A Postman sandbox script uses bare tests[...] and still passes — why isn't that proof it is current API?

## The mechanism: warn once, then answer Postman's script sandbox is a JavaScript execution environment with a single current entry point: the `pm` object. Everything the current API offers a script — reading the reply, writing a variable, naming a test, steering the run — hangs off that one object. Beside it the sandbox installs a **legacy compatibility layer**, held internally as a `LEGACY_GLOBS` proxy, which keeps the older *bare global* spelling working. When a script touches one of those old names, the proxy does exactly two things, in this order: 1. it emits a **deprecation warning for that identifier name**, once; 2. it **returns the real value anyway**. It does not throw. It does not hand back `undefined`. It does not mark the result as degraded. The script runs to completion and the assertions evaluate. That single design decision is the whole trap, and it is the point of this topic: **an identifier that resolves through a compatibility shim is not evidence that it is current API.** ## What the layer covers The legacy surface is a fixed set of names, not an open-ended alias mechanism. Broadly it holds the old assertion object, the old `postman` command object, two bare reply readers, and a handful of bundled library globals. | legacy spelling | current spelling | |---|---| | `tests["name"] = value` | `pm.test(name, fn)` | | `responseCode` | `pm.response.code` | | `responseBody` | `pm.response.text()` | | `postman.setEnvironmentVariable(key, value)` | `pm.environment.set(key, value)` | | `postman.setNextRequest(name)` | `pm.execution.setNextRequest(name)` | | `tv4`, `xml2Json`, `CryptoJS`, `_` | bundled libraries, reached through the sandbox's module surface | Read that strictly as a **naming map**. It tells you what to write instead; it does not tell you what the right-hand call *does*. Each current name has its own behaviour and its own rules, owned by the surface it belongs to — the variable stores, the named-test recorder, the sequence control. The migration skill this topic is about is narrower and more mechanical: recognising the left column on sight and knowing the right column exists. ## Why a green run tells you nothing - The shim **answers**, by design, so behaviour is preserved. Nothing in the result distinguishes a value read through a legacy global from the same value read through `pm`. - The warning fires on the **first touch of a name**, not on every use. A name read forty times in one script produces one warning line, so the volume of warnings badly understates how much legacy code is actually there. - A warning is a warning. It does not fail an assertion and it does not change what the report records as passing. In a busy console it is easy to miss entirely. - Because the old spelling warns rather than fails, legacy scripts survive for years and get copied forward into new requests by people who reasonably assume that working code is current code. - Nothing in the collection file marks a script as legacy. The script is stored as source text; the sandbox decides at execution time which names it will answer. ## Turning the warning into a failure The sandbox hands the script itself a switch. The pragma `"use sandbox2";`, placed at the top of the script, opts that script out of the legacy layer entirely. With it in place the old names are simply not installed, so a bare `responseCode` is an undefined identifier and the script fails outright instead of quietly succeeding. That inverts the signal you get. Without the pragma, legacy usage shows up as a passing run plus a console line you may never read. With it, legacy usage shows up as a failing script that names the line. It is the difference between an advisory and a check. ## Reading a script you did not write 1. **Scan for the `pm` prefix.** Current script API is reached through `pm`. A bare identifier that is not a JavaScript builtin and not a variable the script declared is a candidate legacy global. 2. **Read the console output of one run.** First-touch warnings name the identifiers the layer answered. Treat the list as a floor, never a total. 3. **Add the pragma to prove the negative.** A script that still passes with `"use sandbox2";` at the top genuinely does not depend on the layer. 4. **Rewrite name by name** using the map above, rather than rewriting the logic, so the change stays reviewable. The honest summary for an interview: the old spelling still runs, the sandbox tells you so exactly once, and "it works" is the one piece of evidence that carries no information here.