Four in-tree test fixtures, two different roots: three use `packages/cli/tmp/` (already ignored), one needs a bespoke ignore rule — decide which is the convention

[os-litant]

Filed unassigned and ungraded by the domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd, out of the #12583 dev's second open question. ⛔ Not graded, not routed. ⚠️ Nothing here is broken — this is a convention question the tree currently answers two ways.

Measured

mkdtempSync appears on 359 lines repo-wide. Exactly four create a directory inside the tracked tree, all under packages/cli/:

file	root	ignored by
test/init-scaffold-authoring-rules.test.ts:63	packages/cli/tmp/	.gitignore:53 tmp/
test/init-template-comments-self-contained.test.ts:92	packages/cli/tmp/	.gitignore:53 tmp/
test/serve-no-artifact.e2e.test.ts:148	packages/cli/tmp/	.gitignore:53 tmp/
test/serve-node-env-production-default.e2e.test.ts:436	packages/cli/test/	⚠️ PR #12631's bespoke packages/cli/test/tmp-node-env-default-*/

⇒ three of four already share a root that costs zero ignore surface; the fourth needed a rule of its own.

⭐ Why the outlier is not simply wrong

Its root is deliberate and documented (:217–222): the generated config does a real, static import, which resolves only because the directory has a node_modules ancestor — "a fixture rooted in os.tmpdir() has no such ancestor and the import fails."

⚠️ But that reason does not distinguish the two in-tree roots. packages/cli/tmp/ has exactly the same node_modules ancestor that packages/cli/test/ has. ⇒ the documented constraint rules out os.tmpdir(); it does not rule out the root its three siblings already use.

What is actually being asked

⭐ A fifth fixture author has to choose, and the tree answers two ways. Either:

• A — packages/cli/tmp/ is the convention. Move the outlier there, delete PR #12631's bespoke entry, and say so in the docblock so the next author does not re-derive the choice. ⚠️ This moves a fixture whose placement is deliberately documented, so the docblock must be updated in the same diff — ⛔ a moved root under an unchanged "why this root" comment is worse than either state.
• B — the in-test/ root is the convention and the three siblings are the drift. ⚠️ Then tmp/ covering them is an accident rather than a decision, and that should be written down too.
• C — both are fine; record that in one place so it stops looking like an inconsistency.

⛔ Do not pick by tidiness. The question is whether the static-import constraint has any bearing on the choice between the two in-tree roots. ⭐ Measured above: it does not — which makes this a naming/consistency call, not a technical one.

⛔ Explicitly not in scope

• Moving anything to os.tmpdir(). The docblock's reason is real and measured; ⛔ that direction is closed.
• Widening .gitignore to a class pattern. PR #12631 measured that the population is one uncovered outlier, so a class pattern would be ignore surface bought for nothing — and an over-broad ignore that hides a real test file is strictly worse than the leak it prevents.

⚠️ Whichever way it goes, keep the property PR #12631 proved

A leftover in the tracked tree does not merely risk a git add -A. Measured on that PR: with the leftover present and no ignore rule, scripts/pm/dispatch-gates.mjs gains 18 spurious families. ⭐ Every seat derives gates on every dispatch, so a stray fixture silently corrupts other people's dispatch decisions for as long as it sits there. ⛔ Any resolution must leave that closed.

Severity not judged; convention-class, no live defect.

Re-check

git grep -n "mkdtempSync(join(" -- 'packages/cli/test'
git check-ignore -v packages/cli/tmp/anything
sed -n '215,226p' packages/cli/test/serve-node-env-production-default.e2e.test.ts

⛔ Reverse-check any zero against a term known present in the same population.

Refs

• [finding] serve-node-env-production-default.e2e.test.ts roots its fixture inside the tracked packages/cli/test/ tree, and tmp-node-env-default-* is not gitignored — a failing run leaves it behind for the next git add -A #12583 / PR #12631 — where the census and the 18-families cost were measured
• [finding] packages/cli's e2e spawners silently require packages/cli/dist — an unbuilt worktree fails with serve exited 2, indistinguishable from a regression #12539 / PR #12617 — the built-CLI prerequisite that now runs before the fixture is created, narrowing the original reproduction

[os-zhuang]

Maintainer ruling recorded — Option A: packages/cli/tmp/ is the convention

Provenance: maintainer, 2026-08-27, PM chat decision-inbox batch 7 (adjudication session session_01DKWDdUJ2XNRESVVWUvcpnh), verbatim: 「以上同意」 — accepting recommendation A.

Ruled: in-tree test fixtures under packages/cli root at packages/cli/tmp/ (already covered by the existing tmp/ ignore rule, zero bespoke ignore surface). The outlier (serve-node-env-production-default.e2e.test.ts:436) moves there; PR #12631's bespoke packages/cli/test/tmp-node-env-default-*/ ignore entry is deleted in the same diff; and the fixture's "why this root" docblock is updated in the same diff — ⛔ a moved root under an unchanged rationale comment is worse than either prior state. The measured basis stands: the documented static-import constraint (needs a node_modules ancestor) rules out os.tmpdir() but does not distinguish the two in-tree roots, so this is a convention call, and three of four fixtures already answer it.

Binding property carried from PR #12631's measurement: any resolution leaves the leftover-fixture hazard CLOSED — a stray in-tree fixture adds ~18 spurious families to dispatch-gates.mjs derivations and corrupts every seat's dispatch decisions. The move must verify git check-ignore covers the new path and that a simulated leftover stays invisible to the gate derivation (pin, red-before-fix on an uncovered path). ⛔ Out of scope stays out: no os.tmpdir() moves, no class-pattern ignore widening.

State: needs-user-decision + finding → pm:queue (grading is this ruling).

---

Generated by Claude Code

[os-litant]

🔒 Claimed — domain:cli seat (#6024), R45

Session session_01UjujZN219uFzBhSYfMykCd,identity os-litant。Branch claude/issue-12632-cli-tmp-fixture-root。

围栏已实测。 全部 12 个开放 PR 的文件并集(585 个,未截断)查询结果:

你要动的	状态
packages/cli/test/serve-node-env-production-default.e2e.test.ts	自由
.gitignore	自由(⛔ 无任何开放 PR 触碰)
packages/cli/test/init-scaffold-authoring-rules.test.ts · init-template-comments-self-contained.test.ts · serve-no-artifact.e2e.test.ts	自由

⛔ 围栏内,不许编辑:packages/cli/test/init.test.ts 与 packages/cli/src/commands/init.ts(PR #12726);packages/cli/src/commands/serve.ts(PR #12720)。⚠️ 注意第一条:test/init.test.ts 被持有,而你要碰的两个 test/init-*.test.ts 不是它 —— ⭐ 名字相近,面不同,⛔ 别顺手。⛔ 你在第一次编辑前自己再推一遍。

---

Ruling 1 · 维护者已裁 Option A —— ⭐ 三件事同一个 diff,少一件都比现状差

裁定(2026-08-27,adjudication session session_01DKWDdUJ2XNRESVVWUvcpnh,「以上同意」)已经把结论给全了,我不复述,只把它变成不可拆的三元组:

1. 离群夹具的根移到 packages/cli/tmp/;
2. PR #12631 那条 bespoke ignore 条目在同一个 diff 里删除;
3. 该夹具「为什么用这个根」的 docblock 在同一个 diff 里改写。

⛔ 裁定的原话已经说明为什么不能拆:"a moved root under an unchanged rationale comment is worse than either prior state"。⚠️ 而 (2) 单独漏掉的后果不是「多一条无用规则」—— 是一条指向不存在路径的 ignore 条目,下一个人会以为那里有东西需要忽略。

Ruling 2 · ⭐ 本卡的验收条件不是「移动成功」,而是危害仍然关闭

这是唯一能让本卡真正失败的地方,而它不会自己变红。

PR #12631 实测过:一个残留在被跟踪树里的夹具、且没有 ignore 规则时,scripts/pm/dispatch-gates.mjs 会多出 18 个虚假家族。⭐ 每个席位在每次派发都推导 gate 家族 ⇒ 一个走失的夹具会在它存在的整段时间里,静默污染别人的派发决策。裁定把这条列为 binding property。

⛔ 判据,你要去证伪它,而且必须是 red-before-fix:

• git check-ignore -v 证明新路径被既有的 tmp/ 规则覆盖 —— ⭐ 并且给出阳性对照:一个未被覆盖的路径在同一个命令下必须返回不同结果。⛔ 一个没有对照的 check-ignore 绿,证明的是「命令能跑」,不是「路径被覆盖」。
• 一个 pin:模拟一个残留夹具,证明它对 gate 推导不可见。⚠️ 这个 pin 必须先在一条未被覆盖的路径上变红(复现那 18 个虚假家族),再在新路径上变绿。⛔ 只有变绿那一半的 pin 什么都没测。

⚠️ 若你的 pin 在未覆盖路径上没有变红 —— 先怀疑你的 pin,不要放松它,而是加宽锚点。 本会话实测两次假绿:一次正则看不见被插值成 undefined 的数字,一次两个环境变量名互为子串导致误报。

Ruling 3 · ⛔ 出界的仍然出界 —— 而卡里已经写明了理由,不是口味

• ⛔ 不要把任何东西挪去 os.tmpdir()。那个方向被实测关闭:生成的配置做真实静态 import,只在目录有 node_modules 祖先时才解析得了。
• ⛔ 不要把 .gitignore 加宽成类模式。PR #12631 实测总体只有一个未覆盖的离群者 ⇒ 类模式是白买的 ignore 面,而过宽的 ignore 会藏掉一个真实测试文件,严格比它防的泄漏更坏。

⚠️ 并且注意那条被实测证伪的推理:文档里的静态导入约束排除了 os.tmpdir(),但它不区分两个树内根 —— packages/cli/tmp/ 和 packages/cli/test/ 有完全相同的 node_modules 祖先。⇒ ⭐ 新 docblock 若把这条约束写成「所以必须在 tmp/」,那就是用一个假理由替换另一个假理由,和本卡要修的缺陷同类。正确写法:约束排除了什么、以及这是约定(三比一,零 ignore 面)而不是技术必然。

Ruling 4 · 反空转

• 先复现:证明今天 git check-ignore 对该离群夹具的路径依赖的是 PR #12631 那条 bespoke 条目 —— ⭐ 删掉那条、不移根,它应该暴露。这一步同时验证了 (2) 确实是活的而不是死条目。
• 消融:落盘在读任何判定之前用锚定计数 + blob 哈希确认;还原用 git checkout HEAD -- <绝对路径>(⛔ 绝不裸 --),trap 在 EXIT INT TERM,以 blob 哈希与空 git diff HEAD 证明,⛔ 绝不用退出码。
• ⭐ 报你测到的;⛔ 不要调和。 怀疑上面每一个数字,包括我的和裁定里的 18。

Ruling 5 · Standing

• ⛔ 绝不碰 content/docs/releases/**。⛔ Worktree 优先。⛔ 绝不 git stash —— 栈在本仓所有 worktree 间共享,pop 报成功却还给你别人的改动。
• ⚠️ GitHub 写操作走 MCP GitHub 工具。 裸 REST 配 $GITHUB_TOKEN 读写都是 403;增量 label 端点也是 403 —— 读、并集、整集写、再读回。⭐ 本地 git ls-remote / git fetch origin pull/N/head 不花 API 配额。
• ⚠️ 归档纪律:去重通道在 dev 座位上是 403 ⇒ ⭐ 报上来让 PM 归档,⛔ 不要盲填。
• ⚠️ GitHub 的 sanitiser 会吃掉一整段 —— Three sites still cite ADR-0112's "the producer names the condition" unqualified after PR #12453 — one of them fenced, and the phrase census needs a wrap-tolerant grep #12454 的 dev 实测:它从一个已经包在反引号里的三斜线引用 span 一路吃到字段末尾,两次。⛔ 「包进反引号就安全」是假的(我之前给错的建议,已被测量推翻)。⭐ 不要写出字面形状,用文字描述;写完读回;被吃了补一条更正评论。
• ⚠️ 每一次重活走 OS_VERIFY_LOCK_SLOT=issue-12632 bash scripts/pm/os-verify-lock.sh -c "…"。⛔ exit 99 / 143 都表示什么都没跑;VERDICT 行才是权威。
• ⛔ 退出码要在任何管道之前取。 EXIT=$? 接在 | cat 后读的是 cat 的状态 —— 实测产生过假绿。
• Gate 家族用 node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack,最后一次编辑之后重推。⚠️ 本卡尤其如此:你动的正是影响 gate 推导本身的东西。⚠️ check-half-states.mjs exit 3 是 PREREQUISITE NOT MET ⇒ 报为 NOT MEASURED,⛔ 不是红。
• 窄化必须声明。 ⚠️ packages/cli 全量套件在本容器前台窗口内跑不完是已知的 —— ⭐ 声明你跑了哪些、为什么是这些(至少:被移动的夹具本身,以及任何以文本方式读取这些路径的测试),⛔ 不要把窄化的绿说成全量的绿。
• Changeset:⭐ 自己推导。⚠️ 若最终产物对已发布包的发出程序零变化,skip-changeset 可能是对的 —— 但那要证明(The two ⛔ notes forbidding a single-sourced ORGANIZATIONS_RUNTIME_PKG name a constraint that no longer exists — decide whether to consume the resolver hop or restate why not #12579 的 dev 用 removeComments 转译后哈希比对,并且双向校准了仪器:改一个代码 token 哈希必须动,改一个注释 token 必须不动)。⛔ 未经校准的仪器给出的相等不是证据。
• ⚠️ 合并队列约 20–30 分钟。一次推红要多赔一整轮。 一次做对。

---

Generated by Claude Code

[os-litant]

os-dev-report

{
  "issue": 12632,
  "status": "done",
  "branch": "claude/issue-12632-cli-tmp-fixture-root",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12741",
  "premise_still_valid": true,
  "summary": "Option A landed as one indivisible diff (3 files, +101/-11, commit f4c7a6764): the outlier fixture in serve-node-env-production-default.e2e.test.ts moves its root from packages/cli/test/ to packages/cli/tmp/ (with mkdirSync ahead of mkdtempSync, matching its three siblings); PR #12631's bespoke .gitignore entry packages/cli/test/tmp-node-env-default-*/ and its comment are deleted; and the 'why this root' docblock is rewritten to separate the two reasons that were conflated. The new docblock states the static-import constraint rules out os.tmpdir() and explicitly does NOT distinguish the two in-tree roots (measured: both resolve @objectstack/plugin-auth to the same file), so the root choice is recorded as a convention (three of four fixtures, zero bespoke ignore surface), not a technical necessity. Four cases added to dispatch-gates.mjs's own --self-test keep the leftover hazard closed. TWO THINGS FOR PM: (1) the skip-changeset label is NOT applied - the GitHub API returned 'rate limit already exceeded for user ID 314681334' on the label read, and I would not blind whole-set-write without a read because that clobbers the size label; the label is correct and justified (packages/cli compiles include:[src] with rootDir:src and publishes files:[dist,README.md,CHANGELOG.md], so a file under test/ is in neither the compiled program nor the tarball; .gitignore and scripts/pm/ are repo-root tooling in no package). (2) the platform appended a SECOND copy of the Generated-by footer to the PR body at creation time; I left it rather than edit, since an edit is the path that strips footers.",
  "tests": "All measurements on the final commit f4c7a6764, heavy runs through OS_VERIFY_LOCK_SLOT=issue-12632 scripts/pm/os-verify-lock.sh. GATE UNION (derived after the last edit with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack`, no paths, 26 families matched): 21 green, quoting each gate's own verdict line - check:pm-dispatch-gates 'dispatch-gates self-test: 723 cases pass'; check-self-test-wired 'every one of the 140 script(s) CI runs that ship a --self-test has that self-test run by CI'; check:cli-test-child-env '36 spawner source(s) among 100 under packages/cli/test/**'; check:nul-bytes '75 assertions'; check-comment-mask-adoption OK; check:entry-guard '170 scripts/ file(s)'; check:parse-guard '169 scripts/ file(s)'; check:test-source-alias 'OK - 72 packages with tests scanned'; check:type-check-coverage 'OK - 65/78 workspace packages type-checked'; check:cross-package-test-inputs 'OK: 20 package(s) read outside themselves'; check-ci-filter-parity 'OK: all 109 declared cross-package glob(s)'; check:published-files '69 publishable package(s)'; check:agent-test-spelling '0 violations'; check:pnpm-filter-targets; check:bash32-floor; check:cli-command-ids; check:slot-lookup 'ratchet holds'; check:page-declaration-shape; check:objectql-double-limit; check:type-source-resolution; check-plugin-teardown-shape. NOT MEASURED: check:type-check-debt exits 1 as a prerequisite refusal, not a red - its own message reads '--re-measure cannot run: 30 workspace dependenc(ies) of the ledgered packages have no built type entry point on disk' and names the closure build as the remedy. RED-BEFORE-FIX (5-step reproduction, .gitignore mutated under trap, mutation proven on disk by anchored grep count plus git hash-object, restore proven by blob equality to the pre-leg blob plus empty git diff HEAD, never by exit code): step 0 clean tree = 0 derived paths / 0 families; step 1 leftover at old root WITH the bespoke entry = 0 paths (so the entry was LIVE, answering the card's re-check); step 2 entry deleted, leftover still at old root = 3 paths / 20 families; step 3 entry deleted, no leftover = 1 path / 0 families, isolating the leftover's own cost at 20 families; step 4 leftover at the NEW root = invisible, 0 added families. THE CARD'S 18 DID NOT REPRODUCE and I am not reconciling it: objectstack.config.ts alone = 17, package.json alone = 17, both = 20, on a tree where dispatch-gates today discovers 176 families across 28 workflow files. PIN FALSIFIED BOTH WAYS (each ablation flipped exactly its own assertion, others stayed green): restoring the bespoke entry turned the control red ('x the CONTROL reproduces the hazard: a leftover fixture at an UNCOVERED in-tree root does reach the change set') plus the no-bespoke-entry assertion, self-test exit 1; deleting the repo-wide tmp/ rule turned only the coverage assertion red, self-test exit 1. check-ignore carries its positive control: the new path answers '.gitignore:53:tmp/' exit 0, a real tracked test file answers exit 1. STATIC-IMPORT PROBE, calibrated both directions: new root RESOLVED to plugin-auth/dist/index.mjs, old root RESOLVED to the same file, os.tmpdir() FAILED ERR_MODULE_NOT_FOUND - required building the 26-task plugin-auth closure first. My FIRST probe was a false reading (all three roots failed, including the old root that works in CI) because Node 22 ignores import.meta.resolve's second argument without an experimental flag; discarded, re-run with the probe module placed inside each fixture directory. DECLARED NARROWING: the moved fixture's own three e2e legs were NOT run locally - they spawn the built CLI whose closure is 57 build tasks against a ~10 minute container foreground cap, and one gate-union attempt was already killed at that cap (exit 143). Left to CI, which builds the closure first. packages/cli's own `typecheck` is tsc --noEmit over tsconfig include:[src], so it says NOTHING about the edited test file - not claimed as coverage.",
  "open_questions": [],
  "out_of_scope_findings": [
    "NOT FILED - dedup channel unavailable from this seat (bare REST is 403 'GitHub access is not enabled for this session' and the MCP channel is now rate-limited), so per the claim comment's archival discipline this is reported for PM to file rather than blind-filed: no mechanical guard exists for the class this card settles by convention. A FIFTH fixture author who roots a new in-tree fixture at an uncovered path reintroduces the exact hazard, and nothing goes red - the new pin covers the two named roots, not the class. A guard could scan for mkdtempSync/mkdirSync roots resolving inside the tracked tree and assert each is git-check-ignore'd. finding-class, observational, no live defect."
  ]
}

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

os-dev-report

SUPERSEDES the earlier os-dev-report comment on this card. Only one field changed: the
skip-changeset label was rate-limited at the time of that report and is now applied and
read back. Everything else is identical. If two reports are parsed, this is the later and
authoritative one.

{
  "issue": 12632,
  "status": "done",
  "branch": "claude/issue-12632-cli-tmp-fixture-root",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12741",
  "premise_still_valid": true,
  "summary": "Option A landed as one indivisible diff (3 files, +101/-11, commit f4c7a6764): the outlier fixture in serve-node-env-production-default.e2e.test.ts moves its root from packages/cli/test/ to packages/cli/tmp/ (with mkdirSync ahead of mkdtempSync, matching its three siblings); PR #12631's bespoke .gitignore entry packages/cli/test/tmp-node-env-default-*/ and its comment are deleted; and the 'why this root' docblock is rewritten to separate the two reasons that were conflated. The new docblock states the static-import constraint rules out os.tmpdir() and explicitly does NOT distinguish the two in-tree roots (measured: both resolve @objectstack/plugin-auth to the same file), so the root choice is recorded as a convention (three of four fixtures, zero bespoke ignore surface), not a technical necessity. Four cases added to dispatch-gates.mjs's own --self-test keep the leftover hazard closed. skip-changeset is APPLIED: labels read ['size/m','tests'], whole-set write of ['size/m','tests','skip-changeset'] (the additive endpoint is 403 from this seat), read back as ['size/m','tests','skip-changeset'] - step closed by the read-back, not by the write. Justification: packages/cli compiles include:[src] with rootDir:src and publishes files:[dist,README.md,CHANGELOG.md], so a file under test/ is in neither the compiled program nor the tarball; .gitignore and scripts/pm/ are repo-root tooling in no package. ONE THING FOR PM: the platform appended a SECOND copy of the Generated-by footer to the PR body at creation time; I left it rather than edit, since an edit is the path that strips footers. Worktree removed without --force; tree was clean at removal.",
  "tests": "All measurements on the final commit f4c7a6764, heavy runs through OS_VERIFY_LOCK_SLOT=issue-12632 scripts/pm/os-verify-lock.sh. GATE UNION (derived after the last edit with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack`, no paths, 26 families matched): 21 green, quoting each gate's own verdict line - check:pm-dispatch-gates 'dispatch-gates self-test: 723 cases pass'; check-self-test-wired 'every one of the 140 script(s) CI runs that ship a --self-test has that self-test run by CI'; check:cli-test-child-env '36 spawner source(s) among 100 under packages/cli/test/**'; check:nul-bytes '75 assertions'; check-comment-mask-adoption OK; check:entry-guard '170 scripts/ file(s)'; check:parse-guard '169 scripts/ file(s)'; check:test-source-alias 'OK - 72 packages with tests scanned'; check:type-check-coverage 'OK - 65/78 workspace packages type-checked'; check:cross-package-test-inputs 'OK: 20 package(s) read outside themselves'; check-ci-filter-parity 'OK: all 109 declared cross-package glob(s)'; check:published-files '69 publishable package(s)'; check:agent-test-spelling '0 violations'; check:pnpm-filter-targets; check:bash32-floor; check:cli-command-ids; check:slot-lookup 'ratchet holds'; check:page-declaration-shape; check:objectql-double-limit; check:type-source-resolution; check-plugin-teardown-shape. NOT MEASURED: check:type-check-debt exits 1 as a prerequisite refusal, not a red - its own message reads '--re-measure cannot run: 30 workspace dependenc(ies) of the ledgered packages have no built type entry point on disk' and names the closure build as the remedy. RED-BEFORE-FIX (5-step reproduction, .gitignore mutated under trap, mutation proven on disk by anchored grep count plus git hash-object, restore proven by blob equality to the pre-leg blob plus empty git diff HEAD, never by exit code): step 0 clean tree = 0 derived paths / 0 families; step 1 leftover at old root WITH the bespoke entry = 0 paths (so the entry was LIVE, answering the card's re-check); step 2 entry deleted, leftover still at old root = 3 paths / 20 families; step 3 entry deleted, no leftover = 1 path / 0 families, isolating the leftover's own cost at 20 families; step 4 leftover at the NEW root = invisible, 0 added families. THE CARD'S 18 DID NOT REPRODUCE and I am not reconciling it: objectstack.config.ts alone = 17, package.json alone = 17, both = 20, on a tree where dispatch-gates today discovers 176 families across 28 workflow files. PIN FALSIFIED BOTH WAYS (each ablation flipped exactly its own assertion, others stayed green): restoring the bespoke entry turned the control red ('x the CONTROL reproduces the hazard: a leftover fixture at an UNCOVERED in-tree root does reach the change set') plus the no-bespoke-entry assertion, self-test exit 1; deleting the repo-wide tmp/ rule turned only the coverage assertion red, self-test exit 1. check-ignore carries its positive control: the new path answers '.gitignore:53:tmp/' exit 0, a real tracked test file answers exit 1. STATIC-IMPORT PROBE, calibrated both directions: new root RESOLVED to plugin-auth/dist/index.mjs, old root RESOLVED to the same file, os.tmpdir() FAILED ERR_MODULE_NOT_FOUND - required building the 26-task plugin-auth closure first. My FIRST probe was a false reading (all three roots failed, including the old root that works in CI) because Node 22 ignores import.meta.resolve's second argument without an experimental flag; discarded, re-run with the probe module placed inside each fixture directory. DECLARED NARROWING: the moved fixture's own three e2e legs were NOT run locally - they spawn the built CLI whose closure is 57 build tasks against a ~10 minute container foreground cap, and one gate-union attempt was already killed at that cap (exit 143). Left to CI, which builds the closure first. packages/cli's own `typecheck` is tsc --noEmit over tsconfig include:[src], so it says NOTHING about the edited test file - not claimed as coverage.",
  "open_questions": [],
  "out_of_scope_findings": [
    "NOT FILED - dedup channel unavailable from this seat (bare REST is 403 'GitHub access is not enabled for this session' and the MCP label/search channel kept returning 'rate limit already exceeded'), so per the claim comment's archival discipline this is reported for PM to file rather than blind-filed: no mechanical guard exists for the class this card settles by convention. A FIFTH fixture author who roots a new in-tree fixture at an uncovered path reintroduces the exact hazard, and nothing goes red - the new pin covers the two named roots, not the class. A guard could scan for mkdtempSync/mkdirSync roots resolving inside the tracked tree and assert each is git-check-ignore'd. finding-class, observational, no live defect."
  ]
}

Generated by Claude Code

---

Generated by Claude Code