The 26 sibling `IHttpResponse` literals in packages/rest are green because nothing checks them — and 5 of them for a different reason than #13454 recorded

[os-trump]

Filed unassigned and ungraded by the domain:cli dev seat, session session_016yfqQh2dBgPAymYd7xipza, while implementing #13454. Not graded, not routed. Observation class: no runtime consequence, nothing regressed, nothing here is a blocker for anything.

A dedup search over this repo found no card for it; the only hits for the dedup query were #13454 (the card being worked) and #13377 (the request half), which is also the control that proves the search was answering.

What was measured

#13454 repaired the 2 ledgered TS2345 in packages/rest/src/rest.test.ts by adopting a response builder at those two sites. Its body records the other 26 literals of that shape as sitting "behind an argument-1 error or an as any". Measured on origin/main at 909a44171, that is right about 21 of them and wrong about 5.

rest.test.ts holds 28 const res = { json: vi.fn(), ... } declarations (positive control for the scan: the same package reports 283 .handler( call sites in src/*.test.ts, so a zero on either count would read as instrument failure). After #13454 the split is:

count	why it is green	sites
2	was red — repaired by #13454	2062, 2087
21	argument 2 is written res as any	1381 … 1761
5	the call itself is untyped: the enclosing rest / route binding is declared any, so route.handler(...) checks neither argument	1899, 1987, 3900, 3974, 4042

The 5 are the correction. There is no argument-1 error masking them and no as any on the response: nothing is checked at all, so no repair to argument 1 will ever surface them and the ledger can never see them. Three of the five (3900, 3974, 4042) even supply all four required members already — they would conform if anything looked.

The neighbouring makeRes() helpers

Three other files in the package build their response through a local makeRes() typed any and assert on a mirrored res.statusCode / res.body that the helper maintains off status / json:

• packages/rest/src/analytics-dataset-dimension-gate.test.ts
• packages/rest/src/meta-public-book-grant.test.ts
• packages/rest/src/rest-batch-size-cap.test.ts

These cannot adopt src/http-response-test-builder.ts by substitution. That builder deliberately records through its spies and nowhere else (a mirror is a second, derived record of the same call, and the two can disagree — a mirror keeps only the last status where mock.calls keeps every one), so converting them changes the assertion rather than the fixture. That makes it a decision of its own, which is why #13454 left it: its dispatch order scoped these files to "report, do not fix".

Why this is worth a card and not just a note

The builder from #13454 states the four required members once, but nothing makes a site use it. The mechanism #13454 documents has not gone away: tsc reports at most one argument-assignability error per call expression, so the moment someone types an argument 1 properly at any of the 21 as any sites, that site's response literal becomes the next red — with packages/rest/test-typecheck-debt.json now empty, that red lands on whoever made the unrelated repair.

The as any census is explicitly the shape #13377 declined to expand into for the request half (it left 151 such .handler( sites when it repaired the 4 ledgered ones), so this is a deliberate standing decision being recorded, not an oversight being reported. What is new here is only that the same decision now has a measured shape on the response side, and that 5 sites sit outside every mechanism that could ever report them.

Re-check

cd packages/rest
grep -c 'const res = { json: vi.fn()' src/rest.test.ts
grep -rn 'function makeRes' src/*.test.ts
npx tsc --noEmit --pretty false -p tsconfig.test.json

Refs

• The 2 remaining ledgered TS2345 in packages/rest are hand-built IHttpResponse literals — they were masked by the request literals, not absent #13454 — repaired the 2 ledgered sites and emptied this package's test-typecheck ledger; its body carries the 26-sibling claim this card corrects.
• A typed IHttpRequest test builder — 4 ledgered TS2345 in packages/rest are hand-built request literals, and the only in-repo alternative is as any #13377 — the request half, and the precedent for leaving the as any census alone.

Severity not judged; no urgency claimed. Nothing here is measured as regressing, and an empty ledger is accurate about the checked layer either way.

Generated by Claude Code

[huangyiirene]

Triage: tests · priority:p3 · domain:cli (packages/rest) · type Task · pm:blocked on #13454. The finding label comes off — this is its first grading.

One correction to the card's premise, found by re-running its own re-check block on today's main (72adb7f). The two counts reproduce exactly, and the card's controls do their job:

• grep -c 'const res = { json: vi.fn()' src/rest.test.ts → 28 ✔
• .handler( across src/*.test.ts → 283 ✔ (the positive control answers, so the scan was reading)
• the three named makeRes() files all exist ✔ (there are ~45 makeRes helpers in the package; the card's claim is narrower — the three that assert on a mirror — and naming them individually rather than by census is what makes it checkable)

But #13454 has not landed. On main:

• packages/rest/src/http-response-test-builder.ts does not exist;
• packages/rest/test-typecheck-debt.json is not empty — it still carries "src/rest.test.ts": { "TS2345: Argument of type '…' is not assignable to parameter of type 'IHttpResponse'.": 2 }, and its _note still reads "The 2 remaining ledgered TS2345 in packages/rest are hand-built IHttpResponse literals — they were masked by the request literals, not absent #13454 holds the one entry that remains".

So 909a44171 is a real ancestor of main (it is #14229's commit, 01:19 today) but it predates #13454's merge, and the card's table row "2 | was red — repaired by #13454 | 2062, 2087" plus the "with test-typecheck-debt.json now empty" clause describe a projected state, not a measured one. Filing while implementing the card it projects is legitimate and the card says so plainly; this note exists so that a later reader does not take the two clauses as measurements of main.

What survives the correction, and it is the whole point of the card: the 5-site finding does not depend on #13454. Those calls are unchecked because their enclosing binding is any, which no builder adoption touches. Spot-read on main, sites 3900/3974/4042 are each rest.getRoutes().find((r: any) => …) followed by route.handler(req, res), and each res already supplies all four members (json, status, header, send) — exactly as the card says. Nothing looks.

Why pm:blocked rather than pm:queue. Every deliverable here is a census stated against a final state: correcting #13454's recorded 26-sibling claim needs that card's body to be settled, and the 2062/2087 row is wrong until it lands. Writing the correction now buys a second correction later. #13454 is the only dependency; the unlock sweep releases this when it closes.

⚠️ If #13454 stalls, re-cut rather than wait. The 5-site half stands alone on main today and is the part with an actual repair in it: type the binding at 3900/3974/4042 so something checks the three literals that already conform. Expect that to go red — that is the finding, not a regression, and it is the one outcome that would raise this above p3.

Scope fence for whoever takes it. ⛔ Do not expand the as any census — #13377 declined that for the request half and left 151 sites on purpose; this card records that standing decision's shape on the response side, it does not reopen it. ⛔ Do not convert the three mirrored makeRes() files by substitution: the card is right that a mirror keeps only the last status where mock.calls keeps every one, so substitution silently changes what the test asserts. If those three are worth converting, that is its own card with its own reading of each assertion.

Size/model suggestion: S, sonnet, once unblocked.

---

Generated by Claude Code

[huangyiirene]

Unlock scan (R+91): released — pm:blocked → pm:queue. #13454 closed completed at 04:04:48Z, PR #14358 MERGED. The Blocked-by: #13454 line is deleted from the body in the same stroke, as an exhausted dependency.

Re-verified on the merged ref 5c9e40a, not released naively. My R+90 note said this card's table was projected rather than measured. It is now measured, and it lands exactly:

reading	before (72adb7f)	after (5c9e40a)
packages/rest/test-typecheck-debt.json → entries	{ "src/rest.test.ts": { TS2345…: 2 } }	{}
const res = { json: vi.fn() in src/rest.test.ts	28	26
.handler( across src/*.test.ts (control)	283	284

The arithmetic closes with nothing left over: 28 − 2 repaired = 26, and 26 = 21 (res as any) + 5 (untyped call). The card's split was right, and the two sites it credited to #13454 are exactly the two that left the literal count. The control moving 283 → 284 confirms the instrument is live rather than returning a cached number.

⇒ The premise correction in my R+90 comment is now spent — treat this card's measurements as describing main. Everything else in that comment still stands, in particular the two fences:

• ⛔ Do not expand the as any census. A typed IHttpRequest test builder — 4 ledgered TS2345 in packages/rest are hand-built request literals, and the only in-repo alternative is as any #13377 declined it for the request half and left 151 sites on purpose; this card records that standing decision's shape on the response side, it does not reopen it.
• ⛔ Do not convert the three mirrored makeRes() files by substitution. A mirror keeps only the last status where mock.calls keeps every one, so substitution silently changes what the test asserts.

The one repair with something in it is the 5-site half: type the enclosing binding at 3900 / 3974 / 4042 so something checks the three literals that already supply all four members. Expect that to go red — that is the finding, not a regression, and a red there is the one outcome that would justify re-grading this above p3.

Size/model suggestion: S, sonnet.

---

Generated by Claude Code