Published ./testing exports on metadata-core and service-cluster advertise a require condition vitest structurally refuses — repair the exports shape

[os-zhuang]

Enumerated by objectstack#12971's class sweep (its PR body carries the detail): @objectstack/metadata-core#./testing and @objectstack/service-cluster#./testing re-export vitest, whose CJS entry throws by design ('Vitest cannot be imported in a CommonJS module using require()') — so both published require conditions can never load. Pre-existing (declared at b489d3c, before the import.meta line). The repair is a published-exports change: stop advertising a require condition the subpath cannot honour (ESM-only exports for the testing subpaths, or whatever the repo's exports conventions prescribe). ⚠️ The check:dual-build-cjs-loads baseline (scripts/dual-build-cjs-loads.baseline.json) declares both with reasons and is SHRINK-ONLY — the fixing PR must delete those entries in the same change or the gate reds. Clause-② likely YES (published exports surface) — contract-tier dispatch when taken.

[os-litant]

围栏读数 — 尚不可派发,阻塞方是 #12984(不是 #11336)

domain:cli 执行 PM 席位(#6024)。围栏在 2026-08-28T12:42:18Z 于 origin/main=2b4178aa5 重新推导,取全部 29 个开放 PR 的完整变更文件并集(692 行,未截断)。

本卡需要动的三个文件的持有情况:

文件	持有者
packages/metadata-core/package.json	#11336
packages/services/service-cluster/package.json	#11336
scripts/dual-build-cjs-loads.baseline.json	#12984

阳性对照已打:packages/cli/src/commands/secret/orphans.ts 正确返回 #12990。扫描是活的,以上不是死扫描的假读数。

#11336 不构成串行持有 —— 记下来,免得下一个席位重犯

#11336 是 changesets 机器人常驻的 chore: version packages(分支 changeset-release/main,作者 github-actions[bot]),每次 main 推进都会自动重算重生。它对全部 77 个 package.json 的持有是版本号 bump,不是任何人著作的形状,也不会停在那里等谁合并。

按同文件硬串行去读它,后果是:只要发布 PR 开着,任何触碰任一 package.json 的卡都永远不可派发 —— 这显然不是该规则想要的。同文件硬串行防的是两个 agent 各自落下冲突的著作形状;机器人重算的版本号不属于这一类。

⇒ 常驻规则:changeset-release/main 上的机器人发布 PR 永不计入串行持有。 我自己第一次推导时把它算了进去,是错的。

真正的阻塞是 #12984

#12984(hotlong,claude/issue-12971-metadata-core-cjs-import-meta)持有 scripts/dual-build-cjs-loads.baseline.json,而本卡的验收判据恰恰要求在同一次改动里删掉该 baseline 的两条条目,否则 check:dual-build-cjs-loads(SHRINK-ONLY)会红。也就是说这不是一个"碰巧同文件"的冲突,而是两个 PR 争夺同一条判据线。

而且 #12984 正是枚举出本卡的那次 class sweep(#12971)的同族 PR,标题里写着 gate the class —— 它极可能已经在处理或改变这条 baseline 的形状。在它落地前派发本卡,做出来的 PR 会在 No other open PR may claim the same single-writer path 这项 CI 上直接红。

结论:本卡保持 pm:queue 未认领,串行等待 #12984 合并。 释放条件是合并,不是它被 arm。#12984 一落地我就重新推导围栏并派发。

Clause-②: yes(publish 出去的 exports 面)。按新规,needs:contract-review 在草稿 PR 存在的那一刻附加,现在不预先贴。

---

Generated by Claude Code

[os-litant]

认领 — domain:cli 执行 PM 席位

• session: session_01UjujZN219uFzBhSYfMykCd
• 分支: claude/issue-12985-testing-exports-esm-only
• Clause-②: yes(published exports 面)。按新规,needs:contract-review 在草稿 PR 存在的那一刻附加,现在不预贴。

围栏已释放 —— 重新推导,不是沿用

上一条评论我判本卡阻塞于 #12984。#12984 已于 2026-08-28T12:56Z 合并(15d55fb24),释放条件是合并且已发生。

围栏在 2026-08-28T12:58:01Z 于 origin/main=15d55fb24 重新推导(26 个开放 PR,678 行完整并集,未截断):

文件	持有者
scripts/dual-build-cjs-loads.baseline.json	FREE(#12984 已落地)
packages/metadata-core/tsup.config.ts	FREE
packages/services/service-cluster/tsup.config.ts	FREE
packages/metadata-core/package.json	仅 #11336
packages/services/service-cluster/package.json	仅 #11336

阳性对照:packages/cli/src/commands/secret/orphans.ts 正确返回 #12990 —— 活扫描。

#11336 是 changesets 机器人常驻的 chore: version packages,按本席位并入 Ruling ① 的规则不构成串行持有(理由见上一条评论)。

对树复核的两点,派发据此收紧

#12984 是 baseline 的创建者,不是修改者。 它新增了 scripts/check-dual-build-cjs-loads.mjs(779 行)、baseline 本身、CI 接线和 tsup.config.ts。所以本卡不是"改一条既有豁免",而是兑现 #12984 在 reason 里明写的那个 repair,并删掉它留下的两条豁免。两条 reason 都点名说 the real repair is at the manifest ... belongs to its own card —— 就是本卡。

两个 ./testing 当前形状(origin/main 实测,完全相同):

"./testing": { "types": "./dist/testing.d.ts", "import": "./dist/testing.js", "require": "./dist/testing.cjs" }

⛔ baseline 是 SHRINK-ONLY,且其 $comment 明写「An entry that starts loading must be DELETED in the same PR that fixes it — the gate reds on a stale exemption」。⇒ 修 exports 与删两条 entry 必须在同一个 PR 里,少任何一半都红。

⚠️ 另外注意该 $comment 的一句:「Its steady state is NOT empty — read the reasons, never the count」。所以不要把"baseline 变空"当成验收判据,要按名删这两条、保留其余。

---

Generated by Claude Code

[os-litant]

os-dev-report

{
  "issue": 12985,
  "status": "done",
  "branch": "claude/issue-12985-testing-exports-esm-only",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/13001",
  "premise_still_valid": true,
  "summary": "Premise confirmed by direct measurement before any edit: node -e \"require('[pkg]/dist/testing.cjs')\" exits 1 with \"Error: Vitest cannot be imported in a CommonJS module using require()\" for BOTH packages, while node --check on the same two files exits 0 — bytes parse, load dies inside vitest, exactly as the card and the ledger reasons state. Both ./testing subpaths are now ESM-only ({types, import}, no require), copying the repo's one existing ESM-only subpath create-objectstack#./created-summary rather than inventing a shape (enumerated over all 74 manifests under packages/; it is the only precedent, and these two were the only testing-ish subpaths in the tree). The two named entries were deleted from scripts/dual-build-cjs-loads.baseline.json in the same commit; the $comment and every other entry are untouched (there were no others — 'entries' now reads {}, reported as a fact about this tree, NOT used as an acceptance criterion, per the $comment's own warning). A minor changeset for both packages carries the FROM -> TO. CONFLICT WITH THE CARD, measured not assumed: the dispatch said 'only fix exports, do not delete the entries => RED'. Ablation B measured GREEN (exit 0). check-dual-build-cjs-loads reconciles the ledger in ONE direction only — staleLedger fires for a ledgered id still in the collected population that now LOADS; an id that has LEFT the population (which is exactly what a manifest-level repair produces) is never consulted, and is not even listed as a 'declared:' hit. A PR that fixed the exports and forgot the ledger deletion would have shipped two stale exemptions all green. This does not change the delivery — deleting them is correct either way and this PR does it — but it is a real gap in the gate, reported below as an unfiled finding. MEASUREMENT 1 (dist/testing.cjs still needed?): DECISION = keep emitting it, not deleted. Both tsup configs declare format ['esm','cjs'] for both entries, so it keeps being emitted; after this change nothing in either manifest points at it and neither package exports ./dist/*, so it is unreachable — dead weight, but pruning it needs per-entry formats, i.e. splitting each defineConfig into an array of two while both configs also set clean:true AND splitting:true (the second config would wipe the first's output and break index/testing chunk sharing). It is also not inert where it is: both packages still have a require entry at '.', so dist/testing.cjs stays under the gate's PARSES sweep. No gate objects — check:published-files asks that the files whitelist COVERS every declared entry point (a removal can never violate that). MEASUREMENT 2 (real require() consumers?): NONE, in this repo and in the pinned sibling. CHANNEL DEVIATION to declare: the container REST channel is dead in this session — curl to api.github.com returns 'GitHub access is not enabled for this session', and scripts/pm/check-half-states.mjs independently measured GITHUB_TOKEN as the proxy placeholder (len 14, no GitHub prefix, GET /rate_limit -> HTTP 401 with the token, HTTP 200 without). So all GitHub work here went through MCP, not REST as the standing discipline prefers.",
  "tests": "All at HEAD 68fb6915f (git rev-parse --short HEAD), clean tree (git status --porcelain = 0 lines), union run after the final and only commit. BUILD: bash scripts/pm/os-verify-lock.sh -c 'NODE_OPTIONS=--max-old-space-size=4096 pnpm build --concurrency=2' -> 'Tasks: 71 successful, 71 total'; wrapper 'VERDICT command-exit 0 · held the lock 544s'. GATE (the card's criterion line) BEFORE the change: '✓ check:dual-build-cjs-loads — 105 published require entry point(s) across 67 package(s) load; 618 emitted CommonJS file(s) parse; 1 cross-format behaviour probe(s) agree; 2 declared non-loadable entr(ies) still justified.' AFTER: '✓ check:dual-build-cjs-loads — 103 published require entry point(s) across 67 package(s) load; 613 emitted CommonJS file(s) parse; 1 cross-format behaviour probe(s) agree.' plus '✓ check-dual-build-cjs-loads self-test: 37 cases pass'. The deltas reconcile exactly: 2 rows removed, and cjsFileCount sums per row, so metadata-core's 3 CJS files and service-cluster's 2 leave the sum once each (618-5=613). GATE FAMILIES: derived with 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' AFTER the final commit (change set: 4 paths vs merge base 15d55fb24). All 32 derived families run, each exit code captured by redirecting to a file BEFORE any pipe. 31 exit 0. Verdict lines quoted from the gates themselves: '✓ check:published-files — 69 publishable package(s) of 78 workspace member(s) declare a files whitelist that covers every entry point plus CHANGELOG.md ...'; 'check-type-source-resolution OK — 94 tsc program(s) across 77 packages scanned'; 'check-test-source-alias OK — 72 packages with tests scanned; ... 45 published subpath(s) resolved through every alias table'; '✓ check-adr-0087-registration: this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen).'; '✓ This diff introduces no major bump.'; '✓ No empty-frontmatter changeset introduced by this diff (1 declaring changeset(s) added).'; '✓ .changeset/config.json \"fixed\" group is in sync with 69 public workspace packages.'; '✓ 9 published-manifest declaration(s) covered by pnpm-workspace.yaml overrides all resolve to their override targets.'; 'check-nul-bytes: OK (scanned 7203 text file(s) -- 7202 tracked, 1 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).' NOT MEASURED (1 of 32): scripts/pm/check-half-states.mjs exits 3 = 'PREREQUISITE NOT MET — the token in the environment is not a valid GitHub credential'; its own text: 'Nothing was swept: no issue was listed, no predicate (H1-H16) ran ... this result says NOTHING about whether the board carries half-states.' Read as NOT MEASURED, not as red and not as green. It is a PM board sweep matched only via the .changeset glob and is unrelated to this diff. TESTS (serialised through scripts/pm/os-verify-lock.sh): own suites — metadata-core 'Test Files 14 passed (14) / Tests 234 passed (234)', service-cluster 'Test Files 4 passed (4) / Tests 66 passed (66)'. Every in-repo consumer of the changed subpaths, targeted at the importing files (pnpm --filter [pkg] exec vitest run --maxWorkers=2 [files], never through a bare --): metadata-fs 31, metadata-protocol 48, rest 123 (3 files), runtime 85, service-cluster-redis 28 = 315 passed, 0 failed, EXIT=0 on each. TYPECHECK: pnpm --filter (metadata-core, metadata-fs, rest, runtime, service-cluster-redis) typecheck -> 'Scope: 5 of 79 workspace projects', each echoed its script name and printed Done (so no pnpm-filter zero-match silent green), including 'check:test-typecheck: OK — @objectstack/rest's test layer compiles under packages/rest/tsconfig.test.json'. ABLATION A (required; predicted direction RED): re-add the require conditions to both manifests with the ledger left empty. The mutated surface is a file the gate reads DIRECTLY from the working tree (manifestPaths() walks packages/**/package.json; readLedger() reads the baseline) — no source is compiled into dist/ on this path, so no rebuild sits between mutation and verdict; dist/ was built once, in full (71/71), before every measurement. Mutation proved on disk, not by an editor exit code: injected-anchor-count=1 and bare-import-line-count=0 per file, plus worktree blob != HEAD blob — and the two mutated blobs came out byte-identical to the pre-fix origin/main blobs (bfa5047705cf1e76534103bff9be4e099096270b, 00b7469ab793c735bfc6cf1216bb38f365034558), so the ablation reconstructed the old manifests exactly. Result: ABLATION_A_GATE_EXIT=1, '✗ check:dual-build-cjs-loads — 2 finding(s) across 105 published require entry point(s)', both naming 'require(./dist/testing.cjs) FAILED — Error: Vitest cannot be imported in a CommonJS module using require().' RESTORE leg: trap '[restore]' EXIT INT TERM with absolute paths seeded from git rev-parse --show-toplevel, restoring with 'git checkout HEAD -- [abs]' (never a bare git checkout --), proved by worktree blob == HEAD blob for both files AND 'git diff HEAD' = 0 lines AND 'git status --porcelain' = 0 lines — never by an exit code. ABLATION B (claim check, predicted GREEN from reading the gate; measured GREEN): restore the two ledger entries with the exports fix in place. Mutation proved on disk (entry-key counts 1 and 1, empty-entries count 0, worktree blob 18606b5f2f210b3c61c2eccacd4cce8cf01281a5 != HEAD 46929bddbeb48692a591bbca8da7cec01f2c8375; the gate's own readLedger view printed [\"@objectstack/metadata-core#./testing\",\"@objectstack/service-cluster#./testing\"]). Result: ABLATION_B_GATE_EXIT=0, GREEN. Restore proved the same way (blob equality, git diff HEAD = 0 lines, status = 0 lines). DISCLOSED NO-OP: the FIRST attempt at leg B aborted with 'FATAL: mutation did NOT land on disk' and measured nothing — my anchor grep -c expected 1 but the id appears twice in the restored file, the second time inside the sibling entry's reason prose. The guard was wrong, not the mutation; the anchor was tightened to the entry-key line and the leg re-run. Recorded rather than quietly re-run. DECLARED NARROWING — repo-wide 'pnpm lint' (eslint . --no-inline-config) was NOT run locally; this is a measured narrowing, not a skip, and all three pieces of evidence are present. (1) Population read from eslint's own config, not guessed: every files: block in eslint.config.mjs is scoped to **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} or narrower; no block matches .json or .md. (2) File count read from --format json: eslint over exactly the 4 changed paths reports 4 results, errorCount=0 on each, every one carrying 'File ignored because no matching configuration was supplied.' (3) Invariance for untouched files: type-aware linting is not enabled here — eslint.config.mjs line 328 states 'no parserOptions.project, no typed @typescript-eslint rules' — so this diff cannot move a verdict on a file it does not contain, and it contains no linted file at all. CI runs the full farm regardless. STALE-TREE NOTE: dispatch-gates.mjs warned that origin/main advanced 8 commits (15d55fb24 -> d028b37cb) mid-run and that 3 files the derivation reads changed. Effect on this answer proved zero rather than assumed: .github/workflows/lint.yml is the only one of 28 workflow files that changed and changed 0 non-comment lines (no gate step added, removed or renamed); scripts/pm/dispatch-gates.mjs gained 0 non-comment lines (62 added, all comment); scripts/engine-double-contract.pinned.json is the ledger of a family whose source did not change and which none of these 4 paths matches. The 4 changed paths are also disjoint from all 30 files in that range, so no conflict. SIBLING PIN (AGENTS.md Workflow rule 4): objectui cloned and checked out at the pinned .objectui-sha 190fbd01d0615e2e168faf9e08b8ad7844bc039d — 0 hits for either ./testing subpath and 0 hits for @objectstack/(metadata-core|service-cluster) at all; positive control on the same scan, '@objectstack/spec', returns 35. The Console Pin Gate cannot see this removal. objectstack-ai/cloud could NOT be scanned: add_repo returned 'you don't have access to objectstack-ai/cloud' — NOT MEASURED there, bounded by the structural argument that no WORKING CJS consumer can exist at all, since the load fails inside vitest for every caller and every code path. CONSUMER SCAN (grep -r over the working tree, a filesystem walk so untracked files are included; deliberately NOT git grep): @objectstack/metadata-core/testing = 11 hits (8 import statements, 3 CHANGELOG/doc prose); @objectstack/service-cluster/testing = 2 hits (1 import, 1 docstring); a require( call naming metadata-core or service-cluster = 3 hits, all three prose ABOUT this defect (this gate's header and #12984's changeset); 'testing.cjs' = 2 hits, the two manifest lines this PR removes. Zero require() call sites. Positive control on the same command shape, with a term in no substring relation to the tested ones (a require( call naming any @objectstack/ specifier): 22 hits, so the scan is live rather than silently empty.",
  "open_questions": [
    {
      "question": "Bump level for a published-exports REMOVAL that removes nothing that ever worked: I chose `minor` on both packages. Both are in the .changeset `fixed` group, so the level moves the whole 69-package lockstep line, and the removal is 'breaking-ish' only in the formal sense — no working consumer can exist, because the require condition always died inside vitest.",
      "options": [
        "A — minor (what I shipped): signals 'the published exports map changed, go look', matches the repo's launch-window convention of spelling breaking-ish removals as minor (check-changeset-no-major.mjs pushes breaking to minor outside pre-mode), and is not disproportionate since 154 of the 372 pending changesets are already minor. Not declared BREAKING (no `**BREAKING` marker, no conventional-commit `!`), so check-adr-0087-registration correctly skipped it — verified green.",
        "B — patch: reads it as a pure defect repair, which is defensible since the condition never resolved to working code and the sibling repair #12984 shipped as patch. Cheaper signal, but a consumer diffing exports maps between two patch releases gets no warning."
      ],
      "recommendation": "A (minor), because the artefact that actually changed is the published exports map and a consumer's BUILD can notice even though no runtime ever could: a bundler resolving under the `require` condition currently finds dist/testing.cjs and bundles it (the throw is a runtime event, not a resolution one), and after this change gets a resolution error at build time. That is the one visible, non-hypothetical difference, and minor is the cheapest honest way to flag it. Flipping to patch is a one-word edit to .changeset/testing-subpath-exports-esm-only.md if you disagree — nothing else in the PR depends on it."
    }
  ],
  "out_of_scope_findings": [
    "NOT FILED (dedup channel unavailable — see reason below): check-dual-build-cjs-loads reconciles its SHRINK-ONLY ledger in one direction only. scan() pushes staleLedger ONLY for a row that is still in the collected population and now loads (scripts/check-dual-build-cjs-loads.mjs line ~503); there is no check that every id in scripts/dual-build-cjs-loads.baseline.json still appears among the collected rows. So an exemption whose subpath stopped declaring a `require` condition becomes invisible dead text and the gate stays green — which is exactly the shape the ledger's own two reasons prescribed as 'the real repair ... at the manifest'. MEASURED, not inferred: with the exports fixed and both entries restored, the gate exits 0 and does not even list them as 'declared:' hits (ablation B above). The gate's header also claims 'The ledger reconciles in both directions', so the text and the code disagree. Suggested repair: after the rows are collected, red on any ledger key not in the row-id set, with a --self-test case pinning it. Concrete defect, so NO label — leave it for PM triage. This PR does delete the two entries, so nothing is stale on main today; the gap is what would let the NEXT one through.",
    "NOT FILED (same reason): after this PR, packages/metadata-core/dist/testing.cjs (28 KB + 48 KB map + testing.d.cts) and packages/services/service-cluster/dist/testing.cjs (12 KB + 14 KB map + testing.d.cts) are emitted, packed by the `files: [\"dist\"]` whitelist and shipped to npm, but unreachable through the manifest — no exports condition points at them and neither package exports ./dist/*. Measured and decided in this PR rather than assumed (see the PR body), and deliberately NOT pruned here: pruning needs per-entry tsup formats, i.e. splitting each defineConfig into an array of two while both configs set clean:true AND splitting:true, so config two would wipe config one's output and break index/testing chunk sharing. Observation class (dead artefact, no behaviour is wrong) => this one wants the `finding` label and no pm:queue.",
    "WHY NEITHER IS FILED — the mandatory 'search before filing' step could not be performed, and filing blind is exactly what that rule forbids: (a) container REST is dead in this session — curl https://api.github.com/repos/objectstack-ai/objectstack/issues/12985 returns 'GitHub access is not enabled for this session. An org admin must connect the Claude GitHub App for this organization.', and scripts/pm/check-half-states.mjs independently measured GITHUB_TOKEN as a 14-char proxy placeholder with no GitHub prefix (GET /rate_limit -> 401 with it, 200 without); (b) the MCP fallback is rate-limited — both mcp__github__search_issues and mcp__github__list_issues return 'API rate limit already exceeded for user ID 314681334'. Writes still work (this PR and this comment went through MCP), so the block is on the dedup READ only. Both findings are written above in full so they can be filed in one paste from a seat with a working read channel."
  ]
}

---

Generated by Claude Code