fix(#3625): the untyped-content gate can fire, and keys on the event not the sentence by rbuergi · Pull Request #3628 · Systemorph/MeshWeaver

rbuergi · 2026-09-07T16:23:15Z

Closes #3625.

The gate could not fire, and that is worse than a gate that is merely wrong

dotnet-test.yml runs check-untyped-content.sh collected-logs on every shard. The script is
careful in every way that matters given its input: it separates "found nothing" from "the scan
failed" on grep's exit code, refuses a missing directory, and explains the fix. Its input could
never arrive.

Both producers logged the degradation as a Warning with no exception:

MeshNodeStreamCache.cs — GetStream's converter
MeshNodeStreamCache.cs — GetQuery's converter

and the sink that writes collected-logs/_meshweaver-test-trace.log takes a record if and only
if exception is not null && logLevel >= LogLevel.Warning
(XUnitFileLogger.Log / LoggingBuilderExtensions.Log → TestTraceLog.AppendFault). The other
route into that directory — per-method */bin/*/test-logs/*.log — is opt-in via
MESHWEAVER_TEST_FILE_LOGS, which node-repo-module-pack.yml sets and dotnet-test.yml does not.
So the phrase reached the scanned directory by construction never: permanently green, and
therefore indistinguishable from a check that passed. That is the one reading AGENTS.md singles out
as forbidden, committed inside a gate written to prevent it.

The existing control test asked the wrong question. UntypedContentDegradationGate pins that
the source still emits the phrase and that the script still greps it. Both were true the whole
time. Neither asks whether a record can reach the directory the script scans — a guard whose
subject moved and whose roots did not passes having checked nothing.

This is the third recorded instance of the same trap: #890's PROCESS CANNOT EMIT and #3413's
never rendered each lost their own explanation to it. The new part is that this time it disarmed a
gate.

The fix — and why the gate no longer keys on prose

1. The record can reach the sink. The three degradation sites now pass
MeshNodeContentDegradedException — an exception object constructed and never thrown, whose
entire job is to satisfy the sink's predicate. Reaching a sink is a property of the CALL, not of the
level or the wording; this is the same fix #890 got, one diagnostic over. It captures no stack (it
is never thrown), so ToString() is exactly type: message — which is the whole record a reader
needs, because the fault is in the DATA, not in a call path.

2. The gate keys on the TYPE, not the sentence. A message is a description of the event; the
type is the event's identity, bound by the compiler at every construction site. The phrase had
exactly one binding — this test file. The type now has two: renaming it is a repo-wide compile
change, and UntypedContentDegradationGate pins the script's MARKER= to
nameof(MeshNodeContentDegradedException). The phrase is kept as a second net because it costs
nothing and a per-test file log carries the formatted message with no exception attached at all.

3. A third blind spot, closed on the way. GetQuery's deserialization catch branch already
carried an exception and so already reached the trace — but its wording is "stays", not
"stayed", so the phrase grep could never have matched it either. Keying on the type covers it;
ex rides along as the inner exception, so the deserialization stack is still in the record.

4. The missing control. UntypedContentDegradationReachesTheTraceSinkTest drives the
production converter (both seams, made internal for exactly this) and evaluates the sink's own
condition against the captured record — pinning the sink predicate, not the call, because asserting
"we passed an exception" would restate the fix in the fix's own terms. Modelled on
EmitDeadAttributionReachesTheTraceSinkTest, which the maintainer named as the template.

It captures through its own recording logger and never touches TestTraceLog. That is deliberate,
and it is the objection that kept this control from being written before: a control arm that wrote a
real degradation into the shared trace file would red every shard. The chain is split cleanly —
emitter → record is exercised by the test, record → file is AppendFault's own contract, and
file → verdict is the script, falsified directly below.

No mocking. The discriminating variable is a real MeshContentTypeRegistry: empty in the
degraded arm, carrying the probe type in the non-vacuity arm. Same node, same converter, same
options — the only difference is whether the mesh knows the type, which is exactly the condition the
warning reports.

🚨 Falsification — the gate made to go red, then green, exit codes read directly

The same degradation, through the same real sink (XUnitFileLogger → TestTraceLog.AppendFault),
under a redirected TMPDIR so nothing touched the shared trace file. Three runs:

arm	what was in `collected-logs/`	gate
fix reverted (exception argument removed at the `GetStream` seam)	the trace file was never created	`No content-type degradation` — exit 0
fix in place	the `[FAULT]` record, carrying the phrase and `MeshWeaver.Mesh.MeshNodeContentDegradedException`	exit 1, `2 Space/ARenderedEmptyPage`
control: a real but unrelated `[FAULT]` (`InvalidOperationException`, 223 bytes)	a non-empty, genuine trace with no degradation	exit 0

The first row is the defect reproduced: the condition the gate exists to catch, occurring, and the
gate reporting success. The third row is what makes the second row a verdict rather than an empty
scan — the gate deliberately passes on an empty directory, so a green arm with nothing in it would
prove nothing.

The harness that produced rows 1 and 2 is deliberately not committed: in CI it would write a
genuine degradation into the shared trace file and red every shard — which is the gate working
correctly.

Verification

dotnet build -c Release -warnaserror, one project per invocation, exit read directly (never
through a pipe): MeshWeaver.Hosting, MeshWeaver.Hosting.Test, MeshWeaver.Documentation.Test
— all 0 Warning(s) 0 Error(s).
UntypedContentDegradationReachesTheTraceSinkTest 4/4 (2 seams × degraded + recovered).
UntypedContentDegradationGate 4/4 (2 pre-existing + 2 new), plus
DocumentationLinkIntegrityTest and WhatsNewEntryIntegrityTest green after the doc edits — 6/6
in that filter.

Work product conserved

Doc/Architecture/ReadingCiSignals → the fault-sink section now carries this as the blind spot's
third instance, with the measurement, why the control test missed it, and the falsification table.
That section already documented instances one and two.

Risk, stated plainly

A test that deliberately seeds unreadable node content will now red its shard, because its
degradation finally reaches the sink. That is the gate doing its job — but it is a behaviour change
to CI, not a refactor, and if a shard reds on this after merge the right response is to fix the
degradation (register the content type where it is READ), never to widen the gate.

What's New: Category: Fix — "A content type nobody registered can no longer slip through CI".

🤖 Generated with Claude Code

…not the sentence `check-untyped-content.sh` greps a shard's `collected-logs/` for a content degradation and reds on a hit. It could not fire: both producers logged the phrase as a Warning with NO exception, and the sink that writes `_meshweaver-test-trace.log` takes a record if and only if `exception is not null && logLevel >= Warning`. The phrase could reach the directory the script scans by construction never — permanently green, and therefore indistinguishable from a check that passed. The two `LogWarning` calls in `MeshNodeStreamCache` (and `GetQuery`'s catch branch, whose wording "stays" the phrase grep never matched anyway) now carry `MeshNodeContentDegradedException` — constructed, never thrown, its whole job being to satisfy the sink's predicate. The gate keys on that TYPE NAME first and on the prose only as a second net: a message describes an event, a type IS the event, bound by the compiler at every construction site, so the coupling gains a binding it did not have. `UntypedContentDegradationReachesTheTraceSinkTest` supplies the half the existing control never asked: it drives the production converter and evaluates the sink's own condition against the captured record, with a non-vacuity arm on the same node through a registry that CAN recover it. `UntypedContentDegradationGate` now also pins the script's key to `nameof(MeshNodeContentDegradedException)` and requires every seam to attach it. Falsified end to end, exit codes read directly: fix reverted -> no trace record written, gate exit 0; fix in place -> record written, gate exit 1; unrelated real fault only -> gate exit 0. Refs #3625 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…and the shape that replaces one A test proving a write REFUSES unreadable content must seed unreadable content, and once these records reach the sink such a fixture reds its own shard. An exemption list would be a permanently green check wearing a reason. The script and the doc now name the shape that removes the pressure: seed a value of a DIFFERENT, REGISTERED type — the cache types it, so nothing degrades and nothing is recorded, while ContentAs<T> still answers null because it recovers a foreign runtime type only when the short name matches. That is the production case (a same-named record from another collectible assembly), so the fixture gets stronger; malformed JSON with no resolvable $type models the OTHER defect, the one the gate reports. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

🟡 Changes recommended

The updated gate script currently greps all files recursively without excluding binary artifacts in collected-logs/, which can cause false positives and misleading output (and the control test has a brittle construction-count heuristic).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR fixes the CI “untyped content degradation” gate so it can actually trigger by ensuring the degradation diagnostics reach the shard trace sink, and makes the gate more robust by keying on an exception type name (event identity) in addition to the prose phrase. It also adds a reachability control test and documents the blind spot and its resolution.

Changes:

Attach a purpose-built (never-thrown) MeshNodeContentDegradedException to degradation warnings so they satisfy the trace sink’s admission predicate.
Update check-untyped-content.sh and its control test to key primarily on the exception type name (with the phrase retained as a secondary net).
Add a production-path reachability test plus supporting documentation/What’s New entry.

File summaries

File	Description
`src/MeshWeaver.Hosting/MeshNodeStreamCache.cs`	Attaches the marker exception at all degradation seams and exposes internal seams for testing.
`src/MeshWeaver.Data.Contract/MeshNodeContentDegradedException.cs`	Introduces the marker exception type used as the gate’s identity key.
`.github/scripts/check-untyped-content.sh`	Updates the gate to scan for marker type name and phrase, and improves reporting.
`test/MeshWeaver.Documentation.Test/UntypedContentDegradationGate.cs`	Extends the control test to pin the script’s marker key and enforce seam coverage.
`test/MeshWeaver.Hosting.Test/UntypedContentDegradationReachesTheTraceSinkTest.cs`	Adds a production-path reachability control that evaluates the sink predicate on captured records.
`src/MeshWeaver.Documentation/Data/Architecture/ReadingCiSignals.md`	Documents the third instance of the sink blind spot and the new controls.
`src/MeshWeaver.Documentation/Data/WhatsNew/2026-09-07-a-content-type-nobody-registered-can-no-longer-slip-through-ci.md`	Adds a user-facing “Fix” entry describing the CI behavior change.

Review details

Files reviewed: 7/7 changed files
Comments generated: 4
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

rbuergi · 2026-09-07T21:44:44Z

 set +e
-matches=$(grep -rl "$PHRASE" "$DIR" 2>"$scan_err")
+matches=$(grep -rl -e "$MARKER" -e "$PHRASE" "$DIR" 2>"$scan_err")
 scan_rc=$?


Adopted, with a different instrument — and applied to both greps in one shared EXCLUDES array so they cannot drift.

The concern is real: dotnet-test.yml copies /tmp/coredumps/*.dmp into collected-logs/, plus a symbols-<project>/ directory of .dll + .pdb whenever a host dies on a signal. A core dump is a snapshot of process memory, so it can contain the marker simply because the process once formatted it — a match there is not a log record.

I did not use -I, and the reason is the same rule this whole script exists to enforce. -I decides by CONTENT: a text log carrying one stray NUL byte becomes invisible to the scan, silently, and the gate then reports "No content-type degradation" — a pass-by-scanning-nothing, which is the one outcome this file must make impossible. A false red is loud and investigable; a false green is not. Excluding by NAME (--exclude='*.dmp' --exclude='*.dll' --exclude='*.pdb') can only ever skip an extension listed in the open, right there in the script, and the reasoning is written beside it.

rbuergi · 2026-09-07T21:44:45Z

+# Both record shapes name the node: the log message says "Content for <path> stayed …", the
+# exception says "content for '<path>' (nodeType …)". Reduce either to the path.
+grep -rh -e "$MARKER" -e "$PHRASE" "$DIR" 2>/dev/null \
+  | sed -E -e "s/.*Content for ([^ ]+) stayed.*/  \1/" \
+           -e "s/.*content for '([^']*)'.*/  \1/" \
  | sort | uniq -c | sort -rn | head -20


Yes — that was the second half of it, and the fix covers both call sites: the EXCLUDES array is applied to the grep -rl scan and to the grep -rh Occurrences pass, so a binary artefact can neither red the gate nor emit a Binary file … matches line that the sed path-extraction cannot reduce.

(Name-based rather than -I — see the reply on the scan line for why deciding by content is the wrong direction in this particular script.)

rbuergi · 2026-09-07T21:44:46Z

+        var source = Read(EmittingSource);
+        var constructions = source.Split('\n').Count(l => l.Contains("new " + Marker, StringComparison.Ordinal));
+


Fixed, and taken one step further than suggested, because a regex alone would have left the second half of your point live.

MeshNodeStreamCache.cs is a file that explains itself at length, and its comments name MeshNodeContentDegradedException repeatedly — so "fooled by a comment" is the normal case here, not the edge case. The count now runs over SourceScan.MaskCommentsAndStrings(...) first (the helper every other source ratchet in this repo uses, which blanks comments and string literals while preserving offsets), and then matches:

\bnew\s+(?:[A-Za-z_][\w]*\s*\.\s*)*MeshNodeContentDegradedException\s*\(

which also handles the wrapped-across-lines and alias-qualified forms you named. Verified green in the full MeshWeaver.Documentation.Test suite (325/325, Release).

rbuergi · 2026-09-07T21:44:48Z

+        public IDisposable BeginScope<TState>(TState state) where TState : notnull => NullScope.Instance;
+
+        public bool IsEnabled(LogLevel logLevel) => true;
+


Adopted — plus the change that actually fixes the brittleness you describe, because narrowing IsEnabled on its own would have been a no-op here.

LoggerExtensions.LogWarning(...) and friends call ILogger.Log(...) unconditionally; they do not consult IsEnabled. This recorder's Log recorded everything it was handed, so IsEnabled was never on the path under test — an added Info/Debug line would still have broken Assert.Single.

What makes the control robust is filtering the asserted population by the sink's own predicate:

Assert.Single(logger.Records.Where(ReachesTheTraceSink))

Assert.Empty(logger.Records.Where(ReachesTheTraceSink))

A future Info/Debug record — which the sink drops anyway, so it says nothing about reachability — can no longer fail these; a second warning-with-exception still does, because two records reaching the sink is a real change to what CI sees.

Your suggestion is in as the other half: IsEnabled is now >= LogLevel.Warning and Log honours it, so the recorder is a faithful logger rather than a tee, and what it holds is what the sink would consider.

github-actions · 2026-09-07T16:35:35Z