned up nothing

Reaching the round-trip comparison means the upload already succeeded, so the object is definitely present — and the return walked straight past the delete on the very next line. A guaranteed leak, not a best-effort one, on the one path that by construction only fires when the adapter is misbehaving. It now runs the same best-effort cleanup as the failure path.

The two judgement calls

1. "target may be unassigned, or may be the very thing that threw." The card is right that a delete against a half-built adapter is its own question, and the answer here is that the question is dissolved rather than answered: buildAdapterFromValues already had its own inner catch that returns, so a construction failure never reached the outer catch — but the reader could not see that from the catch, because the declaration was out of scope there. Hoisting the resolution above the try states the invariant where it can be read: past that point target is either proxy or a fully constructed temporary adapter. A construction failure still returns before anything is written, and on that path no cleanup is attempted at all — nothing was written, and a delete would have to name an adapter that does not exist. That decision is pinned (as a declared control, below), so a later "tidy-up" that adds a finally reddens it.

2. Where defect 2 cleans up. A finally was rejected: the success path already deletes on its own line, and its failure IS a probe failure the operator must be told about, so a finally would either delete twice or need a flag to know not to. "Leave it for inspection" was rejected because nothing records the key — it is minted per call from a timestamp and a random suffix — so the object would be un-findable litter rather than evidence. The mismatch path therefore calls the same cleanup helper the catch does, immediately before its return.

Built on batch 7, not over it

#12981 batch 7 made a refused cleanup name the key it left behind. That repair is intact — it moved into the shared removeProbeObject helper, warn level and message text unchanged — and it now covers the mismatch path too, which it could not reach before because no cleanup was attempted there. One pin drives exactly that case.

What did NOT change

No sweep for the __objectstack_probe__/ prefix — out of scope by the card. What the probe reports to the operator is unchanged on every path: the same result shape and the same messages, pinned in every case below. No published surface changes and no accept/reject behaviour moves.

Verification

All numbers from head 11c802f5d.

Pins — packages/services/service-storage/src/storage-service-plugin.probe-cleanup-store.test.ts

Every store in the file is a realLocalStorageAdapter on its own temp directory with exactly one verb replaced (via Object.create, so every other member stays the adapter's own). PUT allowed / GET refused is the ordinary shape of a half-right credential and it is what makes the leak observable: the bytes really land on disk, then the probe really fails. The assertions read the filesystem — what is left under __objectstack_probe__/ when the handler returns — rather than a call counter that could agree with a store nobody wrote to.

case	kind
failed probe with edited credentials leaves nothing in the TEMPORARY store (and the persisted store is neither written to nor asked to delete)	pin
failed probe with no edited credentials leaves nothing in the PERSISTED store	declared control
an adapter that fails to build is reported, and no cleanup is attempted anywhere	declared control
a mismatch on edited credentials leaves nothing in the TEMPORARY store	pin
a mismatch with no edited credentials leaves nothing in the PERSISTED store	pin
a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch	pin

The two controls are green in both directions by construction — with no overrides target === proxy, so the old code deleted from the right store by accident, and the old code also attempted no cleanup after a build failure. They are declared as controls in the file's header and are not ablation evidence; they are there so the pins cannot pass on a handler that deletes from everything, or on one that cleans up after a store it never wrote to.

Ablation

Predicted before the run: reverting only storage-service-plugin.ts reddens the 4 pins and leaves the 2 controls green.

Procedure: the repair was committed first (c80f33a90); the mutation reverted the single file to its pre-fix blob in the worktree only; an EXIT INT TERM trap restored it with an absolute path; the mutation was confirmed on disk before measuring, by blob hash and by marker counts, never by an editor's exit code. No rebuild is in the loop: the pins import the module under test by relative path within the same package, so vitest reads the source .ts, and this package's vitest.config.ts carries no alias that could route it to dist/.

== blobs: HEAD(fixed)=56697fe055842a08f8f46703478e1bfefb57f373 HEAD~1(pre-fix)=51f623729c21dd6824d69cccc3be1b843779f4c7
== markers BEFORE mutation (working tree = the repair)
removeProbeObject: 3
proxy-as-IStorageService-delete: 0
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373
== MUTATE (revert the handler to the pre-fix blob; worktree only, index untouched)
hash-on-disk: 51f623729c21dd6824d69cccc3be1b843779f4c7
removeProbeObject: 0 (expect 0 — the repair's helper is gone)
proxy-as-IStorageService-delete: 1 (expect 1 — the wrong-store cleanup is back)
== MUTATED RUN
mutated-run-exit=1
× … defect 1 … a failed probe with EDITED credentials leaves nothing behind in the TEMPORARY store
✓ … CONTROL: a failed probe with NO edited credentials leaves nothing behind in the PERSISTED store
✓ … CONTROL: an adapter that fails to BUILD is reported, and no cleanup is attempted anywhere
× … defect 2 … a mismatch on EDITED credentials leaves nothing behind in the TEMPORARY store
× … defect 2 … a mismatch with NO edited credentials leaves nothing behind in the PERSISTED store
× … defect 2 … a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch
Test Files 1 failed (1)
Tests 4 failed | 2 passed (6)
== RESTORE
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373 (expect 56697fe055842a08f8f46703478e1bfefb57f373)
removeProbeObject: 3
git diff HEAD -- target: []
git status --porcelain -- target: []
== RESTORED RUN
restored-run-exit=0
Test Files 1 passed (1)
Tests 6 passed (6)

The mutated failures are the leak itself, named on disk:

AssertionError: expected [ '1788193993158-fbkl7y8s' ] to deeply equal []
AssertionError: expected [ '1788193993188-8cske18x' ] to deeply equal []
AssertionError: expected [ '1788193993190-d0e7dm5m' ] to deeply equal []
AssertionError: expected [] to have a length of 1 but got +0 (the refusal warning that is never logged, because no cleanup is attempted)

Direction observed = direction predicted. The restore leg is proven by state — hash back to the HEAD blob, empty git diff HEAD, empty git status --porcelain — and re-measured green afterwards, so no later reading was taken on a mutated tree.

Suites and gates

• pnpm --filter @objectstack/service-storage exec vitest run --maxWorkers=2 — 35 files, 528 tests passed (the whole package, including The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 7's own file).
• pnpm --filter @objectstack/service-storage exec tsc --noEmit — 51 errors, zero of them in either changed file. That is exactly this package's frozen DEBT ledger count, so check:type-check-debt's re-measure cannot move up on this diff. Run with the dependency closure built (pnpm --filter '@objectstack/service-storage^...' build), which is the ledger's own measurement condition.
• Gate family re-derived from the actual diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (both output sections read whole; the family is identical at the final head). All 36 harvested commands run; 32 green, and 4 report PREREQUISITE NOT MET, i.e. NOT MEASURED, never a pass and never a red: check:test-completeness (exit 3 — grades a saved turbo test log, none exists locally), check:dual-build-cjs-loads (exit 3 — needs a full pnpm build), check:i18n and check:type-check-debt (both need a built workspace closure; both refuse rather than measure). CI builds the workspace and runs all four.
• The slot-lookup erasure ratchet did not move; the gate's own verdict line: ✓ slot-lookup ratchet holds: 106 unswept site(s) in 25 file(s), none new, and every file in the population parsed.
• ESLint: declared narrowing to the two changed files rather than the repo-wide pnpm lint, which CI owns and runs regardless. pnpm exec eslint --no-inline-config --format json on both paths — 2 files linted, 0 errors, 0 warnings; both were accepted into eslint's own population rather than ignored (they are returned as results). The narrowing excludes nothing: this repo runs one eslint.config.mjs which never enables type-aware linting for any file (no parserOptions.project, no typed rules — stated and measured in the config's own header), so no rule's verdict on an untouched file is a function of this diff. Independently, check:slot-lookup executes ESLint across all of packages/ with the baseline's ignores lifted, and holds.

Changeset

.changeset/storage-probe-cleanup-target-store.md, patch on @objectstack/service-storage: the behaviour an operator can observe does move — the probe no longer leaves objects in the store it wrote to — even though no API surface does.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4642f4c64c002f94f1d737bbb2a5fc94ae43ddf3 → packageMentionDocs.

[claude]

Closes#13726

The settings.registerAction('storage', 'test', …) handler writes a probe object, reads it back and deletes it. When the form posts values it builds a temporary adapter first — so an operator can validate credentials that are typed but not yet saved — and probes that adapter instead of the persisted one. Two paths left the probe object behind in whichever store it was actually written to. Both were surfaced by the #12981 batch-7 dev inside the lines that batch edits, and correctly left alone there; re-verified by symbol on this branch's base (46b53a25b), since PR #13725 moved the line numbers.

Defect 1 — the failure cleanup deleted from a store the probe never wrote to

let target: IStorageService = proxy was declared inside the try, so at the catch the only name in scope was proxy, the persisted adapter. On the case the temporary adapter exists for — a failed test with edited credentials — the object leaked in the store that held it while a delete was issued against a store that never did. Deleting an absent key is a no-op on both shipped adapters, so the wrong-store delete "succeeded" and nothing looked wrong.

Repaired by resolving the adapter before the try whose catch has to clean up after it. That makes "the cleanup names the store the upload named" true by construction rather than by two expressions that happen to agree today.

Defect 2 — the content-mismatch return path cleaned up nothing

Reaching the round-trip comparison means the upload already succeeded, so the object is definitely present — and the return walked straight past the delete on the very next line. A guaranteed leak, not a best-effort one, on the one path that by construction only fires when the adapter is misbehaving. It now runs the same best-effort cleanup as the failure path.

The two judgement calls

1. "target may be unassigned, or may be the very thing that threw." The card is right that a delete against a half-built adapter is its own question, and the answer here is that the question is dissolved rather than answered: buildAdapterFromValues already had its own inner catch that returns, so a construction failure never reached the outer catch — but the reader could not see that from the catch, because the declaration was out of scope there. Hoisting the resolution above the try states the invariant where it can be read: past that point target is either proxy or a fully constructed temporary adapter. A construction failure still returns before anything is written, and on that path no cleanup is attempted at all — nothing was written, and a delete would have to name an adapter that does not exist. That decision is pinned (as a declared control, below), so a later "tidy-up" that adds a finally reddens it.

2. Where defect 2 cleans up. A finally was rejected: the success path already deletes on its own line, and its failure IS a probe failure the operator must be told about, so a finally would either delete twice or need a flag to know not to. "Leave it for inspection" was rejected because nothing records the key — it is minted per call from a timestamp and a random suffix — so the object would be un-findable litter rather than evidence. The mismatch path therefore calls the same cleanup helper the catch does, immediately before its return.

Built on batch 7, not over it

#12981 batch 7 made a refused cleanup name the key it left behind. That repair is intact — it moved into the shared removeProbeObject helper, warn level and message text unchanged — and it now covers the mismatch path too, which it could not reach before because no cleanup was attempted there. One pin drives exactly that case.

What did NOT change

No sweep for the __objectstack_probe__/ prefix — out of scope by the card. What the probe reports to the operator is unchanged on every path: the same result shape and the same messages, pinned in every case below. No published surface changes and no accept/reject behaviour moves.

Verification

All numbers from head 11c802f5d.

Pins — packages/services/service-storage/src/storage-service-plugin.probe-cleanup-store.test.ts

Every store in the file is a realLocalStorageAdapter on its own temp directory with exactly one verb replaced (via Object.create, so every other member stays the adapter's own). PUT allowed / GET refused is the ordinary shape of a half-right credential and it is what makes the leak observable: the bytes really land on disk, then the probe really fails. The assertions read the filesystem — what is left under __objectstack_probe__/ when the handler returns — rather than a call counter that could agree with a store nobody wrote to.

case	kind
failed probe with edited credentials leaves nothing in the TEMPORARY store (and the persisted store is neither written to nor asked to delete)	pin
failed probe with no edited credentials leaves nothing in the PERSISTED store	declared control
an adapter that fails to build is reported, and no cleanup is attempted anywhere	declared control
a mismatch on edited credentials leaves nothing in the TEMPORARY store	pin
a mismatch with no edited credentials leaves nothing in the PERSISTED store	pin
a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch	pin

The two controls are green in both directions by construction — with no overrides target === proxy, so the old code deleted from the right store by accident, and the old code also attempted no cleanup after a build failure. They are declared as controls in the file's header and are not ablation evidence; they are there so the pins cannot pass on a handler that deletes from everything, or on one that cleans up after a store it never wrote to.

Ablation

Predicted before the run: reverting only storage-service-plugin.ts reddens the 4 pins and leaves the 2 controls green.

Procedure: the repair was committed first (c80f33a90); the mutation reverted the single file to its pre-fix blob in the worktree only; an EXIT INT TERM trap restored it with an absolute path; the mutation was confirmed on disk before measuring, by blob hash and by marker counts, never by an editor's exit code. No rebuild is in the loop: the pins import the module under test by relative path within the same package, so vitest reads the source .ts, and this package's vitest.config.ts carries no alias that could route it to dist/.

== blobs: HEAD(fixed)=56697fe055842a08f8f46703478e1bfefb57f373 HEAD~1(pre-fix)=51f623729c21dd6824d69cccc3be1b843779f4c7
== markers BEFORE mutation (working tree = the repair)
removeProbeObject: 3
proxy-as-IStorageService-delete: 0
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373
== MUTATE (revert the handler to the pre-fix blob; worktree only, index untouched)
hash-on-disk: 51f623729c21dd6824d69cccc3be1b843779f4c7
removeProbeObject: 0 (expect 0 — the repair's helper is gone)
proxy-as-IStorageService-delete: 1 (expect 1 — the wrong-store cleanup is back)
== MUTATED RUN
mutated-run-exit=1
× … defect 1 … a failed probe with EDITED credentials leaves nothing behind in the TEMPORARY store
✓ … CONTROL: a failed probe with NO edited credentials leaves nothing behind in the PERSISTED store
✓ … CONTROL: an adapter that fails to BUILD is reported, and no cleanup is attempted anywhere
× … defect 2 … a mismatch on EDITED credentials leaves nothing behind in the TEMPORARY store
× … defect 2 … a mismatch with NO edited credentials leaves nothing behind in the PERSISTED store
× … defect 2 … a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch
Test Files 1 failed (1)
Tests 4 failed | 2 passed (6)
== RESTORE
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373 (expect 56697fe055842a08f8f46703478e1bfefb57f373)
removeProbeObject: 3
git diff HEAD -- target: []
git status --porcelain -- target: []
== RESTORED RUN
restored-run-exit=0
Test Files 1 passed (1)
Tests 6 passed (6)

The mutated failures are the leak itself, named on disk:

AssertionError: expected [ '1788193993158-fbkl7y8s' ] to deeply equal []
AssertionError: expected [ '1788193993188-8cske18x' ] to deeply equal []
AssertionError: expected [ '1788193993190-d0e7dm5m' ] to deeply equal []
AssertionError: expected [] to have a length of 1 but got +0 (the refusal warning that is never logged, because no cleanup is attempted)

Direction observed = direction predicted. The restore leg is proven by state — hash back to the HEAD blob, empty git diff HEAD, empty git status --porcelain — and re-measured green afterwards, so no later reading was taken on a mutated tree.

Suites and gates

• pnpm --filter @objectstack/service-storage exec vitest run --maxWorkers=2 — 35 files, 528 tests passed (the whole package, including The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 7's own file).
• pnpm --filter @objectstack/service-storage exec tsc --noEmit — 51 errors, zero of them in either changed file. That is exactly this package's frozen DEBT ledger count, so check:type-check-debt's re-measure cannot move up on this diff. Run with the dependency closure built (pnpm --filter '@objectstack/service-storage^...' build), which is the ledger's own measurement condition.
• Gate family re-derived from the actual diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (both output sections read whole; the family is identical at the final head). All 36 harvested commands run; 32 green, and 4 report PREREQUISITE NOT MET, i.e. NOT MEASURED, never a pass and never a red: check:test-completeness (exit 3 — grades a saved turbo test log, none exists locally), check:dual-build-cjs-loads (exit 3 — needs a full pnpm build), check:i18n and check:type-check-debt (both need a built workspace closure; both refuse rather than measure). CI builds the workspace and runs all four.
• The slot-lookup erasure ratchet did not move; the gate's own verdict line: ✓ slot-lookup ratchet holds: 106 unswept site(s) in 25 file(s), none new, and every file in the population parsed.
• ESLint: declared narrowing to the two changed files rather than the repo-wide pnpm lint, which CI owns and runs regardless. pnpm exec eslint --no-inline-config --format json on both paths — 2 files linted, 0 errors, 0 warnings; both were accepted into eslint's own population rather than ignored (they are returned as results). The narrowing excludes nothing: this repo runs one eslint.config.mjs which never enables type-aware linting for any file (no parserOptions.project, no typed rules — stated and measured in the config's own header), so no rule's verdict on an untouched file is a function of this diff. Independently, check:slot-lookup executes ESLint across all of packages/ with the baseline's ignores lifted, and holds.

Changeset

.changeset/storage-probe-cleanup-target-store.md, patch on @objectstack/service-storage: the behaviour an operator can observe does move — the probe no longer leaves objects in the store it wrote to — even though no API surface does.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4642f4c64c002f94f1d737bbb2a5fc94ae43ddf3 → packageMentionDocs.

[claude]

Closes#13726

The settings.registerAction('storage', 'test', …) handler writes a probe object, reads it back and deletes it. When the form posts values it builds a temporary adapter first — so an operator can validate credentials that are typed but not yet saved — and probes that adapter instead of the persisted one. Two paths left the probe object behind in whichever store it was actually written to. Both were surfaced by the #12981 batch-7 dev inside the lines that batch edits, and correctly left alone there; re-verified by symbol on this branch's base (46b53a25b), since PR #13725 moved the line numbers.

Defect 1 — the failure cleanup deleted from a store the probe never wrote to

let target: IStorageService = proxy was declared inside the try, so at the catch the only name in scope was proxy, the persisted adapter. On the case the temporary adapter exists for — a failed test with edited credentials — the object leaked in the store that held it while a delete was issued against a store that never did. Deleting an absent key is a no-op on both shipped adapters, so the wrong-store delete "succeeded" and nothing looked wrong.

Repaired by resolving the adapter before the try whose catch has to clean up after it. That makes "the cleanup names the store the upload named" true by construction rather than by two expressions that happen to agree today.

Defect 2 — the content-mismatch return path cleaned up nothing

Reaching the round-trip comparison means the upload already succeeded, so the object is definitely present — and the return walked straight past the delete on the very next line. A guaranteed leak, not a best-effort one, on the one path that by construction only fires when the adapter is misbehaving. It now runs the same best-effort cleanup as the failure path.

The two judgement calls

1. "target may be unassigned, or may be the very thing that threw." The card is right that a delete against a half-built adapter is its own question, and the answer here is that the question is dissolved rather than answered: buildAdapterFromValues already had its own inner catch that returns, so a construction failure never reached the outer catch — but the reader could not see that from the catch, because the declaration was out of scope there. Hoisting the resolution above the try states the invariant where it can be read: past that point target is either proxy or a fully constructed temporary adapter. A construction failure still returns before anything is written, and on that path no cleanup is attempted at all — nothing was written, and a delete would have to name an adapter that does not exist. That decision is pinned (as a declared control, below), so a later "tidy-up" that adds a finally reddens it.

2. Where defect 2 cleans up. A finally was rejected: the success path already deletes on its own line, and its failure IS a probe failure the operator must be told about, so a finally would either delete twice or need a flag to know not to. "Leave it for inspection" was rejected because nothing records the key — it is minted per call from a timestamp and a random suffix — so the object would be un-findable litter rather than evidence. The mismatch path therefore calls the same cleanup helper the catch does, immediately before its return.

Built on batch 7, not over it

#12981 batch 7 made a refused cleanup name the key it left behind. That repair is intact — it moved into the shared removeProbeObject helper, warn level and message text unchanged — and it now covers the mismatch path too, which it could not reach before because no cleanup was attempted there. One pin drives exactly that case.

What did NOT change

No sweep for the __objectstack_probe__/ prefix — out of scope by the card. What the probe reports to the operator is unchanged on every path: the same result shape and the same messages, pinned in every case below. No published surface changes and no accept/reject behaviour moves.

Verification

All numbers from head 11c802f5d.

Pins — packages/services/service-storage/src/storage-service-plugin.probe-cleanup-store.test.ts

Every store in the file is a realLocalStorageAdapter on its own temp directory with exactly one verb replaced (via Object.create, so every other member stays the adapter's own). PUT allowed / GET refused is the ordinary shape of a half-right credential and it is what makes the leak observable: the bytes really land on disk, then the probe really fails. The assertions read the filesystem — what is left under __objectstack_probe__/ when the handler returns — rather than a call counter that could agree with a store nobody wrote to.

case	kind
failed probe with edited credentials leaves nothing in the TEMPORARY store (and the persisted store is neither written to nor asked to delete)	pin
failed probe with no edited credentials leaves nothing in the PERSISTED store	declared control
an adapter that fails to build is reported, and no cleanup is attempted anywhere	declared control
a mismatch on edited credentials leaves nothing in the TEMPORARY store	pin
a mismatch with no edited credentials leaves nothing in the PERSISTED store	pin
a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch	pin

The two controls are green in both directions by construction — with no overrides target === proxy, so the old code deleted from the right store by accident, and the old code also attempted no cleanup after a build failure. They are declared as controls in the file's header and are not ablation evidence; they are there so the pins cannot pass on a handler that deletes from everything, or on one that cleans up after a store it never wrote to.

Ablation

Predicted before the run: reverting only storage-service-plugin.ts reddens the 4 pins and leaves the 2 controls green.

Procedure: the repair was committed first (c80f33a90); the mutation reverted the single file to its pre-fix blob in the worktree only; an EXIT INT TERM trap restored it with an absolute path; the mutation was confirmed on disk before measuring, by blob hash and by marker counts, never by an editor's exit code. No rebuild is in the loop: the pins import the module under test by relative path within the same package, so vitest reads the source .ts, and this package's vitest.config.ts carries no alias that could route it to dist/.

== blobs: HEAD(fixed)=56697fe055842a08f8f46703478e1bfefb57f373 HEAD~1(pre-fix)=51f623729c21dd6824d69cccc3be1b843779f4c7
== markers BEFORE mutation (working tree = the repair)
removeProbeObject: 3
proxy-as-IStorageService-delete: 0
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373
== MUTATE (revert the handler to the pre-fix blob; worktree only, index untouched)
hash-on-disk: 51f623729c21dd6824d69cccc3be1b843779f4c7
removeProbeObject: 0 (expect 0 — the repair's helper is gone)
proxy-as-IStorageService-delete: 1 (expect 1 — the wrong-store cleanup is back)
== MUTATED RUN
mutated-run-exit=1
× … defect 1 … a failed probe with EDITED credentials leaves nothing behind in the TEMPORARY store
✓ … CONTROL: a failed probe with NO edited credentials leaves nothing behind in the PERSISTED store
✓ … CONTROL: an adapter that fails to BUILD is reported, and no cleanup is attempted anywhere
× … defect 2 … a mismatch on EDITED credentials leaves nothing behind in the TEMPORARY store
× … defect 2 … a mismatch with NO edited credentials leaves nothing behind in the PERSISTED store
× … defect 2 … a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch
Test Files 1 failed (1)
Tests 4 failed | 2 passed (6)
== RESTORE
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373 (expect 56697fe055842a08f8f46703478e1bfefb57f373)
removeProbeObject: 3
git diff HEAD -- target: []
git status --porcelain -- target: []
== RESTORED RUN
restored-run-exit=0
Test Files 1 passed (1)
Tests 6 passed (6)

The mutated failures are the leak itself, named on disk:

AssertionError: expected [ '1788193993158-fbkl7y8s' ] to deeply equal []
AssertionError: expected [ '1788193993188-8cske18x' ] to deeply equal []
AssertionError: expected [ '1788193993190-d0e7dm5m' ] to deeply equal []
AssertionError: expected [] to have a length of 1 but got +0 (the refusal warning that is never logged, because no cleanup is attempted)

Direction observed = direction predicted. The restore leg is proven by state — hash back to the HEAD blob, empty git diff HEAD, empty git status --porcelain — and re-measured green afterwards, so no later reading was taken on a mutated tree.

Suites and gates

• pnpm --filter @objectstack/service-storage exec vitest run --maxWorkers=2 — 35 files, 528 tests passed (the whole package, including The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 7's own file).
• pnpm --filter @objectstack/service-storage exec tsc --noEmit — 51 errors, zero of them in either changed file. That is exactly this package's frozen DEBT ledger count, so check:type-check-debt's re-measure cannot move up on this diff. Run with the dependency closure built (pnpm --filter '@objectstack/service-storage^...' build), which is the ledger's own measurement condition.
• Gate family re-derived from the actual diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (both output sections read whole; the family is identical at the final head). All 36 harvested commands run; 32 green, and 4 report PREREQUISITE NOT MET, i.e. NOT MEASURED, never a pass and never a red: check:test-completeness (exit 3 — grades a saved turbo test log, none exists locally), check:dual-build-cjs-loads (exit 3 — needs a full pnpm build), check:i18n and check:type-check-debt (both need a built workspace closure; both refuse rather than measure). CI builds the workspace and runs all four.
• The slot-lookup erasure ratchet did not move; the gate's own verdict line: ✓ slot-lookup ratchet holds: 106 unswept site(s) in 25 file(s), none new, and every file in the population parsed.
• ESLint: declared narrowing to the two changed files rather than the repo-wide pnpm lint, which CI owns and runs regardless. pnpm exec eslint --no-inline-config --format json on both paths — 2 files linted, 0 errors, 0 warnings; both were accepted into eslint's own population rather than ignored (they are returned as results). The narrowing excludes nothing: this repo runs one eslint.config.mjs which never enables type-aware linting for any file (no parserOptions.project, no typed rules — stated and measured in the config's own header), so no rule's verdict on an untouched file is a function of this diff. Independently, check:slot-lookup executes ESLint across all of packages/ with the baseline's ignores lifted, and holds.

Changeset

.changeset/storage-probe-cleanup-target-store.md, patch on @objectstack/service-storage: the behaviour an operator can observe does move — the probe no longer leaves objects in the store it wrote to — even though no API surface does.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4642f4c64c002f94f1d737bbb2a5fc94ae43ddf3 → packageMentionDocs.

[claude]

Closes#13726

The settings.registerAction('storage', 'test', …) handler writes a probe object, reads it back and deletes it. When the form posts values it builds a temporary adapter first — so an operator can validate credentials that are typed but not yet saved — and probes that adapter instead of the persisted one. Two paths left the probe object behind in whichever store it was actually written to. Both were surfaced by the #12981 batch-7 dev inside the lines that batch edits, and correctly left alone there; re-verified by symbol on this branch's base (46b53a25b), since PR #13725 moved the line numbers.

Defect 1 — the failure cleanup deleted from a store the probe never wrote to

let target: IStorageService = proxy was declared inside the try, so at the catch the only name in scope was proxy, the persisted adapter. On the case the temporary adapter exists for — a failed test with edited credentials — the object leaked in the store that held it while a delete was issued against a store that never did. Deleting an absent key is a no-op on both shipped adapters, so the wrong-store delete "succeeded" and nothing looked wrong.

Repaired by resolving the adapter before the try whose catch has to clean up after it. That makes "the cleanup names the store the upload named" true by construction rather than by two expressions that happen to agree today.

Defect 2 — the content-mismatch return path cleaned up nothing

Reaching the round-trip comparison means the upload already succeeded, so the object is definitely present — and the return walked straight past the delete on the very next line. A guaranteed leak, not a best-effort one, on the one path that by construction only fires when the adapter is misbehaving. It now runs the same best-effort cleanup as the failure path.

The two judgement calls

1. "target may be unassigned, or may be the very thing that threw." The card is right that a delete against a half-built adapter is its own question, and the answer here is that the question is dissolved rather than answered: buildAdapterFromValues already had its own inner catch that returns, so a construction failure never reached the outer catch — but the reader could not see that from the catch, because the declaration was out of scope there. Hoisting the resolution above the try states the invariant where it can be read: past that point target is either proxy or a fully constructed temporary adapter. A construction failure still returns before anything is written, and on that path no cleanup is attempted at all — nothing was written, and a delete would have to name an adapter that does not exist. That decision is pinned (as a declared control, below), so a later "tidy-up" that adds a finally reddens it.

2. Where defect 2 cleans up. A finally was rejected: the success path already deletes on its own line, and its failure IS a probe failure the operator must be told about, so a finally would either delete twice or need a flag to know not to. "Leave it for inspection" was rejected because nothing records the key — it is minted per call from a timestamp and a random suffix — so the object would be un-findable litter rather than evidence. The mismatch path therefore calls the same cleanup helper the catch does, immediately before its return.

Built on batch 7, not over it

#12981 batch 7 made a refused cleanup name the key it left behind. That repair is intact — it moved into the shared removeProbeObject helper, warn level and message text unchanged — and it now covers the mismatch path too, which it could not reach before because no cleanup was attempted there. One pin drives exactly that case.

What did NOT change

No sweep for the __objectstack_probe__/ prefix — out of scope by the card. What the probe reports to the operator is unchanged on every path: the same result shape and the same messages, pinned in every case below. No published surface changes and no accept/reject behaviour moves.

Verification

All numbers from head 11c802f5d.

Pins — packages/services/service-storage/src/storage-service-plugin.probe-cleanup-store.test.ts

Every store in the file is a realLocalStorageAdapter on its own temp directory with exactly one verb replaced (via Object.create, so every other member stays the adapter's own). PUT allowed / GET refused is the ordinary shape of a half-right credential and it is what makes the leak observable: the bytes really land on disk, then the probe really fails. The assertions read the filesystem — what is left under __objectstack_probe__/ when the handler returns — rather than a call counter that could agree with a store nobody wrote to.

case	kind
failed probe with edited credentials leaves nothing in the TEMPORARY store (and the persisted store is neither written to nor asked to delete)	pin
failed probe with no edited credentials leaves nothing in the PERSISTED store	declared control
an adapter that fails to build is reported, and no cleanup is attempted anywhere	declared control
a mismatch on edited credentials leaves nothing in the TEMPORARY store	pin
a mismatch with no edited credentials leaves nothing in the PERSISTED store	pin
a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch	pin

The two controls are green in both directions by construction — with no overrides target === proxy, so the old code deleted from the right store by accident, and the old code also attempted no cleanup after a build failure. They are declared as controls in the file's header and are not ablation evidence; they are there so the pins cannot pass on a handler that deletes from everything, or on one that cleans up after a store it never wrote to.

Ablation

Predicted before the run: reverting only storage-service-plugin.ts reddens the 4 pins and leaves the 2 controls green.

Procedure: the repair was committed first (c80f33a90); the mutation reverted the single file to its pre-fix blob in the worktree only; an EXIT INT TERM trap restored it with an absolute path; the mutation was confirmed on disk before measuring, by blob hash and by marker counts, never by an editor's exit code. No rebuild is in the loop: the pins import the module under test by relative path within the same package, so vitest reads the source .ts, and this package's vitest.config.ts carries no alias that could route it to dist/.

== blobs: HEAD(fixed)=56697fe055842a08f8f46703478e1bfefb57f373 HEAD~1(pre-fix)=51f623729c21dd6824d69cccc3be1b843779f4c7
== markers BEFORE mutation (working tree = the repair)
removeProbeObject: 3
proxy-as-IStorageService-delete: 0
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373
== MUTATE (revert the handler to the pre-fix blob; worktree only, index untouched)
hash-on-disk: 51f623729c21dd6824d69cccc3be1b843779f4c7
removeProbeObject: 0 (expect 0 — the repair's helper is gone)
proxy-as-IStorageService-delete: 1 (expect 1 — the wrong-store cleanup is back)
== MUTATED RUN
mutated-run-exit=1
× … defect 1 … a failed probe with EDITED credentials leaves nothing behind in the TEMPORARY store
✓ … CONTROL: a failed probe with NO edited credentials leaves nothing behind in the PERSISTED store
✓ … CONTROL: an adapter that fails to BUILD is reported, and no cleanup is attempted anywhere
× … defect 2 … a mismatch on EDITED credentials leaves nothing behind in the TEMPORARY store
× … defect 2 … a mismatch with NO edited credentials leaves nothing behind in the PERSISTED store
× … defect 2 … a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch
Test Files 1 failed (1)
Tests 4 failed | 2 passed (6)
== RESTORE
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373 (expect 56697fe055842a08f8f46703478e1bfefb57f373)
removeProbeObject: 3
git diff HEAD -- target: []
git status --porcelain -- target: []
== RESTORED RUN
restored-run-exit=0
Test Files 1 passed (1)
Tests 6 passed (6)

The mutated failures are the leak itself, named on disk:

AssertionError: expected [ '1788193993158-fbkl7y8s' ] to deeply equal []
AssertionError: expected [ '1788193993188-8cske18x' ] to deeply equal []
AssertionError: expected [ '1788193993190-d0e7dm5m' ] to deeply equal []
AssertionError: expected [] to have a length of 1 but got +0 (the refusal warning that is never logged, because no cleanup is attempted)

Direction observed = direction predicted. The restore leg is proven by state — hash back to the HEAD blob, empty git diff HEAD, empty git status --porcelain — and re-measured green afterwards, so no later reading was taken on a mutated tree.

Suites and gates

• pnpm --filter @objectstack/service-storage exec vitest run --maxWorkers=2 — 35 files, 528 tests passed (the whole package, including The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 7's own file).
• pnpm --filter @objectstack/service-storage exec tsc --noEmit — 51 errors, zero of them in either changed file. That is exactly this package's frozen DEBT ledger count, so check:type-check-debt's re-measure cannot move up on this diff. Run with the dependency closure built (pnpm --filter '@objectstack/service-storage^...' build), which is the ledger's own measurement condition.
• Gate family re-derived from the actual diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (both output sections read whole; the family is identical at the final head). All 36 harvested commands run; 32 green, and 4 report PREREQUISITE NOT MET, i.e. NOT MEASURED, never a pass and never a red: check:test-completeness (exit 3 — grades a saved turbo test log, none exists locally), check:dual-build-cjs-loads (exit 3 — needs a full pnpm build), check:i18n and check:type-check-debt (both need a built workspace closure; both refuse rather than measure). CI builds the workspace and runs all four.
• The slot-lookup erasure ratchet did not move; the gate's own verdict line: ✓ slot-lookup ratchet holds: 106 unswept site(s) in 25 file(s), none new, and every file in the population parsed.
• ESLint: declared narrowing to the two changed files rather than the repo-wide pnpm lint, which CI owns and runs regardless. pnpm exec eslint --no-inline-config --format json on both paths — 2 files linted, 0 errors, 0 warnings; both were accepted into eslint's own population rather than ignored (they are returned as results). The narrowing excludes nothing: this repo runs one eslint.config.mjs which never enables type-aware linting for any file (no parserOptions.project, no typed rules — stated and measured in the config's own header), so no rule's verdict on an untouched file is a function of this diff. Independently, check:slot-lookup executes ESLint across all of packages/ with the baseline's ignores lifted, and holds.

Changeset

.changeset/storage-probe-cleanup-target-store.md, patch on @objectstack/service-storage: the behaviour an operator can observe does move — the probe no longer leaves objects in the store it wrote to — even though no API surface does.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4642f4c64c002f94f1d737bbb2a5fc94ae43ddf3 → packageMentionDocs.

[claude]

Closes#13726

The settings.registerAction('storage', 'test', …) handler writes a probe object, reads it back and deletes it. When the form posts values it builds a temporary adapter first — so an operator can validate credentials that are typed but not yet saved — and probes that adapter instead of the persisted one. Two paths left the probe object behind in whichever store it was actually written to. Both were surfaced by the #12981 batch-7 dev inside the lines that batch edits, and correctly left alone there; re-verified by symbol on this branch's base (46b53a25b), since PR #13725 moved the line numbers.

Defect 1 — the failure cleanup deleted from a store the probe never wrote to

let target: IStorageService = proxy was declared inside the try, so at the catch the only name in scope was proxy, the persisted adapter. On the case the temporary adapter exists for — a failed test with edited credentials — the object leaked in the store that held it while a delete was issued against a store that never did. Deleting an absent key is a no-op on both shipped adapters, so the wrong-store delete "succeeded" and nothing looked wrong.

Repaired by resolving the adapter before the try whose catch has to clean up after it. That makes "the cleanup names the store the upload named" true by construction rather than by two expressions that happen to agree today.

Defect 2 — the content-mismatch return path cleaned up nothing

Reaching the round-trip comparison means the upload already succeeded, so the object is definitely present — and the return walked straight past the delete on the very next line. A guaranteed leak, not a best-effort one, on the one path that by construction only fires when the adapter is misbehaving. It now runs the same best-effort cleanup as the failure path.

The two judgement calls

1. "target may be unassigned, or may be the very thing that threw." The card is right that a delete against a half-built adapter is its own question, and the answer here is that the question is dissolved rather than answered: buildAdapterFromValues already had its own inner catch that returns, so a construction failure never reached the outer catch — but the reader could not see that from the catch, because the declaration was out of scope there. Hoisting the resolution above the try states the invariant where it can be read: past that point target is either proxy or a fully constructed temporary adapter. A construction failure still returns before anything is written, and on that path no cleanup is attempted at all — nothing was written, and a delete would have to name an adapter that does not exist. That decision is pinned (as a declared control, below), so a later "tidy-up" that adds a finally reddens it.

2. Where defect 2 cleans up. A finally was rejected: the success path already deletes on its own line, and its failure IS a probe failure the operator must be told about, so a finally would either delete twice or need a flag to know not to. "Leave it for inspection" was rejected because nothing records the key — it is minted per call from a timestamp and a random suffix — so the object would be un-findable litter rather than evidence. The mismatch path therefore calls the same cleanup helper the catch does, immediately before its return.

Built on batch 7, not over it

#12981 batch 7 made a refused cleanup name the key it left behind. That repair is intact — it moved into the shared removeProbeObject helper, warn level and message text unchanged — and it now covers the mismatch path too, which it could not reach before because no cleanup was attempted there. One pin drives exactly that case.

What did NOT change

No sweep for the __objectstack_probe__/ prefix — out of scope by the card. What the probe reports to the operator is unchanged on every path: the same result shape and the same messages, pinned in every case below. No published surface changes and no accept/reject behaviour moves.

Verification

All numbers from head 11c802f5d.

Pins — packages/services/service-storage/src/storage-service-plugin.probe-cleanup-store.test.ts

Every store in the file is a realLocalStorageAdapter on its own temp directory with exactly one verb replaced (via Object.create, so every other member stays the adapter's own). PUT allowed / GET refused is the ordinary shape of a half-right credential and it is what makes the leak observable: the bytes really land on disk, then the probe really fails. The assertions read the filesystem — what is left under __objectstack_probe__/ when the handler returns — rather than a call counter that could agree with a store nobody wrote to.

case	kind
failed probe with edited credentials leaves nothing in the TEMPORARY store (and the persisted store is neither written to nor asked to delete)	pin
failed probe with no edited credentials leaves nothing in the PERSISTED store	declared control
an adapter that fails to build is reported, and no cleanup is attempted anywhere	declared control
a mismatch on edited credentials leaves nothing in the TEMPORARY store	pin
a mismatch with no edited credentials leaves nothing in the PERSISTED store	pin
a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch	pin

The two controls are green in both directions by construction — with no overrides target === proxy, so the old code deleted from the right store by accident, and the old code also attempted no cleanup after a build failure. They are declared as controls in the file's header and are not ablation evidence; they are there so the pins cannot pass on a handler that deletes from everything, or on one that cleans up after a store it never wrote to.

Ablation

Predicted before the run: reverting only storage-service-plugin.ts reddens the 4 pins and leaves the 2 controls green.

Procedure: the repair was committed first (c80f33a90); the mutation reverted the single file to its pre-fix blob in the worktree only; an EXIT INT TERM trap restored it with an absolute path; the mutation was confirmed on disk before measuring, by blob hash and by marker counts, never by an editor's exit code. No rebuild is in the loop: the pins import the module under test by relative path within the same package, so vitest reads the source .ts, and this package's vitest.config.ts carries no alias that could route it to dist/.

== blobs: HEAD(fixed)=56697fe055842a08f8f46703478e1bfefb57f373 HEAD~1(pre-fix)=51f623729c21dd6824d69cccc3be1b843779f4c7
== markers BEFORE mutation (working tree = the repair)
removeProbeObject: 3
proxy-as-IStorageService-delete: 0
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373
== MUTATE (revert the handler to the pre-fix blob; worktree only, index untouched)
hash-on-disk: 51f623729c21dd6824d69cccc3be1b843779f4c7
removeProbeObject: 0 (expect 0 — the repair's helper is gone)
proxy-as-IStorageService-delete: 1 (expect 1 — the wrong-store cleanup is back)
== MUTATED RUN
mutated-run-exit=1
× … defect 1 … a failed probe with EDITED credentials leaves nothing behind in the TEMPORARY store
✓ … CONTROL: a failed probe with NO edited credentials leaves nothing behind in the PERSISTED store
✓ … CONTROL: an adapter that fails to BUILD is reported, and no cleanup is attempted anywhere
× … defect 2 … a mismatch on EDITED credentials leaves nothing behind in the TEMPORARY store
× … defect 2 … a mismatch with NO edited credentials leaves nothing behind in the PERSISTED store
× … defect 2 … a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch
Test Files 1 failed (1)
Tests 4 failed | 2 passed (6)
== RESTORE
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373 (expect 56697fe055842a08f8f46703478e1bfefb57f373)
removeProbeObject: 3
git diff HEAD -- target: []
git status --porcelain -- target: []
== RESTORED RUN
restored-run-exit=0
Test Files 1 passed (1)
Tests 6 passed (6)

The mutated failures are the leak itself, named on disk:

AssertionError: expected [ '1788193993158-fbkl7y8s' ] to deeply equal []
AssertionError: expected [ '1788193993188-8cske18x' ] to deeply equal []
AssertionError: expected [ '1788193993190-d0e7dm5m' ] to deeply equal []
AssertionError: expected [] to have a length of 1 but got +0 (the refusal warning that is never logged, because no cleanup is attempted)

Direction observed = direction predicted. The restore leg is proven by state — hash back to the HEAD blob, empty git diff HEAD, empty git status --porcelain — and re-measured green afterwards, so no later reading was taken on a mutated tree.

Suites and gates

• pnpm --filter @objectstack/service-storage exec vitest run --maxWorkers=2 — 35 files, 528 tests passed (the whole package, including The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 7's own file).
• pnpm --filter @objectstack/service-storage exec tsc --noEmit — 51 errors, zero of them in either changed file. That is exactly this package's frozen DEBT ledger count, so check:type-check-debt's re-measure cannot move up on this diff. Run with the dependency closure built (pnpm --filter '@objectstack/service-storage^...' build), which is the ledger's own measurement condition.
• Gate family re-derived from the actual diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (both output sections read whole; the family is identical at the final head). All 36 harvested commands run; 32 green, and 4 report PREREQUISITE NOT MET, i.e. NOT MEASURED, never a pass and never a red: check:test-completeness (exit 3 — grades a saved turbo test log, none exists locally), check:dual-build-cjs-loads (exit 3 — needs a full pnpm build), check:i18n and check:type-check-debt (both need a built workspace closure; both refuse rather than measure). CI builds the workspace and runs all four.
• The slot-lookup erasure ratchet did not move; the gate's own verdict line: ✓ slot-lookup ratchet holds: 106 unswept site(s) in 25 file(s), none new, and every file in the population parsed.
• ESLint: declared narrowing to the two changed files rather than the repo-wide pnpm lint, which CI owns and runs regardless. pnpm exec eslint --no-inline-config --format json on both paths — 2 files linted, 0 errors, 0 warnings; both were accepted into eslint's own population rather than ignored (they are returned as results). The narrowing excludes nothing: this repo runs one eslint.config.mjs which never enables type-aware linting for any file (no parserOptions.project, no typed rules — stated and measured in the config's own header), so no rule's verdict on an untouched file is a function of this diff. Independently, check:slot-lookup executes ESLint across all of packages/ with the baseline's ignores lifted, and holds.

Changeset

.changeset/storage-probe-cleanup-target-store.md, patch on @objectstack/service-storage: the behaviour an operator can observe does move — the probe no longer leaves objects in the store it wrote to — even though no API surface does.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4642f4c64c002f94f1d737bbb2a5fc94ae43ddf3 → packageMentionDocs.

[claude]

Closes#13726

The settings.registerAction('storage', 'test', …) handler writes a probe object, reads it back and deletes it. When the form posts values it builds a temporary adapter first — so an operator can validate credentials that are typed but not yet saved — and probes that adapter instead of the persisted one. Two paths left the probe object behind in whichever store it was actually written to. Both were surfaced by the #12981 batch-7 dev inside the lines that batch edits, and correctly left alone there; re-verified by symbol on this branch's base (46b53a25b), since PR #13725 moved the line numbers.

Defect 1 — the failure cleanup deleted from a store the probe never wrote to

let target: IStorageService = proxy was declared inside the try, so at the catch the only name in scope was proxy, the persisted adapter. On the case the temporary adapter exists for — a failed test with edited credentials — the object leaked in the store that held it while a delete was issued against a store that never did. Deleting an absent key is a no-op on both shipped adapters, so the wrong-store delete "succeeded" and nothing looked wrong.

Repaired by resolving the adapter before the try whose catch has to clean up after it. That makes "the cleanup names the store the upload named" true by construction rather than by two expressions that happen to agree today.

Defect 2 — the content-mismatch return path cleaned up nothing

Reaching the round-trip comparison means the upload already succeeded, so the object is definitely present — and the return walked straight past the delete on the very next line. A guaranteed leak, not a best-effort one, on the one path that by construction only fires when the adapter is misbehaving. It now runs the same best-effort cleanup as the failure path.

The two judgement calls

1. "target may be unassigned, or may be the very thing that threw." The card is right that a delete against a half-built adapter is its own question, and the answer here is that the question is dissolved rather than answered: buildAdapterFromValues already had its own inner catch that returns, so a construction failure never reached the outer catch — but the reader could not see that from the catch, because the declaration was out of scope there. Hoisting the resolution above the try states the invariant where it can be read: past that point target is either proxy or a fully constructed temporary adapter. A construction failure still returns before anything is written, and on that path no cleanup is attempted at all — nothing was written, and a delete would have to name an adapter that does not exist. That decision is pinned (as a declared control, below), so a later "tidy-up" that adds a finally reddens it.

2. Where defect 2 cleans up. A finally was rejected: the success path already deletes on its own line, and its failure IS a probe failure the operator must be told about, so a finally would either delete twice or need a flag to know not to. "Leave it for inspection" was rejected because nothing records the key — it is minted per call from a timestamp and a random suffix — so the object would be un-findable litter rather than evidence. The mismatch path therefore calls the same cleanup helper the catch does, immediately before its return.

Built on batch 7, not over it

#12981 batch 7 made a refused cleanup name the key it left behind. That repair is intact — it moved into the shared removeProbeObject helper, warn level and message text unchanged — and it now covers the mismatch path too, which it could not reach before because no cleanup was attempted there. One pin drives exactly that case.

What did NOT change

No sweep for the __objectstack_probe__/ prefix — out of scope by the card. What the probe reports to the operator is unchanged on every path: the same result shape and the same messages, pinned in every case below. No published surface changes and no accept/reject behaviour moves.

Verification

All numbers from head 11c802f5d.

Pins — packages/services/service-storage/src/storage-service-plugin.probe-cleanup-store.test.ts

Every store in the file is a realLocalStorageAdapter on its own temp directory with exactly one verb replaced (via Object.create, so every other member stays the adapter's own). PUT allowed / GET refused is the ordinary shape of a half-right credential and it is what makes the leak observable: the bytes really land on disk, then the probe really fails. The assertions read the filesystem — what is left under __objectstack_probe__/ when the handler returns — rather than a call counter that could agree with a store nobody wrote to.

case	kind
failed probe with edited credentials leaves nothing in the TEMPORARY store (and the persisted store is neither written to nor asked to delete)	pin
failed probe with no edited credentials leaves nothing in the PERSISTED store	declared control
an adapter that fails to build is reported, and no cleanup is attempted anywhere	declared control
a mismatch on edited credentials leaves nothing in the TEMPORARY store	pin
a mismatch with no edited credentials leaves nothing in the PERSISTED store	pin
a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch	pin

The two controls are green in both directions by construction — with no overrides target === proxy, so the old code deleted from the right store by accident, and the old code also attempted no cleanup after a build failure. They are declared as controls in the file's header and are not ablation evidence; they are there so the pins cannot pass on a handler that deletes from everything, or on one that cleans up after a store it never wrote to.

Ablation

Predicted before the run: reverting only storage-service-plugin.ts reddens the 4 pins and leaves the 2 controls green.

Procedure: the repair was committed first (c80f33a90); the mutation reverted the single file to its pre-fix blob in the worktree only; an EXIT INT TERM trap restored it with an absolute path; the mutation was confirmed on disk before measuring, by blob hash and by marker counts, never by an editor's exit code. No rebuild is in the loop: the pins import the module under test by relative path within the same package, so vitest reads the source .ts, and this package's vitest.config.ts carries no alias that could route it to dist/.

== blobs: HEAD(fixed)=56697fe055842a08f8f46703478e1bfefb57f373 HEAD~1(pre-fix)=51f623729c21dd6824d69cccc3be1b843779f4c7
== markers BEFORE mutation (working tree = the repair)
removeProbeObject: 3
proxy-as-IStorageService-delete: 0
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373
== MUTATE (revert the handler to the pre-fix blob; worktree only, index untouched)
hash-on-disk: 51f623729c21dd6824d69cccc3be1b843779f4c7
removeProbeObject: 0 (expect 0 — the repair's helper is gone)
proxy-as-IStorageService-delete: 1 (expect 1 — the wrong-store cleanup is back)
== MUTATED RUN
mutated-run-exit=1
× … defect 1 … a failed probe with EDITED credentials leaves nothing behind in the TEMPORARY store
✓ … CONTROL: a failed probe with NO edited credentials leaves nothing behind in the PERSISTED store
✓ … CONTROL: an adapter that fails to BUILD is reported, and no cleanup is attempted anywhere
× … defect 2 … a mismatch on EDITED credentials leaves nothing behind in the TEMPORARY store
× … defect 2 … a mismatch with NO edited credentials leaves nothing behind in the PERSISTED store
× … defect 2 … a mismatch whose cleanup is REFUSED names the stray key, and still reports the mismatch
Test Files 1 failed (1)
Tests 4 failed | 2 passed (6)
== RESTORE
hash-on-disk: 56697fe055842a08f8f46703478e1bfefb57f373 (expect 56697fe055842a08f8f46703478e1bfefb57f373)
removeProbeObject: 3
git diff HEAD -- target: []
git status --porcelain -- target: []
== RESTORED RUN
restored-run-exit=0
Test Files 1 passed (1)
Tests 6 passed (6)

The mutated failures are the leak itself, named on disk:

AssertionError: expected [ '1788193993158-fbkl7y8s' ] to deeply equal []
AssertionError: expected [ '1788193993188-8cske18x' ] to deeply equal []
AssertionError: expected [ '1788193993190-d0e7dm5m' ] to deeply equal []
AssertionError: expected [] to have a length of 1 but got +0 (the refusal warning that is never logged, because no cleanup is attempted)

Direction observed = direction predicted. The restore leg is proven by state — hash back to the HEAD blob, empty git diff HEAD, empty git status --porcelain — and re-measured green afterwards, so no later reading was taken on a mutated tree.

Suites and gates

• pnpm --filter @objectstack/service-storage exec vitest run --maxWorkers=2 — 35 files, 528 tests passed (the whole package, including The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 batch 7's own file).
• pnpm --filter @objectstack/service-storage exec tsc --noEmit — 51 errors, zero of them in either changed file. That is exactly this package's frozen DEBT ledger count, so check:type-check-debt's re-measure cannot move up on this diff. Run with the dependency closure built (pnpm --filter '@objectstack/service-storage^...' build), which is the ledger's own measurement condition.
• Gate family re-derived from the actual diff with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (both output sections read whole; the family is identical at the final head). All 36 harvested commands run; 32 green, and 4 report PREREQUISITE NOT MET, i.e. NOT MEASURED, never a pass and never a red: check:test-completeness (exit 3 — grades a saved turbo test log, none exists locally), check:dual-build-cjs-loads (exit 3 — needs a full pnpm build), check:i18n and check:type-check-debt (both need a built workspace closure; both refuse rather than measure). CI builds the workspace and runs all four.
• The slot-lookup erasure ratchet did not move; the gate's own verdict line: ✓ slot-lookup ratchet holds: 106 unswept site(s) in 25 file(s), none new, and every file in the population parsed.
• ESLint: declared narrowing to the two changed files rather than the repo-wide pnpm lint, which CI owns and runs regardless. pnpm exec eslint --no-inline-config --format json on both paths — 2 files linted, 0 errors, 0 warnings; both were accepted into eslint's own population rather than ignored (they are returned as results). The narrowing excludes nothing: this repo runs one eslint.config.mjs which never enables type-aware linting for any file (no parserOptions.project, no typed rules — stated and measured in the config's own header), so no rule's verdict on an untouched file is a function of this diff. Independently, check:slot-lookup executes ESLint across all of packages/ with the baseline's ignores lifted, and holds.

Changeset

.changeset/storage-probe-cleanup-target-store.md, patch on @objectstack/service-storage: the behaviour an operator can observe does move — the probe no longer leaves objects in the store it wrote to — even though no API surface does.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4642f4c64c002f94f1d737bbb2a5fc94ae43ddf3 → packageMentionDocs.