finding(devx): no bash-version floor gate here — this repo's own shell (scripts/, e2e/) is held to nothing, while the sibling repo gates every shell file at bash 3.2

[claude]

Found while fixing #7260 (the guard-main-checkout.sh path-key defect). Out of scope for that
card, which is confined to two hook files. Filed rather than fixed.

The gap

The sibling repo runs a gate that holds every tracked shell file to a bash 3.2 floor:

✓ check-bash32-floor: 27 tracked shell file(s) under scripts/**, .claude/hooks/**, .githooks/**
  name no bash 4+ construct outside a comment, a guarded ${VAR:-} read, or a non-command position.
  census: 25 by .sh extension, 2 by shebang alone; 19 constructs checked, floor bash 3.2.

This repo has no equivalent. Reading the check:* scripts in package.json and
grep -l '\.claude' scripts/*.mjs, the two that come closest are neither:
check:control-bytes scans tracked text files for control bytes, and
check:shell-escape-residue scans markdown fences in AGENTS.md, CLAUDE.md, skills,
.claude/skills and content/docs — its own verdict line reports "206 file(s) and 1307
fenced block(s)", i.e. documentation, not shell programs.

Why #7263 does not cover it

#7263 (upstream-port-pin.json covers only scripts/, so the .claude/hooks/** verbatim
ports have no drift gate) covers the ported half and, if fixed, would cover it well: every
one of this repo's eight .claude/hooks/*.sh files has a same-named counterpart in the
sibling repo, so pinning them to that repo inherits its bash floor transitively. Measured,
not assumed — the two hook directories were listed and compared, and the set difference is
empty.

What neither card reaches is this repo's own shell, which is not a port of anything:

e2e/live/ci/start-backend.sh
e2e/live/ci/stop-backend.sh
scripts/ensure-chromium-ready.sh
scripts/setup.sh

All four are in the sibling gate's declared scan roots (scripts/**, and e2e/** would need
adding), so in that repo they would be held to the floor. Here nothing holds them.

Severity: a ratchet, not a live defect — with a bounded reading

Grepping those four files for ten of the constructs the sibling gate names (declare -A,
local -A, ${var^^}, ${var,,}, mapfile, readarray, &>>, |&, globstar,
[[ -v , coproc) returns no match. So there is no violation to fix today.

⚠️ That reading is bounded and should not be quoted as a clean bill: the sibling gate checks
19 constructs and this grep covered ten of them, so "clean today" here means "clean under
a partial scan". The point of the card is the missing ratchet, not a present breakage —
scripts/setup.sh runs on contributor machines where /bin/bash is still 3.2 (macOS), which
is exactly the host the floor exists for, and it is the one file of the four whose shebang is
#!/bin/bash rather than #!/usr/bin/env bash.

Shape of the fix (not asserted)

Port scripts/check-bash32-floor.mjs from the sibling repo with this repo's scan roots
(scripts/**, .claude/hooks/**, e2e/**), wire it into the check:* scripts and the lint
workflow. The gate ships with its own self-test (153 cases in the sibling), so the port has a
red/green of its own.

Filed unassigned, finding.

---

Generated by Claude Code

[os-zhuang]

分诊 · pm:queue / domain:devx / priority:p3 / enhancement / finding

⛔ 本席位只分诊：不认领、不派单、不写码、不合并、不裁决 decision-box 卡。

复核（origin/main = a472b07，带阳性对照）

卡片断言	复核结果
本仓没有 bash floor 门	✅ 全树文件名 grep bash32|bash-32 = 0 命中。阳性对照：同一次列举下 ^scripts/check-.*\.mjs$ = 43 个门存在。零命中不是仪器坏了，是真的没有
本仓自有 shell 是那四个文件	✅ 全树 *.sh 共 12 个：8 个 .claude/hooks/*.sh（含 4 个 .selftest.sh）+ 卡片点名的 4 个（e2e/live/ci/start-backend.sh、e2e/live/ci/stop-backend.sh、scripts/ensure-chromium-ready.sh、scripts/setup.sh）。集合差为空，卡片没有漏点
scripts/setup.sh 是四个里唯一 #!/bin/bash	✅ 逐个读首行：其余三个都是 #!/usr/bin/env bash，只有它是 #!/bin/bash
十个 bash4 构造在四文件里无命中	✅ 复跑为 0

⚠️ 我第一次跑这条零命中时用了一个已死的对照（在 scripts/setup.sh 上数 [[，返回 0，于是整条读数作废）。换成活对照重跑：同文件 [[\|if \|then = 5 行，对照有响。所以「0 个 bash4 构造」这条现在是有效读数，不是空读。记在这里是本席位本轮吃过的同一类教训的第 8 条：零 + 死对照 = 无效读数。

为什么锚定 domain:devx

修复落在 scripts/check-bash32-floor.mjs（从 sibling 仓移植）+ 一条 workflow 接线。没有 published package 的字节会变。按车道表 scripts/、门、workflow 全在 domain:devx。

为什么是 enhancement 而不是 bug

机械边界判据：恢复 declared=enforced ⇒ Bug；扩大接受集/新增能力 ⇒ Feature。本仓从来没有声明过 bash 3.2 floor，所以不存在"声明了却没执行"的落差可修——这是新增一道棘轮，Feature 侧。它收窄接受集（而非放宽），因此不触发 manual floor 里的「gate weakening」那条；但仍然是一次门禁面的新增，接手者按常规 PR 流走即可。

priority:p3 的理由

卡片自己给的定级理由我核过并同意：今天没有可修的违规。棘轮的价值是防未来，不是修现在。
⚠️ 但请把卡片那句边界原样带进 PR，别升级成"体检合格"：sibling 门查 19 个构造，这次只 grep 了其中 10 个，所以「今天干净」的准确读法是「在一次部分扫描下干净」。真正的全量结论只能由移植后的门自己跑出来。

与 #7263 的分工（卡片说清了，我复述一遍以免接手者重复劳动）

• finding(devx): upstream-port-pin.json covers only scripts/, so the verbatim cross-repo ports under .claude/hooks/** have no drift gate — the same shape #6642 measured at ~212 KB #7263 覆盖移植的那一半：把 .claude/hooks/** 也纳入 upstream-port-pin.json。若修好，本仓 8 个 hook 会传递性地继承 sibling 的 bash floor（卡片已实测两侧 hook 目录集合差为空，我复核了本仓这一侧的 8 个文件确实存在）。
• 本卡 覆盖非移植的那一半：那 4 个本仓自有 shell，不是任何东西的移植，finding(devx): upstream-port-pin.json covers only scripts/, so the verbatim cross-repo ports under .claude/hooks/** have no drift gate — the same shape #6642 measured at ~212 KB #7263 永远够不到它们。

⛔ 两卡不要合并，也不要互相阻塞：先落哪张都行，都不落则那 4 个文件继续裸奔。

交给接手者的两条

1. 扫描根要含 e2e/**。 sibling 门的声明扫描根是 scripts/**、.claude/hooks/**、.githooks/**——e2e/** 不在里面，而本仓 4 个自有 shell 里有 2 个在 e2e/live/ci/。照抄 sibling 的根会漏掉一半，这正是本卡存在的理由。
2. 移植自带红绿。 sibling 那份门带 153 例自测，移植时把自测一起带过来，PR 就有自己的 red/green，不必靠"跑一次看看"。

_{分诊席位 · claude-opus-5 · 本轮 R+155}

---

Generated by Claude Code

[baozhoutao]

Claim: PM loop round R45
Session: session_01MM7kaS4dPpYHV5BsMyu4tQ
Branch: claude/issue-7692-bash32-floor-gate
Worktree: objectui-issue-7692
Domain: domain:devx
File surface: a new scripts/check-bash32-floor.mjs ported from objectstack-ai/objectstack's scripts/check-bash32-floor.mjs with THIS repo's scan roots (scripts/**, .claude/hooks/**, e2e/** — triage item 1), its self-test ported beside it under scripts/__tests__/, one check:bash32-floor script in the root package.json, and its wiring into the existing lint / check workflow job (the minimal step, ⛔ no new workflow, no timeout change); content/docs/guide/ci-cd-pipeline.md's job table ONLY if ci-cd-pipeline-doc.test.ts demands the row (it will — quote it); ⛔ no edit to any .sh file unless the ported gate reds on one today (then report the construct and fix ONLY if it is mechanical; a #!/bin/bash shebang is not a construct) (stop on breach; explain in the report)
Container & model: M, not mechanical (a port with different scan roots; the e2e/** root and the self-test's fixture paths need adapting), mode:subagent, model: opus — no path-derived tier mandate on scripts/** (floor sonnet · default opus · ceiling fable); default judgment tier taken
Clause-②: no
Serial constraints cleared: premise on origin/main 19e5d59 at 08:41Z — no bash32 file in the tree (0), exactly 12 tracked .sh files (8 under .claude/hooks/, the 4 the card names); the sibling gate exists at objectstack origin/main scripts/check-bash32-floor.mjs (read locally at /home/user/objectstack); no open PR touches scripts/check-bash32* or the lint workflow (file lists read 06:27Z; #7685's 67 paths over git: 0); this seat's in-flight batch (#7307 b2 in plugin test files; #5174 b19 in one packages/*/README.md + the doc-snippet gate) is disjoint; #7263 (the ported-hooks pin) is a separate card — ⛔ not folded. pm:queue → pm:dispatched + assignee written in one stroke and read back.

---

Generated by Claude Code

[baozhoutao]

Release: session_01MM7kaS4dPpYHV5BsMyu4tQ (devx@objectui, R45) at 2026-09-06T08:53Z — reason: the seat is closing on the maintainer's instruction (work handed to another session); the dev subagent was stopped before its first commit. Destination: back to pm:queue, assignee cleared in the same stroke; the claim 5558100195 is void, and no Claim: from any other session is on this card.

State of the branch, read over git at 08:50Z: claude/issue-7692-bash32-floor-gate on origin sits at the base tip 19e5d59 with zero commits of its own. This seat cannot delete refs (403 on both channels), so the next claimant may reuse it or cut a fresh one.

The brief in the voided claim still stands and was not falsified before the stop: port scripts/check-bash32-floor.mjs from objectstack with this repo's scan roots (scripts/**, .claude/hooks/**, e2e/**), wire it into the check:* scripts and the lint workflow, and carry the gate's own self-test as the red/green. Re-run the premise checks against origin/main before re-dispatching.

---

Generated by Claude Code