cd237ae760
## The gate could not see the one place raw SQL is actually written by hand `check-sql-column-literals` walked `packages/` only and took `.tsx?`. Every operator script is a repo-root `.mjs`. I found it by removing a raw-SQL lane literal in #2999 and watching this gate report: ``` [check-sql-column-literals] 22 known SQL column literal(s), none added. ``` Unchanged, and green. Its own header promises the opposite — *"a LOWER count fails too so the baseline is ratcheted down"* — so the silence was the tell. **Two changes, and either alone still sees nothing:** the root and the extension. Adding one without the other scans nothing new and reports a reassuring zero — the same trap #2978 hit when widening the lane-wiring census. ## Newly visible: 6 sites, audited not blind-baselined | site | verdict | | --- | --- | | `audit-branch-cross-contamination.mjs:182` — `"column" IN ('triage','todo','in-progress','in-review')` | **real** — the contamination audit scans only the legacy active lanes, so on a renamed board it scans nothing and reports no contamination. Read-only, and it does print its `scannedColumns`, which is the one thing keeping that from being fully silent. | | `reconcile-leaked-soft-deletes.mjs:53, :73` | already fixed by **#2999** — the PR that exposed this gap | ## Proven able to fail, not just to count A guard that has only ever printed a number is a number. A temporary `.mjs` holding one forbidden comparison: ``` scripts/zz-probe-tmp.mjs: 1 SQL column literal(s), baseline allows 0 ``` and the gate returned to green once removed. ## One claim I withdrew I initially wrote that the `ScriptKind` move to `JS` for `.mjs` was needed because *"TSX treats `<` as JSX and would misparse an ordinary comparison"*. I could not demonstrate it. I tried three JSX-ambiguous shapes — `x <div> y`, `f<b, c>(d)`, and a literal sandwiched between `<` and `>` comparisons — and TSX recovered from all three with counts identical to JS. So `JS` is used because it is the correct kind for the file, **not** because a miss was observed, and the code now says exactly that. The opposite claim would have been easy to make and wrong, and this gate's whole value is that its statements about its own coverage are true. ## Merge order **#2999 removes both literals in `reconcile-leaked-soft-deletes.mjs`.** Landing it *after* this PR drops the count, and this gate fails on DECREASE (by design), needing a re-record. Merge #2999 first, or say the word and I will re-record here. Note the widening is self-protecting afterwards: if someone narrows the walk back to `packages/`, the recorded `scripts/` entries vanish from the scan and the gate goes red on decrease. ## Verification (measured) - gate — green, **28 known / none added** (was 22 across `packages/` only) - its own suite — **32 passed** - `eslint` — clean - `lifecycle-column-census --strict`, `check-lane-wiring`, `check-fnxc-future-dates` — green Gate/tooling only; no product file touched.
18 lines
804 B
JSON
18 lines
804 B
JSON
{
|
|
"packages/core/src/async-mission-store-queries.ts": 1,
|
|
"packages/core/src/async-mission-store.ts": 2,
|
|
"packages/core/src/github-issue-analytics.ts": 1,
|
|
"packages/core/src/gitlab-issue-analytics.ts": 1,
|
|
"packages/core/src/mission-store.ts": 1,
|
|
"packages/core/src/productivity-analytics.ts": 1,
|
|
"packages/core/src/task-store/async-archive-lineage.ts": 3,
|
|
"packages/core/src/task-store/async-maintenance.ts": 1,
|
|
"packages/core/src/task-store/async-merge-coordination.ts": 1,
|
|
"packages/core/src/task-store/reads.ts": 1,
|
|
"packages/core/src/task-store/task-artifacts-ops.ts": 1,
|
|
"packages/core/src/task-store/workflow-definitions.ts": 2,
|
|
"packages/core/src/team-analytics.ts": 3,
|
|
"packages/core/src/workflow-analytics.ts": 3,
|
|
"scripts/audit-branch-cross-contamination.mjs": 4
|
|
}
|