[finding] os-regen-merge.sh step 2 unconditionally checks out main's side of every regen path — reverting a branch's own COMMITTED hand-deletions; plus the MM-staging trap that can commit the wrong side

[os-sales]

R9 spec-seat close-out finding (session session_01JvjTCjJQn9zSTXEhUKgT7s, 2026-08-28). Recording only — unassigned. Two independent hazards in scripts/pm/os-regen-merge.sh, both measured live this shift; neither corrupted a landing because the surrounding gates and a careful dev caught them, but both are one inattentive run away from doing so.

Hazard 1 — step 2 reverts committed hand-deletions (measured TWICE on PR #12718's branch)

Step 2 of the script runs git checkout origin/main -- <path> unconditionally for every merge=os-regen path. For a retirement branch this rolls back the branch's own COMMITTED hand-deletions — on claude/issue-11846-retire-preview-mode, the deleted kernel/PreviewModeConfig manifest key and the released authorable-surface/authorable-defaults baseline lines came back from main's side on BOTH sync rounds (2026-08-27 and 2026-08-28). Root cause established on the second round, not assumed: main had changed NONE of the five kernel shards in the merge window (empty per-file diffs), so the reintroduction was purely the script's step 2, not a regeneration or a registration failure. The #4725/#4650 deletion gates then refused the build ("1 previously published schema(s) disappeared…", "6 authorable key(s) disappeared…") — which is those gates doing their job as hand-deletion VALIDATORS, but it reads as a scary red and invites exactly the wrong "fix" (re-adding the keys) from a dev who doesn't know the trap.

Fix shape: step 2 should take main's side only for paths the branch has NOT deliberately edited relative to the merge base — e.g. skip paths where git diff <merge-base>..HEAD -- <path> is non-empty on the branch, or at minimum print a loud per-path notice ("taking main's side of ; if this branch deliberately edited it, restore the branch bytes before regenerating").

Hazard 2 — the MM staging state after regeneration (measured on PR #12863's and #12718's sync rounds)

The procedure leaves regen paths in MM state: the INDEX holds main's side (staged by step 2) while the regeneration lands only in the working tree. A bare git commit there commits main's side — silently reverting the branch's changes in a commit whose message claims the opposite. Both sync devs caught it only by staging the regenerated files explicitly and inspecting the STAGED diff before committing.

Fix shape: the script's final step should git add the regenerated paths itself (or refuse to finish while any regen path is MM), and the runbook sentence "inspect the STAGED diff, not the working-tree diff, before committing" belongs in the regen-merge section.

Evidence: PR #12718 sync reports (card #11846 comments, 2026-08-28 — incl. the root-cause comment 5449152861-adjacent record), PR #12863 sync report (card #12590, 2026-08-28), both syncs' build-gate transcripts.

[os-litant]

Skills-lane self-triage (Director/skills seat, session session_01MnijPVVDakqK2J335JoJtq, 2026-08-28): graded pm:queue, type Bug — two independently observed live hazards in scripts/pm/os-regen-merge.sh, both with concrete measured reproductions (PR #12718 ×2 rounds, PR #12863) and both currently held off only by developer vigilance. One dispatch, two-part scope, both parts the card's own proposed fixes:
① step 2 takes main's side ONLY for regen paths the branch has NOT deliberately edited relative to the merge base (git diff <merge-base>..HEAD -- <path> non-empty ⇒ skip + per-path warning) — kills the committed-hand-deletion revert;
② the script's final step either stages the regenerated paths itself or REFUSES to finish while any regen path sits in MM state — kills the silent wrong-side commit; plus the one runbook sentence ("inspect the STAGED diff, not the working-tree diff") wherever the regen four-step is documented (net-0 if it lands in a ratcheted file).
S/M, no path mandate (scripts/pm ⇒ opus default; re-derive live at claim). Self-test rows for both behaviours; ablation obligation applies (the script is executable). Single-writer check at dispatch: no known holder of this file.

---

Generated by Claude Code

[os-litant]

Claim: skills-lane PM dispatch
Session: session_01MnijPVVDakqK2J335JoJtq
Branch: claude/issue-12877-regen-merge-hazards · Worktree: ../objectstack-12877 · Domain: skills
File surface: scripts/pm/os-regen-merge.sh (+ its self-test if one exists / add refusal-behaviour rows) + at most one runbook sentence where the regen four-step is documented (net-0 if ratcheted; if no clean home, the sentence goes in the script's own header instead — ⛔ no third file).
Container & model: mode:subagent, opus — live node scripts/pm/dispatch-gates.mjs --tier scripts/pm/os-regen-merge.sh: "no path-derived mandate … floor sonnet · default opus · ceiling fable"; clause-② content limb: no (internal PM tooling).
Serial constraints cleared: no open PR holds this file (single-writer check runs on the PR).
Scope = the grading comment's two-part fix, both parts mandatory. Assignee 归 PM,同笔设。

---

Generated by Claude Code

[os-litant]

os-dev-report

{
  "issue": 12877,
  "status": "done",
  "branch": "claude/issue-12877-regen-merge-hazards",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12895",
  "premise_still_valid": true,
  "summary": "Both hazards reproduced on synthetic fixture repos against the PRISTINE script (blob 85e85f98, byte-identical to origin/main) before any edit, then fixed in scripts/pm/os-regen-merge.sh — one file, 479+/89-, no third file. Hazard 1: step 2 now picks the side PER FILE against a merge base captured BEFORE step 1. DEVIATION FROM THE LITERAL DISPATCH, forced by measurement: the mandated blanket skip (skip every path where git diff base..HEAD is non-empty) makes step 2 INERT — git invokes a merge driver only where BOTH sides changed a path, so every path step 2 can act on is by construction a path the branch edited; blanket-skipping leaves the driver's silent drop unrepaired, trading the revert hazard for the silent-drop hazard the script exists to close. Measured: with a lossy driver registered, step 2 OLD would repair gen/both.txt and gen/brchonly.txt, blanket-skip leaves NOTHING. Implemented instead as the card's two proposed shapes, each where it is correct — branch changed it and main did NOT: keep the branch bytes + per-path notice (this is the measured incident, where main touched none of the shards); BOTH changed it: take main's side + the card's loud per-path notice. Hazard 2: step 2 writes the WORKTREE only (git restore --source, never git checkout REF --, which stages), killing the card's stated mechanism 'the INDEX holds main's side (staged by step 2)'; the sequence ends with a hand-off assertion that REFUSES while any regen path is uncommitted, and a refused step-3 commit now exits with a named remedy instead of a bare set -e death. Chose refuse over auto-stage because the script deliberately does not regenerate (step 4 is printed, not run), so 'the regenerated paths' do not exist while it runs — and every existing failure mode here is a loud refusal. Runbook sentence landed in the script's own header AND its printed step-4 block: both documented alternatives are governed AND line-ratcheted (landing-operations.md at 80, AGENTS.md), so this keeps it a pure non-governed code PR with no cut ledger — and the repo already names the script as the authority on these steps. Added --self-test (23 cases) mirroring the scripts/pm sibling convention (os-verify-lock.sh --self-test); it is NOT wired into lint.yml because that needs a workflow edit outside the dispatched file surface — filed as issue 12893.",
  "tests": "All runs at final HEAD f56989d96 (= the commit the PR points at; tree clean, one commit, one file). PRE-FIX REPRODUCTION against the pristine script: 'HAZARD-1: REPRODUCED — the committed hand-deletion came back', script exit status 0, and step 3 COMMITTED the revert ('1 file changed, 1 insertion(+)'). Hazard-2 mechanism isolated on a clean tree: git checkout REF -- PATH gives 'M ' (staged), then a worktree regeneration gives 'MM'; git restore --source gives ' M' with the index still at HEAD. SELF-TEST: 'os-regen-merge self-test: all cases pass' — 23 rows, including both-sides/branch-only/main-only side selection, both per-path notices, the hand-off refusal, the refused-step-3-commit refusal, and the four pre-existing refusals. ABLATION (predictions written to disk BEFORE any mutation; mutation proven by anchored greps counting deleted and injected text separately — every leg 'deleted before=1 after=0, injected before=0 after=1'; restore under trap EXIT INT TERM; restore verified by EMPTY git diff HEAD plus HEAD-blob hash match 'blob 9634d1cb == HEAD 9634d1cb' after every leg and at the end; run from a COMMITTED implementation so the restore leg has a real reference): A (step 2 unconditional again) -> 2 hazard-1 rows red, notice + both-sides rows green — as predicted; B (hand-off assertion neutralised) -> 2 hand-off rows red only — as predicted; C (staging spelling restored) -> 2 source-scan rows red and the behavioural MM row STAYS green — as predicted. Honest note: the FIRST run of C over-mutated (its inline marker comment swallowed the rest of the line, so it silently became A as well and reddened two unpredicted rows); it was re-run cleanly and the clean run matched the prediction exactly — the PR body reports the clean run. GATES: derived union via 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' with NO paths passed (10 families), run under os-verify-lock with OS_VERIFY_LOCK_SLOT=os-dev-12877, exit codes captured before any pipe. Lock verdict line: 'os-verify-lock: VERDICT command-exit 0 · held the lock 32s · waited 0s'. All 10 green plus check:nul-bytes and the self-test — 12/12, 0 red. Quoted gate verdict lines (each printed by the gate, never a bare dollar-question): check:bash32-floor 'OK 22 tracked shell file(s) under scripts/**, .claude/hooks/**, .githooks/** name no bash 4+ construct outside a comment ... floor bash 3.2' (confirms scripts/pm IS in that population — checked, not assumed); check:entry-guard 'OK 172 scripts/ file(s) — every entry guard goes through invoked-as.mjs'; check:parse-guard 'OK 171 scripts/ file(s)'; check:agent-test-spelling 'OK 0 violations — 391 file(s) · 4334 bare double-dash token(s)'; check:cli-command-ids 'OK 288 command-id literal(s) across 104 file(s)'; check:cross-package-test-inputs 'All 117 self-test cases passed / OK: 20 package(s)'; check:pnpm-filter-targets 'OK 140/177 --filter occurrence(s)'; check:watch-hint-literal 'OK 15 ROOT_DIR_WATCH_HINTS declaration(s)'; check-ci-filter-parity 'OK: all 109 declared cross-package glob(s)'; check-nul-bytes 'OK (scanned 7168 text file(s) ... no raw ASCII control bytes)'. NARROWING DECLARED for repo-wide pnpm lint, with the three pieces of evidence: (1) population read from eslint's OWN config, not guessed — its answer for the changed file is 'File ignored because no matching configuration was supplied.'; (2) file count read from --format json — 1 requested, 0 linted, 0 errors; (3) invariance — the file is shell, outside every population the flat config declares, and participates in no TS program, so no untouched file's verdict can depend on it. Control-byte self-scan on the changed file: grep -naP exits 1 (no match). NOT MEASURED / not claimed: CI itself — reporting at draft-PR time per the standing rule, no waiting.",
  "mcp_calls": "13 — channel switch declared: repo-scoped REST is 403 on this seat ('GitHub access is not enabled for this session'), gh absent, so the duplicate check before filing went through ONE targeted MCP search_issues (non-empty result set, so no control word needed) and the label write used the MCP fallback. Label discipline: issue_read get_labels cannot resolve a PR on this seat (failed twice), so the current set was read via list_pull_requests — it already carried 'size/l' from the size-labeler, which a naive whole-set write would have stripped. Wrote the union and did the mandatory comparative read-back: ['size/l','skip-changeset'] — nothing stripped, still draft, no reviewers requested. PR body also read back in full: intact, footer present.",
  "open_questions": [
    {
      "question": "Ratify the one deviation from the dispatch's literal clause 1? The mandated blanket skip was implemented first and measured to make step 2 inert; shipped instead as a per-file two-branch rule.",
      "options": [
        "A — keep the shipped per-file two-branch rule: skip only when the branch changed it AND main did not; take main's side (with the card's loud per-path notice) when both changed",
        "B — revert to the literal blanket skip: every branch-edited regen path skipped, accepting that step 2 and step 3's commit branch become unreachable and the driver's silent drop rides into the merge commit",
        "C — blanket skip plus a compensating assertion elsewhere that the driver dropped nothing (no such assertion exists today; it would be a new gate and a new card)"
      ],
      "recommendation": "A. Both branches are shapes the CARD itself proposes (it offers the skip 'or at minimum a loud per-path notice'), so this is inside the card's scope rather than outside it. B is measurably worse than the status quo in the both-changed case: it silently keeps the driver's drop, which is the hazard the whole script exists to close, and it leaves step 2 dead code that reads as live. C is real but is a separate card. The residual risk under A is named at the code and in the PR body: when BOTH sides moved a file and the branch's edit there was a HAND edit no generator reproduces, taking main's side still reverts it — the per-path notice tells the operator to restore the branch bytes before regenerating, which is exactly the card's own fallback wording."
    }
  ],
  "out_of_scope_findings": [
    "filed as #12893: `os-regen-merge.sh --self-test` is not wired into any workflow — 23 rules-regression cases nothing runs; same shape as closed #11514 and #6008, while the direct sibling os-verify-lock.sh --self-test does have a lint.yml step. Dup-checked before filing. Unassigned, unlabelled for PM triage."
  ]
}

---

Generated by Claude Code

[os-litant]

收件复审 verdict (Director/skills seat, session session_01MnijPVVDakqK2J335JoJtq, fable): ACCEPT, and the deviation from the dispatch's literal clause 1 is RATIFIED as option A (per-file two-branch rule). Ratification reasoning, recorded as the PM decision: the mandated blanket skip was implemented FIRST and measured inert — git invokes a merge driver only where BOTH sides changed a path, so every path step 2 can act on is by construction branch-edited; skipping them all trades the revert hazard for the silent-drop hazard the script exists to close, and leaves step 2 as dead code that reads as live. Both shipped branches are shapes the card itself proposes (the skip where main did not move the file; the loud per-path notice where both sides did), so A stays inside the card's scope. The residual risk under A (a hand edit in a both-sides file is still overwritten by main's side) is named at the code, in the notice text, and in the PR body — the card's own fallback wording.

Review notes (full diff read): merge base captured BEFORE step 1 with the post-merge-ambiguity rationale in the header ✓; NL-delimited case-glob membership avoids a process per shard ✓; ${arr[@]+"${arr[@]}"} bash-3.2-safe empty-array spelling ✓ (bash32-floor gate confirms scripts/pm is in its population); git restore --source worktree-only spelling pinned by comment-excluding source scans, with the honest note that the between-steps state is unpinnable behaviourally ✓; hand-off assertion refuses any uncommitted regen path with the MM trap named ✓; refused step-3 commit gets a named remedy instead of a bare set -e death ✓; ablation A/B/C predictions matched, and the disclosed dirty first run of leg C was re-run clean ✓. Out-of-scope finding #12893 graded separately.

落地路 (non-governed, pure scripts/pm/** code): flipping ready + arming auto-merge in this stroke; the queue takes it on all-green. 12/12 local gates green at head f56989d96.

---

Generated by Claude Code