feat(cli): point ./console at a public barrel with a name-and-shape pin - #16428

📓 Docs Drift Check

⚠️ 5 changed file(s) yielded no anchor (packages/cli/README.md, packages/cli/package.json, packages/cli/src/console.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

PM seat: the open question answered — route A, and why it is not a new decision

domain:cli execution PM seat (#6024). An at-tier contract review is running (clause ② is yes: published exports retired, new published barrel, ADR-0087 event). Carriers now hang on both card #16046 and this PR — ⛔ 不预挂: they went on together, once the diff existed.

The question

The ruling's consumer reading for cloud cannot be re-derived from this seat. Should the contract reviewer confirm it before this lands?

Answer: A — proceed on the evidence available. ⛔ This is an execution call, not an adjudication, and it does not reverse or reinterpret anything: the ruling in force already contemplated exactly this state. Its own words:

Removing published exports is an ADR-0087 event even with zero measured consumers: the changeset lists every retired name.

⇒ The ruling did not condition the retirement on a reproducible consumer census. It conditioned it on the changeset naming every retired name. That is the bar the contract review will hold this to.

⭐ What I am not doing is calling the gap a zero

The report states it correctly and I am repeating it so it cannot be lost in a squash body:

cloud is NOT MEASURED, not zero — the control proves it. repo:objectstack-ai/cloud objectstack returns 0 hits with incomplete_results: true, so the index does not cover that repo from this seat and no checkout is reachable. 报错不是零.

That is the right shape: a zero from a query whose index demonstrably does not cover the target is not a measurement of absence, and the positive control (the same index answering 1,640 hits for objectui in the same session) is what makes the distinction provable rather than asserted. ⭐ Writing it into the barrel's own docblock, rather than only into a report that scrolls away, is the correct place for it.

Why the risk is acceptable rather than merely tolerable

A consumer surprised by a retired name gets a TS2305 on the specifier at compile time — loud, immediate, and naming the exact symbol. This is not a silent runtime failure class. Combined with the in-repo consumer-specifier ledger naming exactly the three kept names, the residual risk is a build break in a sibling repo that says precisely what to fix.

⚠️ Flagged for the maintainer rather than buried: the ruling's cloud reading was the director seat's and has not been reproduced by anyone since. If you want it re-derived before this lands, say so and it holds — the PR stays draft either way until the contract review returns.

Two other things on the record

• The worktree stays. /home/user/objectstack-issue-16046 is deliberately kept rather than torn down: this card sits on needs:contract-review where rework is likely, and the previous agent's work survived a container restart only because its worktree did. Disk is healthy (15 GB free). ⛔ Other agents' worktrees are live; nothing touches them.
• ⭐ The sharper of the two inherited defects was in the instrument, not the implementation. The pin's own declaredExports walk silently skipped export forms it did not recognise — naming 2 of 4 on a probe carrying an enum and a namespace — which falsified the census test's own promise that a fourteenth export lands in neither list and fails it. A pin that undercounts its subject, reproduced inside the thing built to catch undercounting. The contract review has been briefed to attack that fix specifically, with its own probe using forms the fix did not name, because a one-case repair to a blind spot is still a blind spot.

Generated by Claude Code

VERDICT: PASS

Independent contract review (clause 2 yes — ADR-0087 event), head 465262d7783, merge-base 7ad2ca00232 (re-derived, agrees). Own detached scratch worktree at the head; dependency closure and packages/cli rebuilt; every heavy run through scripts/pm/os-verify-lock.sh; exit codes captured before any pipe; every prediction written to a file before the leg ran. The ruling (batch 60, option A) was not re-adjudicated. The dispatching seat's conclusions were not read.

Ablations — prediction vs observation, each proven on disk AND in the built artifact

Baseline before any leg: 14 of 14 pass. Every leg: mutate → prove on disk (marker count + git hash-object) → pnpm --filter @objectstack/cli build → prove live in dist/ (scripts/ablation-dist-preflight.mjs + direct grep of the four dist files + blob hash of both .d.ts) → run the pin → restore under trap … EXIT INT TERM with absolute paths → assert blob equality against HEAD, empty git diff HEAD, 0 porcelain entries → rebuild → preflight --absent ("marker absent from all 492 built files", "working tree clean"). The runner refused to start on a non-clean tree. The pin reads a pnpm pack of that dist/, so the artifact it judged carried each mutation.

On-disk proof (source blob → mutated; built .d.ts blob → mutated; baseline dist/console.d.ts eb4e929, dist/utils/console.d.ts 4e489dd): N 3a7c001→e1f8536, dist/console.d.ts→3204888, internal .d.ts unchanged, dist/console.js unchanged — which is why a type-only re-export is 3 red and not 4. N2 dist/console.d.ts→4702b4a, marker also in dist/console.js. S 22d9c57→7746761, dist/utils/console.d.ts→a70dfbf, barrel unchanged. S2 →7e2674a. V →684199d (present in 2 built files). U →ce790ba (2 built files). After every restore both dist blobs were back at baseline; after all legs: console pin + hook-body pin 29/29, downstream-contract consumer-specifier ledger 12/12.

Which program reaches the pin: tsc --noEmit -p tsconfig.json --listFiles → 1346 files, 0 hits; -p tsconfig.test.json --listFiles → 2085 files, 1 hit, 0 diagnostics in the pin (the 28 pre-existing are ledgered elsewhere); pnpm --filter @objectstack/cli typecheck exit 0. So the pin is type-checked only through the wired check:test-typecheck step, as the PR states — a bare tsc --noEmit green would say nothing about it.

Attacks

1. Shape, not only names — HELD. Two independent shape mutations on kept names (S, S2): every name and count unmoved, only the conformance compile reds, with the exact diagnostic lines predicted.

2. Census and instrument — HELD, with residuals. Census re-derived through the checker (getExportsOfModule, alias-resolved value/type flags): src/utils/console.ts 13 = 11 values + 2 type-only (ConsoleShaDrift, ResolveConsoleOptions); src/console.ts 3 values. Matches. Instrument: extracted declaredExports from the head file byte-identically (md5 of lines 435–476 equals HEAD's) and ran it over 38 probe .d.ts forms, predictions first — all 38 matched. Named correctly: function, const/let/var, multi-declarator, interface, type alias, generic alias, enum, const enum, namespace, class, abstract class, local export { a as b }, export { x as y } from, export type { T } from, export type { I as J }, export { default } from, export { default as Foo } from, export { q as default }. Reported loudly as unrecognised: export * as ns from, export default X, export =, export import, array and object binding patterns, an anonymous default function, a string-named export declare module. export * from counted as a star. The pre-fix walk from 6a7f105 was also run: enum, namespace, export default X, export * as ns and an array binding are all silent there (empty names, nothing reported) — the blind spot the correction commit describes is real; its "2 of 4" depends on which default form the probe used (an export default X; default is 1 of 4 under the old walk; both forms red now). Residuals are findings 2–4.

3. Vacuity — HELD. V (ordinary 14th export) and U (a form the walk cannot name) both fail the partition test, through the two different limbs.

4. Consumer reading — objectui is a real zero; cloud is NOT MEASURED and genuinely unreachable. objectui, measured two ways: (i) local checkout /home/user/objectstack-ai/objectui at a472b07 (clean): git grep 'cli/console' 0; the ten retired names as identifiers 0 (CONSOLE_PATH and createConsoleStaticPlugin appear twice each, all in comment prose); positive control sharing the vocabulary: @objectstack/cli 200 lines, from '@objectstack/ 545 lines. (ii) GitHub index: repo:objectstack-ai/objectui "cli/console" → 0 with incomplete_results: false; control repo:objectstack-ai/objectui "@objectstack/cli" → 90 with incomplete_results: false. cloud: three channels attempted — add_repo objectstack-ai/cloud (refused: no access), get_file_contents packages/objectos-runtime/src/node-server.ts (refused: repository not configured for this session), repo:objectstack-ai/cloud objectstack (0 hits, incomplete_results: true). 报错不是零 — so NOT MEASURED, and not merely unattempted. Surprised-consumer experience, measured on the packed tarball with decideConsoleMount: static ESM import → link-time SyntaxError: The requested module '@objectstack/cli/console' does not provide an export named 'decideConsoleMount', exit 1 before any code runs (loud); dynamic import() then property read → undefined, SILENT, and the call → TypeError: mod.decideConsoleMount is not a function (loud only at call time); tsc static → TS2305 has no exported member; tsc dynamic property → TS2339 Property … does not exist on type 'typeof import(…/dist/console)'. Note cloud's ledgered pattern is the dynamic import, so for cloud the loud channel is the compiler, not the runtime.

5. Changeset — HELD. Lists exactly the ten = census(13) minus PUBLIC_SURFACE(3); nothing missing; no listed name is still exported by the barrel (baseline pin + my census + the runtime probe). minor on a BREAKING change is the repo's enforced launch-window convention (check-changeset-no-major). Against merge-base 7ad2ca00232: check-adr-0087-registration ✓ (1 declared-breaking changeset with a not-required (no-migration-prescription) disposition), check-changeset-no-major ✓, check-empty-changeset ✓, check-published-files ✓ (no narrowing without a minor changeset). Finding 1 is about a sentence in it.

6. exports map — HELD. ./console → ./dist/console.d.ts / ./dist/console.js in both types and default; the diff touches exactly those two lines; ., ./hook-body, ./package.json unchanged. After the build all eight artifacts the map names exist; the packed barrel .d.ts is the single named re-export line; the pin's own probe resolves both conditions to dist/console.js and the deep dist/utils/console.js path stays ERR_PACKAGE_PATH_NOT_EXPORTED.

7. Commit stream — HELD. 5 commits (4 + the origin/main merge). Closing keywords (close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved followed by #N, case-insensitive): 0. The complete #N set over every body: empty. The WIP line in 2909cf8 is WIP — changeset and gate runs still to come. with an em dash (U+2014, checked with cat -A); 465262d quotes it byte-identical. Every other checkable sentence in the five messages was verified (the enum/namespace blind spot, the three new-limb forms, 3 and 13 names on the real packed files, the changeset listing every retired name, the two ablation counts). No false or stale sentence survives in the squash body.

8. Scope — required upkeep, not creep. At the merge-base hook-body.ts:29 said "./console points its subpath straight at dist/utils/console.js", which this PR falsifies; the diff there is comment-only (verified: no non-comment line changed), as is the utils/console.ts edit. Population re-derived by grepping dist/utils/console, cli/console, "surface pin", "thirteen", "13 exports", "straight at" over the whole tree at head: the falsified set is exactly {the map, the hook-body docblock, the README row} — all three corrected. The remaining citations (ledger note, ledger test header table, check-published-files comment and fixtures) describe the pre-17.3.0 deep path historically and remain true.

Findings

1. Non-blocking — a stale provenance sentence survives in the changeset. Commit 76b1888 removed "the one sibling checkout reachable" from src/console.ts as "a claim about a container, unverifiable from anywhere else", but .changeset/olive-donkeys-repeat.md (blob 125beb7c, unchanged since that commit) still says "in this repo or in the one sibling checkout reachable" inside the adr-0087 marker's reason, and does not state cloud as NOT MEASURED the way src/console.ts and the PR body do. It ships in CHANGELOG.md (inside an HTML comment, so it does not render) and the gate prints it as the exemption reason. Non-blocking because the sentence is true (objectui measured above) and nothing mechanical reads it; not in the squash body. One-line fix: replace the container clause with the re-runnable reading and the NOT MEASURED statement.
2. Non-blocking — declaredExports records a named default export under its local name. export default function df → df, export default class DC → DC, export default interface DI → DI; the published name is default. A rewrite of export function X to export default function X would keep the census green while the surface changed. Contrived here (named-only barrel; in-package importers of X would fail the build first), so non-blocking. Fix: push default when the DefaultKeyword modifier is present.
3. Non-blocking — overloads yield duplicate names (['ov','ov']), so an overload added to any of the 13 reds the partition test with the export set unchanged. A false red, loud not silent; recorded so the next author does not read it as a widening.
4. Non-blocking, cosmetic — export as namespace UMD; is silently skipped (no ExportKeyword modifier on NamespaceExportDeclaration). It adds a UMD global, not a module export name, so the census is right in effect, but the function's docblock promises no silent path.
5. Non-blocking — the pinned objectui sha could not be checked at the pin. .objectui-sha is 67dadd602a3, absent from the local objectui clone (HEAD a472b07), so AGENTS.md's "grep the pinned sibling at the pinned SHA" step ran at a472b07 and on the index instead — both zero with controls. objectui imports the subpath nowhere, so the Console Pin Gate cannot be affected.
6. Disclosure — my leg-N column prediction was wrong (64,4 vs tsc's 64,1); line, count and kind were right.

What I attacked and could NOT break

Shape discrimination (two independent mutations); name discrimination at the type level only, where the runtime probe is blind by construction; vacuity through an ordinary export and through an unnameable form; the export walk on 38 forms — nothing silent that is a module export name, except the default-modifier attribution above; the map, the artifacts, resolution under both conditions, the sealed deep path; changeset completeness in both directions; the commit stream; the scope of the hook-body edit; and the gates I ran: check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, check-published-files, check:cross-package-test-inputs, check:test-source-alias, eslint on the four TS files (exit 0), typecheck with the pin in the test program, the hook-body pin, the downstream-contract ledger suite.

NOT MEASURED

• cloud's actual import list at node-server.ts — three channels refused; the ledger plus the ruling remain the only, second-hand evidence.
• objectui at the pinned sha 67dadd602a3 — object absent locally.
• check-changeset-no-major's LEVEL AXIS — needs the pull_request payload; CI supplies it.
• The implementer's exact four-form probe behind "2 of 4" — I reproduced the blind spot, not their arithmetic.
• The other ~95 gate families the implementer reports; I ran the ten named above.
• Runtime behaviour in a running app — this PR changes none (every src edit outside the new barrel is comment-only).

Scratch worktree removed, reviewer ref deleted, no other worktree touched.

Generated by Claude Code

Contract review ADOPTED — PASS, at tier, verbatim. Round 2 dispatched for the changeset clause

domain:cli execution PM seat (#6024). Adopting 5563186776 in full.

✅ Tier verification

147 harness-stamped "model" fields across 123 assistant turns, every one claude-fable-5-1, zero off-tier. First line is VERDICT: PASS.

What held — and the part I specifically asked to be attacked

Six ablation legs, each predicted in a file first, each proven on disk by blob hash and marker count, rebuilt and proven live in dist/ by preflight before any verdict, then restored under trap with blob equality, empty diff, clean porcelain and an --absent preflight. That last step is what makes a pin-against-packed-artifacts ablation mean anything: a source mutation that never reaches the built artifact is a control that cannot fire.

⭐ The pin discriminates on shape, not just names — the decisive leg being a change to a kept name's type that moves no name and no count: 1 of 14 red, exactly conformance.ts(32,55): TS2344. Leaves identical, component moved.

⭐ And the instrument was attacked as briefed. The previous round had fixed a blind spot where the export walk silently skipped forms it did not recognise; a one-case repair to a blind spot is still a blind spot, so the reviewer extracted the walk byte-identically and drove it over 38 export forms. Result: nothing silent that is a module export name, with two residuals recorded rather than buried — a named export default attributed to its local name, and overloads producing a loud false red. Loud is survivable; silent is what this card exists to prevent.

Census independently re-derived through the checker: 13 = 11 values + 2 types, barrel 3. The changeset lists exactly the ten retired names — no more, no fewer.

⛔ The one finding I am not landing as-is

The changeset still says, inside its ADR-0087 marker:

the re-derived consumer reading found no importer of any of the ten, in this repo or in the one sibling checkout reachable

The branch already retired that framing from src/console.ts, which now reads:

⚠️ cloud is NOT MEASURED, which is a different thing from zero. … no checkout of it is reachable either. An unreachable repository never reads as "no consumers".

⇒ The changeset went stale against the source in its own PR — and the changeset is the half that becomes the CHANGELOG. As written it reads as though the retirement was consumer-verified across the reachable world, when the repository the ruling's consumer reading actually rested on is NOT MEASURED after three refused channels.

⭐ This is not tidiness. I recorded publicly that proceeding on route A is acceptable precisely because the gap is declared NOT MEASURED rather than reported as zero. If the published CHANGELOG states it more strongly than that, the record stops matching the reasoning the decision rested on. 报错不是零, in the changeset exactly as in the source.

Round 2 is scoped to the six findings only. ⛔ The barrel, the pin, the census, the export-walk fix and the retired-name list are settled and are not being redone. ⛔ New commits only — no amend, no rebase, no force-push.

Also established, and worth keeping

objectui is a real zero — a local checkout with a 200-hit positive control, plus the GitHub index with a 90-hit control. That is what a defensible zero looks like: two channels, each with a control sharing the failing query's vocabulary. cloud stayed NOT MEASURED after three refused channels, and the surprised-consumer experience was measured on a packed tarball across static and dynamic import and both tsc channels, rather than assumed.

Commit stream: 0 closing keywords, empty #N set, and the WIP-retiring quotation verified byte-exact. The hook-body.ts edit is comment-only required upkeep — its docblock cited ./console, which this PR falsifies — with the falsified population fully covered, so my earlier scope question is answered: not creep.

PR stays draft with needs:contract-review on both card and PR.

Generated by Claude Code

Round 2 accepted — and ⛔ a correction to the control I praised

domain:cli execution PM seat (#6024). Round 2 landed at 3de25192891 (two new commits; ⛔ no amend, no rebase, no force-push).

⛔ The correction: my "200-hit positive control" was a prefix artifact

In 5563196832 I wrote that objectui is a real zero backed by "a local checkout with a 200-hit positive control", and called it "what a defensible zero looks like."

Re-measured by me, read-only at the pinned .objectui-sha (a472b07167a3…, which I confirmed is the sha main records and the sha that checkout sits at):

naive prefix  '@objectstack/cli'      : 200
  of which    '@objectstack/client'   : 195
exact-boundary @objectstack/cli       :   6
scope control "from '@objectstack/"   : 545
specifier      'cli/console'          :   0

⇒ @objectstack/cli is a prefix of @objectstack/client. 195 of those 200 lines are the client package. The "control" was live on a different string than the one whose absence it was vouching for — so it demonstrated that @objectstack/client is used, which is not the question.

⭐ That is precisely the failure I spend this session hunting: a control that cannot fail for the reason you care about. I did not merely miss it — I held it up as exemplary. The round-2 implementer caught it, declined to publish 200 as the control, and cited the sound one instead: 545 lines importing from the @objectstack/ scope, which is live for the corpus without depending on the collision. The changeset now carries that number, not mine.

The zero itself survives — cli/console occurs 0 times, and none of the ten names occurs as an identifier except CONSOLE_PATH twice, both comment prose, neither an import. The reading was right; my evidence for it was not.

The changeset now states each reading at exactly its measured strength

In this repo: no importer of any of the ten outside packages/cli itself. In objectui: a real zero, re-derived at the pinned .objectui-sha … against a positive control of 545 lines that do import from the @objectstack/ scope, so the corpus is live and the zero is a reading rather than a silence. In cloud: NOT MEASURED, which is not the same thing as zero … Every channel tried refused, and an unreachable repository never reads as [zero].

That is the framing route A rests on, now in the artifact that becomes the CHANGELOG rather than only in the source.

⛔ Finding 5 declined — its premise was false, and that was measured

Round 2 did not simply disagree: .objectui-sha is a472b07… at all five original commits, at the merge base and at origin/main; the sha finding 5 rested on (67dadd602a3) was the pin two bumps ago and is not a valid object in the objectui clone at all. So AGENTS.md's prescribed pre-removal step did run at the current pin, and its result is now recorded as a fifth reading in src/console.ts. ⇒ A second measurement error in an at-tier review, found by re-deriving rather than deferring.

Findings 2–4 were recorded in declaredExports's own docblock rather than repaired — a named default attributed to its local name, overloads yielding a loud false red, and export as namespace UMD as the one deliberate silent skip. Repairing any of them re-opens an instrument the review verified over 38 forms and would owe that probe again. Recording beats churning; ⛔ neither is dropping it.

⭐ Two gate readings worth keeping

• Its first gate harvest read the Reconciliation prose and silently dropped the convention block — 4 families — which is exactly the failure [finding] dispatch-gates' reconciliation line enumerates what sits OUTSIDE the runnable total and omits two blocks it printed itself — the WIDE-population block and the artifact rosters #16398 exists to name. --commands caught it. The prose is not the population.
• check:type-check-debt exited 3, which looks like a failure and is the gate's own documented PREREQUISITE NOT MET: an OOM, because the agent's NODE_OPTIONS=--max-old-space-size=4096 was tighter than the 6144 MB ceiling the gate itself pins. Re-run with headroom it is genuinely green (5 ledger entries re-measured, 55 raw tsc errors, none above its recorded number) — and it was counted as measured, not as a pass. An exit code is never a verdict.

Round 2 changed 0 non-comment lines under packages/, and the ten-bullet retired-name list is byte-identical to before. Commit stream: 7 commits, 0 closing keywords, #N still the empty set — the new commit contains no # character at all.

PR stays draft with needs:contract-review on card and PR until I land it.

Generated by Claude Code

Landing record — carriers cleared, enqueued 01:29:48Z

domain:cli execution PM seat (#6024). Head 3de25192891. Flipped ready and auto-merge armed; the queue takes it from here. ⛔ Nothing bypassed.

Against the arm-precondition list in scripts/pm/check-skill-line-ratchet.mjs:323 (清标即落地), item by item:

⛔ The one precondition I could not satisfy, recorded rather than dressed up

node scripts/pm/check-clause2-carriers.mjs --pair 16428   ->  exit 3
  PREREQUISITE NOT MET — GET /repos/... -> HTTP 403
  "0 pair(s) had been read when it failed, so this run is NOT a reading of a clean board"
  (--use-env-proxy: identical, exit 3)

The family's own classifier, check-half-states.mjs --probe, also exits 3 and names the cause: the transport authenticates but repo-scoped reads are refused — GET /rate_limit answers 200 with 15000 left while GET /repos/objectstack-ai/objectstack answers 403 with no x-ratelimit-* headers at all. A quota that is not being spent cannot be what blocks the read; the egress proxy is answering for repo-scoped paths. Its prescribed fix: "in a proxy-mediated seat, repo-scoped reads stay on the mcp__github__* tools, which take a different path and do work here."

⇒ I took the substance through that channel — both carriers read directly, before and after clearing — but the scripted reading itself is NOT MEASURED, and I am not recording exit 3 as a pass. ⭐ A GATE NOBODY CAN RUN IS INDISTINGUISHABLE FROM A GATE THAT FINDS NOTHING (#13526).

⚠️ Raised for the maintainer, not worked around: this precondition requires a reading the dispatching seat is structurally unable to produce. ⛔ I have not rewritten the rule and will not.

⛔ My governed-surface derivation was wrong the first time

I first restated the boundary with git diff --name-only origin/main HEAD and it listed AGENTS.md and .claude/skills/pm-dispatch/** — which would have made this a governed-surface PR and stopped the landing dead.

That is a two-dot diff: it reports files where main is ahead of the branch too. main had moved to c14ebfeb29d, which includes #16368 — a PR that touches exactly those paths. The tell was the unrelated metadata-protocol / rest files in the same list.

Re-derived with three-dot (origin/main...HEAD — what the branch changed since its merge-base):

.changeset/olive-donkeys-repeat.md          packages/cli/src/console.ts
packages/cli/README.md                      packages/cli/src/hook-body.ts
packages/cli/package.json                   packages/cli/src/utils/console.ts
                                            packages/cli/test/published-subpath-console.pin.test.ts

7 files, all packages/cli/** plus its changeset — not governed. content/docs/releases/ clean.

⭐ Worth stating as a rule, because it fails in the dangerous direction: on a branch whose base has moved, a two-dot diff manufactures governed-surface hits out of other people's landed work. The boundary must be read three-dot.

⭐ Step ③ earned its place in the order

Clearing the carrier re-triggered Check Changeset (in_progress at 01:23:22Z). Had I flipped ready first and enqueued, I would have done it on a pre-clear reading of the clause-② gate. It came back success at 01:24:08Z, in the final label state, and only then was this enqueued.

Commit stream the squash will concatenate, re-read at this head: 7 commits, 0 closing keywords, #N the empty set. The card relation is declared once, in the body. So #16046 will be closed by hand after landing, not by a trailer.

Generated by Claude Code