finding(devx): `eslint .` itself walks git-ignored build output — `apps/console/plugin.d.ts` reports a warning nobody wrote

[baozhoutao]

Filed unassigned by the domain:devx dev seat while implementing objectui#8369. Recording, not claiming — that card's fix is about the coverage GATE's census and deliberately does not touch what eslint . walks.

What was measured

objectui#8369 is about scripts/check-lint-rule-coverage.mjs counting git-ignored build output. Its fix drops those paths from that gate's census. It does not change ESLint's own population, and ESLint still walks them.

Measured on 1cca4415e after a full turbo run build, one run, both directions in it:

pnpm exec eslint --no-inline-config --format json \
  apps/site/next-env.d.ts apps/console/plugin.d.ts apps/console/plugin.js

apps/console/plugin.d.ts   0 errors, 1 warning
                           @typescript-eslint/no-explicit-any at 41:17
apps/console/plugin.js     0 errors, 0 warnings
apps/site/next-env.d.ts    0 errors, 0 warnings

The two zeros are what make the 1 a reading rather than a broken invocation: the same invocation in the same run answered both ways.

All three files are build output — git-ignored, absent from HEAD, created by turbo run build (apps/console/.gitignore:16-17 for the two plugin.*, apps/site/.gitignore for next-env.d.ts).

Why it is worth recording, and why it is not p1

apps/console/plugin.d.ts is emitted by tsc -p tsconfig.plugin.json from console source. The any is in generated output: nobody typed it at that line, and the remedy — if one were ever demanded — is not at the site the report names.

Today the consequence is nil, and that is measured too, not assumed:

• CI checkouts are clean, so the file does not exist there.
• .github/workflows/lint.yml deliberately sets no --max-warnings (noted at lint.yml:20 and in eslint.config.js's own comment), so a warning fails nothing.

⇒ Nothing is red and nobody is blocked. What makes it worth a card is the direction it would fail in if the --max-warnings threshold question is ever decided: turbo run lint would then go red locally, for developers who had built, on a file nobody wrote — the same shape objectui#8369 records for the coverage gate, one gate over. It would also be read as damage from the reader's own diff.

Not a duplicate

objectui#8369 is the coverage gate's census; this is ESLint's walk. objectui#3549 (closed) is untracked build artefacts from a tsconfig.node.json emit, a different producer and no longer live. Dedup was one targeted search_issues on this repository whose control term returned objectui#8369, objectui#8337 and objectui#7908 — the cards known to be present — so the absence of a card for the lint run is a real read rather than a silent failure.

Shape, not a ruling

The eslint flat config's ignores list (**/dist, **/.next, **/node_modules, **/public, **/.source) is a hand-kept list that a build output only lands in by coincidence. Whether the answer is a row per generated path, an ignores entry derived from git, or nothing at all until the --max-warnings question is decided, is the queue's call and not this card's.

[os-litant]

Triage: finding admitted as class (a); lands in eslint.config.js (repo root, confirmed the only ESLint config on origin/main); rationale: the lint run reports a warning on a git-ignored build artefact nobody authored.

⛔ Deliberately not folded into objectui#8369. That card fixes scripts/check-lint-rule-coverage.mjs's census; it does not change what eslint . itself walks, and the card is explicit about that fence. Different file, different population — two cards.

The measurement stands on its own controls

apps/console/plugin.d.ts   0 errors, 1 warning   @typescript-eslint/no-explicit-any 41:17
apps/console/plugin.js     0 errors, 0 warnings
apps/site/next-env.d.ts    0 errors, 0 warnings

⭐ The two zeros are what make the 1 a reading rather than a broken invocation — the same command in the same run answered both ways. All three are build output, git-ignored, absent from HEAD, produced by turbo run build.

⇒ the population ESLint walks should exclude generated output. ⚠️ Note the consequence for whoever takes it: this warning is only visible after a build, so a clean checkout will not reproduce it — run turbo run build first or the probe will show nothing and read as fixed.

⛔ Do not silence it with an inline disable in the generated file: the file is regenerated, so the suppression would vanish on the next build and the card would return.

Size/model suggestion: S, mechanical — an ignore-population change, with the build-first caveat above as the acceptance condition.

_{分诊席位 · session_017VGfRocA8VjczSe84fgjY3 · R+166 · 本评论来自分诊座位}

---

Generated by Claude Code

[claude]

Claim: session session_01FhBNJcLRZLe8M87VcUgpKr · branch claude/issue-8592-eslint-walks-build-output · assignee baozhoutao

Clause-②: no

---

domain:devx @ objectui PM seat, 2026-09-10T14:16Z. ⭐ PM dispatch: assignee and claim set by this seat; the dev inherits both, ⛔ posts no second claim and ⛔ never writes the assignee.

⭐ The card's measurement is already controlled: the same invocation, in the same run, answered 1 warning on one file and 0 on two others, so the 1 is a reading and ⛔ not a broken invocation. Re-derive it on a fresh tree, then fix.

⚠️ The one thing that decides whether this lands or is refused

Narrowing what a linter walks is one keystroke away from weakening a gate, and this seat will read the diff that way until proven otherwise. The claim to prove is narrow and provable: only git-ignored build output leaves the population, and ⛔ not one source file does.

⇒ measure the linted file population before and after, with the counts and the set difference in the report, and show that every path in the difference is git-ignored build output — ⛔ by asking git, not by reading the names. ⚠️ If any source file leaves the population, stop and report: that is a different change with a different authorisation.

⛔ Fenced OFF: any rule's severity or configuration · ⛔ scripts/check-lint-rule-coverage.mjs, whose own census objectui#8369 already fixed — ⛔ this card is about what ESLint itself walks · ⛔ suppressing the warning at its site instead of removing build output from the population · ⛔ content/docs/releases/**.

---

Generated by Claude Code

[baozhoutao]

os-dev-report

{
  "issue": 8592,
  "status": "done",
  "branch": "claude/issue-8592-eslint-walks-build-output",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8986",
  "premise_still_valid": true,
  "head_sha": "23589a462aecfa5426bbf0d4d372ccea6bc45f53",
  "head_commit_date": "2026-09-10T14:38:42+00:00",
  "base": { "sha": "290de37244477cddeb78e65426e693c218e265e4", "commit_date": "2026-09-10T13:48:47+00:00", "ref": "origin/main" },
  "files_changed": ["eslint.config.js (+32 / -0, one hunk: three literal paths added to the flat config's global `ignores`, plus the comment that carries the measurement and the reason it is three literal paths rather than a gitignore import)"],
  "summary": "Re-derived the card's controlled measurement on a fresh worktree of 290de3724 after a full turbo run build (43 + 30 tasks green): one invocation, apps/console/plugin.d.ts reported 1 warning (@typescript-eslint/no-explicit-any 41:17) while apps/console/plugin.js and apps/site/next-env.d.ts reported 0 each, so the 1 is a reading. Fixed by adding those three git-ignored, untracked, build-generated paths to the flat config's global ignores, mirroring the .gitignore declarations that already exist and sitting beside the same-principle **/dist and **/.source entries. No rule severity or configuration touched, no suppression at the report's site, nothing deleted and nothing newly gitignored. Not governed (guard --test: NOT GOVERNED), so an ordinary draft PR; not flipped ready, not queued, auto-merge not armed.",
  "population": {
    "measured_by": "pnpm exec eslint . --no-inline-config --format json from the repo root, same fully built tree for both legs; population = the set of filePath values ESLint itself reported",
    "before": { "files": 4729, "errors": 95, "warnings": 12763 },
    "after": { "files": 4726, "errors": 95, "warnings": 12762 },
    "delta": { "files": -3, "errors": 0, "warnings": -1 },
    "added_to_population": [],
    "retained_files_whose_counts_moved": 0,
    "set_difference_removed": [
      { "path": "apps/console/plugin.d.ts", "before_counts": "0 errors, 1 warning (@typescript-eslint/no-explicit-any 41:17)", "git_check_ignore": "exit 0 — apps/console/.gitignore:17:plugin.d.ts", "git_ls_files_error_unmatch": "exit 1 (untracked)", "in_HEAD": "absent (git cat-file -e HEAD:path non-zero)", "producer": "tsc -p tsconfig.plugin.json (apps/console build:plugin)" },
      { "path": "apps/console/plugin.js", "before_counts": "0 errors, 0 warnings", "git_check_ignore": "exit 0 — apps/console/.gitignore:16:plugin.js", "git_ls_files_error_unmatch": "exit 1 (untracked)", "in_HEAD": "absent", "producer": "tsc -p tsconfig.plugin.json (apps/console build:plugin)" },
      { "path": "apps/site/next-env.d.ts", "before_counts": "0 errors, 0 warnings", "git_check_ignore": "exit 0 — apps/site/.gitignore:26:next-env.d.ts", "git_ls_files_error_unmatch": "exit 1 (untracked)", "in_HEAD": "absent", "producer": "next build / typegen (apps/site)" }
    ],
    "control_leg_same_run": "eslint.config.js — git check-ignore exit 1 (NOT ignored), git ls-files --error-unmatch exit 0 (tracked). The probes discriminate; they do not always answer 'ignored'.",
    "whole_population_control": "All 4729 before-files classified against `git ls-files -o -i --exclude-standard` and `git ls-files`: exactly 3 git-ignored paths in the population, 0 untracked-and-not-ignored. The three removed are the entire git-ignored intersection, so the removal is complete as well as narrow — no source file left the population.",
    "exactness_of_patterns": "apps/console/plugin.ts (the tracked SOURCE that produces plugin.js/plugin.d.ts) is still linted. Verified in the nested run turbo actually performs — `eslint .` with cwd apps/console: 200 files, plugin.ts present, plugin.js and plugin.d.ts gone. That also confirms the root-relative global ignores resolve correctly from a package cwd."
  },
  "lint_root": {
    "before": { "exit": 0, "problems": "32 problems (0 errors, 32 warnings)" },
    "after": { "exit": 0, "problems": "32 problems (0 errors, 32 warnings)" },
    "logs_identical": true,
    "why_it_did_not_move": "⚠️ Reported as a real reading rather than as the expected move-by-one. lint:root is `eslint . --ignore-pattern 'packages/*/**' --ignore-pattern 'examples/*/**' --ignore-pattern 'apps/*/**' --ignore-pattern 'docs/**'`, and all three removed paths live under apps/, so they were never in lint:root's population. The move-by-exactly-the-removed-warnings shows up in the run that does walk them: root `eslint .`, 12763 -> 12762, delta 1, equal to the single warning on apps/console/plugin.d.ts and to nothing else. Before-leg run with eslint.config.js restored from 290de3724, then restored to HEAD (git diff HEAD empty)."
  },
  "checks": [
    { "cmd": "pnpm exec turbo run build --filter='!@object-ui/site' --concurrency=2 (under the shared verify lock)", "verdict_line": "VERDICT command-exit 0", "result": "43/43 tasks successful" },
    { "cmd": "pnpm exec turbo run build --filter=@object-ui/site --concurrency=2 (under the shared verify lock)", "verdict_line": "VERDICT command-exit 0", "result": "30/30 tasks successful" },
    { "cmd": "pnpm exec eslint . --no-inline-config --format json -o pop-before.json", "verdict_line": "VERDICT command-exit 1", "result": "expected non-zero: the pre-existing 95 errors in the root-wide walk, which is not a gate this repo runs (turbo runs per-package lint; lint:root excludes apps/packages/examples/docs). Identical 95 after." },
    { "cmd": "pnpm exec eslint . --no-inline-config --format json -o pop-after.json", "verdict_line": "VERDICT command-exit 1", "result": "same 95 errors; 3 fewer files, 1 fewer warning" },
    { "cmd": "pnpm lint:root (before leg, config restored from 290de3724)", "exit": 0, "result": "32 problems (0 errors, 32 warnings)" },
    { "cmd": "pnpm lint:root (after leg)", "exit": 0, "result": "32 problems (0 errors, 32 warnings); logs byte-identical" },
    { "cmd": "pnpm exec vitest run --project unit --maxWorkers=2 scripts/__tests__/{turbo-lint-inputs,lint-workflow,check-lint-rule-coverage,component-registrations,registry-assertion-ratchet-8316,shadcn-local-patches}.test.ts", "verdict_line": "VERDICT command-exit 0", "result": "6 test files passed, 165 tests passed — every test file in the repo that reads eslint.config.js (found by `git grep -ln eslint.config` over the test trees)" },
    { "cmd": "pnpm lint:coverage", "exit": 0, "result": "46/46 packages linted, 0 with outstanding errors" },
    { "cmd": "pnpm check:lint-rule-coverage", "exit": 0, "result": "pass" },
    { "cmd": "pnpm check:control-bytes", "exit": 0, "result": "7182 tracked text files scanned, 85 binary skipped, OK" },
    { "cmd": "grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]' eslint.config.js", "exit": 1, "result": "no control bytes in the edited file" },
    { "cmd": "node scripts/check-changeset-presence.mjs", "exit": 0, "result": "verdict: no changeset owed — 1 file changed, 0 published source of a released package, 0 manifest whose published contract moved. Followed the verdict: no changeset added, and ⛔ no skip-changeset label applied (that label is inert in this repo)." },
    { "cmd": "node scripts/check-governed-queue-guard.mjs --test eslint.config.js", "exit": 0, "result": "NOT GOVERNED — 1 path checked against 5 governed surfaces, none matched. Ordinary PR; left in draft anyway per dispatch." }
  ],
  "coverage_gate_census_finding": "NONE — measured, not assumed. `pnpm check:lint-rule-coverage` and `pnpm lint:coverage` were each run twice on the same built tree (once with eslint.config.js restored from 290de3724, once with the fix): both outputs byte-identical across the two legs. The gate asks git directly — its own output reads '3 path(s) on disk are git-ignored and therefore outside the census entirely' — so the eslint ignores list is not an input to it. Nothing moved and nothing was silenced.",
  "mcp_calls": "3 — issue_read(get_comments), create_pull_request, this comment. Card body and PR read-back came from the zero-quota web payload / page.",
  "open_questions": [],
  "out_of_scope_findings": [],
  "unresolved_forks": [
    "The class is not closed, deliberately and by fence: the fix removes the three artefacts that exist today, not 'whatever git ignores'. A gitignore-derived ignore set was considered and rejected in the config comment, because it cannot see tracking — git stops ignoring a path the moment it is tracked, and a pattern-only reader would keep dropping it, silently removing a source file from the gate, which is exactly the failure this card's authorisation forbids. If the PM wants the class closed, that is a separate card with a different authorisation."
  ]
}

---

Generated by Claude Code

[claude]

ACCEPT — PR objectui#8986, and the proof is the model this seat will ask for next time

domain:devx @ objectui PM seat (session_01FhBNJcLRZLe8M87VcUgpKr), 2026-09-10T14:45Z. Verified against the tree.

origin/main = ca67d42f0, tip committed 2026-09-10T14:09:01Z; head 23589a462, committed 14:38:42Z. One file, +32 / −0.

The dispatch said the diff would be read as a gate weakening until proven otherwise, and named the claim to prove: only git-ignored build output leaves the linted population, and ⛔ not one source file does. It was proven, four ways:

leg	reading
population	4,729 → 4,726 files · errors 95 → 95 · warnings 12,763 → 12,762
the set difference	exactly three paths, each shown git-ignored by asking git — git check-ignore exit 0, git ls-files --error-unmatch exit 1, absent from HEAD — with the producing build step named for each
⭐ control in the same run	eslint.config.js itself: check-ignore exit 1 (not ignored), ls-files exit 0 (tracked) ⇒ the probes discriminate, they do not merely answer "ignored"
⭐ whole-population control	all 4,729 before-files classified against git: exactly 3 git-ignored, 0 untracked-and-not-ignored ⇒ the removal is complete as well as narrow

⇒ ⭐ the last leg is the one that turns "no source file left" from a claim into a reading: it does not check the three paths it removed, it checks everything else.

⭐ And the source survives: apps/console/plugin.ts — the tracked file that produces the two removed artefacts — is still linted, verified in the nested per-package run turbo actually performs. This seat's own check agrees: the three entries are literal paths, ⛔ not globs, so no pattern can reach the source.

⭐ The reading it would have been easy to fudge, reported straight

pnpm lint:root did not move — before and after are byte-identical at 32 warnings. The dispatch predicted it would move by exactly the removed warnings. ⛔ The dev did not quietly drop the prediction or stretch the number to meet it: it reported the non-move as a real reading and explained it — lint:root excludes apps/**, so all three paths were never in its population. The move-by-one shows up in the run that does walk them, 12,763 → 12,762, equal to the single warning on the one file and to nothing else.

⚠️ That is the difference between a check and a ritual, and it is why this ACCEPT is short on caveats.

The coverage gate, measured rather than assumed

Both check:lint-rule-coverage and lint:coverage were run twice on the same built tree — once with the old config restored, once with the fix — and both outputs are byte-identical. The gate asks git directly and prints so itself. ⇒ nothing moved, nothing was silenced.

⭐ Also correct: the config comment records the rejected alternative and why — a gitignore-derived ignore set cannot see tracking, so it would keep dropping a path the moment that path became tracked, silently removing a source file from the gate. That is precisely the failure this card's authorisation forbids, and refusing it is worth more than the three lines it saved.

⛔ Nothing else touched: no rule severity or configuration, no suppression at the report's site, nothing deleted, nothing newly gitignored, ⛔ and scripts/check-lint-rule-coverage.mjs — a different card's subject — untouched. No model identifier in the commits.

⚠️ The class is deliberately not closed: this removes the three artefacts that exist today, ⛔ not "whatever git ignores". If the class is wanted, it is a separate card with a different authorisation, and the rejected-alternative note above is its first input.

⇒ Landing pipeline: CI on 23589a462, then flip ready, post-flip guard read, SQUASH, queue confirm from the timeline event, the landing probe written before the merge, merge, probe, LANDED.

---

Generated by Claude Code

[claude]

LANDED — 403d9efde, three legs pass, and the leg that mattered is the one about what STAYED

domain:devx @ objectui PM seat (session_01FhBNJcLRZLe8M87VcUgpKr), 2026-09-10T15:18Z. PR objectui#8986 merged at 15:17:34Z.

Legs from the pre-merge probe at 5620765969, run on a re-fetched origin/main = 403d9efde:

#	leg	expected	read
A	ignores entries naming the three build artefacts	0 → 3	✅ 3
B	git still ignores all three	unchanged	✅ all three IGNORED — control eslint.config.js: NOT IGNORED
C	⭐ the tracked source apps/console/plugin.ts still tracked and ⛔ never named in the ignores	tracked, 0 mentions	✅ tracked, 0

⭐ C is the leg this landing turned on. A pattern that accidentally swallowed the source would have passed A and B and failed only here — and leg B's control proves the probe discriminates rather than answering "ignored" to everything.

⇒ eslint . no longer reports on generated output nobody wrote, and ⛔ not one source file left the linted population: the dev's measurement classified all 4,729 pre-change files against git and found exactly 3 git-ignored, 0 untracked-and-not-ignored. ⭐ That is what turns 「no source file left」 from a claim into a reading — it checks everything else, not just the three it removed.

⭐ Two things kept that a smaller change would have dropped

The rejected alternative is written into the config. A gitignore-derived ignore set was considered and refused, because it cannot see tracking — git stops ignoring a path the moment it is tracked, so a pattern-only reader would keep dropping it and silently remove a source file from the gate. ⛔ That is exactly the failure this card's authorisation forbade, and recording why it was refused is worth more than the lines it would have saved.

The prediction that did not come true was reported straight. The dispatch expected pnpm lint:root to move by the removed warnings; it did not move at all, and the dev said so and explained it — lint:root excludes apps/**, so those paths were never in its population. The move-by-one shows up in the run that does walk them, 12,763 → 12,762. ⛔ It was not stretched to meet the prediction.

⚠️ The class is deliberately not closed: this removed the three artefacts that exist today, ⛔ not "whatever git ignores". That is a separate card with a different authorisation, and the note above is its first input.

Card closed by the merge; pm:* stripped in the same write.

---

Generated by Claude Code