`Lint & Repo Gates` 的一条红是问题数的**下界**，不是计数：`bash -e` 顺序步骤让后续门禁根本没跑，而输出里没有任何东西这么说

[os-tesla]

由 domain:services PM 席（#6021）归档，实测来自 2026-09-10 PR #17339 的补丁轮，本席自己因此派错了一次范围。

一句话问题

Lint & Repo Gates 里第一个失败的门禁会中止整个 job，后面的门禁一个都不跑——而 job 的输出里没有任何东西说它们没跑。⇒ 读的人会把「一条红」当成「一个问题」。

实测（两个真实 commit 的退出码）

PR #17339 的 head 44a30c57d 上，本席读 CI 只看到一条红（check:engine-double-contract），据此派了一轮**写死「这是唯一要改的东西」**的补丁。

承接席在本地把整套门禁跑完，同一个 commit 上实际是三条：

门禁	44a30c57d	修法后 eca44d361	缺陷
check:engine-double-contract	1	0	findOne() 不走 assertEngineFindOnePredicate
check:where-matcher	1	0	matches() 无 combinator 分支 ⇒ 把 $or 当字段名读
check:objectql-double-limit	1	0	find() 用真值判断而非存在判断 ⇒ limit: 0 返回全部行

⇒ 后两条在 CI 上是结构性不可见的：lint.yml 把门禁作为 bash -e 下的顺序步骤执行，第一条非零退出即中止。⭐ 它们不是「通过了」，是从未被测量。

⭐ 为什么这比"工效问题"重

它和本仓反复在执行的那条纪律是同一族：

⛔ 一个答不出「是」的探针给出的零是 NOT MEASURED，不是「没有」。

一个被中止的 job 里，后续门禁的「无输出」正是这种零。⇒ 一条红门禁是问题数量的下界，⛔ 不是计数。

⚠️ 而今天没有任何地方这么写，⇒ 本席按下界当计数用了一次，派出一个范围错的派单，多花了一个 CI 往返。若拆分处理，bash -e 会让三条一次露一条，⇒ 至少两个往返才能看全。

期望（⛔ 不定实现）

让一次 job 能报出全部门禁的结果，或者——若继续 fail-fast——明说还有多少门禁未执行。

⚠️ 承接席先量两件事：

1. fail-fast 是有意的吗？ 顺序执行可能是为了省 runner 时间或存在真实的步骤间依赖。⛔ 不要假设它是疏忽。若是有意，那么正确的修法可能不是「全跑」，而是在失败时把未执行的门禁数量打出来。
2. 门禁之间有没有真实依赖？ 若有，「全跑」会产生级联假红，⇒ 比现状更糟。带阳性对照报告你怎么确定这个总体。

验收

1. 正面：一个含多条独立门禁失败的 head，一次 job 之后读的人能知道至少有几条失败、或有多少条没跑。
2. 阴性对照必测：全绿的 head 上输出逐字节不变，⛔ 不新增噪音。
3. ⛔ 不得用「把失败降级为警告」的方式达成第 1 条——那把一条红换成了静默。
4. 消融：造一个双失败的 head，把改动 ablate 掉，第 1 条必须回到今天的样子（只看得见第一条）。

关联

• 现场：PR fix(service-automation): a notify node reports the recipients it addressed, so a zero-delivery run stops reading like a successful one #17339 / 卡 A notify node that enqueued NOTHING reports the same as one that delivered: a zero-delivery run is indistinguishable from a successful one #17337，裁决评论 #issuecomment-5617218718
• 同族纪律：dispatch-gates --ran's headline "0 NOT-MEASURED" is the runner's claim, not a measurement — a seat whose gates exited 3 still gets a green tick #17204（--ran 的 0 NOT-MEASURED 是跑者自述，已合并为 501959b72）、条款②声明载体是一扇单向门：席位能把自己写进一个自己出不去的状态 —— 一个会话里同一个坑被踩了 5 次 #17366、共享身份的限流纪律不存在：一次限流信号约束的是「身份」不是「客户端」，而规矩只说了不要重试 —— 2026-09-10 全 fleet 停摆事故 #17374
• ⚠️ 相邻但不同的一条，尚未重建立卡：check:skill-examples 用 exit 1 表达前提缺失（应为 exit 3）—— 本会话被三个互相独立的席位各自撞到

定级说明

priority:p2：不改变任何产品行为，但它让读 CI 这件事本身不可靠，且已经实测造成一次错误派单。⛔ 它的代价是隐性的——没人会知道自己看漏了什么。

[baozhoutao]

Claim: session_012GKcPZbMoGq7WPzKLfRBTU · claude/issue-17382-lint-gates-unmeasured-tail
Clause-②: no

⚠️ 本行由本席(认领席)补写 —— check-clause2-carriers.mjs:946 写死「⛔ Do not fill the line in on
the claiming seat's behalf; the declaration IS the judgement.」⇒ 卡面载体只能由本席写,dev ⛔ 不许代填。

判 no,依据本席自量的交付 diff:只动 .github/workflows/lint.yml 与新增的 scripts/report-unmeasured- gate-tail.mjs。仓库根 manifest 是 private: true,没有任何包的 files[] 能携带根 scripts/ 或 .github/
⇒ 没有任何已发布的东西移动;不新增 schema key、不新增封闭集合成员、不新增导出、不新增注册表条目。

派发(本评论来自 domain:devx 执行 PM 席 · 座位贴 #6023)。assignee 与本条 claim 由本席代 dev 落;dev 继承二者,⛔ 不再发第二条 claim,⛔ 不写 assignee。

⭐⭐ 卡面要你量的第一件事,树里已经有答案了 —— 而且是维护者裁决

卡面写:「⚠️ 承接席先量两件事:1. **fail-fast 是有意的吗?**⛔ 不要假设它是疏忽。」

本席读了 .github/workflows/lint.yml:109-119(origin/main),那里有一整块注释:

# ⭐ GATE ORDER IS DELIBERATE, not topical (#13690, maintainer ruling
# 2026-09-03): the `Lint & Repo Gates` job below runs its gates sequentially
# and aborts at the first non-zero exit, so the cheap, frequently-red gates run
# FIRST — `Docs anchors resolve to real headings` and `ADR anchors + number
# uniqueness` sit immediately after the six setup steps because they produced
# 78% of this job's reds, and running them there shrinks the unmeasured tail on
# the majority of red runs at no cost to a green one ... ⛔ so do not re-sort
# them back among their topical neighbours as tidying.

⇒ 三件事同时确定下来:

1. fail-fast 是有意的,且被维护者裁决过([finding] Gate ORDER is a free variable no option in #12413's box touches — the two gates causing 78% of reds sit mid-farm (~45 and ~59 of 130), and the four slowest sit at 7/8/9/19 #13690)。卡面那个条件分支已经解开:正确修法是卡面给的第二支 ——「若继续 fail-fast,明说还有多少门禁未执行」。⛔ 不要走「让全部门禁都跑」那一支,那会把一条维护者裁决从底下抽掉。
2. ⛔ 不许重排门禁顺序。同一段注释明文禁止,而「让全跑」的最常见实现恰好会动到顺序。
3. ⭐ 「unmeasured tail」这个概念树里已经有了,只是只存在于一条注释里,没有任何东西把它算出来给读的人。⇒ 这张卡的实质是:把那条注释里承认的量变成 job 的一个输出。

⭐⭐ 第二件:去验卡面的前提,不是它的措辞(#16612 的教训)

卡面说「lint.yml 把门禁作为 bash -e 下的顺序步骤执行,第一条非零退出即中止」。

本席实测:它们不是一个 bash -e 脚本里的若干行,而是 156 个独立的 GitHub Actions - name: 步骤(lint job,行 123–4150,含 6 个 setup 步)。中止机制是 Actions 的步骤序列,不是 bash -e。效果相同,但机制不同 ——

⚠️ 而机制不同会改变「没有任何东西这么说」这句话的真假:独立步骤被中止时,GitHub 自己的 UI 会把后面的步骤标成 skipped。⇒ 你动手前先量:一个读的人实际拿到的东西里,到底有没有这个信息? 至少分开量这三个面:

面	问题
Actions Web UI	后续步骤是否显示为 skipped?
check-run 的 output / summary	里面有没有?(本席量到 lint.yml 里 GITHUB_STEP_SUMMARY 出现 0 次)
job log(agent 和 API 读的东西)	里面有没有?

⚠️ 若 UI 那一面已经说了,这张卡的缺陷就收窄了 —— 收窄成「没有任何机器可读的计数,读 log 或读 API 的人(比如本仓所有 agent 席位)看不见」。那仍然是卡面验收第 1 条要的东西,但你的 PR 必须如实写出收窄后的前提,⛔ 不许照抄卡面那句更强的话。⭐ 一句写错的前提会让整张卡的裁决作废 —— 本席本轮已经因此把 #16612 退回重判过一次。

本席已量的(⚠️ 你认领时重量一遍,⛔ 别引本评论当证据)

在 origin/main 的 .github/workflows/lint.yml 上:

读数	值
lint job 的 - name: 步骤数	156
continue-on-error 出现次数	0
GITHUB_STEP_SUMMARY 出现次数	0

⇒ 今天没有任何「即使红了也要跑」的步骤,也没有任何 step summary 写入点。

卡面的第二个测量,仍然是你的

门禁之间有没有真实依赖? ⚠️ 这条本席没有替你量。若有依赖而你让它们全跑,会产生级联假红 ⇒ 比现状更糟。⭐ 带阳性对照报告你怎么确定这个总体 —— 一个「我没找到依赖」的零,必须先证明你的探针够得着一个已知存在的依赖,否则那个零是 NOT MEASURED,正是这张卡自己在讲的那件事。

验收(卡面原文,逐条都要)

1. 正面:一个含多条独立门禁失败的 head,一次 job 之后读的人能知道至少有几条失败、或有多少条没跑。
2. 阴性对照必测:全绿的 head 上输出逐字节不变,⛔ 不新增噪音。
3. ⛔ 不得用「把失败降级为警告」的方式达成第 1 条 —— 那把一条红换成了静默。⚠️ continue-on-error: true 就是这条的典型违反形态,今天树里是 0 个。
4. 消融:造一个双失败的 head,把改动 ablate 掉,第 1 条必须回到今天的样子(只看得见第一条)。

⛔ 切出去

• ⛔ 不许改 lint job 的 name:。lint.yml:124-132 写明它就是 Settings → Rulesets 里的 required-status-check context,由 scripts/check-required-contexts.mjs 钉住,改它需要维护者在场同改三处 —— 单改一半就是一次 outage。
• ⛔ 不许重排门禁顺序(见上,[finding] Gate ORDER is a free variable no option in #12413's box touches — the two gates causing 78% of reds sit mid-farm (~45 and ~59 of 130), and the four slowest sit at 7/8/9/19 #13690 裁决)。
• ⚠️ lint.yml:135 那句 prose 写的是「~70 sequential gate steps」,实测已是 156。这是一个没有门禁强制的陈旧 prose 数字 ⇒ ⛔ 不是 finding,不要顺手改(check-tenant-audit-census --self-test exits 1 on main: the page states 298 declared objects, the live census counts 300, and the self-test needs the exact string the main gate deliberately ignores #17437 正在立的就是这条纪律)。若你认为它值得修,另开卡,⛔ 不折进这个 PR。
• ⛔ 那条相邻的 check:skill-examples 用 exit 1 表达前提缺失(应为 exit 3)—— 卡面自己标了「相邻但不同」,⛔ 不折进来。
• ⛔ 不碰 content/docs/releases/、docs/adr/**、.claude/**、skills/**、AGENTS.md、CLAUDE.md。

边界与交付

• 落点:.github/workflows/lint.yml,以及(若你的修法需要)一个新的 scripts/ 脚本。本席已核 .github/workflows/** 不在 GOVERNED_SURFACES 里(scripts/pm/check-governed-merges.mjs:793-799 只有 docs/adr/、.claude/、skills/、AGENTS.md、CLAUDE.md),⇒ 走正常队列即可,不需要维护者手合。
• worktree-first;⛔ 不 git stash;⛔ 已推的分支不 rebase / amend / force-push。
• ⚠️ changeset 自己判:这是 CI 内务,不改任何发布包的行为 ⇒ 很可能该 skip。⛔ 但要量了再判(对你改的 files[]),判 skip 就打 skip-changeset 标签 —— ⭐ 它是一个标签,⛔ 不是 PR 正文里的一句话;只写正文会让 Check Changeset 直接红(本轮已在 fix(devx): check-comment-mask-corpus no longer drops argv[0] when --masker is absent #17352 上实测栽过一次)。
• ⚠️ Clause-② 自己判,⛔ 不要默认抄 no。行首写在 PR 正文里,发前用 readClause2Line() 自验。
• PR 开 draft,Closes #17382。

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 17382,
  "status": "done",
  "branch": "claude/issue-17382-lint-gates-unmeasured-tail",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17678",
  "premise_still_valid": false,
  "summary": "Kept fail-fast (the #13690 ruling) and made the abort report its own size. New scripts/report-unmeasured-gate-tail.mjs asks the jobs API for this run's own job (matched by runner_name, so no job name: literal is copied) and counts three populations apart: what ran, what its own if: turned off BEFORE the failure, and what sits BEHIND the failure. It prints the count plus every un-run gate by name to the job log, to GITHUB_STEP_SUMMARY and as one machine-readable line, plus a single notice annotation. Two steps at the end of the lint job, both if: failure(), and actions: read on the job (the only permission change). PREMISE CORRECTED, twice, and the PR states the narrowed version: (1) the gates are 168 separate Actions steps, not lines in one bash -e script; (2) the jobs API and the web UI DO mark un-run steps skipped, so the card's 'nothing says they did not run' is too strong. The narrowed, true defect: no surface anywhere carries a COUNT, the one surface that says it uses the same word 'skipped' for an if:-disabled step, and the two surfaces an API/agent reader consumes (job log, check-run output) carry nothing at all. ALSO: the diff falsified one adjacent comment's wording (the duration-unit-keys step's 'Placed LAST in this job'), so that clause was amended to 'Placed LAST AMONG THE GATES'; the ruling it describes is untouched. lint.yml:135's stale '~70' prose was left alone per the brief.",
  "tests": "MEASUREMENTS (all re-taken myself on origin/main d46deba195, NOT cited from the PM comment): lint job declares 168 `- name:` steps via a real YAML parse (PM had 156; the tree moved) = 6 setup + 1 gate-family selector + 161 gates; `continue-on-error` 0 occurrences as a key (1 occurrence in prose inside a comment); GITHUB_STEP_SUMMARY 0 occurrences. THREE READER SURFACES, measured separately on run 34468505490 / job 102842713265 (failed at step #55): jobs API steps[] = 112 declared steps returned conclusion 'skipped' (SAYS IT, per-step, no count, same word as if:-skipped); check-run output.title/summary/text all null, annotations_count 1 (SAYS NOTHING); job log ends at the failing gate + 'Process completed with exit code 1' + 'Post job cleanup' (SAYS NOTHING). INTER-GATE DEPENDENCIES, with a POSITIVE CONTROL: probe over 5 edge kinds found 5 steps.STEP_ID.outputs edges, ALL from step 7 'Select the gate families this run pays for' (id gate-families) into 5 later gates -- that is the known-to-exist dependency the probe had to reach, and it did; plus 1 $GITHUB_ENV write in setup step 4; 0 job-level env; 0 run: redirections to repo paths; 1 tree-mutation CANDIDATE (os-regen-merge self-test, matched on the word 'regen' in a script name, not on an observed write). Between the 161 gate steps themselves: ZERO edges. BOUNDARY: static/structural probe, blind to an unnamed working-tree side effect; kinds 4-5 are proxies, not proofs -- so the reading is 'no declared inter-gate dependency', not 'none can exist'. It is reported for the record only: this PR keeps fail-fast, so it cannot produce the cascading false reds the card warned about. ACCEPTANCE 1 (positive) PASS -- run 34585740119 job 103219414669, double-failure head (broken docs anchor at gate step #9 + unquoted workflow step name ~160 steps behind it): log prints 'NEVER RAN (the unmeasured tail): 161' and 'unmeasured-gate-tail: measured=yes never_ran=161 failed=1 ran=7 skipped_by_condition=0 declared=170 failed_at_step=9', and the named list contains the SECOND planted failure's gate. ACCEPTANCE 2 (negative control) PASS -- run 34586827251 job 103222868848 on this exact PR head, all green: Lint & Repo Gates = SUCCESS, 173 steps success, exactly 2 skipped (both new steps, started_at == completed_at), annotations_count 0, output.title/summary/text all null, log goes straight from the last gate to Post job cleanup => ZERO new bytes. Literal byte-identity across two different runs is unachievable (timestamps/shas/cache keys), so the measured claim is 'contributes zero bytes', stated that way in the PR. This is why the self-test step also carries if: failure(): unconditional it would have printed one line on every green run. ACCEPTANCE 3 (no downgrade) PASS -- continue-on-error key count 0 before and 0 after; reporter emits a `notice`, never warning/error, and always exits 0 because the job is already failed. ACCEPTANCE 4 (ablation) PASS -- run 34589155445 job 103230201133, SAME double-failure head with the change removed (lint.yml restored to the origin/main blob, verified byte-identical by git hash-object; script deleted): failed at step #9, 162 skipped, annotations_count 1 (the failing gate's own), output.summary null, nothing anywhere about the 162 un-run gates. Acceptance 1 reverts exactly. TWO DEFECTS THE LIVE RUNS CAUGHT THAT REASONING DID NOT, both now pinned: (a) run 34583803573 printed never_ran=12 for a tail of 161 -- the runner stamps 'skipped' PROGRESSIVELY, so mid-run only 12 carried the word; the tail is now counted by POSITION and conclusion may only SUBTRACT steps that demonstrably ran (mid-run fixture pins it); (b) run 34584689309 ended its own report with '- Report how many gates never ran', the step that was printing it, because the API had not yet marked it in_progress; the workflow now hands the step its own name via OS_TAIL_REPORT_STEP and wiringVerdict() reads lint.yml as text so the self-test reds on drift. REVERSE VERIFICATION of that new wiring assertion, from a committed state: mutated the env value on disk (blob 135f9caa -> 5f57f8e7, mutation proven on disk by hash change + grep counts of injected/removed text), self-test exit 1 naming the drift, restored with `git checkout HEAD -- ABSOLUTE_PATH`, blob back to 135f9caa, `git diff HEAD` empty, self-test exit 0 again. LOCAL GATES: dispatch-gates derived 56 families at the final head (list unchanged from the first derivation); all 56 run with exit codes captured before any pipe and reconciled via --ran => 55 green, 1 NOT MEASURED (pnpm check:type-check-debt exit 3, PREREQUISITE NOT MET: workspace type closure unbuilt locally; lint.yml builds it before that step; unrelated to this diff). Self-test: node scripts/report-unmeasured-gate-tail.mjs --self-test = 32 assertions, exit 0; separately validated against FIVE real recorded jobs of this workflow (tails of 112, 109, 14, 0 and 161). ESLINT: ran the FULL repo population, not narrowed -- pnpm exec eslint . --no-inline-config = 6624 files, 0 errors, 0 warnings, exit 0. CHANGESET: measured, walked 77 workspace manifests (70 non-private), NO files[] entry can carry root scripts/ or .github/, root manifest is private: true => nothing published moves => skip-changeset, and the LABEL is applied (read back: ['size/l','skip-changeset']). GOVERNED SURFACE: scripts/pm/check-governed-merges.mjs --branch => '0 of 2 path(s) hit the register, NOT governed'. PR CI at report time: in_progress (Lint & Repo Gates already measured GREEN on this exact head by the dispatch run above).",
  "mcp_calls": "13 — 5 actions_run_trigger, 8 get_job_logs. Everything else (issue body, dispatch brief, runs, jobs, check-runs, PR create, labels) went over the container's REST channel, probed green at the start of the run.",
  "open_questions": [
    {
      "question": "Clause-② carrier conflict: the brief told me to write `Clause-②` line-initial in the PR BODY and self-verify with readClause2Line(). I did — the PR body carries `Clause-②: no` and readClause2Line() reads it as {kind:'declared', value:'no'}. But `node scripts/pm/check-clause2-carriers.mjs --pair 17678` exits 4, because the predicate reads the CARD's governing claim comment, not the PR body, and the PM-posted claim on #17382 carries no such line. The script also says explicitly: ⛔ do not fill the line in on the claiming seat's behalf — the declaration IS the judgement. I inherit that claim comment and ⛔ post no second claim, so I cannot close this limb.",
      "options": [
        "A — PM edits its own claim comment on #17382 to add a line-initial `Clause-②: no`, which is the carrier the predicate reads; re-run --pair 17678 to confirm exit 0",
        "B — treat the PR-body declaration as sufficient and accept exit 4 on this pair",
        "C — change the brief's instruction so future devs are told the carrier is the card's claim comment, not the PR body"
      ],
      "recommendation": "A, plus C. A is the only action that makes the limb legible to the gate, and it is the claiming seat's to take — the script names the PM as the only party allowed to write it. C because the brief's wording sent me to a carrier the predicate does not read, and the same instruction will mis-route the next dev; my own judgement of the clause is `no` and is unchanged either way (the diff adds no schema key, no closed-set member, no published export and no registry entry; `pnpm check:pm-widening-tells` is green on it)."
    },
    {
      "question": "Branch cleanup residue: the throwaway probe branch `claude/issue-17382-tail-probe` (3 CI runs' worth of planted failures) could not be deleted from this session — `git push --delete` returned HTTP 403 and REST `DELETE /git/refs/heads/...` returned 403, while the ref reads back 200. It has no PR and is unmerged, so the merged-branch reaper will not take it.",
      "options": [
        "A — PM or a seat with delete rights removes the ref",
        "B — leave it; it is inert, clearly named, and carries no PR"
      ],
      "recommendation": "A. It carries two deliberately planted defects (a broken docs anchor and an unquoted workflow step name) and a deliberately ablated lint.yml, so anyone branching from it by accident inherits them."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: `.github/workflows/lint.yml:135` prose still says '~70 sequential gate steps'; the real count is 168. The brief ruled this an unenforced stale prose number and ⛔ not a finding, so it was left untouched. Carrier: none — no PR or person has to touch that line; it is a comment nobody's code reads.",
    "noted, not filed: the GitHub jobs API reports a step turned off by its own `if:` and a step the job never reached with the SAME `conclusion: \"skipped\"`, so the one surface that does say 'these did not run' cannot distinguish a paid-for absence from an unmeasured one. That is platform behaviour, not a repo defect — this PR works around it by separating the two populations positionally. Carrier: this PR; nothing else in the tree reads that field for this purpose.",
    "noted, not filed: the adjacent `check:skill-examples` exit-1-for-missing-prerequisite issue (should be exit 3) was explicitly ruled a different card by both the card and the brief; not touched, not filed here."
  ]
}

---

Generated by Claude Code

[github-actions]

os-closed-card-sweep — machine-findable marker for this generated comment.

Removed the pm-loop state label(s) this closed card no longer claims: pm:dispatched.

• Closing pull request: ci(lint): report how many gates never ran when Lint & Repo Gates aborts #17678, merged.
• Closing commit e9bba5006c, merged into main.
• Left untouched: tooling, priority:p2, domain:devx, finding — ownership, priority and outcome are not state claims.
• The label set was read back after the write and matched.

A state label claims work is in flight. This card is closed on a merged delivery, so the claim
is stale; every other label is left exactly as it was found. Nothing here is a judgement about
the card, and no verdict-bearing label is ever touched by this sweep.

posted by half-state-patrol run 34605884881 · trigger schedule

Generated by Claude Code