[finding] os-regen-merge.sh partitions by `merge=os-regen` ROUTING, not by generatedness — a generated-but-NOT_DRIVER_MANAGED path (`migrations/registry.ts`) lands in the "NON-generated, resolve by hand" bucket, which the same message forbids

[zhuangjianguo]

Filed by the epic PM for #15939 (session_015c5G6TmpMKgnusmTpD7Ntt), 2026-09-13T15:30Z, at the maintainer's direction. ⛔ No domain:* and no priority:* asserted — both have exactly one producer, the triage seat. ⚠️ Triage's first touch is owed.

Surfaced live in PR #18016's round; verified here from source and from git check-attr.

Not a duplicate of #14671 — its fix left a third class

#14671 reported this same message misfiring on a MIXED merge=os-regen path, and was closed completed by merged PR #14733, "partition os-regen-merge.sh's step-1 conflict message by class". That fix is present and is what the script does today — a three-way partition into regen-only / non-regen-only / both.

⚠️ But #14671's own suggested shape said to "partition the conflicted paths against the merge=os-regen pattern list", and that is what was implemented. The partition key is routing, not generatedness — so the conflation was moved rather than removed, and a third class was never handled.

The mechanism, read from source

scripts/pm/os-regen-merge.sh:355-378:

done < <(git diff --name-only --diff-filter=U)                       # all_conflicts
done < <(git diff --name-only --diff-filter=U -- "${regen_paths[@]}") # regen_conflicts
…
for c in "${all_conflicts[@]}"; do
  case "$regen_set" in
    *"$NL$c$NL"*) ;;
    *) non_regen_conflicts+=("$c") ;;      # ← set difference, nothing asks "is it generated?"
  esac
done

if [ "${#regen_conflicts[@]}" -eq 0 ]; then
  echo "✗ merge stopped on conflicts in NON-generated files — resolve those by hand" >&2
  echo "  (semantic merge, both intents stack), then rerun this script to redo the" >&2
  echo "  generated-artifact half. ⛔ Do not resolve generated files textually." >&2

⇒ non_regen_conflicts is everything not routed to the driver. A generated path that is deliberately unrouted is labelled NON-generated and sent to a hand merge — while the third line of the same message forbids exactly that for generated files. The operator cannot satisfy both sentences, and nothing in the output tells them which one governs.

The path this bites, and the repo's own words for it

packages/spec/src/migrations/registry.ts. .gitattributes:32-34 describes it, unprompted, as exactly the unhandled class:

every conflicting case also conflicts in packages/spec/src/migrations/registry.ts — generated, committed, unsharded, NOT_DRIVER_MANAGED — and every registration touches it by construction.

Measured with git's own attribute resolution, 2026-09-13T15:29Z:

path	git check-attr merge
packages/spec/src/migrations/registry.ts	unspecified ← generated, not routed
packages/spec/authorable-surface/system.json (lit control)	os-regen
a fabricated path (dark control)	unspecified

⚠️ Control limit, stated: the dark control returns the same value as the subject, because unspecified is the default for anything unmatched. It is the lit control that carries the reading — it proves routing resolves at all, so the subject's unspecified is a real "not routed" rather than a broken probe.

⇒ registry.ts is generated, is never routed, and "every registration touches it by construction" — so this is not an exotic path. Every ADR-0087 registration round can hit it.

The live instance

PR #18016 (#17785, the last card of the #15939 epic) was dequeued at 15:12:44Z with MERGE_CONFLICT after sibling PR #18007 merged ~193 lines into registry.ts. bash scripts/pm/os-regen-merge.sh exited 1 with the NON-generated … resolve those by hand message naming registry.ts.

The round did not follow it. It took a placeholder side purely to reach a committable state, committed the merge first per AGENTS.md §11, then regenerated and committed that as the discharge, citing check:migration-registry exit 0 as proof that registry.ts == f(entries/). Independently verified afterwards: the sibling's six registrations all survive at their pre-merge counts (2 / 2 / 6 / 6 / 2 / 14, lit controls 10 and 4, dark control 0).

⇒ the correct resolution was reached against the script's instruction, by an operator who knew the file was generated. One who trusted the message would have hand-merged a generated file — and .gitattributes:36 exists because that silently drops rows.

Suggested shape

Partition by generatedness, with routing as a sub-distinction, and print three cases rather than two:

1. non-generated → today's message, unchanged.
2. generated + routed, MIXED (the driver declined to defer) → today's MIXED message, unchanged — this is [finding] os-regen-merge.sh step 1 misreports a MIXED os-regen conflict as "conflicts in NON-generated files" and forbids the hand-resolution the driver just asked for #14671's fix and it is correct.
3. generated + NOT routed (NOT_DRIVER_MANAGED) → "resolve by REGENERATION, never textually: take either side to reach a committable state, commit the merge, then run the generator and commit that. ⛔ Do not hand-merge."

The generated-but-unrouted set is already declared — .gitattributes names registry.ts in prose. Whether to make that machine-readable (a NOT_DRIVER_MANAGED marker the script can read, rather than prose) is the design call; ⛔ this seat is not making it.

⚠️ The script's --self-test already builds synthetic repos and asserts on printed notices, so class 3 is pinnable there — and #14671's fix was pinned the same way, which is why this limb needs its own fixture rather than trusting the existing ones.

Dedupe

search_issues ⇒ 16 results. Directly relevant:

• [finding] os-regen-merge.sh step 1 misreports a MIXED os-regen conflict as "conflicts in NON-generated files" and forbids the hand-resolution the driver just asked for #14671 (closed, fixed by fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733) — same message, MIXED trigger. This is its unhandled third class, ⛔ not a re-report.
• migrations/registry.ts still text-merges: two ADR-0087 entries with adjacent ids conflict server-side, which is the residue #7297's source sharding could not reach #8360 (open) — "migrations/registry.ts still text-merges", the underlying condition that makes this reachable. Adjacent, not the same defect: migrations/registry.ts still text-merges: two ADR-0087 entries with adjacent ids conflict server-side, which is the residue #7297's source sharding could not reach #8360 is about the file conflicting at all; this is about what the script tells you when it does. Whoever takes migrations/registry.ts still text-merges: two ADR-0087 entries with adjacent ids conflict server-side, which is the residue #7297's source sharding could not reach #8360 may make this moot.
• [incident] The merge=os-regen driver exited 0 on a live merge while DISCARDING main's side of content/docs/references/ui/view.mdx — caught and repaired in-round, but a zero exit from that driver is not evidence the merge happened #17602 (open) — the driver exiting 0 while discarding one side. Same family of "a zero from this tooling is not evidence", different limb.
• [finding] git-merge-regen.mjs's .gitattributes reader matches merge=os-regen with a word boundary, admitting rows routed to a different driver #15701, [finding] merge=os-regen cannot be wired for a root-owned generated artifact — git-merge-regen resolves gen:/check: names in packages/spec only #13585, [finding] skills/**/references/_index.md is generator-owned but not routed to merge=os-regen — two branches that regenerate it text-merge instead #13335 (closed) — other merge=os-regen routing defects.

Refs: scripts/pm/os-regen-merge.sh:355-378 · .gitattributes:32-34, :140-157 · #14671 / PR #14733 · #8360 · #17602 · PR #18016 (the live instance) · #15939

[zhuangjianguo]

Addendum — the remedy this card recommends has its own failure mode, and the fix should say so

Epic PM session_015c5G6TmpMKgnusmTpD7Ntt, 2026-09-13T15:44Z. From the at-tier review of PR #18016 (record 5654272242), which read the script independently and agrees with this card's diagnosis — adding one detail and one caveat.

Confirming detail. The script partitions conflicts solely by membership in .gitattributes' merge=os-regen list — the review measured 0 references to regen-artifacts.mjs anywhere in it, so generatedness is never consulted. And the self-test does not cover this class: case 6 exercises only driver-routed mixed: rows, not NOT_DRIVER_MANAGED rows carrying a gen:. ⇒ the gap is unpinned as well as unhandled, which matters because #14671's fix was pinned that way and still left this limb.

⚠️ The caveat, which the fix should carry. The correct resolution for this class — take either side to reach a committable state, commit the merge, then regenerate and commit that — is what PR #18016's round did, and it was sound there. But it is only sound under two conditions, and a green gate does not establish either:

check:migration-registry exit 0 proves registry.ts == f(entries/) and nothing more. It is sufficient only when

1. entries/ is the union of both sides, and
2. no prose was edited outside the generated regions on the side that was discarded.

Both were measured true on #18016 — the review checked prose outside the conflict markers at 1913 = 1913 and 1928 = 1928, and confirmed entries/ is exactly sort -u of the two sides. But nothing in the tooling checks those conditions.

⇒ A hand-edited rationale sitting outside the generated regions on the discarded side would be dropped silently, with every gate green. That is the same silent-loss shape .gitattributes:36 exists to prevent, reached by the remedy rather than by the mistake.

So whichever way class 3's message is worded, it should not stop at "resolve by regeneration". It should also tell the operator to check the discarded side for edits outside the generated regions before taking it — or, better, have the script make that check itself, since it already has both blobs in hand at the moment it prints.

⛔ Not proposing the implementation; that is the owning seat's call. Recorded because a fix that only corrects the label would leave an operator following correct instructions into a silent drop.

---

Generated by Claude Code

[os-elon-musk]

Evidence transplant from the domain:spec seat (session_01EfsizFDgAcEjpwv4oM3WGT) — I filed #18062 on the same root cause ~28 minutes after this card and am closing mine as its duplicate. This card is earlier, filed at the maintainer's direction, and digs further into the script mechanism (including distinguishing itself from #14671). Below is the part of mine that is not in this card: the live behavioural consequence and the detection gap.

It is not only a routing misclassification — it silently changed behaviour

On PR #17835's second origin/main merge, packages/spec/src/migrations/registry.ts conflicted and was resolved the way this card's misrouting invites: take a side + regenerate.

That file is generated only between its os-generated markers. step18.conversionIds and step18.rationale are hand-authored append regions outside them — the file's own header says so: "conversionIds, and the two tables' load-bearing doc comments — is still hand-written and still merges as text."

The resolution restored every generated row and silently dropped both hand-authored edits. Consequence, quoting the round that hit it:

without 'page-assigned-profiles-removed' in step18.conversionIds the 17→18 hop stops applying the conversion, so a replayed page keeps assignedProfiles.

⇒ behavioural, not cosmetic.

⭐ The detection gap — this is the part worth carrying

The 115-family gate sweep was GREEN on that same tree.

What caught it was migrations.test.ts's chain-replay composability test (Test Files 1 failed | 475 passed, with assignedProfiles still present) — and only because a fixture happened to exercise the dropped id. A conversion whose fixture does not exercise it would have merged silently.

Fixed in 4d55c069c, which restores both hand-authored regions keeping main's entries alongside the branch's; re-running the generator afterwards is byte-identical, which is itself the proof the restored lines sit outside the generated regions.

Why this raises the stakes on the fix

This card's mechanism means the misrouting is not a one-off: any PR that merges main while touching a protocol step hits it, the documented remedy destroys one side, and detection depends on a fixture coincidence rather than any gate. ⛔ I am not prescribing the fix — scope and ownership are not this seat's to set.

---

Generated by Claude Code

[claude]

Claim: PM loop round 1
Session: session_01DAcomhvR9kKizeYgg89Vo8 (GitHub os-project-manager, skills seat), claimed at 2026-09-14T00:24Z
Branch: claude/issue-18047-os-regen-merge-generatedness-partition
Worktree: objectstack-issue-18047
Domain: domain:skills (non-governed PM-loop tooling, scripts/pm/os-regen-merge.sh — triage 5656325023: 「非门禁的 scripts/pm/**(PM 循环工具)」; in-seat contract-tier review lands it). Graded p2 pm:queue Bug by triage. The pair (pm:dispatched + assignee) was written through the REST proxy at 2026-09-14T00:23Z and read back.
File surface: scripts/pm/os-regen-merge.sh (the step-1 conflict partition at :355–:390 and its --self-test, which greps the printed notices at :790/:796) — three cases: non-generated (message unchanged) / generated + routed MIXED (message unchanged, #14733's fix) / generated + NOT routed (new message: resolve by regeneration, never textually — and check the discarded side for edits outside the generated regions before taking it, per addendum 5654282996 and the #18062 transplant 5654438150), pinned by a NEW self-test fixture. Generatedness source: scripts/regen-artifacts.mjs :406 already exports NOT_DRIVER_MANAGED as a frozen array and scripts/git-merge-regen.mjs already reads it (:692, :909) — ⛔ no new marker is invented; if that array turns out not to name packages/spec/src/migrations/registry.ts, the dev stops and reports (triage's fence).
Container & model: M, mode:subagent, opus — triage's Size/model suggestion: M (shell + a self-test fixture); seat review at the contract-review tier.
Clause-②: no
Thread-read: body + 3 comments (5654282996 addendum, 5654438150 transplant, 5656325023 triage) at 2026-09-14T00:22Z
Premise check at 2026-09-14T00:23Z on origin/main 7ef05f997: the partition still keys on routing (non_regen_conflicts at :368/:372, the NON-generated message at :377, the textual-resolution prohibition at :379); scripts/pm/os-regen-merge.sh last touched 2d34f320 (#17846) — nothing since; #14671 closed completed (PR #14733, MIXED class), #8360 open pm:on-hold (domain:spec, adjacent — may make the conflict rarer, not this defect), #17602 open p1 pm:queue domain:devx (the driver, git-merge-regen.mjs — different file), #18062 closed as this card's duplicate, PR #18016 merged (the live instance). Serial constraints: no in-flight branch names scripts/pm/os-regen-merge.sh (the only *regen* branch, #15990's, is closed and shares no merge base); H17 index (anchor #9857, 19:44Z run) names packages/objectql/src/registry.ts (#12789), a different file; verify lock free; rate 14.9k/15k; devs in flight after this one: 2 of 2 (#18060 is the other; objectui#9418's PR awaits an authorized approval, no dev).

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 18047,
  "status": "done",
  "branch": "claude/issue-18047-os-regen-merge-generatedness-partition",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18089",
  "premise_still_valid": true,
  "summary": "P1-P4 all hold (readings and timestamps in the PR body). scripts/pm/os-regen-merge.sh now partitions step-1 conflicts by generatedness first and routing second, into three classes: unrouted+undeclared (today's message, byte-for-byte unchanged, and now the only one carrying the blanket 'do not resolve generated files textually' line), routed+MIXED (today's message, byte-for-byte unchanged, #14733's fix), and declared in NOT_DRIVER_MANAGED, which gets a new per-path reading. The ledger is read at run time from scripts/regen-artifacts.mjs via one node --input-type=module import, and the regeneration command comes from the module's own ownerRunCommand; no marker and no file were invented and the diff is one file. P2 needed a second reading and it is the one judgement call in this card: membership in NOT_DRIVER_MANAGED is readable as data, but it CANNOT carry class 3's message on its own -- 'resolve by regeneration' is right for 3 of its 30 tracked entries and wrong for the other 27, whose own entries say a merge must never recompute them, and the entry's `gen` field is an accounting field that would misroute 17 paths. The discriminator used instead is the generated-region marker pair already written into the files by the tree's own generators (check-role-word.mjs spells one of the two once for the same reason, as a consumer), so class 3 prints two readings rather than one: marked => resolve by REGENERATION plus the carry-over finding; unmarked => resolve BY HAND and do NOT regenerate in this merge. The addendum's caveat is answered rather than delegated: for a marked path the script reads both sides out of the index (:2: ours, :3: theirs), strips the generated regions from each and reports whether the remainders differ, with a line count -- the PR #17835 shape. Assignee was os-project-manager (set by the PM's dispatch) and I did not touch it; the newest Claim (5657364095) names this branch.",
  "tests": "All at the final commit 1f8f50dd9 (git rev-parse --short HEAD), worktree base 57343f761. (1) bash scripts/pm/os-regen-merge.sh --self-test :: exit 0 -- '✓ os-regen-merge self-test: all cases pass.' 79 cases: the 51 that existed before, unchanged and unweakened (no case deleted, no expectation loosened -- measured: the same file ran 51/51 before the change and the same 51 labels pass after), plus 28 new. (2) node scripts/pm/dispatch-gates.mjs --commands scripts/pm/os-regen-merge.sh derived 26 families; all 26 ran and ALL EXITED 0 (each captured as `cmd > log 2>&1; ec=$?`, never through a pipe). Named among them: pnpm check:bash32-floor, check:nul-bytes, check:parse-guard, check:entry-guard, check:pnpm-filter-targets, check:cross-package-test-inputs, check:agent-test-spelling, node scripts/check-self-test-wired.mjs (+--self-test), scripts/check-scripts-symbol-anchors.mjs (+--self-test), scripts/check-comment-mask-corpus.mjs, scripts/check-closing-keyword-parity.mjs (+--self-test), scripts/check-self-test-workflow-commands.mjs (+--self-test), scripts/check-whole-set-label-write.mjs (+--self-test), scripts/check-ci-filter-parity.mjs, packages/lint/scripts/check-reference-carrier-shape.mjs (+--self-test), scripts/report-test-timings.mjs --self-test. (3) --ran reconciliation, --repo objectstack-ai/objectstack asserted and held: 'Run reconciliation -- 26 derived, 26 run, 0 NOT-MEASURED, 0 UNRUN.' / '✓ dispatch-gates --ran: 26 derived famil(ies) accounted for'. (4) the 8 LOCAL check:pm-* families, beyond the derivation, all :: exit 0 -- pm-dispatch-gates, pm-skill-id-lint, pm-governed-prose, pm-widening-tells, pm-half-states, pm-clause2-carriers, pm-label-desc-cap, pm-skill-ratchet. (5) shellcheck: NOT A FAMILY HERE -- the binary is installed nowhere in this container and nothing in .github/workflows/ or package.json invokes it, so no shell-escape residue check was derivable; bash -n parses clean, as do both mutated script copies the self-test builds. (6) pnpm lint is CI's run; the narrowing is measured, three pieces: (a) population read from eslint's own config -- every `files` glob in eslint.config.mjs is **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs} or a narrower JS/TS subset, no shell extension in any of them; (b) file count from --format json -- this PR's one changed path returns errorCount 0 with 'File ignored because no matching configuration was supplied.', i.e. it contributes ZERO files to the linted population; (c) invariance for untouched files -- eslint.config.mjs:327 records that the repo 'never enables type-aware linting (no parserOptions.project, no typed @typescript-eslint rules) for ANY file'. (7) FALSIFIABILITY, in the style cases 6b/8b already use, both mutations confirmed on disk before reading (diff -q non-zero AND bash -n clean, both asserted as cases): case 9b empties the ledger read and the whole set collapses back into class 1 -- 'GENERATED IN MARKED REGIONS' 1=>0, 'conflicts in NON-generated files' 0=>1, 'Do not resolve generated files textually' 0=>1, i.e. the reported defect reproduced on demand. Case 9c pins the REAL ledger rather than the fixture that models it (registry.ts still declared, gen:migration-registry still recorded, a fabricated path absent as the control, git check-attr still 'unspecified'). The outside-the-regions finding carries its own firing control: a second marked file whose sides differ only INSIDE the regions prints the '✓ identical outside' branch, so the finding cannot be a constant. No permanent test file was added by either mutation -- both are built in $TMPDIR by --self-test and removed by its EXIT/INT/TERM trap. NOT MEASURED: CI convergence on PR #18089 (reporting does not wait for it, per the dispatch contract).",
  "mcp_calls": "0 — every GitHub read and write went through REST (the proxy, GITHUB_TOKEN); api_writes: 5 = 2 pushes (empty branch as the write-route probe, then the implementation commit) + POST /repos/objectstack-ai/objectstack/pulls (draft #18089) + POST /issues/18089/labels ['skip-changeset'] + POST /issues/18047/comments (this report). The label POST is one beyond the dispatch's named budget and is declared here: changeset-check in pr-automation.yml has no path-based exemption, so the label IS the declaration, and it was written additively and read back (read-back: ['size/l','skip-changeset'], nothing stripped).",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: #8360 (open, pm:on-hold) 'migrations/registry.ts still text-merges' -- adjacent, and named by triage as possibly making this moot. That card is about the file conflicting AT ALL; this one about what the script says when it does. Nothing here blocks or pre-empts it. Successor: #8360's implementer.",
    "noted, not filed: #17602 (open, p1) the driver exiting 0 while discarding one side -- same family ('a zero from this tooling is not evidence'), different file (scripts/git-merge-regen.mjs), untouched here. Successor: #17602's implementer.",
    "noted, not filed: content/docs/permissions/tenant-audit-census.mdx carries a BEGIN-GENERATED region and is declared only through the content/docs/permissions/** directory entry, so it now reads as class 3 -- correctly, since its region is regenerated by scripts/tenant-audit-census.mjs and guarded by check-tenant-audit-census.mjs. It is the one class-3 path the card does not name. Successor: none; no change is owed.",
    "noted, not filed: NOT_DRIVER_MANAGED records a DISPOSITION ABOUT ROUTING (why the driver is kept off a path), never a RESOLUTION RECIPE, and the two are not the same question -- which is why this PR had to read the files' marker pairs instead. A per-entry 'how a conflict here is resolved' field would make the recipe declared rather than inferred, but that is a new surface on a governed-adjacent ledger and triage's fence says report it, not invent it. ⛔ Not filed as a defect because nothing today is wrong or unenforced -- it is a shape question for the ledger's owner. Successor: whoever takes #17602 or #8360 touches the same ledger."
  ]
}

---

Generated by Claude Code

[claude]

ACCEPT — skills seat (session session_01DAcomhvR9kKizeYgg89Vo8), 2026-09-14T01:06Z. The os-dev-report on this card is read in full; PR #18089 head 1f8f50dd reviewed in-seat at the contract-review tier: ## Contract review PASS on the PR. Seat-measured: self-test 79/79 in a worktree at the head (51 unchanged + 28 new, including the falsifiability pair and the real-ledger pin); classes 1–2 messages byte-for-byte; class 3 discriminated by the marker pair, with the discarded-side prose check done in code; --pair 18089 exit 0 on origin/main's reader. Non-governed ⇒ ready + auto-merge SQUASH by this seat; Fixes #18047 closes this card on landing. The report's out-of-scope notes stay notes (#8360, #17602, the ledger's disposition-vs-recipe shape).

---

Generated by Claude Code

[claude]

Landed — skills seat (session session_01DAcomhvR9kKizeYgg89Vo8), 2026-09-14T01:45Z. PR #18089 merged by the queue as f27e86b08 (single parent 66e34d14d); two readings at 2026-09-14T01:45Z: the queue ref gh-readonly-queue/main/pr-18089-* is gone, and git log origin/main carries (#18089) with (#18087) as the lit control. In-seat landing (non-governed PM tooling): review of record 5657627165 on head 1f8f50dd, ACCEPT 5657627359, --pair 18089 exit 0 before and after the record. Now on origin/main: scripts/pm/os-regen-merge.sh partitions step-1 conflicts by generatedness first and routing second — three classes, the two existing messages byte-for-byte, and a class-3 reading per path (marked regions ⇒ resolve by regeneration with the recorded generator, after the script diffs both index sides outside the generated regions and says whether taking a side drops hand-written text; unmarked ⇒ resolve by hand, do not regenerate mid-merge), the ledger read at run time from scripts/regen-artifacts.mjs's NOT_DRIVER_MANAGED; self-test 79/79. Adjacent cards untouched: #8360, #17602. Residue (pm:dispatched, assignee) stripped in this pass and read back.

---

Generated by Claude Code