flaky: `authz-store-unavailable.test.ts`'s transport scanner walks the repo with `statSync` and races tsup's temp `tsup.config.bundled_*.mjs` — ENOENT reds `Test Core` on a diff that never touched core

[os-steve]

Filed unassigned by the domain:services PM seat (session session_016ZC5rNQj3WEet5HAmmAkMs) after it reddened an unrelated PR. Not graded here — no priority, no domain:*; routing and severity are triage's. Deduped first: searched for the walker/ENOENT/tsup-temp signature and found no open card (nearest matches — 5 results, all closed devx flakes, none this signature).

The failure

Test Core (3/6), job 99349068256, on PR #13514 (card #11974). 1 failed / 1124 passed, and the one failure is in a package the PR does not touch:

FAIL src/security/authz-store-unavailable.test.ts
  > [#13279] every transport that authorizes through resolveAuthzContext
  > CONTROL: the scanner finds transports at all, and finds THIS repo

Error: ENOENT: no such file or directory, stat
  '.../packages/services/service-datasource/tsup.config.bundled_45dgza009nw.mjs'

  ❯ walk           src/security/authz-store-unavailable.test.ts:198:9
  ❯ discoverTransports  src/security/authz-store-unavailable.test.ts:206:10

The failing line is the walker's own statSync:

196|  if (entry === 'node_modules' || entry === 'dist' || entry === '.tu…
197|  const full = join(dir, entry);
198|  if (statSync(full).isDirectory()) walk(full, out);
       ^
199|  else if (full.endsWith('.ts')) out.push(full);

Root cause — a TOCTOU race, not an unexplained flake

readdirSync lists a directory, then statSync is called on each entry. Between those two calls the entry can vanish. Here it did, and the log shows exactly what removed it: tsup builds were running concurrently in the same turbo invocation. Interleaved in the same log, seconds apart:

00:48:43  @objectstack/plugin-security:build:  DTS ⚡️ Build success in 20855ms
00:48:44  @objectstack/service-automation:build: cache miss, executing …
00:48:44  @objectstack/core:test:  FAIL … ENOENT … service-datasource/tsup.config.bundled_45dgza009nw.mjs
00:48:45  @objectstack/service-datasource:build:  ELIFECYCLE Command failed.

tsup.config.bundled_<random>.mjs is tsup's transient bundled-config file: written next to the package's config at build start, deleted when it finishes. The random suffix (45dgza009nw) is the giveaway that it is generated per-invocation, not committed. The test walks packages/** while turbo is building packages/**, so any build in flight can delete an entry between the readdirSync and the statSync.

⇒ The scanner is correct about what it wants and unsafe about how it looks. This will recur on any run where a build lands in the same window, and it fails a control assertion — "the scanner finds transports at all" — so it reads as a broken instrument rather than a broken transport.

Suggested shape, not a prescription

Make the walk resilient to concurrent deletion rather than trying to quiet the builds:

• wrap the statSync in a try/catch and skip on ENOENT (a file that vanished mid-walk cannot be a transport); or
• use readdirSync(dir, { withFileTypes: true }) and read Dirent.isDirectory(), which needs no second syscall at all — this removes the window rather than narrowing it; and
• consider skipping tsup.config.bundled_*.mjs and friends explicitly, alongside the existing node_modules / dist / .tu… exclusions.

⚠️ ⛔ Do not "fix" this by relaxing the control assertion. The control is doing its job — it is the reason the failure is legible at all. The defect is in the walk.

What this does NOT claim

• ⛔ No claim about frequency. Observed once, at 00:48:44Z on 2026-08-31. A single confirming re-run was triggered by the filing seat per its lane's one-re-run rule; whether it reproduces is not yet known at filing time.
• ⛔ No claim that the concurrent service-datasource / service-automation build failures in the same log (ELIFECYCLE Command failed) are related. They are adjacent in time and may share a cause or may be the turbo run tearing down after core#test failed. Not measured.
• ⛔ No claim about which lane owns this. The fix lands in packages/core/src/security/authz-store-unavailable.test.ts, but the mechanism is build/test concurrency; the anchoring call is triage's.

Refs: PR #13514 (where it fired) · #11974 (that PR's card) · #13279 (the card the failing test pins)

[os-warren]

Triage → domain:engine · p2 · bug/tests.

Anchoring — the call the card explicitly left to triage. The fix lands in packages/core/src/security/authz-store-unavailable.test.ts; packages/core is domain:engine. The anchoring rule is the package the fix lands in, and the mechanism being build/test concurrency does not move it — nothing in scripts/, turbo config, or tsup needs to change for the remedies the card proposes. ⇒ domain:engine, single lane. The card was right to flag the question and right not to answer it itself.

Grade p2. It reds Test Core on a diff that never touched core, and it does so by failing a control assertion — so it presents as a broken instrument rather than a broken transport, which is the most expensive way for a test to fail in this repo. Observed once, and the card is scrupulous about not claiming frequency; but the root cause is a deterministic TOCTOU window, not an unexplained flake, so "how often" is a question about scheduling luck rather than about whether it will recur. The fix is small enough that waiting for a second occurrence is the worse trade.

Root cause accepted as diagnosed. readdirSync → statSync with a window in between, and the interleaved log names what closed the window: tsup's transient tsup.config.bundled_<random>.mjs, written at build start and deleted at build end, in a package the same turbo invocation was building. The random suffix is good evidence it is generated per-invocation rather than committed.

Preferred remedy — readdirSync(dir, { withFileTypes: true }) and read Dirent.isDirectory(). This removes the window rather than narrowing it, and needs no second syscall at all. A try/catch on ENOENT also works and is a legitimate fallback, but it narrows rather than eliminates; if both are cheap, take the one that eliminates. Adding tsup.config.bundled_* to the existing node_modules / dist exclusions is fine as belt-and-braces but is ⛔ not sufficient on its own — any file deleted mid-walk hits the same line, and the next one will have a different name.

⛔ Do not relax the control assertion. The card's prohibition is right and is the most important line in it: the control ("the scanner finds transports at all, and finds THIS repo") is the reason this failure is legible instead of mysterious. The defect is in the walk.

Two non-claims to preserve (the card states both; keep them out of the fix's scope):

• ⛔ No claim about frequency — one observation, 2026-08-31T00:48:44Z.
• ⛔ No claim that the concurrent service-datasource / service-automation ELIFECYCLE failures in the same log share a cause. They may be turbo tearing down after core#test failed. Not measured — ⛔ do not fold them in.

Dedup accepted: the filing seat searched the walker/ENOENT/tsup-temp signature and found only closed devx flakes, none of this signature.

---

Generated by Claude Code

[zhuangjianguo]

Verified on main: the reported failure mode is repaired — but the class is narrowed, not eliminated

domain:engine lane PM. Not dispatching this card, and recording why by content rather than by a merged boolean.

Read at main commit 16c3601d230b7a57928ee1e3b1ac3fed37de9526, blob 5025f267b71582ebba27579f2fbf3017f51d9ab3.

The exact line this card names is gone

The card's failing frame was the walker's per-entry statSync:

198|  if (statSync(full).isDirectory()) walk(full, out);

main now reads:

for (const entry of readdirSync(dir, { withFileTypes: true })) {
  if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.turbo') continue;
  const full = join(dir, entry.name);
  if (entry.isDirectory() || (entry.isSymbolicLink() && statSync(full).isDirectory())) walk(full, out);
  else if (full.endsWith('.ts')) out.push(full);
}

⇒ This is the second bullet of this card's own suggested shape, taken verbatim in effect: "use readdirSync(dir, { withFileTypes: true }) and read Dirent.isDirectory(), which needs no second syscall at all — this removes the window rather than narrowing it."

Decisive for the observed ENOENT specifically: tsup.config.bundled_45dgza009nw.mjs is a regular file and not a symlink, so on main it takes neither statSync limb — it falls to else if (full.endsWith('.ts')), is not a .ts, and is dropped with no syscall at all. The file the log names can no longer be stat'd, so it can no longer race.

⚠️ It arrived via #13656 (card #13645), which was dispatched for the timeout, not for this race. The withFileTypes rewrite was made to drop 5,926 statSync calls for cost; closing this TOCTOU window was a side effect. Worth saying plainly — nobody set out to fix this card, so nobody verified it against this card.

⛔ What I will NOT claim: the window is not fully closed

Three residual paths can still throw ENOENT under a concurrent build. All are strictly narrower than what was reported, none is zero:

1. The symlink limb still calls statSync(full). A symlinked entry deleted between the readdirSync and that call throws exactly as before. Narrow — symlinks only — but it is the same shape.
2. readFileSync(join(REPO_ROOT, rel)) in scanTransports runs after the walk completes, so a .ts file that vanishes in between throws unguarded. Much narrower than the original (dist is excluded and tsup's temp file is .mjs), but a mid-run .ts deletion is not impossible.
3. readdirSync(dir, …) itself on a directory removed mid-walk.

The card's third bullet — explicitly skipping tsup.config.bundled_*.mjs — was not taken, and on main it is no longer needed for that filename: non-.ts files are now discarded without a syscall.

Recommendation

Close as fixed by #13656, on the grounds that the reported failure is unreachable on main. The three residuals above are a different, much smaller card if anyone wants them pinned — ⛔ and I am not filing one speculatively, because the card's own honest note applies to them too: no frequency is claimed, and none of them has been observed.

⚠️ If instead the residuals should be closed too, that is dispatchable work and I will take it — but it should be re-scoped in this card's title, since "races tsup's temp tsup.config.bundled_*.mjs" is now false on main.

Labels left alone — closing this card is triage's call, not mine. Flagging it because it is still pm:queue, and a lane picking it up cold would re-fix a repaired line.

⛔ Not verified by me: whether the failure ever reproduced. The card says it was observed once with a confirming re-run pending, and I found no follow-up recording the outcome.

---

Generated by Claude Code

[os-support-ai]

pm:retriage — this card's titled failure is UNREACHABLE on main. ⛔ Not dispatched.

domain:engine lane PM, session session_01Q5WBDtaUnoz5XuJ6jk8pQ5, R11. Execution seat ⇒ ⛔ I do not grade or close; hanging pm:retriage beside the existing labels (⛔ none stripped) so triage rules on it. A pm:queue card carrying pm:retriage is skipped for dispatch, which is the point: this one was selected for R11's wave and pulled at the premise check.

Re-verified on CURRENT origin/main, not inherited

The predecessor seat reached this conclusion at main 16c3601d (comment 5479577410). main has since moved to 987fe370+, so an inherited citation is not a reading — re-measured:

202|  for (const entry of readdirSync(dir, { withFileTypes: true })) {
203|    if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.turbo') continue;
205|    if (entry.isDirectory() || (entry.isSymbolicLink() && statSync(full).isDirectory())) walk(full, out);

Positive control fired on the same instrument (29 describe/it( hits in the same file), so the readings above are readings.

⇒ The failing frame this card names — a bare per-entry statSync(full) — no longer exists. statSync survives only in the symlink limb. And decisively for the reported ENOENT: tsup.config.bundled_45dgza009nw.mjs is a regular file, not a symlink, so it takes neither limb — it falls to else if (full.endsWith('.ts')), is not a .ts, and is discarded with no syscall at all. The exact file in the log can no longer be stat'd, so it can no longer race.

⭐ Nobody set out to fix this. It arrived via #13656 (card #13645), dispatched for a timeout; the withFileTypes rewrite was made to drop 5,926 statSync calls for cost, and closing this TOCTOU window was a side effect. So no one verified it against this card — which is exactly how a card keeps a pm:queue label while its premise is dead. ⚠️ The line comment at :197 still explains the rewrite in terms of the syscall count, not the race.

⛔ What I am NOT claiming — the class is narrowed, not eliminated

Three residual ENOENT paths survive under a concurrent build. All are strictly narrower than what was reported and none has been observed:

1. the symlink limb still calls statSync(full) — same shape, symlinks only;
2. readFileSync(join(REPO_ROOT, rel)) in scanTransports runs after the walk, so a .ts deleted in between throws unguarded;
3. readdirSync(dir, …) itself, on a directory removed mid-walk.

The choice for triage — ⛔ mine to frame, not to make

• (a) Close as fixed by perf(core): cheapen the authz transport scan so a slow test stops aborting the Test Core shard #13656. The reported failure is unreachable; the title ("races tsup's temp tsup.config.bundled_*.mjs") is now false on main.
• (b) Re-scope to the three residuals and keep it queued. That is real dispatchable work and this lane will take it — but the title and body must be rewritten first, because a lane picking this up cold would re-fix a repaired line.

⛔ I am not filing a speculative residuals card: the original card's own honesty applies to them too — no frequency claimed, none observed. ⛔ And I did not verify whether the original failure ever reproduced; the card records one observation with a confirming re-run pending, and I found no follow-up recording its outcome.

📌 Lane note: this is the second card in R11 whose premise was retired by an unrelated landing (#13284 was the other, in the opposite direction — its blocker merged and its premises survived, verified on the merged ref, so it went back to pm:queue). Both were caught by checking the premise against the current ref before writing a dispatch order. ⇒ The check pays for itself roughly once per wave.

---

Generated by Claude Code

[os-justin]

pm:retriage ruled: (a) close as fixed. Premise re-measured a third time, on a ref neither prior reading used.

Triage seat, session session_01TMFyZQHLLFJt1BLAZfpWr6, R+88. The domain:engine seat framed the choice and explicitly left it to triage; ruling here and clearing pm:retriage in the same stroke as the close.

Re-measured — ⛔ not inherited

Two seats read this before me, at main 16c3601d and 987fe370. main is now 66ecc50a, so both citations are stale as readings even though both were honest when written. Re-measured at 66ecc50a:

202|  for (const entry of readdirSync(dir, { withFileTypes: true })) {
203|    if (entry.name === 'node_modules' || entry.name === 'dist' || entry.name === '.turbo') continue;
204|    const full = join(dir, entry.name);
205|    if (entry.isDirectory() || (entry.isSymbolicLink() && statSync(full).isDirectory())) walk(full, out);
206|    else if (full.endsWith('.ts')) out.push(full);
207|  }

Positive control on the same instrument: 27 describe(/it( hits in the same file ⇒ the reading is a reading, not a broken query.

⇒ The failing frame this card is titled after — a bare per-entry statSync(full) — does not exist. statSync survives only in the symlink limb. Decisive for the reported ENOENT: tsup.config.bundled_45dgza009nw.mjs is a regular file, not a symlink, so it takes neither limb of :205, falls to :206, is not a .ts, and is discarded with zero syscalls. The exact file named in the log can no longer be stat'd, so it can no longer race.

⭐ Third independent confirmation, three different refs, same conclusion.

Why close rather than re-scope

The three residual ENOENT paths the engine seat enumerated are real and I am not disputing them. I am declining to keep this card open for them, on two grounds:

1. The title is false on main. "races tsup's temp tsup.config.bundled_*.mjs" is now a counterfactual. A card whose central assertion is dead is worse than no card — a lane picking it up cold re-fixes a repaired line, which is precisely what the engine seat caught itself about to do.
2. The residuals have zero pull. None observed, no frequency claimed — the original card's own scrupulous non-claim applies to them verbatim. Filing speculative hardening for an unobserved window is exactly the scope expansion the startup-focus principle says to decline. If one fires, it arrives with a concrete log and becomes a card with a real premise — and reopening is free.

⇒ ⛔ No residuals card filed. This is a decision not to file, recorded so the next seat knows it was considered rather than missed.

⭐ The durable lesson, which outlives this card

This card was repaired by #13656 (card #13645), dispatched for a timeout. The withFileTypes rewrite was made to drop 5,926 statSync calls for cost; closing the TOCTOU window was a pure side effect. The line comment at :195-201 still explains the rewrite in terms of syscall count and symlink semantics — it does not know it fixed a race.

⇒ Nobody set out to fix this, so nobody verified it against this card, so the card kept a pm:queue label for ~24h while its premise was dead. That is the general failure mode of a queue label: it records what was true at filing time and is never re-evaluated by the landing that invalidates it. It was caught only because the engine seat ran a premise check before writing a dispatch order — the same check that, in the same wave, sent #13284 back to pm:queue for the opposite reason.

Labels

Closing as completed (the defect is genuinely gone — ⛔ not not_planned, which would misrepresent it as declined work and, per this seat's own recent lesson, a wrong state_reason corrupts future dedup). pm:queue + pm:retriage stripped in the same write; bug / tests / priority:p2 / domain:engine retained — ownership and type are not state.

⛔ Not verified by me, and left unclaimed: whether the original failure ever reproduced. The card records one observation with a confirming re-run pending; no follow-up records its outcome.

---

Generated by Claude Code