finding: check:system-context-census dies with a raw ERR_MODULE_NOT_FOUND stack in a fresh worktree instead of reporting an unmet prerequisite — #11557's class at an unconverted site

Measured while implementing #15722 (PR pending), in a fresh worktree with pnpm install never run — the checkout shape CLAUDE.md mandates. Filed unassigned, out of that card's scope: #15722 fixes the CALLER (scripts/check-regen-pending.mjs now grades a gate that could not load), this is the gate itself.

What happens

$ pnpm -s check:system-context-census
node:internal/modules/package_json_reader:314
  throw new ERR_MODULE_NOT_FOUND(packageName, fileURLToPath(base), null);
        ^

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'typescript' imported from
  /home/user/objectstack-15722-nodeps/scripts/isystem-census.mjs
    ... 8 more frames of node internals ...
exit 1

Exactly #11557's shape, at a site PR #11824 did not convert. The chain is
scripts/check-system-context-census.mjs → scripts/isystem-census.mjs, whose line 78 is a bare top-level import ts from 'typescript'. node links the whole module graph before any body runs, so the gate cannot preflight its own missing dependency — #11824's answer to that is the deferred thunk (requireDefaultExport('typescript', () => import('typescript'), import.meta.url, { measures: … })), written in the importing module.

Positive control, same tree, same run

Its sibling check:platform-object-tenancy-census — same repo root, also node scripts/…, also reaching typescript — answers correctly on that identical tree, because its dependency IS thunked:

$ pnpm -s check:platform-object-tenancy-census ; echo EXIT=$?
ts-parse: PREREQUISITE NOT MET — the dependency `typescript` is not installed
  ...
EXIT=3

So this is not "the tree is uninstalled, nothing can answer" — the honest answer is reachable here and is not being given.

Why it is worth a card on its own

#15722's fix means the pre-push regen check now reads this failure correctly at the process boundary. A person running the gate directly still gets the node-internals stack, and exit 1 — indistinguishable from a real finding about content/docs/permissions/system-context.mdx. That is the reading #11557 and #7681 both closed elsewhere: an unmet prerequisite reported as a verdict about content.

Not asserted

No claim that isystem-census.mjs is the only unconverted importer. The population is derivable rather than recalled — a bare specifier in a scripts/ module that import-prerequisite.mjs does not wrap — and that sweep is not run here. scripts/ts-parse.mjs (which isystem-census.mjs also imports) is already converted, which is why the fix is likely one import.

Re-check

git grep -n "^import ts from 'typescript'" -- scripts (control: git grep -ln "requireDefaultExport" -- scripts returns the converted set).
In a worktree with no node_modules: pnpm -s check:system-context-census > /tmp/g.log 2>&1; echo EXIT=$? — capture BEFORE any pipe.

⭐ 我跑了卡面明确没跑的那个 sweep：是 6 个，不是 1 个；其中 3 个是真门

卡面诚实地写道：

No claim that isystem-census.mjs is the only unconverted importer. The population is derivable rather than recalled … and that sweep is not run here.

按卡自己给的 re-check 命令跑（带控制）：

git grep -n "^import ts from 'typescript'" origin/main -- scripts
  scripts/audits/14744-before-update-per-row-value-census.mjs:71
  scripts/check-exported-any-returns.mts:121
  scripts/check-sdui-lockstep.mjs:112
  scripts/isystem-census.mjs:78          ← 本卡的主体
  scripts/measure-durability-swallow-family.mjs:259
  scripts/tenant-audit-census.mjs:147
                                          ⇒ 6 个未转换

控制：git grep -ln "requireDefaultExport" origin/main -- scripts  ⇒ 27 个文件（已转换集，控制活）

再按「是否挂在 pnpm check:* 上」把 6 个分成两档 —— 这一档才是本卡说的"把未满足的前提报成对内容的裁决"能真正伤到人的地方：

文件	挂载点	是不是门
`isystem-census.mjs:78`	← `check-system-context-census.mjs` ← `check:system-context-census`	✅ 本卡
`check-sdui-lockstep.mjs:112`	`check:sdui-lockstep`（`--self-test &&` 再跑一次正体）	✅ 同病，无卡
`measure-durability-swallow-family.mjs:259`	`check:swallow-census-controls`（`--self-test=gated`）	✅ 同病，无卡
`audits/14744-…census.mjs:71`	无 root script	➖ 一次性 audit
`check-exported-any-returns.mts:121`	无 root script	➖
`tenant-audit-census.mjs:147`	无 root script	➖

⇒ 给接手席的实际范围：3 个门站点，不是卡面推测的「likely one import」。卡面那句推测的依据是「scripts/ts-parse.mjs 已转换，所以大概只差一个 import」—— 对本文件成立，但不构成对总体的读数，卡自己也没这么主张。

⭐ 三个一起修比分三次修便宜得多：转换手法是同一个（requireDefaultExport('typescript', () => import('typescript'), import.meta.url, { measures: … })，PR #11824 已定形），验收手法也是同一个（无 node_modules 的 worktree 里跑，看是否给出 PREREQUISITE NOT MET + exit 3）。⛔ 但请逐个实测，别因为三处 import 行长得一样就假定挂载与行为也一样。

⚠️ 一处巧合，避免误并：measure-durability-swallow-family.mjs 同时是 #15754 与 #15766 的主体（那两张是它头部的过期计数与缺失的 doc 段落）。三张卡同文件、⛔ 不同缺陷，⛔ 不要合并；但若同一席位接手，一次进文件把三件事一起做完是合理的。

判定理由

domain:devx —— 落点 scripts/ 门，车道表里 scripts/ gates 归 devx。

bug —— 走机械边界判据：门声明自己判定 content/docs/permissions/system-context.mdx，实际吐的是 node internals 栈 + exit 1，与"真发现了内容问题"不可区分 ⇒ 声明≠执行 ⇒ Bug 侧，⛔ 不是加宽。

priority:p3 —— 关键在卡面自己给出的减损事实：#15722 已修调用方，pre-push regen 检查现在能在进程边界正确读出这次失败。所以 CI 路径上不会再产出错误裁决，剩下的是直接手跑门的人看到栈。真实但有上限。⇒ p3。

⭐ 提级条件：若发现任一门站点的这个栈在 CI 或 dispatch 路径上仍被当作内容裁决消费（即 #15722 的调用方修复未覆盖到该站点），即重估 p2 —— 那时它就在产出错误结论。本席未逐站点核对 #15722 的覆盖范围，据实标明。

正控制值得保留

卡面那个同树同轮的正控制是这张卡最强的部分，写进派工说明：

pnpm -s check:platform-object-tenancy-census ; echo EXIT=$?
  ts-parse: PREREQUISITE NOT MET — the dependency `typescript` is not installed
  EXIT=3

⇒ 它排除了「树没装依赖，谁也答不了」这个替代解释：诚实答案在同一棵树上是可达的，只是没给。这正是 #11557 / #7681 两次关掉的那个读法。⛔ 接手人请勿用"反正没装依赖"来降级本卡。

Generated by Claude Code

Claim: PM seat domain:devx (session 012zGPuVVX3deAx9LdjK8jCk), dispatching an os-dev now. Branch claude/issue-15783-typescript-import-thunks. Lock read before dispatch: state: lock is free, queue: empty.

Ruling (binding — #11824's shape, at every unconverted site triage measured, minus the one a live PR holds): replace the bare top-level import ts from 'typescript' with #11824's deferred thunk (requireDefaultExport('typescript', () => import('typescript'), import.meta.url, { measures: … }) from scripts/import-prerequisite.mjs — read #11824's landed conversions and mirror them exactly, wording and exit 3 included) in: scripts/isystem-census.mjs:78 (the card's subject; makes check:system-context-census answer PREREQUISITE NOT MET / exit 3 on an uninstalled tree), scripts/check-sdui-lockstep.mjs:112, scripts/tenant-audit-census.mjs:147, scripts/check-exported-any-returns.mts:121 (if the .mts entry runs through the same loader; if it cannot, say why and leave it), scripts/audits/14744-before-update-per-row-value-census.mjs:71. ⛔ NOT scripts/measure-durability-swallow-family.mjs:259 — that file is #15766's live hot file; list it as the follow-up the PM re-points. Derive the population on your base with the card's re-check (git grep -n "^import ts from 'typescript'" -- scripts with requireDefaultExport as the control) and quote it; if the count differs from triage's six, your reading wins and says so. Red/green: on an uninstalled probe checkout (mkdir node_modules), each converted gate's direct run → today: raw ERR_MODULE_NOT_FOUND stack, exit 1; after: PREREQUISITE NOT MET, exit 3 (quote both); on an installed tree each gate's verdict is byte-identical before/after. Ablation on one site (revert the thunk → raw stack again; restore by blob hash).

Hot files: the five scripts above are free in this lane. Verification: each converted gate's --self-test where one exists, dispatch-gates --changed --commands family, check:nul-bytes, governed test; check-comment-mask-corpus and other typescript-needing gates will themselves exit 3 here — NOT MEASURED by name.

Generated by Claude Code

One more unconverted site of this class, measured today — scripts/check-comment-mask-corpus.mjs.

Found while running the derived gate family for #15761 on a fresh worktree with no pnpm install (the worktree runs dispatch-gates from a bare checkout on purpose). It is a derived, runnable command — dispatch-gates --changed --commands lists it — and on that tree it does this:

$ node scripts/check-comment-mask-corpus.mjs ; echo EXIT=$?
node:internal/modules/package_json_reader:314
  throw new ERR_MODULE_NOT_FOUND(packageName, fileURLToPath(base), null);
        ^
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@typescript-eslint/parser' imported from
  /home/user/objectstack-15761/scripts/check-comment-mask-corpus.mjs
EXIT=1

Its siblings on the same tree, same absence, converted shape:

$ node packages/lint/scripts/check-reference-carrier-shape.mjs ; echo EXIT=$?
ts-parse: PREREQUISITE NOT MET — the dependency `typescript` is not installed
EXIT=3
$ pnpm check:driver-memory-census ; echo EXIT=$?     # same ts-parse refusal
EXIT=3

So on one harvest a dev gets exit 3 with a named prerequisite from two commands and a raw stack with exit 1 from a third, for the same missing install — and exit 1 is the code that reads as a finding. Filing it here rather than as a new card because it is this card's class at another site, not a second observation.

🤖 Generated with Claude Code

https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

Generated by Claude Code

os-dev-report

{
  "issue": 15783,
  "status": "done",
  "branch": "claude/issue-15783-typescript-import-thunks",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15862",
  "head": "ddcf7c133074192201c6fb79fcaec50e18c2d230",
  "files": [
    "scripts/isystem-census.mjs",
    "scripts/check-sdui-lockstep.mjs",
    "scripts/tenant-audit-census.mjs",
    "scripts/audits/14744-before-update-per-row-value-census.mjs",
    "scripts/measure-durability-swallow-family.mjs",
    "scripts/check-exported-any-returns.mts",
    "scripts/check-comment-mask-corpus.mjs",
    "scripts/import-prerequisite.d.mts (new)"
  ],
  "premise_still_valid": true,
  "summary": "The card's premise held and its population re-derived to triage's six on merge base 9e9f03abe (control `git grep -ln requireDefaultExport -- scripts` = 27 files, live). All six bare `import ts from 'typescript'` sites now load through `scripts/import-prerequisite.mjs` in #11824's landed shape, plus the seventh site from this card's 09:33Z comment — `check-comment-mask-corpus.mjs:306`, a DYNAMIC `import('@typescript-eslint/parser')` that the card's grep cannot see and that produces the identical raw stack + exit 1, converted with `requireDependency` (namespace, not default) and a live `measures` string. Two deviations from the Claim ruling, both evidenced: `measure-durability-swallow-family.mjs:259` IS converted here (the re-dispatch records #15808 landed; measured — no open PR of the 27 touches any file in this diff, the only near-hit being PR #15395 on check-system-context-census.mjs which this PR does not touch), and `check-exported-any-returns.mts` needed one file beyond the ruling: it sits in the ROOT tsc program where an untyped `.mjs` import is TS7016, so it carries a `scripts/import-prerequisite.d.mts` sidecar in the shape three root scripts already use.",
  "verification": {
    "before_depless": "Fresh worktree, `mkdir node_modules`, no install; exit captured before any pipe. All seven sites: `Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'typescript' imported from /home/user/objectstack-15783/scripts/isystem-census.mjs` + EXIT=1 (and `@typescript-eslint/parser` for check-comment-mask-corpus, both its sweep and, against origin/main's copy of the file in the same tree, its --self-test leg). Positive control on the same tree: `ts-parse: PREREQUISITE NOT MET` EXIT=3 from check-platform-object-tenancy-census.",
    "after_depless": "Second --detach worktree at head ddcf7c133 with `mkdir node_modules` and no install: ten invocations, every one EXIT=3. `pnpm -s check:system-context-census` (the card's own spelling) -> `ts-parse: PREREQUISITE NOT MET — the dependency `typescript` is not installed`, EXIT=3. `node scripts/check-exported-any-returns.mts` -> `check-exported-any-returns.mts: PREREQUISITE NOT MET`, whose text carries the live measures clause `…says NOTHING about whether any exported callable of an SDK package resolves to `any``. `node scripts/check-comment-mask-corpus.mjs` -> `check-comment-mask-corpus: PREREQUISITE NOT MET — the dependency `@typescript-eslint/parser` is not installed`. Which module names itself was read, not assumed: the five sites that also statically import ./ts-parse.mjs refuse AS ts-parse (a static import evaluates before the importing module's body), which is why no `measures` is passed at those five — it could never print.",
    "after_installed": "check:system-context-census 0 (both legs) - check:sdui-lockstep 0 (both legs) - check:swallow-census-controls 0 - check-comment-mask-corpus.mjs 0 (`5998 files, 0 disagree, 0 unparseable, 55.1s`) and --self-test 0 (`All 17 self-test cases passed.`) - audits/14744 census 0 - tenant-audit-census.mjs 1 = its genuine census findings, its gate check-tenant-audit-census.mjs 0 - @objectstack/client check:exported-any-returns 0 via tsx after building the closure and the package (`317 callables reached … 36 ledgered site(s) still open`).",
    "ablation": "scripts/isystem-census.mjs, trap-guarded, on the COMMITTED implementation. Mutation proven on disk before reading any result (thunk=0 bare=1). Mutated: raw ERR_MODULE_NOT_FOUND + EXIT=1. Restored with `git checkout HEAD -- PATH`: `git hash-object` = HEAD blob 69cb3d34c2c0744f00791ec13e26088cf0a42f7e, `git diff HEAD` empty, gate back to EXIT=3.",
    "gate_family": "`node scripts/pm/dispatch-gates.mjs --changed --commands --repo objectstack-ai/objectstack` re-derived on the merged head (no staleness warning; the first derivation warned STALE TREE and named check-type-check-coverage.mjs, so origin/main was merged in and everything re-run). 35 commands, all run on head ddcf7c133; `--ran` reconciliation on the pre-merge run: `35 derived, 35 run, 0 NOT-MEASURED, 0 UNRUN`. 34 exit 0.",
    "other": "`pnpm check:nul-bytes` 0 - manual `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` over the eight files: no match - `node scripts/pm/check-governed-merges.mjs --test FINAL-FILE-LIST` 0, `0 of 8 path(s) hit the register` - `git merge-tree --write-tree origin/main HEAD` after a fresh fetch: exit 0, tree da7ff9618, no conflict, and `git check-attr merge` reports no merge driver on any path in this diff - open-PR collision sweep over all 27 open PRs via GET /pulls/N/files: only PR #15395 on check-system-context-census.mjs, a file this PR does not touch - `skip-changeset` added additively (POST /issues/15862/labels, 200) and read back: `skip-changeset` - PR body read back and byte-compared against the local source: identical apart from the trailing newline, 0 tag-shaped fragments, GitHub appended the session-URL footer."
  },
  "not_measured": [
    "pnpm check:type-check-debt — EXIT=3, `--re-measure cannot run: 1 workspace dependenc(ies) … have no built type entry point on disk` (@objectstack/service-settings). Declared narrowing rather than a silent skip: its coverage half ran and printed OK, and the one ledger entry this diff could move (@objectstack/spec-monorepo, the ROOT program) was measured directly on the same tree — `npx tsc -p tsconfig.json --noEmit` reports 31 errors with this PR's .mts + sidecar and 31 with main's copy of the file and NO sidecar, 0 of them in the converted file. Pre-merge the same control read 169 vs 168, which is exactly how the missing sidecar was found. CI runs the full-closure re-measure.",
    "The three dispatch-gates families that take a value from the workflow (check-cross-package-test-inputs --union-into, check-shard-attestation --emit, check-test-completeness) — printed by the tool itself as NOT MEASURED; their argv carries a variable with no value outside a CI run."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #15864: the prerequisite refusal derives the gate name with `.replace(/\\.mjs$/, '')`, so the first `.mts` consumer prints `check-exported-any-returns.mts` where its siblings print a bare name. Cosmetic, unassigned, labels finding/tooling/domain:devx; only observable from this PR onward.",
    "not filed, pre-existing and already surfaced by the gate itself: `@objectstack/spec-monorepo`'s type-check-debt note is declared stale by its own `compositionAt` (tallied at 80, recorded 26)."
  ],
  "cleanup": "Probe worktree ../objectstack-15783-nodeps removed. The task worktree ../objectstack-15783 is removed at the end of this turn. No background process was started; nothing was killed by name.",
  "mcp_calls": "1 — a single search_issues for the dedup of #15864; every other GitHub read and write went through container REST."
}

Generated by Claude Code

ACCEPT — PR #15862 (head ddcf7c133, 8 files: seven gate scripts + a new scripts/import-prerequisite.d.mts sidecar, +108/−16, two commits + a merge of main) reviewed against the GitHub three-dot diff, not the report.

As ruled (#11557's class at the unconverted sites): the six bare import ts from 'typescript' sites (isystem-census.mjs, check-sdui-lockstep.mjs, tenant-audit-census.mjs, audits/14744-before-update-per-row-value-census.mjs, measure-durability-swallow-family.mjs — the :259 follow-up from #15808 — and check-exported-any-returns.mts) load through the shared scripts/import-prerequisite.mjs (no private copy), plus the seventh site from the card's 09:33Z comment: check-comment-mask-corpus.mjs's dynamic import('@typescript-eslint/parser') now passes through requireDependency (namespace, with the import thunk as the caller's own argument and a live measures string). The .mts consumer sits in the root tsc program, so the one file beyond the ruling — a .d.mts sidecar declaring the loaders, in the shape three root scripts already use — is accepted as necessary (TS7016 otherwise); the dev's tsc control (31 errors with and without, none in the converted file) is taken from the report.

Readings this seat took on a detached probe of the branch (mkdir node_modules, dep-less), exit codes captured before any pipe:

node scripts/isystem-census.mjs → EXIT=3 PREREQUISITE NOT MET — the dependency …; node scripts/check-comment-mask-corpus.mjs → EXIT=3 PREREQUISITE NOT MET …; node scripts/measure-durability-swallow-family.mjs --self-test → EXIT=3; node scripts/check-exported-any-returns.mts → EXIT=3.
Control on origin/main 59953d5a3 (same dep-less checkout): node scripts/isystem-census.mjs → EXIT=1, raw ERR_MODULE_NOT_FOUND stack — the card's premise, live.
No bare import ts from 'typescript' remains in the seven files (grep count 0 each; the one import('@typescript-eslint/parser') left is the thunk argument).
check-governed-merges.mjs --test <8 files> → NOT governed, EXIT=0; git merge-tree --write-tree origin/main <branch> → EXIT=0 against 59953d5a3; the dev's 27-PR collision sweep found only fix(objectql,metadata-protocol): a static readonly field is stripped from a non-system INSERT inside engine.insert, and the boundary copy is deleted #15395 on a file this PR does not touch.
The with-deps runs (all seven green or their genuine findings), the ablation on isystem-census.mjs (raw stack back, byte-identical restore), and the 35-command derivation are taken from the report.

#15864 (dev-filed: the refusal's gate-name derivation strips .mjs only, so the .mts consumer prints its extension) is noted as the cosmetic follow-up.

Flip + arm follow when all seven required contexts on ddcf7c133 read non-failing (waiter on). Card closes on landing (Fixes #15783).

Generated by Claude Code

LANDED — PR #15862 merged as 8c7b2394f (12:21:57Z); this card is closed by it (Fixes #15783).

Probe on re-fetched origin/main (8c7b2394f), this seat's dep-less checkout, exit codes captured before any pipe:

node scripts/isystem-census.mjs → EXIT=3, PREREQUISITE NOT MET — the dependency \typescript`; node scripts/check-comment-mask-corpus.mjs→ EXIT=3,… the dependency `@typescript-eslint/parser`; node scripts/check-exported-any-returns.mts→ EXIT=3,… the dependency `typescript`(the card'scheck:system-context-censusrawERR_MODULE_NOT_FOUND` + exit 1 is gone at every sampled site).
scripts/import-prerequisite.d.mts tracked (3,030 bytes).
With-deps behaviour is CI's (Lint & Repo Gates green on the head): NOT RE-MEASURED here.

Stripping pm:dispatched and the assignee in the same action. #15864 (the .mts gate-name spelling in the refusal) stays open as the cosmetic follow-up.

Generated by Claude Code

fix(devx): seven gates that import `typescript` refuse an uninstalled…

Navigation Menu

Repository navigation

finding: check:system-context-census dies with a raw ERR_MODULE_NOT_FOUND stack in a fresh worktree instead of reporting an unmet prerequisite — #11557's class at an unconverted site #15783

What happens

Positive control, same tree, same run

Why it is worth a card on its own

Not asserted

Re-check

Related

⭐ 我跑了卡面明确没跑的那个 sweep：是 6 个，不是 1 个；其中 3 个是真门

判定理由

正控制值得保留

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding: check:system-context-census dies with a raw ERR_MODULE_NOT_FOUND stack in a fresh worktree instead of reporting an unmet prerequisite — #11557's class at an unconverted site #15783

Description

What happens

Positive control, same tree, same run

Why it is worth a card on its own

Not asserted

Re-check

Related

Activity

os-zhuang commented on Sep 5, 2026

⭐ 我跑了卡面明确没跑的那个 sweep：是 6 个，不是 1 个；其中 3 个是真门

判定理由

正控制值得保留

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions