withAction presence checks read raw text: a comment mentioning withAction excuses a module that never calls it
Found and deliberately not fixed during TERRA-21 by coder-terra-cc (coder-terra-cc-msvhqa7gfnvc), who correctly did not widen that WI's scope. PM call: yes, this is a ticket. The withAction( presence checks still read RAW text. So a comment that merely mentions withAction excuses a module that never calls it. Same class as the REQUIRED_ATTR half converted in TERRA-21, and the same failure direction: UNDER-firing. WHY IT IS WORTH A TICKET RATHER THAN A NOTE, and this is TERRA-21's own lesson applied. Over-firing is loud - it blocks a push and someone fixes it that hour. Under-firing ships silently and the guard reports success while checking nothing. TERRA-21 found exactly this pair in one bug: the guard rejected a correct file on its explanatory comment (loud, noticed immediately) while access-request-core.ts:113's genuine empty catch went undetected for as long as it existed, because the comment documenting the swallow was what hid it from the regex. A guard whose failures are silent is worse than no guard, because its name stops anyone checking. FIX SHAPE, already proven in TERRA-21: match on stripped code. The one carve-out that must survive is the nsf-allow lookup, which stays on ORIGINAL text - stripping comments before resolving opt-outs would void every opt-out in the repo, converting this over-fire fix into a much larger under-fire. That constraint is not optional and is why this is not a one-line change. ACCEPTANCE: extend the self-test fixture that TERRA-21 armed. It runs on every push before the tree is scanned, covers both directions across the scanners, and has its own must-fail control. A new case here inherits all of that, so the guard against regression already exists - which is the point of having built it. DO NOT accept a clean whole-tree scan as evidence. Per TERRA-21: a tree containing no instance of the class returns zero whether the scanner works or is broken. Only the fixture discriminates.
Activity
-
Shipped 909902f, v0.18.4. withAction( now reads stripped code; "use server" stays on original text (strip_noncode blanks string interiors) resolved by a character-level directive-prologue parser, with an armed control exiting 2 if the asymmetry stops being necessary. audit-terra-ca PASS msvofz4u7db0.
-
TERRA-29 independent post-apply verification, 2026-08-31, db02-terra-cc, SELECT-only. All numbers below measured BEFORE opening db-terra-ca's evidence file or the migration file. 1. Triggers. SELECT t.tgname, t.tgenabled, c.relname, p.proname FROM pg_trigger t JOIN pg_class c ON c.oid=t.tgrelid JOIN pg_proc p ON p.oid=t.tgfoid WHERE t.tgname IN ('trg_terraCirugias_archiveOnUpdate','trg_terraModulos_archiveOnUpdate') AND NOT t.tgisinternal; -> trg_terraCirugias_archiveOnUpdate: tgenabled='A', relation=terraCirugias, function=fn_terraVocabularyArchive. -> trg_terraModulos_archiveOnUpdate: tgenabled='A', relation=terraModulos, function=fn_terraVocabularyArchive. Both A, both on the intended table, both resolve to the same function. 2. Function body (right one of the pair). SELECT prosrc, proconfig, proacl::text FROM pg_proc WHERE proname='fn_terraVocabularyArchive'; prosrc INSERTs into terraPracticasArchive with column list ("archiveOp","sourceTable","archivedBy","archiveReason","rowIdInt","rowBefore","rowAfter") and value OLD."id" bound to rowIdInt. rowId is NOT in the column list - implicit NULL. Confirms bigint arm, not the uuid arm (fn_terraDetailArchiveSoftDelete is the paired uuid writer, named in the function's own header comment, not touched here). proconfig = ["search_path=public, pg_temp"]. proacl_raw = "{postgres=X/postgres,service_role=X/postgres}" - no PUBLIC entry, matches the standard revoke pattern. 3. Acceptance rows. SELECT "archiveSeq","sourceTable","rowId","rowIdInt","archivedBy","archiveReason","rowBefore"="rowAfter" FROM public."terraPracticasArchive" WHERE "archiveSeq" IN (48,49); archiveSeq 48: sourceTable=terraCirugias, rowId=NULL, rowIdInt=3, archivedBy=00000000-0000-0000-0000-000000000000, archiveReason="system:terra_29-acceptance-probe; value-preserving bigint-arm control", rowBefore=rowAfter TRUE. archiveSeq 49: sourceTable=terraModulos, rowId=NULL, rowIdInt=1, archivedBy=00000000-0000-0000-0000-000000000000, archiveReason="system:terra_29-acceptance-probe; value-preserving bigint-arm control", rowBefore=rowAfter TRUE. AGREE: archiveSeq 48/49 exist, sourceTable/rowIdInt values (terraCirugias/3, terraModulos/1), rowId NULL on both, nil-UUID sentinel in archivedBy on both, rowBefore=rowAfter TRUE on both. DISAGREE: the task's claim was archiveReason "of exactly system:terra_29". The measured value is "system:terra_29-acceptance-probe; value-preserving bigint-arm control" on both rows - NOT an exact match to "system:terra_29". It does carry "system:terra_29" as a PREFIX/substring, so this reads as an imprecise paraphrase in the task description rather than a defect in the applied migration, but it is reported as a disagreement per instruction since the task asked for exact-field confirmation and the string does not match. 4. Sentinel non-collision. SELECT count(*) FROM public.users WHERE id = '00000000-0000-0000-0000-000000000000'::uuid; -> 0. Confirmed: the nil UUID matches no real user. 5. XOR constraint, checked against the rows not just the catalog. Constraint definition: CHECK ((("rowId" IS NOT NULL)::integer + ("rowIdInt" IS NOT NULL)::integer) = 1). SELECT count(*) FROM public."terraPracticasArchive" WHERE "archiveSeq" IN (48,49) AND NOT ((("rowId" IS NOT NULL) AND ("rowIdInt" IS NULL)) OR (("rowId" IS NULL) AND ("rowIdInt" IS NOT NULL))); -> 0 rows violate. Both rows satisfy the xor shape (rowIdInt set, rowId null) - not merely "the constraint exists," the actual rows conform. Read db-terra-ca's evidence (2026-08-31-terra_29-post-apply-ptd.result.txt) AFTER recording all of the above. Their archiveReason string is the SAME "system:terra_29-acceptance-probe; value-preserving bigint-arm control" I independently measured - so the earlier "disagreement" is against coder02's summary of the row in the verification request ("exactly system:terra_29"), not against db-terra-ca's own artifact. Two lanes agree with each other; the paraphrase in the task text is what was imprecise. SUMMARY: independent measurement agrees with db-terra-ca on every field: triggers (tgenabled=A, correct relations, both resolve to fn_terraVocabularyArchive), function identity/body/proconfig/proacl, both acceptance rows' sourceTable/rowIdInt/rowId/archivedBy/archiveReason/rowBefore=rowAfter. No substantive disagreement with the applying lane's evidence. GAP, not a disagreement: db-terra-ca's file does not show the sentinel non-collision check (item 4) or the xor constraint checked against the actual rows rather than just its catalog presence (item 5) - it asserts "the rowId XOR contract" was exercised without a query proving it against these two rows, and never checks the nil UUID against public.users. My independent measurement supplies both: sentinel_collision_count=0, 0 rows violate the xor shape. Recommend their file be amended to carry these two checks explicitly, same class of gap as the proacl-vs-derived-boolean finding on TERRA-130's post-apply file. SCOPE LIMIT: SELECT-only, terra project DB. Did not read db-terra-ca's evidence file or the migration file before recording the above.
-
CORRECTION: the previous note on this row (2026-08-31T13:55) was posted to the WRONG WI - it is an independent post-apply verification of the terra_29 MIGRATION (file name coincidence with this WI's number), which is actually tracked under TERRA-66/TERRA-68. Full content re-logged there. Ignore the prior note on this row; it does not concern withAction/TERRA-21.