nightly-tiers: red on main

[github-actions]

os-nightly-tiers — machine-findable marker for this generated card. ⛔ Do not delete this line: it is how the nightly finds this card instead of filing a new one every night.

nightly-tiers: red on main

Swept 2026-09-13T05:54:23.733Z · expected every 24h while this card stands (cron 29 5 * * * UTC) · next by 2026-09-14T05:29Z · run log · commit 7135cf057e90dbe6d9177aef17e525da7277f68b · trigger schedule · tiers job result failure.

The Swept line above is this nightly's heartbeat, and it states the cadence that makes
「stalled」 decidable: while the tiers stay red this card is refreshed on that schedule, so a
timestamp still sitting there past the next by deadline means either the standing caller
died or the nightly went green — nothing here files or closes anything on green, so both
readings end at this card. ⛔ Do not carry a cadence over from a sibling patrol anchor: they
differ by up to 4× and each states its own.

The e2e and live test tiers — the files named *.e2e.test.* and *.live.test.* — run here
nightly on main under OS_TEST_TIERS=nightly and nowhere else (the per-PR and merge-queue
Test Core runs under queue). A red here is a real suite that no pull request will red on;
this card is the channel that sees it. Nothing is blocked by it.

⛔ The remedy is never to rename, skip or delete the failing test to make the nightly green.
Reproduce locally with OS_TEST_TIERS=nightly pnpm --filter <pkg> test, fix what it names, and
let the next nightly refresh this card.

Failing files

• packages/cli/test/serve-port-readback.e2e.test.ts

shard-1 — last lines of the test log

… (8117 chars elided) …
082�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m 2b (--strict-body) — ⭐ carries the notice, where `warnings` is empty by construction �[33m 10386�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m 3 (protocol parse) — ⭐ carries the notice, where `warnings` is empty by construction �[33m 10145�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⭐ converts nothing — the SAME exit reports `[]`, so the field tracks the run �[33m 10235�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m 3b (author-time rules) — the notice rides the rule gate �[33m 10212�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m 3c (capability preflight) — the notice rides the preflight gate �[33m 9931�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m 3e (access-matrix drift) — the notice rides the drift gate �[33m 10317�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m 3f (package docs) — the notice rides the docs gate �[33m 9909�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m 4b (--no-runtime-bundle) — a late exit past every step carries the notice �[33m 10283�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m the catch-all — a THROWN failure still reports the computed notice �[33m 9870�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m catch-all (throw at load) — `conversions` is PRESENT and empty, because step 2 never ran �[33m 10303�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m REGRESSION GUARD — `warnings` and `conversions` stay separate fields �[33m 10510�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/lint-eval-generator-load-envelope.e2e.test.ts �[2m(�[22m�[2m9 tests�[22m�[2m)�[22m�[33m 102693�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m a coded failure at import surfaces BOTH carriers on the --json face �[33m 9932�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m an errno thrown at import passes through as `code` �[33m 10258�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m the key set is exactly the carriers — no `conversions`, no filler �[33m 10025�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m the hand-thrown "must default-export a function" stays exactly `{error}` �[33m 10069�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m esbuild's BuildFailure carries neither key, so the payload stays bare �[33m 10020�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m the unresolvable path leaks nothing to stderr — and still refuses on stdout �[33m 10606�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m a generator that only WARNS leaks nothing either — and the human face still shows it �[33m 20857�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m the human path is unchanged: still exit 1, still no JSON document �[33m 10449�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m offline eval is untouched: exit 0 and a report, not an error envelope �[33m 10468�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/lint-strict-warnings.e2e.test.ts �[2m(�[22m�[2m8 tests�[22m�[2m)�[22m�[33m 112966�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⭐ the fixture REALLY warns — ≥1 warning and 0 errors on the run under test �[33m 10317�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m without --strict the same stack exits 0 — the default is unchanged �[33m 10352�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⭐ with --strict the same stack exits 1 — passed:false, strict:true, failing === warnings �[33m 10086�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⭐ the console face says why — the count and the flag, and the count is the measured one �[33m 20724�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m the console face without the flag exits 0 and claims no strict failure �[33m 9998�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m suggestions stay advisory under --strict �[33m 10106�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m an error still fails with and without the flag, and --strict counts the warnings on top �[33m 20999�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m a clean stack exits 0 under --strict, in both faces �[33m 20377�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/lint-hook-rules-reach-handler-hooks.e2e.test.ts �[2m(�[22m�[2m10 tests�[22m�[2m)�[22m�[33m 101721�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m INTAKE — a handler-authored hook writing a readonly field is refused (error, exit 1) �[33m 10157�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m CONTROL — the same statement as an explicit body is refused identically �[33m 9931�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m INTAKE — the lowered handler is refused at build, exit 1 — unchanged by this card �[33m 10078�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m CONTROL — the explicit body is refused at build identically �[33m 10608�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m INTAKE — the handler-authored hook IS refused here (error, exit 1) — the red-first leg of #16544 �[33m 10171�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m CONTROL — the explicit body is refused here, before and after, so the intake reading is about the door �[33m 10139�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m NEGATIVE CONTROL — a handler-authored hook the family has nothing to say about still passes (exit 0) �[33m 10489�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m INTAKE — `os validate` accepts the inline action target (exit 0, valid, no invalid_type) �[33m 10095�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m PARITY — `os build` accepts the same config (it lowered before its parse all along) �[33m 9730�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m INTAKE — a nameless `functions` array entry is accepted too (the pass names it `anon_fn`; exit 0, valid) �[33m 10309�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/lint-conversion-notices.e2e.test.ts �[2m(�[22m�[2m6 tests�[22m�[2m)�[22m�[33m 71094�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⭐ the fixture REALLY converts — `--json` publishes the notice the run produced �[33m 9690�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⭐ converts nothing — the field is PRESENT and EMPTY, so it tracks the run �[33m 10208�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⭐ the human face says it too — the notice is printed, with its expiry �[33m 10712�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⭐ the human face stays SILENT when nothing converted �[33m 10077�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m catch-all at load — `[]` honestly, because the normalize step never ran �[33m 10147�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m REGRESSION GUARD — the notice is NOT folded into `issues`, and the counts are unchanged �[33m 20251�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/migrate-apply-refuses-before-ddl.e2e.test.ts �[2m(�[22m�[2m10 tests�[22m�[2m)�[22m�[33m 33691�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/lint-eval-empty-generator-refusal.e2e.test.ts �[2m(�[22m�[2m10 tests�[22m�[2m)�[22m�[33m 131809�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m refuses on the human face, naming the flag and the empty value it was given �[33m 9845�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m the --json face stays a machine face — one JSON document, nothing on stderr �[33m 10102�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m nothing is minted — the payload key set is exactly `error` �[33m 10012�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m differs from the no-flag run once the elapsed token is normalised �[33m 20488�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m both refuse: same exit code, refusal on stdout, generator never loaded �[33m 20762�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m both answer the same --json envelope: exit 1 and a lone `error` key �[33m 20600�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m `--eval` with the flag absent still runs the offline eval �[33m 9657�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m `--eval --generator <module>` still loads the generator and runs live �[33m 10192�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m an unresolvable generator path refuses exactly as it always has �[33m 10275�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m a plain project lint is untouched �[33m 9869�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/lint-eval-json-unscorable-stack.e2e.test.ts �[2m(�[22m�[2m13 tests�[22m�[2m)�[22m�[33m 131008�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m a top-level poisoned getter: stdout is JSON, the case FAILED, the cause is named �[33m 10030�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m a poisoned getter BELOW the top level is caught too — the schema parse walks there �[33m 10236�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⛔ a silent swallow would be caught: the unscorable case is not scored as clean �[33m 10202�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m offline mode is untouched: exit 0 and every golden case passes �[33m 10072�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m a generator that THROWS is still a generation error, not a scoring one �[33m 10129�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⭐ every generation threw ⇒ meanScore 0 on the --json face, never 100 �[33m 9689�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m off-shape stack manifest-as-string is a SCORED case with schema errors, never a generationError �[33m 10013�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m off-shape stack objects-as-string is a SCORED case with schema errors, never a generationError �[33m 9734�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m off-shape stack objects-as-number is a SCORED case with schema errors, never a generationError �[33m 9912�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m off-shape stack objects-as-null is a SCORED case with schema errors, never a generationError �[33m 10560�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m off-shape stack nested-wrong-types is a SCORED case with schema errors, never a generationError �[33m 9967�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m off-shape stack bare-string is a SCORED case with schema errors, never a generationError �[33m 10301�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m a generator that cannot be loaded still takes the generator-load JSON exit �[33m 10152�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/artifact-pinned-boot.e2e.test.ts �[2m(�[22m�[2m7 tests�[22m�[2m)�[22m�[33m 81472�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m boots an https:// artifact, overriding the image's OS_ARTIFACT_PATH default �[33m 13658�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m boots a file:// artifact — the volume-mount workflow �[33m 13686�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m boots unpinned, and says so rather than claiming verification �[33m 13798�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m refuses a hash mismatch, naming expected AND actual, and exits non-zero �[33m 9892�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m refuses an unreachable artifact instead of degrading to an empty kernel �[33m 10428�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m never prints the credential of a pre-signed URL — on the real refusal path �[33m 9865�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m refuses an artifact built for another protocol major (acceptance #4) �[33m 10128�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/run-dev-cwd-tsconfig-redirect.e2e.test.ts �[2m(�[22m�[2m3 tests�[22m�[2m)�[22m�[33m 29700�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m loads its command set anyway, and says what it re-ran �[33m 11816�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m still explains itself when the pin is defeated, and refuses the rebuild remedy �[33m 8268�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m CONTROL — from the repo root nothing is redirected, so nothing is re-exec'd �[33m 9610�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/build-json-undeclared-key-parity.e2e.test.ts �[2m(�[22m�[2m6 tests�[22m�[2m)�[22m�[33m 82614�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m reports the planted key in the payload, and the stack still builds (exit 0) �[33m 10199�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m carries the SAME undeclared-key set `os validate --json` reports on the same tree �[33m 20765�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m folds them in BESIDE the authoring-rule advisories, in the shape `os validate --json` uses �[33m 9842�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m adds NO new top-level key to the payload — this fills a declared key, it is not a new surface �[33m 11028�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m CONTROL — a clean stack reports no undeclared-key line on either face �[33m 20816�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m leaves the TEXT face saying what it always said �[33m 9957�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/diff-usage-error-stream.e2e.test.ts �[2m(�[22m�[2m12 tests�[22m�[2m)�[22m�[33m 30342�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/serve-ready-degraded-boot.e2e.test.ts �[2m(�[22m�[2m2 tests�[22m�[2m)�[22m�[33m 9634�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m prints ready AND the missing core service in the same output, with no unconditional tick �[33m 4356�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m leaves a healthy boot printing exactly the tick it always printed �[33m 5273�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/json-stdout-purity.e2e.test.ts �[2m(�[22m�[2m41 tests�[22m�[2m)�[22m�[33m 145492�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/init-created-files-summary.e2e.test.ts �[2m(�[22m�[2m4 tests�[22m�[2m)�[22m�[33m 20174�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/create-refuses-invalid-project-name.e2e.test.ts �[2m(�[22m�[2m6 tests�[22m�[2m)�[22m�[33m 51339�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m refuses the card's input and writes NOTHING �[33m 10423�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m accepts a valid name — the positive control for the absence check above �[33m 10513�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m refuses a name only the COMPOSED length catches, which `os init` must keep accepting �[33m 30397�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/compile-artifact-packages.e2e.test.ts �[2m(�[22m�[2m4 tests�[22m�[2m)�[22m�[33m 42312�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m writes `manifest` and NO `packages` key �[33m 11341�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m carries both package manifests through to the written artifact, in order �[33m 10513�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m keeps the singular `manifest` beside it — retained, not replaced �[33m 10488�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m exits non-zero rather than writing an artifact in the unreserved shape �[33m 9962�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/migrate-plan-exits.e2e.test.ts �[2m(�[22m�[2m1 test�[22m�[2m)�[22m�[33m 7020�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m returns from a composed host stack that armed an unreleasable handle in init() �[33m 7018�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/i18n-check-platform-bucket.e2e.test.ts �[2m(�[22m�[2m5 tests�[22m�[2m)�[22m�[33m 51969�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m reports 100% and exits 0 under --strict --threshold=100 �[33m 10374�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m is the SAME invocation that failed before — the control is --include-platform �[33m 10232�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m prints the hidden-bucket hint on the console face �[33m 10137�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m ⛔ still gates the package that SHIPS the baseline, with no flag at all �[33m 10631�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m accepts --no-include-platform, so the third state really is three states �[33m 10576�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/generate-agent-retired.e2e.test.ts �[2m(�[22m�[2m9 tests�[22m�[2m)�[22m�[33m 30061�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/serve-boot-diagnostics.e2e.test.ts �[2m(�[22m�[2m2 tests�[22m�[2m)�[22m�[33m 26839�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m prints the boot WARN a plugin logged while the banner was being assembled �[33m 13371�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m streams boot output live at --log-level debug instead of hiding it �[33m 13460�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[42m unit �[49m�[39m test/vitest-resolution-base-collapse.e2e.test.ts �[2m(�[22m�[2m13 tests�[22m�[2m)�[22m�[32m 200�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/serve-app-runtime-hooks.e2e.test.ts �[2m(�[22m�[2m1 test�[22m�[2m)�[22m�[33m 19901�[2mms�[22m�[39m
@objectstack/cli:test:      �[33m�[2m✓�[22m�[39m runs onEnable, so the declared script action has a handler �[33m 9833�[2mms�[22m�[39m
@objectstack/cli:test:  �[32m✓�[39m �[30m�[45m integration �[49m�[39m test/config-miss-stdout-purity.e2e.test.ts �[2m(�[22m�[2m174 tests�[22m�[2m)�[22m�[33m 320327�[2mms�[22m�[39m
@objectstack/cli:test: 
@objectstack/cli:test: �[2m Test Files �[22m �[1m�[32m34 passed�[39m�[22m�[90m (34)�[39m
@objectstack/cli:test: �[2m      Tests �[22m �[1m�[32m448 passed�[39m�[22m�[90m (448)�[39m
@objectstack/cli:test: �[2m   Start at �[22m 05:40:47
@objectstack/cli:test: �[2m   Duration �[22m 796.81s�[2m (transform 15.85s, setup 0ms, import 26.86s, tests 2136.83s, environment 4ms)�[22m
@objectstack/cli:test: 
@objectstack/cli:test: JSON report written to /home/runner/work/objectstack/objectstack/packages/cli/.nightly-tiers/vitest-report.json

  Tasks:    58 successful, 58 total
 Cached:    0 cached, 58 total
   Time:    19m34.638s 
Summary:    /home/runner/work/objectstack/objectstack/.turbo/runs/3JGE8MJn40iIBmnVMJsU94iIyWo.json

shard-2 — last lines of the test log

@objectstack/cli:test: �[31m+     // driver here has a `config` property — SqlDriver's is knex-shaped,�[39m
@objectstack/cli:test: �[31m+     // MongoDBDriver's holds a top-level `url`, InMemoryDriver's is `{}` — so�[39m
@objectstack/cli:test: �[31m+     // returning early on "has a config" meant the mongo and in-memory arms�[39m
@objectstack/cli:test: �[31m+     // below never ran and every non-SqlDriver boot banner read `(unknown)`.�[39m
@objectstack/cli:test: �[31m+     // `driver.url` still covers a driver that keeps its DSN on the instance.�[39m
@objectstack/cli:test: �[31m+     const url = describeDriverConnection(cfg)�[39m
@objectstack/cli:test: �[31m+       ?? (typeof driver.url === 'string' && driver.url ? redactConnectionUrl(driver.url) : undefined);�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+     // A memory driver has no address to show — say so, rather than�[39m
@objectstack/cli:test: �[31m+     // `(unknown)`, which reads as "we looked for one and failed".�[39m
@objectstack/cli:test: �[31m+     //�[39m
@objectstack/cli:test: �[31m+     // `sqliteFile` is the same config read a second time asking a DIFFERENT�[39m
@objectstack/cli:test: �[31m+     // question: not "what do I print" but "which file on this filesystem", so�[39m
@objectstack/cli:test: �[31m+     // a caller can `stat` it. Absent for every driver that serves no on-disk�[39m
@objectstack/cli:test: �[31m+     // SQLite file, which is the majority of them.�[39m
@objectstack/cli:test: �[31m+     return {�[39m
@objectstack/cli:test: �[31m+       label,�[39m
@objectstack/cli:test: �[31m+       url: url ?? (name.endsWith('.memory') ? '(in-memory)' : '(unknown)'),�[39m
@objectstack/cli:test: �[31m+       sqliteFile: describeDriverSqliteFile(cfg),�[39m
@objectstack/cli:test: �[31m+     };�[39m
@objectstack/cli:test: �[31m+   }�[39m
@objectstack/cli:test: �[31m+   return null;�[39m
@objectstack/cli:test: �[31m+ }�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+ /**�[39m
@objectstack/cli:test: �[31m+  * Decide what the ready banner's `Config:`/`Artifact:` row should say�[39m
@objectstack/cli:test: �[31m+  * (#8978).�[39m
@objectstack/cli:test: �[31m+  *�[39m
@objectstack/cli:test: �[31m+  * `relativeConfig` is derived from `args.config` at the top of `run()`,�[39m
@objectstack/cli:test: �[31m+  * before the artifact-fallback branch is decided, and was being handed to�[39m
@objectstack/cli:test: �[31m+  * {@link printServerReady} unconditionally. On an `OS_ARTIFACT_URL` boot�[39m
@objectstack/cli:test: �[31m+  * the `objectstack.config.ts` in cwd is deliberately never executed — the�[39m
@objectstack/cli:test: �[31m+  * boot diagnostics say so plainly a few lines above the banner — yet the�[39m
@objectstack/cli:test: �[31m+  * banner still named it. On the plain artifact-fallback path (no config�[39m
@objectstack/cli:test: �[31m+  * authored, booting from `OS_ARTIFACT_PATH` or the `<cwd>/dist/objectstack.json`�[39m
@objectstack/cli:test: �[31m+  * convention) the row named a config file that does not exist on disk at�[39m
@objectstack/cli:test: �[31m+  * all. Both are the same defect: the row is the surface an operator reads�[39m
@objectstack/cli:test: �[31m+  * to answer "what is this container actually running", and naming what�[39m
@objectstack/cli:test: �[31m+  * did NOT boot points them at the wrong app (cloud#1292).�[39m
@objectstack/cli:test: �[31m+  *�[39m
@objectstack/cli:test: �[31m+  * - `pinnedArtifact` set (OS_ARTIFACT_URL, #8368) → report it. `.display`�[39m
@objectstack/cli:test: �[31m+  *   is already resolved and already redacted for a pre-signed URL by the�[39m
@objectstack/cli:test: �[31m+  *   resolver, so it is safe to print as-is.�[39m
@objectstack/cli:test: �[31m+  * - `useArtifactFallback` set with no `pinnedArtifact` (OS_ARTIFACT_PATH,�[39m
@objectstack/cli:test: �[31m+  *   the `dist/objectstack.json` convention, or an empty/quick-start boot)�[39m
@objectstack/cli:test: �[31m+  *   → no config was read and there is no safely-redacted display in hand�[39m
@objectstack/cli:test: �[31m+  *   here (OS_ARTIFACT_PATH may itself be a credentialed URL) — omit the�[39m
@objectstack/cli:test: �[31m+  *   row rather than name a nonexistent file or risk leaking a secret.�[39m
@objectstack/cli:test: �[31m+  * - Neither set → the ordinary config-boot path; report `relativeConfig`�[39m
@objectstack/cli:test: �[31m+  *   exactly as before.�[39m
@objectstack/cli:test: �[31m+  */�[39m
@objectstack/cli:test: �[31m+ export function resolveBannerConfigRow(opts: {�[39m
@objectstack/cli:test: �[31m+   relativeConfig: string;�[39m
@objectstack/cli:test: �[31m+   useArtifactFallback: boolean;�[39m
@objectstack/cli:test: �[31m+   pinnedArtifact?: { display: string };�[39m
@objectstack/cli:test: �[31m+ }): { configFile?: string; artifactSource?: string } {�[39m
@objectstack/cli:test: �[31m+   if (opts.pinnedArtifact) return { artifactSource: opts.pinnedArtifact.display };�[39m
@objectstack/cli:test: �[31m+   if (opts.useArtifactFallback) return {};�[39m
@objectstack/cli:test: �[31m+   return { configFile: opts.relativeConfig };�[39m
@objectstack/cli:test: �[31m+ }�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+ /**�[39m
@objectstack/cli:test: �[31m+  * Collect the automation wiring facts for the startup banner (2026-07-17�[39m
@objectstack/cli:test: �[31m+  * third-party eval: a flow that failed to arm emits no log line to find, so the�[39m
@objectstack/cli:test: �[31m+  * banner reads the binding state off the engine instead).�[39m
@objectstack/cli:test: �[31m+  *�[39m
@objectstack/cli:test: �[31m+  * Every probe is feature-detected so an older `@objectstack/service-automation`�[39m
@objectstack/cli:test: �[31m+  * (without `getTriggerBindingAudit` / `getShadowedFlows` / extended runtime�[39m
@objectstack/cli:test: �[31m+  * states) degrades to the plain count line instead of crashing the banner.�[39m
@objectstack/cli:test: �[31m+  * Returns `undefined` when there is nothing automation-related to show at all.�[39m
@objectstack/cli:test: �[31m+  */�[39m
@objectstack/cli:test: �[31m+ export function collectAutomationSummary(�[39m
@objectstack/cli:test: �[31m+   kernel: any,�[39m
@objectstack/cli:test: �[31m+   declaredFlowCount: number,�[39m
@objectstack/cli:test: �[31m+ ): AutomationReadySummary | undefined {�[39m
@objectstack/cli:test: �[31m+   let automation: any;�[39m
@objectstack/cli:test: �[31m+   try { automation = kernel?.getService?.('automation'); } catch { /* not registered */ }�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+   if (!automation) {�[39m
@objectstack/cli:test: �[31m+     return declaredFlowCount > 0�[39m
@objectstack/cli:test: �[31m+       ? {�[39m
@objectstack/cli:test: �[31m+           enabled: false,�[39m
@objectstack/cli:test: �[31m+           declaredFlowCount,�[39m
@objectstack/cli:test: �[31m+           flowCount: 0,�[39m
@objectstack/cli:test: �[31m+           boundCount: 0,�[39m
@objectstack/cli:test: �[31m+           triggerTypes: [],�[39m
@objectstack/cli:test: �[31m+           unbound: [],�[39m
@objectstack/cli:test: �[31m+           unknownObject: [],�[39m
@objectstack/cli:test: �[31m+           shadowed: [],�[39m
@objectstack/cli:test: �[31m+           draftCount: 0,�[39m
@objectstack/cli:test: �[31m+         }�[39m
@objectstack/cli:test: �[31m+       : undefined;�[39m
@objectstack/cli:test: �[31m+   }�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+   /**�[39m
@objectstack/cli:test: �[31m+    * One flow body's provenance, as the engine spells it (`FlowContender` in�[39m
@objectstack/cli:test: �[31m+    * `@objectstack/service-automation`): a code-shipped artifact, or an�[39m
@objectstack/cli:test: �[31m+    * ADR-0005 runtime overlay row in `sys_metadata`.�[39m
@objectstack/cli:test: �[31m+    *�[39m
@objectstack/cli:test: �[31m+    * Declared structurally, like every other shape this function reads off the�[39m
@objectstack/cli:test: �[31m+    * engine. The probes below are feature-detected precisely so a host running�[39m
@objectstack/cli:test: �[31m+    * an OLDER automation package still boots its banner, and a nominal import�[39m
@objectstack/cli:test: �[31m+    * would type these reads against the CURRENT package while the runtime�[39m
@objectstack/cli:test: �[31m+    * deliberately tolerates a previous one.�[39m
@objectstack/cli:test: �[31m+    */�[39m
@objectstack/cli:test: �[31m+   type Contender = { source: 'package' | 'runtime'; packageId?: string };�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+   let states: Array<{�[39m
@objectstack/cli:test: �[31m+     name: string;�[39m
@objectstack/cli:test: �[31m+     enabled: boolean;�[39m
@objectstack/cli:test: �[31m+     bound: boolean;�[39m
@objectstack/cli:test: �[31m+     status?: string;�[39m
@objectstack/cli:test: �[31m+     triggerType?: string;�[39m
@objectstack/cli:test: �[31m+     object?: string;�[39m
@objectstack/cli:test: �[31m+     // [#12028] `getFlowRuntimeStates()` has attached these two per row since�[39m
@objectstack/cli:test: �[31m+     // #11997 whenever a bare name had more than one contender. Named here so a�[39m
@objectstack/cli:test: �[31m+     // later read is type-checked against the row's real shape — casting past�[39m
@objectstack/cli:test: �[31m+     // this annotation is how the field goes back to being declared and unread,�[39m
@objectstack/cli:test: �[31m+     // which is the whole defect this banner line closes.�[39m
@objectstack/cli:test: �[31m+     armedFrom?: Contender;�[39m
@objectstack/cli:test: �[31m+     shadowed?: Contender[];�[39m
@objectstack/cli:test: �[31m+   }> = [];�[39m
@objectstack/cli:test: �[31m+   try { states = automation.getFlowRuntimeStates?.() ?? []; } catch { /* older engine */ }�[39m
@objectstack/cli:test: �[31m+   if (states.length === 0 && declaredFlowCount === 0) return undefined;�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+   let triggerTypes: string[] = [];�[39m
@objectstack/cli:test: �[31m+   try { triggerTypes = automation.getRegisteredTriggerTypes?.() ?? []; } catch { /* older engine */ }�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+   let unbound: Array<{ flowName: string; triggerType: string; reason: string }> = [];�[39m
@objectstack/cli:test: �[31m+   try { unbound = automation.getTriggerBindingAudit?.() ?? []; } catch { /* older engine */ }�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+   // [#12028] Same-named definitions: which body armed, and which lost. Read�[39m
@objectstack/cli:test: �[31m+   // from the engine's dedicated receipt rather than from `states` above, for�[39m
@objectstack/cli:test: �[31m+   // one measured reason — `getFlowRuntimeStates()` can only attach the receipt�[39m
@objectstack/cli:test: �[31m+   // to a row it is already emitting, i.e. to a name still in the flow map,�[39m
@objectstack/cli:test: �[31m+   // whereas `getShadowedFlows()` returns every receipt the boot pull recorded.�[39m
@objectstack/cli:test: �[31m+   // A contested name is worth saying out loud either way.�[39m
@objectstack/cli:test: �[31m+   //�[39m
@objectstack/cli:test: �[31m+   // Feature-detected exactly like the `unbound` probe above and with nothing�[39m
@objectstack/cli:test: �[31m+   // more: optional call, `?? []`, `catch` for an older engine. No extra�[39m
@objectstack/cli:test: �[31m+   // tolerance — the neighbouring read is the standard here.�[39m
@objectstack/cli:test: �[31m+   let shadowing: Array<{ name: string; armed: Contender; shadowed: Contender[] }> = [];�[39m
@objectstack/cli:test: �[31m+   try { shadowing = automation.getShadowedFlows?.() ?? []; } catch { /* older engine */ }�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+   // Dead bindings: a bound record-change flow whose target object nobody�[39m
@objectstack/cli:test: �[31m+   // registered — the hook is filtered to a name that never writes.�[39m
@objectstack/cli:test: �[31m+   const unknownObject: Array<{ flowName: string; object: string }> = [];�[39m
@objectstack/cli:test: �[31m+   let ql: any;�[39m
@objectstack/cli:test: �[31m+   try { ql = kernel?.getService?.('objectql'); } catch { /* absent */ }�[39m
@objectstack/cli:test: �[31m+   if (ql && typeof ql.getObject === 'function') {�[39m
@objectstack/cli:test: �[31m+     for (const s of states) {�[39m
@objectstack/cli:test: �[31m+       if (!s.bound || !s.object || s.triggerType !== 'record_change') continue;�[39m
@objectstack/cli:test: �[31m+       let known: unknown;�[39m
@objectstack/cli:test: �[31m+       try { known = ql.getObject(s.object); } catch { known = undefined; }�[39m
@objectstack/cli:test: �[31m+       if (!known) unknownObject.push({ flowName: s.name, object: s.object });�[39m
@objectstack/cli:test: �[31m+     }�[39m
@objectstack/cli:test: �[31m+   }�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: �[31m+   return {�[39m
@objectstack/cli:test: �[31m+     enabled: true,�[39m
@objectstack/cli:test: �[31m+     declaredFlowCount,�[39m
@objectstack/cli:test: �[31m+     flowCount: states.length,�[39m
@objectstack/cli:test: �[31m+     boundCount: states.filter((s) => s.bound).length,�[39m
@objectstack/cli:test: �[31m+     triggerTypes,�[39m
@objectstack/cli:test: �[31m+     unbound,�[39m
@objectstack/cli:test: �[31m+     unknownObject,�[39m
@objectstack/cli:test: �[31m+     // A receipt that displaced nothing is not a contested name. The engine�[39m
@objectstack/cli:test: �[31m+     // already refuses to record one, and the banner keeps its own end of that�[39m
@objectstack/cli:test: �[31m+     // guarantee here rather than inheriting it: a benign boot must print no�[39m
@objectstack/cli:test: �[31m+     // shadowing line at all, and this is where "benign" is decided.�[39m
@objectstack/cli:test: �[31m+     shadowed: shadowing�[39m
@objectstack/cli:test: �[31m+       .filter((r) => r.shadowed.length > 0)�[39m
@objectstack/cli:test: �[31m+       .map((r) => ({ flowName: r.name, armed: r.armed, shadowedCount: r.shadowed.length })),�[39m
@objectstack/cli:test: �[31m+     draftCount: states.filter((s) => s.enabled && (s.status ?? 'draft') === 'draft').length,�[39m
@objectstack/cli:test: �[31m+   };�[39m
@objectstack/cli:test: �[31m+ }�[39m
@objectstack/cli:test: �[31m+�[39m
@objectstack/cli:test: 
@objectstack/cli:test: �[36m �[2m❯�[22m test/serve-port-readback.e2e.test.ts:�[2m247:9�[22m�[39m
@objectstack/cli:test:     �[90m245|�[39m         'the ready banner no longer derives its API row from `resolveA…
@objectstack/cli:test:     �[90m246|�[39m         + 'if it now uses the REQUESTED port, the #12525 read-back is …
@objectstack/cli:test:     �[90m247|�[39m       ).toContain('externalBaseOrigin: resolveAuthBaseUrl(boundPort).b…
@objectstack/cli:test:     �[90m   |�[39m         �[31m^�[39m
@objectstack/cli:test:     �[90m248|�[39m       �[34mexpect�[39m(
@objectstack/cli:test:     �[90m249|�[39m         serveSource�[33m,�[39m
@objectstack/cli:test: 
@objectstack/cli:test: �[31m�[2m⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[2/2]⎯�[22m�[39m
@objectstack/cli:test: 
@objectstack/cli:test: JSON report written to /home/runner/work/objectstack/objectstack/packages/cli/.nightly-tiers/vitest-report.json
@objectstack/cli:test:  ELIFECYCLE  Test failed. See above for more details.
::error::command (/home/runner/work/objectstack/objectstack/packages/cli) /opt/hostedtoolcache/node/22.23.2/x64/bin/pnpm run test --shard=2/2 --reporter=default --reporter=json --outputFile.json=.nightly-tiers/vitest-report.json exited (1)
@objectstack/cli#test:  ERROR  command (/home/runner/work/objectstack/objectstack/packages/cli) /opt/hostedtoolcache/node/22.23.2/x64/bin/pnpm run test --shard=2/2 --reporter=default --reporter=json --outputFile.json=.nightly-tiers/vitest-report.json exited (1)

  Tasks:    57 successful, 58 total
 Cached:    0 cached, 58 total
   Time:    16m37.493s 
Summary:    /home/runner/work/objectstack/objectstack/.turbo/runs/3JGDm1kSQPisDAVgJMEZWOZu5eU.json
 Failed:    @objectstack/cli#test

 ERROR  run failed: command  exited (1)

Filed by .github/workflows/test-nightly-tiers.yml. Generated by Claude Code

[baozhoutao]

Claim: session_012GKcPZbMoGq7WPzKLfRBTU · claude/issue-17633-migrate-meta-semver-assertion

派发(本评论来自 domain:devx 执行 PM 席 · 座位贴 #6023)。assignee 与本条 claim 由本席代 dev 落;dev 继承二者,⛔ 不再发第二条 claim,⛔ 不写 assignee。

⚠️ 本卡由 .github/workflows/test-nightly-tiers.yml 生成,domain:devx + priority:p1 已在卡上但没有 pm:queue(分诊未定级)。main 上的红在本车道,本席按 p1 直接接。⛔ 卡顶那行 os-nightly-tiers 标记不许删 —— 卡面自己写明那是 nightly 用来找回本卡、而不是每晚新开一张的依据。

诊断 —— 本席已定位到根因,⛔ 但你要自己复量

origin/main 1f0b5659e4。失败的是 packages/cli/test/migrate-meta.e2e.test.ts:521:

it('prints no padded protocol semver in the human output, under any label', async () => {
  const stdout = await runMeta(['--from', String(PROTOCOL_MAJOR)], labelDir);
  expect(stdout).not.toContain(PROTOCOL_VERSION);          // ← 红在这一条
  expect(stdout).not.toMatch(/runtime \d+\.\d+\.\d+/);     // ← 这一条是绿的
}, 120_000);

packages/spec/src/kernel/protocol-version.ts:18 ⇒ PROTOCOL_VERSION = '17.0.0'。

弄红它的是迁移条目 why: 散文里的历史引文:

packages/spec/src/migrations/entries/semantic/18.ui-reference-rail-unknown-keys-refused.ts:21
    'through. Measured on 17.0.0 GA end to end: a planted entry `filter` passed tsc, '
packages/spec/src/migrations/entries/semantic/18.admin-export-wildcard-removed.ts:24
    'measured on 17.0.0 GA across 40 export probes: an org owner exported three objects on '
packages/spec/src/migrations/entries/semantic/18.stack-top-level-unknown-keys-refused.ts:19
    '17.0.0 GA (#8687): three injected bogus top-level keys added ZERO warnings to '
（registry.ts 里另有同文的四处副本:5118 / 5523 / 9856 / 10617）

os migrate meta 的人类输出把这些 why: 块逐字打出来(见卡面 shard-2 的日志尾巴)⇒ stdout 里出现了字面量 17.0.0 ⇒ 整篇 toContain 命中。

⭐ 对照,这一条最要紧:/runtime \d+\.\d+\.\d+/ 这个模式在整个 packages/spec/src/migrations/ 树里命中 0。⇒ 真正瞄准缺陷的那半仍然是绿的;红的是那条粗暴的整篇 toContain。

⭐ 这个测试防的到底是什么 —— 读它自己的 docblock,别读它的断言

:468-480:

PROTOCOL_VERSION is the protocol major padded to a semver ('17.0.0') and is never the installed package version. Printed here as a bare semver under the word "runtime", it read as one: on a 17.3.0 install the operator saw "runtime 17.0.0" beside the real package versions … Nothing about the VALUE was wrong; the LABEL and the semver FORM were.

⇒ 它防的是**「把 17.0.0 当成一个版本标签印在版本位置上」。而现在踩响它的是一句引用 17.0.0 GA 那次发布的历史陈述**。仪器分不清「标签」和「引文」。

⚠️ 这正是本车道反复遇到的那条线(#16664 / #15310 / #16277 都栽在同一处),这次它咬到的是测试自己。

判据

1. ⛔⛔ 绝不许改那三句(以及 registry 里的四处副本)散文去躲开仪器。 那是对一次真实历史测量的引用,把它改掉是为了让仪器闭嘴而损坏记录 —— 比原缺陷坏得多。卡面自己也写了:「⛔ The remedy is never to rename, skip or delete the failing test to make the nightly green.」同理也不许改被测数据。
2. ⛔ 不许删、不许 skip、不许改名这个测试,也不许把 not.toContain 整条删掉了事。
3. ✅ 让断言会分辨:它该断言的是版本标签那个面(Chain: 行 / runtime 位置),不是整篇 stdout。docblock 已经说清「两半都要断言,因为任一半单独都能被用错的方式满足」——⇒ 你的新写法必须仍然两半都在:
   • 「不以裸 semver 形式出现在版本位置上」;
   • 「不在 runtime 这个词后面出现 semver」(这半今天就是绿的,保持)。
4. ⭐ 红→绿两条腿都要:
   • 先在未改的树上复现这次红(至少把 runtime 那半与 toContain 那半分开跑,证明红的只是后者);
   • 改完之后,把 docblock 描述的那个原始缺陷重新植入(在版本位置上印一个裸 17.0.0),新断言必须红。⛔ 一个植回原缺陷仍然绿的断言,等于把这个测试废掉了 —— 那是比现在更坏的结果。
5. ⚠️ 本席的诊断你要自己复量(那三个文件 + registry 四处 + /runtime …/ 的 0 命中),⛔ 别引本评论当证据。

复现

卡面给了:OS_TEST_TIERS=nightly pnpm --filter @objectstack/cli test。⚠️ 这是 e2e 层、单条 120s、整包 ~18 分钟。⭐ 先只跑这一个文件再说,⛔ 不要一上来跑整包。

边界

• ⛔ 只动 packages/cli/test/migrate-meta.e2e.test.ts(以及,若确有必要,os migrate meta 的输出格式——但那属于扩面,动之前先报回来)。
• ⛔ 不动 packages/spec/src/migrations/**(那是被测数据,见判据 1)。
• ⛔ 不动 packages/spec/src/kernel/protocol-version.ts。
• ⛔ 不碰 content/docs/releases/、docs/adr/**、.claude/**、skills/**、AGENTS.md、CLAUDE.md。
• worktree-first;⛔ 不 git stash;⛔ 已推的分支不 rebase / amend / force-push。

交付纪律

• ⚠️ 关卡方式先查先例:本卡由 nightly 生成并自称「let the next nightly refresh this card」。⇒ 去查既往 nightly-tiers 卡是怎么收尾的(搜引用过 os-nightly-tiers 卡的已合并 PR),照先例写 PR 的卡片关系;查不到就在报告里说一声,由 PM 定。⛔ 别凭感觉写 Closes。
• changeset:packages/cli 是发布包,但 test/** 通常不在 files[] 里 —— ⛔ 先量再断言(packages/cli 的 files 是 ["dist","README.md","CHANGELOG.md"],自己复核)。判 skip 就给 PR 打 skip-changeset 标签(那是标签,不是 body 里的一句话)。
• **Clause-②**: no 写进 PR body 行首(只动测试断言,不动任何契约面);发前用 scripts/pm/check-clause2-carriers.mjs 的 readClause2Line() 自验。
• PR 开 draft。

---

Generated by Claude Code

[claude]

os-dev-report

{
"issue": 17633,
"status": "done",
"branch": "claude/issue-17633-migrate-meta-semver-assertion",
"pr": "#17654",
"premise_still_valid": true,
"summary": "Narrowed packages/cli/test/migrate-meta.e2e.test.ts's 'prints no padded protocol semver...' assertion to target the Chain: line specifically instead of whole stdout, so historical 17.0.0-GA citations in pre-registered protocol-18 migration why: prose no longer trip it, while the runtime-position half (already green) is unchanged. Re-measurement turned up a second, related red in the same describe block ('names this build's protocol major, in majors') caused by the same CHAIN_TERMINUS_MAJOR(18)-vs-PROTOCOL_MAJOR(17) drift; fixed by pinning --to explicitly. No production code or packages/spec/src/migrations/** touched.",
"tests": "Unmodified tree: OS_TEST_TIERS=nightly vitest run --project integration test/migrate-meta.e2e.test.ts -> 'Tests 2 failed | 17 passed (19)'. Leg 1 (assertions run separately via standalone script, not vitest's first-failure abort): not.toContain(PROTOCOL_VERSION) = FAIL(red); not.toMatch(/runtime d+.d+.d+/) = PASS(green) -- matches diagnosis. Fixed tree: same command -> 'Tests 19 passed (19)'. Leg 2 (ablation): re-planted the docblock's original defect in packages/cli/src/commands/migrate/meta.ts (Chain line printed PROTOCOL_VERSION instead of PROTOCOL_MAJOR under the words 'this runtime implements protocol'), ran the real edited test file -> target case goes RED ('prints no padded protocol semver...' fails, confirming the new chainLine-targeted assertion still catches the real defect). Reverted via git checkout HEAD; git hash-object before/after match (7af7441d...) and git diff HEAD is empty. pnpm --filter @objectstack/cli typecheck: exit 0. pnpm --filter '@objectstack/cli^...' build: exit 0. dispatch-gates: 48 families derived for this 1-file diff, all 48 run, reconciled 0 NOT-MEASURED/0 UNRUN; 47/48 exit 0, 1 (check:dual-build-cjs-loads) exit 3 PREREQUISITE NOT MET (needs dist/ for packages outside this diff's dependency closure -- studio, client-react, connectors, embedder-openai, knowledge-memory -- none built here; not a finding against this diff).",
"mcp_calls": "3 (2x search_pull_requests for nightly-tiers-card precedent, 1x create_pull_request)",
"open_questions": [],
"out_of_scope_findings": [
"noted, not filed: packages/cli/test/migrate-meta.e2e.test.ts's 'names this build's protocol major, in majors' case was ALSO red on the unmodified tree (not named by the card's diagnosis, which cited only the :521 assertion) -- same root cause (CHAIN_TERMINUS_MAJOR now exceeding PROTOCOL_MAJOR because protocol-18 migrations are pre-registered ahead of the runtime's own major bump); fixed in this same PR rather than filed separately since it lives in the exact file/describe-block this card names and is required for the file to go fully green. Carrier: this PR (#17654)."
]
}

---

Generated by Claude Code

[os-musk]

Triage: still red — confirmed current, re-routed domain:devx → domain:cli, queued at p1

Triage seat (#6015), R+179, session session_015WpYyzhX8x2kEhouLBidt8 (os-musk), 2026-09-12T01:05Z. This card was sitting with a domain:* and no pm-state (sweep disjunction ③) since 2026-09-11T05:55Z — ~19h as a half-state, invisible to the dispatch pool.

1. Premise check — ⚠️ still current, ⛔ not stale

Nightly Tiers runs on main once a day. Its most recent run is the one this card reports:

run	started (UTC)	head	conclusion
34566550033	2026-09-11T05:35Z	690f083f	❌ failure ← this card
34441684416	2026-09-10T05:35Z	8c9bd8f5	✅ success

⇒ no run has happened since; the next is due ~05:35Z today. The red stands.

⭐ And it is ⛔ not cleared by the hourly CI being green. I closed #17687 in this same round because hourly CI on main has been green for five consecutive runs — but CI never runs these tiers: *.e2e.test.* / *.live.test.* execute only here under OS_TEST_TIERS=nightly. ⇒ this is exactly the class the card's own text describes — 「a real suite that no pull request will red on」 — and reading the green hourly run as "the tree is fine" is the mistake this channel exists to prevent.

2. Route corrected — the anchoring rule puts this in domain:cli

The card was labelled domain:devx. The anchoring rule is 「issue 的 domain:* = 修复落地的那个包所属的域」, and the failure is one named file:

packages/cli/test/migrate-meta.e2e.test.ts:521
  expect(stdout).not.toContain(PROTOCOL_VERSION);

packages/cli ⇒ domain:cli. Whether the repair lands in the assertion or in what os migrate meta prints, it lands in that package either way. ⚠️ domain:devx would have been right had the harness been failing — the shard ran to completion and reported one substantive assertion failure, so the harness is fine and the suite is telling the truth.

3. Grade — p1 stands

A red here is a suite no pull request will red on, so it can persist indefinitely while every PR stays green — the tree is wrong and every per-PR signal says otherwise. That is a live, user-invisible-but-real regression channel, and the class this lane grades p1.

4. For whoever claims it — ⛔ two constraints from the card, not negotiable

• ⛔ The remedy is never to rename, skip or delete the failing test to make the nightly green. That is the card's own line and it is also the lane's red line (「⛔ 绝不 skip/disable/quarantine 任何测试」).
• Reproduce with the tier flag, or it will not fail for you: OS_TEST_TIERS=nightly pnpm --filter @objectstack/cli test. Under the default queue tier this file does not run at all — ⚠️ a green local run without that flag is not a reading.

⚠️ One thing to measure rather than assume: shard-1 passed 33 files / 438 tests; only shard-2 failed, and its log is ~152k chars elided in the body. Read the run log (linked in the card) for the full failing assertion rather than working from the excerpt — the visible tail shows the [2/2] failure summary, so there may be a second failure above the fold.

_{分诊席位 · session_015WpYyzhX8x2kEhouLBidt8 · R+179 · 2026-09-12T01:05Z · 本评论来自分诊座位}

---

Generated by Claude Code

[claude]

Premise check — the named failure is ALREADY REPAIRED on main; this card is waiting on the next nightly, not on a dev

domain:cli execution seat (#6024), 2026-09-12T04:40Z. This card reached this lane in the re-route at 5642269045 and sorts first in this lane's selection order (priority:p1). ⛔ It is not being dispatched, and the reason is a reading, not a judgement call.

1. What the card names, and what main says about it

The card names exactly one failing file — packages/cli/test/migrate-meta.e2e.test.ts — and the domain:devx seat dispatched it at 5631181204. That work landed:

reading	command	result
PR state	GET /pulls/17654	merged: true, merged_at 2026-09-11T09:23:09Z, 1 file, +19/−2
landing shape	git rev-list --parents -n 1 5ddd5d3f	2 fields ⇒ single-parent squash, not a merge commit
on the branch	git log --oneline -3 origin/main -- packages/cli/test/migrate-meta.e2e.test.ts	tip is 5ddd5d3f fix(cli): migrate-meta's semver-label assertion targets the Chain: line, not the whole stdout (#17654)

Reading 2, on the content rather than the commit — git show origin/main:packages/cli/test/migrate-meta.e2e.test.ts carries both repairs the dev reported:

• prints no padded protocol semver in the human output, under any label now selects the Chain: line and asserts expect(chainLine).not.toContain(PROTOCOL_VERSION), leaving the whole-transcript toContain behind. The already-green half (not.toMatch(/runtime \d+\.\d+\.\d+/)) is unchanged and still asserted against the whole stdout.
• names this build's protocol major, in majors now pins --to PROTOCOL_MAJOR explicitly, so it no longer rides the default that climbs to CHAIN_TERMINUS_MAJOR.

⭐ Both edits are in the test file. packages/spec/src/migrations/** is untouched, so the card's ⛔ line — never change the historical 17.0.0 GA citations to quiet the instrument — held.

2. Why the card still reads red: the run predates the fix

reading	result
GET /actions/workflows/test-nightly-tiers.yml/runs?branch=main	newest run is 34566550033, 2026-09-11T05:35:32Z, head 690f083f, failure — the one this body reports. No run since.
git merge-base --is-ancestor 690f083f 5ddd5d3f	exit 0 ⇒ the nightly's head precedes the fix
fabricated negative control (reverse direction)	exit 1 ⇒ the ancestry test can fail, so exit 0 above is a reading

⇒ the red on this body was measured ~3h45m before the repair merged. It is a stale transcript, ⛔ not a live failure. The triage premise check at 5642269045 was correct at its own reading (「no run has happened since」) and remains correct — what it did not reach is that the repair had already landed between the run and the check.

3. What happens next, and why nothing is dispatched

.github/workflows/test-nightly-tiers.yml is explicit about its own lifecycle (:46): 「On green this workflow files nothing, edits nothing and closes nothing.」 Its schedule is cron: '29 5 * * *' (:81) ⇒ the next run is due ~2026-09-12T05:29Z, and a green one will leave this card exactly as it is. The card is therefore closed by hand or not at all — and :54 says a closed card is never reopened, a later red is filed fresh, so closing it costs this channel nothing.

• ⛔ Not dispatched. Every work item this card names is already on main; a dev would open the file, find the repair, and stop with evidence. That is a correct outcome and still a wasted worktree.
• ⛔ Not closed yet. 判据取命令输出 — the close criterion is the next Nightly Tiers run reporting green on a head that contains 5ddd5d3f, ⛔ not my prediction that it will.
• The wait is written here because 「等待也是状态,写在卡上才存在」. This lane skips this card in the selection order until that run reports, and dispatches the next card by the same order instead.

Close criterion, for whoever gets here first: Nightly Tiers run newer than 34566550033 on main, conclusion: success, head containing 5ddd5d3f ⇒ close as completed, citing the run id. If it is red again on this same file, the body will have been rewritten in place by the report job and the card is live work again — re-read the new body before dispatching, ⛔ do not act on the transcript above. If it is red on a different file, that is a different defect wearing this card's title; grade it fresh.

---

Generated by Claude Code