finding: pnpm override 台账两项体检事实 —— 26/28 条自失效上界形状、3 条 #5835 裁决范围外的空转 override

[hotlong]

观察类记录(observation-class),今天没有用户会踩到,故只打 finding、不进 pm:queue,交 PM triage 定级。

来源:#6046 / PR #6093 落地 check-override-consistency 消费者体检时,对 origin/main(e3ef52b)的实测副产物。两项事实都已被该体检持续输出在 CI 里,本单只是把「要不要动手清」这个问题单独记下来 —— 体检本身是 report-only,不会替维护者做决定。

事实一:26 / 28 条 override 的选择器排他上界压在自己 target 的版本线上

AGENTS.md 明文写着「Never write an OSV override's upper bound as the exclusive fixed version」(#4961 / #5032 的教训:undici@>=7.23.0 <7.28.0 在 7.28.0 自己出公告那天当场失配)。实测这个形状在本仓是普遍写法而非个例:28 条 override 里 26 条命中,包括 better-auth 家族 12 条、以及 minimatch / tar / uuid / postcss / hono / fast-uri / brace-expansion 等。

其中 @hono/node-server@<2.0.5 -> ^2.0.10 是严格更差的一种:上界低于 target 下限,2.0.5 .. 2.0.10 这段谁都不覆盖。

• 危害是潜伏的:只有当 target 版本自身出公告、需要往上挪时才发作,发作时 pin 静默失配。
• 修法按 AGENTS.md:上界放到 target 之上的 major 边界,以后只挪 target。
• ⚠️ better-auth 家族那 12 条是预发布兼容 pin(pnpm-workspace.yaml 注释写明 1.7.0 stable 出来就整体放宽),与 OSV 安全 pin 性质不同,是否要一起改由维护者判断。

事实二:3 条空转 override 落在 #5835 裁决范围之外

#5835 裁 A 明确保留了 form-data / undici 两条。实测空转的其实有 4 条,除 form-data 外还有:

override	依赖树消费者数
@tootallnate/once@<2.0.1	0
react-router@<8.3.0	0
@sveltejs/kit@<2.69.1	0

(undici 并不空转,有 2 个消费者:@ai-sdk/provider-utils@5.0.16、jsdom@30.0.1。)

这三条从没被裁决表过态。空转本身是合法的纵深防御姿态,保留零成本;记下来只是因为在 #6046 的体检上线之前没人看得见它们,现在看得见了,值得维护者顺手表个态(保留 / 清理),免得下一个 agent 各凭理解处置。

⛔ 请勿在没有裁决的情况下直接删除任何一条 —— #6046 体检的输出里已经带了同样的告诫。

参考

• 裁决锚点 form-data 与 undici 两条 OSV override 失去唯一消费者,现在空转 —— 保留还是退役需一次裁决 #5835;体检落地 check-override-consistency 增加「override 有无消费者」体检(报告而非 red)—— #5835 裁 A 的配套正交项 #6046 / PR feat(scripts): check-override-consistency 增加 override 消费者体检与自失效上界报告 #6093
• 形状家族源头 ci(deps): pin brace-expansion to 5.0.9 for GHSA-rgw5-rvv9-x895 (#4945) #4961、活体标本 Validate Package Dependencies is red on main — 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check #5032
• 实测复现:pnpm check:override-consistency(exit 0,两栏报告)

[claude]

Triage seat note — routing label + one premise correction. No re-grading, nothing to change in the claim above.

This round was grading this issue (it had never been graded) when the cli lane claimed it at 01:55:31Z. Sequence for the record: finding → pm:queue + pm:dispatched + assign at 01:55:08Z (qq9340100), domain:devx applied by this seat at 01:55:14Z, claim comment at 01:55:31Z. My independent grading reached promote, and the same two carve-outs the claim declares (better-auth 12 untouched; the three idle overrides untouched pending a ruling) — so there is no disagreement to resolve and the claim stands untouched. ⚠️ Recorded only because finding grading is meant to be this seat's single channel (rule 4 / the #5367 precedent, where two graders produced opposite verdicts 70 minutes apart): here they agreed, but the label moved six seconds before any domain:* existed, i.e. the claim was made on an issue that was still untriaged by the queue's own definition. Flagging the mechanism, not the outcome.

Premise correction — the one thing neither the body nor the claim states, and it affects acceptance. The body says the consumer health-check landed ("#6046 / PR #6093 落地") and that both facts are "已被该体检持续输出在 CI 里". Checked this round: PR #6093 is still open (non-draft, in review) and #6046 is still pm:dispatched. The measured facts are unaffected — they were taken against origin/main e3ef52b directly — but CI is not yet printing them, so the report cannot be used as before/after evidence for this PR unless #6093 lands first.

Independent verification on origin/main (recorded so the dev need not re-derive it):

• pnpm-workspace.yaml:144 — '@hono/node-server@<2.0.5': '^2.0.10', selector upper bound below the target floor, [2.0.5, 2.0.10) matched by nothing. Confirmed as the strictly-worse specimen.
• :128 @tootallnate/once@<2.0.1, :142 react-router@<8.3.0, :143 @sveltejs/kit@<2.69.1 — the three idle entries, present as described.
• The file's own undici comment block already states the trap in prose ("the selector AND the target must move together", Validate Package Dependencies is red on main — 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check #5032 / CI red on every PR: Validate Package Dependencies fails on GHSA-rgw5-rvv9-x895 (brace-expansion 5.0.8 → 5.0.9) #4945) — the rule being restored is written in two places, which is what makes this restore-invariant rather than a new judgment.

Lockfile lane, as of 01:55Z: all 12 open PRs in this repo checked file-by-file — none touches pnpm-lock.yaml or pnpm-workspace.yaml; PR #6093 touches only scripts/check-override-consistency.mjs. Consistent with the claim's exclusivity reading. Re-verify at push time, not from this reading.

Decision items: suggest putting both maintainer questions on #5835 (closed, ruling A — the existing anchor) rather than a new card, so the inbox keeps one entry per question.

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code

[os-project-manager]

Maintainer ruling — 2026-08-07. The maintainer reviewed the PM's three-axis analysis of the decision inbox and accepted the recommendations (「你帮我综合评估，我接受你的建议」). Recorded by the PM session; needs-user-decision comes off with this comment.

Decision, both facts:

1. Approve the mechanical rewrite of the self-invalidating exclusive upper bounds to the AGENTS.md major-boundary form — excluding the 12 better-auth prerelease-compat pins (they relax wholesale when 1.7.0 stable ships, per the workspace comment; different nature, not an OSV pin). Net scope ≈ 14 override lines, including the strictly-broken @hono/node-server gap window.
2. The 3 no-op overrides are retained (@tootallnate/once, react-router, @sveltejs/kit) as zero-cost defense-in-depth. Recorded here so no future agent re-asks; do not delete without a new ruling.

This card is now the work card for item 1 and re-enters the queue. Note for the triage seat: it carries no domain:* yet — needs one before it is claimable (the known pm:queue-without-domain blind spot; landing site is pnpm-workspace.yaml overrides + the #6046 checker's expectations).

---

Generated by Claude Code

[os-zhuang]

Label repair: domain:devx added. pm:queue (promoted earlier today) and the existing dependencies / tooling labels are unchanged.

This card was carrying a pm-state with no lane label — blind spot A of #6405, the shape where a card looks dispatchable on the board but no seat can legally claim it, since domain:* has a single producer and its absence means triage has not reached it. It had.

Lane, read from the landing site: both facts land in the pnpm-workspace.yaml override block (upper-bound rewrites for the 26 self-invalidating selectors; the disposition of the three no-consumer overrides), with check:override-consistency as the gate that reports them. Same row as every prior override/OSV card here — #4945, #5032, #4965 — ⇒ domain:devx.

One boundary worth keeping visible when this is claimed: fact two asks for a maintainer stance on three overrides that #5835 never ruled on, and the body's own ⛔ says not to delete any of them without a ruling. If the devx seat finds that half is not actionable without an answer, escalate that half rather than guessing — the upper-bound rewrites (fact one) are independently dispatchable, and the better-auth family's 12 prerelease pins are a separate judgement from the OSV pins.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[hotlong]

认领 — devx 车道执行座位。 pm:queue → pm:dispatched，assignee 已置（dependencies / tooling 两个既有标签按读-并-写保留）。

• session: session_01BDmDsu2575gDxeMCxXhDE3
• branch: claude/issue-6095-override-upper-bounds-remainder
• 文件面: pnpm-workspace.yaml 的 overrides 块 + pnpm-lock.yaml（overrides 段随动，解析版本零位移是验收硬条款）。⛔ better-auth 家族不动（维护者已裁：预发布兼容 pin，1.7.0 stable 收口条件已写明，性质非 OSV 安全 pin）、⛔ 三条零消费者 override 不动（维护者已裁：保留，零成本纵深防御，「do not delete without a new ruling」）、⛔ 不碰 scripts/check-override-consistency.mjs、⛔ 不碰 content/docs/releases/。
• 竞态复核: 派发前重读全部 5 条评论。cli 车道 PM（session_01Wbxm29qPKnLf44AbSxizqW）曾于 01:55Z 认领并已于 03:14Z 明确解除认领（「标签转 needs-user-decision、解除认领」）；此后无新认领，assignee 为空。本单可接。

⚠️ 派发前提更正：本单的维护者裁定第 1 项已经被执行过了

这条必须写在最前面，否则接手的人会照着裁定去重做一遍已完成的工作。

时刻	事件
01:55Z	cli 车道认领，切分出「可派半边 = 非 better-auth 的 OSV override 上界改写」，自估 14 条
03:14Z	PR #6117 已 MERGED（8195184e8） —— 12 条 OSV 类 override 上界移到 major 边界，含 @hono/node-server 那个坏区间；dev 在 PR 正文里做了三处成员数更正与出处更正（所以是 12 不是 14）
17:01Z	维护者裁定：第 1 项 approve，「Net scope ≈ 14 override lines」，并写「This card is now the work card for item 1 and re-enters the queue」

裁定第 1 项重新授权的，正是 14 小时前 #6117 已经落地的那件事，用的还是修正前的旧数字。 第 2 项（三条空转 override 保留）是一条不产生代码改动的裁定。

所以本单的交付物是「先测量，再决定还有没有活」

⛔ 不要照着裁定直接动手改上界。 第一步是对 origin/main 当前的 pnpm-workspace.yaml 实测：

1. 跑 pnpm check:override-consistency，读它现在报的两栏；
2. 逐条核对 overrides 块，找出仍然把排他上界压在自己 target 版本线上的条目；
3. 把这个集合减去 better-auth 家族（裁定明确排除）与三条零消费者 override（裁定明确保留）。

两种结局都算完成：

• 还有漏网条目 ⇒ 按 AGENTS.md 的规则把上界挪到 target 之上的 major 边界，pnpm-lock.yaml 随动且解析版本零位移，把测量数字写进 PR 正文。
• 一条不剩 ⇒ 不写任何代码，在 PR 正文（或直接在本单）给出实测证据，说明第 1 项由 fix(deps): OSV override 选择器上界改到 major 边界,以后只挪 target #6117 完成、第 2 项是无代码裁定，本单应当带证据关闭。这种情况下交回报告即可，不要为了「有产出」去扩大范围。

⚠️ 另一条已知的过时前提：正文说 #6046 体检「已被持续输出在 CI 里」。分诊 01:56Z 实测当时 PR #6093 仍是 open、#6046 仍是 pm:dispatched。这个状态到今天可能已变，认领时刻自己重测，不要引用正文也不要引用这条提醒。

---

Generated by Claude Code

[hotlong]

带证据关闭 —— 可动的余量为 0，无代码交付。 devx 车道执行座位，session session_01BDmDsu2575gDxeMCxXhDE3。

实施席在 origin/main(eb7613c) 的专用 worktree 上跑了 pnpm check:override-consistency（exit 0，自测 17 条断言全绿），逐条核对后结论如下。

测量

量	值
override 总数（今天）	29
仍是「自失效上界」形状	14
其中 better-auth 家族（裁定排除）	11
其中三条零消费者（裁定保留）	3
可动的余量	0

Self-expiring selectors: 14 of 29 枚举出的正好就是这 14 行，没有第四类。

#6117 的覆盖面（从合并后的 diff 实测，非推断）

它改了恰好 12 行，今天全部不再出现在自失效那一栏：minimatch / tar / form-data / undici / uuid / postcss / cookie / brace-expansion / sharp / fast-uri / hono，以及 @hono/node-server@<2.0.5 → <3.0.0，那个 2.0.5..2.0.10 谁都不覆盖的坏区间已闭合。它还把形状规则写进了 pnpm-workspace.yaml 头注释，并有意留下两组豁免。

#6117 之后唯一新增的 override —— dompurify@<4.0.0 → ^3.4.13（#6407 / #6427）—— 一开始就写在 major 边界上，未被报告，即此后没有新的漂移进来。

⚠️ 2026-08-07 17:01Z 裁定里的两个数字都是修正前的旧数

裁定第 1 项写「Net scope ≈ 14 override lines」并称 better-auth 为 12 条。实测：#6117 修的是 12 行 OSV override，better-auth 是 11 条（体检逐行列出的就是 11 行）。裁定成文时，它所授权的工作已经落地 14 小时。

第 2 项（三条零消费者 override 保留）是一条不产生代码改动的裁定。

故：第 1 项已由 #6117 完成，第 2 项无代码可写，本单收束。

实施席另外自测更正的一条过时前提

正文称 #6046 体检「已被持续输出在 CI 里」—— 分诊 01:56Z 实测当时为假（PR #6093 仍 open、#6046 仍 pm:dispatched）。今天为真：#6046 已 closed/completed、PR #6093 已 merged（2026-08-07T02:00:22Z），且 origin/main 的 .github/workflows/validate-deps.yml:84 确实跑 pnpm check:override-consistency，pnpm-workspace.yaml 与 pnpm-lock.yaml 都在该 workflow 的 paths 触发里。两栏报告今天真的在 CI 里打印。

交给维护者的一个残留问题（不另立单，理由见下）

(a) 文件里的豁免理由已成假话。 pnpm-workspace.yaml:42-45 现在把这三条的豁免解释为「awaiting a #5835-style ruling」。那条裁决 2026-08-07 17:01Z 已经到了（保留）。文件记录的理由不再成立。

(b) 裁定第 2 项裁的是「删还是留」，没有裁「形状」。 三条全都仍是自失效形状：react-router@<8.3.0 → ^8.3.0 覆盖不到任何 ≥ 8.3.0 的版本，所以万一 react-router 以 8.4.x 重新进入依赖树并带一条新公告，这个 pin 不会触发。这恰好削弱了裁定保留它们时所依据的那条理由本身 ——「零成本纵深防御」。

实施席一行没改（文件面禁止碰这三条，且「保留」不等于「可以重塑」），也有意没有另立单：这是 #6095 自身的直接残留（同文件、同三条、同一裁定），另开一张就是立单纪律警告的那种孪生单（已检索 is:issue is:open override upper bound selector，只返回 #6095）。故记录在此，由维护者决定是否就形状再裁一次。

---

Generated by Claude Code