devx(scripts): register check-bash32-floor.mjs in the upstream port pin at its own ref

[baozhoutao]

Fixes #8694

scripts/check-bash32-floor.mjs was ported from objectstack and left out of scripts/upstream-port-pin.json, so it had no drift gate — the exact failure class it exists to catch, since a construct missing from CONSTRUCTS reads as an approval. objectui#8288 retired the ledger-wide upstream.ref, so it can now be registered at the revision it was actually taken from without disturbing any other entry.

One new files[] entry. 140 insertions, 0 deletions, one file.

The ref: 61362932b5ad4c85b39169e70cf9be64d4332ce5

Deriving it was the work of the card, so here is how, and what is wrong with each alternative.

Three independent statements name 6136293, and none of them was taken on trust:

1. the port's own docblock — PORTED from objectstack-ai/objectstack scripts/check-bash32-floor.mjs at commit 6136293;
2. the wiring comment in .github/workflows/lint.yml:306 — Ported from objectstack scripts/check-bash32-floor.mjs at 6136293;
3. objectui#8385, the parent card — taken from objectstack 6136293.

⭐ The proof is not any of those three; it is byte equality. Reversing the 22 declared divergences out of this repository's copy reconstructs upstream's blob at 61362932b exactly — reconstruction === upstream is true as raw text, not merely as a digest — and the forward direction round-trips too. A ref that was not the source could not do that.

Rejected alternatives, each with what would have been wrong:

candidate	why rejected
upstream main today (ce7bae8b4)	The card's named trap. It happens to carry the same blob (git rev-parse on both trees returns f453895ba…), so the digest would have verified and nothing would have gone red — which is precisely what makes it dangerous. The ref documents which tree a human actually read; nobody read ce7bae8b4. Any upstream change between the two would have been absorbed into the divergence list as an "adaptation", inverting the gate.
abc10b27b, the last commit that TOUCHED the file at or before the port	Plausible-looking, and it breaks the ledger's established convention. The .claude/hooks/guard-main-checkout.selftest.sh entry is pinned at 70e77ec3b — a docs(rest) commit — while that file's last-touching commit is c2520416c. So the convention is tip-at-read-time, which is also what --resync --ref takes from the operator.
bf10debd5 or 70e77ec3b, the refs already in the ledger	Pure convenience: it would have kept the summary line's "distinct refs" count at 2. Those are refs this file's bytes were never taken from — the false-provenance bug objectui#8288 exists to make unavailable.

The acceptance probe, both verdict lines verbatim

Captured by redirect-then-capture, never through a pipe.

Before — exit=0:

✓ check-upstream-port-parity: 3 ported file(s) match objectstack-ai/objectstack modulo their declared divergences, each at its own pinned ref (2 distinct: bf10debd5, 70e77ec3b). (The digest is verified; the ref beside it is provenance and is NOT fetched.)

After — exit=0:

✓ check-upstream-port-parity: 4 ported file(s) match objectstack-ai/objectstack modulo their declared divergences, each at its own pinned ref (3 distinct: bf10debd5, 70e77ec3b, 61362932b). (The digest is verified; the ref beside it is provenance and is NOT fetched.)

⚠️ The distinct-ref count went 2 to 3, and that is the correct outcome, not a side effect. The card said to report which and why either way. It rose because this port was taken at a third revision; the only way to keep it at 2 was to pin a ref this file was never read at, which is the rejected row above. The gate prints one ref per ref by design (objectui#8288) and the wiring test asserts no entry's verdict line names a foreign ref — both still hold.

The 22 divergences

Derived from the real diff, not assumed: a minimal changed-region set with one line of context, expanded until each snippet is unique. The card named one (the shebang census); it is population-shebang-census-is-zero-here, and it is 1 of 22. --list reports every one of them as 1 match(es) in the ported copy, so no anchor is ambiguous.

The substantive ones, as opposed to the header-and-prose ones: population-roots-literal (this repository declares e2e/** where upstream declares .githooks/** — two of the four shell files it wrote itself live there), real-tree-legs-replace-byshebang-floor (upstream's live.byShebang > 0 is red here on day one), clean-tree-census-asserted-by-count, and the objectui#8404 host-premise family.

Proof the new entry can FAIL, two-sided

Both legs mutate on disk, prove the mutation landed before reading anything, and restore under trap … EXIT INT TERM.

leg	on-disk proof	result
digest wrong (one hex char flipped)	blob 2ea9063b4… moved to 985a320c3…	exit=1, reconstruction does not match the pinned upstream blob, and it prints both digests
a declared divergence wrong (population-roots-literal.ported corrupted)	blob 2ea9063b4… moved to 627a3f251…	exit=1, divergence `population-roots-literal`: expected its ported text exactly once, found 0

Restore proven both ways after each leg and at the end: git hash-object equals the HEAD blob 2ea9063b406f3be7518f4c81362bc77a379db251, and git diff HEAD is empty. The restore names HEAD explicitly rather than using a bare git checkout --, which would have taken the mutation back out of the index.

Gates, by required context

context	command	verdict
the card's own gate	node scripts/check-upstream-port-parity.mjs --self-test	exit=0 — ✓ check-upstream-port-parity self-test: 58 cases pass
Test (shard N/4)	pnpm exec vitest run scripts/	exit=0 — Test Files 148 passed | 2 skipped (150), Tests 4395 passed | 2 skipped (4397)
Type Check	pnpm exec tsc -p tsconfig.scripts.json	exit=0, no output
Changeset Declaration	node scripts/check-changeset-presence.mjs	exit=0 — ✅ No source or published contract of a released package changed in this range, so no changeset is owed. The gate's own line is the authority here: a ledger JSON is not published package source. No changeset and no label.
Control Byte Scan	node scripts/check-control-bytes.mjs	exit=0 — ✅ check-control-bytes: OK (scanned 7400 tracked text file(s); skipped 85 binary).
Lint	narrowed, declared below	no effect possible

Declared narrowing for Lint, with its three measurements. eslint's own population, read from --format json on a repo-wide run rather than guessed: 4,849 files, of which 0 are .json. The changed file is not among them; the control, scripts/check-upstream-port-parity.mjs, is. eslint says so itself a second way: --print-config scripts/upstream-port-pin.json prints undefined while the same command on the .mjs returns a config object. Invariance: eslint.config.js configures no type-aware linting (no project, projectService or parserOptions.project), so a file outside the population cannot move any other file's verdict — and the diff changes exactly one file.

Declared narrowing for Test. Two files in the whole repository read the pin path at runtime, both under scripts/: scripts/__tests__/upstream-port-parity-wiring.test.ts and the gate itself. Grep printed its matched lines and ran with a control that hit. The full scripts/ test population ran, not just the one file.

The stop condition: exactly one entry

git diff --numstat reads 140 0 — zero lines removed, so no existing line was touched at all, let alone an existing entry. Independently, the three pre-existing entries deep-compare identical before and after the write. The .claude/hooks/guard-main-checkout.selftest.sh entry is byte-identical and no re-sync was run against it. Governed-surface verdict for the changed path: NOT GOVERNED — 1 path(s) checked against 5 governed surface(s); none matched, with AGENTS.md as the control returning GOVERNED in the same run.

Out of scope, filed not folded: objectui#9206

Registering the file makes its own prose false, and the fences forbid editing it here — correctly, since editing the ported bytes would change the very divergence pairs this PR declares. Two locations, one argument written twice:

• scripts/check-bash32-floor.mjs lines 11, 162 and 170 still say it is not registered;
• ⭐ .github/workflows/lint.yml lines 306-313 still describe the retired global upstream.ref as the blocker. That copy is false on origin/main today, independent of this PR: objectui#8385 item 1 corrected only the .mjs — its changeset names that file alone — and this second copy was missed.

Two of the new entry's divergence why fields record the obligation in the ledger, so the next reader of the pin stands on it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FhBNJcLRZLe8M87VcUgpKr

---

Generated by Claude Code

[baozhoutao]

ACCEPT — objectui#8694 / PR #9207

Reviewed against the diff at a32110b88e5bc301c1abb9e9eb7930807d3414d7, not against the report. ls-remote, the report's pushed_sha and the branch head all agree.

1. Verified in the tree

claim	how	verdict
triage's stop condition — the diff touches exactly one new entry	git diff --numstat = 140 0 — ⛔ zero removed lines	✅
the three pre-existing entries are untouched	parsed both JSONs and deep-compared: added = ['scripts/check-bash32-floor.mjs'], removed = [], every pre-existing entry byte-identical, upstream block identical	✅ — nothing re-synced as a side effect, and ⛔ the governed .claude/hooks/ entry was not disturbed
the acceptance probe	3 entries / 2 distinct refs → 4 entries / 3 distinct refs	✅
entry shape	ref 40 chars, upstreamSha256 64 chars, 22 divergences, every one carrying {id, upstream, ported, why} with why ≥ 10 chars	✅
the ref is cited in the tree, not invented	.github/workflows/lint.yml:306 — "Ported from objectstack scripts/check-bash32-floor.mjs at 6136293"; scripts/check-bash32-floor.mjs:8 — "commit 6136293, which is where the class, the construct table and the…"	✅ two independent in-tree citations

NOT MEASURED by me — and the reason is worth more than the leg would have been. See §3.

2. The corrections, and three of them are to me

⭐ 1. The convenience trap was UNDETECTABLE, not merely forbidden. My order said picking upstream main would "silently convert every later upstream improvement into a declared divergence". The reality is sharper: upstream has not touched this file since 6136293, so upstream main today carries the same blob. The forbidden ref would have produced a fully green gate with a false provenance line — objectui#8288's exact failure re-created inside the card written to prevent it, with no signal anywhere. ⇒ my fence was right for a reason I did not know, which is not the same as being right.

⚠️ 2. --resync is not the route, and both triage and I implied it was. I carried the card's sentence — "scripts/** is not governed surface, so --resync needs no long-form flag here" — forward without checking what the flag does. It operates only on entries already in the pin; measured against the pre-change pin it exits 2: "no pinned file matches. Pass --path …". The file says so in its own header, which neither of us read:

The ledger REGISTERS a file; --resync REWRITES one. Those are different.

⇒ the ungoverned/long-form-flag note answers a question this card never reaches. A sentence inherited from a card is not a reading either.

⭐ 6. "Deriving that ref is the real work" pointed at the wrong half. The ref is written down in three places on origin/main; deriving it was the easy part. The real work was verifying it byte-exactly — reversing all 22 declared divergences out of this repo's copy reconstructs upstream's blob at 61362932b as raw text, not merely as a matching digest — and reading the ledger's ref convention off entry 3, which is pinned at 70e77ec3b, a commit that does not touch its own file (c2520416c did). ⇒ the convention is tip-at-read-time, no card mentions it, and getting it wrong would also have been green.

4. "The shebang-census half" is 1 of 22 and is not the substantive one. The port's own header names a different change as "THE PORT'S ONE SUBSTANTIVE CHANGE": POPULATION_ROOTS declares e2e/** where upstream declares .githooks/**. No card mentions it.

3. Triage's S, mechanical contradicts the card it graded, whose body says "the divergence list is real work, not a formality." Only the digest is mechanical; the rest is a 542-line diff over a 1,569-line file collapsed into 22 uniquely-matching pairs. The card was right and its own triage note wasn't.

⚠️ 9 — a correction to my standing dev brief, not to this card. In this repository pnpm lint is turbo run lint (per-package eslint .), ⛔ not eslint . --no-inline-config. That flag reports 95 errors and 12,934 warnings on an untouched tree by stripping disable directives CI honours, and those numbers are not a regression. Carried into the dispatch template so the next round does not spend a cycle chasing them.

3. ⭐ The probe leg I nearly wrote, and why it is NOT MEASURED

I dry-ran before writing, and the result is the most useful thing I learned this round.

scripts/check-upstream-port-parity.mjs imports node builtins only — no node_modules — so this seat can execute it, which would normally make a runner leg free. I ran it. Exit 0, four confident green lines:

✓ check-upstream-port-parity: 3 ported file(s) match objectstack-ai/objectstack@bf10debd5
  modulo their declared divergences.

⛔ That green is about a tree nobody asked about. This seat's working checkout sits at 28cfff491a, dated 2026-09-06 — 580 commits behind main — and its copy of the pin file still carries the retired global upstream.ref with no per-file refs: the pre-objectui#8288 shape. The verdict line even differs from the current one (no "each at its own pinned ref"), and the hooks entry reports 14 divergences where main has 2.

⇒ a runnable gate answered fluently, in the right format, with the right exit code, about a ledger shape the repository retired days ago. Nothing in the output says which tree it read. Pasted into a probe it would have been indistinguishable from a green about the merge commit.

⭐ That is the same shape as everything this board has paid for today: a plausible answer to a question nobody asked — a grep that counted comments, a ruling quoted as a reading, a frozen constant quoted as a live margin. ⇒ the gate's verdict stays NOT MEASURED here and CI's run on this head is the reading. Running it would have required checking out the merge commit, which means writing to a shared checkout — ⛔ not something a probe does.

4. Routed, ⛔ not folded in

objectui#9206 — this PR makes its own subject's prose false: scripts/check-bash32-floor.mjs still carries "## Why this port is not YET pinned" at its lines 12 and 162 (verified). ⛔ Correctly not fixed here — editing the ported bytes would change the very divergence pairs this PR declares, which is as clean a reason to file rather than fold as this lane has produced.

⭐ And it carries a half nobody had noticed: .github/workflows/lint.yml has described the retired global upstream.ref as the blocker since objectui#8288, because objectui#8385 item 1 corrected only the .mjs and missed the second copy. That is false on main today, independent of this PR.

Proceeding to the merge queue.

---

Generated by Claude Code

[baozhoutao]

Armed — auto-merge SQUASH, and the probe I will run afterwards, written first

Armed 2026-09-11T18:58:07Z on head a32110b88e5bc301c1abb9e9eb7930807d3414d7. ⓘ The arm call echoed method: MERGE; ⛔ that echo is not the authority — origin/main is linear and prior PRs' branch commits are not ancestors of it, so the queue squashes.

The probe, posted BEFORE the merge

Every expected value below was extracted from the tree at a32110b88e just now by parsing the JSON — ⛔ not retyped from the report. Post-merge legs are scoped to <merge>^ <merge>, ⛔ never origin/main. ⚠️ And every leg names an explicit ref: this seat's working checkout is 580 commits stale (§3 of the ACCEPT), so a command that reads the working directory is reading 2026-09-06.

L1 — the file set. git diff --name-only <merge>^ <merge> = exactly 1 path: scripts/upstream-port-pin.json. A second path is a FAIL.

L2 — triage's stop condition, carried across the merge. git diff --numstat <merge>^ <merge> = 140 0. ⛔ The zero is the assertion, not the 140: a removed line means something re-synced an entry that was not part of this work.

L3 — what must STAY, deep-compared rather than counted. Parse both JSONs and assert: the upstream block identical; removed = []; and the three pre-existing entries — scripts/pm/check-half-states.mjs, scripts/invoked-as.mjs, .claude/hooks/guard-main-checkout.selftest.sh — byte-identical object-for-object. ⭐ The third of those is governed surface already living in this ledger; it is the entry an over-broad re-sync would take, and this leg exists for it specifically.

L4 — what moved, two-sided against L3.

reading	<merge>^	<merge>
files[] entries	3	4
distinct ref values	2	3
entries whose ported is scripts/check-bash32-floor.mjs	0	1

and on the new entry, asserted as text:

ref            61362932b5ad4c85b39169e70cf9be64d4332ce5      (40 chars)
upstreamSha256 0da45049c680c2b2d58d52d637f17f7c45421a46a92a8dd0e6385dadb384dffa   (64 chars)
divergences    22, every one carrying {id, upstream, ported, why}, every `why` ≥ 10 chars

⛔ The counts alone would not distinguish "the right entry landed" from "an entry landed"; the two strings are what make them readable.

L5 — nothing moved in transit, by blob. scripts/upstream-port-pin.json on the merge commit = 2ea9063b406f3be7518f4c81362bc77a379db251. ⭐ Free cross-check that costs nothing: this is the same blob prefix the report quotes as the pre-mutation baseline in both ablation legs (2ea9063b4 → 985a320c3, 2ea9063b4 → 627a3f251). The round's ablation and my read of the tree are describing one object.

L6 — the absence claim, with its control in the same run. .claude/hooks/guard-main-checkout.selftest.sh must appear exactly once on the merge commit and be unchanged — ⛔ "exactly once", never "zero": the tombstone surviving is the assertion, and a leg that only checked it was not modified would pass equally if it had been deleted.

⛔ NOT MEASURED, deliberately: the gate's own verdict. check-upstream-port-parity.mjs imports node builtins only, so this seat can run it — and that is the trap rather than the opportunity. Run from this checkout it returns exit 0 with four green lines about a pre-objectui#8288 ledger shape from 2026-09-06, in the right format, with no indication which tree it read. ⇒ CI's run on this head is the reading. The full account is §3 of the ACCEPT above; it is the most useful thing this round taught me.

A leg that comes back amber will be published with its cause. ⛔ It will not be re-run into green.

---

Generated by Claude Code

[baozhoutao]

LANDED — 0f7f8e61c0

Merged as one squash commit. Probe run scoped to 0f7f8e61c0^ 0f7f8e61c0 — ⛔ never origin/main, which has moved twice since. All six legs green, each against the value posted before the merge.

leg	reading
L1 file set	1 — scripts/upstream-port-pin.json ✅
L2 triage's stop condition	git diff --numstat = 140 0 ✅ — ⛔ the zero is the assertion, and it held
L3 what must STAY	upstream block identical; removed = []; the three pre-existing entries byte-identical object-for-object ✅
L4 what moved	entries 3 → 4, distinct refs 2 → 3; ref 61362932b5ad4c85b39169e70cf9be64d4332ce5, upstreamSha256 0da45049c680c2b2d58d52d637f17f7c45421a46a92a8dd0e6385dadb384dffa, 22 divergences, every why ≥ 10 chars ✅
L5 nothing moved in transit	blob 2ea9063b406f3be7518f4c81362bc77a379db251 ✅ — the same object the round's two ablations used as their baseline
L6 the tombstone survives	the governed .claude/hooks/guard-main-checkout.selftest.sh entry appears exactly once and is unchanged ✅ — ⛔ "exactly once", never "zero"

⭐ L3 and L6 are the ones worth naming. This ledger already holds a governed-surface entry, and the failure this PR could have had is not a wrong digest — it is a re-sync that quietly swept that entry up. The deep-compare says it did not.

⛔ What this green does NOT say

It says what landed. It does not re-run check-upstream-port-parity.mjs — this seat can execute it (node builtins only), and that is exactly why it is excluded: run from this checkout it returns exit 0 with four confident green lines about a pre-objectui#8288 ledger shape from 2026-09-06, in the right format, naming no tree. CI's run on this head is the reading.

⭐ What the round established that the card did not

• The convenience trap was undetectable, not merely forbidden. Upstream has not touched this file since 6136293, so upstream main today carries the same blob — the wrong ref would have produced a fully green gate with a false provenance line, objectui#8288's exact failure re-created inside the card written to prevent it.
• The ledger's ref convention is tip-at-read-time, read off entry 3 — which is pinned at a commit that does not touch its own file. No card mentions it, and getting it wrong would also have been green.
• The port's own header names POPULATION_ROOTS declaring e2e/** where upstream declares .githooks/** as "THE PORT'S ONE SUBSTANTIVE CHANGE" — it is 1 of 22 divergences and no card mentions it either.

Closing objectui#8694. objectui#9206 stays open: this PR makes its own subject's prose false, and ⛔ fixing it here would have changed the very divergence pairs the PR declares.

---

Generated by Claude Code