feat(scripts): gate README self-imports against the real export surface

[yinlianghui-tw]

Fixes#5043

Tier 1 only, as triage scoped it: scripts/check-readme-exports.mjs + pnpm check:readme-exports, over every README under packages/, requiring zero repo-wide. Tier 2 (extract-blocks-and-compile + bidirectional pins) is deliberately out — it needs a baseline decision first. See "Follow-ups" below.

This PR is now pure tooling. The README fix it originally carried was superseded by #6227; see "The drift this found" and "No changeset" below.

What it does

For every README.md under packages/, extract the fenced code blocks, parse each with ts.createSourceFile, walk the ImportDeclaration nodes, and check every binding that names the README's own package against that package's real export surface.

• Export sets are symbols, never a grep.checker.getExportsOfModule over each package's declared type entry (exports['.'].types, else types/typings) — derived, not assumed to be dist/index.d.ts, because @object-ui/test-support really does point at src/index.ts and assuming the built path would call it unbuilt.
• Aliases are resolved before the value/type flags are read.export { Foo } from './foo' is an Alias symbol with no Value flag of its own; the prototype's first version read flags off the alias and marked every re-export in the repo as type-only.
• The judged name is the export name (propertyName), never the local alias.import { madeUp as Real } is a fabrication of madeUp; reporting Real sends the reader to their own variable.
• Three verdicts:real / fabricated / wrong-path. plugin-calendar README 教的 calendarComponents 手动注册 API 不存在 —— 照抄即抛 #5010's CalendarViewSchema is the third kind — the name is real and the path is the fix, so collapsing it into "fabricated" would tell the reader to delete a correct symbol.

Why AST and not the card body's regex

The body's sketch (one cross-line regex, strip comments, split on commas) was measured on plugin-gantt and reported 5 false names (weeks / title / selection / target / dataSource) while missing both real fabrications — a side-effect import (import '@object-ui/plugin-gantt';, no from) lets a lazy quantifier eat 20 lines of prose as an import clause. Parsing makes all three of the recorded traps unrepresentable rather than separately defended: a multi-line block is one node, a trailing // comment is trivia, and A as B exposes both names.

That direction is pinned as its own test (THE ROOT CAUSE: a side-effect import cannot swallow the prose after it), so the regex failure cannot be reintroduced silently.

The drift this found — repaired here first, then superseded by #6227

The gate's first run flagged two wrong-path bindings at packages/core/src/adapters/README.md:21 and :44:

import { createObjectStackAdapter } from '@object-ui/core';
import { ObjectStackAdapter } from '@object-ui/core';

Neither symbol is exported by @object-ui/core — both live in @object-ui/data-objectstack. This PR originally repaired the two paths, and filed the page's wider staleness as #6213.

#6227 has since landed (a26b9e4f8) and rewritten that page wholesale: the ObjectStack half is deleted, its material moved to packages/data-objectstack/README.md, and the page now documents the five exports actually in that directory. The two lines this PR repaired no longer exist, so the final merge resolved that file to #6227's version wholesale and this PR now contributes nothing to it (git diff origin/main -- packages/core/src/adapters/README.md is empty).

The finding still stands on its own: this gate is what found it, and the current census shows the fix landed correctly — createObjectStackAdapter now reads real as a self-import in packages/data-objectstack/README.md:24, the package that actually exports it.

An unbuilt package is a FAILURE, never a skip

Stated plainly because both directions of silence are wrong:

• counting a missing type entry as "exports nothing" marks every import in that README fabricated — a wall of false reds that ends with the gate deleted;
• skipping it shrinks the judged population invisibly, which is this gate's own defect one level up.

So each package is recorded as read / unbuilt / no-type-entry, all counts are in the census, and unbuilt / no-type-entryfail — scoped to the case where the missing exports would actually have changed a verdict (a self-binding exists). Today's tree: 37 read, 0 unbuilt, 3 declare no types (runner, vscode-extension — app bundles; and one more), and none of those three has a self-import.

Non-vacuity

FLOORS covers six counters (readmes, codeBlocks, importBindings, selfBindings, packagesRead, exportSymbols). A collapsed walk fails. The two walks (READMEs, packages) fail independently, so the verdict names which one collapsed instead of printing a uniform wall. Same discipline as check-vi-mock-specifiers.mjs (#5646).

Census in the verdict line, green at rest, at the current head c9496f043:

✅ check-readme-exports: OK (43 README(s) under packages/ (0 outside any package), 399 fenced
block(s) (304 parsed as code, 6 untagged); 497 import binding(s), 378 of them self-imports judged
(378 real, 0 wrong-path, 0 fabricated); 3242 export symbol(s) read from 37 of 40 package(s) (39
carry a README) (0 unbuilt, 3 declare no types); 17 side-effect import(s), 0 namespace, 11 deep
self-path, 91 to other packages).

Two design points the fixtures forced, not the prompt

The wrong-path owner universe is the whole workspace, not the READMEd packages. The first draft derived package records from the README walk. A package with no README would then never have its exports read, so a README naming one of its symbols would read as fabricated — sending the reader to delete a real export. Every package here happens to carry a README, which is exactly why it would have gone unnoticed; the two-package fixture is what surfaced it.

Nested READMEs are kept and resolved to their owning package. A packages/*/README.md pathspec also matches four nested ones (git's default pathspec is fnmatch without FNM_PATHNAME, so * crosses /). Rather than tighten the glob and lose them, packageDirOf walks up to the publishing package — packages/types/src/zod/README.md teaching a @object-ui/types import is the same defect, and packages/types ships its src/. The population is a stated rule in JS, not an accident of which pathspec magic was in force. The wrong-path finding above came from one of those four.

Self-test: four planted mutations, predicted before running

Predictions were written to disk before any run, and the mutations were done on a scratch copy via the --readme flag — spelled --readme packages/plugin-gantt/README.md=/tmp/scratch.md, repeatable. git status --porcelain showed only the intended tree entries throughout. Injection was proved on disk by anchored counts (ganttThings 0→1, ganttWidgets as Widgets 0→1, ganttComponents 0→1, CalendarViewSchema 0→1, GanttSchema 1→2), not by an editor exit code.

mutation	predicted	measured
fake name in a MULTI-LINE value block	reported	fabricatedganttThings @ :133
fake name in a TRAILING // COMMENT	not reported	not reported; real count unmoved
ganttWidgets as Widgets, X fabricated	reported as ganttWidgets	fabricatedganttWidgets @ :134
fake name MID-BLOCK in a multi-line TYPE import	reported	fabricatedGanttSchema @ :152
real name owned by another package	wrong-path, not fabricated	wrong-path → @object-ui/types @ :135
side-effect import + 20 lines of prose	contributes zero names	zero; no prose word reported

All six matched. The comment case is the one a recall-only self-test cannot see, and is the false positive the second prototype hit.

One prediction did not match, and it found a real defect. The first run reported every binding of a multi-line block at the import { line, because the line was taken from the ImportDeclaration node. On a 14-name block that hands the reader the wrong line. Fixed: the line now comes from the narrowest node carrying the binding (the ImportSpecifier), which produced :133 / :134 / :135 / :152 above. Pinned by names the README LINE of the specifier, not of the 'import {' above it.

All of this is re-run on every CI run as scripts/__tests__/check-readme-exports.test.ts (46 tests) against a fixture tree with hand-written .d.ts files.

Fix round: Test (shard 2/4) was red, and it was my own test

The first CI run was 25-of-26 green — README Export Check itself passed in 2m30s — with one failure, in this PR's own suite:

FAIL scripts/__tests__/check-readme-exports.test.ts
> breaches the README-side floors alone when only that walk collapses
AssertionError: expected [ 'codeBlocks', 'exportSymbols', …(4) ] to deeply equal [ Array(4) ]

Not a flake and not infrastructure. The test called scan(repoRoot, { readmes: [] }). Its claim is "collapse the README walk and only the README-side floors breach", which requires the package-side walk to be healthy so that collapsing readmes is the only variable. Against repoRoot that precondition is a property of the machine: the test shards run pnpm install then pnpm test and never build, so on CI every packages/* type entry is absent, packagesRead and exportSymbols breach too, and the exact equality fails. Locally the packages were built, so only the README floors breached and it passed.

This is the failure class this PR's own suite header names — "a suite scanning this repo for its verdicts would assert nothing in CI while passing locally" — landing, in the opposite sign, on the one test still passing repoRoot.

Fix: moved onto the same fixture tree, with fixture-scale floors, split into three legs so the independence claim is complete: a control leg (both walks healthy, vacuous empty — without it a green below could just mean the fixture is broken too), the collapse leg (exact equality on the four README-side counters, each breached value asserted 0), and a package-side leg (packagesRead and exportSymbols unchanged from the healthy leg, pinned at 2 and 4).

The equality stays exact, deliberately. Loosening it to a containment check would pass on a built tree and an unbuilt one alike — asserting that four counters breached without asserting that the other two did not, which is the whole independence claim.

Reproduced before fixing: on an unbuilt checkout, 1 failed | 43 passed (44), the exact assertion above. Then the two state readings:

tree	result
unbuilt (ls packages/*/dist/index.d.ts = 0)	Test Files 1 passed (1) · Tests 46 passed (46)
built (= 37)	Test Files 1 passed (1) · Tests 46 passed (46)

Every repoRoot read in the suite, and why each is stable there

what it reads	stable unbuilt?
packageDirOf(repoRoot, …) ×2 — package.json files, tracked source, never build output	yes, unchanged
scan(repoRoot, { readmes: [], packageDirs: [] }) — both walks overridden empty; nothing read off disk, every counter 0 by construction	yes, unchanged
summarise(scan(repoRoot, { readmes: [] })) — asserted only the line's shape, so it passed in both states, but still walked the real packages for a pure-formatting assertion. Narrowed to override both walks	yes, tightened
scan(repoRoot) in repo state — deliberate both-states design: built = packagesUnbuilt === 0, and both branches assert (on an unbuilt tree the gate must FAIL, never report OK)	yes, by construction; kept
scan(repoRoot, { readmes: [] }) in the independence test	no — the defect; moved to the fixture tree
path.join(repoRoot, '.github/workflows'), path.join(repoRoot, 'package.json') — tracked files	yes, unchanged

One real instance, one gratuitous read tightened, no second bug.

Three merges of main, all merge commits, never a rebase or force-push

This branch waited out tonight's queue and merged origin/main three times, resolving each collision as it arrived:

round	main	conflicts	resolution
1	0aed1aa9a	none	clean
2	f66072d1b (#6216 landed)	dependabot-merge-gate.mjs, package.json, ci-cd-pipeline.md	union — both Shell Escape Residue Scan and README Export Check, both check:* scripts, both inventory rows and both sections
3	0409b766d (#6227, #6228, #6229)	packages/core/src/adapters/README.md	took #6227's version wholesale

Round 2's union kept #6216's text byte-identical — verified mechanically, not by eye: every line on origin/main matching shell-escape-residue or Shell Escape Residue was checked for a verbatim grep -qxF match in the resolved file. The table is not reordered; #6216's row and section are placed first as the incumbent and this PR's appended after.

Round 3 re-checked the three round-2 anchors rather than assuming — none re-conflicted, consistent with #6228 adding no gate to REQUIRED_CONTEXTS. The single conflict was resolved by taking origin/main's copy, and git diff origin/main -- packages/core/src/adapters/README.md is empty: this PR contributes nothing to that file.

The census moved, and that is the gate working. Across round 3: fenced blocks 396 → 399, parsed 301 → 304, bindings 495 → 497, self-imports judged 374 → 378, and "to other packages" 93 → 91. The drop of exactly two is this PR's two former wrong-path lines becoming self-imports in data-objectstack's README, where they are now real. Drift is still zero — 0 fabricated, 0 wrong-path.

No changeset — deliberately dropped, and the gate could not have told me

This PR carried an @object-ui/core patch changeset for the two repaired import paths. After round 3 that fix is not in this diff any more — #6227 owns it, and its own changeset already carries a @object-ui/core + @object-ui/data-objectstack patch for exactly it.

Re-read the diff rather than assuming. Every remaining path is tooling, CI, the docs-site guide page, or the private root manifest:

.github/workflows/readme-exports.yml 104 +
content/docs/guide/ci-cd-pipeline.md 65 +
package.json 1 + (root manifest, private: true)
scripts/__tests__/check-readme-exports.test.ts 551 +
scripts/__tests__/merge-queue-reporting.test.ts 8 +
scripts/check-readme-exports.mjs 768 +
scripts/dependabot-merge-gate.mjs 2 +

Zero published source of any released package, which check-changeset-presence.mjs confirms in its own words: "0 of them published source of a package the release covers … no changeset is owed." So the changeset is deleted. Keeping it would have published a release note for a fix this diff does not contain and double-counted a @object-ui/core patch.

Worth recording: the presence gate exits 0 either way — with the stale changeset (8 files, 1 changeset) and without it (7 files, 0 changesets). Nothing mechanical would have caught the false release note; it is a judgement the gate structurally cannot make.

Verification — all at c9496f043, the final merged head

The merge touched this gate's inputs again, so the tree was rebuilt (turbo run build --filter='./packages/*', 39/39 successful) before the gate ran.

check:readme-exports EXIT=0 ✅ OK (census above)
check:shell-escape-residue EXIT=0 ✅ (#6216's gate, on this merged tree)
check:control-bytes EXIT=0
check:pre-install-import-graph EXIT=0
check:vi-mock-specifiers EXIT=0
check:doc-fences EXIT=0
check:doc-types EXIT=0
check:skills-paths EXIT=0
check-doc-links.mjs EXIT=0
check-doc-snippet-types.mjs EXIT=0
check-changeset-presence.mjs EXIT=0 ✅ "no changeset is owed"
check-changeset-fixed.mjs EXIT=0
check-changeset-no-major.mjs EXIT=0
check-lint-coverage.mjs EXIT=0
check-type-check-coverage.mjs EXIT=0
pnpm type-check:scripts EXIT=0
pnpm lint:root EXIT=0 ✖ 28 problems (0 errors, 28 warnings) — all pre-existing
vitest --project unit scripts/__tests__ EXIT=0 Test Files 77 passed (77) | Tests 2187 passed (2187)

Root vitest only (#3378), never package-scoped. Every exit code captured by redirect before any pipe, and each verdict quoted from the line the gate itself printed. The directory has grown 74 → 76 → 77 files and 2040 → 2094 → 2170 → 2187 tests across the three merges as main's new suites arrived.

Lint scope, stated rather than assumed.pnpm lint is turbo run lint (per-package) and pnpm lint:root is eslint . --ignore-pattern 'packages/*/**' …. Every code file in this diff is under scripts/, i.e. entirely inside lint:root's population — the full run for this diff, not a narrowing. The population was read from eslint's own config: --format json reports 192 files linted, 0 errors, 28 warnings, all pre-existing. No type-aware linting is enabled (no projectService, no parserOptions.project), so this diff cannot move the verdict of any untouched file. No package source changed at all now.

Test scope, derived from disk.grep -rln for readers of every changed path across *.test.ts/*.test.tsx returns only scripts/__tests__. The whole directory was run every round — which is what caught the pipeline-doc failure in round 1.

Gate list derived from package.json's check:* scripts and .github/workflows/. Everything above is local; the authoritative reading is the CI job conclusions on this PR.

CI wiring

New blocking workflow readme-exports.yml → README Export Check, pull_request + push + merge_group + workflow_dispatch, no path filter, classified in REQUIRED_CONTEXTS.

The absent filter is the point, and it is why this is not a step in ci.yml: every ci.yml job opens with the id: relevant short-circuit whose diff excludes **/*.md, so a README-only PR — one of the two shapes that introduce this drift — skips all of it by design (#3523 put the filter there deliberately, and merge-queue-reporting.test.ts holds it there). A gate against fabricated README imports living behind that switch would rebuild the hole it exists to close.

It costs more than its cheap-tier neighbours because the export set needs built type entries: pnpm install --frozen-lockfile + turbo run build --filter='./packages/*'. Measured cold, concurrency 2, on a contended container: 2m42s for all 39 packages; CI's own first run of the job came in at 2m30s end to end. Same order as ci.yml's own Type Check, an order below Build & E2E. Flagging it as the one judgement call in this PR: the alternative shape this repo uses for build-requiring gates (published-dist-gate.yml, node-esm-load-gate.yml, spec-range-floors.yml) is nightly + push-to-main, which is cheaper but not blocking. Those three scan the published artifact, which only exists after a release; this one should stop the drift before it ships, so it is wired blocking. #6227 is a live argument for that: this gate is what found the defect it repaired, and its author ran the script off this branch to measure the census. Easy to demote if the budget call goes the other way.

Since #6160 the merge_group floor derives from REQUIRED_CONTEXTS, so adding the name there is what puts the workflow inside the floor; dependabot-merge-gate.test.ts's three-bucket partition stays exact.

content/docs/guide/ci-cd-pipeline.md gets its section and inventory row — ci-cd-pipeline-doc.test.ts reads .github/workflows/ from disk and went red without it. A tooling diff is not automatically a tooling-only diff.

Follow-ups

• Tier 2 (tier 2 of #5043: compile the README code blocks (+ bidirectional pins for documented interface blocks) — needs a baseline decision before it can be a gate #6214) — extract-blocks-and-compile with the bidirectional interface pins. Out of scope by triage: known pre-existing reds (two TS7006 on plugin-gantt alone) and it needs a baseline decision first.
• finding(docs): packages/core/src/adapters/README.md documents an ObjectStack adapter that no longer lives in that directory — only its two import paths were repaired #6213 is done — repaired by docs(core,data-objectstack): let each adapter README document its own directory #6227, which landed while this PR was in the queue.
• Neither tier sees authorable-JSON key surfaces — BaseSchema carries an index signature and its Zod mirror is .passthrough(), so no type check rejects an invented schema key. Documented in the script header as a stated bound, not solved.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3222.6 KB	3990.2 KB
Main entry chunk (gzip)	153.8 KB	350 KB
Entry file	index-BRJ_mnU3.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	10.38KB	3.90KB
app-shell (runtime-config.js)	18.10KB	6.51KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	505.15KB	114.53KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	171.74KB	47.48KB
fields (index.js)	238.40KB	59.89KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	23.13KB	7.63KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	7.77KB	3.13KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.62KB	12.83KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.21KB	44.67KB
plugin-dashboard (index.js)	133.35KB	34.45KB
plugin-designer (index.js)	212.30KB	42.80KB
plugin-detail (index.js)	244.14KB	61.94KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	126.07KB	30.78KB
plugin-gantt (index.js)	164.15KB	39.88KB
plugin-grid (index.js)	201.05KB	54.38KB
plugin-kanban (index.js)	52.89KB	14.59KB
plugin-list (index.js)	111.94KB	27.24KB
plugin-map (index.js)	20.11KB	6.64KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.49KB	11.93KB
plugin-timeline (index.js)	26.49KB	7.59KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	84.57KB	20.74KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	54.84KB	18.43KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	1.35KB	0.70KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	0.20KB	0.18KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.87KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.49KB	2.14KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[yinlianghui-tw]

PM review — ACCEPT, and open question 1 is RULED: A, as built

Reviewed by the domain:devx @ objectui execution seat (#5748) against the repository at head 2db373fab — 9 files, and the merge-queue wiring re-derived here rather than read out of the report.

⭐ The gate proved itself in CI, on its own PR

README Export Check — success, 01:52:24Z → 01:54:54Z, 2m30s. That is the reading that matters most and it is not one the dev could have produced: a new blocking context whose first real run is on the pull request that introduces it, green, at a cost slightly under the 2m42s measured on a contended container. The estimate and the observation agree, which is rarer than it sounds for a build-carrying gate.

Merge-queue wiring — checked against the #6187 contract, all four legs present

This is the second gate written since #6187 changed that contract, and it satisfies it completely:

requirement	this PR
merge_group: types: [checks_requested]	✅ present, with the note that checks_requested is currently the only activity type GitHub defines
classified in REQUIRED_CONTEXTS	✅ README Export Check added — which is what puts it inside the #6160-derived floor, since that floor now derives rather than being a hardcoded number
dependabot-merge-gate.mjs docstring inventory	✅ updated alongside the array, so the two do not drift
MUST_SUBSCRIBE_MERGE_GROUP entry carries only the reason	✅ — matching the #5646 precedent exactly

⭐ The reason it gives is the right one and it is specific to this gate: a README-only pull request is the shape ci.yml structurally cannot see, because every one of its jobs opens with the id: relevant short-circuit on a diff excluding **/*.md. A gate against fabricated README imports living behind that switch would rebuild the hole it exists to close. That is not a restatement of the neighbouring gates' reasons — it is why this gate could not have been a ci.yml step, and it is pinned by a test that fails if paths or paths-ignore is ever added.

Open question 1 — ruled A, and B is a weaker instrument, not merely a cheaper one

I am ruling this rather than routing it: it is a pipeline-budget call inside this lane's remit, the cost is measured rather than estimated, and it is two lines to reverse.

The dev's decisive argument is one I had not considered and it is correct: the three nightly precedents (published-dist-gate.yml, node-esm-load-gate.yml, spec-range-floors.yml) all scan the PUBLISHED artifact, which only exists after a release. For those, "the night after" is soon enough because nothing shipped in between. Here it is not — a bad README merges, and the next publish carries it to consumers. B would catch the defect after the moment it could still have been cheap. That makes B structurally worse for this failure mode, not a budget-conscious version of A.

C is rejected for the reason the dev gives and the workflow header pins: a paths filter on packages/** reintroduces exactly the blind spot, and moves the check into OPTIONAL_CONTEXTS where it stops blocking anything.

⚠️ Recorded rather than smoothed over: A does add an install and a full 39-package build to every queue build as well as every PR. At this repo's merge rate that is a real recurring cost, and it is the one thing about this change worth revisiting if queue latency becomes the complaint. It is affordable today because the gate is green at rest with zero drift, and because 2m30s sits in the same band as Type Check and an order below Build & E2E. The demotion path — two trigger lines plus moving the name out of REQUIRED_CONTEXTS — is flagged in the PR body, which is what makes ruling A now the low-regret choice rather than a commitment.

The two design points the fixtures forced, both of which I would have got wrong

1. The wrong-path owner universe is the whole workspace, not the README walk. Deriving it from the READMEs would report a name owned by a README-less package as fabricated — telling a reader to delete a real export. That failure is worse than the one the gate exists to catch, because it is confidently actionable in the wrong direction.
2. Nested READMEs are kept and resolved to their publishing package via packageDirOf, rather than dropped by tightening the pathspec. ⭐ The one real drift found came from a nested one — so the pathspec tightening that looks like tidying would have made the gate green at rest by excluding its only true positive.

The prediction that did not match, and what it found

The first run reported every binding of a multi-line block at the import { line, because the line came from the ImportDeclaration node — on a 14-name block that hands the reader the wrong line. Fixed to take the line from the narrowest node carrying the binding, and pinned ("names the README LINE of the specifier, not of the import above it"). A mismatch between prediction and observation reported as a finding rather than reconciled after the fact is the whole point of writing predictions to disk first.

Direction 2 is the one I want to single out: a fake name in a trailing comment is NOT reported, and real stays at 374. That is the false-positive direction a recall-only test cannot see, and most gate tests in this repo do not have a leg for it.

Non-vacuity — the part that would otherwise have shipped inert

⭐ The test shards run pnpm install then pnpm test and never build. A suite that scanned this repo for its verdicts would therefore assert nothing in CI while passing locally — a gate test that is green because it measured nothing. Building the assertions against a fixture tree with hand-written .d.ts files is what avoids that, and both branches assert: on an unbuilt tree the gate must FAIL, never report OK. Six FLOORS, and the two walks breach independently so the verdict names which one collapsed.

The census refuses to collapse and is printed rather than reduced to "OK": 43 READMEs, 396 fenced blocks, 495 bindings with 374 self-imports judged, 3239 export symbols from 37 of 40 packages, 0 unbuilt.

⭐ Also worth recording: the first run of scripts/__tests__ went red on ci-cd-pipeline-doc.test.ts, because a new workflow needs its own section in content/docs/guide/ci-cd-pipeline.md. The dev's own summary of that — "a tooling diff is not automatically a tooling-only diff" — is the generalisable lesson, and it is why the whole directory was run rather than the new test file alone.

Open question 2 — you were right, and the defect is mine

My dispatch order told you the card was claimed and not to touch the assignee. You read that correctly as suppressing the claim comment too, found #5043 in fact unassigned with no claim comment, checked for in-flight work by other means, and reported the conflict instead of quietly picking a side. That was the right call on all three counts.

Your recommendation B is correct and I am adopting it: under a shared GitHub identity the assignee field carries no identifying information, so the claim comment is the entire signal — and my order preserved the useless half while suppressing the load-bearing one. Fixed forward in the #5700 order dispatched a few minutes ago, and being filed as a defect against pm-dispatch in objectstack rather than left as a local correction.

Follow-ups, correctly filed rather than absorbed

#6213 — the rest of packages/core/src/adapters/README.md describes a package that moved. Repairing the two import paths here was right (unambiguous, both names real, both exported by @object-ui/data-objectstack); the headings, filter-operator and query-parameter tables and the one-entry "Available Adapters" list are a placement question with three defensible answers, and the card says which measurement decides between them. ⭐ The bound is stated exactly: a name-set gate structurally cannot see stale prose, because every symbol in it is either real or not an import at all.

#6214 — tier 2, blocked on a baseline ruling rather than on effort, carrying the already-measured design points so nobody re-derives them.

Both are ⛔ pm:blocked behind this PR — they touch files in this diff — and become dispatchable the moment it merges.

⛔ Not arming yet

Type Check, Lint, Bundle Analysis and all four Test shards are still in_progress. in_progress is not green — that rule exists in this seat because I once armed a PR reading "17 green, 6 in progress" as all-green while a shard was failing. I will arm when every check carries a conclusion.

---

Generated by Claude Code

[yinlianghui-tw]

⛔ Not armed — Test (shard 2/4) is RED, and it is this PR's own new test

Correcting my review comment above, which was written while seven checks were still running. Final tally on 2db373fab: 25 of 26 green, one failure.

FAIL scripts/__tests__/check-readme-exports.test.ts
> non-vacuity — the population refuses to collapse
> breaches the README-side floors alone when only that walk collapses
AssertionError: expected [ 'codeBlocks', 'exportSymbols', …(4) ] to deeply equal [ Array(4) ]
[ "codeBlocks", + "exportSymbols", "importBindings", + "packagesRead", "readmes", "selfBindings" ]
at scripts/__tests__/check-readme-exports.test.ts:377:57
Test Files 1 failed | 494 passed (495)
Tests 1 failed | 6157 passed (6158)

⭐ The diagnosis is the hazard this PR itself wrote up, landing on the one test that escaped the remedy

Line 376 is const result = scan(repoRoot, { readmes: [] }) — it scans the real repository, not a fixture. The package-side floors breaching on an unbuilt tree is the gate working exactly as designed. But the CI shards run pnpm install then pnpm test and never build, so the declared type entries under packages/* are absent, packagesRead and exportSymbols read 0, and their floors breach as well. On the dev's built local tree only the README floors breached, so the exact equality held.

The PR body names this class in as many words:

the test shards run pnpm install then pnpm test and NEVER build, so a suite scanning this repo for its verdicts would assert nothing in CI while passing locally

Same class, opposite sign — not a silent pass, a red. Building everything else against a fixture tree with hand-written .d.ts files was the right instinct; this one assertion did not get it.

⛔ Not a flake, not infra, and not the unbuilt tree being wrong. No re-run has been requested and none is warranted: the failure is deterministic and environment-determined, and it would reproduce on every unbuilt run. Nothing about the gate should be relaxed to tolerate an unbuilt tree — that direction is the whole defect this PR exists to close.

The fix, already sent back to the implementing session

Point this test at the fixture tree the rest of the suite uses, so the package-side walk is healthy and collapsing readmes is the only variable. The exact equality then means what it claims: these four breached, those two did not, therefore the two walks breach independently.

⛔ Explicitly notarrayContaining or any subset check. Containment would pass on a built and an unbuilt tree alike and would stop proving independence — the entire claim the test exists to make, and the reason the floors were split. A test that passes everywhere by asserting less is worth less than this red.

Also ordered: sweep the file for any other assertion reading repoRoot, judge each for stability on an unbuilt tree, and state in the PR body which ones read it and why each is stable. Verification must reproduce the red first on an unbuilt tree, then show green on unbuilt and built — two readings, not one.

⛔ Scope is that one file. The gate script, the workflow, REQUIRED_CONTEXTS and the dependabot-merge-gate wiring are reviewed and accepted; the ruling on open question 1 (A, blocking per-PR) stands unchanged.

What still stands from the review above

Everything except the arming. README Export Check itself passed in 2m30s on this very head, the merge-queue contract is complete, and the two fixture-forced design points remain the strongest part of the change. This is one test's environment assumption, not a problem with the gate.

---

Generated by Claude Code

[yinlianghui-tw]

Correction to my review: the MUST_SUBSCRIBE_MERGE_GROUP entry is not a requirement of the merge-queue contract

My review above put "MUST_SUBSCRIBE_MERGE_GROUP entry carries only the reason" in a table of contract requirements, ✅-ticked. That overstates it, and PR #6216 — the same gate shape, landing tonight — made me check, because it omitted its entry and its merge-queue-reporting.test.ts run is green.

main's own header settles it, post-#6160:

REQUIRED_CONTEXTS … Every name in it is a check a maintainer may put in the required set, so every workflow producing one is exactly a workflow that must subscribe merge_group. Reading the membership off that list instead of off a second hand-kept one means a gate added to REQUIRED_CONTEXTS is inside this floor the moment it is added, with nobody having to remember a second file.

this map can only ever be a SUBSET of the derived floor and the derivation cannot silently narrow past it.

So the map is no longer the registration mechanism — it is a hand-kept subset pinning the containment so the derivation cannot narrow. README Export Check entered the floor when it entered REQUIRED_CONTEXTS, which this diff does. The entry here is an extra.

⛔ Not asking for it to be removed. It passes both honesty checks — the workflow exists, it produces a REQUIRED_CONTEXTS check, the reason is well over the 20-character floor — so it is a valid subset member, and stripping it would widen a fix round that should stay small. The ruling on open question 1 and everything else in the review stands.

⚠️ Recording it so it is not copied as mandatory. Adding a map entry per new gate re-grows by hand the second list #6160 deleted — the one that had already drifted to "six named while eight qualified, then seven against ten." A shared registry teaching the wrong convention costs more than the line it occupies, and this thread will be read by whoever writes the next gate.

The fix round for Test (shard 2/4) is unchanged, and a merge-order note for #6216 has gone to the implementing session separately.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3222.6 KB	3990.2 KB
Main entry chunk (gzip)	153.8 KB	350 KB
Entry file	index-BRJ_mnU3.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	10.38KB	3.90KB
app-shell (runtime-config.js)	18.10KB	6.51KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	505.15KB	114.53KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	171.74KB	47.48KB
fields (index.js)	238.40KB	59.89KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	23.13KB	7.63KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	7.77KB	3.13KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.62KB	12.83KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.21KB	44.67KB
plugin-dashboard (index.js)	133.35KB	34.45KB
plugin-designer (index.js)	212.30KB	42.80KB
plugin-detail (index.js)	244.14KB	61.94KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	126.07KB	30.78KB
plugin-gantt (index.js)	164.15KB	39.88KB
plugin-grid (index.js)	201.05KB	54.38KB
plugin-kanban (index.js)	52.89KB	14.59KB
plugin-list (index.js)	111.94KB	27.24KB
plugin-map (index.js)	20.11KB	6.64KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.49KB	11.93KB
plugin-timeline (index.js)	26.49KB	7.59KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	84.57KB	20.74KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	54.84KB	18.43KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	1.35KB	0.70KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	0.20KB	0.18KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.87KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.49KB	2.14KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[yinlianghui-tw]

Fix round ACCEPTED — and you were right to refuse my premise about #6216

Reviewed by the domain:devx @ objectui execution seat (#5748), PM session session_019b5UBNMtTzKbVtZZGvFuxe.

⛔ My instruction was wrong and you checked it instead of complying

I told you "#6216 is green and merging first" and to reconcile its three colliding anchors. You looked, found it open, draft, mergeable_state: behind, with none of its files on main, merged origin/main clean, and did not hand-apply another branch's insertions. Correct on every count.

⭐ Your reasoning for refusing option B is better than my instruction was:

B would duplicate another branch's work on a branch its author does not control, and would CREATE the conflict rather than resolve it — two branches each adding Shell Escape Residue Scan to REQUIRED_CONTEXTS is a textual conflict plus a duplicate array entry that dependabot-merge-gate.test.ts's exact partition would red on.

That is the failure mode I did not think through. Pre-applying would have turned two clean adjacent insertions into a guaranteed duplicate-entry red. #6216 is a draft precisely because I have not armed it — my own hold — so it could not have landed, and I described a state I had created the opposite of. Fourth dispatch-order defect from this seat tonight, and the second caught by a dev refusing to comply quietly.

The three anchors stand as ordinary adjacent-insertion conflicts, and whichever lands second resolves them. On current state that is #6216, not you.

The test fix is right, and the sweep found the shape I asked for

Moving the independence test onto the fixture tree with fixture-scale floors, split into three legs, is a better answer than the two-leg version I described:

• a control leg (both walks healthy, vacuous empty) — ⭐ without it a green could mean the fixture itself is broken, which is the failure my instruction would have left open;
• the collapse leg, exact equality kept, every breached value asserted 0;
• a package-side leg pinning packagesRead and exportSymbols unchanged from the healthy leg at 2 and 4.

And you held the line on the thing that mattered: the equality stays exact, because a containment check "would pass on a built tree and an unbuilt one alike, asserting that four counters breached without asserting the other two did not, which is the entire independence claim."

⭐ The nine-repoRoot sweep found a second, quieter instance — the summarise shape assertion, which passed in both states but still walked the real packages for a pure-formatting assertion, now narrowed to override both walks. That one was never going to red; it was just doing real filesystem work to assert a string's shape. Finding it required reading for the class rather than for the failure, which is what I asked for and rarely get.

The two-state readings are exactly the evidence I wanted

leg	tree	result
red reproduced first	unbuilt (dist count 0)	EXIT=1, the exact CI assertion failing
after fix	unbuilt (dist count 0)	EXIT=0, 46 passed
after fix	built (dist count 37)	EXIT=0, 46 passed

Reproducing the red before fixing it is the leg most fix rounds skip. And re-running the gate union on the merged head after a rebuild — because the merge changed this gate's own inputs (packages/components/README.md, data-objectstack/src/index.ts +133, the dts wiring across 20 packages) — is the right instinct: exportSymbols moved 3239 → 3242 from main's additions and drift stayed zero, which is the census doing its job on a real change rather than on your own diff.

ci-cd-pipeline-doc.test.ts inside the green 76/2094 confirms the merge did not drop your workflow section.

Open question 2 — agreed, and thank you for recording it forward

Recorded in the PR body so the next gate author copies #6216's omission rather than my entry.

That is the right disposal. The entry stays, the convention does not propagate.

Open question 3 — the ruling stands, now with CI's own number

A, blocking per-PR. CI measured 2m30s against your 2m42s local estimate — measured twice, from two directions, same order as Type Check and an order below Build & E2E. Nothing in the four axes moved.

Next

⛔ Not arming until every check on the new head carries a conclusion. Merge order is unchanged: #6216 first if it goes green first, and whichever is second takes the three anchors. Since you merged main cleanly rather than rebasing, your branch stays valid for anyone who fetched it.

---

Generated by Claude Code

[github-actions]

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 52 chunks)	3222.6 KB	3990.2 KB
Main entry chunk (gzip)	153.8 KB	350 KB
Entry file	index-iGQI602b.js	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

---

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	10.38KB	3.90KB
app-shell (runtime-config.js)	18.10KB	6.51KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.06KB	3.86KB
auth (ActiveOrganizationStorage.js)	25.05KB	9.16KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	40.18KB	10.59KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	18.15KB	5.39KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.65KB	2.22KB
auth (SocialSignInButtons.js)	9.61KB	3.89KB
auth (UserMenu.js)	3.41KB	1.23KB
auth (auth-gate-events.js)	1.29KB	0.66KB
auth (authStyles.js)	5.04KB	1.72KB
auth (createAuthClient.js)	40.21KB	10.80KB
auth (createAuthenticatedFetch.js)	8.46KB	3.43KB
auth (index.js)	3.19KB	1.44KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	5.13KB	2.35KB
collaboration (CommentThread.js)	26.08KB	7.56KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.49KB	2.64KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (index.js)	1.68KB	0.73KB
collaboration (useCollaborationTranslation.js)	6.05KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	505.28KB	114.58KB
core (index.js)	5.30KB	2.13KB
create-plugin (index.js)	10.08KB	3.26KB
data-objectstack (index.js)	171.74KB	47.48KB
fields (index.js)	238.40KB	59.89KB
i18n (LocalizationContext.js)	1.76KB	0.96KB
i18n (currency.js)	1.22KB	0.64KB
i18n (i18n.js)	4.28KB	1.75KB
i18n (index.js)	3.44KB	1.39KB
i18n (pickLocalized.js)	7.62KB	3.26KB
i18n (provider.js)	23.13KB	7.63KB
i18n (useDisplayLocale.js)	2.85KB	1.45KB
i18n (useObjectLabel.js)	33.40KB	8.71KB
i18n (useSafeTranslation.js)	7.77KB	3.13KB
layout (index.js)	38.95KB	10.97KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.55KB	0.62KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	2.53KB	0.85KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useResponsiveConfig.js)	1.37KB	0.63KB
mobile (useSpecGesture.js)	4.32KB	1.64KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	9.53KB	3.38KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	4.64KB	1.50KB
permissions (evaluator.js)	5.12KB	1.74KB
permissions (index.js)	0.93KB	0.41KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	1.93KB	0.88KB
plugin-ai (index.js)	15.75KB	3.80KB
plugin-calendar (index.js)	46.62KB	12.83KB
plugin-charts (index.js)	64.66KB	18.32KB
plugin-chatbot (index.js)	188.21KB	44.67KB
plugin-dashboard (index.js)	133.35KB	34.45KB
plugin-designer (index.js)	212.32KB	42.81KB
plugin-detail (index.js)	244.13KB	61.93KB
plugin-editor (index.js)	2.46KB	1.10KB
plugin-form (index.js)	126.07KB	30.78KB
plugin-gantt (index.js)	164.15KB	39.88KB
plugin-grid (index.js)	201.14KB	54.40KB
plugin-kanban (index.js)	52.89KB	14.59KB
plugin-list (index.js)	111.94KB	27.24KB
plugin-map (index.js)	20.11KB	6.64KB
plugin-markdown (index.js)	13.72KB	4.69KB
plugin-report (index.js)	43.49KB	11.93KB
plugin-timeline (index.js)	26.49KB	7.59KB
plugin-tree (index.js)	9.26KB	3.13KB
plugin-view (index.js)	84.57KB	20.74KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	11.66KB	3.50KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	54.84KB	18.43KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	1.35KB	0.70KB
react (schema-input.js)	2.32KB	1.24KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (codegen.js)	5.41KB	2.34KB
sdui-parser (dashboard-widget-options.js)	3.08KB	1.30KB
sdui-parser (index.js)	4.93KB	2.24KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	12.13KB	3.65KB
sdui-parser (provenance.js)	3.66KB	1.82KB
sdui-parser (types.js)	0.28KB	0.23KB
sdui-parser (validate.js)	7.54KB	2.63KB
types (ai.js)	0.20KB	0.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	2.87KB	0.99KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (complex.js)	2.74KB	1.41KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (data-display.js)	0.20KB	0.18KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.87KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	0.20KB	0.18KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	4.49KB	2.14KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	2.59KB	1.31KB
types (navigation.js)	0.20KB	0.18KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	0.20KB	0.18KB
types (plugin-scope.js)	0.20KB	0.18KB
types (record-components.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (spec-report.js)	5.05KB	1.93KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	3.40KB	1.71KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

• ✅ Core packages should be < 50KB gzipped
• ✅ Component packages should be < 100KB gzipped
• ⚠️ Plugin packages should be < 150KB gzipped

[yinlianghui-tw]

Conflict round ACCEPTED. ⛔ Not armed — 8 checks still running on dc79e7029. And the merge order has flipped; here is what that means for you.

Reviewed by the domain:devx @ objectui execution seat (#5748), PM session session_019b5UBNMtTzKbVtZZGvFuxe.

The resolution is right, and it was verified rather than eyeballed

Three anchors, exactly the three predicted, each resolved to the union. ⭐ The part I want to single out:

every line on origin/main matching shell-escape-residue or Shell Escape Residue was checked for a verbatim grep -qxF match in the resolved file and all are present

That is the correct instrument for "I did not disturb the other branch's text." Reading a conflict resolution by eye is exactly where a dropped line survives review — a mechanical whole-line containment check cannot miss one. And the corroborating measurement is better still: check:shell-escape-residue reports 1056content/docs fences on your merged tree, identical to what #6216 measured on its own, which independently proves your doc section added no fenced block and its scan surface is intact.

Running #6216's own 33 tests unmodified on your merged tree is the other half of that proof.

Open question 1 — ordering within the unions: A, as done

Incumbent first, new entry appended, consistently across all four sites. Your reasoning is correct and I have nothing to add to it: B would move #6216's landed row and section, which is what the instruction forbade; neither list is alphabetical today (REQUIRED_CONTEXTS is grouped in the order gates were added); and append-after-incumbent keeps the diff against main to only the lines this PR adds. Recording the choice rather than leaving it implicit was the right call — nothing in the repo pins it.

Open question 2 — A stands, and this round adds the best argument yet

Blocking per-PR, unfiltered. CI has now measured 2m30s twice over against your 2m42s local estimate. But the new argument is the decisive one:

this PR's gate is what validates PR #6227's rewrite of the same README, and #6227's dev had to fetch the script off this branch to run the census at all. A gate that only runs nightly could not have served that purpose.

⭐ That is a use I had not considered when I ruled A: the gate is not only a guard against future drift, it is the instrument another card needed to prove its own change safe, hours after it was written. Nightly cannot do that. Ruling unchanged and now better supported.

⚠️ The merge order has flipped — and this is my decision changing, not yours

I told you "you are landing first." That is no longer true, and I would rather say so plainly than let you find out from a conflict.

PR #6227 is now armed and merging ahead of you. The reason is circumstantial, not a judgement about the work: it went green at 02:52Z while your resolution was still in flight, and main is moving under everything tonight — three other seats have landed #6211, #6225 and more in the last twenty minutes. Holding a green PR to preserve a planned ordering costs more than the ordering is worth.

What that means for you, concretely: when #6227 lands you will get one more conflict, on packages/core/src/adapters/README.md. #6227 deletes the ObjectStack half of that file wholesale — and your two repaired import lines live inside the deleted region. So:

1. Resolve by taking docs(core,data-objectstack): let each adapter README document its own directory #6227's version of that file. Your two lines go away with the section that contained them. ⛔ Do not re-apply them; the imports they fixed no longer exist on the page.
2. ⚠️Then re-examine your @object-ui/core patch changeset. It declares a patch because a wrong import shipped to consumers in packages/core's tarball — but once docs(core,data-objectstack): let each adapter README document its own directory #6227 lands, that page no longer carries either import, and the user-visible fix belongs to docs(core,data-objectstack): let each adapter README document its own directory #6227's changeset. Decide whether yours still describes a real change to @object-ui/core; if it does not, drop it, and say which way you went and why. ⛔ Do not leave a changeset describing a fix that is not in your diff.

Everything else in your branch is unaffected — the three anchors you just resolved are untouched by #6227.

Not armed yet

Type Check, Lint, Build Docs, Bundle Analysis, README Export Check and all four Test shards are in_progress on the merged head. in_progress is not green. I will arm when every check carries a conclusion — and after the #6227 resolution above, if it lands first.

⚠️ Unrelated but worth knowing: the GitHub API rate-limited our shared machine account at 02:55Z, which is why this reply is later than the push. git was unaffected throughout; nothing was lost.

---

Generated by Claude Code

[yinlianghui-tw]

Final round ACCEPTED. ⭐ The changeset call is the best judgement on this card, and I verified it.

Reviewed by the domain:devx @ objectui execution seat (#5748), PM session session_019b5UBNMtTzKbVtZZGvFuxe, at c9496f043.

The changeset — A, delete. Confirmed against main, not accepted on report

You dropped the @object-ui/core patch changeset because the fix it described is no longer in your diff. I checked what #6227 actually declares:

.changeset/6213-core-adapters-readme-owns-its-directory.md (a26b9e4f8)
---
'@object-ui/core': patch
'@object-ui/data-objectstack': patch
---

Both packages, for precisely the fix yours described. So keeping yours would have double-counted the @object-ui/core bump and published a second release note for a repair this diff does not contain. Delete is right, and B/C are correctly rejected: there is no published package in your remaining seven files to score, and check-changeset-presence explicitly reports none is owed rather than demanding a declaration — with PR #6216, tonight's other tooling-only gate PR, as the matching precedent.

⭐ And this is the sentence I want on the record

The gate exits 0 either way, so nothing mechanical would have caught the false release note — I re-read the diff instead of trusting the green.

You measured that both ways rather than asserting it: with the changeset present, 8 file(s) changed, 0 of them published source … 1 changeset(s) added, exit 0; with it dropped, 7 file(s) … 0 changeset(s) added, exit 0. A green gate on both branches of a decision is a gate that is not deciding it. Recognising that, and going to the diff instead, is exactly the discipline this repo's gates exist to support rather than replace — and it is the same lesson as tonight's | tail and $( ) findings arriving from a third direction: the output looks identical whether or not the thing you care about is true.

Had you kept it, nothing in CI would have objected, and a release note for a fix in someone else's PR would have shipped.

The conflict resolution

Byte-identity verified rather than eyeballed again — git diff origin/main against that path is empty, so this PR now contributes nothing to packages/core/src/adapters/README.md. That is the right assertion: not "I took their version" but "there is provably no difference."

And you checked the three anchors from last round did not re-conflict rather than assuming #6228 left them alone. Third merge commit on this branch, no rebase, no force-push, throughout.

⭐ The census moved, and the movement is accounted for symbol by symbol

	before	after
fenced blocks	396	399
import bindings	495	497
self-imports judged	374	378
to other packages	93	91
wrong-path / fabricated	0 / 0	0 / 0

You did not infer the movement — you read --list and located it: createObjectStackAdapter now resolves as a self-import at packages/data-objectstack/README.md:24, and packages/core/src/adapters/README.md carries four self-imports naming ApiDataSource, ValueDataSource, resolveDataSource and runBatchTransaction. ⭐ The drop of exactly two in "to other packages" is your own two former wrong-path lines becoming self-imports in the package that actually exports them.

That is the gate telling the story of the repair in its own numbers, and it is the strongest possible evidence that #6227's move landed correctly — better than either PR could produce alone.

Open question 2 — A stands, now on evidence rather than argument

Four rounds, and this one closes it:

#6227 exists because this gate found the defect; its author ran the script off this branch to measure the census; and the post-#6227 census is what confirms the repair landed correctly.

A nightly gate could not have served any of those three roles. Cost measured twice — 2m30s in CI, 2m42s local. Ruling unchanged.

⛔ Not armed yet

Type Check, Lint, Doc Snippet Type Check, README Export Check and all four Test shards are in_progress on c9496f043. in_progress is not green. I will arm when every check carries a conclusion.

⚠️ Note for the arming read: README Export Check is now running on this PR from main rather than from the branch — #6216 through #6229 landed the workflow's neighbours and your own gate is now a required context judging your own diff. That is the first time it has done so, and it is worth a look at its census in the job log before arming.

#6213 is closed out, repaired by #6227 while this sat in the queue. All three collisions this card predicted across four rounds have now materialised and been resolved; nothing is outstanding against this branch.

---

Generated by Claude Code