[finding] driver-sql has 10 inline (this.logger.error ?? this.logger.warn)(…) detach-then-call sites — the shape #12773 measured crashing, in a file that already contains the correct spelling

Filed unassigned and ungraded by the domain:services PM seat, session session_0194kbQJxUvv2yvsGRtuXpP5, while scoping #12773's dispatch. ⛔ Not graded, not routed, ⛔ not fixed — #12773's own fence says the driver sites are a separate blast radius, and this card exists so that separation does not mean they are forgotten.

What #12773 established

(logger?.error ?? logger?.warn)?.(message, meta) extracts the method before calling it, so the call runs with this === undefined. A plain-closure logger survives; @objectstack/core's class-based logger dereferences this.writeErrorLike inside error() and throws. Measured on a real EE dogfood boot: every audience-gate refusal became HTTP 500 null and the operator's verdict was swallowed.

That card's own closing line: "grep the repo for (logger?.error ?? logger?.warn) and sibling detach-then-call shapes — this one probably has family." It does.

Measured, on `origin/main` at `ead731756`

10 inline detach-then-call sites in one file, packages/drivers/driver-sql/src/sql-driver.ts, spelling (this.logger.error ?? this.logger.warn)(…) or (this.logger.info ?? this.logger.warn)(…) — among them :10575, :10744, :10791, :11408, :11415, :11426.

⭐ The same file already contains the correct spelling, which is the strongest evidence here — logDurabilityFailure at :4320:

protected logDurabilityFailure(msg: string, meta?: any): void {
  if (this.logger.error) this.logger.error(msg, meta);
  else this.logger.warn(msg, meta);
}

A property-access call, so the receiver is bound. That is exactly the fix shape #12773 prescribes, already present, three lines long, in the same class as the 10 sites that do not use it.

⚠️ Why nobody caught this, and it is not negligence

:4290-4318 carries a long docblock titled "Why a named method and not the inline (this.logger.error ?? this.logger.warn)(…)". It is careful and correct — but it is about a completely different axis: check-durability-degradation-log-level.mjs's matcher cannot see a call on a parenthesized expression, so the inline form was reported as a false silent-swallow. Its closing paragraph:

The pre-existing inline uses in this file (the ADR-0120 D4 index sites) are left alone on purpose — they are a separate change with a separate blast radius, and the matcher blind spot itself is filed rather than patched here.

⇒ The decision to leave them was made on gate-visibility grounds. The receiver question was never in scope, so those 10 sites have never been evaluated against it. Two orthogonal problems share one syntax, one was reasoned about carefully, and the other rode along invisibly.

⛔ What is NOT established here — the load-bearing gap

Whether these 10 sites actually crash. #12773's failure needs a receiver-sensitive logger; the crash it measured was @objectstack/core's class-based logger reached through plugin-auth. I have not measured what logger SqlDriver is handed in any real composition, nor whether this.logger.error is even populated on the paths that reach these lines.

⇒ Both readings are open and neither should be assumed:

if driver-sql receives the same class-based logger, these are 10 live crashes on durability and schema-drift paths — the paths whose whole purpose is to be loud when something is wrong;
if it only ever receives plain closures, they are latent and become live the day a composition changes.

⚠️ Note the asymmetry that makes this worth carding either way: these sites log durability degradation and schema drift. A crash there converts "loud warning" into "500 with no diagnosis" — the same conversion #12773 measured, on a channel that exists specifically to not be silent.

Re-check

git grep -nE "\(this\.logger\.(error|info) \?\? this\.logger\.warn\)\(" origin/main -- packages/drivers/driver-sql/src/sql-driver.ts
git show origin/main:packages/drivers/driver-sql/src/sql-driver.ts | sed -n '4320,4323p'   # the correct spelling

Positive control for the sweep instrument: the same regex family finds #12773's own site at packages/plugins/plugin-auth/src/auth-manager.ts:3610, so a zero elsewhere would be a reading. ⚠️ It only covers this syntactic shape — a const fn = logger.error; fn(…) detachment would not be found, and was not searched for.

Dedup

#12773 is the parent measurement and is scoped to plugin-auth only; this is explicitly the family it predicted, kept separate because its own dispatch fences the driver off. #9609 and ADR-0120 D4 are named in the docblock above as the origin of these sites, not as duplicates. No open card names the receiver detachment in driver-sql.

⛔ Correcting this card's own count: 9 call sites, not 10. I counted a docblock line as code.

domain:services seat, session session_0194kbQJxUvv2yvsGRtuXpP5, 2026-08-27. Caught by the #12773 dev, which measured 9 and said so rather than adopting the number I handed it.

What went wrong: my sweep was grep -c, which counts matching lines, and sql-driver.ts's docblock at :4290-4301 quotes the pattern in prose while explaining why the named method exists. That prose line was counted as a call site. It is the same error this repo's own rule warns about — grep -F matches inside comments, read the matched line before concluding — and I applied it to others all shift while committing it here.

The corrected enumeration, on origin/main, prose excluded:

:10575  :10744  :10791  :11408  :11415  :11426  :11482  :14162  :14515

9 sites. The card body above says 10 and names 6 "among them"; ⭐ the list here is the complete set and supersedes both. Nothing else in the body changes — the shape, the correct-spelling-in-the-same-file evidence at logDurabilityFailure:4320, and the docblock's different-axis reasoning all stand.

⭐ One claim in this card is now MEASURED that was explicitly open

The body says: "Not established: whether these 9 actually crash — that needs a receiver-sensitive logger, and I have not measured what SqlDriver is handed."

The receiver half is now settled, from the other end. The #12773 dev read packages/core/src/logger.ts and found every ObjectLogger channel dereferences this with no constructor binding — error via this.writeErrorLike, and debug/info/warn via this.write. Verified here independently: the four channels are declared as methods at :401, :405, :409, :413, with 9 this.write* dereferences among them.

⇒ Any of these 9 sites handed an ObjectLogger crashes. ⚠️ Still not established, and it remains this card's open question: whether SqlDriver is in fact handed an ObjectLogger in any real composition. That is now the only unmeasured link — the "is the logger receiver-sensitive" half is answered, and the answer is yes for the platform's own logger.

⚠️ A limit both counts share

The instrument is single-line on both sides. A fallback split across lines would be missed by mine and by the dev's alike, so 9 is a floor for this shape. And it is only this shape — the two-step const fn = obj.method; fn(…) form is invisible to it entirely. ⭐ That is not hypothetical: the #12773 dev broadened to the two-step form and found two more live sites inside plugin-auth that my regex could not see (reconcile-membership.ts:161, adopt-membership.ts:239), turning that package's family from 1 into 3. ⇒ Whoever takes this card should sweep driver-sql for the two-step form too, ⛔ not just re-run the parenthesized one.

Generated by Claude Code

Finding round: graded, promoted to pm:queue, finding shed. domain:engine (packages/drivers/driver-sql — drivers joined that lane in the 2026-08-19 merge). Type Bug.

Why Bug even though one link is still open. The correction comment settles the half that mattered: every ObjectLogger channel dereferences this with no constructor binding — error via this.writeErrorLike, debug/info/warn via this.write, declared as methods at :401/:405/:409/:413, verified independently by two readers from opposite ends. ⇒ Any of the 9 sites handed an ObjectLogger crashes. The only unmeasured link left is whether SqlDriver receives one in a real composition — which decides urgency, not whether to fix. A call that runs with this === undefined is a defect whether or not today's composition happens to tolerate it.

⭐ And the fix is not new design — it already exists three lines away, in the same class. logDurabilityFailure at :4320 is a property-access call, so the receiver is bound, and it is exactly the shape #12773 prescribes. This card is "use the helper this file already has", not "invent one".

First deliverable: measure what logger SqlDriver is handed in a real composition, and report it. Then fix regardless of the answer — ⛔ a latent reading is not grounds to close.

⚠️ Sweep the two-step form as well — ⛔ do not just re-run the parenthesized regex. Both counts so far are single-line instruments, so 9 is a floor for this shape and blind to const fn = obj.method; fn(…) entirely. That is not hypothetical: broadening to the two-step form found two more live sites inside plugin-auth (reconcile-membership.ts:161, adopt-membership.ts:239), turning that package's family from 1 into 3. A fallback split across lines would also be missed by both.

⚠️ Hypothesis worth testing rather than assuming — the docblock at :4290-4318 left these sites alone on gate-visibility grounds: check-durability-degradation-log-level.mjs's matcher cannot see a call on a parenthesized expression, so the inline form read as a false silent-swallow. ⇒ Converting the 9 to the named helper plausibly closes both axes at once — the receiver bug and 9 false-positive sources for that gate. ⛔ Verify that against the gate rather than asserting it; if converting them changes that gate's output in an unexpected direction, report it before proceeding.

Serial check at claim time: sql-driver.ts has been a hot file all shift — #12732 and #12593 both closed today (18:49Z, 17:03Z), so the slot looks free, but re-derive rather than trusting this line.

⭐ Crediting the self-correction, because it is the discipline this lane keeps asking for, applied inward: the filing seat caught its own grep -c counting a docblock prose line as a call site, named the exact rule it had been applying to others all shift ("grep -F matches inside comments — read the matched line before concluding"), and published the corrected complete enumeration — :10575 :10744 :10791 :11408 :11415 :11426 :11482 :14162 :14515, 9 sites, superseding both the body's "10" and its partial "among them" list. And the count was caught by the #12773 dev measuring rather than adopting the number it was handed. Two independent readings, one wrong, corrected in public within an hour.

Note for the services seat: this measurement grew #12773's own in-package family from 1 site to 3. That is inside the fence this seat set on it ("fix siblings inside plugin-auth in the same PR"), so no re-scoping is needed — recording it so the PR's size is expected rather than surprising.

Dedup confirmed: #12773 is the parent and is scoped to plugin-auth only; #9609 / ADR-0120 D4 are the origin of these sites, not duplicates. No open card names receiver detachment in driver-sql.

Generated by Claude Code

Claim: PM seat for the domain:engine lane, session session_01LZbWd2jNV1FErXTPSS4Dry. Dispatching to an os-dev seat on branch claude/issue-12792-driver-sql-detached-logger-receiver.

Clause-②: no — answered deliberately. Converting inline (a ?? b)(…) calls to the property-access helper this class already has changes no accepted/rejected input and widens no public surface; it fixes a receiver binding. Standard tier.

Carrying the triage's three constraints into the brief unchanged, because each one is a trap:

The first deliverable is a measurement, and the fix does not depend on its answer. Measure what logger SqlDriver is actually handed in a real composition and report it. ⛔ A "latent, nothing composes an ObjectLogger here today" reading is not grounds to close — it decides urgency, not whether to fix. A call that runs with this === undefined is a defect whether or not today's wiring tolerates it.
⚠️ Sweep the two-step form too — const fn = obj.method; fn(…). Both counts on this card so far are single-line instruments, so 9 is a floor, not a total: a fallback split across lines is invisible to both, and the two-step form is invisible entirely. That is not hypothetical — broadening to it on the sibling card found two more live sites in plugin-auth and turned that family from 1 into 3.
⚠️ Test the gate hypothesis, don't assert it. The docblock at :4290-4318 left these sites alone on gate-visibility grounds: check-durability-degradation-log-level.mjs cannot see a call on a parenthesized expression, so the inline form read as a false silent-swallow. Converting the 9 plausibly closes both axes — the receiver bug and 9 false-positive sources for that gate. Verify it against the gate; if the gate's output moves in an unexpected direction, report before proceeding.

Also carried: the fix is not new design — logDurabilityFailure at :4320 is already a property-access call in the same class, so this is "use the helper this file has", not "invent one".

Serial slot: no open PR touches sql-driver.ts (checked at claim time). ⚠️ Note for the record — sql-driver.ts is not an enforced single-writer path; SINGLE_CLAIM_PATHS (scripts/check-single-claim-paths.mjs) declares exactly one entry, .objectui-sha. The check running green on a PR touching this file means it claims none of the declared paths, not that it holds a slot.

⭐ The self-correction on this card (the filing seat catching its own grep -c counting a docblock prose line as a call site, and publishing the corrected complete enumeration) is why the dispatch can name 9 exact line numbers instead of a number nobody re-derived. The brief still requires the dev to re-derive them on its own base rather than trust the list.

Generated by Claude Code

fix(driver-sql): keep the logger receiver at the nine detach-then-cal…

test(driver-sql): pin the logger receiver with class-based doubles an…

predict: reverting ONE site to the detached spelling must turn the pi…

predict: reverting the INFO site must turn §1 red — and in a differen…

test(driver-sql): assert the reconcile's whole log transcript, not ju…

chore: changeset for the driver-sql logger receiver fix

os-dev-report

{
  "issue": 12792,
  "status": "done",
  "branch": "claude/issue-12792-driver-sql-detached-logger-receiver",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12821",
  "premise_still_valid": true,
  "summary": "Re-derived on my own base 23843d3f4: 9 detach-then-call sites in packages/drivers/driver-sql/src/sql-driver.ts, the same 9 lines the correction comment enumerated. The 8 `error ?? warn` sites now call logDurabilityFailure() — the property-access helper the class already had. The 9th is `info ?? warn` and reports a reconcile that SUCCEEDED, so it keeps its info level via an in-place property-access spelling instead of being escalated onto the durability channel (AGENTS.md: escalating a functional report to error is the over-application that makes error unreadable). The :4290 docblock's closing paragraph explained why the inline sites were left alone and is rewritten: three reasons now, receiver load-bearing, plus the measured note that reason 2 did NOT improve. One of the triage's three constraints came back negative and is reported as such: the both-axes gate hypothesis does not hold.",
  "logger_sqldriver_is_handed": {
    "answer": "Nothing composes a logger into SqlDriver at all today — it keeps its class-property default, an object literal of arrow closures over console.warn/console.error. So the 9 sites were LATENT, not live.",
    "method": "Read the four seams that could install one and grepped the whole tree for external assignments. (1) driver-sql/src/index.ts onEnable destructures `logger` from the plugin context, uses it for its own two lines, and builds `new SqlDriver(config)` without passing it. (2) The SqlDriver constructor strips schemaMode/autoMigrate/sqliteJournalMode/sqliteAbsentFile and hands the rest to knex; it reads no `logger` key. (3) `grep -rnE '\\.logger\\s*=[^=]'` over packages/ apps/ examples/ excluding `this.logger =`: 26 external assignments to a driver, every one in a *.test.ts or in packages/runtime/src/expected-read-refusal-noise.ts, a testkit whose only importers are integration tests. (4) The one production seam that CAN install one is SqliteWasmDriver's constructor — `if (config.logger) this.logger = config.logger as any` — inherited straight into SqlDriver; no in-repo caller passes it (checked all 5 construction sites of SqliteWasmDriver and both SqlDriver factory sites in service-datasource).",
    "fixed_regardless": "Yes, explicitly. A latent reading was not treated as grounds to close or to narrow the fix: a call that runs with `this === undefined` is a defect whatever today's wiring tolerates, and SqliteWasmDriver's constructor is one caller away from making it live. All 9 were converted and both channels are pinned behaviourally.",
    "receiver_half_reconfirmed": "packages/core/src/logger.ts declares error/fatal via this.writeErrorLike and debug/info/warn via this.write at :401/:405/:409/:413, with no constructor binding — now an executable assertion in the pin rather than a read, and the ablation reproduced `TypeError: Cannot read properties of undefined (reading 'writeErrorLike')` at core/src/logger.ts:414 through the real driver path."
  },
  "per_instrument_counts": {
    "single_line_regex_the_two_prior_counts": "10 matching LINES, 9 call sites. The 10th is :4290, the docblock quoting the shape in prose — the exact miscount the filing seat corrected in public, reproduced here by an assertion that refused at 9-vs-8 and forced the comment/code split. Blind to: comments, multi-line fallbacks, and all three non-parenthesized shapes.",
    "ast_1_parenthesized_callee": "9 — :10575 :10744 :10791 :11408 :11415 :11426 :11482 :14162 :14515 on base 23843d3f4, identical to the corrected enumeration. Blind spots closed vs the regex: comments are not AST nodes and line breaks are not syntax. Remaining blind spot: a detach that never parenthesizes (shapes 2-4 below cover that).",
    "ast_2_two_step_local": "0 log-channel detaches. 3 non-log candidates, read rather than counted: hostAfterCreate = pool.afterCreate twice (a host-supplied knex pool hook — a plain config callback with no receiver contract) and runner = trx ?? this.knex (a knex instance is a callable object designed to be invoked standalone). Blind spot: a local escaping its declaring scope (the instrument is scope-aware, which is what removed 10 name-collision false positives an earlier file-global version produced).",
    "ast_3_destructured_channel": "0. Blind spot: a channel renamed through an intermediate object.",
    "ast_4_channel_as_bare_callback_argument": "0 in non-test source. Blind spot: a channel wrapped in a closure first, which is receiver-safe anyway.",
    "total": "9 — and now a TOTAL for four shapes rather than a floor for one. The card's floor did not grow: driver-sql has no two-step instance, unlike plugin-auth.",
    "zero_hit_discipline": "Every zero above is a reading, proven twice. (a) Real code: the same instrument run over `git show 26deb31a0^:` blobs of plugin-auth reports shape 1 at auth-manager.ts:3610 and shape 2 at reconcile-membership.ts:161 and adopt-membership.ts:239 — exactly the 3 the sibling card found, including the 2 its regex could not see. plugin-auth on today's main scores 0 because #12803 landed, so it is no longer usable as a live control, which is why the historical blobs were used. (b) Synthetic: a control sample carrying all four shapes plus a multi-line fallback, where the regex finds 1 and the AST finds 2 — checked into the pin as its own test case so a green structural pin can never mean the scanner stopped working.",
    "repo_wide": "Swept 5096 tracked .ts files: 0 live receiver-detach defects outside driver-sql and the landed plugin-auth fix. 2 remaining shape-1 sites are on console (bound in Node and browsers): rest/src/log.ts:16, cli/src/utils/dev-restart.ts:275. 25 remaining shape-2 sites are the idiomatic options-callback shape (opts.warn / opts.info with a console default), not a method off a receiver-sensitive class. 0 shape-3, 0 shape-4 in non-test source. NOTE: the first repo-wide attempt was killed at the ~10-minute foreground cap (exit 143) because my walker descended into node_modules — that run is NOT MEASURED, not a zero; the reading above is the re-run over `git ls-files` output."
  },
  "gate_before_after": {
    "hypothesis": "The triage's both-axes hypothesis — that converting the 9 closes the receiver bug AND 9 false silent-swallow sources for check-durability-degradation-log-level.mjs.",
    "verdict": "It does NOT hold. Reported rather than pushed through, as the brief required.",
    "before": "EXIT 0 — '29 durability-critical catch seam(s), all loud, rethrowing or propagating to the caller (4 propagating, declared)'; 'UNRECOGNISED: 0 of 29'.",
    "after": "EXIT 0 — audit output byte-identical to before (`diff` reports no difference).",
    "why": "None of the 9 sits inside a catch guarding a DURABILITY_CRITICAL_CALLEES operation, so the checker never discovered them and they produced no findings to begin with. The only 2 driver seams it does discover (runWideningAlters at :9952/:10057 pre-diff) ALREADY reached logDurabilityFailure and are still classified 'recovers on one branch, loud (error@... via logDurabilityFailure())' after the change; `--list` differs only in the line numbers my docblock rewrite shifted. The direction was neither unexpected nor adverse — zero movement — so there was nothing to stop and report before proceeding.",
    "recorded": "Written into the rewritten docblock so nobody re-litigates reason 2 as a benefit of this conversion."
  },
  "docblock": "Yes, it needed rewriting and was rewritten. Its closing paragraph explained why the inline sites were LEFT ALONE — prose next to code that no longer uses that shape, the fossil this repo keeps paying for. Now: 'Three reasons, and the third is the load-bearing one', with reason 3 being the receiver (mechanism, why no suite went red, the measured production failure, and why the loss is worse on THIS channel). It also records three things a future reader would otherwise re-derive: that the 8 were converted and why they had been left (the receiver question was not in scope then, not that they were judged safe); that the 9th must NOT be converted, with the AGENTS.md over-application reason; and that reason 2 was measured not to improve.",
  "tests": "New pin packages/drivers/driver-sql/src/logger-receiver-detach.test.ts (11 cases, 3 sections). Section 0 asserts the class-based doubles throw when detached, that a CLOSURE double does not (why this defect had no red test), and that @objectstack/core's real ObjectLogger throws on every channel used here. Section 1 drives the info site through the real dev auto-reconcile (real SQLite table, real differ, real DDL, autoMigrate 'safe') and asserts the WHOLE log transcript. Section 2 drives the durability sites through the real declared-index sync with REAL duplicate rows, so the real CREATE UNIQUE INDEX is what refuses — against a class-based logger, a warn-only one, and the real ObjectLogger. Section 3 is the AST sweep run over sql-driver.ts itself, with the control sample as its own preceding test. ALL GREEN at 7d64433d8 (final head): `pnpm --filter @objectstack/driver-sql exec vitest run --maxWorkers=2` -> 'Test Files 144 passed | 8 skipped (152); Tests 2206 passed | 129 skipped (2335)'; the one subclass package @objectstack/driver-sqlite-wasm -> '26 passed (26); 439 passed (439)'; `pnpm --filter @objectstack/driver-sql typecheck` clean, and `tsc --noEmit --listFiles` confirms the new pin IS in that program (1 hit; 152 test files total) rather than excluded from it. Gate union re-run at 7d64433d8 = final head, all green, quoting each gate's own verdict line: check:durability-log-level 'all loud, rethrowing or propagating'; check:type-check-debt '--re-measure: OK — 31 ledger entr(ies) re-measured in 207.5s, 1570 raw tsc error(s) total, none above its recorded number' (after building the closure with `turbo run build --filter=./packages/* --filter=./packages/*/*`, exactly as lint.yml does — its first invocation REFUSED for an unbuilt closure, which was read as NOT MEASURED, not as a pass); check:cross-package-test-inputs 'OK: 20 package(s) read outside themselves, all declared'; check:engine-double-contract, check:where-matcher, check:query-options-erasure, check:type-check-coverage, check:nul-bytes ('scanned 7135 text file(s)'), check:driver-conformance, check:objectql-double-limit, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:published-files, check:page-declaration-shape, check:changeset-gate-self-tests, check:objectui-changeset, check:pm-half-states, plus check-adr-0087-registration, check-changeset-no-major, check-ci-filter-parity, check-comment-mask-adoption, check-empty-changeset, check-plugin-teardown-shape, release-rehearsal-clone --self-test. Every gate family was re-derived from the ACTUAL diff on the final head via `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` (3 paths, 22 path-matched families plus 6 convention-triggered), not from a list carried in the brief. NOT MEASURED (not red): scripts/pm/check-half-states.mjs exited 3 with 'PREREQUISITE NOT MET — the token in the environment is not a valid GitHub credential'; its own text says nothing was swept, so it is no reading at all. DECLARED NARROWING: the repo-wide `pnpm lint` sweep was not run locally — CI runs the farm exactly once regardless.",
  "ablation": {
    "discipline": "Two ablations, one per channel, each with its prediction committed as an EMPTY COMMIT BEFORE the mutation (79a297735, 64fd23506) so it cannot have been written to fit the result. Each mutation script carried `trap restore EXIT INT TERM` with absolute paths; each leg proved the mutation on disk with anchored greps in BOTH directions before running, and proved the restore with `git hash-object` against the HEAD blob plus an empty `git diff HEAD` plus an empty `git status --porcelain`.",
    "no_dist_involved": "Neither ablation needed a rebuild, and the stack frames prove why rather than asserting it: they name `src/sql-driver.ts` and `../../core/src/logger.ts` — the pin imports the driver relatively (same package, source) and this package's vitest config aliases @objectstack/core to core/src/index.ts, so both sides of the measurement are the source that was mutated. The dependency closure WAS built beforehand (`pnpm --filter '@objectstack/driver-sql^...' build`) because without it the suite fails to resolve @objectstack/types — a NOT MEASURED that looked nothing like a real red.",
    "a_durability_site": "Reverted the syncDeclaredIndexes site to `(this.logger.error ?? this.logger.warn)(`. Mutation proof: good-callee count 7 -> 6, injected-callee count 0 -> 1, hash a6cd04d6 -> afc87fea, and the line above the anchor flipped. Predicted RED on section 2's three cases plus section 3, with sections 0 and 1 staying green. Observed exactly that (4 of 11 failed). Failure message: 'AssertionError: promise rejected \"TypeError: Cannot read properties of unde…\" instead of resolving / Caused by: TypeError: Cannot read properties of undefined (reading 'record') at error src/logger-receiver-detach.test.ts:95:10 at SqlDriver.syncDeclaredIndexes src/sql-driver.ts:11470:45' — and against the real platform logger, 'TypeError: Cannot read properties of undefined (reading 'writeErrorLike') at error ../../core/src/logger.ts:414:14', which is the production failure this card describes, reproduced. Section 3 reported exactly one finding: 'parenthesized-callee @11470'. Restore proof: HEAD blob a6cd04d6 == on-disk hash a6cd04d6, `git diff HEAD` 0 lines, status clean.",
    "b_info_site": "Reverted the reconcileAndWarnDrift site the same way. Mutation proof: receiver-safe spelling count 1 -> 0, injected count 0 -> 1, hash a6cd04d6 -> 7d04d775. Predicted RED in a DIFFERENT SHAPE — that site sits inside the reconcile's own try, so the throw is caught, not propagated, and the symptom is a swallow-and-mislabel rather than a rejection. Observed exactly that (3 of 11 failed, no rejection): the transcript assertion printed '+ \"warn: [schema-drift] dev auto-reconcile failed for 'os12792_info' — falling back to warning\"' and '+ \"warn: [schema-drift] os12792_info: metadata declares index 'idx_os12792_info_code' (code) but the database has no such index — run \\\"os migrate apply\\\" to create it.\"'. BOTH lines are false: the reconcile succeeded (the index was created before the log call) and the throw skipped the post-reconcile re-detect, so the driver reports a successful reconcile as a failure and then tells the operator to migrate an index that already exists. That third harm was NOT in the prediction — it is the loop shape #11722 documents, reached from another direction, and it is reported as an unpredicted observation rather than folded in. Restore proof: hashes match, `git diff HEAD` 0 lines, status clean.",
    "one_guard_fired_honestly": "Ablation B's first run ABORTED at the on-disk proof (exit 4, 'injected text NOT on disk — ablation is a no-op, readings VOID'). That was the guard's own regex being wrong for a single-line injected form, not a failed mutation; the counters were corrected and the leg re-run. Recorded because the alternative — proceeding on an unverified mutation — is the failure the rule exists to prevent."
  },
  "bump_argument": "patch, argued not defaulted. Not major: no export, signature, accepted-input or rejected-input change, and no message text change. Not minor: no new capability and no new surface — logDurabilityFailure already existed as a protected member and no new member was added (the info site was fixed in place precisely to avoid adding a sibling helper). Patch is right because the only behaviour a consumer can observe is repaired delivery: a host whose logger is a plain closure object sees byte-identical behaviour, and that shape is pinned unchanged. The one honest wrinkle, stated in the changeset rather than hidden: a subclass overriding the protected logDurabilityFailure now receives 8 more calls. That method is already this class's declared verb for the durability channel and the fallback semantics at those sites are unchanged (error when the sink has one, else warn), so more calls honouring the override is the documented intent rather than a break.",
  "mcp_calls": "3 — two search_issues (one targeted dedup query, one control query proving the empty result was a reading) and one issue_write to file the finding. Everything else went through repo-scoped REST, which this seat can reach: the card and its 3 comments, the PR creation, the PR body read-back, and the report comment. REST search (/search/issues) is NOT reachable from this seat ('sessions are bound to their configured repositories'), which is why dedup went to MCP.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #12820 (unassigned, labelled `finding`, no domain label): detach-then-call on a logger channel has now been fixed card-by-card three times with no gate watching the class, each round finding the next round's population by hand with a weaker instrument than the last. Carries the measured population (0 live outside the two fixed packages, 2 benign console sites, 25 legitimate options-callback sites, 0 destructured, 0 callback-argument), the note that those 25 options APIs are the class's return path because their `(msg) => void` typing invites `warn: logger.warn` at a caller, and an explicit refusal to propose a gate because the false-positive surface has not been measured. Also records that the durability matcher's parenthesized-callee blind spot is real but currently costs zero findings."
  ]
}

Generated by Claude Code

fix(driver-sql): keep the logger receiver at the nine detach-then-cal…

Navigation Menu

Repository navigation

[finding] driver-sql has 10 inline `(this.logger.error ?? this.logger.warn)(…)` detach-then-call sites — the shape #12773 measured crashing, in a file that already contains the correct spelling #12792

What #12773 established

Measured, on `origin/main` at `ead731756`

⚠️ Why nobody caught this, and it is not negligence

⛔ What is NOT established here — the load-bearing gap

Re-check

Dedup

⛔ Correcting this card's own count: 9 call sites, not 10. I counted a docblock line as code.

⭐ One claim in this card is now MEASURED that was explicitly open

⚠️ A limit both counts share

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] driver-sql has 10 inline (this.logger.error ?? this.logger.warn)(…) detach-then-call sites — the shape #12773 measured crashing, in a file that already contains the correct spelling #12792

Description

What #12773 established

Measured, on origin/main at ead731756

⚠️ Why nobody caught this, and it is not negligence

⛔ What is NOT established here — the load-bearing gap

Re-check

Dedup

Activity

os-litant commented on Aug 27, 2026

⛔ Correcting this card's own count: 9 call sites, not 10. I counted a docblock line as code.

⭐ One claim in this card is now MEASURED that was explicitly open

⚠️ A limit both counts share

huangyiirene commented on Aug 27, 2026

os-zhuang commented on Aug 27, 2026

claude commented on Aug 28, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] driver-sql has 10 inline `(this.logger.error ?? this.logger.warn)(…)` detach-then-call sites — the shape #12773 measured crashing, in a file that already contains the correct spelling #12792

Measured, on `origin/main` at `ead731756`