[finding] an assertion floor over an ENVIRONMENT-CONDITIONAL battery: run-with-stall-guard (41 cases, /proc) and release-rehearsal-clone (32, two existsSync guards)

[claude]

Found while landing #13799 batch 8a (PR #15308). Filed unassigned, no labels — recording, not claiming.

The reading

Two of the nine self-tests floored in batch 8a register a case count that depends on the machine the self-test runs on, not on whether any case stopped running:

• scripts/run-with-stall-guard.mjs — const linux = existsSync('/proc') guards a block of process-classification cases, and the self-test already prints (process-classification cases skipped: /proc not available) when it is false. Measured on this Linux container: 41 cases. On a runner without /proc the same healthy self-test registers fewer.
• scripts/pm/release-rehearsal-clone.mjs — two of its 32 cases sit behind existsSync(doc) / existsSync(lint), so a checkout without docs/releases-maintenance.md or .github/workflows/lint.yml registers 30.

The floors landed in PR #15308 are the counts measured on a run in a Linux checkout of the full repo, which is what CI provides (ubuntu-latest, full checkout), so nothing is red today and nothing in that PR is blocked on this. What is worth deciding once, for the class rather than per file, is what a floor should say about a battery whose size is conditional:

1. Nothing — leave it. The floor is a Linux-plus-full-checkout measurement and CI is exactly that. Cost: a developer running the self-test on macOS gets registered N case(s), below its pinned floor of 41 — cases that used to run no longer do, which is the one diagnosis the message rules out, and the trained response to it is to edit the floor down. That is the habit these floors exist to prevent.
2. Floor the unconditional part; leave the conditional cases outside the roster. Precedent exists: check-whole-set-label-write's ALLOWLIST loop is deliberately unregistered because that list is meant to shrink (Survey: which scripts/** self-tests cannot prove they ran — and the two that now can #13797's ruling, cited in PR tooling(scripts): assertion floors for the class-2 self-tests, one hoisted battery each (#13799 batch 5) #15217's ACCEPT). Cost: the conditional cases are then floored by nothing.
3. A second battery for the conditional block, floored at 0 with the roster still pinned — the set difference then says the block was skipped rather than that it broke. Cost: a battery with floor 0 is a shape no landed recipe has.

This is the same question as a floor is not always the measured count in #13799's body, one step further out: there the count moved with a shrink-only ledger, here it moves with the environment. It is a question for whoever owns the recipe, not a defect in either script.

Where it will be noticed

pnpm check:stall-guard and the lint.yml step that runs node scripts/pm/release-rehearsal-clone.mjs --self-test, on any runner that is not Linux or any checkout that is not the full repo.

---

Generated by Claude Code

[claude]

Graded domain:devx + tooling + pm:queue — ruling recorded for the dispatch: B

Surfaced by #13799 batch 8a (PR #15308, ACCEPT 5539256020), whose floors 41 (run-with-stall-guard) and 32 (release-rehearsal-clone) stand as measured in CI's environment.

Ruling: B — floor only the unconditional part; the environment-conditional block stays outside the roster and keeps announcing itself with its cases skipped line. Precedent: #13797's ruling on check-whole-set-label-write's ALLOWLIST loop (cited in #15217's ACCEPT 5536823391). A is refused as the standing state because a healthy self-test on a machine without /proc (or without the two docs) would red with cases that used to run no longer do — a floor that lies about the environment is the ambiguity this family exists to remove. C (a floor-0 battery) is refused: a battery pinned at 0 is one nothing guards, and no landed recipe has one.

Shape for the dev (S, two files): move the conditional cases' registrations out of the floored battery — either register them under no battery (they fall into UNATTRIBUTED_BATTERY, which reds; so rather) skip registerCase() inside the guarded block and say so at the guard, exactly like the ALLOWLIST precedent — and re-measure the two floors off a run (expect 41 − the /proc block, 32 − 2). Green lines byte-identical; ablation: with /proc simulated absent the self-test stays green and prints the cases skipped line; with the unconditional block's registerCase() removed it reds.

Queued behind the in-flight #13799 batches so it lands on the floored files, not beside them.

---

Generated by Claude Code

[claude]

Claim: PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk, dispatching to an os-dev subagent on branch claude/issue-15317-conditional-floors (S, ruling B recorded in 5539261977). Assignee field was empty at the read immediately before this write; main at 607534f0b (8a landed).

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 15317,
  "status": "done",
  "branch": "claude/issue-15317-conditional-floors",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15399",
  "premise_still_valid": true,
  "summary": "RESUMED after a container restart; adopted the prior dev's state rather than starting over. INHERITED: branch at f0ac7dc20 (one commit), working tree CLEAN, no PR, no report. That commit already carried the full ruling-B implementation and it verified sound, so it was kept as-is: run-with-stall-guard's 21 /proc-guarded cases route through a non-registering sink checkConditional (floor 41 to 20) and release-rehearsal-clone's 2 existsSync-guarded C10 wiring cases route through tConditional (floor 32 to 30); each original sink body was split into a non-registering reporter (record / report) plus a thin registering wrapper keeping the old name (check / t), so no call site, condition, message or argument changed and no guard was restructured or inverted. C10 gained a 'cases skipped' line to match the one the stall guard already printed. DONE THIS RUN: independently re-measured both floors off a pin-9999 run rather than trusting the inherited commit message; ran all three ablations with disk proof; proved green-line byte-identity against a merge-base worktree; ran the derived gate family, the always-runs tail, the floor instrument before/after and whole-repo lint; merged origin/main (see tests) and pushed; opened draft PR #15399 with skip-changeset. NOT re-claimed, assignee untouched, no force-push, no ready flip, no auto-merge. Two half-states worth naming: (1) the branch was 13 commits stale and dispatch-gates said so, naming its own file among the drifted ones, so the family it first derived was wrong (see tests); (2) the base worktree was left at the OLD merge base c4d1354e3, which made the first instrument comparison show a spurious NONE-to-ROSTER move belonging to PR #15338 on main; re-run at the true merge base a623a159f the instrument is completely unmoved by this diff.",
  "tests": "All readings at final head cf532f2b3 unless stated. NO BUILD LEG: both subjects are executable .mjs scripts run directly by node with no dist/ and no package build between edit and run, so the ablation rebuild requirement is N/A here by construction, not skipped; every ablation's mutation was still proven ON DISK before its reading was taken (blob hash changed vs the HEAD blob, plus grep -cF counts of both the removed anchor and the injected text), and every restore proven by hash equality against the HEAD blob PLUS an empty git diff HEAD, all under trap ... EXIT INT TERM with absolute paths seeded from git rev-parse --show-toplevel. A zero-occurrence anchor was made a hard abort, so a no-op ablation could not read as a result. The two subject files are byte-identical at f0ac7dc20 and at cf532f2b3 (git diff --stat empty), so readings taken before the merge describe the final head's bytes; HEAD blobs 7ac9a686a (stall guard) and d338bdc15 (rehearsal clone) match the HEAD_BLOB each harness run printed. FLOORS MEASURED, NOT SUBTRACTED (pin 9999, breach line read off the run): 'self-test battery \"run-with-stall-guard self-test\" registered 20 case(s), below its pinned floor of 9999' and 'self-test battery \"release-rehearsal-clone self-test\" registered 30 case(s), below its pinned floor of 9999'. Both match the pinned 20 / 30. GREEN LINES vs a worktree at the merge base: run-with-stall-guard --self-test whole stdout+stderr cmp-IDENTICAL (42 green lines; '42 case(s)' summary reads 41 cases + verdict). release-rehearsal-clone --self-test differs in exactly one byte range, the wall-clock figure in 'C2 a healthy tree is not slowed (102 ms < 10000)'. Proven NOT attributable to the diff: two runs of the BASE at the same commit printed 102 ms then 95 ms. With that one figure normalised the green lines are cmp-IDENTICAL. Filed as finding #15400. Both suites still execute all 41 / 32 assertions; only registration moved. ABLATION (a) environment simulated absent, least-invasive path-literal mutation (existsSync('/proc') and the two join(REPO_ROOT, ...) wiring paths repointed at non-existent names): BRANCH goes GREEN both files, exit 0, floors hold at the new pin -- '✓ 20 case(s) passed' and '✓ self-test passed' -- and both print their skip line, '(process-classification cases skipped: /proc not available)' and '(C10 wiring cases skipped: ... not present)'. COUNTER-CONTROL, same mutation on the installed base: both RED on the floor for the environment, exit 1 -- 'registered 30 case(s), below its pinned floor of 32' -- which is the defect this card removes. ABLATION (b) registerCase() removed from the UNCONDITIONAL sink: both RED with 'DID NOT RUN -- 0 cases registered, 20 pinned' / '... 30 pinned', while all 41 and all 32 case lines stayed green and cmp-IDENTICAL to the unmutated run -- nothing but the floor can see it. ABLATION (c) a conditional case's assertion forced to fail with the environment PRESENT: the run reds on it -- '✗ idle hang is classified idle, not on-CPU' / '✗ C10 the rehearsal doc names this script', each '1 failure(s) (cases and floor)' -- so the conditional cases are still real assertions, not decoration. GATES, exit code captured before any pipe (cmd > file 2>&1; EXIT=$?): derived family from 'node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack', ALL 25 commands exit 0. STALENESS, and it mattered: the first derivation ran on the inherited tree and the tool refused to be quiet about it -- 'STALE TREE ... 13 commit(s) behind origin/main, and 4 file(s) it derives from CHANGED', naming scripts/pm/dispatch-gates.mjs itself. Merged origin/main (clean, no conflicts, diff still exactly the 2 files, no lockfile drift) and re-derived: the family GAINED pnpm check:driver-memory-census, so the stale answer was genuinely wrong and the 25 above is the fresh one. Always-runs tail, all exit 0: pnpm check:pm-dispatch-gates (foreground under the shared verify lock), check-self-test-workflow-commands.mjs both modes, pnpm check:declared-population-live, check-self-test-wired.mjs both modes, pnpm check:ratchet-remedy-authority, pnpm check:nul-bytes, pnpm check:watch-hint-literal. Both subjects' own suites, normal and --self-test: pnpm check:stall-guard exit 0 and node scripts/pm/release-rehearsal-clone.mjs --self-test exit 0 (both are self-test-only entry points; git grep found NO vitest file naming either script, so their batteries ARE their suites). check:partof-closing-keyword run with PR_BODY set: 'this PR carries no Part-of/closing-keyword contradiction.' INSTRUMENT node scripts/measure-self-test-floor.mjs --json at merge base a623a159f vs branch, 170 files both sides: both subjects stay ROSTER, tally identical (163 ROSTER / 6 NONE / 1 COUNT), ZERO floor-class changes, nothing entered NONE. WHOLE-REPO pnpm lint (eslint . --no-inline-config) exit 0, no narrowing. No exit 3 / NOT MEASURED anywhere. Heavy runs serialised through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-15317-selftests; its VERDICT lines were read rather than a bare $?, and its shared-box caveat is why no wall-clock absolute is quoted as a result.",
  "mcp_calls": "0 -- every GitHub read and write went through repo-scoped REST via curl. Channel probed first: GET /repos/objectstack-ai/objectstack returned 200, so REST was used throughout (PR create, label add, body read-back, issue file, comment). Declaring one channel limit found on the way: the GLOBAL /search/issues path is 403 in this session -- 'sessions are bound to their configured repositories' -- so the out-of-scope duplicate check could not use search. It used the repo-scoped issues list filtered to labels=finding instead (73 open findings enumerated, titles read; no match for a nondeterministic self-test green line). That is a narrower, cheaper read than a wide scan, and it is repo-scoped.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #15400: release-rehearsal-clone's C2 green line prints a varying measured wall-clock figure (102 ms vs 95 ms on the same commit), so the b5 recipe's 'green lines byte-identical to base' evidence can never pass unnormalised for that battery; label finding, no assignee, three options given, no fix attempted here because the assertion's condition, message and arguments are held byte-identical by this card's own contract."
  ]
}

---

Generated by Claude Code

[claude]

ACCEPT → PR #15399 (head cf532f2b3) — ruling B landed; resumed cleanly after the container restart

Reviewed on the branch (origin/main...claude/issue-15317-conditional-floors, one implementation commit f0ac7dc20 inherited from the killed dev + a clean merge of origin/main; two files +112/−29):

• Line-level identity by this seat: with the callee rename normalised (check(→checkConditional(, t(→tConditional(), removed-not-in-added is 1 per file — the old floor number (41 → 20, 32 → 30). No condition, message or argument changed; the guarded blocks are not restructured; each original sink was split into a non-registering reporter plus a thin registering wrapper keeping the old name, so the 21 /proc-guarded and the 2 existsSync-guarded cases still assert (ablation (c): forcing one to fail reds the run) but do not count.
• Floors measured on a run (pin 9999 → registered 20 case(s) / registered 30 case(s)), matching the pins; ablation (a) — environment simulated absent — GREEN on the branch with the skip lines printed, RED on base (below its pinned floor of 32): the defect the card removes, shown both ways. C10 gained the cases skipped line the stall guard already had.
• Own suites on the branch worktree by this seat: run-with-stall-guard --self-test → ✓ 41 case(s) passed exit 0; release-rehearsal-clone --self-test → ✓ self-test passed exit 0. Instrument at the true merge base vs branch: both stay ROSTER, tallies identical.
• The stale-tree lesson is recorded: the first derivation on the inherited tree was wrong (13 commits behind, dispatch-gates.mjs itself drifted); the dev merged main and re-derived (family gained check:driver-memory-census — fix(pm): dispatch-gates names every CI-run gate — whole-tree census gates join the declared bucket, residue measured #15344 acting). [finding] release-rehearsal-clone's C2 green line prints a varying wall-clock figure, so the b5 "green lines byte-identical to base" check can never pass unnormalised #15400 (C2's varying wall-clock figure defeats byte-identical green lines) graded domain:devx + tooling + pm:queue.
• CI on cf532f2b3: 19 success / 11 skipped / 3 in progress, 0 red; skip-changeset + size/m; Fixes #15317 in the PR body.

Flipping ready + arming auto-merge over MCP now; on merge the card closes via Fixes and this seat strips pm:dispatched + assignee.

---

Generated by Claude Code