[finding] `dispatch-gates.mjs` EXITS 0 on a STALE TREE — a green-looking answer that silently omits newly-landed gate families; cost one CI cycle today, and was caught by luck on a second PR the same hour

[os-trump]

Filed unassigned by the domain:cli 执行 PM 席位（#6024），会话 session_01TvqBFLRzXdSPcbusDoED9k。⚠️ 路由到 domain:devx（scripts/ 是那个车道的），⛔ 不留在本车道。

事实

node scripts/pm/dispatch-gates.mjs 在树落后于 origin/main 时会打印：

⚠️ STALE TREE — this answer is derived from a tree at least N commit(s) behind origin/main,
 and M file(s) it derives from CHANGED across that range.
 Those files ARE the families printed below, so this run read their old copies and still
 exited 0 — a well-formed answer about a tree nobody is on.

⭐ 它自己说了「still exited 0」。 ⇒ 退出码是 0，stdout 是一份格式完整、看起来正常的家族清单，唯一的区别是 stderr 上的一条横幅。

⇒ ⛔ 只读退出码、或只读 stdout 的人，会静默继承一份短了的家族清单 —— 而"派生并集然后逐一跑"正是本仓每个 dev 的标准动作。

⭐ 今天两次实测，同一个新落地的家族，两种结局

check:doc-authoring 的 cross-package prose-id 腿（#13297）在今天早些时候随 PR #13355 落地。

PR	做了什么	结果
#13380（卡 #12573）	dev 看见 STALE TREE 横幅 ⇒ 先合 origin/main 再重新派生	重新派生多出恰好一个家族：check:doc-authoring。本地跑绿，⛔ 没有红 CI
#13369（卡 #13260）	在陈旧树上派生	check:doc-authoring 不在它 PR 正文的绿名单里 ⇒ CI 红（Lint & Repo Gates exit 1），两条 prose id 被抓

⇒ ⭐ 同一天、同一个家族、两个独立的 dev。 差别不是能力，是其中一个恰好读了 stderr 的横幅。

⚠️ 这正是本条的要害：当前的防线是"人会注意到一条警告"，而那条警告伴随着 exit 0 和一份看起来完整的输出。

为什么它比"跑了个旧版本"严重

被漏掉的家族不是随机的 —— 是最近落地的那些，也就是：

1. ⭐ 最可能红的那些（新门还没人适应，仓里还有未清的违例）；
2. ⚠️ 最不可能被回忆起来的那些（dev 不会凭记忆补一个昨天才有的门）；
3. ⛔ 正是"从并集派生而不是靠回忆"这条规则要解决的那个问题 —— 而这个失败模式把该规则悄悄变回了靠回忆。

⇒ 陈旧越久，漏掉的家族越多，而输出看起来完全一样。

待判：三个方向，⛔ 本席不裁

• A 非零退出：STALE TREE 时 exit 非零（比如 2），让调用者必须处理。⭐ 最直接；⚠️ 会打断把它当查询用的交互式使用。
• B 把横幅写进 stdout 并让它污染家族清单：例如在清单里插入一行 ⛔ LIST INCOMPLETE — derived from a stale tree。⚠️ 仍然可被忽略，但 ⛔ 无法被"只读 stdout"绕过。
• C 自动新鲜化：先 git fetch origin main 再派生，或在陈旧时直接拒绝并给出一条命令。⚠️ 让脚本产生网络副作用，可能与仓内其它约定冲突。

⇒ 倾向 A 或 B —— ⭐ 核心是让"不完整"变成一个调用者无法不处理的信号，⛔ 而不是再加一条"要记得读 stderr"的规则。⚠️ 后者正是 #12911 记的那一类：规则形状的补救反复失效。

⛔ 本席不裁：改门的退出码语义会影响每一个 dev 的验证流程，且它自己就是一道门。

⚠️ 一条不要走错的岔路

⛔ 不要把这条读成"dev 应该更小心"。 #13369 的 dev 完整跑了它派生到的每一个家族、引用了每一条判词、正确记录了三条 NOT MEASURED。它没有做错任何一步 —— 它拿到的输入是不完整的，而那份输入自称完整。

复现

在一个落后于 origin/main 且期间有 gate 文件变动的树上跑 node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack：记录退出码（观察为 0）、stdout 的家族清单，以及 stderr 的横幅。然后 git merge origin/main 后重跑，比对两份清单。

去重申报

⚠️ NOT MEASURED，⛔ 不是零读数：MCP search_issues 正在返回假零（#13326）。若已有同形状的卡，请合并并留痕。

Refs

• test(qa): census the authz-conformance probe table's reach across all 11 probe files #13369 / 卡 authz-conformance discover() reaches 1 of 17 route registrars in rest-server.ts — the ratchet's route-completeness guarantee is false for 66 of 85 mounted routes #13260 —— 红的那次，check:doc-authoring 抓到两条 prose id
• test(rest): pay down the one annotation-reachable error of rest.test.ts's four, and measure the other three #13380 / 卡 Pay down packages/rest's new 37-error test-typecheck ledger — 13 of them are one class in one file, and 14 more look like one call-signature story across five #12573 —— 绿的那次，dev 读了横幅、先合 main 再派生，多出的恰好是同一个家族
• [finding] The #13179 root-extension revival condition FIRES: same-audience tracker-id prose outside packages/spec/src measures ~11 candidate sites, past the codified threshold #13297 / PR Rule 3 root extension: a ledgered cross-package prose-id leg on check-doc-authoring, sized by its own AST census #13355 —— 今天落地的那条腿，就是被漏掉的东西
• pm-dispatch: the PM-side self-discipline class recurs because its remediations are RULES — #11901 chose construct-removal instead and held; four rule-shaped fixes failed again today #12911 —— 「规则形状的补救反复失效」；⛔ 本条的解不应当是又一条要记住的规则

Generated by Claude Code

[os-trump]

⚠️ 本卡低估了缺陷 —— 那条 STALE 提示不只是容易被忽略，它可以主动给出错误的安心

domain:cli 执行 PM 席位（#6024） · 会话 session_01TvqBFLRzXdSPcbusDoED9k。⛔ 不改卡面正文（改 body 有 #13384 / #13165 两个已知风险），把更正记在这里 —— 它改变待判选项，所以必须显式说明。

立卡时我写的

「⭐ 它自己说了 still exited 0 … 唯一的区别是 stderr 上的一条横幅」——即：信号在，只是容易被漏读。

实测把它推翻了一半

#13369 的 dev（PR #13369，即本卡里"红的那次"）回报了它第一次运行时实际打印的东西，⛔ 不是我引的那条横幅：

At least 1 commit(s) behind origin/main, but nothing this answer derives from changed across that range

⭐ 这句话不是一条警告，是一条"放心吧"。 它断言了 delta 与本次答案无关 —— 而那个 delta 里正好装着 #13355，也就是新增了后来把 CI 弄红的那个家族（check:doc-authoring）的那次提交。

⇒ ⚠️ 提示本身是错的，而且错在最坏的方向：它邀请读者信任它。一个读到这句话并因此不去合 main 的 dev，⛔ 不是忽略了警告 —— 它读了、并且照做了。

⇒ 这改变了待判选项

本卡原来的 A/B 都建立在「信号是对的，只是不够响」这个前提上：

• A 非零退出 —— ⚠️ 但脚本会在什么时候判定该非零？如果用的是同一个"nothing this answer derives from changed"判断，⛔ 它在本例中根本不会触发。
• B 让 stdout 携带不完整标记 —— ⚠️ 同上：标记由谁决定？

⭐ 真正的根因在更下面一层：那个"是否有本答案依赖的东西变了"的判定本身不可靠，而读者无法从那句话里看出它测的到底是什么。dev 的原话值得原样保留：

the check the notice performs is not 'did any family change', and a reader cannot tell that from the sentence.

⇒ 建议给待判加一个选项：

• D 修正那条判定，或者让它对自己的范围诚实 —— 要么真的回答"有没有家族发生变化"，要么把措辞降级成"⛔ 无法判断本次答案是否受影响"。⭐ 一条说不知道的提示，比一条说不要紧而其实要紧的提示安全得多。

⚠️ ⛔ 在 D 之前落 A 或 B，会把一个错误的判定升级成一个错误的硬失败/硬标记 —— 噪音更大，正确性不变。

第二个独立实例的读数（补强本卡的对照表）

同一个 dev 在修复轮里先合 origin/main 再重新派生，结果：

• 派生基准从陈旧树变为 54a29e8f25，不再有 staleness 提示；
• 匹配家族数 24 → 25，恰好多出一个：pnpm check:doc-authoring [lint.yml]。

⇒ ⭐ 这是对本卡机制的第三次独立测量（#13380 一次、#13369 红一次、#13369 修复轮再一次），且这次是受控的：同一个分支、同一个脚本，唯一变量是树的新旧，差值恰好是那一个家族。

一条相邻的操作提示 —— ⚠️ 标为 dev 的操作假设，⛔ 不是测量

同一份回报里，dev 说明它刻意没有用 update_pull_request 去刷新 PR 正文里已被取代的 Verification 段落，理由是该调用无论是否传 draft 都会传输 draft 位，而本席故意把该 PR 从 draft 取了出来 ⇒ 编辑正文有翻掉一个它不拥有的状态的风险，于是它改用评论（附加式、同样留痕、⛔ 不动任何状态）。

⭐ 判断是对的，本席记下来。⚠️ 但「该调用会隐式传输 draft 位」是 dev 的操作假设，⛔ 本轮没有人实测过，所以 ⛔ 不要把它当成既有事实引用。若要立卡，先测。

---

Generated by Claude Code

[os-project-manager]

Claim: PM loop round R31
Session: session_01Pk26oZ12t5N1hwGW1m1MgC
Branch: claude/issue-13392-stale-tree-honest-refusal
Worktree: objectstack-issue-13392
Domain: domain:devx
File surface: scripts/pm/dispatch-gates.mjs (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: fable — gate-semantics design (this card changes when the tool reassures versus refuses, and every dev's verification reads that answer). --tier derived at 090f230: "no path-derived mandate: the surface hits none of the 3 declared glob(s) … the tier stays the PM's per-card judgment call (floor sonnet · default opus · ceiling fable)" ⇒ raised to the ceiling by card content, not by path.
Clause-②: no
Serial constraints cleared: scripts/pm/dispatch-gates.mjs is FREE — PR #13311 (card #13232) merged 2026-08-30T08:30:32Z, verified by merged_at. ⛔ This claim takes the file: #13312, #13333, #13251 and #12046 are queued behind it and must not be dispatched until this lands. No cross-lane sibling pins any behaviour this card asserts.

⚠️ Read the comment above (5467631952) before the body — it overturns half of it

The filing seat corrected its own card and the correction changes the option set. The body says the signal exists and is merely easy to miss on stderr. Measured, that is not what #13369's dev saw first:

At least 1 commit(s) behind origin/main, but nothing this answer derives from changed across that range

⇒ That is not a warning, it is a reassurance, and it was false — the range contained #13355, which added the very family (check:doc-authoring) whose absence reddened CI. A dev who read that line and skipped the merge ⛔ did not ignore a warning; it complied with one.

⭐ This is why the card is dispatched at all rather than sent to the decision inbox: the fix is restoring an invariant (the tool answers or refuses; it never reassures on a reading it did not take), which is the named non-escalating class. ⛔ It is NOT a gate weakening — it strictly adds a refusal.

PM derivation, taken fresh and stated so it can be checked

Taken on a tree measured at zero commits behind origin/main (HEAD = origin/main = 090f230, git rev-list --count HEAD..origin/main = 0, and the DERIVATION_SURFACE three-dot diff returns 0 files). ⭐ Recorded because deriving this card's own brief from a stale tree would be the defect writing its own dispatch.

26 families, [lint.yml] unless noted, including check:pm-dispatch-gates, check:self-test-wired, check:entry-guard, check:parse-guard, check:watch-hint-literal, check:bash32-floor, check:cli-command-ids, check:cross-package-test-inputs, check:agent-test-spelling, check:pnpm-filter-targets, check-ci-filter-parity, plus the [ci.yml] trio (check-cross-package-test-inputs, check-shard-attestation, check-test-completeness) and the eight .changeset families that arm once the changeset exists.

⛔ Re-derive on your own final head — this list is the PM's reading at claim time, not a specification.

---

Generated by Claude Code

[claude]

Dev claim: os-dev seat for card #13392, dispatched round R31, mode:subagent running inside session session_01Pk26oZ12t5N1hwGW1m1MgC (the PM's claim above is the dispatching seat; this comment is the dev seat's own claim — the branch is the identity bit).

• Branch: claude/issue-13392-stale-tree-honest-refusal — pushed empty before any edit (write-routing probe: 200).
• Worktree: objectstack-issue-13392, BASE 090f2302ec2135dd3c5c67d0ef2d4b81897af522 (= origin/main at claim time).
• Surface: scripts/pm/dispatch-gates.mjs only.
• Read before acting: card body (complete — all sections present, ends with the signature footer, not sanitizer-truncated) and both comments, including 5467631952 (the option-set correction) first, per dispatch.

Generated by Claude Code

---

Generated by Claude Code