[finding] UNCONFIRMED: runtime bundle filename hash differs across byte-identical rebuilds — needs a deterministic-rebuild repro

[huangyiirene]

Symptom

UNCONFIRMED. During the build-own-contract run, the runtime bundle's filename hash differed across runs whose inputs were restored byte-for-byte, suggesting the emitted bundle name may not be content-deterministic. The QA run explicitly declined to file this as a defect: it is a side-observation with no dedicated reproduction yet and means nothing until reproduced. Do not treat as a confirmed defect.

Root cause

Not located by the run. Possible non-deterministic build output — e.g. a timestamp, iteration ordering, or salt feeding the bundle-name hash — in the objectstack build / compile pipeline (packages/cli). Unverified.

Reproduction

Not yet established. Next step is a dedicated deterministic-rebuild repro: build twice from byte-identical restored inputs (same source tree, same lockfile, cleared caches), capture the emitted runtime bundle filenames both times, and diff them. If the hash differs with identical content, capture the differing input feeding the hash. Until this repro is in hand the observation is not actionable as a defect.

Routing note: labeled domain:cli because the runtime bundle is produced by the objectstack build / compile command in packages/cli; re-route to domain:devx if the repro localizes it to build tooling under scripts/ instead.

Source

Extracted from the QA run #7628 (framework 92f26f7, console 6314e87f).

[os-zhuang]

Triage — dual-state resolution: finding + domain:cli kept; pm:queue removed (queue+finding is an illegal pair).

• Why finding: the card is explicit that it is UNCONFIRMED with no reproduction — "until this repro is in hand the observation is not actionable as a defect" is the filer's own framing, and it is right. A queue card with no repro dispatches a dev into an unbounded hunt. Held as an observation; promotion condition: the deterministic-rebuild repro the body specifies (build twice from byte-identical inputs, diff emitted bundle filenames).
• Routing kept: domain:cli — the bundle name is produced by the objectstack build/compile pipeline in packages/cli; the filer's own re-route note (devx if it localizes to scripts/) is the correct contingency and stays with the card.
• Dedup: no open card on bundle-name determinism (repo-scoped search on "deterministic build hash bundle" — only this).
• Stale-premise: n/a — nothing to verify until the repro exists; nothing on main claims determinism of the bundle filename.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Findings triage round, 2026-08-11 (maintainer-directed). Graded: hold — self-declared UNCONFIRMED with no repro; the card is a re-check reminder, not a defect. Restart: a dedicated deterministic-rebuild repro (build twice from byte-identical inputs, diff bundle names), most cheaply as a rider observation on the next packages/cli build-pipeline card.

---

Generated by Claude Code

[hotlong]

Finding-grading round: closed, not planned — the root-cause hypothesis is now disproven on origin/main.

The card guesses "a timestamp, iteration ordering, or salt feeding the bundle-name hash"; the hash site (packages/cli/src/utils/build-runtime.ts:157) is plain sha256(emitted code) — content-addressed, no timestamp or salt anywhere in build.ts (counter-checked: createHash present in 2 cli files, so the path is real). Self-declared UNCONFIRMED with no reproduction across two prior holds. Any re-file should target emit-ordering in lowerCallables with a captured double-build diff, not the hash.

---

Generated by Claude Code