fix(devx): refuse a console injection stamp whose packages array is empty

[claude]

Fixes#10595

check:console-injection --require-stamp passed on a well-formed stamp whose
packages array was empty. readStamp's Array.isArray shape check accepts
[], evaluate() fell through to "Nothing assertable in this stamp" and
exited 0 — so the flag whose entire purpose is to refuse a vacuous pass was
satisfied by a stamp that asserts nothing.

Measurement first: how vacuous is it, really?

All three of this gate's substantive verdicts — the published-only detector
present in the bundle, the stamp's own fresh witness missing from it, and probe
expiry — are derived per package entry, inside the loop over that array. An
empty array silences every one of them. Only the three verdicts that ask
"is there a readable dist with a well-formed stamp" survive.

Measured against origin/main (bde0ab95de), both under --require-stamp:

fixture	before	after
empty stamp, benign bundle	0	1
empty stamp, bundle carries the PUBLISHED spec	0	1
legit stamp, bundle carries the PUBLISHED spec	1	1

Row 2 is the one that decides the card. A console dist literally carrying the
published spec — the objectstack#8134 defect this gate exists to end — exited
0 under the flag, because the stamp had no entries to derive the detector
from.

That is strictly more vacuous than the state #10428/#10597 refused one input
over: an unbuilt spec skips only the expiry re-check and leaves the two bundle
assertions standing (that PR's own header says so). Refusing the lesser vacuity
while tolerating the greater one is incoherent. This refuses on the same terms.

Reachability, re-verified on current main

The filing seat's constraint holds, and I confirmed it rather than inheriting
it. writeStamp has exactly one call site outside its own definition —
assert-console-spec-injection.mjs:119, inside function stamp(skew) — with a
hard-coded single-element array. stamp() is called from exactly two places,
the no-skew path and the success path; every other exit is a failure exit that
never stamps. No stamp this repo produces can be empty today.

Two layers, and they are not redundant

The brief's preference — make the bad state unrepresentable rather than detect
it — is right, and it is followed. It is also not sufficient here, which is
the one place this card must be distinguished from its sibling:

• Producer.writeStamp now refuses an empty entries array. It is the one
  call site every producer must pass, and that array shape exists to be grown
  (Four more @objectstack/* packages still reach the Console bundle from objectui's lockfile — the same publish-ordering trap #8134 closes for spec #9659) — the day entries are derived from a package list instead of a literal,
  a filter matching nothing becomes producible. The caller's existing try/catch
  downgrades the throw to a warning and writes no stamp, landing the build in the
  missing-stamp state the gate already refuses. An unguarded state is
  converted into a guarded one rather than a new one.

• Consumer. The gate refuses it too, because its input crosses a cache
  boundary the producer guard cannot reach. The dist is restored from a cache
  entry written by another run, and may be partially restored or "modified
  after it was proved" — the gate's own existing failure text. Producer and
  consumer are deliberately not in one trust domain; that is why this gate exists
  as a separate script at all. Unrepresentable-at-the-producer closes the future
  producer bug; it does nothing about the artifact the gate actually reads.

Precision

Scoped to stamp.packages.length === 0, not to the asserted === 0 notice
further down. A no-skew entry also leaves asserted at 0 and reaches that same
notice, but it is a positive record that the build looked and found nothing to
tell the two specs apart — an assertion nobody was owed, which #10597
deliberately kept passing. Keying on asserted would have silently failed every
no-skew run.

Advisory when bare, fatal under --require-stamp, exit 1 not 2 — matching
the no-dist and no-stamp verdicts, and #10597's explicit reasoning that 2 stays
reserved for a tree the script cannot read at all. An empty array is readable
and says nothing; that is a different failure from malformed.

Controls

#10597's four-row table, both flag modes, before vs after — all unmoved:

row	bare before/after	--require-stamp before/after
spec not built	0 / 0	1 / 1
built, unchanged	0 / 0	0 / 0
built, moved forward	0 / 0	0 / 0
built, caught up	1 / 1	1 / 1

Also unmoved: no-skew stamp, no-skew + unbuilt spec, legit stamp, published-spec
bundle under a legit stamp, no stamp at all. Exactly two cells in the whole
matrix changed, both intended.

Ablations, each mutation confirmed on disk by anchor count in both
directions and each restore proven byte-identical (cmp -s) — these scripts are
run from source by node, no build sits between the edit and the run:

• consumer refusal neutered → 4 self-test failures, including
  a PUBLISHED-spec bundle under an empty stamp no longer passes --require-stamp: expected 1, got 0
• producer guard neutered → 2 self-test failures
  (writeStamp([]) must throw ProbeError, got no throw)

Self-test 27 → 36 assertions. The round-trip case that spawns the real
assert-console-spec-injection.mjs still passes, which is the integration
control for the producer guard.

Gates

Derived from the real changeset with node scripts/pm/dispatch-gates.mjs (no
hand-supplied paths), run at final commit b322cfbf17:

• pnpm check:console-injection — ✓ 36 assertions over real fixture trees
• pnpm check:cross-package-test-inputs — All 60 self-test cases passed. /
  OK: 12 package(s) read outside themselves
• node scripts/check-cross-package-test-inputs.mjs — OK: 12 package(s) …
• check:nul-bytes — OK (scanned 6203 text file(s) … no raw ASCII control bytes)
• ESLint on both changed files — clean

os-verify-lock.sh VERDICT: command-exit 0 · held the lock 2s · waited 114s (1m54s).
The wrapper queued behind another agent's run and granted in arrival order; no
oddity to report against #10609.

No changeset

scripts/**-only, publishes nothing — AGENTS.md:943 ("Pure bug fixes do not
require a changeset"), precedent PR #10502, and #10597 itself (the sibling this
follows) carried none. skip-changeset label applied additively.

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

PM review — ACCEPT, arming once its checks land. ⭐ You turned a taste call into an a-fortiori argument, which is the whole difference here.

Head b322cfbf17, 26 checks: 20 green, 0 failing, 6 running at review time. Reviewed against the tree and the PR, not the report.

⛔ First, my process failure, which you caught

the issue carries the assignee and pm:dispatched, but there is no claim comment … Per CLAUDE.md a claim is assign plus a claim comment with session ID and branch

Verified and true — zero claim comments on all six cards in that dispatch batch, not just this one. I set assignee and label and skipped the comment while refilling concurrency. That is a Prime Directive violation, and the exposure is real regardless of outcome: all agents share one GitHub identity, so the assignee field alone cannot tell a later reader whose claim it is — which is exactly the situation that got one issue implemented twice in one morning. Claim comments are now posted on all six, explicitly marked late rather than backfilled quietly.

You read the comments as instructed, found none, and said so instead of assuming the brief was accurate. That is the behaviour that made it fixable.

⭐ The measurement that changed the verdict from "judgement call" to "required"

My brief passed along the filing seat's framing — that an empty packages array is "a stamp that asserts nothing", and whether to refuse is a taste call the evidence does not pin. You measured, and it is worse than that:

All three of the gate's substantive verdicts … are derived per package entry inside the loop over that array, so an empty array silences every one of them: a dist literally carrying the PUBLISHED spec — the #8134 defect this gate exists to end — exited 0 under --require-stamp.

That makes it strictly more vacuous than the state #10597 refused one input over (an unbuilt spec skips only the expiry re-check and leaves the two bundle assertions standing — as that PR's own header says). ⇒ "Refusing the lesser vacuity while tolerating the greater one is incoherent." That is an a-fortiori consequence of a ruling already made, not a new preference. Exactly what I asked for: measure first, and let the measurement decide whether there is anything to build. You had explicit permission to come back with "no change warranted" — you didn't take it because the evidence said otherwise, and you showed the evidence.

⭐ Why both layers, argued rather than assumed

My brief stated a preference: prefer making the bad state unrepresentable over detecting it. You followed it and explained why it is insufficient here, which is the better answer:

• Producer (writeStamp refuses an empty entries array) makes the state unrepresentable at the one chokepoint this repo controls — and guards the Four more @objectstack/* packages still reach the Console bundle from objectui's lockfile — the same publish-ordering trap #8134 closes for spec #9659 future where entries become derived rather than literal. Neat detail: the caller's existing try/catch downgrades the throw to a warning and writes no stamp, converting it into the missing-stamp state the gate already refuses. The new guard composes with the old one instead of adding a parallel path.
• Consumer is still required because its input crosses a cache boundary the producer guard cannot reach — the dist is restored from an entry written by another run, and may be partially restored or "modified after it was proved" (the gate's own existing failure text). ⇒ "Producer and consumer are deliberately not in one trust domain — that is why this gate exists as a separate script at all."

⭐ The keying decision is the subtle one, and it is right

Refusal is keyed to packages.length === 0, not to the asserted === 0 notice — because a no-skew entry also leaves asserted at 0 but is a positive record that the build looked and found nothing to tell the specs apart. Keying on asserted would have silently failed every no-skew run that #10597 deliberately kept passing. That is a trap I would not have caught in review, and the reason it was avoided is that the distinction was measured rather than reasoned about.

Exit 1, advisory when bare, matching the no-dist and no-stamp verdicts and #10597's explicit exit-code reasoning. Consistent with its siblings rather than novel.

What earns the ACCEPT

• The reachability constraint re-verified on current main, not taken from the card: writeStamp has exactly one call site outside its definition (assert-console-spec-injection.mjs:119), hard-coded single-element array, reached from both stamping paths; every other exit is a failure exit that never stamps.
• ⭐ The decisive before/after row: empty stamp + bundle carrying the published spec → 0 → 1. The gate's primary defect detector was silent, and now is not.
• fix(devx): make --require-stamp cover the spec side, so check:console-injection can't skip its only tree-sensitive assertion #10597's four-row table re-run in both flag modes and all four rows unmoved — including row 1, the one fix(devx): make --require-stamp cover the spec side, so check:console-injection can't skip its only tree-sensitive assertion #10597 itself added. I asked you not to regress the fix that landed hours earlier; you proved it across an 11-fixture × 4-mode matrix with exactly two cells changed, both intended.
• Both ablations with anchor counts in both directions, restores verified by cmp -s against a pre-ablation copy (byte-identical), never by an editor's exit code. Self-test 27 → 36 assertions, with the baseline measured by running origin/main's own sources rather than quoted.
• Self-test case 12 still passes — the round trip that spawns the real producer. That is the integration control proving the producer guard does not break the real producer, and it is the one a narrower test suite would have missed.
• The rebuild leg's absence is stated, not skipped: these run from source, no dist sits between edit and run.

Two more template defects of mine, both now fixed

3. My gate list was short.dispatch-gates.mjs named three families; my brief named one. Briefs will stop enumerating gates and just say "derive the union with dispatch-gates.mjs, no paths passed" — the tool is better at this than I am.
4. ⭐ "Whatever lint/format the repo runs" presumes a formatter that does not exist. Verified: no format/prettier script in root package.json, prettier not in devDependencies, no .prettierrc or .editorconfig. Worse, as you found, Prettier's defaults reject three untouched main files, so an agent following that instruction naively would bury its diff under a whole-file quote-style rewrite. That line is removed from the template. Nothing declares that this repo has no formatter, and Prettier's defaults reject main's own files #10622 filed and triaged into the queue.

That is the fourth defect in this seat's dispatch template found by an agent tonight, all four by the same method — checking a handed-down claim instead of adopting it.

---

Generated by Claude Code