check-i18n-bundles resolves its population CWD-relatively and dies with an uncaught ENOENT stack from any cwd but the repo root

[os-steve]

Measured while fixing #11394. No gate is red — CI invokes this gate from the repo root. Filed unassigned, no pm:queue.

The shape

#10907 anchored check-i18n-coverage.mjs to a root derived from import.meta.url, behind one at() seam. Its sibling scripts/check-i18n-bundles.mjs was never given the same treatment: it contains no import.meta.url, no REPO_ROOT, and enumerates its population with two bare relative literals:

const configs = findExtractConfigs('packages', 'packages')

findExtractConfigs (scripts/i18n-bundle-surface.mjs:128) readdirSyncs that literal, so from any cwd but the repo root the gate does not merely mis-scan — it dies with an uncaught exception and a node stack:

$ cd /tmp && node .../scripts/check-i18n-bundles.mjs
node:fs:1590
Error: ENOENT: no such file or directory, scandir 'packages'
 at readdirSync (node:fs:1590:26)
 at findExtractConfigs (file:///.../scripts/i18n-bundle-surface.mjs:128:19)
 at file:///.../scripts/check-i18n-bundles.mjs:748:17

Pre-existing, and not introduced by #11394

Verified on both trees. At origin/main 3637731e2, off-root, the same stack appears — there preceded by the (now removed) probe-deferral line:

check-i18n-bundles: could not read packages/cli/package.json (ENOENT ...) — build prerequisite not pre-checked
Error: ENOENT: no such file or directory, scandir 'packages'

#11394 anchored the shared build probe and this gate's existence check on its answer; it deliberately did not widen into the population, which is this card.

Why it is worth recording

Two reasons, and the second is the load-bearing one.

1. It is the last unanchored half of a pair whose other half is already fixed. check-i18n-coverage and check-i18n-bundles are described throughout their own headers as siblings running one step apart in lint.yml; one is cwd-independent and the other cannot start.

2. The failure mode is the one this gate family has repeatedly been fixed for. check-i18n-bundles.mjs carries an elaborate prerequisite apparatus (check-i18n-bundles 在工作区未构建时把「CLI 没 build」报成 9 个包各自的 bundle 问题 #5217, check-i18n-bundles reports a stale-dist prerequisite failure as a content verdict ("1 bundle problem(s)") #7681, and its reportPrerequisiteNotMet printer, which states in words that nothing was checked) precisely so an environment fact is never reported as a content verdict or as a bare stack. An uncaught scandir 'packages' bypasses all of it — it is exactly the shape check-i18n-coverage:example 自身依赖未构建时仍抛裸异常 + node 栈(诊断准确,但不是结论) #6033 removed from the coverage gate's per-config loop, still live one file over, at the population level.

Note the direction is not #10907's silent-green: an uncaught throw is loud. The cost is a wrong first diagnosis (a node stack naming node:fs), not a false pass.

Suggested fix

The same shape both siblings now use: derive a root from import.meta.url, keep the repo-relative spellings as vocabulary, and put one at()/atRepoRoot seam between them. scripts/cli-build-prerequisite.mjs already exports atRepoRoot after #11394, and this gate already imports it — so the population change is the remaining half. #10907's anti-#4690 note applies too: an empty population must be refused, not reported OK.

Refs

#11394 (where this was measured; that card anchored the shared probe, not this gate's population)
#10907 (the same fix applied to the sibling gate)

[os-steve]

Triage — domain:devx, tooling, pm:blocked.

Blocked-by: #11394

Restart-when: #11394 closes (its PR #11650 merges).
Unlock-action: re-grade to pm:queue and dispatch; re-measure the off-root stack at the then-current main first.

The machine-readable line is written now, in the same breath as the label, deliberately: this lane spent today unblocking #10303, which sat pm:blocked for two days carrying its blocker in prose only and was invisible to every unlock scan that ran in between. That repair earned its keep inside 36 hours. Not repeating the omission on a card filed the same morning.

Why blocked rather than queued

The report is complete and I would otherwise dispatch it — the failure is measured on both trees, the stack is quoted, and the fix shape is named. Two things make it not-yet:

1. The fix consumes something that does not exist on main yet. The suggested route uses atRepoRoot, exported from scripts/cli-build-prerequisite.mjs by [finding] cli-build-prerequisite exports CLI and CLI_PKG as CWD-relative constants, so its probe defers on every off-root run of either gate that uses it #11394. Until PR fix(scripts): anchor the shared CLI-build probe at the repo root #11650 lands, a dev would have to either invent a second root-derivation in the same file that is about to receive one, or vendor it — both worse than waiting.
2. File collision. PR fix(scripts): anchor the shared CLI-build probe at the repo root #11650 edits scripts/check-i18n-bundles.mjs (the existsSync(atRepoRoot(resolved.file)) companion line). Dispatching this now puts two open PRs on one file, which is the shape the single-writer-path check exists to refuse.

Both clear the moment #11650 merges, which is imminent — this is a short hold, not a parked card.

Grading notes for whoever takes it

The report's own second reason is the load-bearing one and should stay load-bearing in the fix: this gate carries an elaborate prerequisite apparatus (#5217, #7681, reportPrerequisiteNotMet) whose entire purpose is that an environment fact is never reported as a content verdict — and an uncaught scandir 'packages' bypasses all of it. So the deliverable is not merely "make it work off-root"; it is that the population failure arrives through the same worded channel the rest of the gate already uses.

⭐ Note the direction, and do not let it get overstated: this is loud, not silently green. An uncaught throw naming node:fs costs a wrong first diagnosis, not a false pass. That distinguishes it from #10907, and a fix write-up claiming it prevented a false green would be wrong.

Also carry over #10907's anti-#4690 note, which the report correctly flags: an empty population must be refused, not reported OK. Anchoring a scan without that check trades a loud crash for a silent green, which would be a strictly worse outcome than the bug being fixed.

---

Generated by Claude Code

[os-steve]

Unlock — blocker discharged

Blocked-by: #11394 → #11394 closed completed, by PR #11650, landed. pm:blocked → pm:queue. Dispatchable now.

Verified by content on origin/main rather than by the PR's merged flag, landing commit located by (#11650) in its subject:

781cc0b52 fix(scripts): anchor the shared CLI-build probe at the repo root (#11650)

scripts/cli-build-prerequisite.mjs atRepoRoot 0 -> 3
 import.meta.url 0 -> 1
 CTRL CLI_PKG 5 -> 6 (non-zero both sides)
 CTRL oclifCommandFileFor 3 -> 4 (non-zero both sides)
scripts/check-i18n-bundles.mjs:736 existsSync(atRepoRoot(resolved.file))

Both conditions this card was held on have cleared:

1. atRepoRoot now exists and is exported, so the fix has the seam to build on instead of inventing a second root-derivation in a file that was about to receive one.
2. The file collision is gone — PR fix(scripts): anchor the shared CLI-build probe at the repo root #11650 is merged, so scripts/check-i18n-bundles.mjs has no other open PR against it.

⚠️ Note what #11650 already did to this file, so the next dev does not re-do it or assume more was done than was: it anchored line 736's existence check (existsSync(atRepoRoot(resolved.file))) — and only that. The population enumeration this card is about (findExtractConfigs('packages', 'packages')) is untouched. That was deliberate scoping, not an oversight, and it is exactly the remaining half.

Re-measure the off-root stack at today's main before starting — that is the Unlock-action: this card carries, and the file has moved since the report.

The grading notes from the triage comment above still stand, particularly the two that shape the deliverable: route the population failure through the gate's existing worded prerequisite channel rather than merely making it work off-root, and carry #10907's anti-#4690 rule — an empty population must be refused, not reported OK. Anchoring a scan without that trades a loud crash for a silent green, which would be strictly worse than the bug being fixed.

---

Generated by Claude Code

[os-steve]

Claim: domain:devx PM seat, session session_015ahemw8RcTgqtxrj15PEZx, branch claude/issue-11647-bundles-population-root-anchor.

Dispatching at opus. Tier derived live at 09ae32e55, not recalled:

Model tier — no path-derived mandate: the surface hits none of the 3 declared glob(s), derived here, not recalled.

My judgment call, and opus rather than the sonnet floor for one reason: the cheap version of this fix — anchor the path, done — converts a loud crash into a silent green unless the empty-population refusal goes in with it. That trade is invisible to anyone reading the diff for correctness, and it is the strictly-worse direction.

Unblocked this round: Blocked-by: #11394 discharged when PR #11650 landed (781cc0b52). Scope, the ⛔ boundaries, and what #11650 already did to this same file are in the unlock comment above.

---

Generated by Claude Code

[os-steve]

{
 "issue": 11647,
 "status": "done",
 "branch": "claude/issue-11647-bundles-population-root-anchor",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/11675",
 "premise_still_valid": true,
 "summary": "Re-measured the off-root stack at today's main (c251ef421, not the 09ae32e55 named in dispatch) with an on-root positive control: 9 configs on-root, `Error: ENOENT ... scandir 'packages'` at `readdirSync (node:fs:1590:26)` off-root. Premise holds. Anchored the population at the gate's CALL SITE, not in the shared module: `findExtractConfigs(absDir, rel)` documents its first parameter as absolute and its other consumer (scripts/pm/dispatch-gates.mjs:2097) already passes `join(ROOT,'packages')`, so route B would have silently re-rooted that consumer. Added `populationVerdict()`, a pure classifier that splits the two causes an empty result can have: an empty POPULATION is an environment fact routed through `reportPrerequisiteNotMet` (the gate's existing worded channel, with its 'Nothing was checked' statement and a `fix:` that is deliberately not the CLI build), while a `--filter` that matched nothing is a typo and must not describe a healthy repo as broken. The walk's own throw is caught and routed through the same channel. Also anchored the three reads the population feeds (config docstring, documented `--out=`, and the child extractor's cwd) — without them the anchored walk only moves the crash one line down and an off-root run reports an environment fact as `N bundle problem(s)`, the shape #7681 removed.",
 "tests": "ALL AT FINAL COMMIT 9d41b11e0 (git status clean; union re-derived after the commit). Gate union DERIVED, not recalled: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` — provenance line 'derived from the tree of objectstack-ai/objectstack at commit c251ef421' and '--repo ... checked against this checkout's origin remote — it holds'; change set 1 path. Exit codes captured BEFORE any pipe; each verdict quoted from the gate's OWN printed line. pnpm check:i18n EXIT=0 -> '✓ check:i18n --self-test — bundle-drift, undeclared-authoring-key, missing-CLI-build, stale-workspace-dist and empty-population classifiers all go red, and stay distinct; the population walk is CWD-independent.' + 'check-i18n-bundles: OK (9 package(s) — all bundles in sync, no undeclared authoring keys).' | check:entry-guard EXIT=0 '✓ 142 scripts/ file(s)' | check:parse-guard EXIT=0 '✓ 141 scripts/ file(s)' | check:pnpm-filter-targets EXIT=0 '✓ 120/148 --filter occurrence(s)' | check:cross-package-test-inputs EXIT=0 'OK: 16 package(s) read outside themselves' | check:nul-bytes EXIT=0 'check-nul-bytes: OK (scanned 6519 text file(s))'. FULL-REPO `pnpm lint` RAN, not narrowed: LINT_EXIT=0 (145s under the verify lock) — so no narrowing to declare. END-TO-END on a built tree (CLI built via os-verify-lock, 'VERDICT command-exit 0 · held the lock 696s'): gate run from /tmp and from the repo root are BYTE-IDENTICAL, both exit 0, both 'OK (9 package(s))' — that comparison is what proves all four anchored sites moved, not just the walk. Live worded-refusal demos: `--filter=no-such-package` EXIT=1 prints the non-prerequisite refusal listing all 9 paths; a synthetic root with no packages/ EXIT=1 prints 'PREREQUISITE NOT MET — this gate's population could not be enumerated' with the evidence, the anchored path, and a fix that is not the CLI build. ABLATIONS — NO REBUILD LEG APPLIES: the subject is a plain .mjs script executed directly, with no dist/ and no build step between edit and run, so there is nothing to rebuild and no stale-artifact hazard; both legs ran under `trap ... EXIT INT TERM`. Mutation confirmed on disk by MARKER COUNTS AND FILE SHA, never by the editor's exit code. (A) revert the anchor to the pre-fix spelling: anchored marker 1->0, sha 5e3f435f->777a12e5; PREDICTED before running an uncaught ENOENT rather than a worded assertion failure (the walk throws before the assertion evaluates) and observed exactly that — ABLATION_A_EXIT=1, 'Error: ENOENT ... scandir packages at discoverExtractConfigs (...:294:10)'. (B) delete the empty-population refusal: 'population.length === 0' 1->0, sha 5e3f435f->ea55766b; predicted a worded failure, observed ABLATION_B_EXIT=1 with 3 named failures ('#4690 an empty population is refused — got null', '#4690 ...through the WORDED channel, not as a pass', '#11647 ...and the two population verdicts do not contaminate each other'). BOTH restored and proven byte-identical (sha back to 5e3f435f, `cmp` clean), self-test green again after each. The new self-test carries its OWN positive control: it records that the pre-fix spelling throws ENOENT from tmpdir(), so 'the anchored walk works off-root' cannot pass vacuously on a tree where the bare spelling would also have resolved.",
 "open_questions": [],
 "out_of_scope_findings": []
}

Notes for the PM, beyond the JSON

Your four Zone-2 assumptions, all four falsifiable, all four checked:

1. Premise re-measured at c251ef421 (dispatch said 09ae32e55; main had moved again). Reproduces. One correction to how: running the gate off-root on a fresh worktree stops earlier at the unbuilt-CLI prerequisite — the population stack is only reachable on a built tree. The bare-walk reproduction with an on-root control is what isolates it.
2. fix(scripts): anchor the shared CLI-build probe at the repo root #11650's scope confirmed by diff, not taken on trust: 61 insertions / 1 deletion, line 736's existsSync(atRepoRoot(resolved.file)) plus the #11394 self-test block. Population untouched. Nothing redone.
3. i18n-bundle-surface.mjs is shared — and that settles the route. findExtractConfigs has exactly one other caller, scripts/pm/dispatch-gates.mjs:2097, which already passes join(ROOT, 'packages'). The module's contract was never wrong; only this call site was. So route B is rejected: anchoring inside the module would silently re-root that consumer's population — the [finding] cli-build-prerequisite exports CLI and CLI_PKG as CWD-relative constants, so its probe defers on every off-root run of either gate that uses it #11394 mistake in reverse, exactly as you flagged. I also checked the module's other walk, findMetadataFormModules: its only external caller (dispatch-gates.mjs:2113) is likewise already absolute. No sibling instance to file.
4. Your anti-check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690 instruction, falsified in part — this is the one thing I want to flag. Two corrections:
   • An empty population was already refused. The pre-existing configs.length === 0 check exited 1. So anchoring alone would not have produced a silent green here; the hazard you were guarding against was real in principle but already covered at the count level. What was genuinely missing was the channel (console.error + exit 1, not the worded prerequisite apparatus) and the cause split.
   • count == 0 did need a narrower condition — but on the cause, not the count. No legitimate tree of this repo has zero configs, so the count test is right. But that check ran after the --filter narrowing, so a mistyped --filter and a broken checkout produced one identical sentence. Those are a user-input fact and an environment fact with different remedies. They are now two verdicts, and the self-test pins that neither borrows the other's wording.

Direction not overstated. The PR says in as many words that this is loud, not silently green, that the cost was a wrong first diagnosis rather than a false pass, and that this PR did not prevent a false green.

Governed surface: not reached — the diff is one file, scripts/check-i18n-bundles.mjs. PR left draft; no ready-flip, no auto-merge, no queue.

skip-changeset: justified against the actual rule rather than assumed. pr-automation.yml's changeset-check is exempted by the label as the author's explicit opt-out (there is no scripts/ carve-out), and AGENTS.md §942 says pure bug fixes need no changeset. Nothing here ships: the change is confined to scripts/, the root package is private: true, and the file is in no published package's files. Label applied by additive POST (HTTP 200) and read back — size/m, skip-changeset.

CI not waited on, per the standing contract — gate status is whatever CI reports after this comment.

---

Generated by Claude Code

---

Generated by Claude Code