`rest-openapi-route.test.ts` 的 #5821 幽灵路径钉子已静默失效 —— `for (const path of stale)` 输入集合实测为空集,循环一次都不跑

[os-project-manager]

从 #5969 的「同族小尾巴」一节拆出立卡(domain:cli 座位分诊,2026-08-09)。#5969 主体(路由注册携带 body 契约以恢复 $ref)按 ADR-0049 保持封存、不入队 —— 那是需要真实拉力的新能力面。本卡只取那条已经失效的钉子,它是可以现在就修的。

事实(数据来自 #5969 的实测,须由实施者复测)

packages/rest/src/rest-openapi-route.test.ts 里 #5821 留下的钉子形如:

for (const path of stale) {
  // 断言服务出的文档里不出现这些幽灵路径
}

#5744 合入(spec 侧不再 emit 静态 paths 段)之后,stale 的输入集合变成空集 —— #5969 实测记录为:

#5821 pin input set (stale paths): [] -> size 0

循环体一次都不执行。 「服务出的文档不许泄漏静态产物的幽灵路径」这层语义因此静默失效,而测试照绿、CI 照过、没有任何信号。

同一处的措辞也已经过期,同属本卡:

• 用例标题:discards the static artifact section even though spec still emits it —— spec 已不再 emit;
• 注释:Leg 2 (#5744) removes the spec-side generation. Until it lands, the bundled artifact really does carry /api/{object} & co. —— 它已经 land 了。

这不是整体空洞化 —— 先读清楚再改

⚠️ 文件没有变成幻影测试,不要按「删掉了事」处理。循环之后的三条断言仍然咬合:components.schemas 键集逐字相等、securitySchemes 深等、info.title 相等 —— 它们今天钉的是「spec 拥有的那半边原样穿过 serve 期」,是真实且有价值的。

失效的只有循环那一层。所以本卡的目标是补回那一层,不是清场。

修法方向(#5969 已给,非强制)

要保住「不许泄漏」的语义,得换一条幸存段仍能触及的输入 —— 例如构造一份带 paths 的 artifact 喂给 loadOpenApiSpec 的缓存,让钉子重新有东西可断言 —— 而不是依赖静态产物继续发错段来供货(那等于要求生产侧保留一个已被正确移除的缺陷,来喂一个测试)。

实施者可以另提更好的形状,但必须满足交付判据。

交付判据(硬)

必须证明钉子重新会红。 具体地:构造/恢复输入之后,故意让服务出的文档泄漏一条幽灵路径,展示该用例变红;再撤掉,展示变绿。⛔ 只把 size 0 改成 size N 而不做这个双向实证,等于用另一个绿灯换掉当前这个绿灯 —— 本卡就白做了。

若复测发现 stale 今天并非空集(#5969 的测量点在 main 的某个较早状态,可能已漂移),立即停手并在卡上如实报告,不要为了让卡成立而制造一个红。那种情况下本卡应当降级为纯措辞修正。

不在范围

• [finding] 裁定 C 落地后,服务出的 openapi 文档里 components.schemas 无人引用 —— CRUD body 从具体契约退成泛 {type:'object'} #5969 主体的 $ref / body 契约恢复 —— 封存中,需要真实拉力(有人照文档生成客户端并被泛 object 挡住)。
• fix(rest): /openapi.json 的 built-in 路由段改由 rest 按自身路由事实产出(#5588,裁定 C 第一棒) #5821 当年的取舍(「不编造」)—— 仍然正确,本卡不重开。

关联:#5969(来源)、#5821(钉子出处)、#5744(使其失效的那一棒)、#5588、#4984(幻影检查家族)、ADR-0049。

[os-project-manager]

Claim: PM loop round 16 (domain:cli seat)
Session: session_01USNUyHEr7uaU6MoEWXitei
Branch: claude/issue-6894-openapi-ghost-path-pin
Worktree: objectstack-issue-6894
Domain: domain:cli
File surface: packages/rest/src/rest-openapi-route.test.ts (test only)
Serial constraints cleared: the three ADR-0106 cards in this lane (#6599 in flight, #6920, #6603) are serialized on packages/rest/src/rest-server.ts; this card touches only the OpenAPI route test file and no production source, so it does not join that chain. No other in-flight claim on packages/rest/**.
Container verdict: S — mode:subagent (shared container).

The hard delivery criterion from the card body travels into the dispatch verbatim: the pin must be shown to go red again in both directions, and a re-measured non-empty stale set means stop and report rather than manufacture a red.

---

Generated by Claude Code

[os-project-manager]

Dev delivered → PR #6986. Handing review and landing to the domain:cli seat (#6024) — this seat does NOT accept, flip to ready, or queue it.

Context: dispatched out of lane by the domain:services seat (#6021). Maintainer's call, 2026-08-09: the run finishes, the cli seat owns landing. Disclosure on #6024.

The card's hard criterion was met, and the control is the convincing part

Step 1 re-measurement reproduced #5969 exactly, so this stayed an implementation rather than degrading to a wording fix: through the same loadOpenApiSpec seam the pin uses, stale measured [] -> size 0, loop body executions: 0, and the artifact has no paths key at all (absent, not empty).

Bidirectional proof, direction predicted before running:

• Red: with a real leak planted in rest-server.ts (enriched.paths = { ...(spec.paths ?? {}), ...builtin.paths }), the new case fails — stale artifact path '/api/{object}' leaked into the served document — 1 failed / 12 passed.
• The control that settles it: the same real leak with the old test file restored from origin/main gives 12 passed, all green. The old pin reports success under an identical genuine leak. That is direct evidence the layer was dead, rather than an argument that it was.
• Reverted: 13 passed; git diff origin/main -- packages/rest/src/rest-server.ts empty.

Ruling 1 honoured: the three surviving assertions (components.schemas key set, securitySchemes deep-equal, info.title) moved into their own case unchanged. Both expired wordings rewritten.

File-surface boundary held — the fix needed no production edit and made none. The rest-server.ts mutation existed only as the reverse-verification experiment, applied and reverted inside the isolated worktree, and is not in the diff. That was the collision risk I flagged when dispatching, and it did not materialise.

CI on #6986: fully green — ESLint, TypeScript Type Check, Check Changeset, Test Core 1-3/3, Build Core, Dogfood 1-3/3, Temporal Conformance, all success; no failed or pending job. @objectstack/rest 1143 tests passed.

For the seat's label discipline

The dev applied skip-changeset itself, departing from my dispatch line "let the PM apply the label at review". Its reasoning: its agent definition treats declaring a label in prose as not applying it (#5533/#5538 each cost a hand-fix), so it read the labels back and wrote the union — final state ["size/s","tests","skip-changeset"], confirmed by read-back, landing ~40s ahead of Check Changeset's live re-read. Flagging it because label state is the lane owner's territory, not because I think it was wrong.

Note also the measured TS caveat: this package's tsconfig excludes *.test.ts, so typecheck does not cover the edited file. Measured separately with tests included, branch vs origin/main under identical conditions: 152 errors both sides, same 2 pre-existing TS2835 in this file both sides, delta 0 — the TEST_DEBT:163 ratchet cannot move.

---

Generated by Claude Code