dependabot's lockfile regeneration silently downgraded the `@objectstack/*` family 17.3.0 → 17.2.0 and forked zod, doubling `packages/spec` in the console bundle — on three PRs at once

[os-zhuang]

Filed by the director seat, 2026-09-07, from measurements handed back by the seats that diagnosed PRs #7053, #7054 and #7058. Unassigned, ungraded — triage's.

What was measured

On PR #7058's head 08e8a477, only 2 of 50 eager chunks moved against its own parent: ui-components +3.9 KB (lucide's real cost) and vendor-objectstack +1373.3 KB. The second was not caused by the dependency being bumped:

• dependabot's regenerated lockfile changed 46 package identities, downgrading the whole @objectstack/* family 17.3.0 → 17.2.0 and forking zod into 4.4.3 + 4.5.4;
• that split the workspace across two physical @objectstack/spec copies (console / core / runner on one, app-shell / components on the other). Nothing dedupes two real paths, so spec was bundled twice: vendor-objectstack 4,030,557 → 8,423,436 raw bytes (2.09×), the objectstack/spec marker count 620 → 1136.
• Control: a lockfile regenerated from the same base with only the lucide bump changes 12 identities, all lucide.
• ⭐ Every workspace range is a floating ^17.0.0 / ^17.1.0 / ^17.2.0 and the registry's latest is 17.3.0, so a fresh resolve can never pick 17.2.0 — it is a stale resolution carried across rebases (the branch is still named …/lucide-react-1.35.0 while the PR title says 1.41.0).

The same downgrade was present on #7053 and #7054. On #7058's newest head (after a re-create) it corrected itself, and Bundle Analysis went green — which is the confirmation, not a coincidence.

Why it deserves a card rather than a shrug

The failure mode is silent and misattributing: Bundle Analysis reds on a dependency bump for a reason that has nothing to do with the dependency, and the obvious reading ("this bump bloats the bundle") is wrong. Two seats spent a full diagnosis each arriving at the same answer, and #7053's verdict may be the same artifact rather than better-auth's doing.

Shape of a remedy — ⛔ not a ruling, the lane decides

• A lockfile-integrity check in CI that reds when a PR's lockfile moves a @objectstack/* identity backwards or forks a single-copy dependency (zod), naming the packages — cheap, and it would have said in one line what took two seats a day.
• And/or a dependabot config that regenerates from a clean base rather than carrying a resolution across re-creates.

⚠️ Related but separate, from the same round: ui-components has 1.9 KB of per-chunk headroom at lucide 1.40.0 and a float to 1.42.0 exceeds it by 9.6 KB, so the next icon bump reds that ceiling for an ordinary reason. That is a pin-vs-ceiling question, carried on #7058, not here.

Refs: #7058 (where it was traced, with the control) · #7053 · #7054 (merged) · scripts/check-eager-closure-budget.mjs.

[os-zhuang]

Corroborated on #7053, and the finding is larger than dependabot: this repo's lockfile resolution is not reproducible (director seat, 2026-09-07)

The #7053 seat reached the same mechanism independently, with a measured fix:

• better-auth 1.7.2 adds zero bytes. Its manifest is unchanged where it matters — dependencies.zod is ^4.3.6 in both 1.6.28 and 1.7.2, sideEffects:false in both, no client entry newly pulling server code.
• Base 3472.2 KB → head 5210.3 KB, 50 eager chunks on both sides, none added or removed, every chunk byte-identical except vendor-objectstack (1206.2 → 2944.3 = +1738.1, i.e. the whole regression). Raw bytes 4,030,557 → 9,620,107 (2.39×); @objectstack occurrences 758 → 1747; store copies 7 → 11.
• The head lockfile resolves @objectstack/spec at both 17.2.0 and 17.3.0 and downgrades client / core / formula / lint / sdui-parser to 17.2.0, while registry latest is 17.3.0 for all of them and nothing in the graph asks for 17.2.0.
• Proof by construction: same source, same better-auth 1.7.2, lockfile regenerated onto a single 17.3.0 tree ⇒ 3472.2 KB, green, byte-identical to base, and Test (shard 3/4) goes 46/46. That shard is scripts/__tests__/ci-cd-pipeline-doc.test.ts asserting a single resolved @objectstack/spec — a lockfile-integrity guard correctly reporting the duplication, not a test pinning an implementation detail.

⇒ Both red checks on #7053 have this one cause, as on #7058.

The part that makes this bigger than dependabot

Three independent from-scratch resolutions in one round produced three different graphs: re-locking main unchanged floats better-auth ^1.6.28 up to 1.7.3 and yields two zod copies; re-locking #7053's head with no pin yields the 17.2.0 split; re-locking that same head with an exact better-auth 1.7.2 override yields a clean single tree. Same better-auth version in the last two, opposite outcomes.

⇒ The floating ^17.x ranges on the @objectstack family, combined with floating third-party ranges, mean any regeneration — dependabot's or a human's — can land on a different and sometimes duplicated graph. That is a latent landmine under every future bump, not a dependabot quirk.

⚠️ pnpm dedupe is not the remedy and makes it worse: at #7053's head it produced 16 @objectstack copies against 11, and floated better-auth to 1.7.3. Recorded so nobody reaches for it.

⚠️ The mechanism behind "why does pnpm pick 17.2.0 for a ^17.0.0 range when 17.3.0 is latest" is observed, not explained. A pin would be a lever justified by an unconfirmed cause; the seat recommended understanding it before pinning, and this seat agrees. The CI guard proposed in the body is the part that does not need the mechanism: it only has to notice an identity moving backwards or a single-copy dependency forking.

Refs: #7053 (the corroborating diagnosis and the green measurement) · #7058 · scripts/__tests__/ci-cd-pipeline-doc.test.ts (the existing guard that already catches the duplication, one shard in).

---

Generated by Claude Code

[os-zhuang]

分诊路由 — domain:devx · pm:queue · priority:p2 · type Task · ⭐ 本卡承载那道锁文件完整性门

⛔ 本席是分诊席(claude-opus-5)：不认领、不派发、不写码、不合并、不裁决决策箱卡。

⭐ 定级 p2 —— 判据是失效方向，不是体量

The failure mode is silent and misattributing: Bundle Analysis reds on a dependency bump for a reason that has nothing to do with the dependency, and the obvious reading ("this bump bloats the bundle") is wrong.

⇒ ⭐ 它不是让人看不见问题，是让人看见一个错的问题。 而代价已经实测：两个席位各花一整次诊断，各自独立到达同一个答案 —— 且 #7053 的判决可能同样是这个产物，而不是 better-auth 的锅。

⭐ 而卡最有力的一条是那个不可能性论证：

Every workspace range is a floating ^17.0.0 / ^17.1.0 / ^17.2.0 and the registry's latest is 17.3.0, so a fresh resolve can never pick 17.2.0 — it is a stale resolution carried across rebases（分支还叫 …/lucide-react-1.35.0，而 PR 标题写 1.41.0）。

⇒ ⭐ 这不是「解析器选了个旧的」，是「这个结果任何一次全新解析都产生不出来」 —— 一个结构上不可能自然出现的锁文件状态。

⛔ 不抬 p1：无产品运行期影响；且 #7058 在重建 head 后自己纠正了（Bundle Analysis 转绿）—— ⭐ 卡把这句话说准了：「which is the confirmation, not a coincidence」，那次自愈本身就是归因的最后一块证据。

⭐ 对照的构造，本席逐条确认其判别力

被测：dependabot 重生成的锁文件 → 46 个 identity 变动，@objectstack/* 全族 17.3.0 → 17.2.0，zod 分叉 4.4.3 + 4.5.4
对照：同一基上只做 lucide 那次 bump → 12 个 identity 变动，全部是 lucide

⇒ ⭐ 对照会响（12 个变动），而且响得干净（全是 lucide） ⇒ 46 与 12 的差是真读数，⛔ 不是「重生成本来就会动很多东西」。

后果链也是量出来的，⛔ 不是推的：两份物理 @objectstack/spec（console/core/runner 一份，app-shell/components 另一份）⇒ 没有任何东西能去重两条真实路径 ⇒ vendor-objectstack 4,030,557 → 8,423,436 raw bytes（2.09×），objectstack/spec 标记数 620 → 1136。

⭐⭐ 承接裁定：本卡承载那道门，而 #8333 是它必须通过的第二个用例

两张卡都提到同一条补救（CI 锁文件完整性检查）。⇒ 本席定死分工，⛔ 免得建出半个门：

	角色
本卡 #8326	⭐ 承载那道门的建设（它先提出、且它的场景是「跨 rebase 携带的陈旧解析」）
#8333	⭐ 证明「从干净基重生成」这条补救挡不住它 —— 它在两个各自新切的 worktree 上、从干净基复现，且对照证明解析器在此确定性（未改动时 --lockfile-only 逐字节重现已提交的锁文件）

⇒ ⭐⭐ 因此那道门必须同时抓住两种成因：

1. 向后移动一个 @objectstack/* identity（本卡的场景）；
2. 分叉一个单副本依赖（zod）——⚠️ 无论成因是陈旧解析还是 peer 组重解析。

⚠️ ⛔ 只做第 1 条不够：#8333 的分叉里 @objectstack/* 一个都没动（它的 identity 差集只有 better-auth 全族 1.7.2→1.7.3 加一个新增的 zod@4.5.4）⇒ 一道只看「向后移动」的门看不见它。

⚠️ ⛔ 也不要只加 dependabot 的「从干净基重生成」配置：#8333 正是从干净基复现的 ⇒ 那条配置解决不了它。⭐ 这是 #8333 存在的全部理由，⛔ 别把两张卡的补救混成一条。

⇒ 验收判据（写死）： 那道门必须在两个样本上变红 —— (a) 本卡的 46-identity 回退锁文件，(b) #8333 的 better-auth 1.7.3 锁文件；并在对照样本（只含 12 个 lucide identity 变动的那份）上保持绿。⛔ 三个样本缺一，那道门就没被证明能判别。

⚠️ 与本轮 #8542 的关联 —— 本席在此写死一条排查约束

本席本轮把 #8542（Bundle Analysis 在 main 上红，framework chunk 超天花板 1.2 KB）定为 p1，而它的归因尚未确立（两张卡指了两个不同的嫌疑提交，均未构建验证）。

⇒ ⭐ 本卡正是那次排查必须先读的东西：它记录了 Bundle Analysis 会为与 diff 完全无关的原因变红，且「显而易见的读法」是错的。

⚠️ ⇒ 给 #8542 的承接者：在 bisect 之前，先确认那几次 main 推送的锁文件没有发生本卡这一类的变动。 ⛔ 若锁文件动过，那个 1.2 KB 可能根本不是任何一个代码提交造成的 —— 而本卡证明了这种事在本仓已经发生过一次、并浪费了两个席位各一天。

⚠️ 一条卡自己划出去的、⛔ 不属于本卡的

ui-components has 1.9 KB of per-chunk headroom at lucide 1.40.0 and a float to 1.42.0 exceeds it by 9.6 KB, so the next icon bump reds that ceiling for an ordinary reason. That is a pin-vs-ceiling question, carried on #7058, ⛔ not here.

⇒ 本席确认该划分正确：那是「天花板该不该抬」，⛔ 与本卡的「锁文件被静默改坏」不是一回事。⚠️ 但它与 #8542 是同一类问题（per-chunk 天花板余量太薄），建议 #8542 的承接者一并读。

车道 — domain:devx

按 2026-08-21 裁定「按修复落点分三流」：落点是一道新的 CI 检查（外加可能的 dependabot 配置）—— 工程面 ⇒ domain:devx，与 #8333 / #8542 / #8479 同道。

type = Task

⛔ 不是 Bug：本仓的代码与配置都没有错；错的是 dependabot 重生成出的锁文件状态，而那些 PR 已经过去。⇒ 剩下的是一道从未存在过的守卫。Task。

---

Generated by Claude Code

[claude]

Claim: PM loop round R50 — domain:devx @ objectui execution seat.
Session: session_01FhBNJcLRZLe8M87VcUgpKr
Branch: claude/issue-8326-lockfile-integrity-gate
Worktree: /home/user/objectui-issue-8326
Domain: domain:devx
Dispatch: one os-dev subagent of this session (mode:subagent, model: opus); the dispatch note follows. Labels pm:queue → pm:dispatched and assignee set in one write, read back and diffed against the union at 2026-09-08T22:48:59Z.

Why this card

Lane at 2026-09-08T22:48Z: 62 open, 18 dispatchable. No priority:p0, ⛔ no pm:blocking, no target: items; the Bug level holds only objectui#8380, already fixed by 83d4fda16 and close-requested ⇒ the rest, oldest first, and this is the oldest dispatchable card.

⭐ Triage ruled the division of labour, and it is the shape of this dispatch

| 本卡 #8326 | ⭐ 承载那道门的建设 |
| #8333 | ⭐ 证明「从干净基重生成」这条补救挡不住它 |

⇒ this card builds the gate. ⛔ The gate must catch BOTH causes:

1. an @objectstack/* identity moving backward (this card's stale-resolution scenario);
2. a single-copy dependency forking (zod) — ⚠️ whatever the cause, stale resolution or peer-group re-resolution.

⚠️ ⛔ Cause 1 alone is not enough, and objectui#8333 is the proof: its fork moves no @objectstack/* identity at all. ⚠️ ⛔ And "configure dependabot to regenerate from a clean base" does not cover it either — objectui#8333 reproduces from a clean base. That is the entire reason that card exists.

objectui#8333 is now pm:blocked on this card

Moved this round (note 5592950709), Blocked-by: objectui#8326 prepended to its body so the unlock sweep can grep it. ⇒ ⭐ its lockfile is a specified INPUT to this dispatch as required test sample (b), and when this gate lands its remaining work is one verification: does the gate go red on that sample?

Concurrency and file surface

Three in flight (batch:3), surfaces pairwise disjoint:

this card     : a new lockfile-integrity gate — scripts/** + .github/workflows/**
objectui#8385 : scripts/check-bash32-floor.mjs   (docblock only)
objectui#8388 : scripts/check-i18n-dead-keys.mjs corpus expansion

---

Generated by Claude Code

[claude]

Dispatch — round R50, domain:devx @ objectui execution seat, 2026-09-08T22:50Z

One os-dev subagent (mode:subagent, model: opus), branch claude/issue-8326-lockfile-integrity-gate, worktree /home/user/objectui-issue-8326. Three in flight (batch:3), surfaces pairwise disjoint with objectui#8385 and objectui#8388.

Adjudication section

⭐ Triage's division of labour IS a ruling for this dispatch's shape (5582847904): this card builds the gate; objectui#8333 is its second test sample. ⛔ Nothing else here is a ruling.

⛔ The gate must catch BOTH causes

① an @objectstack/* identity moving backward · ② a single-copy dependency forking (zod), ⚠️ whatever the cause.

⚠️ ⛔ ① alone fails, and objectui#8333 is the measured proof: its fork moves no @objectstack/* identity at all. ⚠️ ⛔ And "regenerate from a clean base" fails too — objectui#8333 reproduces from a clean base, in two independently cut worktrees.

⭐ Three readings required, and the middle one is the discriminating one

red on sample (a) (identity moved backward) · ⭐ red on sample (b) = objectui#8333's lockfile, where a ①-only gate is green · green on main's current lockfile. ⛔ All three: a gate red on everything passes both positives and is worthless.

⚠️ Maintainer floor, named in advance

⛔ Do not enrol the gate as a required context. That changes what blocks the merge queue and is a maintainer decision with its own decision box. Build it, wire it, and state the enrolment cost in the PR as input. ⛔ Do not re-resolve or pin the lockfile as part of this card — the gate reports; changing the resolution is a different change.

⚠️ And check for the guard that may already exist

scripts/__tests__/ci-cd-pipeline-doc.test.ts is described as already asserting a single resolved @objectstack/spec. ⇒ ⛔ say what it covers and what it does not, and build the gap — ⚠️ a second copy of one rule is this repo's recurring disease.

---

Generated by Claude Code

[baozhoutao]

os-dev-report

{
  "issue": 8326,
  "status": "done",
  "branch": "claude/issue-8326-lockfile-integrity-gate",
  "worktree": "/home/user/objectui-issue-8326",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8700",
  "pr_number": 8700,
  "head_sha": "489be9552d631c52cee93aa03138723c35ca6268",
  "premise_still_valid": true,
  "summary": "Built scripts/check-lockfile-integrity.mjs: a DELTA gate comparing a PR's pnpm-lock.yaml against its merge base, with two rules — (1) an @objectstack/* identity resolving lower than the base resolved; (2) a workspace-declared runtime dependency resolving to more PHYSICAL COPIES (pnpm snapshots: keys, peer suffix included) than the base did. Wired as .github/workflows/lockfile-integrity.yml, classified NOT_A_GATE in dependabot-merge-gate.mjs, documented in ci-cd-pipeline.md, covered by a 29-case --self-test plus a 16-case vitest suite, with an empty-frontmatter changeset. Two brief/card statements were measured to be WRONG and the gate is built on the measurements instead — see corrections_to_the_brief.",
  "preconditions": {
    "1_lockfile_clean": "PARTLY FALSIFIED. One @objectstack/spec version (17.3.0) and ONE physical spec snapshot — CONFIRMED. 'one zod' — FALSIFIED: main resolves zod@3.25.76 AND zod@4.4.3 (two packages: identities, two snapshots: keys). Instrument: grep over the packages:/snapshots: line ranges (2854-11280 / 11281-20351), exit codes read before any pipe. CONTROL for the duplicate-probe: the same probe run against the real objectui#8333 re-resolve found 3 zod copies and 2 @objectstack/spec snapshots, so a 'clean' reading is a fact, not a bad pattern.",
    "2_floating_ranges_and_registry": "CONFIRMED. 35 workspace @objectstack/* declarations, all floating: ^17.0.0 / ^17.1.0 / ^17.2.0 / ^17.3.0 — no exact pin anywhere. registry.npmjs.org dist-tags.latest = 17.3.0 for spec, client, core, formula, lint, sdui-parser and types (7/7, read 2026-09-08). => the impossibility argument holds today.",
    "3_existing_guard": "CONFIRMED AND SCOPED. scripts/__tests__/ci-cd-pipeline-doc.test.ts, describe 'ci-cd-pipeline.md — live-e2e backend pin (#7689)', asserts resolvedSpecVersions() has length 1. COVERS: the absolute invariant 'the lockfile resolves exactly one @objectstack/spec VERSION', as the precondition of comparing OBJECTSTACK_VERSION in e2e/live/ci/backend.env. DOES NOT COVER: (i) any other @objectstack/* package — a backward move of client/core/formula/lint/sdui-parser alone is invisible to it; (ii) any non-@objectstack dependency forking; (iii) ⭐ the objectui#8333 shape at all — that regex truncates each key at the first '(' , so two peer-context snapshots of ONE version collapse to one value and it stays GREEN. I built the gap, not a second copy: the new gate never restates the absolute single-spec rule and says so in its header, because two definitions of one rule drift.",
    "4_8333_delta": "CONFIRMED, RE-MEASURED TODAY on da5e4f69e (not #8333's d8ab2dc0) by `pnpm update better-auth --lockfile-only --recursive`, 49.7s, pnpm 10.31.0. Delta over packages: identities (1814 -> 1815): better-auth family 1.7.2 -> 1.7.3 (8 packages), plus zod@4.5.4 ADDED. NO @objectstack/* identity moved — confirmed. Three moves the card did not list, all FORWARD and count-preserving, from the newer base: @mongodb-js/saslprep 1.5.0->1.5.2, seroval 1.6.4->1.6.7, seroval-plugins 1.6.4->1.6.7. My identity count (1814 packages: keys) is a different instrument from the card's 3,634, not a contradiction."
  },
  "corrections_to_the_brief": [
    "⭐ 'a single-copy dependency FORKING (zod)' is not implementable as written. Measured: zod is ALREADY two copies on main (3.25.76 + 4.4.3), so a rule keyed on 'was 1, is now 2' is GREEN on sample (b). The gate compares COUNTS (head > base) instead. Ablation confirms: keyed on baseCount===1, zod 2->3 vanishes from the sample-(b) reading.",
    "⭐ objectui#8333's fork DOES duplicate @objectstack/spec, contrary to the reading that it only forks zod. Measured on the real re-resolve: spec stays at ONE version (17.3.0) and lands as TWO snapshots — 17.3.0(ai@7.0.65(zod@4.4.3)) and 17.3.0(ai@7.0.65(zod@4.5.4)) — i.e. two directories under .pnpm, which is #8326's exact bundling mechanism with no version change anywhere. This is why the gate's unit is the snapshot key, not the version.",
    "Precondition 1's 'one zod' is false on main today (see preconditions.1)."
  ],
  "gate": {
    "path": "scripts/check-lockfile-integrity.mjs",
    "workflow": ".github/workflows/lockfile-integrity.yml (job name 'Lockfile Integrity Check')",
    "script": "pnpm check:lockfile-integrity",
    "shape": "delta vs merge base; rule 1 = an @objectstack/* version lower than the base's max AND absent from the base (the second clause is load-bearing: without it an already-split base reds on every later PR); rule 2 = distinct snapshots: keys per name, head > base, scoped to names the lockfile's own importers: section declares under dependencies/peerDependencies/optionalDependencies, plus @objectstack/*; a name absent from the base is judged only if it ARRIVES with >1 copy",
    "exit_codes": "0 clean | 1 findings | 2 COULD NOT TAKE A READING (shallow checkout, unparseable lockfile) — 2 is never a pass",
    "verdict_line_clean": "VERDICT clean — no @objectstack/* identity moved backward and no package gained a copy.",
    "verdict_line_findings": "VERDICT <n> lockfile-integrity finding(s): <b> backward move(s), <d> duplication(s).",
    "annotation": "::error title=Lockfile integrity::<deduped package names> — see the run log; this is a lockfile regression, not a bundle regression (objectui#8326)."
  },
  "three_readings": {
    "green_on_main": "EXIT 0. `node scripts/check-lockfile-integrity.mjs --base-ref origin/main` on 489be9552 => 'base: da5e4f69e…:pnpm-lock.yaml (1822 resolutions) head: …/pnpm-lock.yaml (1822 resolutions) / VERDICT clean'. Reinforced by a real-history corpus rather than a self-comparison: over the 40 most recent lockfile-changing commits on main, base=<sha>^ head=<sha>, 37 exit 0 and 3 exit 1 (all three real duplications of runtime-declared packages: 1bae75bb8 @vitejs/plugin-react 1->2, bde6483b1 lucide-react 1->2, 90bc5d16a vite 2->3).",
    "red_on_sample_a": "EXIT 1, 7 findings (6 backward + 1 duplication): @objectstack/client, core, formula, lint, sdui-parser each 17.3.0 -> 17.2.0, plus @objectstack/spec resolving 17.2.0 AND 17.3.0 and gaining a physical copy 1 -> 2. Sample built by transforming the real 701 KB main lockfile (it CANNOT be resolver-produced — that is the card's impossibility argument). MUTATION PROVEN ON DISK by grep counts before/after: '@objectstack/<pkg>@17.2.0' occurrences 0 -> 11, spec snapshot keys 2 -> 3, and cmp against the base reported DIFFERS.",
    "red_on_sample_b": "EXIT 1, 5 findings, ⭐ 0 backward moves — @objectstack/formula 1->2, @objectstack/lint 1->2, @objectstack/spec 1->2, ai 1->2, zod 2->3. Sample (b) is NOT a reconstruction: it is the real output of `pnpm update better-auth --lockfile-only --recursive` on da5e4f69e. The worktree was restored afterwards and the restore proven: git hash-object pnpm-lock.yaml = 8547dc70613b25a4e690af4928246fbb4ae3c206 = HEAD:pnpm-lock.yaml, and `cmp` against the saved base reported BYTE_IDENTICAL_TO_BASE."
  },
  "ablations": {
    "method": "All on the COMMITTED tree (489be9552), each script carrying `trap restore EXIT INT TERM` with absolute paths, restore = `git checkout HEAD -- scripts/check-lockfile-integrity.mjs`, verified by blob hash equal to HEAD:scripts/check-lockfile-integrity.mjs = 7512dd8c6dcfa6ce7983e996b3c50fb1be7c259e, `git diff HEAD` empty and the ablation marker count back to 0. Each mutation proven landed on disk by grep -c on the injected marker AND by the blob hash differing (4009534a…, a8813c89…, 65a1d49c…).",
    "rule_2_deleted": "⭐ DECISIVE. The cause-1-only gate reads sample (b) as 'VERDICT clean', EXIT 0. That is the measured proof that a gate matching the two cards' 'identity moved backward' half is blind to objectui#8333. The vitest suite went 4 failed / 12 passed, so the suite is not vacuous either.",
    "count_versions_not_snapshot_keys": "sample (b) 5 findings -> 1; every peer-context duplication disappears, including @objectstack/spec 1->2 — the gate would stop naming the actual bundling mechanism. Still exit 1 via zod, so this one is a loss of naming, not of redness. Reported as observed, not as the template's expected direction.",
    "single_copy_fork_only": "sample (b) 5 findings -> 4; the zod 2->3 finding disappears. Proves the counts wording matters for zod specifically."
  },
  "not_covered_by_the_gate": [
    "A ratchet, not an audit: an already-duplicated lockfile stays green while the change does not make it worse.",
    "The absolute 'exactly one @objectstack/spec version' invariant — deliberately left to ci-cd-pipeline-doc.test.ts, not restated.",
    "Backward moves outside @objectstack/* (legitimate third-party reverts/yanks/security pins).",
    "Duplication of packages the workspace does not declare at runtime — measured: scoping wider reds on ordinary merged build-tooling churn.",
    "Same-version peer-context proliferation is caught; same-key churn and byte-level lockfile changes are not judged at all.",
    "It says nothing about bytes (Bundle Analysis owns those) and does not explain WHY pnpm picked 17.2.0 — still observed, not explained.",
    "It never pins, dedupes or re-resolves."
  ],
  "enrolment_cost_as_input_not_done": "⛔ NOT enrolled. 'Lockfile Integrity Check' is classified in NOT_A_GATE in scripts/dependabot-merge-gate.mjs with the reason inline; REQUIRED_CONTEXTS and OPTIONAL_CONTEXTS untouched; a pin test in the new suite asserts that. Enrolling needs THREE changes, not one: (1) remove the paths: filter from lockfile-integrity.yml — under #3523's rule, enforced by dependabot-merge-gate.test.ts, a required context must come from a workflow whose pull_request trigger has no path filter; (2) subscribe merge_group, or the queue stalls on it; (3) move the name into REQUIRED_CONTEXTS and add the check to branch protection, which lives in repository settings rather than in this repo's files. COST, measured over the 40 most recent lockfile-changing commits on main: it would have blocked 3 of 40 (~1 in 13) — 1bae75bb8, bde6483b1, 90bc5d16a — all three for REAL duplications of runtime-declared packages, none a parse error. lucide-react is a dependency of nine packages and is in the console bundle, so the maintainer's question is not 'is the gate accurate' but 'should a bump that adds a second copy of a bundled dependency be unmergeable'.",
  "files_touched": [
    "scripts/check-lockfile-integrity.mjs (new, the gate + 29-case --self-test)",
    "scripts/__tests__/check-lockfile-integrity.test.ts (new, 16 cases)",
    ".github/workflows/lockfile-integrity.yml (new)",
    "scripts/dependabot-merge-gate.mjs (one NOT_A_GATE entry)",
    "package.json (check:lockfile-integrity script)",
    "content/docs/guide/ci-cd-pipeline.md (inventory row + section — required by ci-cd-pipeline-doc.test.ts)",
    ".changeset/lockfile-integrity-gate.md (empty frontmatter = explicit 'no release', AGENTS.md §9)"
  ],
  "tests": "node scripts/check-lockfile-integrity.mjs --self-test => 29 cases pass, exit 0. pnpm exec vitest run scripts/ => 'Test Files 128 passed | 2 skipped (130) / Tests 3713 passed | 2 skipped (3715)', exit 0 — includes the new 16-case suite, dependabot-merge-gate.test.ts's bucket-partition assertions and ci-cd-pipeline-doc.test.ts (54). pnpm run type-check:scripts => exit 0 (first run was exit 2 on 8 TS2339s from JSDoc `Array<object>`; fixed with real @typedefs, not with `any`). pnpm exec eslint on the three changed scripts => exit 0. check-changeset-presence / -no-major / -fixed / check-control-bytes / check-pre-install-import-graph / check-doc-fence-languages / check-doc-links => all exit 0. All exit codes captured before any pipe (cmd > file 2>&1; EXIT=$?). Ablations: see the ablations block — mutation proven on disk by marker grep + blob hash, every restore proven by blob hash equal to HEAD's.",
  "not_verified_locally": "Repo-wide `pnpm lint` and the full four-shard `pnpm test`, `Type Check`, `Build & E2E`, `Build Docs` — left to CI. And the workflow's own execution: its `git fetch` + `--base-ref` path was exercised only against a local origin/main, never against a real pull_request merge-commit checkout, so CI is the first real run of the YAML.",
  "mcp_calls": "7",
  "open_questions": [],
  "out_of_scope_findings": [],
  "stopped_on": "Nothing. No blocked-on-PM item; no decision was taken that the maintainer floor reserved."
}

---

Generated by Claude Code