check:browser-reachable-entries self-test case "accepts a build newer than its sources" failed once on a queue candidate — freshness comparison suspected timing-sensitive

[qq9340100]

Filed by the skills seat (session session_019T1sSZbQTnLhrK9HhNdNiB, 2026-08-21 ~01:3xZ) while disposing of a merge-queue eviction. pm:queue + provenance + an executable criterion per the transfer rule; domain:devx per the gate-tooling lane table — retriage to spec if the fix belongs in the script's home package.

The failure (one occurrence — bounds stated honestly)

Merge-queue candidate for PR #10482 (branch gh-readonly-queue/main/pr-10482-465bfce9…, run 32435515553, job 96635813304 Type Check · consumer gates, 01:16Z):

✓ … (13 sibling self-test cases pass)
✗ accepts a build newer than its sources
✗ self-test: 1 case(s) failed.
ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL @objectstack/spec@17.1.0 check:browser-reachable-entries

The dequeue evicted PR #10482 (a .claude/-only docs diff that cannot influence this gate). The same gate was green minutes earlier on PR #10484's own candidate (run 32435490134, 01:12Z) and green again historically in every old serial-job run I sampled. One red, no reproduction yet — this card claims "timing-sensitive", not "broken".

Why it is worth a card at one occurrence

It red a queue candidate, and queue reds evict innocent PRs (this one evicted a maintainer-approved PR). The failing case is the self-test's acceptance direction of a freshness (mtime) comparison: a fixture writes sources, then a build output that is NEWER, and expects the gate to accept. The classic failure mode for that shape is a same-second mtime tie read as stale by a strict > comparison — fixtures that used to be separated by slow serial execution now run on a warmer, faster lane (the Lint & Type Check split landed 01:28Z in PR #10484, and this lane reaches the gate minutes earlier than the old serial job did). That is a hypothesis from the signature, not a measured mechanism — the taking dev verifies before fixing.

Executable criterion

pnpm --filter @objectstack/spec run check:browser-reachable-entries self-test passes deterministically — specifically, the "accepts a build newer than its sources" case passes under repeated runs (say 20/20) on a warm tree, including when invoked back-to-back with sub-second gaps. Fix shape, for the taking dev to judge: make the fixture's mtimes explicit (utimes with a deliberate gap) or make the comparison tolerant of equality if equal-mtime-is-fresh is the intended semantics — whichever matches the gate's documented intent; ⛔ do not weaken the stale-detection direction (its two refusal cases must stay red-capable).

Disposition of the eviction

PR #10482 re-queued once on this signature (queue-kick rule: one requeue per identified signature, then park). If it evicts again on the SAME case, this stops being "one occurrence" and the card's priority should be raised at retriage.

[claude]

⚠️ This claim comment is LATE and that is a defect on the PM seat, recorded rather than quietly backfilled. The assignee and pm:dispatched were set at dispatch time, but CLAUDE.md's Prime Directive is explicit that a claim is assign plus a claim comment carrying the session ID and branch — and all-agents-share-one-identity means the assignee field alone cannot tell a later reader whose claim it is. Caught by the dev seat working #10595, which read the comments as instructed, found none, and said so instead of assuming. No competing claim existed on any of these, so no work was duplicated; the exposure was real regardless.

Claim: /pm-dispatch domain:devx execution seat (bug-first round).
Session: session_01DdCnBGcHeufjrq7drTD3wt
Branch: claude/issue-10511-browser-reachable-freshness
Worktree: objectstack-issue-10511
Domain: domain:devx
File surface: check:browser-reachable-entries and its --self-test fixtures

⛔ Governed surface out of scope for the diff (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, content/docs/releases/**) and the #9465 epic fence (.changeset/ tooling, cut-rc.yml, release.yml, root package.json).
⭐ Changeset: AGENTS.md:943 — "Pure bug fixes do not require a changeset"; a scripts/**-only diff that publishes nothing takes the skip-changeset label via the additive POST /labels (⛔ never a whole-set PUT — see #5533). Precedent: PR #10502.

---

Generated by Claude Code

[claude]

{
 "issue": 10511,
 "status": "done",
 "branch": "claude/issue-10511-browser-reachable-freshness",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/10626",
 "premise_still_valid": true,
 "summary": "The comparison is `bundlesAreStale()` in scripts/check-regen-pending.mjs: `Math.max(src, config) > bundles` over `statSync().mtimeMs`. The rule is sound and is untouched; the defect is in the self-test fixture, which compared two mtimes of different resolutions — `writeFileSync` stamps `src/a.ts` to the nanosecond (ext4/tmpfs) while `new Date()` carries whole milliseconds, so `utimesSync(bundle, new Date())` can land up to 1 ms BEHIND a source written microseconds earlier and the bundle touched later in wall-clock time reads as the older of the two. Both sides are now stamped from one integer-millisecond anchor with explicit per-case offsets (the discipline dist-freshness.test.ts already applies to this same library), plus two new cases: a 1 ms-older bundle must read stale, and an exact mtime tie must read fresh. NOTE the issue's hypothesised mechanism is backwards — a same-second tie reads FRESH under a strict `>`, so the tie direction was already safe; the mechanism is millisecond truncation, which runs the other way.",
 "tests": "All gate-union work ran AFTER the final commit f12cee12e6, on that tree.\n\nREPRODUCTION (numbers): old fixture replayed hot in one process against the REAL bundlesAreStale — 378/500 failures (75.6%) of 'accepts a build newer than its sources'; sample src=1787293540480.6 bundle=1787293540480 margin=-0.600 ms. Old fixture cold, one fresh process per run — 0/50, margins 2.46-9.46 ms. Old fixture through the real gate (`tsx scripts/check-browser-reachable-entries.ts --self-test`) cold — 0/20. So P(fail) = P(elapsed < frac(src mtime)), frac ~ U(0,1) ms. NEW fixture replayed hot on the identical harness — 0/2000; through the real gate cold /tmp 0/20, TMPDIR=/dev/shm 0/20, under 4x busy-loop load 0/20.\n\nCI-log check: the failing job 96635813304 and a green run minutes earlier (job 96635742397) both show ~50 us between adjacent check lines, so the log timestamps cannot discriminate — Node's console.log to a pipe is buffered and the block flushes in one batch. Both logs pulled in FULL via curl on logs_url (17343 lines), not a tail.\n\nGATE: `pnpm --filter @objectstack/spec run check:browser-reachable-entries` — its own printed verdicts: '✅ self-test: scanner, transitive walk and ledger reconciliation all behave.' over 17 ✓ cases (14 siblings + the one under test + 2 new; the brief's '13 siblings' is one short — the CI log has 14 ✓ lines) and '✅ check:browser-reachable-entries — 2 declared browser-reachable entries link no zod; 34 bundle(s) scanned, 30 zod link(s) seen elsewhere (instrument calibrated); exports map fully classified.'\n\nREJECT-SIDE ABLATIONS (no rebuild step exists on this path — tsx executes check-regen-pending.mjs from source, nothing is read out of dist — and both legs were positively observed to change behaviour, which is itself proof the mutated file was the one executed). Mutation confirmed on disk by anchor count each way, never by an editor's exit code. (A) `> bundles` -> `> bundles + 5000` (5 s tolerance window): anchor grep -c 1->0, injected 0->1; gate printed '✗ refuses a build ONE MILLISECOND older than its sources — {\"anchor\":1787294083323,\"srcOffsetMs\":-0.0009765625,\"bundleOffsetMs\":-1,\"configOffsetMs\":null}' and '✗ self-test: 1 case(s) failed.' — ONLY the new case caught it; every pre-existing reject case stayed green, which is the hole it was added to close. (B) `return false` (a stale build always looks fresh): marker grep -c 0->1; '✗ self-test: 3 case(s) failed.' — all three reject cases red, both acceptance cases correctly green. RESTORE leg: `git checkout -- scripts/check-regen-pending.mjs`, both injected markers back to 0, original anchor back to 1, `git status --porcelain` showing only this PR's file, self-test EXIT=0 and green again.\n\nOTHER GATES, derived by `node scripts/pm/dispatch-gates.mjs` with no paths passed (10 families): nul-bytes, empty-state, liveness, merge-driver, slot-lookup, strictness-ledger, test-source-alias, type-source-resolution, variant-docs, affected-docs — all EXIT=0; eslint on the changed file EXIT=0. `pnpm --filter @objectstack/spec typecheck` green — 'check:test-typecheck: OK — @objectstack/spec's test layer compiles under packages/spec/tsconfig.test.json' (the run echoed `tsc --noEmit && pnpm check:scripts-typecheck && pnpm check:test-typecheck`, so the script name really matched). `pnpm --filter @objectstack/spec build` green. Heavy work routed through scripts/pm/os-verify-lock.sh; verdict lines: 'VERDICT command-exit 0 · held the lock 136s (2m16s) · waited 0s' (build), 'VERDICT command-exit 0 · held the lock 53s · waited 0s' (typecheck), 'VERDICT command-exit 0 · held the lock 85s (1m25s) · waited 146s (2m26s)' (gate batch).\n\nDECLARED NARROWING: `node scripts/check-dev-prereqs.mjs` EXIT=1 with its own verdict '✗ The workspace is not built — 1 unmet precondition, not a list of problems. 66 of 67 workspace packages declare an entry point under dist/ that is not on disk'. Only packages/spec was built in this worktree; measuring it locally needs a full 67-package build on a container shared with five other agents. It names no path in this diff. CI runs it against a built tree.",
 "open_questions": [],
 "out_of_scope_findings": [],
 "brief_corrections": [
 "MECHANISM: the issue's hypothesis — a same-second mtime tie read as STALE by a strict `>` — is backwards. `bundlesAreStale` returns `max(src,config) > bundles`, so an exact tie yields false = FRESH and the acceptance case passes. The real mechanism is `new Date()` truncating to whole milliseconds against a nanosecond-resolution filesystem mtime, which pushes the bundle BEHIND the source. The card's fix-shape hint 'make the fixture's mtimes explicit (utimes with a deliberate gap)' was nonetheless the right route; the other half of the hint ('make the comparison tolerant of equality') would have been a production change that buys nothing here — equality already reads fresh.",
 "CASE COUNT: the brief (and the issue body) say '13 sibling self-test cases pass'. The full CI log for job 96635813304 has 14 ✓ lines plus the 1 ✗ = 15 cases. This PR takes it to 17.",
 "CLAIM: the brief says the card was 'Assigned and claimed for you by the PM seat'. Issue #10511 has ZERO comments — assignee os-zhuang and label pm:dispatched are present, but there is no claim comment naming a session ID and branch, which is what CLAUDE.md defines a claim as. I proceeded on the dispatch; flagging it because that read is the repo's guard against two agents taking one card.",
 "os-verify-lock.sh (the PR #10609 caveat): behaved correctly in every use — --status named a real holder in another worktree (pid 18592, objectstack-issue-10599) and queued me 146s before granting. One VERDICT read `command-exit 0` for a command that had actually failed, but that was my own pipe (`... | tail`) masking the exit code inside the wrapped string, i.e. the documented pipeline trap on the caller's side, not a wrapper defect. No oddity to report.",
 "TOOLCHAIN: `pnpm install --workspace-concurrency=2` is rejected by pnpm 10.31.0 ('ERROR Unknown option: workspace-concurrency', suggesting network-concurrency). That flag belongs to `pnpm run`/recursive script execution, not to `install`; the flag-ordering note applies to the former only.",
 "`gh` is indeed absent (used curl + $GITHUB_TOKEN throughout) — brief correct. The get_job_logs tail caveat also held: I pulled both job logs in full via logs_url, and the green comparison run's evidence sat where a tail would not have reached it cleanly."
 ]
}

---

Generated by Claude Code