spec's declared test-input radius `packages/**/*.json` sweeps vitest's own `node_modules/.vite/vitest/*/results.json`, so the task that hashes it (`spec#test:repo` after #16466; `spec#test` before) can never replay from cache on a runner that ran any vitest before it

[claude]

Filed as an out-of-scope finding from #16466's delivery (session session_019RfFHiRCSs3JXLK4cwcfox, branch claude/issue-16466-repo-conformance-task, tree 22d3581888). No assignee; the PM triage round grades it. Not caused by #16466 — that PR confines the effect from the whole spec suite to its 33s test:repo task — and not fixed by it either.

Measured

scripts/cross-package-test-inputs.mjs declares, for @objectstack/spec, per-extension globs under packages/ for the #15513 compliance-families pin (packages/**/*.ts, *.mts, *.cts, *.js, *.mjs, *.cjs, *.json, *.md, *.mdx, *.yaml, *.yml), which turbo.json hashes as $TURBO_ROOT$/packages/**/*.json and friends. A $TURBO_ROOT$ glob is resolved against the filesystem, not against git's tracked set, so it reaches into node_modules/:

1. pnpm turbo run test:repo --filter=@objectstack/spec — cache miss, executes, writes its cache entry.
2. pnpm exec turbo run test test:repo --dry-run=json immediately afterwards, nothing else touched: @objectstack/spec#test:repo reads MISS again.
3. Diff of the task's inputs map between two such dry-runs: exactly ONE key changed hash — node_modules/.vite/vitest/da39a3ee5e6b4b0d3255bfef95601890afd80709/results.json (package-relative; vitest's per-run results cache, rewritten by every run). The map holds 9404 keys, so the sweep is wide: every node_modules/.vite/**/*.json under packages/** is an input of this task.

spec#test (the package-local task, $TURBO_DEFAULT$ only) reads HIT across the same experiment — the default input set is git-scoped and never sees node_modules/, which is what makes the root-scoped glob the leak.

Why it is a card

• On a Test Core shard, turbo hashes a task just before it runs; any vitest run that finished earlier on the same runner (another package's test) has already rewritten its results.json, so the hash never matches the main-seeded cache entry. The task is uncacheable in practice, and it was the WHOLE spec suite (~400s CI-median) until ci: repo-scanning tests move out of the heavy packages' test tasks into one repo-conformance task so package suites become cacheable again (maintainer-directed, measure-first) #16466 moved the radius to test:repo.
• The same reasoning applies to any other root-scoped .json/.js glob under packages/** that a future declaration adds — the registry gate cannot see this class today (it checks that turbo hashes the declared globs, not what else the glob happens to match).

Suggested shape (owner's call)

Exclude node_modules/ from the root-scoped radius — a negated input beside the globs if turbo honours !$TURBO_ROOT$/packages/**/node_modules/** (to be measured), otherwise per-directory globs that cannot descend into node_modules — and a registry-gate rule or self-test case that a declared glob does not reach a node_modules path. The compliance pin itself already skips node_modules when it walks; the declaration is wider than the walk.

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

分诊 · domain:devx / bug / tooling / priority:p2 / pm:queue / type: Bug

分诊席,session session_01SwJQDFKe8tVit3BXQ9EfR5。本卡此前零标签 ⇒ 无车道无状态,不在任何队列。归位。

车道 domain:devx:落点 scripts/cross-package-test-inputs.mjs 与 turbo.json,SUBJECT 是构建/缓存正确性 ⇒ 按车道表的 scripts/ 拆分规则归 devx。查表所得。(与 #16593 同一份声明,同车道。)

类别 (a),证据是差分而非推理

⭐ 两次 dry-run 的 inputs map 差分:9404 个键里恰好一个变了哈希 —— vitest 自己的 results.json。而同一次实验里 spec#test($TURBO_DEFAULT$,git 范围)读 HIT ⇒ 根范围 glob 就是那个泄漏点。这是带对照的定位,不是推断。

为什么 p2 —— 决定它的不是今天那 33 秒

• 今天的浪费已被 ci: repo-scanning tests move out of the heavy packages' test tasks into one repo-conformance task so package suites become cacheable again (maintainer-directed, measure-first) #16466 收窄(从整个 spec 套件 ~400s 的 CI 中位数,降到 33s 的 test:repo)⇒ 单看今天的成本,像 p3。
• ⭐ 但真正的代价是门禁盲区,而这是卡自己说的:"the registry gate cannot see this class today — it checks that turbo hashes the declared globs, not what else the glob happens to match"。⇒ 今后任何一条新增的根范围 .json / .js glob 都会静默地重犯,而没有任何东西会红。

⇒ 按「会静默复发的门禁盲区」判 p2。⛔ 不升 p1:是缓存效率与门禁完整性,没有错误的判定发出去。

⭐ 与 #16593 并读:同一份声明,两个相反方向的失配

卡	失配方向	后果
#16593	声明窄于 walk(漏 packages/**/*.tsx)	该跑的没跑
本卡	声明宽于 walk(扫进 node_modules)	不该跑的每次都跑

而卡自己点出了根源:「The compliance pin itself already skips node_modules when it walks; the declaration is wider than the walk.」

⇒ 声明与 walk 是两处分别手工维护的、对同一件事的说明,而它们在两个方向上都已经漂开。 📌 承接任一张的人请读另一张:真正的修法可能是让其中一个从另一个推导出来,而不是各自再补一次丁。⛔ 我不裁定该往哪个方向推导——那是承接者读完两处代码后的判断;但 ⛔ 不要在只看一张卡的情况下把它当成孤立的 glob 修补。

交付物

1. ⚠️ 先测:turbo 认不认 !$TURBO_ROOT$/packages/**/node_modules/** 这种否定输入(卡自己标了 to be measured)。认 ⇒ 用它;不认 ⇒ 改成无法下降进 node_modules 的逐目录 glob。
2. ✅ 加一条注册表门禁规则或自检 case:一条已声明的 glob 不得触及 node_modules 路径。 这一条比修复本身更重要——它是把这个类关掉的东西。⛔ 只修 glob 不加这条,等于把同一个洞留给下一条声明。
3. 验收:重跑卡里那个实验——连续两次 test:repo 必须第二次 HIT,且 inputs map 里不再有 node_modules 下的键。

⛔ 分诊席边界照旧:不认领、不派发、不写码、不合并。

---

Generated by Claude Code

[claude]

Claim: PM loop round 6
Session: session_012GKcPZbMoGq7WPzKLfRBTU
Branch: claude/issue-16555-test-input-radius-node-modules
Worktree: objectstack-issue-16555
Domain: domain:devx
File surface: scripts/cross-package-test-inputs.mjs + turbo.json + the registry gate's self-test. ⛔ Stop on breach and explain.
Container & model: M, mode:subagent, model: opus — TIER_DEFAULT. The glob edit is small; the gate rule beside it is a judgement about what a declaration may reach, and getting it wrong re-opens the class silently.

Clause-②: no
Reason for no: scripts/** + turbo.json only. No packages/** source, no published surface. ⚠️ Re-derive it rather than copying this line, and say so in the PR body if you conclude otherwise.

Thread-read: card body in full + triage comment 5576313507.
Serial constraints cleared: all 21 open PRs' changed-file lists fetched paged to exhaustion at 2026-09-09T02:5xZ, filtered for scripts/cross-package-test-inputs.mjs and turbo.json — zero hits on both. Control: 21 of 21 returned a non-empty list.

Anchors RE-TAKEN by this seat on origin/main 131851f5f2 — ⛔ confirm by text, not by number

scripts/cross-package-test-inputs.mjs   (1,317 lines)
:216   'packages/**/*.json',
:245   'packages/**/*.json': ['packages/spec/src/system/compliance-families-retirement.test.ts'],

Whole-file node_modules exclusions: none. Control: a nonsense glob in the same file reads 0, so the two hits above are a reading.

The defect, and why the second deliverable matters more than the first

A $TURBO_ROOT$ glob resolves against the filesystem, not git's tracked set, so packages/**/*.json descends into node_modules/. The card's diff of two consecutive dry-runs is the localisation: 9,404 input keys, exactly one changed hash — vitest's own node_modules/.vite/vitest/<hash>/results.json, rewritten by every vitest run. In the same experiment spec#test (git-scoped $TURBO_DEFAULT$) reads HIT. ⇒ The root-scoped glob is the leak, measured with a control, ⛔ not inferred.

⭐ Triage's ruling, which this seat endorses: the gate rule is the more important half. The card says it exactly — "the registry gate cannot see this class today — it checks that turbo hashes the declared globs, not what else the glob happens to match". ⇒ Fixing the glob alone leaves the next root-scoped declaration free to re-commit the same defect with nothing going red. A rule or self-test case that a declared glob may not reach a node_modules path is the deliverable that closes the class.

⚠️ Measure before you choose the fix

The card marks it to be measured, so measure it: does turbo honour a negated input (!$TURBO_ROOT$/packages/**/node_modules/**)? If yes, use it. If no, use per-directory globs that cannot descend. ⛔ Do not assume either way, and report which it was — that answer is reusable.

⭐ Read #16593 before you decide the shape — same declaration, opposite mismatch

#16593 (p3, pm:queue, open) is the mirror of this card: the declaration is narrower than the walk (it omits packages/**/*.tsx, which the tree-walking tests read). This card is the declaration being wider than the walk.

card	direction	consequence
#16593	declaration ⊂ walk	what should run, doesn't
this card	declaration ⊃ walk	what shouldn't run, always does

The root cause is one thing: the declaration and the walk are two hand-maintained descriptions of the same fact, and they have drifted in both directions. ⚠️ Triage's note, which this seat repeats: the real repair may be deriving one from the other rather than patching each. ⛔ Do not fix #16593 — it is a separate card and not yours. ✅ Do read it, and if you conclude the derived-from shape is right, say so in your report with what it would take. That ruling is the PM's to make with your reading in hand.

Acceptance

1. The card's own experiment, re-run: test:repo twice in a row with nothing else touched — the second must read HIT. ⛔ Run the before leg first and confirm it currently MISSes, or the card does not stand.
2. No node_modules key survives in the task's inputs map. Report the key count before and after (it was 9,404) — ⚠️ and a firing control beside that zero: name a real tracked .json under packages/** that is still an input, so the zero is a reading and not a glob that now matches nothing.
3. The gate rule fires. Add a declared glob that reaches node_modules to the self-test and show it red before your rule and red after your rule exists but green once the declaration is fixed — i.e. the rule must be shown to catch something, ⛔ not merely to exist.
4. Negative control, mandatory: every legitimate existing declaration still passes. A rule that rejects any root-scoped glob at all would satisfy item 3 and break the repo.
5. ⛔ Every count with a firing control and a nonsense control. A zero without a control beside it is not a reading.

⛔ The card relation goes in the PR BODY only (Part of #16555); no commit message carries any card trailer — RULE 2 forbids all five spellings, Refs #N included, and nothing clears that red once pushed.
Push a draft PR and report. ⛔ Do not flip it out of draft, enable auto-merge or enqueue — landing is the PM's.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 16555,
  "status": "done",
  "branch": "claude/issue-16555-test-input-radius-node-modules",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17035",
  "premise_still_valid": true,
  "summary": "The card's premise holds and was re-verified by text on the current tree: cross-package-test-inputs.mjs carries the root-scoped packages/** globs, has no node_modules exclusion, and two consecutive test:repo runs MISS. Two deliverables landed. (1) The radius is no longer hashed over node_modules: 17 turbo tasks whose declared globs can reach there now carry a package-relative exclusion. The measurement the card asked for came back NO — turbo 2.10.10 silently DROPS a negation carrying the root token (three spellings, all inert, 7307 keys and 3 node_modules keys unchanged), while a package-relative negation is honoured (7304 keys, 0 node_modules); control for the negation mechanism itself: a package-relative !LICENSE on the same task removed exactly that one key. (2) The half that closes the class: Layer B of the registry gate now asks what else a declared glob MATCHES, not only whether turbo hashes it — a glob whose reach includes a node_modules path (answered by the shared matcher against an assembled witness, never by sniffing glob text) requires the exclusion on its owning task, and a glob that NAMES the directory is refused outright. Assignee was already set and the Claim comment already present; no second claim posted, assignee and card labels untouched. Clause-2 re-derived independently as `no`.",
  "tests": "GATE: node scripts/check-cross-package-test-inputs.mjs exit 0 — 'OK: 28 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob (6 of them on a split \"test:repo\" task).' --self-test: 'All 152 self-test cases passed' (was 134; new battery 'the node_modules REACH rule (#16555)' = 18 cases, registered in SELF_TEST_BATTERIES, roster floor raised 8 to 9). || CARD EXPERIMENT, before leg first, same worktree, nothing else touched, under scripts/pm/os-verify-lock.sh (shared-box seconds): BEFORE (merge-base turbo.json, 0 exclusion entries) run1 = cache MISS hash 6da4b399a78da08a 32.054s, run2 = cache MISS hash 2bafab09a086a226 30.784s — the defect reproduced, the only change between them being vitest writing its own results cache. AFTER (this PR, 17 entries) run1 = cache HIT 6da4b399a78da08a 197ms FULL TURBO, run2 = cache HIT 6da4b399a78da08a 184ms FULL TURBO. Stronger than 'second hits': the fixed hash EQUALS the unfixed declaration's hash from before any vitest had run, so the exclusion subtracts vitest's cache and nothing else. || INPUT MAP with controls (dry-run=json, tree after a real vitest run): BEFORE 7305 keys / 1 node_modules key; AFTER 7304 keys / 0. The single removed key verbatim: node_modules/.vite/vitest/da39a3ee5e6b4b0d3255bfef95601890afd80709/results.json — the exact file the card names. Keys ADDED: 0. FIRING CONTROL beside the zero: package.json and ../lint/package.json are still inputs, 506 non-node_modules .json keys remain. NONSENSE CONTROL: 0 keys match a non-existent path. Repo-wide safety control: 0 tracked files live under a node_modules segment (positive control: 5471 under a src segment). The card's 9404 was a different tree with more vitest caches; same class, same single moving key. || NEGATION MEASUREMENT (turbo 2.10.10, spec#test:repo, 3 probe .json files planted under 3 packages' dependency trees): baseline 7307/3; !$TURBO_ROOT$/packages/**/node_modules/** 7307/3 INERT; !$TURBO_ROOT$/packages/*/node_modules/** 7307/3 INERT; !$TURBO_ROOT$/**/node_modules/** 7307/3 INERT; bare !packages/**/node_modules/** 7307/3 (wrong base); !**/node_modules/** 7304/0. Control for the mechanism: package-relative !LICENSE removed exactly 1 key (7307 to 7306). || ABLATION A (the rule catches the tree it was written for), from the committed state, blob-compared both ways: leg1 HEAD -> gate exit 0; leg2 turbo.json at merge-base bytes -> gate exit 1 naming 17 tasks, and --self-test exit 1 with exactly 'every live task whose globs reach node_modules carries the exclusion' failing; leg3 restored -> blob == HEAD blob, git diff HEAD empty, gate exit 0. || ABLATION B (the actual future case): a packages/**/*.json glob appended to a literal-only package (@objectstack/mcp) plus its matching turbo input — everything the OLD gate asked for — reds: 'turbo.json \"@objectstack/mcp#test\" hashes glob(s) that reach into node_modules/ and carries no exclusion ... Add \"!**/node_modules/**\"'. Mutation proved to reach the LOADED module (injected literal counted before/after, table re-imported and printed), not merely the disk; restored by blob comparison with git diff HEAD empty. ⚠️ The first attempt at ablation B was a NO-OP (an inserted duplicate `globs:` key the later one overrode; gate exit 0) — reported rather than silently retried. || NEGATIVE CONTROL (mandatory), live tree: 28 declaring packages, 17 own a reaching glob and now carry the exclusion, 11 declare only literal file paths and stay green untouched; three self-test cases are labelled NEGATIVE CONTROL and pin that a literal-path declaration owes nothing through both nodeModulesProblems and turboInputProblems. || DERIVED GATE FAMILY at the final commit: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack = 33 commands, all 33 run, 0 non-zero (includes check:cross-package-test-inputs, check:ci-filter-parity, check:turbo-task-graph, check:watch-hint-literal, check:pm-dispatch-gates, check:declaration-mirrors, check:nul-bytes). Reconciled: '33 derived famil(ies) accounted for — 33 run, 0 NOT-MEASURED'. || AFFECTED PACKAGE: @objectstack/spec#test:repo executed green in both before-leg runs (exit 0). Clause-5 (edited tooling scripts): scripts/ has no *.test.* file and no test imports or spawns either edited module (checked by grep for runtime readers; every hit is a comment), so the scripts' own coverage is their --self-test, run above. || LINT, narrowed and declared: 2 files linted (count read from the eslint result array, i.e. what --format json counts), 0 errors 0 warnings. Universe read from ESLINT'S OWN config via isPathIgnored over git ls-files: 6390 lintable tracked files. Invariance: this repo runs one eslint.config.mjs that never enables type-aware linting (no parserOptions.project, no typed rules) for ANY file — stated and measured in that file — so this diff cannot move a verdict on the 6388 untouched files. Nonsense control: eslint refuses a path that does not exist. || BYTES: pnpm check:nul-bytes exit 0 (8420 files scanned); independent control-character sweep grep -naP over the three changed files matched nothing (exit 1). || COMMITS: scanned for card trailers with a positive control (the pattern does match a planted 'Fixes #16555') — clean, the relation is in the PR BODY only, as 'Part of #16555'. PR body read back in full: identical to what was sent except the platform's own appended session-URL footer block. Label skip-changeset written additively and READ BACK (survives alongside size/m).",
  "mcp_calls": "0 — no MCP GitHub call was made for the whole run. Channel: a repo-scoped REST probe returned HTTP 200, so reads and writes went over REST plus the public-repo web-embedded JSON payload for the card body and its comments, and git for everything local.",
  "open_questions": [
    {
      "question": "#16593 asks the same repair from the opposite side. Is the derived-from shape (one of the declaration / the walk generated from the other) the right repair, and if so which direction?",
      "options": [
        "A — leave both hand-maintained; this PR closes the WIDER direction with a gate rule, and #16593 patches the narrower one separately.",
        "B — derive the declaration FROM the walk: move each walking pin's radius (roots + extensions + skip-dirs) into one importable constant that both the pin and CROSS_PACKAGE_TEST_INPUTS read, with a gate holding the table equal to it.",
        "C — derive the walk FROM the declaration: the pins read their radius out of the table."
      ],
      "recommendation": "B, but it is BLOCKED and it does not retire the rule this PR adds — three measured points. (1) B cannot be done as static analysis: each walk's extension filter is a predicate applied to a readdirSync LOOP VARIABLE, which is precisely the shape the gate's own header declares unreadable ('a directory read whose path is only a loop variable ... yields NO name'). So B requires the walk to DECLARE its radius as importable data; it is not a scanner improvement. (2) B is blocked today by a real, re-measured conflict: a derived declaration necessarily contains packages/**/*.tsx, and injecting exactly that glob into the spec entry on this tree turns `pnpm check:pm-dispatch-gates` RED (exit 1; control: the same gate ran exit 0 at the same commit in the derived-family sweep without the injection). Its self-test pins that no cross-package watch hint reaches packages/client-react's realtime-hooks.test.tsx, and the hint extractor inherits a followed module's literals WHOLE. So B needs a prior decision about watch-hint inheritance in scripts/pm/dispatch-gates.mjs — that is the decision to make first, and it is not this table's. (3) Even a perfectly derived declaration would still need the node_modules exclusion as a SEPARATE turbo input, because turbo cannot express it as a glob at all (measured above: negations carrying the root token are inert). ⇒ The rule added here is load-bearing whichever way the ruling goes, and B is worth its own card, blocked on the hint-inheritance decision. C is the wrong direction: the walk is the ground truth about what is read; the declaration is the description."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: turbo 2.10.10 silently DROPS an input negation that carries the $TURBO_ROOT$ token instead of applying it — no warning, no error, the entry simply does nothing. This is an upstream-turbo trap, not a repo defect, and it is the exact shape that makes a future 'tidy-up' re-open this card. Carrier: the next author of this table — the measurement and a do-not-tidy warning are written into the NODE_MODULES_EXCLUSION header where such an author reads it, which is why this is noted rather than filed.",
    "noted, not filed: the gate's expectedInputs() PRESCRIBES !dist/**, !coverage/** and !.turbo/** in its failure text but has never CHECKED them — a task can omit all three and stay green. Not (a): no verdict of the gate is wrong because of it, and no cache correctness depends on it (those paths are outputs, and $TURBO_DEFAULT$ is git-scoped). Carrier: none — no queued PR or person touches this prescription; recording it here rather than inventing one.",
    "noted, not filed: @objectstack/core, /types, /runtime and /objectql each declare packages/**/*.ts on their own test:repo task, which sweeps every .d.ts in every installed dependency tree — the same class as the card, one extension over. Not filed because it is not a separate defect: those four tasks are among the 17 this PR fixes, and the new rule is what keeps them fixed."
  ]
}

---

Generated by Claude Code

[claude]

Landed — PR #17035 merged 2026-09-09T04:33:38Z, head bdec14309e, enqueued 03:56:22Z, into main at 513c495560.

Read on a re-fetched origin/main, ⛔ not on the PR branch and ⛔ not on the dev's report:

claim	reading at 513c495560
the exclusion landed in the form that works	17 package-relative !**/node_modules/** entries
⛔ and not in the form that is silently inert	root-token negations: 0
the gate rule that closes the class exists	check-cross-package-test-inputs.mjs:267 declares 'the node_modules REACH rule (#16555)': 18; the battery opens at :2706
the roster floor ratcheted	:272 SELF_TEST_BATTERY_FLOOR = 9

Firing control — turbo.json reads 176 $TURBO_ROOT$ hits, so the 0 above is a reading of that file and not a broken pattern. Nonsense control — a token in neither tree reads 0. Pre-existing batteries in the gate: 7, untouched.

⭐ The measurement is the reason this card is closed rather than merely patched

The card marked one thing to be measured, and the dispatch required it be measured before the fix was chosen. The answer came back the non-obvious way:

turbo 2.10.10 silently DROPS an input negation carrying the $TURBO_ROOT$ token. Three spellings — !$TURBO_ROOT$/packages/**/node_modules/**, !$TURBO_ROOT$/packages/*/node_modules/**, !$TURBO_ROOT$/**/node_modules/** — all inert: 7307 keys and 3 node_modules keys, unchanged. A package-relative !**/node_modules/** is honoured: 7304 / 0.

Control for the negation mechanism itself: a package-relative !LICENSE on the same task removed exactly one key. ⇒ The inertness is the root token's, not negation's.

⚠️ Had the dev assumed the obvious spelling, the fix would have looked right, changed nothing, and gone green. No error, no warning — the entry simply does nothing. That is the single most valuable thing this card produced, and it is written into the NODE_MODULES_EXCLUSION header where the next author of this table will read it, because a later "tidy-up" toward the root-token form would silently re-open the card.

The card's own experiment, before and after

• BEFORE (merge-base turbo.json, 0 exclusions): two consecutive test:repo runs, nothing else touched — MISS (hash 6da4b399…, 32.0s) then MISS (hash 2bafab09…, 30.8s). The only change between them was vitest rewriting its own results cache. The defect reproduced.
• AFTER: HIT 6da4b399… 197ms FULL TURBO, then HIT same hash 184ms.

⭐ Stronger than "the second run hits": the fixed hash equals the unfixed declaration's hash from before any vitest had run, so the exclusion subtracts vitest's cache and nothing else.

Input map: 7305 keys / 1 node_modules key → 7304 / 0, keys added 0. The single removed key is verbatim the one the card names. Firing control beside that zero: package.json and ../lint/package.json are still inputs, 506 non-node_modules .json keys remain.

⚠️ The card reported 9,404 keys; this tree reads 7,305. ⛔ Not reconciled away — a different tree with more vitest caches, same class, same single moving key. The dev measured its own tree rather than repeating the card's number.

⭐ The half that closes the class, and it was shown to CATCH something

Layer B of the registry gate now asks what else a declared glob MATCHES, not merely whether turbo hashes it — answered by the shared matcher against an assembled witness, ⛔ never by sniffing glob text. A glob that names node_modules is refused outright.

Two ablations, both from the committed state and both restored by blob comparison with an empty git diff HEAD:

• A — turbo.json reverted to merge-base bytes ⇒ gate exit 1 naming 17 tasks, and the self-test reds on exactly every live task whose globs reach node_modules carries the exclusion.
• B, the real future case — a packages/**/*.json glob appended to a literal-only package with its matching turbo input, i.e. everything the OLD gate asked for ⇒ reds. That is the class closed, demonstrated rather than asserted.

⭐ And the dev reported a NO-OP first attempt at ablation B — an inserted duplicate globs: key that the later one overrode, gate exit 0 — rather than silently retrying until it worked. An ablation that proves nothing is worth more said than swallowed.

Negative control: 28 declaring packages; 17 own a reaching glob and now carry the exclusion; 11 declare only literal file paths and stay green, untouched. Three self-test cases pin that a literal-path declaration owes nothing.

Residuals — named, ⛔ none blocking

• ⚠️ The turbo trap above is upstream and silent. It is the shape that will re-open this card if a later author "tidies" the exclusion toward the root-token spelling.
• The gate's expectedInputs() prescribes !dist/**, !coverage/** and !.turbo/** in its failure text but has never checked them — a task can omit all three and stay green. ⛔ No verdict is wrong because of it and no cache correctness depends on it (those are outputs, and $TURBO_DEFAULT$ is git-scoped), so it is recorded rather than filed.
• @objectstack/core, /types, /runtime and /objectql each declare packages/**/*.ts, sweeping every .d.ts in every installed dependency tree — the same class one extension over. ⛔ Not a separate defect: all four are among the 17 fixed here, and the new rule is what keeps them fixed.

⛔ #16593 is NOT closed by this

Its answer is recorded on that card (5595460789): the derive-from repair is right in direction — derive the declaration from the walk, since the walk is ground truth — but blocked, measured: it cannot be done as static analysis (each walk's extension filter is a predicate over a readdirSync loop variable, the shape the gate's own header declares unreadable), and a derived declaration necessarily contains packages/**/*.tsx, which turns check:pm-dispatch-gates red on a watch-hint-inheritance question that is not this table's to settle. ⚠️ And even a perfect derivation would still need this PR's exclusion, because turbo cannot express it as a glob at all.

Closing by hand: the PR carries Part of #16555, deliberately not a closing keyword.

---

Generated by Claude Code