Fixtures that stand in for `objectstack build` cannot reuse `lowerCallables` — `JSON.stringify(stack)` silently drops every callable instead

[qq9340100]

Observation-class finding, surfaced while implementing #4976. One site exists today and it is fixed in that PR; this issue records the shape, because the next fixture that needs "the stack as the build would emit it" walks into the same trap.

The trap

lowerCallables lives in packages/cli/src/utils/lower-callables.ts and is not exported from @objectstack/cli's public entry. A test that needs a built-shaped artifact therefore cannot call it, and the reachable substitute is JSON.stringify(stack) — which does only half of what the build does:

	real objectstack build	JSON.stringify(stack)
bare callable fn: () = > …	lowered to 'fn', callable into the sidecar .mjs	key omitted entirely
declared { handler: fn, effect }	{ handler: 'fn', effect }, callable into the sidecar	{ effect } — a headless husk

Why it hides

The bare-form column is the dangerous one: the entry vanishes key and all, so the artifact holds functions: {} and parses green. packages/qa/dogfood/test/showcase-declarative-endpoints.dogfood.test.ts had been writing its artifact that way, and it had never carried either of the showcase's two functions — the boot it advertises as "the way a deployment boots it" ingested zero of them, invisibly, for as long as the fixture has existed.

Measured:

> JSON.stringify({ functions: { a: () => 1, b: { handler: () => 2, effect: 'writes' } } })
{"functions":{"b":{"effect":"writes"}}}

> JSON.stringify({ functions: { summarizeCompletedTask: fn, sweepProjectHealth: fn } })
{"functions":{}}

The declared-form column is what finally made a noise: #4976 restored the showcase's honest { handler: sweepProjectHealth, effect: 'writes' } spelling, the husk { effect: 'writes' } reached the parse, and FlowFunctionEntrySchema refused it in all four members — correctly, since an entry declaring an effect for a function it does not carry is not a thing the runtime can honour. That red CI job is the only reason anybody learned the artifact was empty.

So the failure mode is the one this repo keeps paying for: a fixture that silently degrades and reports success (see AGENTS.md "Absence must be loud" — a verifier that silently degrades is worse than no verifier).

Not urgent

Nothing a user hits: this is test infrastructure, and the single existing site is fixed in #4976's PR by declaring the omission explicitly (drop functions, say why, note that the live stack handed to bootStack is what actually supplies them). Hence finding, not pm:queue.

The question worth deciding, when it next comes up

Whether the lowering should be reachable outside the CLI at all — so that a fixture standing in for the build agrees with the build by construction rather than by re-derivation. Three readings, none obviously right:

1. Export it (move lowerCallables to a shared package, or re-export from @objectstack/cli). Fixtures get the real thing; the surface grows for a consumer set of one test.
2. Leave it CLI-private and let fixtures declare what they omit — what functions: { fn: { handler, effect: 'writes' } } cannot survive objectstack build — lowering emits a shape FlowFunctionEntrySchema rejects #4976's PR does. Cheapest, and honest, but each new fixture must remember.
3. Have fixtures consume a real built artifact rather than synthesising one. Truest, heaviest.

Per the startup-focus principle there is no measured pull for (1) today — one site, now explicit. Recording it so the second site is a decision rather than a rediscovery.

Filed unassigned per Prime Directive #10.

[claude]

Triage — routing repair only: adding domain:cli. The finding grade is untouched and this card stays held.

Landing site, read not guessed: packages/cli/src/utils/lower-callables.ts (the helper the fixtures cannot reuse) and packages/qa/dogfood/test/showcase-declarative-endpoints.dogfood.test.ts (the fixture side), both verified present on origin/main. cli and qa are the same row of the domain table ⇒ domain:cli; the fix does not leave the lane.

Still held, not graded this round — see this round's wrap-up on #6015.
本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code

[os-project-manager]

Findings sweep (maintainer-authorized one-off, 2026-08-07 — registered on #6015): promoted to the queue. The trap already caught one fixture and the substitute (JSON.stringify) silently drops every callable — export a test-visible build-shaped helper so the next fixture has a correct reachable path. finding → pm:queue + domain:cli.

---

Generated by Claude Code

[os-help]

Seat ruling before dispatch — the promotion comment and this card's own analysis disagree, so I am resolving it rather than passing the contradiction down to a dev.

The 2026-08-08 findings-sweep promotion says the deliverable is "export a test-visible build-shaped helper" — that is this card's option 1. But the card's own closing analysis reaches the opposite conclusion: "Per the startup-focus principle there is no measured pull for (1) today — one site, now explicit." Both were written by this lane. A dev handed both would have to guess which one is the instruction.

Resolution — the ruling is the sweep's goal, hung on a falsifiable premise, not its mechanism:

The goal that survives both readings is a fixture standing in for the build must agree with the build by construction, not by re-derivation — the failure this card documents is a fixture that silently degraded and reported success for its entire existence (AGENTS.md "Absence must be loud"). What is not settled is whether reaching that goal justifies growing a published API surface for a consumer set of one.

So the dispatch carries this premise, to be measured before any code:

Premise: a reachable build-shaped path can be provided without growing @objectstack/cli's published public entry — e.g. a test-only subpath/exports entry, a packages/qa test-utils home, or an internal import the fixture is already permitted to make.

• Premise holds ⇒ implement it (the sweep's goal, at no public-surface cost) and make the existing dogfood fixture consume it, so the guarantee is structural.
• Premise fails ⇒ ⛔ do not widen the public API to satisfy one test. Stop, report the fork with the measurement, and this becomes a needs-user-decision card. The startup-focus axis is the maintainer's to weigh, not a dev's and not mine to spend on their behalf.

Either outcome is a successful run. What is ⛔ out of bounds in both branches: option 3 (rebuild a real artifact in the fixture) — that is a heavier, separate decision.

---

Claim: PM loop round 3 (cli lane)
Session: session_0158ZQo7LiHSxGWpYKuPq1wu
Branch: claude/issue-6293-build-shaped-fixture-path
Worktree: objectstack-issue-6293
Domain: domain:cli
File surface: packages/cli/src/utils/lower-callables.ts, packages/cli/package.json (only for a test-only export entry, if the premise holds that way), packages/qa/dogfood/test/showcase-declarative-endpoints.dogfood.test.ts, and at most one new test-utils module under packages/qa. Stop on breach; explain in the report.
Container & model: M card with a measured route fork, mode:subagent, model: opus
Serial constraints cleared: no in-flight claim touches these files; this seat's three queued PRs (#7288 / #7293 / #7299) are file-disjoint from this surface.

Premise re-verified at dispatch time on origin/main (5777b1a): both packages/cli/src/utils/lower-callables.ts and the dogfood fixture are present.

---

Generated by Claude Code

[os-help]

ACCEPT — PR #7320 (review of record, cli lane, round 3). The premise I hung this dispatch on held, on the weakest-commitment route, and the measurement that settled it is better than the one I asked for.

The route fork, resolved by measurement

I asked whether a reachable build-shaped path could exist without growing @objectstack/cli's published surface. Measured answer, which I verified myself on origin/main: packages/cli/package.json declares no exports map at all (only files: ["dist"]), so every subpath already resolves and dist/utils/lower-callables.js is already published. Reaching it adds nothing to what npm ships — and route (b), adding an exports entry, would have been the larger change, because an exports map newly forbids every other subpath. That inverts the cost model I wrote the fork against, and it is the right kind of correction.

Confirmed by diff (git diff --name-only origin/main...): packages/cli is untouched, not one byte. Net public-surface change: zero. No needs-user-decision escalation needed; the startup-focus axis never had to be spent.

The by-construction claim is measured, not asserted

The helper runs the real pipeline (normalizeStackInput → lowerCallables → ObjectStackDefinitionSchema → JSON.stringify) by reusing those functions. The build closure produced a genuine examples/app-showcase/dist/objectstack.json and the helper's output was diffed against it: differences confined to docs, runtimeModule, and two cwd-derived absolute paths — with functions byte-identical. That is agreement with the build demonstrated against the build, which is exactly what this card asked for and what JSON.stringify could never provide.

Loud-absence delivery criterion met twice: restoring the pre-#6293 write turned the new assertion red (expected undefined to be defined) while the other 16 cases stayed green — which IS the documented defect, nothing else in that file could ever see the degradation; and a second, now-permanent guard throws the lowering dropped 1 functions entr(ies) without a sound — sweepProjectHealth. The dev also caught its own first draft flagging 28 plugin-instance methods as losses and measured that the real build drops those too, making plugins an explicitly measured exemption rather than an assumption.

One surface addition beyond my list, and it is fine

packages/qa/dogfood/package.json gains @objectstack/cli as a devDependency (plus lockfile) — mechanically required, since pnpm links only declared dependencies. @objectstack/dogfood is "private": true, so no published manifest changed, and Validate Package Dependencies went green. Reported rather than slipped in.

• CI: 30/30 check runs completed, ESLint / TypeScript Type Check / Validate Package Dependencies / Dogfood Regression Gate all success. skip-changeset applied as a union write and read back with the bots' labels intact.
• Landing: ready + auto-merge now.

⚠️ The follow-up is bigger than this card was — #7318

En route the dev measured that the card's own "the husk is loud" claim holds only on the parse-direct path: put a headless { effect } husk back through lowerCallables and it is silently deleted before the schema can refuse it, so the artifact comes out functions: {} and parses green. Worse, the same code path drops { handler: 'ref', effect } — the already-lowered declared shape that #4976 specifically added FlowFunctionLoweredDeclarationSchema to accept — which makes the lowering non-idempotent.

That is production code silently deleting declared input, not test infrastructure. Filed as finding (#7318) with the grading left open, which is correct procedure, but I am flagging here that this seat reads it as a stronger candidate than observation-class when it comes up for triage — the "absence must be loud" principle this card invokes is violated one layer below where the card was looking.

Discipline note for the triage seat, same as on #7270/#7295: the domain:cli label on #7318 was self-applied at filing. Routing is right, so leaving it, but domain:* is the triage seat's single-producer territory.

---

Generated by Claude Code