ci(devx): run the dev-prereqs gate's self-test half in lint.yml

[hotlong]

Fixes#8170

The second and only other member of the split-gate family whose first member landed as #8171. One step in .github/workflows/lint.yml running node scripts/check-dev-prereqs.mjs --self-test, and deliberately nothing else.

What lands

• .github/workflows/lint.yml — one step in the typecheck job, in the pre-build group, invoked as node (never through the check:dev-prereqs npm script, which is --self-test && the scan), with the same "self-test half only, never the scan" naming as the ci(lint): run the skill-frame freshness gate's self-test half in CI (#8110) #8171 and 观察单：changeset 家族三个 check-*.mjs 的 --self-test 只在可被 skip-changeset 整体豁免的 job 里跑，改这些脚本的 PR 恰好豁免自己的自检 #6509 precedents.
• scripts/check-dev-prereqs.mjs — header precision only, no behaviour change. Its header said "CI IS UNAFFECTED. This is wired into the root dev / dev:* scripts only — never into a workflow". That is true of the scan and this change makes it false of the file, so the paragraph is split into WHERE THE SCAN RUNS / WHERE THE SELF-TEST RUNS. Leaving a header that flatly contradicts the step being added seemed worse than the extra file; the dispatch's file surface was lint.yml (+ package.json if argued), so this is a stated deviation rather than a silent one.
• No package.json change, matching check:skill-frame-freshness --self-test runs nowhere in CI, so a broken fixture is invisible until a human runs the gate #8110's decision against a dedicated script name — a second hand-kept spelling of one command buys nothing here.

Measurements, re-taken on this tree (not inherited)

Every reading below was taken fresh in a worktree at merge base a5dcb74, with no node_modules and nothing built.

#	claim	reading
A	--self-test is green and hermetic	exit 0, 16 cases, 0.105–0.222s; no node_modules present
A'	it survives CI's shallow clone	green in a git clone --depth 1 --single-branch carrying zero refs/remotes/origin/main (verified by show-ref), 0.105s
B	the scan half is CI-hostile	exit 1 — "The workspace is not built … 67 of 67 workspace packages declare an entry point under dist/ that is not on disk", byte-for-byte the reading the issue recorded
D	wall clock as its own step	~0.11s steady-state (0.222s cold)

C — what reddens it, and where this differs from #8171

#8110's gate turned out to be unable to redden alone; its sibling check:skill-frame-sync reds first with a clearer diagnosis. Asking the same question here gives the opposite answer, measured both directions:

• It CAN go red alone. Rewording the stale-dist red message (LIES → MISLEADS) in scripts/check-dev-prereqs.mjs reds the self-test on its own: stale/says-it-lies: expected true, got false. Nothing else in CI reads this script — the other repo references are prose, plus packages/spec's build script calling --stamp — so no sibling gate reddens first.
• That is fine here, and it is why the placement did not need to change. The self-test's only input is this one script's own code, so the only PR that can reach the step red is a PR editing that script, and the failure names the assertion label sitting a few lines below the edit. The check:skill-frame-freshness --self-test runs nowhere in CI, so a broken fixture is invisible until a human runs the gate #8110 hazard was a red whose diagnosis lived elsewhere; this red is same-file and self-explaining.
• The other direction. A legitimate change elsewhere cannot redden it: dropping --stamp from packages/spec's build script — which does red the scan half with a CoverageError — leaves the self-test green, because its fixtures are synthetic. Stated in the step comment as the step's honest boundary: it vouches for the gate's verdict paths, never for this workspace.

Placement

Next to the existing Stall-guard self-test rather than beside #8171's step. Both neighbours are self-tests of a guard whose real path CI does not exercise, which is this step's actual subject; the region around #8171's step is a tight run of skill-frame / .claude gates, and wedging a dev-preflight gate into it would break that narrative. The family reads as a family through the shared step-name convention, not through adjacency. Happy to move it if the reviewer prefers adjacency.

The naive-grep meta-hazard is honoured: with comment lines stripped, check:dev-prereqs appears nowhere in .github/workflows/, so no comment here can be misread as evidence the whole gate is wired.

Verification

Gates re-derived against the actual changed paths with node scripts/pm/dispatch-gates.mjs .github/workflows/lint.yml scripts/check-dev-prereqs.mjs, then run:

check:nul-bytes OK (7454 files, self-test 75 assertions)
check:filter-alias-parity OK
check:node-version OK (27 setup-node steps across 24 workflows)
check:required-contexts OK
check:shard-attestation OK (self-test 92 assertions)
check:workflow-status-functions OK (24 workflows, 43 jobs)
check:type-check-coverage OK (64/77 packages)
check:changeset-gate-self-tests OK (118 + 153 + 117 assertions)
node scripts/check-dev-prereqs.mjs --self-test exit 0, 16 cases

check:type-check-debt was not run locally: it refuses without the full workspace build closure ("55 workspace dependencies … have no built type entry point on disk") and CI runs it after the build step. This diff contains no TypeScript.

The workflow was also parsed with a YAML loader to confirm the new step lands in jobs.typecheck.steps as exactly one run line, with none of the comment prose leaking into it.

Release impact

None — a workflow step and a comment block. Route 2: skip-changeset, no changeset file.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 12, 2026 9:27pm