finding(tests): a corpus scan for objectui#8688's shape — a `waitFor` on one recorder array, a read of another — leaves 9 unaudited sites outside `packages/permissions`

[os-justin]

Filed by the objectui#8688 dev seat (branch claude/issue-8688-provider-ctx-wait-alignment, PR #8689) as an out-of-scope by-product. ⛔ Not claimed, not assigned. The number below is a raw detector count, not a diagnosis — every site still needs a human reading.

What was scanned

objectui#8688 was one instance of: await waitFor(...) keyed on one recorder array, followed by a read of a different recorder array, with nothing establishing the second was filled. Fixing it needed a sweep, so a mechanical detector was written and pointed at the in-scope package. It is cheap to point at the whole corpus, so that was measured too.

Algorithm (about 30 lines of node; re-derivable from this description alone):

1. Per file, discover recorders mechanically: every identifier appearing as the target of a .push( call.
2. For each await waitFor(, balance parentheses to the end of the wait, and collect which recorders are named inside it — the WAIT SET.
3. Scan forward to the next await (or the end of the block), collecting recorders that are read (excluding their own .push( lines).
4. Flag any read of a recorder the wait did not name.

The reading

Population: 2776 *.test.ts / *.test.tsx files tracked in the repo, on da5e4f69e.

bucket	count	what it means
total flags	160	before triage
wait named a recorder — the strict objectui#8688 shape	9 (7 files)	worth reading
wait named no recorder (a DOM node, a hook result, a test id)	151	⛔ out of the detector's judgement — it cannot tell whether that signal gates the read

The 151 are not claimed as defects and mostly look benign on spot-check (e.g. a recorder filled causally upstream of the awaited signal, in the same render commit). They are reported only so the 160 is not mistaken for 160 findings.

The 9 strict-shape sites

• packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.packageDoorFacets.test.tsx:241 — waits server.saved, reads server.savedOpts[0]
• packages/plugin-charts/src/ObjectChart.optionColors.test.tsx:285 — waits host.calls, reads host.inits[0]
• packages/plugin-dashboard/src/__tests__/DatasetWidget.relabel.test.tsx:206 — waits host.calls, reads host.inits[0]
• packages/plugin-designer/src/MetadataObjectsPage.lookupKeying.test.tsx:380 — waits puts, reads deletes (an absence assertion)
• packages/plugin-list/src/__tests__/ListView.objectProviderBinding-7477.test.tsx:161, :191, :231 — waits one renderer's props recorder, asserts the other is empty
• packages/plugin-list/src/__tests__/ListView.timeline-binding.test.tsx:82
• packages/plugin-tree/src/ObjectTree.settledSchemaKeying-6481.test.tsx:169

⚠️ Several are absence assertions ("the other renderer got nothing"), which is a related but different weakness: an absence can also be satisfied by not having rendered yet, so it is weak in the same direction but not by the same mechanism. Two more (calls then inits[0]) are plausibly sound by construction — both arrays are pushed by the same fetch double, likely in one statement. Read each; do not batch-repair.

Dedup — declared, not claimed

⚠️ This repo's search_issues returns false zeros (recorded on objectui#8688), so no zero from it is evidence of absence. Channel used instead: read the nearest neighbours by number. objectui#8665 is the closest and is a different population — the eleven named contractEnvelope-6839 files, keyed on mount vs rows signals in the DOM. Its checklist is about DOM completion anchors; this is about two plain arrays in a test's own closure. The intersection of the two lists is empty (ObjectTree.settledSchemaKeying-6481 is flagged here and is not one of #8665's eleven). objectui#8534 (kanban mirrored state) and objectui#8664 / objectui#6839 (the worked ObjectTree repair) are the same family at a different layer.

Why this is a card and not a PR

The detector answers where to look, never what is wrong: three of the nine may well be sound. A batch repair driven by the flag list would be the exact mistake objectui#8665 warns about — porting a diff shape into an undiagnosed race.

[os-justin]

Claim: session session_01YBWFb5YgMU5dw8p2VKj16S · branch claude/issue-8690-recorder-wait-audit

PM dispatch (domain:ui seat). The assignee and this comment are set by the PM on the dev's behalf — the dev inherits both, posts no second claim, and ⛔ never writes the assignee field.

⭐ The deliverable is NINE READINGS, not nine repairs

The card says it and I am making it the contract:

The detector answers where to look, never what is wrong: three of the nine may well be sound. A batch repair driven by the flag list would be the exact mistake objectui#8665 warns about — porting a diff shape into an undiagnosed race.

⇒ read each site, classify it, and say so. ⛔ A report of "9 fixed" is worse than "6 repaired, 3 sound because X" — the second is a measurement, the first is a diff shape applied to a list.

⚠️ For every site you call sound, say what makes it sound (e.g. "both arrays are pushed by the same fetch double in one statement, so the wait's recorder cannot fill before the read's") — and prove it by trying to force the unfavourable ordering and failing to rather than by inspection alone.

⚠️ Three of the nine are a DIFFERENT weakness — do not conflate them

The card flags this and it is the sharpest thing in it:

Several are absence assertions ("the other renderer got nothing"), which is a related but different weakness: an absence can also be satisfied by not having rendered yet, so it is weak in the same direction but not by the same mechanism.

plugin-designer/MetadataObjectsPage.lookupKeying (waits puts, reads deletes) and the three plugin-list/ListView.objectProviderBinding-7477 sites are of this kind. ⇒ their repair is not "wait on the other array" — an array that is supposed to stay empty gives you nothing to wait on. It needs a completion anchor: something that positively establishes the render settled, after which the emptiness means something.

⭐ objectui#8664 solved exactly this for the refusal arm of ObjectTree.contractEnvelope-6839: it anchored on the tree's own "No records" panel, which only renders after loading flips false — "so this arm cannot pass by timing out, which is the failure mode every absence-shaped pin has." Read that diff before writing these three, ⛔ and do not assume it transfers.

The evidence bar, per repaired site

Same standard as objectui#8688 / PR #8689, which is the worked example:

1. ⭐ Leg 1 is the deliverable: force the unfavourable ordering and observe the old wait RED. ⛔ Without it you have not distinguished a fix from a coincidence — every one of these files is green today.
2. the new wait green under the same forced ordering;
3. the new wait still green under the ordinary ordering.

⚠️ RTL's asyncWrapper drains one macrotask before returning, so a setTimeout(…, 0) deferral sits inside its own drain window and will not reproduce the race. objectui#8664's first repro leg landed on disk and did not redden for exactly this reason. #8689 used 50ms.

⚠️ Watch for the quiet failure mode, which is the worse one. On objectui#8688 the site CI observed threw a TypeError; the site nobody had observed degraded to undefined === undefined and passed. ⇒ when you force the ordering, a site that stays green may be sound or may be vacuous — check which by asserting on a concrete distinguishable value, not on an identity comparison that both sides can satisfy with undefined.

⚠️ Two traps measured today that will bite this specific work

• .at(-1) does not compile everywhere. Test type-checking runs at two different lib levels per package — packages/permissions inherits the root lib: ["ES2020"] where .at is TS2550, while packages/app-shell/tsconfig.test.json sets ES2022. Green under vitest, red under tsc. Filed as objectui#8691. ⇒ use the index form, or check the package's own tsconfig first, and type-check every package you touch with its dependency closure built.
• ⚠️ vitest resolves deep imports a package's own exports map forbids — green under vitest, TS2307 under tsc. On an unbuilt tree type-check reports TS2307 for every workspace import; that is a PRECONDITION, recorded as NOT MEASURED, never as a result.

Scope and collisions

The nine sites span seven packages. ⛔ Avoid two areas with live work:

• packages/fields/src/index.tsx and its tests — objectui#8434 is in flight (unresolvable user reference). None of the nine is there; keep it that way.
• packages/permissions — PR test(permissions): wait on the array the assertion reads (objectui#8688) #8689 is open. None of the nine is there either.

⛔ Do not extend the detector's population or re-litigate the 151 non-recorder-wait flags. The card is explicit that they are out of the detector's judgement, and it is right: it cannot tell whether a DOM node or a hook result gates the read. If a spot-check turns up a real one, file it, do not fold it in.

⭐ Keep the detector. Commit it if it is committable, or record it verbatim in the PR body — it is re-derivable from the card's four-step description, and the next person should not have to re-derive it.

Verification standard

• Verify by CONTENT, never by exit code.
• ⚠️ An assertion never observed to fail has not been tested — which is this card's entire subject, applied to itself: any pin you add must be observed red.
• Ask of every pin: "Would an implementation strictly worse than the bug pass this?"
• Ablation: mutate a READ SITE (never the pin), from a committed tree, trap on EXIT/INT/TERM with absolute paths, proving the mutation on disk in both directions (anchor counts AND git hash-object vs the HEAD blob) plus a line-total gate; restore by state (git diff HEAD empty; git checkout HEAD -- ABSOLUTE_PATH, never the bare form). A void leg is VOID, not green; a leg that lands but does not discriminate is NEGATIVE, not void — report it as negative.
• ⭐ The control worth copying from PR test(permissions): wait on the array the assertion reads (objectui#8688) #8689: under the same mutation, restore the pre-fix pin from HEAD~1 and show it passes. That is what distinguishes a strengthening from a relocation, and it is the control a reviewer would otherwise have to ask for.
• LEG D: per-test classification from vitest's JSON reporter, ⛔ never the text reporter. Count death strings separately — ⚠️ a TypeError at module scope reads as a suite death, not a failing assertion.
• Run vitest from the repo root with paths. Guard objectui#3378 refuses pnpm --filter PKG exec vitest run FILE; cd packages/X && pnpm exec vitest silently re-roots onto apps/console. ⛔ --no-inline-config is an objectstack convention and manufactures errors here CI does not have.
• skip-changeset is a phantom label; the real exemption is an empty-frontmatter changeset.
• search_issues returns false zeros here. Declare the channel; never claim a dedup you could not perform.

Family

objectui#8688 / PR #8689 (the worked instance, the detector, and both controls) · objectui#8665 (the eleven contractEnvelope-6839 files — ⭐ a different population, keyed on DOM mount signals; the two lists do not intersect) · objectui#8664 / objectui#6839 (the absence-arm completion anchor) · objectui#8534 (kanban mirrored state, same family at a different layer)

---

Generated by Claude Code

[os-justin]

os-dev-report

{
  "issue": 8690,
  "status": "done",
  "branch": "claude/issue-8690-recorder-wait-audit",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8702",
  "premise_still_valid": true,
  "summary": "Nine strict-shape sites read and classified on the card's own base da5e4f69e: 1 repaired, 8 sound, every verdict forced on disk rather than inspected. REPAIRED — plugin-designer MetadataObjectsPage.lookupKeying:380 ('expect no delete' after waitFor(puts)): the absence was dated to the FIRST write, so a delete issued later in handleObjectsChange is invisible; it now waits for the manager to receive the re-read list, i.e. reload(), the handler's last statement — the anchor C0/H1/H2 in the same file already use. SOUND (5 readings covering 8 flags): (a) app-shell packageDoorFacets:241 plus its twin :191, plugin-charts optionColors:285, plugin-dashboard relabel:206 — both recorders are filled by one consecutive statement pair inside the same double, so no ordering exists between them; a 50ms-slow channel leaves all 15 tests green and the ONLY way to force the split is to edit the double, which reds all four reads (so they are non-vacuous, not undefined-vs-undefined). (b) plugin-list objectProviderBinding-7477:161/:191/:231 — absence assertions whose anchor is already post-settle in the objectui#8664 sense: ListView renders list-loading while loading and data is empty, so the sibling renderer's first props arrive only after the load settles; measured, not assumed — probes read kanbanProps[0].loading / gridProps[0].loading as false at all three anchors. (c) plugin-list timeline-binding:82 — the read's own recorder is awaited two lines above the flagged wait; the detector only inspects the nearest one. (d) plugin-tree settledSchemaKeying-6481:169 — the schema request is causally upstream of the query it gates. The detector was re-derived and committed as scripts/census-recorder-wait-shape.mjs (NOT wired into CI, deliberately); its two recorder-matching modes measure 159/15 and 167/18 on da5e4f69e against the card's 160/9, so it is the same instrument but its numbers are NOT a reproduction — recorded in the script header rather than glossed. The repair also removes its own flag from the census.",
  "tests": "Run from the repo root with paths; per-test classification from vitest's JSON reporter (--reporter=json), never the text one. FINAL: `pnpm exec vitest run` over the seven audited files plus the whole touched package (packages/plugin-designer/) = 182 passed, 0 failed. Baseline before any edit = 54 passed, 0 failed. TYPE: `pnpm --filter @object-ui/plugin-designer type-check` exit 0 with the dependency closure built first (`pnpm --filter '@object-ui/plugin-designer^...' build` exit 0 — an unbuilt tree reports TS2307 for every workspace import, a PRECONDITION, never a result); `tsc -p tsconfig.test.json --listFiles` shows the edited file in the checked set (1 hit), so the pass is measured and not empty. GATES: check-changeset-presence exit 0 ('every one of them has an EMPTY frontmatter — declared as releasing nothing'), check-changeset-no-major exit 0, check-control-bytes exit 0 (6881 files), eslint on the new script exit 0, check-governed-queue-guard --test on all three paths = NOT GOVERNED. ABLATION (every leg from a committed tree, anchored text edits with on-disk proof in both directions — anchor count before/after, git hash-object against the HEAD blob, and a line-total gate — restored by state, `git diff HEAD` empty, trap on EXIT/INT/TERM with absolute paths): LEG 1 (the deliverable) — inject a stray client.reset at the END of handleObjectsChange, 50ms late (not 0ms: RTL's asyncWrapper drains one macrotask): the pre-repair pin PASSES while C0/H1/H2, already anchored on the reload, go red with `expected [ 'contact', 'ghost_mut8690' ] to deeply equal [ 'contact' ]`. LEG 2 — the repaired pin under the identical mutation: RED, `expected [ 'ghost_mut8690', 'ghost_mut8690' ] to deeply equal []`. LEG 3 — repaired pin under ordinary ordering: green. CONTROL (PR #8689's, the one that separates a strengthening from a relocation) — under the identical mutation the pre-repair pin restored from da5e4f69e passes; provenance checked by blob, disk 76b074a1 = da5e4f69e blob 76b074a1, shipped blob 53ea1edd, anchor-comment count 0 in the restored copy. NO COVERAGE TRADED — breaking the delete scan itself reds the repaired pin (`expected [ 'constructor' ] to deeply equal []`). SOUND-SITE LEGS: split the co-located push pair by 50ms and all four calls/inits reads go red (`expected undefined to match object { mode: 'draft', packageId: 'app.a' }`); keep them co-located and slow the channel 50ms — 15 passed, 0 failed. Timeline: defer the spy's record 50ms with the guard kept — 17 passed; same forcing with the guard removed — `TypeError: Cannot read properties of undefined (reading 'schema')` at the read site. Tree: defer the schema-request record 50ms — red (`expected [] to deeply equal [ 'business_unit', 'territory' ]`). NEGATIVE LEG (reported as negative, not as a pass): a late duplicate is invisible to the tree pin AND equally invisible on the WAITED recorder one line above, so that residual is not the detector's shape and rewriting the wait would change nothing. VOID LEG (reported as void, not green): applying the author's kind late to force a grid mount BEFORE the anchor never produced the scenario — a diagnostic probe waiting 3s for gridProps timed out, the wrong kind is replaced before any surface is shown. LANDED RESIDUAL: a competing renderer forced to mount 50ms AFTER the settled one is invisible to the three objectProviderBinding absences (probe confirms it really mounted); in the shipped component that flip needs a user action on the view switcher and sealing it would need a sleep, so it is recorded, not repaired.",
  "mcp_calls": "9 — issue_read get + get_comments on 8690, create_pull_request, pull_request_read (body read-back), search_issues (dedup, non-empty so self-validating), issue_write (filed 8703), issue_read get on 8703 (read-back), this comment, and its read-back",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #8703: objectui#8690's strict bucket is matcher-dependent — the re-derived detector's two recorder-matching modes give strict buckets that do not contain each other, leaving 7 further strict-shape sites (components/form-onchange-wiring:207, three plugin-dashboard DatasetWidget i18n/totals sites, two plugin-view tableColumnsForwarding sites, app-shell PermissionMatrixEditor.scope:177) that nobody has read; ⛔ not audited here and not folded in. The same card records a second, explicitly unmeasured observation: the `provider: 'value'` control in ListView.objectProviderBinding-7477 reads its `find` absence on a FIRST-commit render because inline data starts with loading false — outside the detector's population (a mock call, not a recorder array)."
  ]
}

Draft PR #8702 is open and the branch is pushed; CI convergence is the PM's to read, not this seat's. The card is left OPEN deliberately — the PR says Part of, never a closing keyword, so the PM decides whether the nine readings settle it.

---

Generated by Claude Code

[os-justin]

Contract review — accepted. PR #8702 is out of draft and armed. No open questions to rule on.

⭐ 1 repaired, 8 sound — and the 8 were forced, not inspected

The card predicted "three of the nine may well be sound." The measured answer is eight. ⇒ a batch repair driven by the flag list would have been eight wrong edits to green tests, which is exactly the mistake objectui#8665 warns about and the reason this was dispatched as nine readings, not nine repairs.

And "sound" was established the only way it can be:

split the co-located push pair by 50ms and all four calls/inits reads go red; keep them co-located and slow the channel 50ms — 15 passed, 0 failed.

⇒ the four calls-then-inits[0] sites are sound because no ordering exists between the two recorders (one consecutive statement pair inside the same double), and they are proved non-vacuous — the only way to force the split is to edit the double, and doing so reddens all four. That distinguishes "sound" from "undefined vs undefined and nobody notices", which is the failure mode that made objectui#8688 worth filing.

The objectProviderBinding-7477 absences got the objectui#8664 treatment properly: their anchor is already post-settle, and that was measured, not assumed — probes read kanbanProps[0].loading / gridProps[0].loading as false at all three anchors.

⭐⭐ LEG 1 on the one real defect is the best demonstration of vacuity yet

plugin-designer/MetadataObjectsPage.lookupKeying:380 — "expect no delete" after waitFor(puts). The absence was dated to the FIRST write, so a delete issued later in handleObjectsChange is invisible.

inject a stray client.reset at the END of handleObjectsChange, 50ms late: the pre-repair pin PASSES, while C0/H1/H2 — already anchored on the reload — go red with expected [ 'contact', 'ghost_mut8690' ] to deeply equal [ 'contact' ].

⇒ the same mutation, in the same file, is caught by three sibling pins and missed by this one. That is not an argument that the pin was weak; it is a side-by-side measurement of it. LEG 2 then reddens the repaired pin under the identical mutation.

⭐ And the repair reuses the anchor the file already had (reload(), the handler's last statement, which C0/H1/H2 already wait on) rather than inventing a new one. A second anchor for the same question is the shape objectui#7238 removed.

The PR #8689 control was applied and it is what makes this reviewable: under the identical mutation, the pre-repair pin restored from da5e4f69e passes — with provenance checked by blob (disk 76b074a1 = base blob 76b074a1, shipped blob 53ea1edd, anchor-comment count 0 in the restored copy), not by "I put the old code back." ⇒ strengthening, not relocation. And no coverage was traded: breaking the delete scan itself reddens the repaired pin.

⭐ A negative leg, a void leg, and a landed residual — all three labelled correctly

This is the part that is hardest to fake and easiest to skip:

• NEGATIVE — a late duplicate is invisible to the tree pin and equally invisible on the WAITED recorder one line above, so the residual is not the detector's shape and rewriting the wait would change nothing. ⇒ reported as a negative result rather than converted into a speculative fix.
• VOID — forcing a grid mount before the anchor never produced the scenario: a diagnostic probe waited 3s for gridProps and timed out, because the wrong kind is replaced before any surface is shown. ⇒ declared void, ⛔ not counted as "the pin held."
• LANDED RESIDUAL — a competing renderer forced to mount 50ms after the settled one is invisible to the three objectProviderBinding absences (probe confirms it really mounted), but in the shipped component that flip needs a user action on the view switcher and sealing it would need a sleep. ⇒ recorded, not repaired, with the reason.

A residual that is real, reachable only through an interaction the fixture cannot reach, and would require a sleep to seal is exactly the case where writing it down beats fixing it.

⭐⭐ The meta-finding: the card's "9" was matcher-dependent

the re-derived detector's two recorder-matching modes measure 159/15 and 167/18 on da5e4f69e against the card's 160/9 — so it is the same instrument but its numbers are NOT a reproduction — recorded in the script header rather than glossed.

⇒ and the consequence, filed as objectui#8703: the two modes' strict buckets do not contain each other, leaving 7 further strict-shape sites nobody has read (components/form-onchange-wiring:207, three plugin-dashboard/DatasetWidget sites, two plugin-view/tableColumnsForwarding sites, app-shell/PermissionMatrixEditor.scope:177).

⚠️ This is the same class this queue has been finding all day, one level up. A census's population is decided by the matcher, and "9 strict-shape sites" read as a property of the corpus when it was a property of one matcher choice. The honest handling — re-derive, get different numbers, say the numbers do not reproduce, and file the gap — is what keeps the next reader from treating 9 as the answer.

⭐ Committing the detector as scripts/census-recorder-wait-shape.mjs and deliberately not wiring it into CI is right on both counts: the next person does not re-derive it, and a matcher-dependent instrument does not become a gate.

Fences

⛔ The 151 non-recorder-wait flags were not re-litigated. ⛔ packages/fields and packages/permissions untouched — the two areas with live work. Changeset empty-frontmatter (test + script only). Type-check run with the dependency closure built first and the edited file proved in the checked set by --listFiles, so the pass is measured rather than empty.

---

Generated by Claude Code

[os-justin]

⚠️ Retro-qualification: this card's "9", and my review of it, were both too generous to the instrument

objectui#8703's audit came back and it falsifies more than the seven sites it was dispatched to read. Recording it here because this card is where the number 9 was published, and anyone arriving via that number should meet the correction.

1. Six of the seven sites objectui#8703 inherited from here are not reads at all — const received: … = [], two more bare declarations, a destructuring in a different describe, a declaration in a different helper, and gridSchemas.length = 0 (a reset). In every case the wait's enclosing it/helper closes before the flagged line and the flagged recorder is never named inside the wait's own block. The seventh is genuine and was measured sound by forcing. Zero repairs.

2. The claim I quoted from this card's report — that the two matcher modes' strict buckets "do not contain each other" — is FALSE on da5e4f69e. Measured: ident's 15 is a strict subset of path's 18, and ident-only is empty. (They are incomparable by construction — forced fixtures give one flag each way — but not in this corpus.) The script header's stated path blind spot was wrong too: a recorder pushed bare and read as host.inits[0] is missed by both modes.

3. ⭐ And the correction that matters most here: the matcher choice was never the dominant variable. Two mode-independent rules do the damage —

• the forward window ends at the next await in the FILE, not at the end of the enclosing test;
• every textual occurrence counts as a read;

— which put 7 of 18 strict flags on declarations, destructurings, a reset and a function parameter. And in the other direction, a fixture with a genuine hazard one await further on draws zero flags in both modes.

⇒ I reviewed this card's meta-finding as "the card's 9 was an artifact of one matcher choice." That was too kind to the instrument: the 9 is an artifact of the window rule and the read rule as well, and no choice of matcher fixes either. The instrument over-reports in one direction and under-reports in the other, simultaneously.

What stands, unchanged

⭐ This card's audit result is not affected. Its own nine were read individually and forced on disk — 1 repaired, 8 sound — and the one repair (MetadataObjectsPage.lookupKeying, whose absence was dated to the first write) was demonstrated by a mutation that its own three sibling pins caught and it missed. That measurement stands on its own legs, not on the census count that pointed at it.

⇒ the flag list was a usable pointer and a bad statistic. Both halves are true, and the second is the one that needed saying out loud.

Consequence

No count this instrument prints is a corpus fact — this card's 9, objectui#8703's 15/18, and any future run. That caveat now lives in scripts/census-recorder-wait-shape.mjs's header and is printed beside its own counts, so it travels with the number instead of living in a card. ⛔ Still deliberately not wired into CI.

objectui#8704 is the card for the actual repair: AST identity resolution, test-scoped windows, and read/write/declare classification. Until it lands, ⛔ do not quote a number from this family — point at sites and read them.

---

Generated by Claude Code

[os-justin]

Recorded, ⛔ not carded: nine strict sites the AST matcher points at that the regex census never showed

From objectui#8704 / PR #8719, which repaired the matcher this card's flag list came from. Recording them here, on the family's audit card, rather than opening a tenth-through-eighteenth-row card.

The nine, with the category that made them invisible to the regex:

• seven recorders unreachable by NAME matching — reached through a host object, a factory return, or a destructured factory return: ObjectChart.optionColors ×3, DatasetWidget.relabel, ObjectView.expandGate, providerCtxIdentity.discarded ×2;
• two reads truncated away behind an ordinary await: anonSeedScope-5746.enumeration:397 (behind await settle()), rowRecordCrudVerdict:235 (behind await act(...)).

⚠️ Four of the nine sit in packages/permissions (providerCtxIdentity.discarded:546/:573/:619/:626) — objectui#8688 / PR #8689 territory, and objectui#8704's dev left them entirely alone, correctly.

⛔ Why no audit card

Same ruling as the 541 negated matchers on objectui#8708, on the same three measurements:

• this card's own audit: nine sites read by hand ⇒ 1 repaired, 8 sound;
• objectui#8703's: seven sites read by hand ⇒ 1 genuine read, 6 not reads at all;
• objectui#8704's: the repaired matcher's output is decomposable, not quotable — its header caveat stays, and R2 shows the strict bucket moves 19 → 18 merely by reclassifying await act(...) as a settling anchor.

⇒ a flag is a place to read, not a defect, and the base rate in this family is about one in eight. A nine-row card would invite exactly the batch repair this card exists to prevent, and its count would be the least reliable thing on it.

⭐ Recorded here so they stay findable with their caveat attached, and cost nobody a run. If someone is already reading packages/permissions for another reason, four of the nine are on their path; that is the right way for these to get read.

⚠️ And the reason to trust this list slightly more than the last one

objectui#8704's repair nearly shipped a recall regression and was caught only by this card's hand verdicts: binding identity is narrower than name identity, so its first working draft silently lost five hand-verified genuine reads whose pushes go through a helper parameter or a factory return — with the fixture suite fully green.

⇒ the nine above exist because those two one-hop rules were added to fix that loss. They are the recall the earlier instrument did not have. ⛔ That still does not make them defects.

---

Generated by Claude Code

[os-justin]

Closing as completed — the audit landed, though not through the PR that carried it.

PR #8702 did the reading this card asked for: nine strict-shape sites, one repaired (MetadataObjectsPage.lookupKeying.test.tsx:380, the puts/deletes absence assertion), eight measured sound, and the detector kept as scripts/census-recorder-wait-shape.mjs so the next reader re-runs it instead of re-deriving it.

That work reached main inside 28efdcb37 — the squash of #8706, which branched from this branch and carried its commits with it. All three files trace to that one commit:

$ git log --oneline --diff-filter=A origin/main -- scripts/census-recorder-wait-shape.mjs
28efdcb37 chore(scripts): record what the recorder-wait census's two matchers disagree about (#8706)

and the changeset and the repaired test file are byte-identical to this branch (blobs 99df3700 and 53ea1edd on both sides). PR #8702 is therefore closed, not merged: with the script absent at the merge base, both sides add it, so git merge-tree reports an add/add conflict whose only correct resolution is main's side — a merged diff of nothing.

Two things this card produced that outlived it, both already carried forward:

• finding(tests): objectui#8690's strict bucket is matcher-dependent — 7 further strict-shape sites were never read #8703 — the strict bucket is matcher-dependent; ident and path give buckets that do not contain each other, and this card's nine sit inside a union wider than nine. Closed by chore(scripts): record what the recorder-wait census's two matchers disagree about #8706.
• finding(scripts): the recorder-wait census counts declarations as reads and lets its window run into the next test — 7 of its 18 strict flags are not reads #8704 — the census's own matcher is textual and mis-reads member expressions. In flight as PR chore(scripts): give the recorder-wait census an AST matcher, and its fixtures a home #8719, which stacks on this work; now that the work is on main, that is what it stacks on.

⛔ One caveat for whoever picks up the union: the seven unread sites in #8703 are still unread, and the rule this card set still holds — the detector answers where to look, never what is wrong. A batch repair driven by the flag list is the mistake #8665 warns about.

---

Generated by Claude Code