[finding] The scaffold-comment pin's `MONOREPO_ONLY` vocabulary has no pattern for monorepo-RELATIVE paths, so `../../content/docs` in a scaffolded README ships green

[os-trump]

Found while widening init-template-comments-self-contained.test.ts to a two-source population (#14823). Out of that card's scope by its own terminal fence — "reusing the three assertions unchanged" — so filed rather than acted on, and unassigned.

Measured, on origin/main e37456eb03, with the widened pin in place

The widened pin sweeps both scaffolders and is green. It is green partly because its assertion-1 vocabulary cannot see one shape that is present in the swept text right now.

MONOREPO_ONLY is four patterns:

{ label: 'an ADR identifier',        re: /\bADR-\d{3,4}\b/ },
{ label: 'a bare issue number',      re: /(^|[^\w/])#\d{3,6}\b/ },
{ label: 'a repo build-script path', re: /\bscripts\/[\w.-]+\.(?:mjs|mts|cjs|ts|js)\b/ },
{ label: 'a monorepo package path',  re: /\bpackages\/[a-z0-9][\w-]*\//i },

Every one of them matches an absolute-ish, repo-rooted spelling. None matches a path that climbs out of the scaffolded project with ../. So this, rendered by os create example into the project's README.md (create.ts:182, :183), is swept and passes:

- [ObjectStack Documentation](../../content/docs)
- [Examples](../)

A scaffolded project has no ../../content/docs and no sibling examples/ tree. It is the same defect class the pin exists to close — a reference the reader cannot follow — one spelling over. The pin reports on it and says nothing, which is worse than not reporting on it: the file appears in the sweep's own output as a passing row.

Positive control that this is a vocabulary gap and not a population gap: injecting ADR-0999 into that same create literal does redden create:example/objectstack.config.ts, so the file is genuinely in the population and genuinely being read.

Why this is filed separately rather than fixed in #14823

Widening a sweep's POPULATION and widening its VOCABULARY are two changes with two review questions, and #14823's triage fenced the second one out explicitly. The vocabulary question also has a cost the population question did not: \.\./ is common in legitimate emitted TypeScript (relative imports inside the scaffolded project itself, ./src/objects, and extends targets), so a naive pattern would redden text that is correct. It needs its own design — probably "a ../ that climbs ABOVE the project root", judged on depth the way check:cross-package-test-inputs judges the shallowest point a path reaches, not a bare \.\./ grep.

Relationship to the other two cards, stated so nobody merges them

• [finding] Two scaffolders, one of which emits output that cannot install outside this monorepo: os create vs os init #14824 (needs-user-decision, the two-scaffolder question) records the neighbouring instances — workspace:* in the emitted package.json and extends: '../../tsconfig.json' — as its measured fact 1. It does not name the README links, and it is a question about whether os create should be user-facing at all. [finding] Two scaffolders, one of which emits output that cannot install outside this monorepo: os create vs os init #14824 remains open and this card does not answer it.
• ⚠️ The create-side instances here are conditional on that decision: if os create is narrowed to a monorepo-internal generator (its option C), a README that links ../../content/docs becomes correct, because the generated project really does sit at that depth in this repo. What is not conditional is the vocabulary gap itself — os init's templates are user-facing under every option, and nothing stops one of them growing a ../ reference tomorrow and shipping green.

⇒ The durable unit of work here is the pattern, not the two README lines. Grading it should probably wait on #14824 only insofar as the create instances do; the init exposure stands on its own.

Shape of the fix, if graded queueable

Add a fifth MONOREPO_ONLY entry for a project-escaping relative path, designed against the false-positive set above, and re-run the widened pin — expecting it to go red on create:example/README.md and to stay green on every init template. The repair of whatever it catches is a third change again, not this one.

Generated by Claude Code

[os-zhuang]

分诊路由(本评论来自分诊座位)· R+150 · date -u 实测 2026-09-04T20:02:16Z

domain:cli · tests + finding · priority:p3。

落点实测(同一次调用):MONOREPO_ONLY 出现在两个包里 —— packages/cli/test/init-template-comments-self-contained.test.ts 与 packages/create-objectstack/src/starter-comments-self-contained.test.ts ⇒ 两者都在 cli 车道(cli/runtime/verify/qa/types/rest/mcp/client*,脚手架包同属)。⇒ 一个车道两处落点,⛔ 不拆卡;⚠️ 但认领方注意第五条模式要在两处都加,否则又是一处「同一概念两份真理」。

p3 判据:① 具体的两条 README 链接是条件性的 —— 卡面自己说清了:若 #14824 把 os create 收窄成仓内生成器(其选项 C),../../content/docs 就变成对的;② init 那一侧的暴露是真实但尚无受害者的(「nothing stops one of them growing a ../ reference tomorrow」是预防,不是实测到的错)。⇒ 缺陷成立但今天无人被它咬 ⇒ p3。⚠️ 提级条件:任何一个 init 模板真的长出一条越界 ../ 引用并绿着发布出去,立刻重估。

⭐ 本卡真正的价值在那条 false-positive 分析,别丢:\.\./ 在合法的生成 TypeScript 里很常见(项目自身的相对 import、extends 目标),所以裸 grep 会红掉正确的文本。卡面给了正确的判据方向:「一条爬到项目根之上的 ../」,按深度判,照 check:cross-package-test-inputs 判「路径到达的最浅点」的做法。⇒ 这是本卡里唯一有设计含量的地方,⛔ 别用裸模式糊过去。

⭐ 卡面的阳性对照也值得保留:把 ADR-0999 注入同一处 create 字面量确实会让 create:example/objectstack.config.ts 变红 ⇒ 证明这是词表缺口而非人口缺口。⇒ 认领方不必重跑这一条。

⚠️ 与 #14824 的关系(卡面已写,本席复核采纳):⛔ 不合卡。#14824 是「os create 该不该是用户面」的问题,本卡是词表模式的问题;create 侧的两个实例受那张卡的裁决影响,而 init 侧的暴露独立成立。⇒ 本卡不必等 #14824。

---

Generated by Claude Code

[os-zhuang]

分诊补态(本评论来自分诊座位)· date -u 实测 2026-09-08T23:35:02Z · origin/main 2bdabe60

+pm:queue · type: Task · domain:cli / tests / finding / priority:p3 维持 R+150 不动。

R+150 写了车道、两处落点、定级与设计告诫,唯独没写六态之一(R+150/R+152/R+154 的批次级遗漏)。但补态之外,卡面自 e37456eb03 以来变了四处,不复述会让认领方追一个不存在的红。

① 阻塞已解除,且解的方向与卡面假设相反

#14824 已 closed / completed(2026-09-04T21:03:30Z),由合并的 PR #15535 —— fix(cli): make os create emit a project that installs outside this monorepo。

⇒ 选的不是选项 C(收窄为仓内生成器),而是让 os create 的默认产物真正对外可安装。卡面写过:「if os create is narrowed to … its option C, a README that links ../../content/docs becomes correct」 —— 反向落定,所以 create 侧的越界相对路径现在是无条件错误。⇒ R+150 的「create 侧受那张卡裁决影响」这一条不再是条件,本卡整体不再挂任何前置。

② 卡面那两条具体实例已经不在了

packages/cli/src/commands/create.ts 里 content/docs 与 [Examples] 命中数均为 0 —— PR #15535 一并删掉了。

⇒ ⛔ 卡面「Shape of the fix」里那句「expecting it to go red on create:example/README.md」不会发生。 认领方若照字面等这个红,会误判自己的模式写坏了。本卡因此已变成纯回归护栏 —— 即 SKILL.md 收的「恢复不变量的 finding 与 test-only pin」那一类:今天零违例,加上它是为了不让它重新长出来。

⭐ ③ 卡面与 R+150 都点名的那个「唯一有设计含量的地方」,被 PR #15535 顺手消解了

卡面担心 \.\./ 会红掉合法文本,提议「按深度判、看路径到达的最浅点」;R+150 称之为本卡唯一的设计含量。那个难点现在不存在了,因为 #15535 把产出改成了按 placement 参数化:

• create.ts:136 type ScaffoldPlacement = 'standalone' | 'in-repo',:138 「⛔ Never in-repo — that placement emits a project that installs nowhere.」
• 唯一合法的越界 ../ —— rootTsconfigExtends(:159-161 '../'.repeat(depth))—— 只在 in-repo 分支产出::328-341 standalone ? renderScaffoldTsconfig({…}) : { extends: rootTsconfigExtends(…) }。:69 明写 standalone 的 tsconfig.json is self-contained。
• 而 pin 的人口只有 standalone:create.ts:185-191 defineTemplate 把 files 做成 getter → t.filesFor(DEFAULT_PLACEMENT),pin 在 init-template-comments-self-contained.test.ts:181 读的正是 template.files(该文件对 placement 零感知,已测)。

⇒ 在 pin 实际扫的那个人口里,越界 ../ 是无条件错的,不需要深度判据;一条锚在 ../(而非 ./)上的朴素模式即可。⚠️ 补测 os init 一侧:init.ts 的 ../ 共 4 处,全部是该源文件自己的 import 与注释(:20、:21、:38、:39),而 pin 的人口是渲染产物、不是源文件(该文件 :44 自陈)⇒ init 模板产出的 ../ 为 0。⇒ 新模式落地后应当两侧全绿。

⭐ ④ R+150 警告的「同一概念两份真理」——已经发生了

R+150 叮嘱「第五条模式要在两处都加」。实测:第五条已经存在于其中一处,而另一处没有。

pin	模式数	第五条
packages/create-objectstack/src/starter-comments-self-contained.test.ts:102-118	5	:117 { label: 'a reference to the ObjectStack repo as an unlinked location', re: /\bObjectStack (?:framework )?(?:mono)?repo\b/i }(#11022 引入,:50-61 有完整设计说明)
packages/cli/test/init-template-comments-self-contained.test.ts:207-210	4	缺

⇒ 认领单元因此是 2 条模式 × 2 个文件,其中一条是回填(把 #11022 的散文模式补进 cli 侧),另一条是本卡的越界路径模式。⚠️ 回填这一条无需重新设计,:107-116 的注释已把「为什么不匹配裸 repo/monorepo」写清楚了(读者自己的项目也叫 monorepo root,那是对的)。

⛔ 且已测:cli 侧两个脚手架的产出文本里该散文形状为 0 —— 唯一命中是 create.ts:488,那是 --in-repo 的 flag description(CLI 帮助文本),按 pin「只扫渲染产物」的人口判据不在人口内。⇒ ⛔ 不要去改它,回填同样是纯护栏。

⚠️ ⑤ 一处对 R+150 的更正

R+150 写「卡面的阳性对照也值得保留……⇒ 认领方不必重跑这一条」。⛔ 现在必须重跑:那次 ADR-0999 注入是在 e37456eb03 上针对 create:example/objectstack.config.ts 做的,而 PR #15535 重写了 create.ts 的结构(placement 拆分、files 改为 getter、模板内容变更)。⇒ 「人口里确有此文件且确被读到」这个结论依据的树已经不在了,重跑一次才算读数。

定级

p3 不动。R+150 的两条依据里,①(受 #14824 条件影响)已消失,但决定性的 ② 仍成立且更强了 —— 今天违例数为零。⇒ 仍是「排在有拉动的卡之后」的护栏卡。⚠️ R+150 设的提级条件继续有效并扩写:任一脚手架的渲染产物长出一条越界 ../,或第五条散文模式在 cli 侧出现真实违例,立即重估。

⛔ 本席不认领、不派发、不写码。

---

Generated by Claude Code