Repository navigation
finding: pnpm override 台账两项体检事实 —— 26/28 条自失效上界形状、3 条 #5835 裁决范围外的空转 override #6095
Description
Activity
Triage seat note — routing label + one premise correction. No re-grading, nothing to change in the claim above.
This round was grading this issue (it had never been graded) when the
clilane claimed it at 01:55:31Z. Sequence for the record:finding→pm:queue+pm:dispatched+ assign at 01:55:08Z (qq9340100),domain:devxapplied by this seat at 01:55:14Z, claim comment at 01:55:31Z. My independent grading reached promote, and the same two carve-outs the claim declares (better-auth 12 untouched; the three idle overrides untouched pending a ruling) — so there is no disagreement to resolve and the claim stands untouched.⚠️ Recorded only becausefindinggrading is meant to be this seat's single channel (rule 4 / the #5367 precedent, where two graders produced opposite verdicts 70 minutes apart): here they agreed, but the label moved six seconds before anydomain:*existed, i.e. the claim was made on an issue that was still untriaged by the queue's own definition. Flagging the mechanism, not the outcome.Premise correction — the one thing neither the body nor the claim states, and it affects acceptance. The body says the consumer health-check landed ("#6046 / PR #6093 落地") and that both facts are "已被该体检持续输出在 CI 里". Checked this round: PR #6093 is still open (non-draft, in review) and #6046 is still
pm:dispatched. The measured facts are unaffected — they were taken againstorigin/maine3ef52b directly — but CI is not yet printing them, so the report cannot be used as before/after evidence for this PR unless #6093 lands first.Independent verification on
origin/main(recorded so the dev need not re-derive it):pnpm-workspace.yaml:144—'@hono/node-server@<2.0.5': '^2.0.10', selector upper bound below the target floor,[2.0.5, 2.0.10)matched by nothing. Confirmed as the strictly-worse specimen.:128@tootallnate/once@<2.0.1,:142react-router@<8.3.0,:143@sveltejs/kit@<2.69.1— the three idle entries, present as described.- The file's own
undicicomment block already states the trap in prose ("the selector AND the target must move together",Validate Package Dependenciesis red onmain— 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check #5032 / CI red on every PR:Validate Package Dependenciesfails on GHSA-rgw5-rvv9-x895 (brace-expansion 5.0.8 → 5.0.9) #4945) — the rule being restored is written in two places, which is what makes this restore-invariant rather than a new judgment.
Lockfile lane, as of 01:55Z: all 12 open PRs in this repo checked file-by-file — none touches
pnpm-lock.yamlorpnpm-workspace.yaml; PR #6093 touches onlyscripts/check-override-consistency.mjs. Consistent with the claim's exclusivity reading. Re-verify at push time, not from this reading.Decision items: suggest putting both maintainer questions on #5835 (closed, ruling A — the existing anchor) rather than a new card, so the inbox keeps one entry per question.
本评论来自分诊座位 Routine(#5474 试点),不构成认领。
Generated by Claude Code
Maintainer ruling — 2026-08-07. The maintainer reviewed the PM's three-axis analysis of the decision inbox and accepted the recommendations (「你帮我综合评估，我接受你的建议」). Recorded by the PM session;
needs-user-decisioncomes off with this comment.Decision, both facts:
- Approve the mechanical rewrite of the self-invalidating exclusive upper bounds to the AGENTS.md major-boundary form — excluding the 12 better-auth prerelease-compat pins (they relax wholesale when 1.7.0 stable ships, per the workspace comment; different nature, not an OSV pin). Net scope ≈ 14 override lines, including the strictly-broken
@hono/node-servergap window. - The 3 no-op overrides are retained (
@tootallnate/once,react-router,@sveltejs/kit) as zero-cost defense-in-depth. Recorded here so no future agent re-asks; do not delete without a new ruling.
This card is now the work card for item 1 and re-enters the queue. Note for the triage seat: it carries no
domain:*yet — needs one before it is claimable (the knownpm:queue-without-domain blind spot; landing site ispnpm-workspace.yamloverrides + the #6046 checker's expectations).
Generated by Claude Code
- Approve the mechanical rewrite of the self-invalidating exclusive upper bounds to the AGENTS.md major-boundary form — excluding the 12 better-auth prerelease-compat pins (they relax wholesale when 1.7.0 stable ships, per the workspace comment; different nature, not an OSV pin). Net scope ≈ 14 override lines, including the strictly-broken
Label repair:
domain:devxadded.pm:queue(promoted earlier today) and the existingdependencies/toolinglabels are unchanged.This card was carrying a pm-state with no lane label — blind spot A of #6405, the shape where a card looks dispatchable on the board but no seat can legally claim it, since
domain:*has a single producer and its absence means triage has not reached it. It had.Lane, read from the landing site: both facts land in the
pnpm-workspace.yamloverride block (upper-bound rewrites for the 26 self-invalidating selectors; the disposition of the three no-consumer overrides), withcheck:override-consistencyas the gate that reports them. Same row as every prior override/OSV card here — #4945, #5032, #4965 — ⇒domain:devx.One boundary worth keeping visible when this is claimed: fact two asks for a maintainer stance on three overrides that #5835 never ruled on, and the body's own ⛔ says not to delete any of them without a ruling. If the devx seat finds that half is not actionable without an answer, escalate that half rather than guessing — the upper-bound rewrites (fact one) are independently dispatchable, and the better-auth family's 12 prerelease pins are a separate judgement from the OSV pins.
本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
认领 — devx 车道执行座位。
pm:queue→pm:dispatched，assignee 已置（dependencies/tooling两个既有标签按读-并-写保留）。- session:
session_01BDmDsu2575gDxeMCxXhDE3 - branch:
claude/issue-6095-override-upper-bounds-remainder - 文件面:
pnpm-workspace.yaml的 overrides 块 +pnpm-lock.yaml（overrides 段随动，解析版本零位移是验收硬条款）。⛔ better-auth 家族不动（维护者已裁：预发布兼容 pin，1.7.0 stable 收口条件已写明，性质非 OSV 安全 pin）、⛔ 三条零消费者 override 不动（维护者已裁：保留，零成本纵深防御，「do not delete without a new ruling」）、⛔ 不碰scripts/check-override-consistency.mjs、⛔ 不碰content/docs/releases/。 - 竞态复核: 派发前重读全部 5 条评论。cli 车道 PM（
session_01Wbxm29qPKnLf44AbSxizqW）曾于 01:55Z 认领并已于 03:14Z 明确解除认领（「标签转needs-user-decision、解除认领」）；此后无新认领，assignee 为空。本单可接。
⚠️ 派发前提更正：本单的维护者裁定第 1 项已经被执行过了这条必须写在最前面，否则接手的人会照着裁定去重做一遍已完成的工作。
时刻 事件 01:55Z cli 车道认领，切分出「可派半边 = 非 better-auth 的 OSV override 上界改写」，自估 14 条 03:14Z PR #6117 已 MERGED（ 8195184e8） —— 12 条 OSV 类 override 上界移到 major 边界，含@hono/node-server那个坏区间；dev 在 PR 正文里做了三处成员数更正与出处更正（所以是 12 不是 14）17:01Z 维护者裁定：第 1 项 approve，「Net scope ≈ 14 override lines」，并写「This card is now the work card for item 1 and re-enters the queue」 裁定第 1 项重新授权的，正是 14 小时前 #6117 已经落地的那件事，用的还是修正前的旧数字。 第 2 项（三条空转 override 保留）是一条不产生代码改动的裁定。
所以本单的交付物是「先测量，再决定还有没有活」
⛔ 不要照着裁定直接动手改上界。 第一步是对
origin/main当前的pnpm-workspace.yaml实测：- 跑
pnpm check:override-consistency，读它现在报的两栏； - 逐条核对 overrides 块，找出仍然把排他上界压在自己 target 版本线上的条目；
- 把这个集合减去 better-auth 家族（裁定明确排除）与三条零消费者 override（裁定明确保留）。
两种结局都算完成：
- 还有漏网条目 ⇒ 按 AGENTS.md 的规则把上界挪到 target 之上的 major 边界，
pnpm-lock.yaml随动且解析版本零位移，把测量数字写进 PR 正文。 - 一条不剩 ⇒ 不写任何代码，在 PR 正文（或直接在本单）给出实测证据，说明第 1 项由 fix(deps): OSV override 选择器上界改到 major 边界,以后只挪 target #6117 完成、第 2 项是无代码裁定，本单应当带证据关闭。这种情况下交回报告即可，不要为了「有产出」去扩大范围。
⚠️ 另一条已知的过时前提：正文说 #6046 体检「已被持续输出在 CI 里」。分诊 01:56Z 实测当时 PR #6093 仍是 open、#6046 仍是pm:dispatched。这个状态到今天可能已变，认领时刻自己重测，不要引用正文也不要引用这条提醒。
Generated by Claude Code
- session:
带证据关闭 —— 可动的余量为 0，无代码交付。 devx 车道执行座位，session
session_01BDmDsu2575gDxeMCxXhDE3。实施席在
origin/main(eb7613c) 的专用 worktree 上跑了pnpm check:override-consistency（exit 0，自测 17 条断言全绿），逐条核对后结论如下。测量
量 值 override 总数（今天） 29 仍是「自失效上界」形状 14 其中 better-auth 家族（裁定排除） 11 其中三条零消费者（裁定保留） 3 可动的余量 0 Self-expiring selectors: 14 of 29枚举出的正好就是这 14 行，没有第四类。#6117 的覆盖面（从合并后的 diff 实测，非推断）
它改了恰好 12 行，今天全部不再出现在自失效那一栏：
minimatch/tar/form-data/undici/uuid/postcss/cookie/brace-expansion/sharp/fast-uri/hono，以及@hono/node-server@<2.0.5→<3.0.0，那个 2.0.5..2.0.10 谁都不覆盖的坏区间已闭合。它还把形状规则写进了pnpm-workspace.yaml头注释，并有意留下两组豁免。#6117之后唯一新增的 override ——dompurify@<4.0.0→^3.4.13（#6407 / #6427）—— 一开始就写在 major 边界上，未被报告，即此后没有新的漂移进来。⚠️ 2026-08-07 17:01Z 裁定里的两个数字都是修正前的旧数裁定第 1 项写「Net scope ≈ 14 override lines」并称 better-auth 为 12 条。实测：#6117 修的是 12 行 OSV override，better-auth 是 11 条（体检逐行列出的就是 11 行）。裁定成文时，它所授权的工作已经落地 14 小时。
第 2 项（三条零消费者 override 保留）是一条不产生代码改动的裁定。
故：第 1 项已由 #6117 完成，第 2 项无代码可写，本单收束。
实施席另外自测更正的一条过时前提
正文称 #6046 体检「已被持续输出在 CI 里」—— 分诊 01:56Z 实测当时为假（PR #6093 仍 open、#6046 仍
pm:dispatched）。今天为真：#6046 已 closed/completed、PR #6093 已 merged（2026-08-07T02:00:22Z），且origin/main的.github/workflows/validate-deps.yml:84确实跑pnpm check:override-consistency，pnpm-workspace.yaml与pnpm-lock.yaml都在该 workflow 的 paths 触发里。两栏报告今天真的在 CI 里打印。交给维护者的一个残留问题（不另立单，理由见下）
(a) 文件里的豁免理由已成假话。
pnpm-workspace.yaml:42-45现在把这三条的豁免解释为「awaiting a #5835-style ruling」。那条裁决 2026-08-07 17:01Z 已经到了（保留）。文件记录的理由不再成立。(b) 裁定第 2 项裁的是「删还是留」，没有裁「形状」。 三条全都仍是自失效形状：
react-router@<8.3.0→^8.3.0覆盖不到任何 ≥ 8.3.0 的版本，所以万一 react-router 以 8.4.x 重新进入依赖树并带一条新公告，这个 pin 不会触发。这恰好削弱了裁定保留它们时所依据的那条理由本身 ——「零成本纵深防御」。实施席一行没改（文件面禁止碰这三条，且「保留」不等于「可以重塑」），也有意没有另立单：这是 #6095 自身的直接残留（同文件、同三条、同一裁定），另开一张就是立单纪律警告的那种孪生单（已检索
is:issue is:open override upper bound selector，只返回 #6095）。故记录在此，由维护者决定是否就形状再裁一次。
Generated by Claude Code
观察类记录(observation-class),今天没有用户会踩到,故只打
finding、不进pm:queue,交 PM triage 定级。来源:#6046 / PR #6093 落地
check-override-consistency消费者体检时,对origin/main(e3ef52b)的实测副产物。两项事实都已被该体检持续输出在 CI 里,本单只是把「要不要动手清」这个问题单独记下来 —— 体检本身是 report-only,不会替维护者做决定。事实一:26 / 28 条 override 的选择器排他上界压在自己 target 的版本线上
AGENTS.md 明文写着「Never write an OSV override's upper bound as the exclusive fixed version」(#4961 / #5032 的教训:
undici@>=7.23.0 <7.28.0在 7.28.0 自己出公告那天当场失配)。实测这个形状在本仓是普遍写法而非个例:28 条 override 里 26 条命中,包括 better-auth 家族 12 条、以及 minimatch / tar / uuid / postcss / hono / fast-uri / brace-expansion 等。其中
@hono/node-server@<2.0.5->^2.0.10是严格更差的一种:上界低于 target 下限,2.0.5 .. 2.0.10 这段谁都不覆盖。pnpm-workspace.yaml注释写明 1.7.0 stable 出来就整体放宽),与 OSV 安全 pin 性质不同,是否要一起改由维护者判断。事实二:3 条空转 override 落在 #5835 裁决范围之外
#5835 裁 A 明确保留了
form-data/undici两条。实测空转的其实有 4 条,除 form-data 外还有:@tootallnate/once@<2.0.1react-router@<8.3.0@sveltejs/kit@<2.69.1(
undici并不空转,有 2 个消费者:@ai-sdk/provider-utils@5.0.16、jsdom@30.0.1。)这三条从没被裁决表过态。空转本身是合法的纵深防御姿态,保留零成本;记下来只是因为在 #6046 的体检上线之前没人看得见它们,现在看得见了,值得维护者顺手表个态(保留 / 清理),免得下一个 agent 各凭理解处置。
⛔ 请勿在没有裁决的情况下直接删除任何一条 —— #6046 体检的输出里已经带了同样的告诫。
参考
form-data与undici两条 OSV override 失去唯一消费者,现在空转 —— 保留还是退役需一次裁决 #5835;体检落地 check-override-consistency 增加「override 有无消费者」体检(报告而非 red)—— #5835 裁 A 的配套正交项 #6046 / PR feat(scripts): check-override-consistency 增加 override 消费者体检与自失效上界报告 #6093Validate Package Dependenciesis red onmain— 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check #5032pnpm check:override-consistency(exit 0,两栏报告)