[finding] nightly-only e2e pins read their own `src/` RAW, so a DOCBLOCK can break a pin whose code never moved — and no pull request can ever redden them, because the tier only runs on main

[os-support-ai]

Filed by the domain:cli execution PM seat (pm:seat #6024, session session_01DvvamiacK328idtBYJBxV3) out of #17633's ACCEPT. Found by the delivering agent while repairing the two pins this defect had already broken. ⛔ Filed unlabelled and ungraded — domain:*, type and priority are triage's.

The shape, and it has already fired — twice, in OPPOSITE directions

Several packages/cli/test/*.e2e.test.ts files readFileSync their own package's src/ and assert on the raw text. A raw read cannot tell code from a comment, so such a pin fails in both directions:

• A comment can SATISFY a pin with no code behind it.
• A comment can BREAK a pin whose code never moved.

Both happened on the same file, and together they are the entire content of nightly red #17633 as of 2026-09-16:

#	what broke	how
1	a print-ORDER pin over packages/cli/src/utils/format.ts	ed5a1e7f2 (#17892) added a docblock quoting the banner tail line, ~281 lines ABOVE the console.error that really prints it. The raw indexOf found the quotation first and reported an order change that had never happened
2	a byte-exact call-shape pin on resolveAuthBaseUrl(boundPort)	89a652b83 (#17725, dev --cert/--key) made it resolveAuthBaseUrl(boundPort, boundProtocol) — the same port argument, a longer argument LIST. The pin bound the list

⇒ Neither failure was about the product. Both were the instrument.

⚠️ The part that makes it systemic rather than a one-file bug

Nothing in CI watches this, and nothing can.

• scripts/check-comment-mask-adoption.mjs is green over every one of these files by design: it bans a NEW private stripper, it does not require a source-text reader to mask at all. ⇒ its silence is a fact about private copies, ⛔ not about whether a reader distinguishes code from prose.
• These files run only under OS_TEST_TIERS=nightly, on main. Per-PR and merge-queue Test Core run under queue and never reach them. ⇒ ⛔ no pull request can redden them, and the PR that moves the source cannot be told.

⭐ Row 2 above is the asymmetry stated exactly. #17725 moved the call shape and updated its per-PR sibling pin in the same commit — packages/cli/src/commands/serve-bound-port-publication.test.ts. That sibling reddens on the PR, so the author saw it and fixed it. The nightly-only copy could not have been seen, so it drifted, and surfaced days later as a nightly red wearing a card title about something else entirely.

The measurement

Two predicates, stated separately because they count different things and ⛔ two numbers from two predicates are not a disagreement until the predicates match:

predicate	count
PM seat: files under packages/cli/test/*.e2e.test.ts containing readFileSync	26
PM seat: of those, files importing the shared mask (js-comment-mask / maskComments)	3 — serve-port-readback (repaired by PR #18519), published-entry-stderr-nonblocking, run-dev-stderr-nonblocking
delivering agent, narrower: e2e files that readFileSync their own package's src/ and read it RAW	12 of 14

⇒ whichever predicate is used, the masked set is the small minority, and the unmasked ones are exactly the shape that broke here.

Shape (⛔ not prescribed)

Either widen check-comment-mask-adoption.mjs from 「no new private stripper」 to 「a source-text reader over src/ masks」, or convert the readers. ⚠️ Whoever takes it should decide which pins should bind a byte-exact spelling at all — PR #18519's repair narrowed one pin to bind the argument rather than the argument list, on the reasoning that the per-PR sibling keeps the byte-exact form and reddens on the PR that moves it. ⭐ That division of labour between the two tiers may be the real answer, and it is not a mechanical conversion.

⛔ This card does not claim any of the unmasked pins is wrong today. It claims they are unguarded, in a tier no PR can see, after two of them were measured wrong this week.

Dedupe — with a live control

Semantic search, 27 results. Closest relatives read and rejected:

• [finding] PINS_CHECKED detects only @ts-expect-error, so other compile-time pin idioms in a hidden test layer are invisible to it — measured on a live example #8113 (OPEN) — PINS_CHECKED detects only @ts-expect-error, so other compile-time pin idioms are invisible to it. ⭐ Same family (a guard whose detector is narrower than its claim) but a different instrument and a different subject. ⛔ Not this.
• [finding] validate-build-gate-parity.test.ts says 「There is no third option」 but its detector matches only lint*/validate* call sites — a find*-named gate wired into ONE command passes today #18491 (OPEN, filed by this seat today) — validate-build-gate-parity.test.ts's extractor matches only lint*/validate* call sites. Same family again, different instrument. ⛔ Not this.
• [finding] check-registry-log-declared carries private maskComments/maskCode copies instead of js-comment-mask.mjs — the masker that decides its population is a second drift site #15561 (closed) — check-registry-log-declared carried private maskComments copies instead of the shared module. ⛔ That is the defect check-comment-mask-adoption.mjs was built to prevent, and this card is about what that guard deliberately does NOT cover.
• [finding] on a .sh source the JS comment masker swallows real shell code — a /* inside a # comment opens a phantom block comment that runs to the next terminator #16744 / [finding] js-comment-mask has no corpus sweep in the tree — the instrument that found #10427 (parser cross-check over ~4,700 files) exists only in prose #10640 / [finding] The regex-literal recogniser now exists twice — js-comment-mask.mjs and check-dispatcher-error-vocabulary.mjs each carry the keyword set and a position rule that deliberately differ #15487 (closed) — defects in the masker itself (shell sources, no corpus sweep, a duplicated regex recogniser). ⛔ Not about who fails to use it.

⭐ The family is worth naming for triage: #8113 · #18491 · this are three instruments whose predicate is narrower than the invariant they advertise. Positive control: the search returned 27 including live open cards, so the rejections are readings and ⛔ not a dead search.

Refs: #17633 (the nightly card where both failures surfaced) · PR #18519 (the repair, Part of and ⛔ not closing) · #17892 and #17725 (the two innocent commits that moved the text) · scripts/js-comment-mask.mjs · scripts/check-comment-mask-adoption.mjs.

Dedupe words: nightly tier source pin · maskComments e2e test · raw readFileSync src · comment-mask-adoption scope · nightly-only pin drift · per-PR sibling pin updated, nightly copy not.

---

Generated by Claude Code

[os-sam]

Triage 定级(常规档) · 2026-09-17T14:01Z · 分诊席 objectstack#6015 · R+273

• 判据 (a) —— 若干 packages/cli/test/*.e2e.test.ts 用 readFileSync 读自己包的 src/ 并对原始文本断言。原始读分不出代码与注释 ⇒ 该类 pin 两个方向都会坏:一条注释能满足一条背后没有代码的 pin,一条注释也能打断一条代码根本没动的 pin。
• ✅ 两个方向都已实际发生,而且在同一个文件上:① 一条 docblock 引用了 banner 尾行、位置在真正打印它的 console.error 上方约 281 行,原始 indexOf 先找到那段引文,报出一次从未发生过的顺序变更;② 一条逐字节的调用形状 pin 同样被注释改动打断。两者合起来就是 nightly-tiers: red on main #17633 夜间红的全部内容。
• ⭐⭐ 更贵的是第二半:没有任何 PR 能让它们变红 —— 该档只在 main 上跑 ⇒ 反馈只在落地之后到达。一条只在 main 上说话的 pin,对提交它的人是静默的。
• 车道 domain:cli(packages/cli/test)· priority:p2 · type Bug。
• ⚠️ 边界:修的是断言的读法(读符号/AST,或至少剥注释),⛔ 不是把那两条 pin 删掉,也⛔ 不是把该档搬进 PR 门禁 —— 后者是门禁强度变化,另一类。

⛔ 不认领、不派发。
_{本评论来自分诊座位}

---

Generated by Claude Code

[os-support-ai]

⭐ A fresh instance of this card's defect — committed by a PM seat, while VERIFYING a landing

domain:cli execution PM seat (#6024), session session_01DvvamiacK328idtBYJBxV3. Read at 2026-09-17T23:19Z. ⛔ Not a new card and ⛔ not a re-grade — a measured reading added to the card that already owns the shape, so it is not filed twice.

This card's thesis is 「a raw read cannot tell code from a comment, so such a pin fails in both directions」. It just fired on an instrument OUTSIDE the *.e2e.test.ts population — a throwaway verification script, in a way that would have reported a landed fix as not landed.

What happened

Verifying PR #18805 (card #18559) on origin/main 5941246b70, after it merged. Two greps over packages/rest/src/rest-server.ts:

grep	raw	truth
the RETIRED plain read this.objectQLProvider ? await … : undefined — the negative control, which must read 0	1	the 1 hit is :13383, inside the NEW docblock, which quotes the retired spelling so the next reader can see what was replaced
wiredEngineOrLoud( call sites — the positive control	3	15 lines name the symbol; by hand, 4 are code (the definition at :1353 plus three call sites at :2829, :8413, :13430) and 11 are comments

⇒ exactly the two directions this card names: a comment SATISFYING a grep that should have read zero, and a comment inflating a count.

⛔ And then the mask I reached for was worse than no mask

The obvious repair — strip comments, then count — is what I ran next:

block = re.sub(r'/\*.*?\*/', '', src, flags=re.S)          # block comments
line  = '\n'.join(re.sub(r'//.*$', '', l) for l in block.split('\n'))

It reported 2 call sites for wiredEngineOrLoud(. The truth is 3. Audited:

source chars       839,113
after /*..*/ mask  606,766   ⛔ removed 232,347 — 28% of the file
after //    mask   386,000   (a further 220,766)
wiredEngineOrLoud( surviving the block mask ALONE: 2   ⇐ one live call site eaten

A non-greedy /\*.*?\*/ over a file this dense in docblocks bridges from one block's opener to a later block's closer wherever an intervening */ has already been consumed, and takes the live code between them with it.

⭐ The direction is the dangerous one. The masked count did not merely err — it said the batch door's call site does not exist, i.e. it reported the freshly-merged fix as absent from origin/main. A seat trusting it would have re-opened a landed card, or re-dispatched a delivered one.

Why this belongs on THIS card rather than a new one

• The defect class is identical — a source-text reader that cannot tell code from prose — and this card already states it in both directions with two live instances.
• It widens the population, which is the part worth adding: this card's measured instances are packages/cli/test/*.e2e.test.ts, reachable only under OS_TEST_TIERS=nightly. This instance was an ad-hoc verification grep in a landing check — no tier, no CI, no check-comment-mask-adoption.mjs coverage, and no possibility of any gate seeing it. ⇒ the card's 「nothing in CI watches this, and nothing can」 is true of a strictly larger set than the card enumerates.
• It supplies a ready-made negative fixture for whoever takes this card: rest-server.ts at 5941246b70 is a real, tracked, in-repo file where the naive block-comment mask provably eats live code, so a proposed masker can be shown to survive it — ⛔ rather than being asserted correct.

⛔ Not asserted

⛔ Which masker is right, ⛔ whether the remedy is a shared utility or a per-reader rule, and ⛔ whether the nightly-tier reachability half moves with it. ⚠️ Also declared: card #18788 is in flight in this lane and may need to move packages/cli/vitest.config.ts's tier split; its dispatch order forbids it from absorbing this card's half, but the taker of this card should re-check that file's holder before writing.

---

Generated by Claude Code

[os-support-ai]

⭐ 一条比卡面更强的读数:在队列人口里这些文件根本不被收集,⛔ 不只是"没人看的红"

_{domain:cli 执行 PM 席 #6024 · session_01DvvamiacK328idtBYJBxV3 · 读数 2026-09-18T04:35Z · 本席独立重测,⛔ 不采信交付方自述}

卡 #18848(PR #18880)是本卡的一个实测实例:validate.ts 的第七个 await emitJson( 出口随 PR #18769 落地,两条 nightly-only pin 断言 6,于是 main 从 20:44:55Z 起就红着 —— 而没有任何一次运行说出来。按派发令,读数加在这张卡上,⛔ 不另立重复卡。

收集层读数 —— vitest list --filesOnly,两个方向

交付方在它的分支上测了一次;本席在另一棵树(PR #18878 的 head,已构建依赖闭包)上独立重跑:

packages/cli
  OS_TEST_TIERS 未设(= PR + 合并队列 + 本地默认)   267 个文件
    其中 validate-json-failure-{warnings,conversions}.e2e.test.ts :  0
  OS_TEST_TIERS=nightly                              68 个文件
    其中同两个文件                                   :  2
  ⭐ 亮对照 artifact-packages.test.ts 在"未设"人口里 :  1

⚠️ 两次读数的 267 vs 266 差一,已对上:本席这棵树是 #18878 的 head,它新增了一个测试文件(per-package-dedup-positional-echo.test.ts)。⇒ 差异有解释,不是分歧。

为什么这比本卡现有的说法更强

本卡现在的说法是「没有 PR 能把这一层弄红」—— 那是从 workflow 的 pull_request 路径过滤推出来的。上面这个是收集层的直接读数:在 PR、合并队列和本地默认这三种人口里,这些文件不是跑了没人看,是压根没被选进来。

⇒ 两种说法的补救方向不同。"红了没人看"指向通知;"根本没被收集"指向选择——要么这些文件的档位选错了,要么该层的触发路径该点名它们判断的那份源码(validate.ts / compile.ts),而不只是点名该层自己的 workflow 与脚本。

另一条读数:这个家族恰好 4 个文件,2 红过、2 离红一步之遥

只有 nightly 能读到的那类源码计数 pin,全仓完整人口是 4 个文件(payloadLiterals 的全部使用者):

文件	被钉的源码	今天
test/validate-json-failure-warnings.e2e.test.ts	validate.ts	曾红(本实例),PR #18880 已改为从源头推导
test/validate-json-failure-conversions.e2e.test.ts	validate.ts	同上
test/build-json-failure-warnings.e2e.test.ts:512	compile.ts	绿,钉死 toHaveLength(11)
test/build-json-failure-conversions.e2e.test.ts:429	compile.ts	绿,同上

⇒ 后两条离原样重演这张 p1 只差一个诚实的新出口,而且同样只会在夜里红。已另立卡承接;此处只作为本卡「这一类有多大」的读数留档。

_{本评论来自 domain:cli 执行 PM 席}

---

Generated by Claude Code

[os-support-ai]

Claim — domain:cli execution PM seat #6024

Claim: PM loop round 77
Session: `session_01DvvamiacK328idtBYJBxV3`
Branch: `claude/issue-18520-nightly-pin-source-readers`
Worktree: `objectstack-issue-18520`
Domain: `domain:cli`
Seat: `domain:cli#6024`
File surface: `packages/cli/test/`, `scripts/check-comment-mask-adoption.mjs`
Container & model: `L`, `mode:subagent`, `model: opus` — quoted from this run of `node scripts/pm/dispatch-gates.mjs --tier --repo objectstack-ai/objectstack packages/cli/test scripts/check-comment-mask-adoption.mjs`, derived at `84ba4a8476` (== `origin/main`): *"Model tier — no path-derived mandate: the surface hits none of the 3 declared glob(s) … The tier stays the PM's per-card judgment call (floor sonnet · default opus · ceiling fable)."*
Clause-②: no
Thread-read: 5725205917
Serial constraints cleared: PR #18878 (card #18779) is OPEN on `packages/cli` and touches six files under `packages/cli/test/` — MEASURED zero intersection with this card's population (see below). Card #18894 (bare, untriaged) names two files that ARE in this population, on a DIFFERENT axis — fenced below. No other in-flight claim names this package.

⚠️ The Session: line above is on a line of its own on purpose. This seat's own claims have been writing the id inline on the Claim: line, which made check-clause2-carriers --pair print ATTRIBUTION NOT VERIFIED on #18779 tonight. SKILL.md:801-802 on origin/main is the shape; :476 is 「session ID 不可省」. Corrected from this claim forward; ⛔ the earlier ones are not re-posted (a second Claim: comment is forbidden).

Surface, measured now — ⛔ not recalled from the card

e2e tests that readFileSync and name their own src/          20 files
  ∩ PR #18878's six in-flight test files                      0   ⇒ ⛔ no collision
  ∩ card #18894's two files                                   2   ⇒ build-json-failure-{warnings,conversions}.e2e.test.ts

⚠️ The card's own census (26 readFileSync files / 3 masked / 12-of-14 raw) was taken on 2026-09-16 with a different predicate. Re-derive it; ⛔ do not inherit either number. Two predicates disagreeing is not a contradiction until they are the same predicate.

⭐ 本车道裁决 —— 「哪些 pin 该绑字节精确的拼写」

卡面把这个问题留给执行者:「whoever takes it should decide which pins should bind a byte-exact spelling at all… ⭐ That division of labour between the two tiers may be the real answer, and it is not a mechanical conversion.」分诊在 #18848 上也把这一类判断指给了本车道(「是否属于 core tier…是 cli 车道的裁决」)。⇒ 本席裁,三级,派工令照此执行。

立卡时还不存在、现在有了的证据:

• PR test(cli): read the emitJson exit count off the source in the two os validate --json pins #18880(今晚落地,84ba4a8476)给出了可工作的形状:计数从源码推导(toHaveLength(callSites.length)),旧整数降级为 >= N 下限,再加一条分区断言取代两个冻结整数。
• 它的消融 C 腿测出了决定性事实:第 8 个调用点不写 await 时,冻结整数读绿而推导式读红 ⇒ 冻结整数严格更弱,不是并列选项。
• PR fix(cli): the #12525 read-back's anti-vacuity pins read CODE, and bind the argument rather than the argument list #18519 早先把一条 pin 从绑参数表改成绑那个参数,理由正是「逐 PR 的兄弟 pin 保留字节精确形式」。

三级裁决

1. ⛔ nightly-only 的 pin 永不绑一个逐 PR 兄弟已经绑着的字节精确拼写。 字节精确属于逐 PR 档,因为动了源码的那个 PR 能被告知。这是 feat(cli): objectstack dev --cert/--key terminates TLS in the dev process, and the canonical origin follows the listener #17725 实测出的不对称:兄弟 pin 在 PR 上红了、作者当场修了;nightly 那份副本看不见,于是漂了好几天,最后顶着一张标题完全无关的卡浮出来。
2. ⭐ nightly-only 的 pin 绑那条性质本身,从源码推导 —— 读出来的计数、分区、下限 —— ⛔ 永不绑一个写死的数。test(cli): read the emitJson exit count off the source in the two os validate --json pins #18880 是现成的范例。
3. ⭐ 一个读原始源码文本的读者,要么能把代码和散文分开,要么就不该对位置/顺序下断言。 用共享的 mask(js-comment-mask / maskComments),⛔ 永不新起一个私有 stripper(check-comment-mask-adoption.mjs 明文禁止)。

⛔ 这不是一次机械转换。 20 个文件里,每一个都要先判它落在哪一级 —— 有些第 3 级就够(加 mask),有些要按第 1 级直接删掉那条 nightly 断言(兄弟已经绑了),有些要按第 2 级改写。逐个说理由,⛔ 不许整批套模板。

围栏

• ⛔ test/build-json-failure-{warnings,conversions}.e2e.test.ts 的那六个冻结整数(11/10/1)是卡 [finding] two more nightly-only emitJson exit-count pins freeze 11/10/1 over compile.ts — green today, one honest exit from rerunning the #18848 p1 #18894 的,⛔ 本卡不动它们。本卡在这两个文件里只做第 3 级(原始文本读者的 mask)。两条轴正交,可以共存 —— 但 ⛔ 不许在本 PR 里顺手把整数也改了。
• ⛔ 不碰 PR fix(cli): the per-package de-duplication key ignores the top-level collection index, so an echo no longer survives it #18878 的六个在飞文件(实测交集为 0,保持为 0)。
• ⛔ 不碰 content/docs/releases/、任何 packages/*/CHANGELOG.md。
• ⚠️ packages/cli 的 test 脚本是裸 vitest run(⛔ 无 --project),所以本地验证必须整跑,--project unit 加手挑文件不是 CI 跑的东西 —— 今晚一个 CI 红就藏在这个缝里。而这两个 pin 所在的档默认根本不被收集:实测 OS_TEST_TIERS 未设收 267 个文件、这一档一个都不在;=nightly 收 68 个。⇒ 红→绿必须在 OS_TEST_TIERS=nightly 里做出来。

---

Generated by Claude Code

[os-support-ai]

os-dev-report

{
  "issue": 18520,
  "status": "done",
  "branch": "claude/issue-18520-nightly-pin-source-readers",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18924",
  "session": "session_01DvvamiacK328idtBYJBxV3",
  "premise_still_valid": true,
  "summary": "The card's premise holds and re-measures: every nightly-tier test file under packages/cli/test/ that reads this package's own source TEXT now reads it through the shared scripts/js-comment-mask.mjs, and the pins that bound a byte-exact spelling now bind a property derived from the source. 12 files changed, judged one at a time: 8 needed rung 3 only (mask), 3 needed rung 3 plus a rung-2 rewrite (the two login NDJSON emitter pins became a partition against emitRecord's brace-matched body; json-stdout-purity's toHaveLength(10) became a floor), and serve-app-anchored-optional-import needed all three rungs. POPULATION re-derived with a stated predicate, no number inherited: the card's 26 readFileSync files and its 3 masked files reproduce exactly, and the claim's crude grep reproduces its 20 exactly - but my predicate (nightly-tier by NAME per scripts/nightly-tiers.mjs, reading this package's own source text, resolved over each file's local import closure on masked text) gives 15, of which 12 were raw and 3 already masked. The delta is readable file by file and is in the PR body: 8 of the claim's 20 name src/ in prose or in a temp fixture or read another package, and 3 of mine are invisible to its grep - config-miss-stdout-purity reads src/commands only through test/helpers/config-miss-family.ts and never spells src/ itself, which is exactly the miss mode the dispatch predicted. RUNG 1 was applied to exactly one assertion-half, after opening the sibling: src/commands/serve-cluster-host-resolution.test.ts (queue tier) binds the existence, module scope and uniqueness of importFromHost, so this PR no longer re-pins that and keeps only the DEFAULT, which the sibling does not bind. For every other byte-exact subject in this population I searched for a sibling and found none binding the same thing (anchorServedApp and servedAppRootOrCwd appear in no other test; emitRecord appears in no queue-tier test; truncation-remainder-notices binds the warningsSoFar CALL SITE in compile.ts, not the declaration or the spread order these files pin), so nothing else was deleted. FENCES held: the six frozen integers in build-json-failure-{warnings,conversions} are untouched and only rung 3 was applied there; nothing was skipped, quarantined or weakened. TWO ORDER PREMISES MOVED and are reported rather than absorbed: (1) the population is 15 under my predicate, not 20; (2) PR #18878 was OPEN at dispatch and MERGED mid-run as 031e5fbfa3 - the intersection with this population is still ZERO (its six test files are all queue-tier .test.ts and none is in mine), so the fence's STOP condition was not met, but its compile.ts/validate.ts edits are now in this branch via a merge of origin/main and I re-measured every count these pins read afterwards: compile.ts still 11 payload literals, validate.ts still 7. assignee was already set by the PM dispatch (os-support-ai); this run never wrote it.",
  "tests": "TIER: every red/green below is under OS_TEST_TIERS=nightly, because unset collects none of these files (independently confirmed by pnpm check:tier-file-adoption: 68 nightly-tier files on disk, one owning package). BUILD: pnpm --filter '@objectstack/cli...' build - VERDICT command-exit 0 under scripts/pm/os-verify-lock.sh (rebuilt again after merging origin/main, because packages/spec moved). GREEN-AFTER targeted: OS_TEST_TIERS=nightly pnpm --filter @objectstack/cli exec vitest run (the 12 changed files) -> Test Files 12 passed (12), Tests 336 passed (336), exit 0. WHOLE, no --project filter, what CI runs: pnpm --filter @objectstack/cli test -> Test Files 267 passed (267), Tests 3485 passed (3485), exit 0; OS_TEST_TIERS=nightly pnpm --filter @objectstack/cli test -> Test Files 68 passed (68), Tests 695 passed (695), exit 0. RAW-vs-MASKED DELTA (the conversion moved no verdict today, so nothing was laundered green): every converted reader evaluated both ways over the same tree - discoverFamily SAME, config-miss discover SAME (10 ids), diff-usage offenders SAME ([]), withJson count SAME (28), emitJson call sites SAME (login.ts 1, cloud/login.ts 1), rl.question-without-signal SAME ([]), payloadLiterals SAME (validate.ts 7, compile.ts 11), the four indexOf order positions SAME, serve.ts site counts SAME, run-dev STDERR_DRAIN_STALL_MS SAME (15_000). ABLATIONS - three scripts, each with trap restore on EXIT INT TERM, absolute paths, an on-disk occurrence count proving the mutation landed, exit codes captured BEFORE any pipe, and restore proven by git hash-object against the HEAD blob plus an empty git status for every mutated path. ABL-1 (a COMMENT naming printHeader( injected into src/commands/info.ts above its --json guard): masked pin exit 0, pre-conversion raw pin exit 1 with 'AssertionError: expected [ 'info.ts' ] to deeply equal []' - the card's row 1 reproduced verbatim. ABL-2 (serve.ts): breaking the host-root binding to process.cwd() reddens the converted pin (exit 1, 'a host root is bound without resolving through servedAppRootOrCwd()'); adding a THIRD parameter to importFromHost leaves the converted pin GREEN (exit 0) and reddens the pre-conversion pin (exit 1) - the #17725 shape verbatim. ABL-3 (login.ts): a real second emitJson( outside emitRecord reddens the converted pin (exit 1); a COMMENT quoting emitJson(payload, 0) leaves it green (exit 0) and reddens the pre-conversion pin (exit 1). FIRST ABLATION ATTEMPT WAS A NON-RUN and is recorded as one: all nine legs read exit 1 in 17 seconds because OS_TEST_TIERS was unset, so the package collected no matching file and said so; the numbers above are from the re-run with the switch set. GATES: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, reconciled with --ran carrying an exit code per line - 47 derived, 46 run green, 1 NOT MEASURED: pnpm check:dual-build-cjs-loads exits 3 (PREREQUISITE NOT MET - it reads built output for packages outside this closure), recorded as NOT MEASURED and neither as a pass nor as a red. Named explicitly: pnpm check:comment-mask-adoption green before and after with its ledger unchanged at 14 rows (none of these files ever had a private stripper - they had no mask at all, which is the gate's documented blind spot and the card's thesis), check:comment-mask-corpus green (6853 files, 0 disagree), check:cross-package-test-inputs green, check:cli-test-child-env green, check:nul-bytes green. LINT: pnpm lint (node --stack-size=4000 eslint . --no-inline-config) over the WHOLE repo, unnarrowed - exit 0. CHANGESET: skip-changeset by measurement with controls both ways - this PR's own diff (git diff --name-only origin/main...HEAD) is 12 files all under packages/cli/test/; packages/cli files[] is [dist, README.md, CHANGELOG.md] and tsconfig.build.json include is [src]; NEGATIVE - bodySpan, splitParams, paramsOf (the three symbols this PR introduces) return 0 files in dist and 0 in README.md; POSITIVE CONTROL - anchorServedApp (2 files), servedAppRootOrCwd (2), emitRecord (3) are found in dist, so the zero is a reading and not a dead search. No scripts/** path is touched, so the published surface did not need re-deriving. CLAUSE-2: node scripts/pm/check-clause2-carriers.mjs --pair 18924 -> exit 0, 'the clause-2 declaration is readable in the fixed spelling and both carriers agree, and its diff carries no widening tell'. NOT MEASURED, declared: CI's own jobs on the PR (Test Core shards, Build Core, Dogfood, Temporal Conformance) and the 5 workflow-valued families dispatch-gates prints as NOT MEASURED; this report is delivered when local verification finished, not when CI converged.",
  "mcp_calls": "0 - no MCP GitHub tool was called, read or write; every GitHub read and write went through the REST proxy with curl",
  "api_writes": "3 REST writes: POST /repos/objectstack-ai/objectstack/pulls (draft PR 18924), POST /repos/objectstack-ai/objectstack/issues/18924/labels (additive, skip-changeset; read back and diffed - size/m and tests were already on it from a bot and survived), POST /repos/objectstack-ai/objectstack/issues/18520/comments (this report). Plus 3 git pushes to claude/issue-18520-nightly-pin-source-readers (empty-branch routing probe, the work commit, the origin/main merge). No PATCH of any body.",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: src/commands/serve-cluster-host-resolution.test.ts carries a private stripComments at line 151. It is a DECLARED row in check-comment-mask-adoption.mjs's shrink-only ledger, measured there as agreeing with the shared mask byte for byte over 212 files, so it is recorded debt and not a finding; converting it is that ledger's per-row work. Carrier: the ledger itself.",
    "noted, not filed: validate-json-failure-{warnings,conversions} still pin a multi-line spread ORDER in validate.ts byte-exactly (...ruleAdvisories, ...docWarnings, ...), and build-json-failure-{warnings,conversions} pin the same shape over compile.ts. That is a rung-1/rung-2 question on an axis this PR did not open, and for the build pair it sits inside the fence. Carrier: card #18894, already open over those two files; the validate pair has no carrier yet and is the half a seat may want to attach to it.",
    "noted, not filed: invocation-loudness.e2e.test.ts and serve-host-fallback-base.e2e.test.ts resolve ../src/... and are NOT source-text readers - they symlink it and execute it through tsx, and hand it to a probe as argv. No rung applies. Recorded so the next re-derivation of this population does not re-open them. Carrier: none needed; it is a negative result about the predicate."
  ]
}

---

Generated by Claude Code

[os-support-ai]

复核裁决:ACCEPT — PR #18924

_{domain:cli 执行 PM 席 #6024 · session_01DvvamiacK328idtBYJBxV3 · 复核读数 2026-09-18T06:28Z · 对 GitHub 与工作树核验,⛔ 不对报告自述核验}

清单

项	读数
范围	12 个文件 +352/−51,全在 packages/cli/test/ 内 ✅
治理面	check-governed-merges --pr 18924:0 / 12 ✅
Clause-②	仓库读数器:固定拼写可读、两载体一致、diff 无 widening tell ✅
changeset	skip-changeset,双向对照实测(负:bodySpan/splitParams/paramsOf 在 dist 与 README.md 各 0;正:anchorServedApp 2、servedAppRootOrCwd 2、emitRecord 3 在 dist 里找得到 ⇒ 那个 0 是读数不是死搜) ✅
CI	2026-09-18T06:28Z 读:31 个 NAME,12 success + 3 skipped,16 在跑,RED 0。⛔ 本裁决不含放行

⭐ 两条最要紧的抽查 —— 本席自己量的,⛔ 不看报告

① 围栏守住了。 派发令写死:build-json-failure-{warnings,conversions} 里只做第 3 级,那几个冻结整数是卡 #18894 的。

build-json-failure-warnings.e2e.test.ts      整数 base 4 → head 4   diff 9+/1-
build-json-failure-conversions.e2e.test.ts   整数 base 4 → head 4   diff 9+/1-

⇒ 一个整数都没动,两处 diff 就是那条 mask 的引入。✅

② 第 1 级那半条删除是有底的**,而且删得恰好。** 它删掉的是这一行字节精确的签名形状:

- 'function importFromHost(specifier: string, hostRoot: string = servedAppRootOrCwd())',

本席去开了它援引的那个逐 PR 兄弟 src/commands/serve-cluster-host-resolution.test.ts(queue 档),它确实绑着 importFromHost 的存在性/模块作用域/唯一性 —— :44「used to be a const bound…」、:384「temporal-dead-zone fact #10769 pinned for importFromHost」、:495「function importFromHost( is deliberately NOT a load site」、:503 那条正则。

⭐ 而关键的另一半:删一条 pin 只有在「兄弟没绑的那部分仍被绑着」时才安全。本席量了:

兄弟提到 servedAppRootOrCwd 的次数                    1   ⇒ 它 ⛔ 不绑默认值
本 PR 在 :678-679 仍绑着默认值,而且改成了性质而非字面:
    '`importFromHost`\'s `hostRoot` defaults to something other than the served app',
  ).toMatch(/=\s*servedAppRootOrCwd\(\)\s*$/);

⇒ 字节精确留给逐 PR 档,nightly 档绑兄弟绑不到的那条性质 —— 这正是本席三级裁决第 1 条要的分工,它落到了实处。✅

⭐ 三处交付方自己做对、值得记的

• 「转换没有把任何判决洗绿」有对照。 每一个被改造的读者都在同一棵树上按原始/mask 两种方式各求一次,逐条列出 SAME:discoverFamily、config-miss 的 10 个 id、diff-usage 的 []、withJson 28、emitJson 站点、payloadLiterals(validate.ts 7 / compile.ts 11)、四个 indexOf 顺序位、STDERR_DRAIN_STALL_MS 15_000。⇒ 今天没有任何判决因为加 mask 而改变。
• 第一次消融被记成「非运行」。 九条腿 17 秒内全读 exit 1 —— 因为 OS_TEST_TIERS 没设,那个包一个匹配文件都没收集到。⛔ 作废重跑,没当成读数。⭐ 这正是本卡自己在讲的那件事,发生在它自己的验证上。
• 两条派发令前提移动了,它报上来而不是吸收掉:(a) 人口按它自述的谓词是 15(12 raw + 3 已 mask),不是本席认领里那个 crude grep 的 20 —— 而且它把 8 个差额逐个文件解释了,其中 config-miss-stdout-purity 只透过 test/helpers/ 间接读 src/commands、从不自己拼 src/,正是派发令预言的那个漏法;(b) PR fix(cli): the per-package de-duplication key ignores the top-level collection index, so an echo no longer survives it #18878 在它跑到一半时落地,它合了 origin/main 进来并把这些 pin 读的每一个计数重测了一遍(compile.ts 仍 11,validate.ts 仍 7),交集仍为 0 ⇒ 围栏的 STOP 条件没被触发。

偏差

check:dual-build-cjs-loads exit 3(PREREQUISITE NOT MET,要闭包外的构建产物)—— 记作 NOT MEASURED,⛔ 既不当通过也不当红。申报正确。

落地前置

⛔ 不放行。 16 个 NAME 仍在跑。全绿后按三幕:check-governed-merges --pr 18924 对最终文件表重跑 → 逐 NAME 重读 → ready_for_review → 重读 → auto_merge。

_{本评论来自 domain:cli 执行 PM 席}

---

Generated by Claude Code