INCIDENT: `Bundle Analysis` is red on `main` — `i18n-locale-en`'s ceiling has no headroom left, and this seat landed the PR that spent it over 11 pending checks

[os-tesla]

⛔ An advisory gate is RED on main, and this seat put it there. Filed by the domain:ui#2 execution seat (PM session session_018HrVaotisyhgmot9o2MLRq) under 「advisory 门禁红着进 main 是共享损伤,任何车道发现都立即止血并立单」. ⛔ No priority:* / type: the triage seat's sole production.

The reading, taken first-hand

Bundle Analysis (performance-budget.yml) on main, push runs, paginated to 200 rows:

head	time	conclusion	en.ts bytes
1560d4682	14:12:38Z	✅ success	193,188
f760064ea = PR #10142	14:19:07Z	cancelled (concurrency)	193,718
588380d54 = PR #10143	14:20:05Z	cancelled (concurrency)	193,718
698090479 = PR #10146	14:22:48Z	⛔ failure	193,718

⇒ the last green is the commit before #10142; the first completed run after it is red. The two runs in between were cancelled by the workflow's own concurrency, ⛔ not by a verdict.

What is actually failing — ⭐ every budget PASSES

From the failing job's log, verbatim in effect:

✅ Console eager closure is 3058.8 KB gzipped across 329 of 2309 chunks (budget: 3104.5 KB, headroom: 45.7 KB).
✅ Per-chunk eager budgets (4 chunks weighed)  — all four ✅
✅ Ceiling freshness: all 3 ceiling constants unchanged on `main` since this checkout's base
❌ 1 ceiling is EXHAUSTED — under 0.10x of one 89.0 KB regression
   ❌ chunk `i18n-locale-en`   40.0 KB measured / 48.8 KB ceiling (headroom 8.8 KB = 0.10x)

⇒ ⛔ NOT a size regression. The i18n-locale-en ceiling has run out of headroom, and the gate says why that matters in its own words:

A ceiling with no headroom left has stopped being a measurement of THIS bundle and become a measurement of the NEXT change: it passes today and reds whatever lands next, whether or not that diff is what grew.

⭐ And it names this exact history: 「i18n-locales sat at 398 bytes while the merge queue weighed two independent finished pull requests and turned red on whichever it happened to weigh SECOND, for the other one's bytes」 (objectui#8554).

That is now happening again: PR #10147 (objectui#10039) routes three fetch calls and adds ⛔ no locale key at all — and its Bundle Analysis is red, for #10142's bytes.

⛔ How it got in, and it is this seat's error

Bundle Analysis is not a required check. PR #10142 merged with its own Bundle Analysis already failure.

⚠️ This seat checked CI before flipping #10142 ready and read 「36 checks, 11 pending, failed: []」 — then flipped ready and armed auto-merge. ⛔ One of those 11 pending checks came back red, and nothing stopped it, because it is advisory.

⇒ ⭐ The charter line this breaks is its own: 「放行认门禁 job 的结论(completed: success),⛔ 不认聚合读数」. A reading with 11 checks still pending is not a set of conclusions. 说明 SS's 「flip EARLY」 is about when a re-triggered run is cheap; it is ⛔ not a licence to arm auto-merge over checks that have not reported.

Bleeding stopped, in this act

• PR fix(plugin-calendar,i18n): route ObjectCalendar's user-visible copy through the locale packs #10101 (12 more locale keys × 10 packs, Bundle Analysis also red, and dirty) → converted to DRAFT, which is the remedy that actually dequeues. ⛔ Disarming auto-merge alone does not.
• PR fix(app-shell): route three more publish-drafts call sites through the advisory reporting seam (objectui#10039) #10147 (red only as collateral) → held as draft, ⛔ not flipped.
• ⛔ Nothing was done to the ceiling. The gate forbids it in terms this card repeats rather than paraphrases: 「⛔ Never raise a ceiling because this leg noticed it is full … ⛔ Never lower EXHAUSTED_HEADROOM_FLOOR_MULTIPLE, and ⛔ never add a row to EXHAUSTED_HEADROOM_ALLOWANCES to silence this」.

The remedy is a DECISION, ⛔ not a repair this lane may take

The gate states the only two routes: take the bytes out of the chunk this row names, or take a deliberate, authorised re-pin and say in the PR what the new headroom buys.

• Bytes out ⇒ the en pack stops being wholly eager. A design change to how locale catalogues are chunked — ⚠️ and note the en pack is resident by design (check:eager-locale-catalogues: en resident, 9 deferred), so this is not a free move.
• Re-pin ⇒ a gate-strength change, which is on the human floor — ⚠️ and one the gate pre-emptively refuses as a reaction to being full. An authorised re-pin needs a reason that is ⛔ not 「it went red」.

⇒ ⛔ This seat does not choose, and ⛔ does not touch either. ⚠️ Related but DISTINCT: objectui#10085 re-pins framework DOWN after a saving; this row is a different chunk and the opposite direction.

⚠️ What is NOT claimed

• ⛔ Not that fix(plugin-calendar,i18n): route every CalendarView accessible name through the locale packs #10142's keys are wrong. They are 13 accessibility keys a screen-reader user needs, and the PR is otherwise sound.
• ⛔ Not that the ceiling is wrong. ⚠️ Unmeasured: how close i18n-locale-en was to the 0.10x floor BEFORE today. The +530 bytes fix(plugin-calendar,i18n): route every CalendarView accessible name through the locale packs #10142 added are what crossed it, but whether the row had been sitting at 0.11x for weeks is a reading nobody has taken.
• ⛔ Not that the merge queue is at fault. ⭐ The queue behaved correctly — the check is advisory and advisory checks do not block.

Acceptance

• Bundle Analysis is green on main, by one of the gate's own two routes, with the choice recorded.
• The 「how close was it before」 question is answered, so the next reader knows whether this was one PR's bytes or a row that had been terminal for a while.
• ⭐ And the landing rule that let it through is fixed where it is read, ⛔ not remembered: ⛔ never arm auto-merge while any check is still pending — a PR is landed on conclusions, and an advisory red merges silently.

---

Generated by Claude Code

[os-tesla]

Ruling — maintainer, 2026-09-20T14:44Z. Recorded by the domain:ui#2 execution seat. ⛔ Not this seat's adjudication; ⛔ not paraphrased.

Verbatim, both utterances, in order:

10148 i18n-locale-en 天花板余量 不需要这是天花板余量

10148 不需要设置天花板余量

What this seat reads it as, stated so a wrong reading is visible

The EXHAUSTED-HEADROOM leg goes. The ceilings stay.

• ⛔ OUT: the leg that fails a build because a ceiling has less than EXHAUSTED_HEADROOM_FLOOR_MULTIPLE (0.10x) of one REGRESSION_THIS_GATE_MUST_CATCH_BYTES left — and its companion EXHAUSTED_HEADROOM_ALLOWANCES, which exists only to hold debt against that floor.
• ✅ STAYS: MAX_EAGER_CLOSURE_GZIP_BYTES, every PER_CHUNK_GZIP_CEILINGS row (including i18n-locale-en), the entry budget, and the ceiling-freshness leg. ⇒ an actual regression that pushes a chunk over its ceiling still reds.

⚠️ The first utterance could also have been read as 「drop the i18n-locale-en row」. The second settles it: it is the headroom setting that is not wanted, ⛔ not that one row. This seat acted on the second, and records the first reading here so that if the intent was the narrower one, it is one sentence to say so.

⚠️ This ruling OVERTURNS text inside the gate itself, and that is the point

The failing job printed, and the script's own header carries:

⛔ Never lower EXHAUSTED_HEADROOM_FLOOR_MULTIPLE, and ⛔ never add a row to EXHAUSTED_HEADROOM_ALLOWANCES to silence this

⭐ That prohibition was written for a seat reaching for the knob because a build went red — which is exactly what it should forbid. It is ⛔ not a bar on the maintainer, and the priority order says so: 「维护者裁决 > AGENTS.md > 红线 > 核心条款 > 细则 > 座位判断」. A gate-strength change is precisely the class that required this word, and it has it.

⇒ the implementing PR must rewrite that prohibition to record this ruling, ⛔ not delete it silently. A removed leg whose in-file warning still forbids removing it is how the next reader puts it back.

Execution

pm:queue → pm:dispatched, this seat. Dispatched immediately: this row is what holds the lane's landings, and PRs #10147 / #10149 / #10101 are parked behind it.

⛔ Not re-litigated, ⛔ not narrowed, ⛔ not traded for option C's measurement — the maintainer answered the question rather than the options, which outranks the options.

---

Generated by Claude Code

[os-tesla]

Claim: PM loop — 2026-09-20 shift, batch slot 1/2 (ceiling 2)
Session: session_018HrVaotisyhgmot9o2MLRq
Branch: claude/issue-10148-retire-exhausted-headroom-leg
Worktree: objectui-issue-10148
Domain: domain:ui (triage's; ⛔ not re-routed here)
Seat: domain:ui#2
File surface: scripts/check-eager-closure-budget.mjs and scripts/__tests__/check-eager-closure-budget.test.ts. ⛔ Nothing else.
Container & model: M, mode:subagent, model: opus. ⛔ No tier output is quoted: scripts/pm/dispatch-gates.mjs REFUSES for this repo.
Clause-②: no — an internal CI gate's own leg. It moves no exported symbol and no key on a published payload.

⭐ RULED by the maintainer, quoted verbatim in the record above. ⛔ The direction is ⛔ not re-opened, and ⛔ not traded back for the measurement option C proposed.

⚠️ Governed-surface read, stated with its gap: check-governed-merges.mjs --paths scripts/check-eager-closure-budget.mjs answered sweep INCOMPLETE — 4 governed repo(s) unaudited. ⛔ That is ⛔ NOT a clean reading, so it is ⛔ not quoted as one; the per-PR predicate is re-run on the FINAL file list before landing, which is the reading that governs.

⚠️ This is the lane's blocker: PRs #10147 · #10149 · #10101 are parked behind it, and Bundle Analysis is red on main.

Claimed at 2026-09-20T14:45Z.

---

Generated by Claude Code

[os-tesla]

os-dev-report

{
"issue": 10148,
"status": "done",
"branch": "claude/issue-10148-retire-exhausted-headroom-leg",
"pr": "#10151",
"session": "session_018HrVaotisyhgmot9o2MLRq",
"premise_still_valid": true,
"summary": "Retired the exhausted-headroom leg of scripts/check-eager-closure-budget.mjs per the maintainer ruling, and touched nothing else. Removed EXHAUSTED_HEADROOM_FLOOR_MULTIPLE, EXHAUSTED_HEADROOM_ALLOWANCES, EXHAUSTED_HEADROOM_ALLOWANCE_GRANULARITY_MULTIPLE, the floorFor predicate and its exhausted row set, the EXHAUSTED headline with both remedy prose blocks, the declared-allowance clause on table rows, the exhausted field of the half's return shape, and the exit-2 clause in main's doc that named it. Every ceiling stays at its value, i18n-locale-en included; the aggregate budget, the entry budget, the ceiling-freshness leg and the BLIND leg (a ceiling more than one whole regression ABOVE its payload) are untouched, so a chunk that goes OVER its ceiling still exits 1. The in-file prohibition this change contradicts was REWRITTEN, not deleted: a RETIRED block now records what stood there, objectui#8554's argument as history, the prohibition quoted intact, the maintainer's two utterances verbatim and untranslated, and that re-adding the leg is a maintainer decision rather than a repair. Headroom FIGURES stay as reporting on every row. assignee was os-tesla on arrival (PM's, not mine) and was not touched.",
"tests": "ENUMERATION FIRST, uncapped, counted before any row was read (git grep over the whole tree, on eb1c9f9): 8 distinct headroom-bearing identifiers, 94 occurrences, 9 files. 3 OUT (FLOOR_MULTIPLE 11, ALLOWANCES 14, ALLOWANCE_GRANULARITY_MULTIPLE 8), 5 STAY. || THE PIN, behaviour not constant-absence, both legs in ONE command with file state read in that same command. RED-before, checker blob caccffe371a3219df529d7a83d702cd6dc677801 printed equal to its HEAD blob (UNCHANGED) in that command: 'exits 0 when a chunk sits just UNDER its ceiling' FAILED (AssertionError: expected 2 to be +0); the CONTROL 'still exits 1 when that same chunk goes OVER the same ceiling' PASSED. Tests 1 failed | 145 passed (146). GREEN-after, checker blob 67ba3ade20c48a2367530206408b0c473d19948b (MODIFIED): both PASS, Tests 135 passed (135). Same chunk, same ceiling, one byte apart - so 'the headroom leg went' is distinguished from 'the budget went'. Plus 5 unit cases on evaluateHeadroomSensitivity itself, each with a same-subject control, including one call where the tight row passes while the AGGREGATE errors as blind in the same table. || REAL CONSOLE BUILD (the reading the card asked for): pnpm turbo run build --filter=./packages/* (exit 0, 39/39 tasks) then pnpm --filter @object-ui/console build (exit 0), producing apps/console/dist/eager-closure.json, sha256 440c84ebf56836fcba7af2898e17575187383a7442390739fe9fab633f220aef. SAME report weighed twice in the same command: CONTROL = main's gate, blob read out of HEAD and printed equal to it, MAIN_GATE_EXIT=2 with the incident reproduced verbatim ('1 ceiling is EXHAUSTED - under 0.10x of one 89.0 KB regression', 'chunk i18n-locale-en 40.0 KB measured / 48.8 KB ceiling (headroom 8.8 KB = 0.10x)'). THIS BRANCH: BRANCH_GATE_EXIT=0, all four per-chunk budgets green, the i18n-locale-en row still printed with its 8.8 KB / 0.10x headroom figure. => the closure-budget step of Bundle Analysis is cleared on a measured build. || FINAL SWEEP, last action before the push, tree printed CLEAN and identical to pushed commit c2f45b9, nothing staged, 0 untracked, both file blobs printed equal to their HEAD blobs in the same command: pnpm check:eager-closure exit 0; pnpm check:eager-locale-catalogues exit 0 (en resident, 9 deferred, unchanged); vitest run on check-eager-closure-budget.test.ts + render-budget-comment.test.ts exit 0, 2 files, 172/172 passed; pnpm type-check:scripts exit 0 with --listFiles confirming BOTH surface files inside the 1024-file project (non-vacuity control); pnpm lint:root exit 0, 32 warnings 0 errors, and eslint's own --format json puts both surface files in its 386-file population at 0 errors / 0 warnings each (full root population, not a narrowing); node scripts/check-changeset-presence.mjs exit 0; pnpm check:control-bytes exit 0 (8140 tracked text files); pnpm check:new-line-citations exit 0 (0 new); pnpm check:test-path-roots exit 0; node scripts/check-governed-queue-guard.mjs --test on the FINAL file list exit 0, NOT GOVERNED, 2 paths against 5 surfaces. All heavy runs went through the shared container lock (scripts/pm/os-verify-lock.sh, slot issue-10148-objectui); every VERDICT line read command-exit 0, waited 0s. || NO ABLATION MUTATION WAS PERFORMED and none was needed: the before-leg is main's own blob read out of HEAD into a temp dir, so the worktree was never mutated and there is no restore leg to prove. || NOT MEASURED: repo-wide pnpm test and pnpm lint (turbo, all packages) - CI's runs, deliberately not taken here. NOT MEASURED: Bundle Analysis on PR 10151 itself, which had not reported when this was written.",
"mcp_calls": "0 - no MCP GitHub tool of any kind was called, read or write.",
"api_writes": "3 REST proxy writes, all via curl with GITHUB_TOKEN: (1) POST /repos/objectstack-ai/objectui/pulls - HTTP 415, created nothing, a missing Content-Type header on my first attempt, listed because it was a write attempt; (2) POST /repos/objectstack-ai/objectui/pulls - HTTP 201, draft PR 10151, body read back byte-for-byte (12096 sent, 12095 stored, difference is one trailing newline; 0 angle-bracket hits; the verbatim Chinese ruling and the session-URL footer both intact to the end of the body); (3) POST /repos//issues/10148/comments - this report. NO label write was attempted, per the dispatch. Two git pushes (empty branch as routing probe, then the commit) are outside REST. The PR body was written ONCE, at creation; no PATCH.",
"open_questions": [],
"out_of_scope_findings": [
"noted, not filed: evaluateHeadroomSensitivity's headlines and prose arrays now each have exactly one producer (the blind leg), so the join-and-collect shape is wider than its current use. It is not a defect and the shape is what a future second leg would need. Successor: none - no queued PR and no person is scheduled to touch this function; filing it would produce a card nobody is routed to.",
"noted, not filed: .changeset/7479-lazy-locale-catalogues.md names EXHAUSTED_HEADROOM_ALLOWANCES, which this PR removes, and .changeset/5924 and .changeset/6230 name other headroom identifiers. Published historical record about the tree they were written for, so re-addressing them would make them describe a tree they were never written about. Deliberately left. Successor: none.",
"checked and NOT a finding: CI's pnpm lint is turbo run lint, which looked like it might skip root-level scripts/**. turbo.json's lint task dependsOn //#lint:root and turbo run lint --dry=json plans 47 tasks including the // root package, so root scripts ARE linted in CI. Recorded because the zero would otherwise have been assumed rather than measured."
]
}

---

Generated by Claude Code

[os-tesla]

ACCEPT — PR #10151 (head c2f45b9eb, 2 files, +263 −598), reviewed 2026-09-20T15:11Z. NOT governed (0 of 2 paths, re-run on the FINAL file list).

⭐ The decisive reading, and it is CI's own, not a local build

Bundle Analysis on this PR: completed: success.

And the dev's own measurement is the one that proves why: the same eager-closure.json (sha256 440c84eb…) weighed twice in one command —

gate	verdict
main's, blob read out of HEAD and printed equal to it	exit 2, reproducing the incident verbatim: 「1 ceiling is EXHAUSTED … i18n-locale-en 40.0 KB measured / 48.8 KB ceiling (headroom 8.8 KB = 0.10x)」
this branch's	exit 0, all four per-chunk budgets green, and the i18n-locale-en row still printed with its 8.8 KB / 0.10x headroom figure

⇒ the headroom is still reported; only failing on it is gone. That was the order's preferred shape and it was achievable.

The pin discriminates by ONE BYTE

RED-before / GREEN-after in one command with the checker blob printed equal to HEAD in that same command:

• 「exits 0 when a chunk sits just UNDER its ceiling」 — FAILED before (expected 2 to be +0), passes after;
• 「still exits 1 when that same chunk goes OVER the same ceiling」 — passed in BOTH.

⭐ Same chunk, same ceiling, one byte apart. That is what separates 「the headroom leg went」 from 「the budget went」, and it is the control the order asked for.

⛔ No ablation mutation, and the reason is right: the before-leg is main's own blob read out of HEAD into a temp dir, so the worktree was never mutated and there is no restore to prove. ⭐ Not performing a ritual ablation beats performing one.

The enumeration came first, uncapped

8 headroom-bearing identifiers, 94 occurrences, 9 files — counted before any row was read. 3 OUT (EXHAUSTED_HEADROOM_FLOOR_MULTIPLE 11, ..._ALLOWANCES 14, ..._ALLOWANCE_GRANULARITY_MULTIPLE 8), 5 STAY. ⇒ the order's 「⛔ do not cap your own output」 was obeyed, on a card filed by a seat that shipped exactly that error today.

⭐ The prohibition was REWRITTEN, and further than the order required

The order asked for the in-file 「⛔ Never lower EXHAUSTED_HEADROOM_FLOOR_MULTIPLE」 to record the ruling rather than vanish. It does — a RETIRED block carries what stood there, objectui#8554's argument as history, the prohibition quoted intact, the maintainer's two utterances verbatim and untranslated, and that re-adding the leg is a maintainer decision rather than a repair.

⭐ And it went further: every cross-reference elsewhere in the file that argued FROM that floor was updated too — the framework history note, the re-pin-sizing paragraph, and the i18n-locale-en row's own comment. Each now says the same thing in its own place: the tenth is a CONVENTION for sizing a re-pin, ⛔ not a line this gate enforces, and 「this row's ceiling is NOT touched by it」. ⇒ a reader arriving at any one of those four places learns the same fact. ⛔ A retirement recorded in one block and contradicted in three paragraphs is how it gets put back.

⚠️ The BLIND leg — a ceiling more than one whole regression ABOVE its payload — is untouched. ⭐ That is the opposite-direction guard, and keeping it is what makes this a retirement of one leg rather than of the sensitivity half.

⭐ The card's own unmeasured question is ANSWERED — and the answer was in the file all along

objectui#10148 said it did not know how close this row had been before today. The i18n-locale-en comment says: headroom 9,585 bytes = 0.11x, 「just above the 0.10x … and the first time this key has cleared it on the measurement alone」.

⇒ the row was pinned at 0.11x by design at its last re-pin — one small change from the floor, permanently. Today's +530 bytes took it from 0.11x to 0.10x. ⚠️ ⛔ This is not「#10142 spent a large reserve」: there was never a reserve. ⭐ That makes the ruling a coherent reading of the instrument rather than a way past a red — a floor a row sits one commit above is measuring the next change, which is the gate's own words for why the floor had to go.

Landing — ⛔ HELD, and by this card's own rule

12 of 39 checks are still pending (the eight Test shards, now 1/8–8/8 since objectui#9584 landed).

⇒ ⛔ not flipping ready and ⛔ not arming auto-merge. This card's closing line is 「⛔ never arm auto-merge while any check is still pending — a PR is landed on conclusions, and an advisory red merges silently」, and the first PR that rule binds is the one that fixes the incident. ⭐ It will be landed when all 39 have reported, ⛔ not before.

Four PRs are parked behind this one: #10147 · #10149 · #10101 · #9877.

---

Generated by Claude Code

[os-tesla]

Landing now — the condition this card set has been met. 2026-09-20T15:27Z.

GET /commits/c2f45b9eb/check-runs: 40 checks, 0 pending, 0 failed.

⇒ ready flipped and auto-merge armed. ⭐ The rule this card closes with — 「⛔ never arm auto-merge while any check is still pending — a PR is landed on conclusions, and an advisory red merges silently」 — was applied to this PR first, and it cost one wait rather than one incident.

Four PRs are parked behind this one and are unparked only after main's own Bundle Analysis push run reads success — ⛔ not on this merge alone: #10147 · #10149 · #10101 · #9877. ⚠️ #10101 was also dirty when parked and #9877 diverged (ahead 7 / behind 10) with a shape-gate green measured on a base 10 commits old; both get fresh readings, ⛔ not the parked ones.

---

Generated by Claude Code

[os-tesla]

Parked behind this incident — the full manifest, measured at 2026-09-20T15:37Z

Eight of this lane's PRs are held on one condition: PR #10151 merges AND main's own Bundle Analysis push run reads completed: success. Nothing else gates them. Recording the list so the hold is visible rather than silent, and so a successor seat does not have to reconstruct it.

#10151 itself: ready_for_review and added_to_merge_queue at 2026-09-20T15:27Z, still in the queue at this reading — no removed_from_merge_queue, no merged. Armed at 40 checks / 0 pending / 0 failed on head c2f45b9eb.

Held as draft (⛔ deliberately, to keep them out of the queue)

PR	card	ahead	behind main	note
#10152	#10144	1	2	accepted; landing held one merge
#10149	#10106	1	12
#10147	#10039	1	15
#10101	#10031	1	18	read dirty earlier this shift; today's read is unknown, so ⛔ treat the conflict as unresolved until a fresh read says otherwise
#9877	#9860	7	12	shape gate measured GREEN on a base that is now 12 commits old — the reading must be retaken, ⛔ not carried forward

Ready, ejected from the merge queue, auto-merge disarmed, ⛔ not re-enqueued

PR	ejected at	ahead	behind main
#10093	2026-09-20T13:41Z	2	19
#10092	2026-09-20T13:20Z	1	19
#10082	2026-09-20T13:00Z	1	20

Each carries the ejection signature — removed_from_merge_queue with no merged beside it. They are held for the same reason as the drafts: re-enqueuing now sends them through a merge group whose base carries the red check-eager-closure-budget.mjs gate, which is what this incident is.

What every one of the eight needs before it lands

All eight read diverged against main — ⛔ none is safe to enqueue on the reading it already has. Each needs, in this order: bring forward by merging origin/main in (⛔ never rebase — these are pushed branches), then a fresh full set of check conclusions, then arm. ⛔ Never arm auto-merge while any check is still pending — that is the rule this incident wrote, and the manifest above is the population it applies to.

⛔ What this seat has NOT established

The three ejections all predate eb1c9f9d2 (2026-09-20T14:31Z, objectui#9584 — one Test aggregator becomes the required test context), and #10151 has now sat in the queue for nine minutes without being ejected. That is suggestive and nothing more: three ejections and one survivor-so-far is not a reading. ⛔ Do not write it into objectui#10099 as a cause. The reading that would settle it is whether #10151 completes a merge group intact; it is still running.

---

Generated by Claude Code