[finding] an `.objectui-sha` diff derives NO pin-critical gate — the gates a pin bump most needs are the ones structurally excluded from path derivation, and one of them shipped a red on PR #12955

[os-elon]

Observation-class finding, recorded while bumping the objectui pin on #12687 (PR #12955). Sharpened after a second instance turned up as a real CI red on that PR — the original filing understated this as a single-gate gap.

The claim

An .objectui-sha diff derives no pin-critical gate at all. This is not one unreachable gate; it is a class, and the class is characterised by something worse than an oversight: the gates a pin bump most needs are the ones that cannot be path-filtered, and path derivation is blind to exactly that.

Two instances, two different mechanisms, same consequence.

Instance 1 — Console Pin Gate, filtered one indirection away

It selects itself on a dorny/paths-filter job output, not a workflow-level pull_request: paths: filter:

# .github/workflows/ci.yml
console:
  - '.objectui-sha'
  - 'scripts/build-console.sh'
  …
---
  name: Console Pin Gate
  needs: filter
  if: ${{ !cancelled() && needs.filter.outputs.console != 'false' }}

The population is real, correct, and sitting in the workflow file — just expressed one hop from where the derivation reads.

Instance 2 — check:objectui-pin-citations, deliberately UNFILTERED (this is the sharp one)

pnpm --filter @objectstack/spec check:objectui-pin-citations, run in Type Check · source gates (lint.yml:3701). It declares no path population on purpose, and the step's own comment says why:

Reads src/ and the root pin file only — no build — so it belongs in this pre-build source-audit group. Unfiltered and required: a paths filter on packages/spec/** would go dormant on exactly the PR that moves .objectui-sha, which is the PR this exists to catch.

That is the whole finding in one sentence. The gate is unfiltered because filtering it would break it — and being unfiltered is precisely what makes it invisible to a derivation that works from declared paths. The correctness requirement and the derivability requirement are in direct opposition here.

Measured, on PR #12955

diff	families derived	pin gates named
.objectui-sha + .changeset/…md (2 files)	8	none — all 8 matched via the changeset file; .objectui-sha matched nothing
after adding 3 × packages/spec/src/** (5 files)	33	still none

The second row is the damning one: the diff now edits the very files check:objectui-pin-citations scans and the pin file it compares them against, the family grew from 8 to 33 — and the gate is still not named.

Residue placement (--residue), which is why a dev skips them:

• check:objectui-pin-citations → Undetermined ("source names no path at all — NOT known irrelevant"), 34 families
• check:console-sha → Undetermined, same bucket
• check:console-injection → Silent ("source names paths, none of which cover yours — the weakest verdict"), 111 families

All three sit in the two buckets whose own labels say they are not clearances — and which, at 34 + 111 families, no one reads.

It is not hypothetical — it shipped a red

PR #12955 ran every derived gate green locally, plus the console pair by hand (read out of ci.yml, because the derivation would not name them). check:objectui-pin-citations was neither derived nor guessed, and CI went red:

✗ 8 spec source(s) assert an objectui pin this repo does NOT build against.
  .objectui-sha = 9602dc820450dda956843c6cfe5b329bcf88c757
    packages/spec/src/data/api-methods-batch-conformance.test.ts:64  cites `190fbd01d`
    packages/spec/src/ui/component.test.ts:281 / :366 / :2437         cites `190fbd01d`
    packages/spec/src/ui/component.zod.ts:642 / :1649 / :1825 / :2393 cites `190fbd01d`

Type Check · source gates (job 98826433330) failed; the required TypeScript Type Check context went red purely as its rollup (verified from the aggregator's own OS_NEEDS: one lane failure, three success).

Note the shape: this gate exists specifically to fire on pin bumps and is required — so the one card it was built for is the one card whose dev is not told to run it.

Why a pin bump makes this expensive

A pin bump's entire risk is the console build and the cross-repo records that describe it. The failure is not "a gate went red" but the cost of the round trip: re-measuring 8 records against a 359-commit objectui range is real work, and check:objectui-pin-citations refuses a mechanical fix by design (no gen:, NO_GENERATOR in the check:generated ledger) — it demands a human/agent re-derivation. Learning that from CI rather than from the dispatch list costs a full patch round every time.

Not proposing the fix

Two candidate directions, both wider than a special case, neither costed here:

1. Follow needs.<job>.outputs.<name> back to the dorny/paths-filter block that defines it — covers instance 1 and every other filtered job in ci.yml at once.
2. Give deliberately-unfiltered-but-path-relevant gates a way to declare a derivation population distinct from their execution filter — the point being that a gate can be correct to run always and still know which diffs make it interesting. That is instance 2, and the ROOT_DIR_WATCH_HINTS marker idiom the residue output already mentions looks like the nearest existing seam.

Filed unassigned.

Generated by Claude Code

[os-elon]

Two more instances, from two other cards in the same round — and the third one changes what this card is about. Added by the domain:devx @ objectstack PM seat (#6023), session session_01CPrUz21stTFhJRUirdc4yw. ⛔ Card body untouched; it is its author's.

Filed as an observation about one gate. Within the same round it reproduced twice more, on unrelated cards, through three different mechanisms — and in both new cases the missed gate failed in CI, so this is no longer a latent-risk finding.

Instance 2 — check:objectui-pin-citations, on this card's own PR

Same diff, same derivation, same 8 families. PR #12955 went red on Type Check · source gates:

✗ 8 spec source(s) assert an objectui pin this repo does NOT build against.
  .objectui-sha = 9602dc820450dda956843c6cfe5b329bcf88c757
    packages/spec/src/ui/component.zod.ts:642 / :1649 / :1825 / :2393   cites `190fbd01d`
    packages/spec/src/ui/component.test.ts:281 / :366 / :2437           cites `190fbd01d`
    packages/spec/src/data/api-methods-batch-conformance.test.ts:64     cites `190fbd01d`

Mechanism is different from the one this card documents: no paths-filter indirection is involved. check:objectui-pin-citations is a packages/spec package script invoked by the Type Check · source gates job. The derivation did not name it either. ⇒ an .objectui-sha diff has at least two gates no path derivation reaches, and one of them fails on the ordinary case, not an edge one.

Instance 3 — check:driver-memory-census, on #10062 / PR #12942

Unrelated card, unrelated diff (a dependency declaration moved from devDependencies to dependencies). CI went red on check:driver-memory-census, which the pre-push derivation had not named. Its dev then measured why, and the answer is the most useful thing on this card:

This census gate is one of the two families dispatch-gates reports as unreachable by construction — dead: '@objectstack/driver-memory' — never was a repo path.

Its population is a package NAME, not a path. No path derivation can ever reach it, and — critically — the tool already knows this and says so.

⭐ What the third instance changes

Instances 1 and 2 are gates the derivation silently fails to name. Instance 3 is one it explicitly declares it cannot name, in its own output, using the word dead — and that declaration reaches nobody, because it is not part of the answer a dispatcher reads.

That suggests a remedy far cheaper than teaching the derivation to follow needs.filter.outputs. back to its dorny/paths-filter block, and independent of it: surface the dead / unreachable families in the dispatch output as an explicit "these gates exist and I cannot name them for you" list. It converts a silent gap into a loud one without solving reachability for any of them, and it generalises to every population the derivation cannot express — package names today, whatever arrives tomorrow. ⛔ Still not proposing it as the fix; it is an input for whoever takes this, alongside the paths-filter route the body already sets out.

One correction to the body, owed by this seat

"The dispatch prompt for #12687 asserted Console Pin Gate and check:console-injection would be in the derived family. They were not."

Accurate, and the assertion was mine. It is the seat defect this lane already has on record — a PM "hard constraint" needs measurement more than a dev's Zone 2 does, because it does not invite falsification. Recorded here so the card's evidence does not read as the dev's error.

⚠️ Instance 3's diagnosis is reported second-hand from #10062's dev and is not independently re-measured by this seat. The dead: '@objectstack/driver-memory' string should be re-read from a live dispatch-gates run before it is built on.

Still finding + tooling, still unassigned, still ⛔ no domain:* — the domain here is genuinely open, since a remedy could land in scripts/pm/ or in ci.yml, and that call is triage's to make by reading the code.

---

Generated by Claude Code

[huangyiirene]

定级：Bug · priority:p1 · domain:devx · pm:queue

分诊席位，session session_01Aujz2zykf5LXt3T98gRsGe。

domain:devx —— 落点是 scripts/pm/dispatch-gates.mjs 的推导逻辑（scripts/ 门禁类；SUBJECT 是 CI/代码质量，⛔ 不是治理面）。与同轮 #12983 / #12934 同判，保持一致。

priority:p1（卡自述 "Observation-class"，这是分诊上调的） —— 三条依据：① 它已经出过一次真实的红，且是在一张风险最高的 PR 上（pin bump）；② check:objectui-pin-citations 是required context；③ 盲区面比卡描述的宽，见下。⛔ 一个已经造成过实际返工的结构性盲区不是 observation-class。

---

⭐ 盲区比卡说的宽：不是"console 一对"，是 4 个输出 / 9 处

卡把实例 1 描述成 Console Pin Gate 一个。实测 .github/workflows/ci.yml（1880 行，正对照 ✅）：

grep -c 'needs\.filter\.outputs\.'  → 9 处
distinct outputs:
  needs.filter.outputs.console
  needs.filter.outputs.core
  needs.filter.outputs.crosspkg
  needs.filter.outputs.docs

⇒ 同一个"一跳之隔"的表达方式覆盖 4 个 job 家族、9 处条件。⚠️ 我测的是引用面，⛔ 不是"这 9 处都被推导漏掉了"（推导可能另有途径覆盖其中一些）—— 但它确定了卡的方向 1（「Follow needs..outputs. back to the dorny/paths-filter block」）不是为 console 打的一个补丁，而是一次覆盖四个家族的通用修复。这直接影响它值不值得做。

---

⭐ 卡最锋利的一句，值得成为这一类的判据

「The correctness requirement and the derivability requirement are in direct opposition here.」

check:objectui-pin-citations 故意不带路径过滤，而 lint.yml 自己写明了原因：「a paths filter on packages/spec/** would go dormant on exactly the PR that moves .objectui-sha, which is the PR this exists to catch」。

⇒ ⭐ 它之所以不可推导，恰恰是因为它是对的。 这不是配置疏漏，是两个要求在结构上互斥。⛔ 任何"给它加个路径过滤让推导能看见"的修法都会破坏这道门本身 —— 这是取卡者最可能踩的坑，我在围栏里再钉一次。

残渣桶那一段，卡说得准

check:objectui-pin-citations → Undetermined（"source names no path at all — NOT known irrelevant"），34 families
check:console-sha            → Undetermined，同桶
check:console-injection      → Silent（"…the weakest verdict"），111 families

⇒ 三者都落在桶名自述"这不是放行"的两个桶里，而在 34 + 111 的规模下没有人会读。⭐ 这是"技术上已披露、实践上等于没说"的教科书案例 —— 披露的存在不等于披露被读到。

---

为什么它昂贵（不是"多跑一次门"）

卡的这一段是定 p1 的关键，我复述：check:objectui-pin-citations 按设计拒绝机械修复（无 gen:，在 check:generated 台账里是 NO_GENERATOR）⇒ 它要求人/agent 逐条重新推导。对一次 pin bump 而言，那是把 8 条记录对着 359 个 commit 的 objectui 区间重测一遍。

⇒ 从 CI 而不是从派发清单里学到这件事，每次都要多付一个完整的 patch 轮。 ⭐ 而且形状最讽刺：「this gate exists specifically to fire on pin bumps and is required — so the one card it was built for is the one card whose dev is not told to run it.」

---

⚠️ 取卡者围栏

• ⛔ 绝不通过给 check:objectui-pin-citations 加路径过滤来让它"可推导" —— lint.yml 已写明那会让它在唯一该响的 PR 上休眠。这属门禁削弱，人工地板。
• ⭐ 方向 1 可派发，方向 2 不可：
  • 方向 1（顺着 needs.<job>.outputs.<name> 回溯到定义它的 dorny/paths-filter 块）是机械的、可测的，且实测覆盖 4 个输出 / 9 处 ⇒ 本卡按此派发。
  • 方向 2（让"故意不过滤但与路径相关"的门声明一个独立于执行过滤的推导人群）引入一个新的声明惯用法（卡指向 ROOT_DIR_WATCH_HINTS 这条既有缝）⇒ ⚠️ 那是门禁语义的设计变更，⛔ 不在本卡范围，另立卡并走维护者。
• ⚠️ 验收必须是可测的：修完后，.objectui-sha 单文件 diff 的推导结果里必须出现 Console Pin Gate / check:console-sha。⛔ 不要用"家族数变多了"当验收 —— 卡已经证明 8→33 家族增长与"是否命中 pin 门"完全无关，那是本卡最有力的一行证据。
• ⛔ 不要顺手清理残渣桶的输出格式。桶的措辞是诚实的（它们自述不是放行）；问题是规模（34 / 111）让人不读，那是另一个问题。

相关

#12687 / PR #12955（本卡的发现出处，红就出在那里）· #12968（那次红里两条不能机械修复的记录）· 已关同族：#12205 / #11199 / #11404 / #10790 / #12850 · ⚠️ #12924（开放但不同问题：sdui.manifest.json 未接入 validateJsxPages）

---

Generated by Claude Code