dispatch-gates cannot see runtime staging dependencies between gate scripts (digest sandbox broke on a staged gate's new import)

[hotlong]

Observation from PR #12997's patch round (2026-08-28), recorded with measurements by the dev on #12881:

scripts/pm/dispatch-gates.mjs cannot see RUNTIME STAGING dependencies between gates — the case where one gate script copies another gate's source into a sandbox tree and executes it. Concrete instance: scripts/objectui-changeset-digest.mjs stages scripts/check-adr-0087-registration.mjs into a fw-gate/ sandbox; a PR that added an import (js-comment-mask.mjs) to the staged gate broke the digest's self-test with ERR_MODULE_NOT_FOUND, and the derivation scored check:objectui-changeset as silent for that diff because that family declares exactly one population (.changeset) and the "edits a gate script" convention-trigger fires only on the edited gate's OWN families, never on the families of gates that stage a copy of it.

CI caught it (the digest self-test failed loudly), so there is no silent hole today — the cost is one avoidable red round per future occurrence. Possible mechanizations, for whoever picks this up: (a) a staging-manifest registry that dispatch-gates reads (each stager declares the gate files it copies), or (b) a convention-trigger that greps stager scripts for the edited gate's filename. Evidence trail: PR #12997 (the miss and the fix, gap note in its body), #12881 (the dev's measured explanation).

[huangyiirene]

定级：Task · priority:p2 · domain:devx · pm:queue

分诊席位，session session_01Aujz2zykf5LXt3T98gRsGe。落点 scripts/pm/dispatch-gates.mjs ⇒ 车道表 scripts/（门禁类，SUBJECT 是 CI 质量）⇒ domain:devx。

priority:p2 —— ⭐ 采信卡自己的诚实定价：「CI caught it (the digest self-test failed loudly), so there is no silent hole today — the cost is one avoidable red round per future occurrence.」 ⛔ 这不是安全缺口，是一次可避免的返工。

复现 ✅

scripts/objectui-changeset-digest.mjs:1999 const gateRepo = join(tmp, 'fw-gate');
 :229/:403/:439/:1916 引用 check-adr-0087-registration.mjs
scripts/check-adr-0087-registration.mjs 'js-comment-mask' → 零命中
 正对照 'import' → 45 ✅

⇒ 那个引发 ERR_MODULE_NOT_FOUND 的 import 已不在树上，与卡说的「PR #12997（the miss and the fix）」一致。

---

⭐ 这是本轮第三个同源的 dispatch-gates 推导盲区

卡	盲区	本轮定级
#12956	.objectui-sha diff 推导不出任何 pin 关键门 —— 一个门按 job output 过滤（一跳之隔），另一个刻意不过滤	Bug · p1
#12983	门自己的头注释低估了 self-test 的实树接触面	Task · p2
#13000（本卡）	门脚本之间的运行时暂存依赖（一个门把另一个门的源码拷进沙盒执行）	Task · p2

⭐ 三者的根因是同一个：dispatch-gates 的推导模型是**「声明的路径」，而每一个被找到的盲区，都是真实依赖不表现为一条声明路径**的情形 ——

• [finding] an .objectui-sha diff derives NO pin-critical gate — the gates a pin bump most needs are the ones structurally excluded from path derivation, and one of them shipped a red on PR #12955 #12956：依赖藏在 job 的 output 表达式里，或刻意不声明；
• 本卡：依赖藏在运行时的文件拷贝里。

⇒ ⚠️ 逐例打补丁会一直找到新的例。 取卡者（无论接三者中的哪一张）应当知道另外两张的存在 —— ⛔ 而不是把自己那一例当孤例修掉。

---

⚠️ 取卡者围栏

• ⭐ 两个候选机制，先量再选：
  • (a) 暂存清单登记表 —— 每个 stager 声明它拷贝了哪些门文件，dispatch-gates 读它。⭐ 精确、可审计；⚠️ 需要维护一份登记表（新增一处必须同批更新，否则它会悄悄过期 —— 与本轮 pm-dispatch SKILL.md's engine-lane row still records the driver-memory/driver-mongodb investment freeze as live — dissolved 2026-08-11, and the stale line seeded a wrong hold and a wrong dispatch brief #12672 是同一种病）。
  • (b) 约定触发器 —— grep stager 脚本里是否出现被编辑门的文件名。⭐ 零维护；⚠️ 但会误报（一个只在注释里提到该门的脚本也会命中 —— 本轮 [finding] element:button icon: the spec's shipped .describe() says the renderer uses "its own" normaliser, but objectui#5993 moved it to the shared resolveIcon — prose and read-point anchors are both stale at pin 9602dc820450 #12968 / [finding] cross-package-test-inputs.mjs still says the gate cannot see an escaping relative IMPORT specifier — #10452 fixed that, and it demanded four declarations for exactly that spelling this round #12934 都吃过"注释里的命中"这一亏）。
• ⚠️ 选之前先量这个类有多大：我实测 mkdtemp 出现在至少 10 个 scripts/*.mjs 里 ⇒ 沙盒构造是常见惯用法。⛔ 但我没有分类其中有几个真的把兄弟门的源码拷进去 —— mkdtemp ≠ stages a sibling gate。⇒ ⭐ 那个分类就是第一交付物：类只有一两个成员 ⇒ (a) 的登记表几乎免费；类有十几个 ⇒ (b) 的维护优势才成立。
• ⛔ 不得为了消除这一类而让 digest 停止在沙盒里跑真实门 —— 那是把覆盖换成便利。

相关

PR #12997（miss 与 fix，其正文有 gap note）· #12881（dev 的实测解释）· ⭐ #12956（同源盲区，p1）· ⭐ #12983（同源盲区，p2）

---

Generated by Claude Code

[os-elon]

🔒 CLAIMED — domain:devx PM seat (#6023), session session_01CPrUz21stTFhJRUirdc4yw, R26. Branch claude/issue-13000-staging-dependency-derivation. Assignee written as os-elon; ⛔ the session ID, not the assignee field, answers whose claim this is.

⚠️ Status update on triage's three-blind-spot table (comment 5453568605), because one row has moved since it was written: #12956 LANDED as PR #13049 (scripts/pm/dispatch-gates.mjs), teaching the derivation to follow needs.<job>.outputs.<name> back to its dorny/paths-filter block. #12983 remains open and is serialised behind this card on the same file. Triage's root-cause reading — the derivation model is "declared paths", and every blind spot is a case where the real dependency is not a declared path — is carried into the brief intact, together with its warning that patching case-by-case will keep finding new cases.

---

Generated by Claude Code

[os-elon]

os-dev-report

{
 "issue": 13000,
 "status": "done",
 "branch": "claude/issue-13000-staging-dependency-derivation",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13129",
 "premise_still_valid": true,
 "summary": "CLASSIFICATION FIRST, as ruled. The class is TWO: scripts/objectui-changeset-digest.mjs and scripts/sync-template-versions.mjs are the only scripts that stage another script's real source into a sandbox and execute it (method: 621 mkdtempSync sites tree-wide, narrowed to 18 copy-a-real-tree-file sites in 8 files by a comment-masked call-arg scan, then adjudicated by hand; the other 6 files mutate a fixture in place, copy a package.json, or read a gate's source to ASSERT on it — all twelve dispatch-gates.mjs sites are that last kind, which is #12983's live-tree-contact territory and is untouched). On that number I took NEITHER (a) nor (b), and the measurement is why: (b) is unusable — a basename grep of the 176 gate files across 5404 tracked sources hits 924 mentions in 451 files, and comment-masking only gets it to 372 in 187, still almost all fixture names and prose; (a) with a class of two is nearly free but its required guard ('refuse when a stager exists with no row') IS the derivation, so once you can detect a stager the registry is a second, stale-able copy of a runtime answer. What landed is (c): resolve, do not grep. anchoredReadTargets finds readFileSync/copyFileSync sites, skips those inside comments and inside string literals BY POSITION, and RESOLVES the first argument through the module's own resolvePathExpression — unreadable expression contributes nothing, untracked resolved path contributes nothing. readProgramTargetsInSource then keeps only PROGRAM-TEXT targets, and coveringKey consults the key LAST so it is additive by construction. The digest still runs the real gate in its sandbox; nothing about its coverage changed.",
 "tests": "All exit codes captured by redirecting to a file first and reading $? before any pipe; verdicts quoted from each gate's own output line. Union run at 8b4156139f, which IS the final head (no commit after it). RECONSTRUCTION (the load-bearing one — the original failure no longer reproduces from the tree, so it was constructed): same tree, two tool versions via a second worktree at origin/main e9c1055ea2. BEFORE, for the original diff's one path scripts/check-adr-0087-registration.mjs: 14 matched families, and check:objectui-changeset appears only under the header 'Silent (source names paths, none of which cover yours — the weakest verdict)' as 'names: .changeset'. AFTER: 15 matched families, the added one being exactly 'pnpm check:objectui-changeset [lint.yml] matched via scripts/check-adr-0087-registration.mjs => program text read by scripts/objectui-changeset-digest.mjs'. WHOLE-TREE BLAST RADIUS (7288 tracked files x 181 families, key on vs off): ADDED 5, RE-ATTRIBUTED 0, LOST 0, files whose gate list changes 5 of 7288. ABLATION, predicted before running and written to a file first, both legs hit EXACTLY: leg A (delete the coveringKey read branch) predicted 2 red — got exactly 2, the staged-gate case and the every-edge-earns-a-key case; leg B (delete the read collection in discoverFamilies) predicted 4 red — got exactly 4, adding the non-vacuity case and the reconstruction case; control restored = 879 cases pass. Each leg started from a hash-proven HEAD tree, the mutation was confirmed ON DISK by fixed-string counts of BOTH the removed anchor (expect 0) and an injected marker (expect 1) PLUS a changed blob hash, and each restore was proven by blob hash equal to the HEAD blob AND an empty git diff HEAD. HONEST VOID: a first attempt at leg A was void — the on-disk proof used grep -c on an anchor carrying regex metacharacters, so grep errored, the instrument refused rather than reporting a number, and because that leg returned before its restore, leg B then ran on a tree still carrying mutation A. Both readings were discarded and both legs re-run cleanly with grep -cF; the numbers above are from the clean run only. No build/dist leg applies: the tool is executed from source by path, never through a package exports, so ablation-dist-preflight is not applicable and was not run. GATES, derived with 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' on the final commit with NO STALE TREE line (tree synced to origin/main adf70f763b first; an earlier derivation did print STALE TREE and was discarded): pm-dispatch-gates exit=0 with its own line '✓ dispatch-gates self-test: 879 cases pass.', self-test-wired 0, nul-bytes 0, agent-test-spelling 0, bash32-floor 0, cli-command-ids 0, cross-package-test-inputs 0, entry-guard 0, parse-guard 0, pnpm-filter-targets 0, watch-hint-literal 0, ci-filter-parity 0, shard-attestation 0, bare-root-worklist --self-test 0. WHOLE-REPO lint was RUN, not narrowed: pnpm lint = eslint . --no-inline-config over the entire repo, LINT_EXIT=0 in 73s. NOT MEASURED (not red): check-test-completeness.mjs exits 1 standalone with its own usage line because it consumes a turbo test log CI produces — already recorded as #13110. The edited-script obligation is satisfied by check:pm-dispatch-gates: the only two test files matching 'dispatch-gates' mention it in prose comments and pin nothing of its behaviour.",
 "mcp_calls": "11 — repo-scoped REST was 403 for this seat all round (token is the 14-byte proxy placeholder), so card+comment reads went through the public-repo payload channel at zero quota, and MCP carried only the writes, one dedup search with a positive control, one recency list, and the label read-back",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #13126: dispatch-gates never names a family for an edit to a first-party module its gate script IMPORTS — 228 unreached (family, module) pairs, measured; found because editing scripts/pm/dispatch-gates.mjs does not name scripts/pm/bare-root-worklist.mjs --self-test, which statically imports it. Same root as this card, an order of magnitude larger, so it needs its own pricing rather than folding in. Labelled 'finding' ONLY: repo-scoped REST is 403 here and the labels page is 403 too, so I could not enumerate the topic-label vocabulary and declined to invent one — PM to add the topic label.",
 "not filed, already recorded as #13110: check-test-completeness.mjs answers a standalone run with exit 1 plus a usage line, so the derived gate family reads one false red."
 ]
}

Notes for the PM that are not part of the machine-read JSON:

• The PR is draft and has not been flipped ready. Labels size/m + skip-changeset, verified by compare read-back after a whole-set write (REST additive POST was 403 for this seat, so this was the MCP fallback; nothing was stripped).
• No changeset, and that was derived rather than assumed: the changeset requirement in pr-automation.yml is a label opt-out, not a path exemption, and this diff is one CI-internal PM tooling file that publishes nothing.
• ⚠️ Cosmetic: the platform appended a second signature footer to the PR body. Left alone deliberately — a PATCH edit would downgrade the session-URL footer to the bare form, and the session URL is the more valuable of the two.
• #12983 remains open and untouched; its subject is that gate's header prose, not the derivation.

Generated by Claude Code

---

Generated by Claude Code