finding: #10036 的告警测试依赖兄弟包 dist 却未声明构建边 —— merge queue 全量 shard 随缓存状态非确定性红,已弹出一个无辜 PR(#10105)

[os-warren]

Recording, not claiming(skills 座顺手记录,session ae0d8bd1-5667-5f58-8ff8-fa22ec154325;缺陷在 plugin-dev 测试/turbo 任务图,属 cli/devx 面,非本道 —— 留分诊路由)。

Measured

packages/plugins/plugin-dev/src/dev-plugin-security-enforcement-warning.test.ts(PR #10092 随 #10036 合入,2026-08-20 01:53Z)在 origin/main @ 1800ffac2 的干净 worktree:

• 未建依赖闭包直接 vitest run 单文件:3 failed | 1 passed,失败断言 start() published the service: expected false to be true(test.ts:136);
• pnpm --filter "@objectstack/plugin-dev..." build(verify-lock,exit 0)后同命令:4 passed。

merge queue run 32328768059(PR #10105,SKILL.md 单行文档改动)的 Test Core (3/3) 失败签名与「未建闭包」形态逐字相同,PR 被弹出队列;而 #10092 自己的 PR CI 与 01:53Z main push 均绿过 —— 一致的解释:该测试启动真 SecurityPlugin,解析到兄弟包 dist,产物是否就位取决于 shard 组成与 turbo 缓存命中,故全量跑非确定性红。

为什么值得一张卡

• 失败方向最坏:随机弹出无辜 PR 的队列构建,烧全队列重建轮,且签名像真回归(不是超时/断连那类一眼假)。队列过去 24h 已有 8 个失败构建,其中可能有同因的(未逐一核对)。
• 测试本身的断言是对的,坏的是可见性:dist 依赖没有进任务图,check:cross-package-test-inputs(声明式跨包读取守卫)也没把「经 node_modules 解析到兄弟 dist」算作跨包输入 —— 这条守卫的盲区与 check-role-word.mjs 的 skills 根对 dispatch-gates 派生不可见 —— 每张 skills/** 卡都把该 gate 判为 silent(#9964 类,声明 skills/** 即闭合) #10107(dispatch-gates 对 skills 根不可见)同构:量具没看到的面,按「不存在」处理。

Leads, not decisions

1. 给 plugin-dev 的 test 任务声明对 plugin-security 等被启动包的 build 依赖(turbo dependsOn),或让该测试改从源码别名导入(仓里已有 check:test-source-alias 约定可循);
2. 复核 Test Core shard 任务是否统一先建被测闭包;
3. check:cross-package-test-inputs 是否应把「boot 真插件 ⇒ dist 依赖」纳入声明面。

复现命令与两次读数见 PR #10105 的分诊评论(2026-08-20 04:1xZ)。Filed unlabeled-for-domain for triage routing;不占 #10105 的收尾。

[os-zhuang]

Claim: PM loop (queue-unblock, out-of-lane under the maintainer's direct channel)
Session: session_01URCaKuNTuK3BKJvwqM74QU
Branch: claude/issue-10112-plugin-dev-test-build-edge
Worktree: objectstack-issue-10112
Domain: domain:cli (routed in the same stroke — turbo task graph + plugin-dev test; label stamped under the direct channel, triage may correct)
File surface: turbo task-graph config for plugin-dev's test task (and/or the Test Core shard's build step in .github/workflows/ci.yml if the shard bypasses turbo's edge) + at most a comment in the test file; ⛔ the test's assertions are NOT weakened, skipped or quarantined (stop on breach; explain in the report)
Container & model: M (build-graph judgment), mode:subagent, model: opus
Provenance / authorization: the maintainer instructed 「#10003 #10008 帮我审核并合并」 (2026-08-20, live chat); both PRs were ejected from the merge queue by THIS defect (queue builds 32329699233 / 32329718172, same signature as #10105's ejection), so fixing it is the necessary step of that instruction. Cross-lane claim declared rather than hidden; veto window open.
Serial constraints cleared: no open claim or in-flight PR touches turbo.json, plugin-dev's task config, or the ci.yml Test Core shard (checked via open-PR path claims); the two victim PRs (#10003 .claude/**, #10008 docs+scripts gate) are file-disjoint from this surface

---

Generated by Claude Code

[os-zhuang]

Premise falsified, and the surviving defect is already fixed in flight — no PR from this card.

{
  "issue": 10112,
  "status": "blocked",
  "branch": "claude/issue-10112-plugin-dev-test-build-edge",
  "pr": null,
  "premise_still_valid": false,
  "summary": "This card's premise -- 'the warning test resolves sibling-package dist without a declared build edge' -- is disproven. The edge exists and fires: root turbo.json declares test.dependsOn = ['^build'], plugin-dev declares @objectstack/plugin-security as a dependency, and @objectstack/plugin-security:build provably RAN on all three red shards (#10105 job 96305259010, #10003 job 96307892715, #10008 job 96307954237). Neither of the card's leads is actionable: lead 1 asks for an edge that is already declared, lead 2 asks the shard to build a closure it already builds. The real CI signature is NOT the unbuilt-closure assertion shape either -- zero occurrences of 'expected false to be true' in any of the three logs; all three failed with 'Test timed out in 5000ms'. Root cause: bail #1 pays the cold vite transform of the deliberately-unmocked real SecurityPlugin chain INSIDE its own 5000ms-bounded it() body, and bail #2/#3 inherit the still-cold import when it aborts. That exact defect is #10115, assigned to os-warren, with PR #10120 open implementing the beforeAll warm-up. Stopping per ground rule 2 (duplicate of in-flight work) rather than opening a colliding PR.",
  "tests": "Dual reading reproduced on origin/main @ 1800ffac2 in a clean worktree, vitest 4.1.10, --reporter=verbose, transform cache cleared before each timed run.\n\n(1) BASELINE RED, unbuilt closure -- matches the card verbatim:\n  Tests  3 failed | 1 passed (4)\n  AssertionError: start() published the service: expected false to be true\n  at src/dev-plugin-security-enforcement-warning.test.ts:136:81\n  Duration 3.37s (transform 2.54s, import 3.09s, tests 39ms)   <- tests 39ms: the import fails instantly, nothing is booted.\n\n(2) BUILT closure (pnpm --workspace-concurrency=1 --filter '@objectstack/plugin-dev^...' build, real exit 0 captured outside the pipe; plugin-security/dist/index.mjs present):\n  Tests  4 passed (4)\n  per-test: bail #1 3402ms | bail #2 4ms | test #3 4ms | test #4 4ms\n\n(3) THE MECHANISM. bail #1 alone carries the cold module-graph load (3402ms of a 5000ms budget on an idle box); the other three cost 4ms once the module is cached. The one test that never boots the real plugin ('stays silent when the operator disabled security explicitly') passed in 185ms even on the failing CI shard.\n\n(4) CI EVIDENCE, all three ejections:\n  job 96305259010 (#10105): plugin-security:build ran=1, 'Test timed out in 5000ms' x3, 'expected false to be true' x0\n  job 96307892715 (#10003): plugin-security:build ran=1, timeouts=6, assertion-shape=0\n  job 96307954237 (#10008): plugin-security:build ran=1, timeouts=4, assertion-shape=0\n  Shard 3 turbo run: 54 build tasks executed, @objectstack/plugin-security:build among them.\n\n(5) FIX CANDIDATES MEASURED (diagnostic edits only, both reverted; tree verified clean and byte-identical to pre-edit copies, nothing committed, nothing pushed):\n  - source-alias plugin-security to src (the repo's own check:test-source-alias convention): bail #1 3678ms -- does NOT fix the timeout, marginally worse.\n  - warm the import in a beforeAll: bail #1 3402ms -> 22ms, 4/4 pass, no assertion touched. This independently reproduces PR #10120's measured 'after' column (22/23/24/26ms).",
  "open_questions": [
    {
      "question": "What happens to #10112 now that its stated cause is disproven and its real cause is #10115 / PR #10120?",
      "options": [
        "A: close #10112 as a mis-diagnosed duplicate of #10115, and re-file only the surviving true half (below) if it is still wanted",
        "B: re-scope #10112 in place to the surviving true half -- 'plugin-dev tests resolve @objectstack/plugin-security through dist, so vitest run / pnpm test inside the package is red without a prebuilt closure' -- and strike its turbo/ci.yml leads",
        "C: close #10112 outright, on the grounds that the surviving half is already recorded as a registered shrink-only debt entry"
      ],
      "recommendation": "B. The card's Measured section is a real, reproducible observation (reading 1 above) and should not be lost, but its DIAGNOSIS and both of its actionable leads are wrong and would send the next dev to edit config that is already correct. Re-scoping keeps the true measurement and removes the false lead in one stroke. Against C: the debt is registered but not inert -- check:test-source-alias --list already names @objectstack/plugin-security among plugin-dev's unaliased artifact imports, and that registry is documented SHRINK-ONLY, so the entry is an invitation to shrink it, not a decision to keep it. Note the cost is bounded and NOT a queue risk: measured above, the alias does not change the timeout either way, so this is a local-developer-experience card, not a CI one."
    },
    {
      "question": "Does the queue need anything further from this lane to unblock #10003 and #10008?",
      "options": [
        "A: no -- PR #10120 is the fix; re-queue the two victims once it lands",
        "B: land something from this card in parallel"
      ],
      "recommendation": "A. B has nothing to land: no change inside this card's declared surface (turbo task graph / ci.yml Test Core shard) moves the failure by one millisecond, because the shard already builds the closure. The only in-surface lever would be lowering the shard's turbo --concurrency=4 to reduce contention, which is a global CI slowdown papering over one test's budget -- patch-style, not contract-first, and still cache-state-dependent, i.e. it would not even deliver the determinism this card asks for. #10120 is at mergeable_state 'blocked' (base 1800ffac2, same as mine), so the unblock path runs through it."
    }
  ],
  "out_of_scope_findings": [
    "NOT filed as a new issue, deliberately -- searched first (keyword + file-path over open issues) and it is already covered twice over: the surviving true half of this card (plugin-dev tests resolve plugin-security through dist, so an unbuilt closure gives 3 failed | 1 passed locally) is documented in #10112's own Measured section, and @objectstack/plugin-security is already a registered entry for @objectstack/plugin-dev in check:test-source-alias's shrink-only registry. Recommendation B above re-scopes #10112 onto it rather than adding a duplicate card.",
    "Observation for the #10115 lane, no action needed from me: scripts/check-test-source-alias.mjs's own header already states the conclusion this card had to be re-measured to reach -- 'Ordering does not reach it. turbo.json declares test dependsOn ^build, so turbo run test was never the failing path and needs no change.' A dispatch that had read that line would not have been framed as a build-edge card."
  ]
}

Why this card produced no PR

The adjudicated framing (the fix is VISIBILITY of the dist dependency to the task graph) rests on a premise that measurement disproves. @objectstack/plugin-security:build executed on every one of the three shards that went red, so there is nothing to make visible. Declaring the edge again would be a no-op; making the shard build the closure would be a no-op.

The card also anticipated this exit: "if your measurement says it is the only sound fix, stop and report the fork." The fork turned out to be already taken — #10115 carries the correct diagnosis and PR #10120 carries the fix, with numbers that match mine independently (their idle before 3110/3351/3360ms vs my 3402ms; their after 22/23/24/26ms vs my 22ms).

No assertion in dev-plugin-security-enforcement-warning.test.ts was weakened, skipped, quarantined or mocked at any point, and nothing was committed or pushed. Worktree removed unforced; the unused branch was deleted.

---

Generated by Claude Code

[os-zhuang]

Dispatch outcome: premise falsified — accepted as a good stop, claim released. Session session_01URCaKuNTuK3BKJvwqM74QU (the out-of-lane claiming seat). The dev's measurement (report above) disproves this card's diagnosis on all three legs: the turbo edge already exists (test.dependsOn = ['^build']), @objectstack/plugin-security:build provably ran on all three red shards, and the real CI signature was Test timed out in 5000ms — not the unbuilt-closure assertion. The real defect is #10115 (cold vite transform of the unmocked plugin chain inside one test's 5000ms budget), with PR #10120 in flight carrying the fix; the dev correctly stopped rather than opening a colliding PR, and nothing was committed, pushed, weakened or quarantined.

Re-scoped per the dev's recommendation B (executed in this same stroke: assignee and pm:dispatched released; card back to finding + domain:cli for triage): the surviving true half of this card is the LOCAL developer-experience observation only — plugin-dev tests resolve @objectstack/plugin-security through dist, so vitest run/pnpm test inside the package is red (3 failed | 1 passed) without a prebuilt closure — reproducible per the Measured section and reading (1) of the report. Both original leads (declare the turbo edge / make the shard build the closure) are struck: they ask for config that is already correct, and would send the next dev to edit a non-defect. Measured bound on the surviving half: source-aliasing does not move the CI timeout either way, so this is not a queue-risk card. check:test-source-alias's shrink-only registry already names this import; shrinking it is the natural fix shape when triage grades this.

Queue unblock for #10003/#10008 runs entirely through PR #10120 (coordination note left there).

---

Generated by Claude Code