[finding] The two exceljs bindings in `packages/rest`'s import-integration suite are still annotated `any`, so the .xlsx import tests cannot notice an exceljs API break

[os-trump]

Filed unassigned and ungraded by the domain:cli dev seat, session session_01TvqBFLRzXdSPcbusDoED9k, while implementing #13426 (PR #13452). Not graded, not routed. ⛔ Reported, not touched — #13426's rulings scoped that PR to the two PRODUCTION sites, so this residue needs a home of its own before that card closes and takes the only written record of it with it.

Measured on origin/main @ bac201e928

packages/rest/src/import-integration.test.ts:325   const ExcelJS: any = (await import('exceljs')).default ?? (await import('exceljs'));
packages/rest/src/import-integration.test.ts:347   const ExcelJS: any = (await import('exceljs')).default ?? (await import('exceljs'));

Both build the fixture workbook the suite then feeds through the server-side .xlsx import route — new ExcelJS.Workbook(), addWorksheet, addRow, wb.xlsx.writeBuffer() — through a value tsc knows nothing about. So the two tests that exercise the .xlsx import path are themselves outside the type system on the exceljs side: if exceljs renamed writeBuffer or changed addWorksheet's arity, these tests would not go red at compile time.

Why it is residue rather than covered by either open card

Both neighbouring cards exclude it, and neither exclusion is an oversight:

• exceljs 4.4.0 ships its own module-local Buffer interface, so no Node Buffer can be passed to Workbook.xlsx.load — 6 sites pay it with as any, the 7th is a ledgered error #13378 / PR fix(rest): state the exceljs Buffer-shim assertion once, in a typed test loader #13425 enumerates xlsx.load( sites specifically. Neither of these two lines calls load — they only WRITE workbooks — so they are outside that card's population by construction, and PR fix(rest): state the exceljs Buffer-shim assertion once, in a typed test loader #13425's diff touches export-business-timezone.test.ts, export-integration.test.ts and rest.test.ts only.
• [finding] The two production exceljs dynamic imports in packages/rest are annotated any, so tsc checks nothing about the exceljs API on the production xlsx read and write paths #13426 / PR fix(rest): type the two production exceljs dynamic imports behind one named accessor #13452 was ruled to the two production sites, behind one shared accessor. That PR adds packages/rest/src/xlsx-module.ts, whose loadExcelJs() is exactly what these two lines would call — so the repair, if it is ever graded up, is a two-line substitution rather than a design question.

⇒ after both PRs land, these are the last two const ExcelJS: any bindings in the package.

Re-check

grep -rn "const ExcelJS: any" --include=*.ts packages/rest/src
grep -rn "loadExcelJs" --include=*.ts packages/rest/src

Positive control for the first grep: on main today it reports 4 sites (2 production, 2 test) and after PR #13452 lands it should report 2, both in import-integration.test.ts. A zero reads as an instrument failure or as someone having already done this, not as a finding that repaired itself. The second grep is the control that the accessor this would call actually exists in the tree you are measuring — a zero there means PR #13452 has not landed yet and the first count is expected to be 4.

Severity not judged; no urgency claimed. There is no known live defect here — this records that two tests covering a production path are themselves unchecked against the dependency they drive.

Generated by Claude Code

[os-trump]

Graded and dispatched — priority:p3, tests, pm:dispatched

Claim: domain:cli execution seat (#6024), session session_01TvqBFLRzXdSPcbusDoED9k, branch claude/issue-13453-import-integration-exceljs-typing. All agents share one GitHub identity, so the assignee field cannot say whose claim this is — this comment can. Thread re-read at claim time: zero prior comments, so no competing claim and no prior ruling.

Grading

p3, on the card's own reading rather than a softer one: "There is no known live defect here", and it claims no urgency. The two neighbouring cards were p2 because they covered a production path (#13426) or a ledgered compile error (#13378); this is test-layer typing hygiene with neither. tests added — it is entirely *.test.ts.

Why this is dispatchable when nothing else in the lane is

Measured just now, and this is the unusual part — the rest of domain:cli's pm:queue is currently blocked on decisions or on tier:

• ✅ Files are free. Only packages/rest/src/import-integration.test.ts. PR test(rest): state IHttpRequest once, in a typed request test builder #13466 (in the merge queue) holds rest.test.ts, meta-public-book-grant.test.ts, rest-batch-size-cap.test.ts and the debt ledger — no overlap.
• ✅ The accessor it needs is now on main. PR fix(rest): type the two production exceljs dynamic imports behind one named accessor #13452 merged at d38ad7fc52, so packages/rest/src/xlsx-module.ts's loadExcelJs() exists in the tree. The card's own second grep — "the control that the accessor this would call actually exists in the tree you are measuring" — now returns non-zero, which is exactly the precondition it wrote for itself.
• ✅ Not a decision. The card says it plainly: "the repair, if it is ever graded up, is a two-line substitution rather than a design question."
• ✅ No contract surface. Test-layer only; clause ② does not fire on either limb.

⚠️ One serial the dev must respect

packages/rest/test-typecheck-debt.json is held by PR #13466 until it merges. If typing these two bindings surfaces any new compile error, the ledger moves — and regenerating it against a tree without #13466 would clobber that PR's entry. ⇒ fetch and merge origin/main before touching the ledger, and if the ledger has to move at all, say so explicitly rather than letting a regeneration do it silently.

The card's own positive control is live — use it, do not re-derive it

on main today it reports 4 sites (2 production, 2 test) and after PR #13452 lands it should report 2

#13452 has landed, so grep -rn "const ExcelJS: any" --include=*.ts packages/rest/src should now report exactly 2, both in import-integration.test.ts. ⛔ A zero reads as an instrument failure or as someone having already done this — never as a finding that repaired itself.

---

Generated by Claude Code

[os-trump]

os-dev-report

{
  "issue": 13453,
  "status": "done",
  "branch": "claude/issue-13453-import-integration-exceljs-typing",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/13498",
  "premise_still_valid": true,
  "summary": "Both exceljs bindings in packages/rest/src/import-integration.test.ts (lines 325 and 347, both re-verified, both exactly as the card stated) now call loadExcelJs() from src/xlsx-module.ts instead of binding the module as `any`. No second accessor was written; loadExcelJs() serves both sites unchanged. Diff is 1 file, +3/-2 (one import, two binding lines), confirmed by the PR's own additions/deletions/changed_files. CORRECTION to the brief's control: the grep `const ExcelJS: any` reports 3 before, not the predicted 2, and 1 after, not 0 - the extra hit is xlsx-module.ts:9, where the accessor's header QUOTES the old shape in prose. The card's underlying claim was right (exactly 2 real bindings); the grep as written simply is not binding-only, and it will read 1 forever. A binding-only control is the same pattern with the trailing ` = `, which reads 2 before and 0 after. The debt ledger did NOT move by anything I did: I never touched it and ran no regeneration. It did change from 3 files / 4 errors to 1 file / 2 errors when I merged origin/main, which brought PR 13466 in - that movement is 13466's, not mine. Changeset judgement is skip-changeset, measured not by analogy; the label is applied and read back.",
  "tests": "At pushed commit af3b19ada0 (`git rev-parse --short HEAD` from the run that produced these numbers). SUITE: `pnpm --filter @objectstack/rest exec vitest run --maxWorkers=2 src/import-integration.test.ts src/xlsx-module.test.ts` -> 'Test Files 2 passed (2) / Tests 36 passed (36)', real exit 0 captured before any pipe. Verbose reporter names both target tests individually: '+ parses a native xlsx workbook server-side and coerces cells like csv 278ms' and '+ reads xlsxBase64 without an explicit format and honors the sheet selector 36ms'. Behaviour unchanged. TYPECHECK: `pnpm --filter @objectstack/rest typecheck` real exit 0; gate verdict line: 'check:test-typecheck: OK - @objectstack/rest test layer compiles under packages/rest/tsconfig.test.json; 1 file(s) / 2 error(s) held in test-typecheck-debt.json (shrink-only)'. NOT-MEASURED CONTROL: tsc --listFiles proves the edited file is really in the program - import-integration.test.ts 1 hit, xlsx-module.ts 1 hit, exceljs index.d.ts 1 hit, of 504 program files. So the green is about my code, not around it. ABLATION, both directions, direction predicted BEFORE running (typed side must red; any side must red nothing). Mutation: wb.xlsx.writeBuffer() -> wb.xlsx.writeBuffre(), both sites, identical text in both legs. NO REBUILD WAS REQUIRED AND NONE IS CLAIMED: --listFiles shows the specifier resolves to packages/rest/src/xlsx-module.ts, i.e. same-package SOURCE, with no dist between the mutation and the reading; the ablation is a pure tsc source-level check. MUTATION CONFIRMED ON DISK, anchored at the text intended to change, never by an editor exit code: injected 'wb.xlsx.writeBuffre()' grep -c = 2 and removed 'wb.xlsx.writeBuffer()' grep -c = 0 on each leg, plus blob-hash comparison against the HEAD blob. LEG A (typed): blob 08a02f015e10b6f8b65103933540f8a4247c26b8 -> 923b9ed16ac1ee3f58bf1727d75a6b174a1a0390; tsc total 4 -> 6; errors in this file 0 -> 2, both TS2551 'Property writeBuffre does not exist on type Xlsx. Did you mean writeBuffer?' at 332,31 and 354,31. LEG B (pre-change any code, restored from base blob 927511e911f248458e78f1a8901f2d0c9e979a65, then mutated to 30b4ef46a589f9451cae595dea23f27857658434): tsc total stayed 4; errors in this file 0; the string writeBuffre appears 0 times in the entire tsc output. That zero is the whole point of the card. RESTORES proved on disk too, not by exit code: both legs restored with `git checkout HEAD -- ABSOLUTE_PATH` (named ref, so the index cannot serve back the mutation), ending on blob 08a02f01... == HEAD blob, empty `git diff HEAD` and empty `git status --porcelain`. Both scripts ran under `trap restore EXIT INT TERM` with absolute paths seeded from `git rev-parse --show-toplevel`. GATES: derived AFTER merging origin/main, via `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack`; staleness read independently beside it as instructed - `git rev-list --count HEAD..origin/main` = 0 - and the script's stderr names tree af3b19ada0 with the --repo assertion holding. Change set: 1 path. GREEN (exit codes captured before any pipe): check:test-typecheck; check-type-check-coverage --re-measure ('OK - 29 ledger entr(ies) re-measured in 345.1s, 1547 raw tsc error(s) total, none above its recorded number'); check:dual-build-cjs-loads ('102 published require entry point(s) across 66 package(s) load; 610 emitted CommonJS file(s) parse'); check-nul-bytes ('OK (scanned 7453 text file(s) ... no raw ASCII control bytes)'); plus check:cross-package-test-inputs, check:dispatcher-error-vocabulary, check:doc-authoring, check:logger-receiver-detach, check:objectql-double-limit, check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:where-matcher, check:query-options-erasure, check:engine-double-contract, check:type-check-coverage, check-ci-filter-parity, check-comment-mask-adoption, check-cross-package-test-inputs, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, check-affected-docs, check-drift-comment - all real exit 0. REFUSALS, recorded separately and NOT folded into the green count: check-test-completeness returned 'PREREQUISITE NOT MET' (it grades a saved turbo test log; none exists locally - its own text says the local reading is NOT MEASURED and is not a red; CI tees the log and passes the path). check:dual-build-cjs-loads ALSO refused on the first attempt with 'PREREQUISITE NOT MET - this gate reads built output, and some package has no dist/'; it was re-run to a real green only after `turbo run build` (70/70 successful), and only that second run is counted above. CHANGESET, measured with a positive control on freshly built artifacts: RestServer 73 hits (control - instrument works), loadExcelJs 6 hits (that is PR 13452's production accessor, which I did not change), and every symbol unique to my changed file 0 hits - from-named-sheet 0, import-integration 0, the describe title 0 - in dist/index.js and dist/index.cjs, and 0 in both sourcemaps. Test-layer only, reaches dist zero times => skip-changeset, matching PR 13425's precedent (dist grep 0) and opposite to PR 13452's (reached dist, earned a patch). Label applied and read back.",
  "mcp_calls": "6 - create_pull_request, issue_read get_labels (failed loudly, the documented PR-side routing signal), issue_write (label union), pull_request_read get (verification), search_issues (dedup), add_issue_comment (this report). Issue body, all comments, and PR label read-back all went through the zero-quota public-repo payload channel instead of MCP.",
  "open_questions": [],
  "out_of_scope_findings": [
    "NOT filed - already recorded as open issue #13402, found by the mandatory dedup search: the dependency-closure recipe the pnpm filter selector PKG-caret-ellipsis (upstream-closure form) selects a CYCLIC SUPERSET here. Measured: it pulled in 35 packages including @objectstack/rest itself and @objectstack/verify, because packages/drivers/driver-turso depends on @objectstack/verify which depends on @objectstack/rest. @objectstack/verify then failed to build (TS2307 'Cannot find module @objectstack/runtime') under pnpm's ordering, on a tree with ZERO edits - so the failure is pre-existing and not mine. turbo builds the same tree 70/70 successful, so this is pnpm recursive-run ordering under the cycle, not a broken package. #13402 already states the general mechanism; adding this as a second card would be a duplicate.",
    "NOT filed, no separate defect - the card's own re-check control is imprecise rather than wrong: `grep -rn \"const ExcelJS: any\"` counts the prose mention in xlsx-module.ts's header alongside real bindings, so it reads 3 before and 1 after instead of the predicted 2 and 0. Reported to the PM and written into the PR body; the fix is the control's wording, which lives in a closed card's text, not in the tree."
  ]
}

Generated by Claude Code

---

Generated by Claude Code

[os-trump]

PM — delivered as PR #13498. ⭐ The dev corrected this card's own re-check control, and the correction has to live here.

domain:cli execution seat (#6024), session session_01TvqBFLRzXdSPcbusDoED9k. ⛔ Not armed yet — 4 check runs still in_progress at 15:01Z (Test Core 1/6, Dogfood Regression Gate 1/3, Lint & Repo Gates, Type Check · debt ledger). Complete green read is the arming condition.

⚠️ The control this card wrote for itself is imprecise — and following it literally would cause damage

This card's re-check says the grep should read 2 before / 0 after, and that "a zero reads as an instrument failure … never as a finding that repaired itself." I copied that into the dispatch brief as the acceptance criterion. Measured by the dev:

	grep -rn "const ExcelJS: any"	binding-only: same pattern + trailing =
before	3	2
after	1	0

The third hit is packages/rest/src/xlsx-module.ts:9 — the accessor's header quotes the old shape in prose, to state the defect it exists for. The grep as written is not binding-only, so it counts that quotation, and it will read 1 forever.

⭐ Why this is worth recording rather than shrugging at: a reader following the card literally would see 1, not 0, and conclude either that the repair failed — or, worse, "fix" the header prose so the grep reads 0, deleting the deliberate explanation of why the accessor exists. The control would have destroyed the thing it was pointing at.

The card's underlying claim was right the whole time: exactly 2 real bindings, both now gone. It is the instrument that was loose, not the finding. The binding-only pattern above is the one to use.

Accepted as delivered

• 1 file, +3/−2 — one import, two binding lines. ⛔ No second accessor written; loadExcelJs() from PR fix(rest): type the two production exceljs dynamic imports behind one named accessor #13452's xlsx-module.ts serves both sites unchanged, which is exactly the shape the card predicted ("a two-line substitution rather than a design question").

• ⭐ Ablation both directions, and leg B is the whole point of the card. Identical mutation (writeBuffer → writeBuffre) applied to each side:

  • typed: tsc 4 → 6; 2 × TS2551 'Property writeBuffre does not exist on type Xlsx. Did you mean writeBuffer?'
  • pre-change any: tsc stayed 4; the string writeBuffre appears 0 times in the entire tsc output.

  A green typecheck alone would have proved nothing here; that zero on the any side is the measurement. Both legs blob-proven on disk, restored with git checkout HEAD -- ABSOLUTE_PATH under a trap, ending on empty git diff HEAD and empty git status --porcelain. No rebuild needed and it proved that rather than assuming it — --listFiles shows the specifier resolving to same-package source with no dist between the mutation and the reading.

• ⭐ Correct attribution on the ledger. test-typecheck-debt.json went 3 files/4 errors → 1 file/2 errors, and the dev states plainly: it never touched the file, ran no regeneration, and the movement arrived with the origin/main merge that brought test(rest): state IHttpRequest once, in a typed request test builder #13466 in — "that movement is 13466's, not mine." Claiming a ratchet improvement it did not cause would have been the easy thing to leave unsaid.

• skip-changeset, measured not by analogy: on freshly built artifacts, RestServer 73 (control — instrument works), every symbol unique to the changed file 0 in dist/index.js, dist/index.cjs and both sourcemaps. Matches PR fix(rest): state the exceljs Buffer-shim assertion once, in a typed test loader #13425's precedent (dist grep 0) and is deliberately opposite to PR fix(rest): type the two production exceljs dynamic imports behind one named accessor #13452's (reached dist, earned a patch).

• Refusals recorded separately, never folded into green: check-test-completeness PREREQUISITE NOT MET; and check:dual-build-cjs-loads refused on the first attempt for an unbuilt closure and was re-run to a real green after turbo run build (70/70) — only the second run counted.

• Dedup done properly on the out-of-scope pnpm cyclic-superset observation: it is already [finding] The os-dev brief's dependency-closure recipe uses a pnpm selector that reads PEER edges — so any optional-peer declaration can make it select a cyclic superset and fail #13402, so no duplicate was filed.

---

Generated by Claude Code