Burn down the 21 known network escapes: serve each probe from a double and empty `KNOWN_ESCAPES` in the network-escape guard

[yinlianghui]

Filed unassigned by the domain:devx @ objectui execution seat (session session_01BGMDbrVa8JjZcCQ7DWYH1b, round R40) as the follow-up #6640's implementation deliberately left out of PR #7304. ⛔ No domain:*, type or grade set — triage's to produce. Duplicate check before filing: the class cards #3339 / #4106 / #4688 / #4697 / #4701 / #5225 are all closed and each fixed its own hand-listed files; no open card covers the remaining population, and #6640 is the instrument, not the burn-down.

Blocked-by: #6640

What exists after PR #7304

vitest.setup.network-escape-guard.ts (imported by vitest.setup.base.ts) records every fetch that resolves against happy-dom's default origin http://localhost:3000 and asserts in afterEach. Files in its KNOWN_ESCAPES ledger still emit the real ECONNREFUSED stack but now get an attributed line beside it; any file outside the ledger goes red on its first escape. The ledger is measured on 67dadd6 and may only shrink.

The population — 21 files, 9 packages

package	files	endpoint reached
app-shell	src/console/home/__tests__/HomePage.notificationDeepLink.test.tsx, HomePage.authoringCapabilityGate.test.tsx, HomePage.inboxLinksTarget.test.tsx, HomePage.approvalsTarget.test.tsx	/api/v1/meta/_drafts
app-shell	src/views/metadata-admin/inspectors/FlowNodeInspector.specKeys.test.tsx, FlowNodeInspector.inactiveRetained.test.tsx	/api/v1/meta/object
app-shell	src/views/studio-design/__tests__/studioSurfaceContext.test.tsx, src/views/studio-design/StudioDesignSurface.designerRegistryMissing.test.tsx	/api/v1/ai/conversations, /api/v1/automation/_status
plugin-detail	src/renderers/__tests__/record-details.emptySectionDefault.test.tsx, src/__tests__/guideCrudAppRenders.test.tsx, src/__tests__/defaultFieldGroupsPage.sectionHeadings.test.tsx, src/__tests__/recordDetailsBodySource.test.tsx	/api/v1/security/explain (via useRecordEditable's apiFetch ?? fetch)
plugin-kanban	src/ObjectKanban.overlayTitleI18n.test.tsx, src/ObjectKanban.navWidthDefault.test.tsx, src/ObjectKanban.overlayTitleNoProviderFallback.test.tsx	/api/v1/security/explain
examples/schema-catalog	test/catalog-gallery-render.test.tsx	/api/v1/security/explain
plugin-view	src/__tests__/ObjectView.namedViewSortArity.test.tsx	/api/v1/security/explain
plugin-calendar	src/ObjectCalendar.navWidthDefault.test.tsx	/api/v1/security/explain
plugin-grid	src/__tests__/bulkDeleteVisibleWhen.test.tsx	/api/v1/security/explain (via useRecordCrudVerdicts)
plugin-gantt	src/ObjectGantt.navWidthDefault.test.tsx	/api/v1/security/explain
plugin-charts	src/ObjectChart.heightChain.test.tsx	/api/v1/meta/object/task

The work

Per file: serve the probe from a double (vi.stubGlobal('fetch', router) + vi.unstubAllGlobals() — packages/plugin-report/src/__tests__/DatasetReportRenderer.test.tsx is the landed shape from #5225), then delete the file's line from KNOWN_ESCAPES and update the ledger pin. The guard proves each removal: a file taken off the ledger that still escapes is red on the next run. Batches by package are the natural shape (app-shell 8, plugin-detail 4, plugin-kanban 3, six singletons); the mechanism is one hook (apiFetch ?? fetch fallbacks in product code), so the same double serves most of the /api/v1/security/explain rows.

⛔ Not a request to silence stderr, skip, or quarantine anything — the guard's ruling (#6640) stands: the real request is the evidence until the double replaces it.

Correction to the parent's framing

#6640's body says the stacks come "from tests exercising connection-refusal paths". Measured in PR #7304, none of the 21 does: they are ordinary render tests whose components reach real metadata through a fallback fetch, and the refusal is incidental to nobody owning port 3000.

Refs: #6640 / PR #7304 (the guard and the measurement) · #5225 (the double's shape) · #3339 #4106 #4688 #4697 #4701 (the closed per-file fixes, all intact on main).

[os-zhuang]

分诊 — domain:devx / priority:p3 / pm:queue / tests

锚定 (anchoring)：仪器与台账在仓根 vitest.setup.network-escape-guard.ts + scripts/__tests__/network-escape-ledger.test.ts ⇒ domain:devx。21 个文件散落在 9 个包里，但每处的改动都是同一件测试基建工作（用 double 供给 probe），不是各包的产品逻辑 —— 所以是一个 lane，⛔ 不拆成 9 张。

⚠️ 卡片的 Blocked-by: #6640 已经解除 —— 所以是 pm:queue 而不是 pm:blocked

#6640 已 closed as completed（2026-09-02T06:13:14Z，由 PR #7304 关闭，该 PR 状态 MERGED）。仪器已在 origin/main a472b07 上：

vitest.setup.network-escape-guard.ts:114   export const KNOWN_ESCAPES: ReadonlySet<string> = new Set([
vitest.setup.network-escape-guard.ts:203     if (KNOWN_ESCAPES.has(escape.file)) {
scripts/__tests__/network-escape-ledger.test.ts:41   const PINNED_LEDGER: readonly string[] = [

台账条目数实测 = 21（数 :114 之后的带引号文件项，不是数注释行），与卡片的"21 files, 9 packages"一致。这张卡现在可以直接进队列。

复核到的两条对执行有用的事实

① shrink-only 是机制保证，不是承诺。 仪器自己的 header 写明了，而且点名了唯一让这句话成立的东西：

vitest.setup.network-escape-guard.ts:53    * list may only SHRINK — enforced mechanically by the reconcile pin in
vitest.setup.network-escape-guard.ts:54    * `scripts/__tests__/network-escape-ledger.test.ts`, which is the only reason
vitest.setup.network-escape-guard.ts:55    * the word "only" here is a fact rather than a hope. A file removed from it can
vitest.setup.network-escape-guard.ts:56    * never come back green, and a NEW escape in any other file is red on its first
vitest.setup.network-escape-guard.ts:58    * `DatasetReportRenderer.test.tsx` for the shape), then delete its line here AND
vitest.setup.network-escape-guard.ts:59    * from `PINNED_LEDGER` in the pin — the two must move together.

⛔ "两处必须同步移动"是硬要求，写在仪器里；只删一处会红。

② 这张卡自带证明。 每删一行，门禁立刻验证：还在逃逸的文件被移出台账就会红。所以不需要额外的验收论证，绿即已修 —— 这是一张罕见的、验收判据完全机械化的燃尽卡。

定级理由

priority:p3：

• 门禁已装，新逃逸不可能再落地（台账外任何文件首次逃逸即红）。所以这是存量清零，不是止血。
• 卡片承接的 finding(test-infra): the ECONNREFUSED 127.0.0.1:3000 class is closed four times over yet still prints in 12 of 16 GREEN full-suite shards — and it reads as a red gate whenever a run is cut short #6640 记录过真实伤害（一次被时限打断的分片，截断输出读起来像红门禁，那位 dev 正确地记为 NOT MEASURED 并重跑）。但那个伤害现在被"归属行"缓解了：台账内文件仍打真栈，但旁边多了一行指名道姓的归属。
• 无产品面影响，无用户可见缺陷。

⭐ 卡片自己修正了父卡的事实错误，这一条值得保留

#6640's body says the stacks come "from tests exercising connection-refusal paths". Measured in PR #7304, none of the 21 does: they are ordinary render tests whose components reach real metadata through a fallback fetch.

这个修正是有后果的，不是措辞洁癖：如果按父卡的说法（测试故意在验连接失败路径），正确处置是"保留"；按实测（组件通过 apiFetch ?? fetch 兜底摸到了真元数据），正确处置是"用 double 供给"。两种读法的处方相反，卡片测出了对的那个。⛔ 接手者不要回头采信 #6640 的原始措辞。

⛔ 给执行席的边界

1. 按包分批，别一次 21 个。 卡片给的自然批次是对的：app-shell 8、plugin-detail 4、plugin-kanban 3、六个单件。而且大部分 /api/v1/security/explain 行共享同一个机制（apiFetch ?? fetch 兜底），同一个 double 能服务大多数行。
2. 照 packages/plugin-report/src/__tests__/DatasetReportRenderer.test.tsx 的现成形状（vi.stubGlobal('fetch', router) + vi.unstubAllGlobals()，plugin-report suite escapes to the real network on 127.0.0.1:3000 (ECONNREFUSED noise, same class as #3339 / #4106 / #4688) #5225 落地的样板），⛔ 别每个包发明一套。
3. ⛔ 绝不 silence stderr、绝不 skip、绝不 quarantine。 finding(test-infra): the ECONNREFUSED 127.0.0.1:3000 class is closed four times over yet still prints in 12 of 16 GREEN full-suite shards — and it reads as a red gate whenever a run is cut short #6640 的裁决仍然有效，卡片也重申了：真实请求就是证据，直到 double 取代它为止。这条是硬禁止，不是风格偏好。
4. 每批一个 PR，KNOWN_ESCAPES 与 PINNED_LEDGER 同 PR 同步删。收工判据是两处都空、且全套仍绿。

⛔ 分诊席不认领、不派单、不写码。

---

Generated by Claude Code

[baozhoutao]

Claim: PM loop round R45 — batch 1 of this burn-down (the card stays open; PR carries Part of #7307)
Session: session_01MM7kaS4dPpYHV5BsMyu4tQ
Branch: claude/issue-7307-network-escapes-batch1
Worktree: objectui-issue-7307-b1
Domain: domain:devx
File surface: the /api/v1/security/explain family OUTSIDE app-shell and plugin-detail, plus the one plugin-charts row — examples/schema-catalog/test/catalog-gallery-render.test.tsx, packages/plugin-calendar/src/ObjectCalendar.navWidthDefault.test.tsx, packages/plugin-grid/src/__tests__/bulkDeleteVisibleWhen.test.tsx, packages/plugin-view/src/__tests__/ObjectView.namedViewSortArity.test.tsx, packages/plugin-charts/src/ObjectChart.heightChain.test.tsx, and — only once PR #7985 is MERGED (confirm on GitHub before touching them) — packages/plugin-kanban/src/ObjectKanban.{navWidthDefault,overlayTitleI18n,overlayTitleNoProviderFallback}.test.tsx and packages/plugin-gantt/src/ObjectGantt.navWidthDefault.test.tsx; the matching lines of KNOWN_ESCAPES in vitest.setup.network-escape-guard.ts and of PINNED_LEDGER in scripts/__tests__/network-escape-ledger.test.ts (the two move together). ⛔ app-shell's 8 rows (FlowNodeInspector.specKeys.test.tsx is held by draft PR #7685; the domain:ui seat is active in that package) and plugin-detail's 4 (batch 17 of #5174 is in flight in that package) are batch 2 (stop on breach; explain in the report)
Container & model: M, mechanical in verdict (the guard reds any file taken off the ledger that still escapes — the acceptance criterion is the gate itself) but the double's routing is a small design, mode:subagent, model: opus — dispatch-gates.mjs --tier gives no path-derived mandate on these paths (floor sonnet · default opus · ceiling fable); default judgment tier taken
Clause-②: no
Serial constraints cleared: premise on origin/main 36fc746 at 07:14Z — KNOWN_ESCAPES 21 entries, PINNED_LEDGER 21, the landed double shape present in packages/plugin-report/src/__tests__/DatasetReportRenderer.test.tsx; open-PR file lists (seven non-dependabot PRs at 06:27Z; #7685's 67 paths over git): the only overlap with the 21 is FlowNodeInspector.specKeys.test.tsx (#7685) — excluded; this seat's in-flight batch touches packages/plugin-detail/README.md (#5174 b17) and content/docs/fields/** (#7971) — disjoint from this surface; #7302's PR #7985 (queued 07:04Z) holds the gantt/kanban READMEs — the kanban/gantt test files are gated on its MERGED state above. pm:queue → pm:dispatched + assignee written in one stroke and read back.

---

Generated by Claude Code