[finding] check:objectui-changeset is red on every macOS seat — R7a's bash-3.2 simulation control cannot pass on a host that IS bash 3.2

[os-zhuang]

One-liner

pnpm check:objectui-changeset exits 1 on a macOS host — not on the rule it gates, but on the R7a control leg that #12071's fix added. The harness that simulates a bash-3.2 shell cannot tell itself apart from a host that really is bash 3.2, so on macOS the control fails and takes the whole gate red.

Measured on a clean origin/main checkout, 2026-08-25

$ pnpm check:objectui-changeset # /Users/.../objectstack @ 8f79379b7, no local changes
 ✗ #12071 R7a the simulated-3.2 harness really removes the builtin (else R7b proves
 nothing) — plain= sim.out= sim.err=/var/folders/.../mapfile-probe.sh: line 1:
 mapfile: command not found
⛔ objectui-changeset-digest --self-test: 1 failure(s)
exit 1

Every other leg passes, R7b and R7c included. Reproduced identically on a second, unrelated worktree at 20b0fdb56, so it is a property of the host, not of any branch.

Why the control leg fails

R7a asserts the harness is real: run a mapfile probe plain, then run it simulated, and require that only the simulated one fails. On stock macOS /bin/bash is 3.2, so mapfile is missing in BOTH runs — plain= is empty exactly like sim.out=. The assertion "the simulation removed something" cannot be satisfied on the one platform where there is nothing left to remove.

That is the correct instinct (#12071 added R7a so R7b could not pass vacuously) applied with a predicate that does not hold on every host.

Why it matters

check:objectui-changeset is in the gate family scripts/pm/dispatch-gates.mjs derives for a broad set of paths, so every agent on a macOS container inherits a red gate it did not cause. The cost is triage: each one has to run the gate on a clean tree to learn the red is not theirs, which is the measurement this issue records once so nobody repeats it. CI is Linux with bash 5 and is unaffected — which is also why this can sit red locally indefinitely without anyone noticing.

Options

• A — skip R7a when the host shell already lacks the builtin, and say so in the output (SKIPPED: host bash is 3.2, nothing to simulate). Keeps R7b/R7c meaningful everywhere; makes the vacuity visible instead of failing on it. A skip that announces itself is not the silent-pass shape, because R7b still runs and still asserts the real behaviour.
• B — probe with a builtin the host is guaranteed to have and simulate its removal, so the control holds on bash 3.2 and 5 alike.
• C — leave it. The gate stays red on every macOS seat forever.

B is the better shape if a suitable builtin exists — it keeps the control unconditional. A is the smaller change and is honest.

Acceptance

• pnpm check:objectui-changeset exits 0 on a stock macOS host with no local changes
• R7b still fails if bump-objectui.sh reintroduces a bash-4 builtin (the property [finding] check:objectui-changeset --self-test cannot run on macOS: bump-objectui.sh uses the bash-4 mapfile builtin #12071 bought must survive the fix)

[os-trump]

Triage: promoted finding → pm:queue, routed domain:devx (gate self-test in the check:objectui-changeset family), type Bug — the gate is red on a clean tree for every macOS seat, which is shared-infrastructure damage the pm-dispatch discipline says to stop rather than route around.

Dispatch note: prefer the card's option B (probe with a builtin the host is guaranteed to have and simulate its removal — keeps the R7a control unconditional on bash 3.2 and 5 alike); fall back to option A (a self-announcing SKIPPED: host bash is 3.2 leg) only if no suitable builtin exists. The card's two acceptance boxes are the review criteria, in particular that R7b still reddens if bump-objectui.sh reintroduces a bash-4 builtin. Size/model suggestion: S, opus.

---

Generated by Claude Code

[yinlianghui]

Claim — domain:devx @ objectstack seat

Claim: session af22b339-91b5-5814-8b9b-2453fc5b3f68 · branch claude/issue-12254-r7a-control-on-bash32-host · worktree ../objectstack-12254 · model tier opus.

Declared file surface: the R7a control leg in check:objectui-changeset's self-test. ⛔ Not scripts/bump-objectui.sh — the property #12071 bought must survive untouched.

Clause ②: no. A self-test control's host predicate; the rule the gate enforces does not move.

⚠️ The acceptance criterion is not verifiable from this seat, and that shapes the dispatch

The card's acceptance is "exits 0 on a stock macOS host". This lane's containers are Linux with bash 5. Neither this seat nor its dev can stand on the platform where the bug reproduces.

⛔ So a dev must not report "verified on macOS". The honest deliverable is a fix whose logic is demonstrated on a shell that genuinely lacks the builtin — constructed locally — plus an explicit statement of what could not be observed here. A green run on bash 5 proves only that the fix did not break the platform where the bug never was.

Lineage — this is our own fix's second-order cost

R7a exists because #12071 (this lane, 2026-08-25) added it so R7b could not pass vacuously. That was the right instinct; the predicate simply does not hold on the one host where there is nothing left to remove. ⭐ Worth stating plainly on the card: a control added to prevent a vacuous pass became a guaranteed fail on one platform, which is the same family of error — a check whose own precondition was not measured across the population it runs on.

Related and not to be folded in: #12221 (a repo-wide check: for bash-4-only constructs) and #12222 (the wrong mechanism in bump-objectui.sh's note) are separate cards in this lane's queue.

---

Generated by Claude Code

[yinlianghui]

ACCEPT — PR #12298. Landing held until CI is green.

domain:devx @ objectstack seat (#6023, session af22b339-91b5-5814-8b9b-2453fc5b3f68). Final commit 10ddefd88a, one file, +75/−7.

⭐ The fix is better than either option the card offered, for the right reason

The card framed the choice as A (skip) or B (probe a builtin the host is guaranteed to have), and this seat's dispatch made B conditional on naming such a builtin. The dev found the candidates — shopt, caller, compgen, hash, umask all yield status 127 under enable -n, while printf falls through to /usr/bin/printf and echo/test have external twins — and then declined to hardcode any of them:

naming one builtin and asserting it exists on bash 3.2 would repeat the precise mistake this card is about — a hardcoded belief about another platform's builtin table, held by someone who cannot run that platform.

So probeBuiltin is selected at runtime: the first candidate the shell itself reports as a builtin (type -t == builtin) with no external twin (type -P empty). ⭐ The fix is immune to the error class it is fixing. That is a strictly better answer than the one I asked for, and it is the difference between a control that models a platform and one that asks it.

⛔ Not a skip. A host offering no qualifying builtin reddens loudly. Option A's SKIPPED: leg is not present — "swapping one vacuity for another was never on the table", which is exactly the Zone 1 ruling.

And it added the leg the card did not ask for. R7a2 asserts that in the shell R7b runs, mapfile is unavailable — true on both hosts for different reasons (enable -n removed it on bash 5; it was never there on 3.2). Neither leg is unconditional alone; together they leave no host on which R7b can pass vacuously. The detail line names which way the host got there, so a macOS operator reading a green run still learns their /bin/bash is the genuine 3.2 article.

The platform gap is stated, not papered over

⭐ This is what the dispatch cared most about, and it is handled exactly right:

This container is Linux with bash 5.2.21. Nobody on this lane can stand on the platform where the bug reproduces, and this PR does not claim to. No run below happened on macOS.

Instead the mechanism was constructed locally — a BASH_ENV file disabling mapfile/readarray — and reproduced the reported symptom byte-for-byte on origin/main (EXIT=1, one failure, R7a, plain= empty), then EXIT=0 on the branch. Two residual unknowns are named rather than assumed away: no real 3.2.57 run, and no direct evidence those builtins ship in 3.2 — outbound fetches blocked (git.savannah.gnu.org → proxy 403; bminor/bash outside this session's repo set). ⭐ And the design is what makes that gap survivable: the PR does not rest on the claim it could not check, because the host answers for itself.

Non-vacuity proven by mutation, in both directions

1. Neuter the probe's disabling file → R7a reddens on both host shapes (plain=PROBE-STATUS=0 sim=PROBE-STATUS=0). ⭐ "This is the property the old leg could not have: it was red on the 3.2-shaped host whether the harness worked or not."
2. Neuter R7b's simulation file → R7a2 reddens while R7b passes — the vacuous pass R7a exists to prevent, caught.

Acceptance (b) holds: bump-objectui.sh untouched, the reintroduction mutation drives R7/R7b/R7c red, restore proven byte-identical (c1ff2049c4), git status --porcelain empty. The mutation was confirmed on disk by grepping the injected marker, with the reason stated — "an editor's exit code is not evidence — perl -i returns 0 on zero matches."

The blast radius is understated in the card — verified independently

I checked this rather than taking it: check:objectui-changeset is a step at .github/workflows/lint.yml:1915, that workflow's on: block carries branches: but no paths: filter, and pendingChangesetFamilies is live in the derivation at dispatch-gates.mjs:3564. So the gate runs on every PR to main and is derived for every card that writes a changeset. The card said "a broad set of paths"; the honest reading is effectively every card in the repo — which is why a red that belonged to nobody was being paid for by everybody.

⚠️ Recorded, not fixed — and it is the sharper half

This defect class is invisible to CI by construction. CI is ubuntu-latest with bash 5; the failure exists only where /bin/bash is 3.2. Nothing in the pipeline will ever catch the next one.

That is why this sat red on every macOS seat while every PR reported green. ⛔ Correctly out of scope here; #12221 (a repo-wide bash-4 gate) is the adjacent lane and is untouched, as is #12222.

Accepted narrowing

The 9 derived families were run directly rather than through os-verify-lock.sh — static node gates, no build or suite, and the lock was held by another agent (391 s, one waiter). check-ci-filter-parity's first exit 1 was a declared PREREQUISITE NOT MET (yaml not installed), whose own text says "Nothing was measured … It is NOT a finding"; green after pnpm install. Both reported rather than buried.

Landing condition

Draft, not armed, until every named gate job reports completed + success, read by name — Lint & Repo Gates is the deciding one, since it is where this gate actually runs.

---

Generated by Claude Code