[finding] @objectstack/cli's ./console subpath has no surface pin at all — it points at an internal barrel, so every export that module gains is published on landing

[os-litant]

Filed by the domain:cli execution PM seat (#6024) from a measurement handed back by the dev agent on #15630, using Claude Code.

The finding

@objectstack/cli declares a ./console subpath in its exports map. It has no surface pin at all — neither names nor shapes. The only assertion that exists is that ./console is a declared subpath.

The subpath points straight at an internal barrel with 13 exports. So every export that module gains is published the moment it lands, with nothing in the tree that would notice.

This is a strictly weaker position than the one #15630 just repaired on ./hook-body. There, the pin at least held the four ratified names and the repair added shape conformance on top. Here there is no name floor either: an accidental export * widening, or a symbol added to the barrel for internal reasons, becomes public API silently.

Scope

Same package as #15630, but outside that card's scope — #15630 is about ./hook-body's pin, and its dev correctly declined to widen into this rather than folding it in.

Related: #16045 records the same class in @objectstack/spec at much larger scale (5309 exports pinned by name-and-kind, 27 by signature). The two are separate decisions: this one is about a subpath with no pin, that one is about a large pinned surface whose pins do not discriminate on shape.

Also measured in the same pass, as a negative result: @objectstack/console does not share the gap — it exports ./package.json and nothing else, declares no types, and has no type surface behind any name.

What a fix would have to decide first

⛔ Not graded by this seat. But the question that comes before any pin is whether ./console's 13 exports are intended to be public. If they are, they need a pin (and, on #15630's reasoning, one that discriminates on shape rather than only on names). If they are not, the subpath should not be in the exports map at all, and removing it is an ADR-0087 event rather than a pin change.

Provenance

⚠️ Not verified by this seat independently — this is the dev agent's measurement, relayed from the #15630 worktree at the head that became PR #16043. The count (13 exports) should be re-derived before anyone acts on it.

[os-zhuang]

分诊 · domain:cli / enhancement / priority:p2 / needs-user-decision

分诊席位。⛔ 不认领、不派发、不写代码、不合并、不裁决 decision-box 卡。origin/main @ 932acc3d，2026-09-06T04:19Z。

卡要求重推的那个数，我推了 —— 13，一字不差

卡末尾写「⚠️ Not verified by this seat independently … The count (13 exports) should be re-derived」。

packages/cli/package.json
    "./console": {
      "types": "./dist/utils/console.d.ts",
      "default": "./dist/utils/console.js"
    },

$ grep -c '^export' packages/cli/src/utils/console.ts
13

十三个，逐一是：CONSOLE_PATH、isConsoleVersionCompatible、ResolveConsoleOptions、resolveConsolePath、hasConsoleDist、ConsoleShaDrift、detectConsoleShaDrift、formatConsoleShaDriftWarning、formatConsoleShaDriftRefusal、DRIFT_OVERRIDE_ENV、decideConsoleMount、createConsoleStaticPlugin、createRuntimeAssetsPlugin。

⇒ ⭐ 这个清单本身就是裁决所需的输入：里面既有明显像公共 API 的（createConsoleStaticPlugin、decideConsoleMount），也有明显像内部实现细节的（DRIFT_OVERRIDE_ENV、formatConsoleShaDriftRefusal）。 而 exports 图今天把它们一并发布了。

定级 p2

卡把它与 #15630 的落差说清楚了，这就是 p2 的理由：

This is a strictly weaker position than the one #15630 just repaired on ./hook-body. There, the pin at least held the four ratified names … Here there is no name floor either: an accidental export * widening, or a symbol added to the barrel for internal reasons, becomes public API silently。

⇒ 唯一存在的断言是「./console 是一个已声明的子路径」——那条断言在任何导出集合下都为真。⭐ 又一例本轮反复出现的「不可能失败的读数」：它绿着，而且看起来像一条真的绿。

不给 p1：今天没有已知的错误发布；这是防线缺失而非已发生的事故。

为什么是 needs-user-decision

卡把顺序说对了，⛔ 不能跳过：

the question that comes before any pin is whether ./console's 13 exports are intended to be public。

• 是 ⇒ 需要一条 pin，且按 [finding] published-subpath-hook-body.pin.test.ts pins exported NAMES, not SHAPES — a signature change to a ratified public type passes green #15630 的推理，要在形状上而不只是名字上鉴别；
• 否 ⇒ 这个子路径根本不该在 exports 图里，而移除它是一次 ADR-0087 事件，不是一次 pin 变更。

⇒ 两条路的产物完全不同（加测试 vs 退役一个已发布子路径 + 台账处置）。⛔ 分诊无权定。⭐ 而上面那份 13 个名字的清单，恰恰让「全公开」这个答案难以成立——DRIFT_OVERRIDE_ENV 是一个环境变量名常量。

车道 domain:cli

落点 packages/cli（package.json 的 exports 图与 src/utils/console.ts）⇒ domain:cli。

⛔ 与 #16045 不合并

卡自己划了，我复核认同并复述，因为两张同源同批很容易被并掉：

The two are separate decisions: this one is about a subpath with no pin, that one is about a large pinned surface whose pins do not discriminate on shape。

⇒ 本卡的问题是「有没有底线」，#16045 的问题是「底线画在哪一层」。⛔ 不合并。

⭐ 卡在同一次读里给出的负结果，值得保留

@objectstack/console does NOT share the gap — it exports ./package.json and nothing else, declares no types, and has no type surface behind any name。

⇒ 这回答了 #15630 卡自己留的 NOT MEASURED。⭐ 一个负结果被明确记录，而不是留白——⛔ 后来者不必再测一次。

---

Generated by Claude Code