fix(devx): deepen on an absent objectui pin endpoint, and refuse an unwalkable range

[claude]

Fixes#14178

The objectui pin bump derives the @objectstack/console changeset — its list and its bump level — from the changesets objectui declared over OLD..NEW. When the OLD endpoint's commit object was absent (what git clone --depth N produces: the shallow boundary sits after the old pin), the digest's endpoint guard returned before findRangeTruncation ran, so the deepen the script advertises was never considered, and the bump fell back to a degraded entry carrying the DEFAULT level.

Implements the triage ruling on the card: candidate 1 + 2 together — deepen on an absent endpoint and re-ask, and refuse when the re-ask still fails.

Measured, before and after

A throwaway objectui: 5 commits, 4 releasing changesets (2 patch, 2 minor, one of the minor ones carrying an author breaking annotation), cloned --depth 2 so the from object is absent. Same range, same command, one file:// remote so the run stays offline.

run	deepen attempted	exit	bump level	list	ADR-0087 prompt
before — shallow, deepen allowed	no	0	patch	1-line degraded (tip subject)	never fired
before — unshallowed by hand	n/a	0	minor	4 releasing, 1 breaking	fired
after — shallow, deepen allowed	yes, then re-asked	0	minor	4 releasing, 1 breaking	fired
after — shallow, OBJECTUI_NO_DEEPEN=1	opted out	1	none	no changeset written, pin untouched	n/a

The degraded entry did label itself degraded, so nothing lied — but the level was a default nobody declared, it publishes into @objectstack/console's CHANGELOG and the curated release notes, every declared-breaking entry was invisible in it, and the ADR-0087 disposition prompt never fired because the degraded changeset declares nothing breaking. That reproduction is now a self-test case (S6), asserted equal to the record the same range yields in a full clone.

The guard reorder

scripts/objectui-changeset-digest.mjs

• findAbsentEndpoints() / describeAbsentEndpoints() — the other half of the walkability precondition, shaped like findRangeTruncation / describeTruncation on purpose: the two are one class of failure with two causes, and a caller that treats them alike must be able to read them alike. It names WHICH endpoint is missing, whether the clone is shallow, re-emits git's own captured diagnostic, and prints the remedy.
• The endpoint guard's catch is replaced by that call, reporting PREREQUISITE NOT MET and keeping exit 2. The exit-code contract is unchanged in its codes and sharpened in its meaning: 2 (endpoint absent) and 3 (history stops inside the range) both mean "repair the input and ask again", and neither authorizes a weaker derivation.
• The same assertion is made inside classifyRange, the single shared implementation, so objectui-range.mjs cannot derive from an absent endpoint either — and it is asked BEFORE the truncation test, because rev-list from..to cannot run without from (pinned as S1).

The refusal shape

scripts/bump-objectui.sh

• Exit 2 now takes the same deepen-and-re-ask path as exit 3. The re-check decides, never the fetch's status — the C17 lesson, unchanged and still pinned.
• A range still unwalkable after that refuses: non-zero, no changeset written, the cause named (absent endpoint / stops inside the range / the probe never returned a verdict), what was tried named (opted out, not shallow, fetch failed, fetch exited 0 without repairing), and two remedies plus --no-changeset for moving the pin while claiming nothing about the range.
• The whole question is asked above the pin write, so a refusal leaves .objectui-sha byte-identical — the bump-objectui.sh leaves a half-applied bump when the objectui commit object is absent: .objectui-sha is rewritten, then the run dies on git log #10797 invariant, now owed by a second refusal and pinned as C15 and S7.
• The degraded artifact for an unwalkable range is removed, not reshaped: the ruling asked for one code path fewer, not a fourth state. The initial pin keeps its degraded entry (no previous SHA, no range, no remedy to name) and gains the self-test coverage the removed paths had.

Self-test

pnpm check:objectui-changeset — 130 checks, all green (was 122). The #9408 shell cases C13/C14/C15/C17 now pin the refusal instead of the degraded artifact; C16 and C18 are unchanged; a new #14178 group (S1–S8) covers the absent-endpoint branch end to end.

Ablation, on the committed tree: restoring the pre-fix deepen trigger in bump-objectui.sh (only exit 3 deepened) turns S6, S6b, S7 and S8 red and the rest green. The mutation was confirmed on disk by anchor grep counts in both directions (deleted text 1 to 0, injected text 0 to 1) plus a blob-hash comparison against the HEAD blob; the restore was confirmed by git hash-object equal to the HEAD blob and an empty git diff HEAD. No rebuild leg applies: both scripts are executed from source, and the self-test copies their bytes into throwaway framework roots.

Gates

Derived in the worktree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (16 families: 14 by path, 2 by change kind), reconciled with --ran against a record built from --commands, at 8084a7bdd:

✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 14 run, 2 NOT-MEASURED.

gate	verdict
check:objectui-changeset	RAN-PASS (130 + objectui-range checks)
check:objectui-bump (this file's own self-test, run beyond the derived set)	RAN-PASS (13 assertions, 4 cases)
check:agent-test-spelling · check:bash32-floor · check:cli-command-ids · check:cross-package-test-inputs · check:entry-guard · check:parse-guard · check:pnpm-filter-targets · check:ratchet-remedy-authority · check:watch-hint-literal	RAN-PASS
check:declared-population-live (dispatch-mandated for every scripts/** card)	RAN-PASS
scripts/check-ci-filter-parity.mjs · scripts/check-cross-package-test-inputs.mjs · scripts/check-shard-attestation.mjs · scripts/pm/bare-root-worklist.mjs --self-test	RAN-PASS
scripts/check-test-completeness.mjs	NOT MEASURED — exit 3, PREREQUISITE NOT MET: it grades a saved turbo run test log and none was named. Its own text prescribes recording NOT MEASURED when reached from the derived family list; CI tees the log and passes the path
check:pm-dispatch-gates	NOT MEASURED — SIGTERM-killed at 600s (exit 143) against this container's ~10-minute foreground ceiling, no verdict printed. CI runs it unconditionally

pnpm lint (repo-wide) is CI's run. The narrowing here is a measurement, declared: the population comes from eslint's own config, which reports scripts/bump-objectui.sh as "File ignored because no matching configuration was supplied" (no files: glob covers .sh), leaving one linted file; --format json counts 2 entries, 1 linted, 0 errors, 0 warnings; and eslint.config.mjs enables no type-aware linting for ANY file (its own note at the QUERY_OPTIONS_TEST_GLOBS block, with a measured positive control), so this diff cannot move the verdict on a file it does not touch.

Also run: node scripts/check-nul-bytes.mjs — OK over 7841 text files — plus a direct control-byte scan of both edited files, no hits.

Changeset

skip-changeset: this diff is repo tooling under scripts/ and publishes nothing from any package — no package's files carries it, and nothing here reaches a published tarball. Same disposition as the recent scripts-only devx PRs (#14255, #14217), both landed carrying that label.

Branch base is d62f990a9; main moved 4 commits while this was in flight (ed9e6996f), none touching a workflow or a gate that declares scripts/**, so the derived family list stands. The PR's CI runs on the merge ref.

Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#14178

The objectui pin bump derives the @objectstack/console changeset — its list and its bump level — from the changesets objectui declared over OLD..NEW. When the OLD endpoint's commit object was absent (what git clone --depth N produces: the shallow boundary sits after the old pin), the digest's endpoint guard returned before findRangeTruncation ran, so the deepen the script advertises was never considered, and the bump fell back to a degraded entry carrying the DEFAULT level.

Implements the triage ruling on the card: candidate 1 + 2 together — deepen on an absent endpoint and re-ask, and refuse when the re-ask still fails.

Measured, before and after

A throwaway objectui: 5 commits, 4 releasing changesets (2 patch, 2 minor, one of the minor ones carrying an author breaking annotation), cloned --depth 2 so the from object is absent. Same range, same command, one file:// remote so the run stays offline.

run	deepen attempted	exit	bump level	list	ADR-0087 prompt
before — shallow, deepen allowed	no	0	patch	1-line degraded (tip subject)	never fired
before — unshallowed by hand	n/a	0	minor	4 releasing, 1 breaking	fired
after — shallow, deepen allowed	yes, then re-asked	0	minor	4 releasing, 1 breaking	fired
after — shallow, OBJECTUI_NO_DEEPEN=1	opted out	1	none	no changeset written, pin untouched	n/a

The degraded entry did label itself degraded, so nothing lied — but the level was a default nobody declared, it publishes into @objectstack/console's CHANGELOG and the curated release notes, every declared-breaking entry was invisible in it, and the ADR-0087 disposition prompt never fired because the degraded changeset declares nothing breaking. That reproduction is now a self-test case (S6), asserted equal to the record the same range yields in a full clone.

The guard reorder

scripts/objectui-changeset-digest.mjs

• findAbsentEndpoints() / describeAbsentEndpoints() — the other half of the walkability precondition, shaped like findRangeTruncation / describeTruncation on purpose: the two are one class of failure with two causes, and a caller that treats them alike must be able to read them alike. It names WHICH endpoint is missing, whether the clone is shallow, re-emits git's own captured diagnostic, and prints the remedy.
• The endpoint guard's catch is replaced by that call, reporting PREREQUISITE NOT MET and keeping exit 2. The exit-code contract is unchanged in its codes and sharpened in its meaning: 2 (endpoint absent) and 3 (history stops inside the range) both mean "repair the input and ask again", and neither authorizes a weaker derivation.
• The same assertion is made inside classifyRange, the single shared implementation, so objectui-range.mjs cannot derive from an absent endpoint either — and it is asked BEFORE the truncation test, because rev-list from..to cannot run without from (pinned as S1).

The refusal shape

scripts/bump-objectui.sh

• Exit 2 now takes the same deepen-and-re-ask path as exit 3. The re-check decides, never the fetch's status — the C17 lesson, unchanged and still pinned.
• A range still unwalkable after that refuses: non-zero, no changeset written, the cause named (absent endpoint / stops inside the range / the probe never returned a verdict), what was tried named (opted out, not shallow, fetch failed, fetch exited 0 without repairing), and two remedies plus --no-changeset for moving the pin while claiming nothing about the range.
• The whole question is asked above the pin write, so a refusal leaves .objectui-sha byte-identical — the bump-objectui.sh leaves a half-applied bump when the objectui commit object is absent: .objectui-sha is rewritten, then the run dies on git log #10797 invariant, now owed by a second refusal and pinned as C15 and S7.
• The degraded artifact for an unwalkable range is removed, not reshaped: the ruling asked for one code path fewer, not a fourth state. The initial pin keeps its degraded entry (no previous SHA, no range, no remedy to name) and gains the self-test coverage the removed paths had.

Self-test

pnpm check:objectui-changeset — 130 checks, all green (was 122). The #9408 shell cases C13/C14/C15/C17 now pin the refusal instead of the degraded artifact; C16 and C18 are unchanged; a new #14178 group (S1–S8) covers the absent-endpoint branch end to end.

Ablation, on the committed tree: restoring the pre-fix deepen trigger in bump-objectui.sh (only exit 3 deepened) turns S6, S6b, S7 and S8 red and the rest green. The mutation was confirmed on disk by anchor grep counts in both directions (deleted text 1 to 0, injected text 0 to 1) plus a blob-hash comparison against the HEAD blob; the restore was confirmed by git hash-object equal to the HEAD blob and an empty git diff HEAD. No rebuild leg applies: both scripts are executed from source, and the self-test copies their bytes into throwaway framework roots.

Gates

Derived in the worktree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (16 families: 14 by path, 2 by change kind), reconciled with --ran against a record built from --commands, at 8084a7bdd:

✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 14 run, 2 NOT-MEASURED.

gate	verdict
check:objectui-changeset	RAN-PASS (130 + objectui-range checks)
check:objectui-bump (this file's own self-test, run beyond the derived set)	RAN-PASS (13 assertions, 4 cases)
check:agent-test-spelling · check:bash32-floor · check:cli-command-ids · check:cross-package-test-inputs · check:entry-guard · check:parse-guard · check:pnpm-filter-targets · check:ratchet-remedy-authority · check:watch-hint-literal	RAN-PASS
check:declared-population-live (dispatch-mandated for every scripts/** card)	RAN-PASS
scripts/check-ci-filter-parity.mjs · scripts/check-cross-package-test-inputs.mjs · scripts/check-shard-attestation.mjs · scripts/pm/bare-root-worklist.mjs --self-test	RAN-PASS
scripts/check-test-completeness.mjs	NOT MEASURED — exit 3, PREREQUISITE NOT MET: it grades a saved turbo run test log and none was named. Its own text prescribes recording NOT MEASURED when reached from the derived family list; CI tees the log and passes the path
check:pm-dispatch-gates	NOT MEASURED — SIGTERM-killed at 600s (exit 143) against this container's ~10-minute foreground ceiling, no verdict printed. CI runs it unconditionally

pnpm lint (repo-wide) is CI's run. The narrowing here is a measurement, declared: the population comes from eslint's own config, which reports scripts/bump-objectui.sh as "File ignored because no matching configuration was supplied" (no files: glob covers .sh), leaving one linted file; --format json counts 2 entries, 1 linted, 0 errors, 0 warnings; and eslint.config.mjs enables no type-aware linting for ANY file (its own note at the QUERY_OPTIONS_TEST_GLOBS block, with a measured positive control), so this diff cannot move the verdict on a file it does not touch.

Also run: node scripts/check-nul-bytes.mjs — OK over 7841 text files — plus a direct control-byte scan of both edited files, no hits.

Changeset

skip-changeset: this diff is repo tooling under scripts/ and publishes nothing from any package — no package's files carries it, and nothing here reaches a published tarball. Same disposition as the recent scripts-only devx PRs (#14255, #14217), both landed carrying that label.

Branch base is d62f990a9; main moved 4 commits while this was in flight (ed9e6996f), none touching a workflow or a gate that declares scripts/**, so the derived family list stands. The PR's CI runs on the merge ref.

Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#14178

The objectui pin bump derives the @objectstack/console changeset — its list and its bump level — from the changesets objectui declared over OLD..NEW. When the OLD endpoint's commit object was absent (what git clone --depth N produces: the shallow boundary sits after the old pin), the digest's endpoint guard returned before findRangeTruncation ran, so the deepen the script advertises was never considered, and the bump fell back to a degraded entry carrying the DEFAULT level.

Implements the triage ruling on the card: candidate 1 + 2 together — deepen on an absent endpoint and re-ask, and refuse when the re-ask still fails.

Measured, before and after

A throwaway objectui: 5 commits, 4 releasing changesets (2 patch, 2 minor, one of the minor ones carrying an author breaking annotation), cloned --depth 2 so the from object is absent. Same range, same command, one file:// remote so the run stays offline.

run	deepen attempted	exit	bump level	list	ADR-0087 prompt
before — shallow, deepen allowed	no	0	patch	1-line degraded (tip subject)	never fired
before — unshallowed by hand	n/a	0	minor	4 releasing, 1 breaking	fired
after — shallow, deepen allowed	yes, then re-asked	0	minor	4 releasing, 1 breaking	fired
after — shallow, OBJECTUI_NO_DEEPEN=1	opted out	1	none	no changeset written, pin untouched	n/a

The degraded entry did label itself degraded, so nothing lied — but the level was a default nobody declared, it publishes into @objectstack/console's CHANGELOG and the curated release notes, every declared-breaking entry was invisible in it, and the ADR-0087 disposition prompt never fired because the degraded changeset declares nothing breaking. That reproduction is now a self-test case (S6), asserted equal to the record the same range yields in a full clone.

The guard reorder

scripts/objectui-changeset-digest.mjs

• findAbsentEndpoints() / describeAbsentEndpoints() — the other half of the walkability precondition, shaped like findRangeTruncation / describeTruncation on purpose: the two are one class of failure with two causes, and a caller that treats them alike must be able to read them alike. It names WHICH endpoint is missing, whether the clone is shallow, re-emits git's own captured diagnostic, and prints the remedy.
• The endpoint guard's catch is replaced by that call, reporting PREREQUISITE NOT MET and keeping exit 2. The exit-code contract is unchanged in its codes and sharpened in its meaning: 2 (endpoint absent) and 3 (history stops inside the range) both mean "repair the input and ask again", and neither authorizes a weaker derivation.
• The same assertion is made inside classifyRange, the single shared implementation, so objectui-range.mjs cannot derive from an absent endpoint either — and it is asked BEFORE the truncation test, because rev-list from..to cannot run without from (pinned as S1).

The refusal shape

scripts/bump-objectui.sh

• Exit 2 now takes the same deepen-and-re-ask path as exit 3. The re-check decides, never the fetch's status — the C17 lesson, unchanged and still pinned.
• A range still unwalkable after that refuses: non-zero, no changeset written, the cause named (absent endpoint / stops inside the range / the probe never returned a verdict), what was tried named (opted out, not shallow, fetch failed, fetch exited 0 without repairing), and two remedies plus --no-changeset for moving the pin while claiming nothing about the range.
• The whole question is asked above the pin write, so a refusal leaves .objectui-sha byte-identical — the bump-objectui.sh leaves a half-applied bump when the objectui commit object is absent: .objectui-sha is rewritten, then the run dies on git log #10797 invariant, now owed by a second refusal and pinned as C15 and S7.
• The degraded artifact for an unwalkable range is removed, not reshaped: the ruling asked for one code path fewer, not a fourth state. The initial pin keeps its degraded entry (no previous SHA, no range, no remedy to name) and gains the self-test coverage the removed paths had.

Self-test

pnpm check:objectui-changeset — 130 checks, all green (was 122). The #9408 shell cases C13/C14/C15/C17 now pin the refusal instead of the degraded artifact; C16 and C18 are unchanged; a new #14178 group (S1–S8) covers the absent-endpoint branch end to end.

Ablation, on the committed tree: restoring the pre-fix deepen trigger in bump-objectui.sh (only exit 3 deepened) turns S6, S6b, S7 and S8 red and the rest green. The mutation was confirmed on disk by anchor grep counts in both directions (deleted text 1 to 0, injected text 0 to 1) plus a blob-hash comparison against the HEAD blob; the restore was confirmed by git hash-object equal to the HEAD blob and an empty git diff HEAD. No rebuild leg applies: both scripts are executed from source, and the self-test copies their bytes into throwaway framework roots.

Gates

Derived in the worktree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (16 families: 14 by path, 2 by change kind), reconciled with --ran against a record built from --commands, at 8084a7bdd:

✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 14 run, 2 NOT-MEASURED.

gate	verdict
check:objectui-changeset	RAN-PASS (130 + objectui-range checks)
check:objectui-bump (this file's own self-test, run beyond the derived set)	RAN-PASS (13 assertions, 4 cases)
check:agent-test-spelling · check:bash32-floor · check:cli-command-ids · check:cross-package-test-inputs · check:entry-guard · check:parse-guard · check:pnpm-filter-targets · check:ratchet-remedy-authority · check:watch-hint-literal	RAN-PASS
check:declared-population-live (dispatch-mandated for every scripts/** card)	RAN-PASS
scripts/check-ci-filter-parity.mjs · scripts/check-cross-package-test-inputs.mjs · scripts/check-shard-attestation.mjs · scripts/pm/bare-root-worklist.mjs --self-test	RAN-PASS
scripts/check-test-completeness.mjs	NOT MEASURED — exit 3, PREREQUISITE NOT MET: it grades a saved turbo run test log and none was named. Its own text prescribes recording NOT MEASURED when reached from the derived family list; CI tees the log and passes the path
check:pm-dispatch-gates	NOT MEASURED — SIGTERM-killed at 600s (exit 143) against this container's ~10-minute foreground ceiling, no verdict printed. CI runs it unconditionally

pnpm lint (repo-wide) is CI's run. The narrowing here is a measurement, declared: the population comes from eslint's own config, which reports scripts/bump-objectui.sh as "File ignored because no matching configuration was supplied" (no files: glob covers .sh), leaving one linted file; --format json counts 2 entries, 1 linted, 0 errors, 0 warnings; and eslint.config.mjs enables no type-aware linting for ANY file (its own note at the QUERY_OPTIONS_TEST_GLOBS block, with a measured positive control), so this diff cannot move the verdict on a file it does not touch.

Also run: node scripts/check-nul-bytes.mjs — OK over 7841 text files — plus a direct control-byte scan of both edited files, no hits.

Changeset

skip-changeset: this diff is repo tooling under scripts/ and publishes nothing from any package — no package's files carries it, and nothing here reaches a published tarball. Same disposition as the recent scripts-only devx PRs (#14255, #14217), both landed carrying that label.

Branch base is d62f990a9; main moved 4 commits while this was in flight (ed9e6996f), none touching a workflow or a gate that declares scripts/**, so the derived family list stands. The PR's CI runs on the merge ref.

Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#14178

The objectui pin bump derives the @objectstack/console changeset — its list and its bump level — from the changesets objectui declared over OLD..NEW. When the OLD endpoint's commit object was absent (what git clone --depth N produces: the shallow boundary sits after the old pin), the digest's endpoint guard returned before findRangeTruncation ran, so the deepen the script advertises was never considered, and the bump fell back to a degraded entry carrying the DEFAULT level.

Implements the triage ruling on the card: candidate 1 + 2 together — deepen on an absent endpoint and re-ask, and refuse when the re-ask still fails.

Measured, before and after

A throwaway objectui: 5 commits, 4 releasing changesets (2 patch, 2 minor, one of the minor ones carrying an author breaking annotation), cloned --depth 2 so the from object is absent. Same range, same command, one file:// remote so the run stays offline.

run	deepen attempted	exit	bump level	list	ADR-0087 prompt
before — shallow, deepen allowed	no	0	patch	1-line degraded (tip subject)	never fired
before — unshallowed by hand	n/a	0	minor	4 releasing, 1 breaking	fired
after — shallow, deepen allowed	yes, then re-asked	0	minor	4 releasing, 1 breaking	fired
after — shallow, OBJECTUI_NO_DEEPEN=1	opted out	1	none	no changeset written, pin untouched	n/a

The degraded entry did label itself degraded, so nothing lied — but the level was a default nobody declared, it publishes into @objectstack/console's CHANGELOG and the curated release notes, every declared-breaking entry was invisible in it, and the ADR-0087 disposition prompt never fired because the degraded changeset declares nothing breaking. That reproduction is now a self-test case (S6), asserted equal to the record the same range yields in a full clone.

The guard reorder

scripts/objectui-changeset-digest.mjs

• findAbsentEndpoints() / describeAbsentEndpoints() — the other half of the walkability precondition, shaped like findRangeTruncation / describeTruncation on purpose: the two are one class of failure with two causes, and a caller that treats them alike must be able to read them alike. It names WHICH endpoint is missing, whether the clone is shallow, re-emits git's own captured diagnostic, and prints the remedy.
• The endpoint guard's catch is replaced by that call, reporting PREREQUISITE NOT MET and keeping exit 2. The exit-code contract is unchanged in its codes and sharpened in its meaning: 2 (endpoint absent) and 3 (history stops inside the range) both mean "repair the input and ask again", and neither authorizes a weaker derivation.
• The same assertion is made inside classifyRange, the single shared implementation, so objectui-range.mjs cannot derive from an absent endpoint either — and it is asked BEFORE the truncation test, because rev-list from..to cannot run without from (pinned as S1).

The refusal shape

scripts/bump-objectui.sh

• Exit 2 now takes the same deepen-and-re-ask path as exit 3. The re-check decides, never the fetch's status — the C17 lesson, unchanged and still pinned.
• A range still unwalkable after that refuses: non-zero, no changeset written, the cause named (absent endpoint / stops inside the range / the probe never returned a verdict), what was tried named (opted out, not shallow, fetch failed, fetch exited 0 without repairing), and two remedies plus --no-changeset for moving the pin while claiming nothing about the range.
• The whole question is asked above the pin write, so a refusal leaves .objectui-sha byte-identical — the bump-objectui.sh leaves a half-applied bump when the objectui commit object is absent: .objectui-sha is rewritten, then the run dies on git log #10797 invariant, now owed by a second refusal and pinned as C15 and S7.
• The degraded artifact for an unwalkable range is removed, not reshaped: the ruling asked for one code path fewer, not a fourth state. The initial pin keeps its degraded entry (no previous SHA, no range, no remedy to name) and gains the self-test coverage the removed paths had.

Self-test

pnpm check:objectui-changeset — 130 checks, all green (was 122). The #9408 shell cases C13/C14/C15/C17 now pin the refusal instead of the degraded artifact; C16 and C18 are unchanged; a new #14178 group (S1–S8) covers the absent-endpoint branch end to end.

Ablation, on the committed tree: restoring the pre-fix deepen trigger in bump-objectui.sh (only exit 3 deepened) turns S6, S6b, S7 and S8 red and the rest green. The mutation was confirmed on disk by anchor grep counts in both directions (deleted text 1 to 0, injected text 0 to 1) plus a blob-hash comparison against the HEAD blob; the restore was confirmed by git hash-object equal to the HEAD blob and an empty git diff HEAD. No rebuild leg applies: both scripts are executed from source, and the self-test copies their bytes into throwaway framework roots.

Gates

Derived in the worktree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (16 families: 14 by path, 2 by change kind), reconciled with --ran against a record built from --commands, at 8084a7bdd:

✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 14 run, 2 NOT-MEASURED.

gate	verdict
check:objectui-changeset	RAN-PASS (130 + objectui-range checks)
check:objectui-bump (this file's own self-test, run beyond the derived set)	RAN-PASS (13 assertions, 4 cases)
check:agent-test-spelling · check:bash32-floor · check:cli-command-ids · check:cross-package-test-inputs · check:entry-guard · check:parse-guard · check:pnpm-filter-targets · check:ratchet-remedy-authority · check:watch-hint-literal	RAN-PASS
check:declared-population-live (dispatch-mandated for every scripts/** card)	RAN-PASS
scripts/check-ci-filter-parity.mjs · scripts/check-cross-package-test-inputs.mjs · scripts/check-shard-attestation.mjs · scripts/pm/bare-root-worklist.mjs --self-test	RAN-PASS
scripts/check-test-completeness.mjs	NOT MEASURED — exit 3, PREREQUISITE NOT MET: it grades a saved turbo run test log and none was named. Its own text prescribes recording NOT MEASURED when reached from the derived family list; CI tees the log and passes the path
check:pm-dispatch-gates	NOT MEASURED — SIGTERM-killed at 600s (exit 143) against this container's ~10-minute foreground ceiling, no verdict printed. CI runs it unconditionally

pnpm lint (repo-wide) is CI's run. The narrowing here is a measurement, declared: the population comes from eslint's own config, which reports scripts/bump-objectui.sh as "File ignored because no matching configuration was supplied" (no files: glob covers .sh), leaving one linted file; --format json counts 2 entries, 1 linted, 0 errors, 0 warnings; and eslint.config.mjs enables no type-aware linting for ANY file (its own note at the QUERY_OPTIONS_TEST_GLOBS block, with a measured positive control), so this diff cannot move the verdict on a file it does not touch.

Also run: node scripts/check-nul-bytes.mjs — OK over 7841 text files — plus a direct control-byte scan of both edited files, no hits.

Changeset

skip-changeset: this diff is repo tooling under scripts/ and publishes nothing from any package — no package's files carries it, and nothing here reaches a published tarball. Same disposition as the recent scripts-only devx PRs (#14255, #14217), both landed carrying that label.

Branch base is d62f990a9; main moved 4 commits while this was in flight (ed9e6996f), none touching a workflow or a gate that declares scripts/**, so the derived family list stands. The PR's CI runs on the merge ref.

Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#14178

The objectui pin bump derives the @objectstack/console changeset — its list and its bump level — from the changesets objectui declared over OLD..NEW. When the OLD endpoint's commit object was absent (what git clone --depth N produces: the shallow boundary sits after the old pin), the digest's endpoint guard returned before findRangeTruncation ran, so the deepen the script advertises was never considered, and the bump fell back to a degraded entry carrying the DEFAULT level.

Implements the triage ruling on the card: candidate 1 + 2 together — deepen on an absent endpoint and re-ask, and refuse when the re-ask still fails.

Measured, before and after

A throwaway objectui: 5 commits, 4 releasing changesets (2 patch, 2 minor, one of the minor ones carrying an author breaking annotation), cloned --depth 2 so the from object is absent. Same range, same command, one file:// remote so the run stays offline.

run	deepen attempted	exit	bump level	list	ADR-0087 prompt
before — shallow, deepen allowed	no	0	patch	1-line degraded (tip subject)	never fired
before — unshallowed by hand	n/a	0	minor	4 releasing, 1 breaking	fired
after — shallow, deepen allowed	yes, then re-asked	0	minor	4 releasing, 1 breaking	fired
after — shallow, OBJECTUI_NO_DEEPEN=1	opted out	1	none	no changeset written, pin untouched	n/a

The degraded entry did label itself degraded, so nothing lied — but the level was a default nobody declared, it publishes into @objectstack/console's CHANGELOG and the curated release notes, every declared-breaking entry was invisible in it, and the ADR-0087 disposition prompt never fired because the degraded changeset declares nothing breaking. That reproduction is now a self-test case (S6), asserted equal to the record the same range yields in a full clone.

The guard reorder

scripts/objectui-changeset-digest.mjs

• findAbsentEndpoints() / describeAbsentEndpoints() — the other half of the walkability precondition, shaped like findRangeTruncation / describeTruncation on purpose: the two are one class of failure with two causes, and a caller that treats them alike must be able to read them alike. It names WHICH endpoint is missing, whether the clone is shallow, re-emits git's own captured diagnostic, and prints the remedy.
• The endpoint guard's catch is replaced by that call, reporting PREREQUISITE NOT MET and keeping exit 2. The exit-code contract is unchanged in its codes and sharpened in its meaning: 2 (endpoint absent) and 3 (history stops inside the range) both mean "repair the input and ask again", and neither authorizes a weaker derivation.
• The same assertion is made inside classifyRange, the single shared implementation, so objectui-range.mjs cannot derive from an absent endpoint either — and it is asked BEFORE the truncation test, because rev-list from..to cannot run without from (pinned as S1).

The refusal shape

scripts/bump-objectui.sh

• Exit 2 now takes the same deepen-and-re-ask path as exit 3. The re-check decides, never the fetch's status — the C17 lesson, unchanged and still pinned.
• A range still unwalkable after that refuses: non-zero, no changeset written, the cause named (absent endpoint / stops inside the range / the probe never returned a verdict), what was tried named (opted out, not shallow, fetch failed, fetch exited 0 without repairing), and two remedies plus --no-changeset for moving the pin while claiming nothing about the range.
• The whole question is asked above the pin write, so a refusal leaves .objectui-sha byte-identical — the bump-objectui.sh leaves a half-applied bump when the objectui commit object is absent: .objectui-sha is rewritten, then the run dies on git log #10797 invariant, now owed by a second refusal and pinned as C15 and S7.
• The degraded artifact for an unwalkable range is removed, not reshaped: the ruling asked for one code path fewer, not a fourth state. The initial pin keeps its degraded entry (no previous SHA, no range, no remedy to name) and gains the self-test coverage the removed paths had.

Self-test

pnpm check:objectui-changeset — 130 checks, all green (was 122). The #9408 shell cases C13/C14/C15/C17 now pin the refusal instead of the degraded artifact; C16 and C18 are unchanged; a new #14178 group (S1–S8) covers the absent-endpoint branch end to end.

Ablation, on the committed tree: restoring the pre-fix deepen trigger in bump-objectui.sh (only exit 3 deepened) turns S6, S6b, S7 and S8 red and the rest green. The mutation was confirmed on disk by anchor grep counts in both directions (deleted text 1 to 0, injected text 0 to 1) plus a blob-hash comparison against the HEAD blob; the restore was confirmed by git hash-object equal to the HEAD blob and an empty git diff HEAD. No rebuild leg applies: both scripts are executed from source, and the self-test copies their bytes into throwaway framework roots.

Gates

Derived in the worktree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (16 families: 14 by path, 2 by change kind), reconciled with --ran against a record built from --commands, at 8084a7bdd:

✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 14 run, 2 NOT-MEASURED.

gate	verdict
check:objectui-changeset	RAN-PASS (130 + objectui-range checks)
check:objectui-bump (this file's own self-test, run beyond the derived set)	RAN-PASS (13 assertions, 4 cases)
check:agent-test-spelling · check:bash32-floor · check:cli-command-ids · check:cross-package-test-inputs · check:entry-guard · check:parse-guard · check:pnpm-filter-targets · check:ratchet-remedy-authority · check:watch-hint-literal	RAN-PASS
check:declared-population-live (dispatch-mandated for every scripts/** card)	RAN-PASS
scripts/check-ci-filter-parity.mjs · scripts/check-cross-package-test-inputs.mjs · scripts/check-shard-attestation.mjs · scripts/pm/bare-root-worklist.mjs --self-test	RAN-PASS
scripts/check-test-completeness.mjs	NOT MEASURED — exit 3, PREREQUISITE NOT MET: it grades a saved turbo run test log and none was named. Its own text prescribes recording NOT MEASURED when reached from the derived family list; CI tees the log and passes the path
check:pm-dispatch-gates	NOT MEASURED — SIGTERM-killed at 600s (exit 143) against this container's ~10-minute foreground ceiling, no verdict printed. CI runs it unconditionally

pnpm lint (repo-wide) is CI's run. The narrowing here is a measurement, declared: the population comes from eslint's own config, which reports scripts/bump-objectui.sh as "File ignored because no matching configuration was supplied" (no files: glob covers .sh), leaving one linted file; --format json counts 2 entries, 1 linted, 0 errors, 0 warnings; and eslint.config.mjs enables no type-aware linting for ANY file (its own note at the QUERY_OPTIONS_TEST_GLOBS block, with a measured positive control), so this diff cannot move the verdict on a file it does not touch.

Also run: node scripts/check-nul-bytes.mjs — OK over 7841 text files — plus a direct control-byte scan of both edited files, no hits.

Changeset

skip-changeset: this diff is repo tooling under scripts/ and publishes nothing from any package — no package's files carries it, and nothing here reaches a published tarball. Same disposition as the recent scripts-only devx PRs (#14255, #14217), both landed carrying that label.

Branch base is d62f990a9; main moved 4 commits while this was in flight (ed9e6996f), none touching a workflow or a gate that declares scripts/**, so the derived family list stands. The PR's CI runs on the merge ref.

Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#14178

The objectui pin bump derives the @objectstack/console changeset — its list and its bump level — from the changesets objectui declared over OLD..NEW. When the OLD endpoint's commit object was absent (what git clone --depth N produces: the shallow boundary sits after the old pin), the digest's endpoint guard returned before findRangeTruncation ran, so the deepen the script advertises was never considered, and the bump fell back to a degraded entry carrying the DEFAULT level.

Implements the triage ruling on the card: candidate 1 + 2 together — deepen on an absent endpoint and re-ask, and refuse when the re-ask still fails.

Measured, before and after

A throwaway objectui: 5 commits, 4 releasing changesets (2 patch, 2 minor, one of the minor ones carrying an author breaking annotation), cloned --depth 2 so the from object is absent. Same range, same command, one file:// remote so the run stays offline.

run	deepen attempted	exit	bump level	list	ADR-0087 prompt
before — shallow, deepen allowed	no	0	patch	1-line degraded (tip subject)	never fired
before — unshallowed by hand	n/a	0	minor	4 releasing, 1 breaking	fired
after — shallow, deepen allowed	yes, then re-asked	0	minor	4 releasing, 1 breaking	fired
after — shallow, OBJECTUI_NO_DEEPEN=1	opted out	1	none	no changeset written, pin untouched	n/a

The degraded entry did label itself degraded, so nothing lied — but the level was a default nobody declared, it publishes into @objectstack/console's CHANGELOG and the curated release notes, every declared-breaking entry was invisible in it, and the ADR-0087 disposition prompt never fired because the degraded changeset declares nothing breaking. That reproduction is now a self-test case (S6), asserted equal to the record the same range yields in a full clone.

The guard reorder

scripts/objectui-changeset-digest.mjs

• findAbsentEndpoints() / describeAbsentEndpoints() — the other half of the walkability precondition, shaped like findRangeTruncation / describeTruncation on purpose: the two are one class of failure with two causes, and a caller that treats them alike must be able to read them alike. It names WHICH endpoint is missing, whether the clone is shallow, re-emits git's own captured diagnostic, and prints the remedy.
• The endpoint guard's catch is replaced by that call, reporting PREREQUISITE NOT MET and keeping exit 2. The exit-code contract is unchanged in its codes and sharpened in its meaning: 2 (endpoint absent) and 3 (history stops inside the range) both mean "repair the input and ask again", and neither authorizes a weaker derivation.
• The same assertion is made inside classifyRange, the single shared implementation, so objectui-range.mjs cannot derive from an absent endpoint either — and it is asked BEFORE the truncation test, because rev-list from..to cannot run without from (pinned as S1).

The refusal shape

scripts/bump-objectui.sh

• Exit 2 now takes the same deepen-and-re-ask path as exit 3. The re-check decides, never the fetch's status — the C17 lesson, unchanged and still pinned.
• A range still unwalkable after that refuses: non-zero, no changeset written, the cause named (absent endpoint / stops inside the range / the probe never returned a verdict), what was tried named (opted out, not shallow, fetch failed, fetch exited 0 without repairing), and two remedies plus --no-changeset for moving the pin while claiming nothing about the range.
• The whole question is asked above the pin write, so a refusal leaves .objectui-sha byte-identical — the bump-objectui.sh leaves a half-applied bump when the objectui commit object is absent: .objectui-sha is rewritten, then the run dies on git log #10797 invariant, now owed by a second refusal and pinned as C15 and S7.
• The degraded artifact for an unwalkable range is removed, not reshaped: the ruling asked for one code path fewer, not a fourth state. The initial pin keeps its degraded entry (no previous SHA, no range, no remedy to name) and gains the self-test coverage the removed paths had.

Self-test

pnpm check:objectui-changeset — 130 checks, all green (was 122). The #9408 shell cases C13/C14/C15/C17 now pin the refusal instead of the degraded artifact; C16 and C18 are unchanged; a new #14178 group (S1–S8) covers the absent-endpoint branch end to end.

Ablation, on the committed tree: restoring the pre-fix deepen trigger in bump-objectui.sh (only exit 3 deepened) turns S6, S6b, S7 and S8 red and the rest green. The mutation was confirmed on disk by anchor grep counts in both directions (deleted text 1 to 0, injected text 0 to 1) plus a blob-hash comparison against the HEAD blob; the restore was confirmed by git hash-object equal to the HEAD blob and an empty git diff HEAD. No rebuild leg applies: both scripts are executed from source, and the self-test copies their bytes into throwaway framework roots.

Gates

Derived in the worktree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (16 families: 14 by path, 2 by change kind), reconciled with --ran against a record built from --commands, at 8084a7bdd:

✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 14 run, 2 NOT-MEASURED.

gate	verdict
check:objectui-changeset	RAN-PASS (130 + objectui-range checks)
check:objectui-bump (this file's own self-test, run beyond the derived set)	RAN-PASS (13 assertions, 4 cases)
check:agent-test-spelling · check:bash32-floor · check:cli-command-ids · check:cross-package-test-inputs · check:entry-guard · check:parse-guard · check:pnpm-filter-targets · check:ratchet-remedy-authority · check:watch-hint-literal	RAN-PASS
check:declared-population-live (dispatch-mandated for every scripts/** card)	RAN-PASS
scripts/check-ci-filter-parity.mjs · scripts/check-cross-package-test-inputs.mjs · scripts/check-shard-attestation.mjs · scripts/pm/bare-root-worklist.mjs --self-test	RAN-PASS
scripts/check-test-completeness.mjs	NOT MEASURED — exit 3, PREREQUISITE NOT MET: it grades a saved turbo run test log and none was named. Its own text prescribes recording NOT MEASURED when reached from the derived family list; CI tees the log and passes the path
check:pm-dispatch-gates	NOT MEASURED — SIGTERM-killed at 600s (exit 143) against this container's ~10-minute foreground ceiling, no verdict printed. CI runs it unconditionally

pnpm lint (repo-wide) is CI's run. The narrowing here is a measurement, declared: the population comes from eslint's own config, which reports scripts/bump-objectui.sh as "File ignored because no matching configuration was supplied" (no files: glob covers .sh), leaving one linted file; --format json counts 2 entries, 1 linted, 0 errors, 0 warnings; and eslint.config.mjs enables no type-aware linting for ANY file (its own note at the QUERY_OPTIONS_TEST_GLOBS block, with a measured positive control), so this diff cannot move the verdict on a file it does not touch.

Also run: node scripts/check-nul-bytes.mjs — OK over 7841 text files — plus a direct control-byte scan of both edited files, no hits.

Changeset

skip-changeset: this diff is repo tooling under scripts/ and publishes nothing from any package — no package's files carries it, and nothing here reaches a published tarball. Same disposition as the recent scripts-only devx PRs (#14255, #14217), both landed carrying that label.

Branch base is d62f990a9; main moved 4 commits while this was in flight (ed9e6996f), none touching a workflow or a gate that declares scripts/**, so the derived family list stands. The PR's CI runs on the merge ref.

Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#14178

The objectui pin bump derives the @objectstack/console changeset — its list and its bump level — from the changesets objectui declared over OLD..NEW. When the OLD endpoint's commit object was absent (what git clone --depth N produces: the shallow boundary sits after the old pin), the digest's endpoint guard returned before findRangeTruncation ran, so the deepen the script advertises was never considered, and the bump fell back to a degraded entry carrying the DEFAULT level.

Implements the triage ruling on the card: candidate 1 + 2 together — deepen on an absent endpoint and re-ask, and refuse when the re-ask still fails.

Measured, before and after

A throwaway objectui: 5 commits, 4 releasing changesets (2 patch, 2 minor, one of the minor ones carrying an author breaking annotation), cloned --depth 2 so the from object is absent. Same range, same command, one file:// remote so the run stays offline.

run	deepen attempted	exit	bump level	list	ADR-0087 prompt
before — shallow, deepen allowed	no	0	patch	1-line degraded (tip subject)	never fired
before — unshallowed by hand	n/a	0	minor	4 releasing, 1 breaking	fired
after — shallow, deepen allowed	yes, then re-asked	0	minor	4 releasing, 1 breaking	fired
after — shallow, OBJECTUI_NO_DEEPEN=1	opted out	1	none	no changeset written, pin untouched	n/a

The degraded entry did label itself degraded, so nothing lied — but the level was a default nobody declared, it publishes into @objectstack/console's CHANGELOG and the curated release notes, every declared-breaking entry was invisible in it, and the ADR-0087 disposition prompt never fired because the degraded changeset declares nothing breaking. That reproduction is now a self-test case (S6), asserted equal to the record the same range yields in a full clone.

The guard reorder

scripts/objectui-changeset-digest.mjs

• findAbsentEndpoints() / describeAbsentEndpoints() — the other half of the walkability precondition, shaped like findRangeTruncation / describeTruncation on purpose: the two are one class of failure with two causes, and a caller that treats them alike must be able to read them alike. It names WHICH endpoint is missing, whether the clone is shallow, re-emits git's own captured diagnostic, and prints the remedy.
• The endpoint guard's catch is replaced by that call, reporting PREREQUISITE NOT MET and keeping exit 2. The exit-code contract is unchanged in its codes and sharpened in its meaning: 2 (endpoint absent) and 3 (history stops inside the range) both mean "repair the input and ask again", and neither authorizes a weaker derivation.
• The same assertion is made inside classifyRange, the single shared implementation, so objectui-range.mjs cannot derive from an absent endpoint either — and it is asked BEFORE the truncation test, because rev-list from..to cannot run without from (pinned as S1).

The refusal shape

scripts/bump-objectui.sh

• Exit 2 now takes the same deepen-and-re-ask path as exit 3. The re-check decides, never the fetch's status — the C17 lesson, unchanged and still pinned.
• A range still unwalkable after that refuses: non-zero, no changeset written, the cause named (absent endpoint / stops inside the range / the probe never returned a verdict), what was tried named (opted out, not shallow, fetch failed, fetch exited 0 without repairing), and two remedies plus --no-changeset for moving the pin while claiming nothing about the range.
• The whole question is asked above the pin write, so a refusal leaves .objectui-sha byte-identical — the bump-objectui.sh leaves a half-applied bump when the objectui commit object is absent: .objectui-sha is rewritten, then the run dies on git log #10797 invariant, now owed by a second refusal and pinned as C15 and S7.
• The degraded artifact for an unwalkable range is removed, not reshaped: the ruling asked for one code path fewer, not a fourth state. The initial pin keeps its degraded entry (no previous SHA, no range, no remedy to name) and gains the self-test coverage the removed paths had.

Self-test

pnpm check:objectui-changeset — 130 checks, all green (was 122). The #9408 shell cases C13/C14/C15/C17 now pin the refusal instead of the degraded artifact; C16 and C18 are unchanged; a new #14178 group (S1–S8) covers the absent-endpoint branch end to end.

Ablation, on the committed tree: restoring the pre-fix deepen trigger in bump-objectui.sh (only exit 3 deepened) turns S6, S6b, S7 and S8 red and the rest green. The mutation was confirmed on disk by anchor grep counts in both directions (deleted text 1 to 0, injected text 0 to 1) plus a blob-hash comparison against the HEAD blob; the restore was confirmed by git hash-object equal to the HEAD blob and an empty git diff HEAD. No rebuild leg applies: both scripts are executed from source, and the self-test copies their bytes into throwaway framework roots.

Gates

Derived in the worktree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (16 families: 14 by path, 2 by change kind), reconciled with --ran against a record built from --commands, at 8084a7bdd:

✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 14 run, 2 NOT-MEASURED.

gate	verdict
check:objectui-changeset	RAN-PASS (130 + objectui-range checks)
check:objectui-bump (this file's own self-test, run beyond the derived set)	RAN-PASS (13 assertions, 4 cases)
check:agent-test-spelling · check:bash32-floor · check:cli-command-ids · check:cross-package-test-inputs · check:entry-guard · check:parse-guard · check:pnpm-filter-targets · check:ratchet-remedy-authority · check:watch-hint-literal	RAN-PASS
check:declared-population-live (dispatch-mandated for every scripts/** card)	RAN-PASS
scripts/check-ci-filter-parity.mjs · scripts/check-cross-package-test-inputs.mjs · scripts/check-shard-attestation.mjs · scripts/pm/bare-root-worklist.mjs --self-test	RAN-PASS
scripts/check-test-completeness.mjs	NOT MEASURED — exit 3, PREREQUISITE NOT MET: it grades a saved turbo run test log and none was named. Its own text prescribes recording NOT MEASURED when reached from the derived family list; CI tees the log and passes the path
check:pm-dispatch-gates	NOT MEASURED — SIGTERM-killed at 600s (exit 143) against this container's ~10-minute foreground ceiling, no verdict printed. CI runs it unconditionally

pnpm lint (repo-wide) is CI's run. The narrowing here is a measurement, declared: the population comes from eslint's own config, which reports scripts/bump-objectui.sh as "File ignored because no matching configuration was supplied" (no files: glob covers .sh), leaving one linted file; --format json counts 2 entries, 1 linted, 0 errors, 0 warnings; and eslint.config.mjs enables no type-aware linting for ANY file (its own note at the QUERY_OPTIONS_TEST_GLOBS block, with a measured positive control), so this diff cannot move the verdict on a file it does not touch.

Also run: node scripts/check-nul-bytes.mjs — OK over 7841 text files — plus a direct control-byte scan of both edited files, no hits.

Changeset

skip-changeset: this diff is repo tooling under scripts/ and publishes nothing from any package — no package's files carries it, and nothing here reaches a published tarball. Same disposition as the recent scripts-only devx PRs (#14255, #14217), both landed carrying that label.

Branch base is d62f990a9; main moved 4 commits while this was in flight (ed9e6996f), none touching a workflow or a gate that declares scripts/**, so the derived family list stands. The PR's CI runs on the merge ref.

Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#14178

The objectui pin bump derives the @objectstack/console changeset — its list and its bump level — from the changesets objectui declared over OLD..NEW. When the OLD endpoint's commit object was absent (what git clone --depth N produces: the shallow boundary sits after the old pin), the digest's endpoint guard returned before findRangeTruncation ran, so the deepen the script advertises was never considered, and the bump fell back to a degraded entry carrying the DEFAULT level.

Implements the triage ruling on the card: candidate 1 + 2 together — deepen on an absent endpoint and re-ask, and refuse when the re-ask still fails.

Measured, before and after

A throwaway objectui: 5 commits, 4 releasing changesets (2 patch, 2 minor, one of the minor ones carrying an author breaking annotation), cloned --depth 2 so the from object is absent. Same range, same command, one file:// remote so the run stays offline.

run	deepen attempted	exit	bump level	list	ADR-0087 prompt
before — shallow, deepen allowed	no	0	patch	1-line degraded (tip subject)	never fired
before — unshallowed by hand	n/a	0	minor	4 releasing, 1 breaking	fired
after — shallow, deepen allowed	yes, then re-asked	0	minor	4 releasing, 1 breaking	fired
after — shallow, OBJECTUI_NO_DEEPEN=1	opted out	1	none	no changeset written, pin untouched	n/a

The degraded entry did label itself degraded, so nothing lied — but the level was a default nobody declared, it publishes into @objectstack/console's CHANGELOG and the curated release notes, every declared-breaking entry was invisible in it, and the ADR-0087 disposition prompt never fired because the degraded changeset declares nothing breaking. That reproduction is now a self-test case (S6), asserted equal to the record the same range yields in a full clone.

The guard reorder

scripts/objectui-changeset-digest.mjs

• findAbsentEndpoints() / describeAbsentEndpoints() — the other half of the walkability precondition, shaped like findRangeTruncation / describeTruncation on purpose: the two are one class of failure with two causes, and a caller that treats them alike must be able to read them alike. It names WHICH endpoint is missing, whether the clone is shallow, re-emits git's own captured diagnostic, and prints the remedy.
• The endpoint guard's catch is replaced by that call, reporting PREREQUISITE NOT MET and keeping exit 2. The exit-code contract is unchanged in its codes and sharpened in its meaning: 2 (endpoint absent) and 3 (history stops inside the range) both mean "repair the input and ask again", and neither authorizes a weaker derivation.
• The same assertion is made inside classifyRange, the single shared implementation, so objectui-range.mjs cannot derive from an absent endpoint either — and it is asked BEFORE the truncation test, because rev-list from..to cannot run without from (pinned as S1).

The refusal shape

scripts/bump-objectui.sh

• Exit 2 now takes the same deepen-and-re-ask path as exit 3. The re-check decides, never the fetch's status — the C17 lesson, unchanged and still pinned.
• A range still unwalkable after that refuses: non-zero, no changeset written, the cause named (absent endpoint / stops inside the range / the probe never returned a verdict), what was tried named (opted out, not shallow, fetch failed, fetch exited 0 without repairing), and two remedies plus --no-changeset for moving the pin while claiming nothing about the range.
• The whole question is asked above the pin write, so a refusal leaves .objectui-sha byte-identical — the bump-objectui.sh leaves a half-applied bump when the objectui commit object is absent: .objectui-sha is rewritten, then the run dies on git log #10797 invariant, now owed by a second refusal and pinned as C15 and S7.
• The degraded artifact for an unwalkable range is removed, not reshaped: the ruling asked for one code path fewer, not a fourth state. The initial pin keeps its degraded entry (no previous SHA, no range, no remedy to name) and gains the self-test coverage the removed paths had.

Self-test

pnpm check:objectui-changeset — 130 checks, all green (was 122). The #9408 shell cases C13/C14/C15/C17 now pin the refusal instead of the degraded artifact; C16 and C18 are unchanged; a new #14178 group (S1–S8) covers the absent-endpoint branch end to end.

Ablation, on the committed tree: restoring the pre-fix deepen trigger in bump-objectui.sh (only exit 3 deepened) turns S6, S6b, S7 and S8 red and the rest green. The mutation was confirmed on disk by anchor grep counts in both directions (deleted text 1 to 0, injected text 0 to 1) plus a blob-hash comparison against the HEAD blob; the restore was confirmed by git hash-object equal to the HEAD blob and an empty git diff HEAD. No rebuild leg applies: both scripts are executed from source, and the self-test copies their bytes into throwaway framework roots.

Gates

Derived in the worktree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (16 families: 14 by path, 2 by change kind), reconciled with --ran against a record built from --commands, at 8084a7bdd:

✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 14 run, 2 NOT-MEASURED.

gate	verdict
check:objectui-changeset	RAN-PASS (130 + objectui-range checks)
check:objectui-bump (this file's own self-test, run beyond the derived set)	RAN-PASS (13 assertions, 4 cases)
check:agent-test-spelling · check:bash32-floor · check:cli-command-ids · check:cross-package-test-inputs · check:entry-guard · check:parse-guard · check:pnpm-filter-targets · check:ratchet-remedy-authority · check:watch-hint-literal	RAN-PASS
check:declared-population-live (dispatch-mandated for every scripts/** card)	RAN-PASS
scripts/check-ci-filter-parity.mjs · scripts/check-cross-package-test-inputs.mjs · scripts/check-shard-attestation.mjs · scripts/pm/bare-root-worklist.mjs --self-test	RAN-PASS
scripts/check-test-completeness.mjs	NOT MEASURED — exit 3, PREREQUISITE NOT MET: it grades a saved turbo run test log and none was named. Its own text prescribes recording NOT MEASURED when reached from the derived family list; CI tees the log and passes the path
check:pm-dispatch-gates	NOT MEASURED — SIGTERM-killed at 600s (exit 143) against this container's ~10-minute foreground ceiling, no verdict printed. CI runs it unconditionally

pnpm lint (repo-wide) is CI's run. The narrowing here is a measurement, declared: the population comes from eslint's own config, which reports scripts/bump-objectui.sh as "File ignored because no matching configuration was supplied" (no files: glob covers .sh), leaving one linted file; --format json counts 2 entries, 1 linted, 0 errors, 0 warnings; and eslint.config.mjs enables no type-aware linting for ANY file (its own note at the QUERY_OPTIONS_TEST_GLOBS block, with a measured positive control), so this diff cannot move the verdict on a file it does not touch.

Also run: node scripts/check-nul-bytes.mjs — OK over 7841 text files — plus a direct control-byte scan of both edited files, no hits.

Changeset

skip-changeset: this diff is repo tooling under scripts/ and publishes nothing from any package — no package's files carries it, and nothing here reaches a published tarball. Same disposition as the recent scripts-only devx PRs (#14255, #14217), both landed carrying that label.

Branch base is d62f990a9; main moved 4 commits while this was in flight (ed9e6996f), none touching a workflow or a gate that declares scripts/**, so the derived family list stands. The PR's CI runs on the merge ref.

Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Generated by Claude Code

---

Generated by Claude Code