docs(scripts,ci): two drifted counts become the relation and a dated reading (objectui#8122)

[claude]

Fixes #8122

Comments only, in two files. No behaviour, no floor, no scan population moves: minFiles: 3 and every SCAN_ROOTS row are byte-identical, and changeset-release.yml's step list below the header is untouched.

Re-derived first, on this branch's base (1706d8be4), not on the card's commit

claim	card's reading (59a3a233d)	this branch's base (1706d8be4)
check-shell-escape-residue population	206 files / 1309 fences	206 files / 1310 fences (gate's own verdict line, pasted below)
pnpm test scripts/__tests__	112 files / 3360 tests	121 files / 3618 tests

Both defects reproduce, and site 2 is worse than the card says: 73 files was never true at the measurement date its own block declares — main carried 81 test files on 2026-08-25 (git ls-tree -r --name-only 129c7a9e7 scripts/__tests__ | grep -c '\.test\.'). The card's own figures had already drifted in the two days between filing and this branch, which is the argument against writing today's number in either place.

Carriers of the fact — swept for the fact, not for the card's list

The card names two sites. The fact has seven carriers; five were already in a form that cannot go stale, so only the two the card names are edited.

#	carrier	state today	action · staleness mode left behind
A1	scripts/check-shell-escape-residue.mjs docblock, "203 of today's 207 files"	false (202 of 206), no measurement point	rewritten. The sentence is now the RELATION with no numeral, and it names summarise() — the function that prints the live per-root population. Staleness mode left behind: none; a rename of that identifier breaks in-file rather than drifting silently
A2	.github/workflows/lint.yml:291 — "206 file(s) and 1309 fenced block(s)"	true at its declared point	left. The paragraph opens "Measured on origin/main 28cfff4". Verified by re-running the gate against an extracted 28cfff4 tree: it prints that string verbatim
A3	scripts/check-bash32-floor.mjs:51 — the same quote	true at its declared point	left, same declaration, same control run
A4	content/docs/guide/ci-cd-pipeline.md, Shell Escape Residue section	numeral-free relation (objectui#7965's repair)	left. This is the rewrite site 1 now copies
A5	same docblock: "Measured when this landed: 1 / 1 / 18 / 184 files…" and "Measured for the widening (objectui#7403, 6aeba67): 4 files, 20 fences"	dated claims, permanently true	left
A6	same docblock: "Every .md/.mdx under .claude/ today is under .claude/skills/ (4 of 4)"	true and machine-pinned — the gate prints coverage -- .claude: 4/4 on every run and reds when a document escapes a declared root	left. This one cannot drift silently; a pin reads it
B1	.github/workflows/changeset-release.yml — "73 files / 1996 tests" (card said line 1035; it is line 1087 today)	false under both readings: 121 files today, 81 on the block's own declared date	rewritten. The middle column now names the directory. The drift is recorded with its measurement point ("until objectui#8122, by which time the directory held 121 files and 3618 tests"), and the reader is pointed at the run's own Test Files / Tests line
B2	content/docs/guide/ci-cd-pipeline.md:1531 — "112 test files / 3360 tests on main@59a3a233d"	true, declares its measurement point	left. objectui#7965 already converted it; re-stating it here would only add a second thing to maintain

The ~1 s / ~4 s / ~50 s column is kept — it is what the scoping decision was made on — but its summary line is now dated (Measured green on a real rendered tree, 2026-08-25) with a note that the suite has grown since, so the wall clocks are that day's readings rather than a claim about today.

Examined and deliberately not touched (same block, different facts, both true or unverifiable):

• "the 40 generated CHANGELOGs" — true today: .changeset/config.json has one fixed group of 40 packages.
• "(measured — 7 of 7 matches)" / "adds an eighth" — the claim it supports still holds (every test that reads a manifest version, QUICK_REFERENCE.md or a CHANGELOG.md is under scripts/__tests__; six carry code-level references, the three matches outside that directory mention those files only in prose). The count itself has no stated definition of "reads", so it cannot be re-derived unambiguously — re-counting it would be exactly the move this card exists to stop. Left as is, reported rather than edited.

What pins any of this

Nothing pins either edited numeral — that is the card's second finding, and it is confirmed: the pin family objectui#7448 / objectui#7825 / objectui#7888 pins numerals in workflow headers but not this one, so site 2 looked pinned and was not. No test in scripts/__tests__/ reads 1996, 73 files, 207 files or 203. Site 1's repair replaces that gap with something better than a pin: the sentence now points at the identifier whose output carries the live figure.

Verification (real output)

check-shell-escape-residue after the edit — the run whose own verdict line the old sentence contradicted:

✅  check-shell-escape-residue: OK (5/5 root(s) resolved -- AGENTS.md: 1 file(s), 15 fence(s); CLAUDE.md: 1 file(s), 0 fence(s); skills: 16 file(s), 210 fence(s); .claude/skills: 4 file(s), 20 fence(s); content/docs: 184 file(s), 1065 fence(s); 206 file(s) and 1310 fenced block(s) examined in total; 0 occurrence(s) outside a fence (counted, not judged); coverage -- .claude: 4/4; skills: 16/16 document(s) under a declared root).

The control for leaving A2 and A3 alone — the same gate, run against a tree extracted at 28cfff4, the commit those two carriers name:

✅  check-shell-escape-residue: OK (5/5 root(s) resolved -- ... 206 file(s) and 1309 fenced block(s) examined in total; ...)

pnpm test scripts/__tests__ (through the shared verify lock), which contains every workflow pin test and the gate's own suite — before and after are the same green:

 Test Files  121 passed (121)
      Tests  3618 passed (3618)
   Duration  100.46s
os-verify-lock: VERDICT command-exit 0 · held the lock 102s (1m42s) · waited 0s

Other gates, exit codes captured before any pipe:

node scripts/check-control-bytes.mjs        exit=0   scanned 6699 tracked text file(s); skipped 85 binary
pnpm check:bash32-floor                     exit=0   12 tracked shell file(s) ... floor bash 3.2
pnpm check:comment-mask-corpus              exit=0   4480 files, 1 disagree (within the objectui#7882 ceiling)
pnpm lint:root                              exit=0   32 warnings, 0 errors (this lane's whole population, not a narrowed run)
node scripts/check-changeset-presence.mjs   exit=0   "No source or published contract of a released package changed in this range, so no changeset is owed."
node scripts/check-governed-queue-guard.mjs --test (both paths)  NOT GOVERNED
grep -naP over both changed files for control bytes: no hits

Changeset: none. Not a guess — check-changeset-presence reports 2 file(s) changed, 0 of them published source of a package the release covers, 0 of them a manifest whose published contract moved.

Draft by dispatch: this PR is left in draft for a human to merge.

---

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code

[claude]

⚠️ Dequeued by the merge queue, ⛔ not merged — and the failure is not this PR's. domain:devx @ objectui execution seat, PM session session_01FhBNJcLRZLe8M87VcUgpKr, R46, 2026-09-08T01:45Z. Recorded here so the next reader does not re-derive it.

github-merge-queue[bot] removed this PR at 01:10:28Z (added 00:59:48Z). Auto-merge is off as a side effect; the PR itself is open, clean, and its own head CI was 28 checks all green.

What failed in the group

Group gh-readonly-queue/main/pr-8462-c13d39e87…, job Test (shard 2/4):

FAIL packages/plugin-kanban/src/ObjectKanban.contractEnvelope-6839.test.tsx:134
  ObjectKanban — the find() envelope it reads (objectui#6839)
    > still reads the contract's `data` member
  AssertionError: the declared rows member must still draw both cards: expected +0 to be 2
Test Files  1 failed | 675 passed (676)
Tests       1 failed | 8992 passed (8993)

This PR's entire diff is two comment blocks — one in scripts/check-shell-escape-residue.mjs, one in a workflow header. minFiles: 3 untouched, no assertion moved, no runtime source in the diff at all. It cannot reach kanban card rendering.

⭐ The discrimination, measured rather than argued

⛔ "It can't be mine" is not a root cause, so the window was narrowed with a control:

reading	base	Test (shard 2/4)
PR #8470's head 5504e7c39	868e82501	success
this PR's merge-queue group	c13d39e87	failure, on the test above

⇒ The failure entered between 868e82501 and c13d39e87. That window is exactly three commits: 617707a48 (#8456, fix(core): lower $and / $or to real AST group nodes in convertFiltersToAST — the only one touching packages/core/src/utils/), d7fecfbcf (#8457) and c13d39e87 (#8460), the last two both plugin-detail.

⛔ This seat does not name which. The failing test unwraps through extractRecords in @object-ui/core; objectui#8436 rewrote that helper at 23:34Z but kept the data arm — it removed records — so #8436 alone does not explain a data-case zero. Proximity is not evidence, and the repair lands in packages/core or packages/plugin-kanban, ⛔ neither of which is this lane's.

What this seat is doing about it

1. The queue is held for this lane — docs(scripts,ci): two drifted counts become the relation and a dated reading (objectui#8122) #8462 is not being re-queued, and tooling(devx): report source files ESLint reaches for NEITHER reason #8467 / docs(plugin-calendar): rewrite the two object-calendar examples onto declared keys, and annotate them #8470 are staying draft despite green CI. Feeding PRs into a queue that will dequeue them burns cycles and makes each dequeue read like the PR's own failure.
2. The outstanding control is main's own CI at c13d39e87. ⚠️ Note for whoever reads this next: on main the job is named Test (coverage shard N/4), not Test (shard N/4) — a waiter matching the PR-side name will hang forever, which it did here before being corrected.
3. If that run is red, Test (shard 1/4..4/4) is a required check, so the merge queue is blocked for every lane — shared damage, and this seat files and reports it immediately rather than routing around it. ⛔ No existing card covers it: the 20 most recently created issues were read.
4. If it is green, the failure is specific to the group combination and this PR goes straight back through flip → guard → arm → queue.

⛔ Nothing about this PR needs changing meanwhile: no rebase, no changes requested, no force-push. The head that was green is the head that will be re-queued.

---

Generated by Claude Code

[claude]

LANDED — domain:devx @ objectui execution seat, PM session session_01FhBNJcLRZLe8M87VcUgpKr, R46. PR #8462 merged 2026-09-08T01:44:44Z as 70de47248; probe run on a clean extract of re-fetched origin/main, ⛔ never on the shared working tree.

leg	reading on origin/main@189328d3d
probe — 203 of today's 207 files gone	0
probe — summarise() named in the rewritten paragraph	:234 every run prints each root's own population through \summarise()` below`
control — minFiles: 3 untouched	present at :230 (the prose) and :262 (the live SCAN_ROOTS row)
control — the dated carriers survive	lint.yml:288, check-bash32-floor.mjs:41 / :212 / :1307, all still Measured on origin/main 28cfff4
control — the grep fires	minFiles × 16

⚠️ One leg returned 1 where this seat predicted 0, and the instrument was again the problem. 73 files / 1996 tests still matches — at :1096, inside the sentence the fix itself wrote:

⭐ The middle column names that directory instead of counting it, for the same reason. It read "73 files / 1996 tests" until objectui#8122, by which time the directory held 121 files and 3618 tests…

⇒ That is the dated historical form — precisely the shape this card exists to produce. A probe string that cannot tell "the live column says X" from "the column used to say X, and here is when it stopped" is asking the wrong question. Same lesson as #8461's docblock false hit an hour ago: a raw grep over a whole file cannot answer a question that is about one region of it.

pm:dispatched stripped in the same pass; domain:devx, documentation, tooling, priority:p3 stay — 归属不是状态. The card closed via Fixes.

---

Generated by Claude Code