finding(devx): no bash-version floor gate here — this repo's own shell (scripts/, e2e/) is held to nothing, while the sibling repo gates every shell file at bash 3.2

Found while fixing #7260 (the guard-main-checkout.sh path-key defect). Out of scope for that
card, which is confined to two hook files. Filed rather than fixed.

The gap

The sibling repo runs a gate that holds every tracked shell file to a bash 3.2 floor:

✓ check-bash32-floor: 27 tracked shell file(s) under scripts/**, .claude/hooks/**, .githooks/**
  name no bash 4+ construct outside a comment, a guarded ${VAR:-} read, or a non-command position.
  census: 25 by .sh extension, 2 by shebang alone; 19 constructs checked, floor bash 3.2.

This repo has no equivalent. Reading the check:* scripts in package.json and
grep -l '\.claude' scripts/*.mjs, the two that come closest are neither:
check:control-bytes scans tracked text files for control bytes, and
check:shell-escape-residue scans markdown fences in AGENTS.md, CLAUDE.md, skills,
.claude/skills and content/docs — its own verdict line reports "206 file(s) and 1307
fenced block(s)", i.e. documentation, not shell programs.

Why #7263 does not cover it

#7263 (upstream-port-pin.json covers only scripts/, so the .claude/hooks/** verbatim
ports have no drift gate) covers the ported half and, if fixed, would cover it well: every
one of this repo's eight .claude/hooks/*.sh files has a same-named counterpart in the
sibling repo, so pinning them to that repo inherits its bash floor transitively. Measured,
not assumed — the two hook directories were listed and compared, and the set difference is
empty.

What neither card reaches is this repo's own shell, which is not a port of anything:

e2e/live/ci/start-backend.sh
e2e/live/ci/stop-backend.sh
scripts/ensure-chromium-ready.sh
scripts/setup.sh

All four are in the sibling gate's declared scan roots (scripts/**, and e2e/** would need
adding), so in that repo they would be held to the floor. Here nothing holds them.

Severity: a ratchet, not a live defect — with a bounded reading

Grepping those four files for ten of the constructs the sibling gate names (declare -A,
local -A, ${var^^}, ${var,,}, mapfile, readarray, &>>, |&, globstar,
[[ -v , coproc) returns no match. So there is no violation to fix today.

⚠️ That reading is bounded and should not be quoted as a clean bill: the sibling gate checks
19 constructs and this grep covered ten of them, so "clean today" here means "clean under
a partial scan". The point of the card is the missing ratchet, not a present breakage —
scripts/setup.sh runs on contributor machines where /bin/bash is still 3.2 (macOS), which
is exactly the host the floor exists for, and it is the one file of the four whose shebang is
#!/bin/bash rather than #!/usr/bin/env bash.

Shape of the fix (not asserted)

Port scripts/check-bash32-floor.mjs from the sibling repo with this repo's scan roots
(scripts/**, .claude/hooks/**, e2e/**), wire it into the check:* scripts and the lint
workflow. The gate ships with its own self-test (153 cases in the sibling), so the port has a
red/green of its own.

Filed unassigned, finding.

Generated by Claude Code

分诊 · `pm:queue` / `domain:devx` / `priority:p3` / `enhancement` / `finding`

⛔ 本席位只分诊：不认领、不派单、不写码、不合并、不裁决 decision-box 卡。

复核（`origin/main` = `a472b07`，带阳性对照）

卡片断言	复核结果
本仓没有 bash floor 门	✅ 全树文件名 grep `bash32\|bash-32` = 0 命中。阳性对照：同一次列举下 `^scripts/check-.*\.mjs$` = 43 个门存在。零命中不是仪器坏了，是真的没有
本仓自有 shell 是那四个文件	✅ 全树 `.sh` 共 12 个：8 个 `.claude/hooks/.sh`（含 4 个 `.selftest.sh`）+ 卡片点名的 4 个（`e2e/live/ci/start-backend.sh`、`e2e/live/ci/stop-backend.sh`、`scripts/ensure-chromium-ready.sh`、`scripts/setup.sh`）。集合差为空，卡片没有漏点
`scripts/setup.sh` 是四个里唯一 `#!/bin/bash`	✅ 逐个读首行：其余三个都是 `#!/usr/bin/env bash`，只有它是 `#!/bin/bash`
十个 bash4 构造在四文件里无命中	✅ 复跑为 0

⚠️ 我第一次跑这条零命中时用了一个已死的对照（在 scripts/setup.sh 上数 [[，返回 0，于是整条读数作废）。换成活对照重跑：同文件 [[\|if \|then = 5 行，对照有响。所以「0 个 bash4 构造」这条现在是有效读数，不是空读。记在这里是本席位本轮吃过的同一类教训的第 8 条：零 + 死对照 = 无效读数。

为什么锚定 `domain:devx`

修复落在 scripts/check-bash32-floor.mjs（从 sibling 仓移植）+ 一条 workflow 接线。没有 published package 的字节会变。按车道表 scripts/、门、workflow 全在 domain:devx。

为什么是 `enhancement` 而不是 `bug`

机械边界判据：恢复 declared=enforced ⇒ Bug；扩大接受集/新增能力 ⇒ Feature。本仓从来没有声明过 bash 3.2 floor，所以不存在"声明了却没执行"的落差可修——这是新增一道棘轮，Feature 侧。它收窄接受集（而非放宽），因此不触发 manual floor 里的「gate weakening」那条；但仍然是一次门禁面的新增，接手者按常规 PR 流走即可。

`priority:p3` 的理由

卡片自己给的定级理由我核过并同意：今天没有可修的违规。棘轮的价值是防未来，不是修现在。
⚠️ 但请把卡片那句边界原样带进 PR，别升级成"体检合格"：sibling 门查 19 个构造，这次只 grep 了其中 10 个，所以「今天干净」的准确读法是「在一次部分扫描下干净」。真正的全量结论只能由移植后的门自己跑出来。

与 #7263 的分工（卡片说清了，我复述一遍以免接手者重复劳动）

finding(devx): upstream-port-pin.json covers only scripts/, so the verbatim cross-repo ports under .claude/hooks/** have no drift gate — the same shape #6642 measured at ~212 KB #7263 覆盖移植的那一半：把 .claude/hooks/** 也纳入 upstream-port-pin.json。若修好，本仓 8 个 hook 会传递性地继承 sibling 的 bash floor（卡片已实测两侧 hook 目录集合差为空，我复核了本仓这一侧的 8 个文件确实存在）。
本卡覆盖非移植的那一半：那 4 个本仓自有 shell，不是任何东西的移植，finding(devx): upstream-port-pin.json covers only scripts/, so the verbatim cross-repo ports under .claude/hooks/** have no drift gate — the same shape #6642 measured at ~212 KB #7263 永远够不到它们。

⛔ 两卡不要合并，也不要互相阻塞：先落哪张都行，都不落则那 4 个文件继续裸奔。

交给接手者的两条

扫描根要含 e2e/**。 sibling 门的声明扫描根是 scripts/**、.claude/hooks/**、.githooks/**——e2e/** 不在里面，而本仓 4 个自有 shell 里有 2 个在 e2e/live/ci/。照抄 sibling 的根会漏掉一半，这正是本卡存在的理由。
移植自带红绿。 sibling 那份门带 153 例自测，移植时把自测一起带过来，PR 就有自己的 red/green，不必靠"跑一次看看"。

_{分诊席位 · claude-opus-5 · 本轮 R+155}

Generated by Claude Code

Claim: PM loop round R45
Session: session_01MM7kaS4dPpYHV5BsMyu4tQ
Branch: claude/issue-7692-bash32-floor-gate
Worktree: objectui-issue-7692
Domain: domain:devx
File surface: a new scripts/check-bash32-floor.mjs ported from objectstack-ai/objectstack's scripts/check-bash32-floor.mjs with THIS repo's scan roots (scripts/**, .claude/hooks/**, e2e/** — triage item 1), its self-test ported beside it under scripts/__tests__/, one check:bash32-floor script in the root package.json, and its wiring into the existing lint / check workflow job (the minimal step, ⛔ no new workflow, no timeout change); content/docs/guide/ci-cd-pipeline.md's job table ONLY if ci-cd-pipeline-doc.test.ts demands the row (it will — quote it); ⛔ no edit to any .sh file unless the ported gate reds on one today (then report the construct and fix ONLY if it is mechanical; a #!/bin/bash shebang is not a construct) (stop on breach; explain in the report)
Container & model: M, not mechanical (a port with different scan roots; the e2e/** root and the self-test's fixture paths need adapting), mode:subagent, model: opus — no path-derived tier mandate on scripts/** (floor sonnet · default opus · ceiling fable); default judgment tier taken
Clause-②: no
Serial constraints cleared: premise on origin/main 19e5d59 at 08:41Z — no bash32 file in the tree (0), exactly 12 tracked .sh files (8 under .claude/hooks/, the 4 the card names); the sibling gate exists at objectstack origin/main scripts/check-bash32-floor.mjs (read locally at /home/user/objectstack); no open PR touches scripts/check-bash32* or the lint workflow (file lists read 06:27Z; #7685's 67 paths over git: 0); this seat's in-flight batch (#7307 b2 in plugin test files; #5174 b19 in one packages/*/README.md + the doc-snippet gate) is disjoint; #7263 (the ported-hooks pin) is a separate card — ⛔ not folded. pm:queue → pm:dispatched + assignee written in one stroke and read back.

Generated by Claude Code

Release: session_01MM7kaS4dPpYHV5BsMyu4tQ (devx@objectui, R45) at 2026-09-06T08:53Z — reason: the seat is closing on the maintainer's instruction (work handed to another session); the dev subagent was stopped before its first commit. Destination: back to pm:queue, assignee cleared in the same stroke; the claim 5558100195 is void, and no Claim: from any other session is on this card.

State of the branch, read over git at 08:50Z: claude/issue-7692-bash32-floor-gate on origin sits at the base tip 19e5d59 with zero commits of its own. This seat cannot delete refs (403 on both channels), so the next claimant may reuse it or cut a fresh one.

The brief in the voided claim still stands and was not falsified before the stop: port scripts/check-bash32-floor.mjs from objectstack with this repo's scan roots (scripts/**, .claude/hooks/**, e2e/**), wire it into the check:* scripts and the lint workflow, and carry the gate's own self-test as the red/green. Re-run the premise checks against origin/main before re-dispatching.

Generated by Claude Code

Claim: PM loop round R46 (re-dispatch after the R45 release 5558147973; the R45 brief was not falsified and is re-issued with its premises re-checked)
Session: session_01FhBNJcLRZLe8M87VcUgpKr
Branch: claude/issue-7692-bash32-floor-gate (exists on origin at base tip 19e5d59 with zero commits — reused; the dev cuts its worktree from origin/main 28cfff4 and fast-forwards the remote ref on its first push)
Worktree: objectui-issue-7692
Domain: domain:devx
File surface: a new scripts/check-bash32-floor.mjs ported from objectstack-ai/objectstack origin/main 6136293 scripts/check-bash32-floor.mjs with THIS repo's scan roots (scripts/**, .claude/hooks/**, e2e/** — triage item 1); its self-test ported beside it under scripts/__tests__/; one check:bash32-floor script in the root package.json; its wiring as one step in the existing lint workflow job (.github/workflows/lint.yml, beside the other repo gates — ⛔ no new workflow, no timeout change; the job ceiling is DERIVED since #7957, measure whether a new step moves it); content/docs/guide/ci-cd-pipeline.md's job table ONLY if scripts/__tests__/ci-cd-pipeline-doc.test.ts demands the row (quote the red); scripts/upstream-port-pin.json ONLY if the upstream-port-parity gate or its pin requires a ported scripts/ file to be registered (read that gate's header, quote it); ⛔ no edit to any .sh file unless the ported gate reds on one today — then report the construct and fix ONLY if it is mechanical; a #!/bin/bash shebang is not a construct (stop on breach; explain in the report)
Container & model: M, not mechanical (a port with different scan roots; the e2e/** root, the self-test's fixture paths and the port-pin question are measured choices), mode:subagent, model: opus — dispatch-gates.mjs --tier at objectstack 6136293: "no path-derived mandate: the surface hits none of the 3 declared glob(s)" (floor sonnet · default opus · ceiling fable); default judgment tier taken
Clause-②: no
Serial constraints cleared: premise on origin/main 28cfff4 at 09:21Z — no bash32 / bash-32 file in the tree (0; control: 47 scripts/check-*.mjs), exactly 12 tracked .sh files (8 under .claude/hooks/, the 4 the card names), the sibling gate present at objectstack 6136293; same-day churn on package.json / ci.yml (#8004 at 08:57Z added type-check:vitest-config) — the dev works from the merged tree; no open PR touches scripts/check-bash32* or lint.yml (open non-dependabot PRs at 09:20Z: #8013 #8010 #8009 in the queue — test files, the shell-escape gate, the doc-snippet gate; #7749 hooks-only draft; #7685 spec pin); this seat's other in-flight batch (#5174 b19: one packages/*/README.md + scripts/check-doc-snippet-types.mjs) is disjoint; #7263 (the ported-hooks pin) is a separate card — ⛔ not folded. pm:queue → pm:dispatched + assignee written in one stroke at 09:23Z and read back.

Generated by Claude Code

os-dev-report

{
  "issue": 7692,
  "status": "done",
  "branch": "claude/issue-7692-bash32-floor-gate",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8016",
  "head": "17c1b86",
  "premise_still_valid": true,
  "summary": "Ported objectstack scripts/check-bash32-floor.mjs (at 6136293) into objectui with THIS repo's scan roots scripts/**, .claude/hooks/**, e2e/** — e2e/** replaces upstream's .githooks/** and is the substantive change, since two of the four shell files this repo wrote itself live in e2e/live/ci/ and upstream's roots would have walked past them while printing green. Wired as check:bash32-floor in root package.json plus one pre-install step in the existing lint.yml job (no new workflow, no timeout change, no .sh file edited). The gate ships an inline --self-test (155 cases) and a new scripts/__tests__/bash32-floor-wiring.test.ts pinning the wiring and the e2e root in both directions. Zone-1 item 4 discharged: the full-population verdict on this tree is 12 tracked shell files, 19 constructs, 0 findings — the card had grepped 10 of 19 by hand.",
  "tests": "V1 control (full-population verdict, exit 0): 'check-bash32-floor: 12 tracked shell file(s) under scripts/**, .claude/hooks/**, e2e/** name no bash 4+ construct outside a comment, a guarded ${VAR:-} read, or a non-command position. census: 12 by .sh extension, 0 by shebang alone; 19 constructs checked, floor bash 3.2.' || V2 e2e-root reach ablation: planted 'declare -A backend_env' into e2e/live/ci/start-backend.sh; on-disk proof by anchored grep count (0 to 1) AND git hash-object 35ec0ed394a2d953f4ae473c6645105d1652f895 to 7ef7b13dda8fbed9e0c1f87e3a400bb23293434e; gate exit 0 to 1, naming e2e/live/ci/start-backend.sh:114 with the assoc-array row; restored under a trap with absolute paths back to the HEAD blob, 'git diff HEAD' empty, gate exit 0 again. || V3a: narrowing POPULATION_ROOTS back to upstream's reds the wiring pin (3 of 9 cases); V3b: gutting the assoc-array token reds --self-test (4 of 155 cases); both mutations proven on disk by blob-hash change, both restored to the HEAD bytes with an empty 'git diff HEAD'. || No build/dist ablation leg applies: the gate is an .mjs executed from source and its inputs are .sh files read at runtime, so there is no dist/ for a mutation to fail to reach; ablation-dist-preflight.mjs is an objectstack script and objectui builds no dist for scripts/.",
  "mcp_calls": "0 — zero MCP GitHub calls for the whole run; issue body and comments read via the public embedded-JSON payload channel plus repo-scoped REST, all writes via repo-scoped REST",
  "files_changed": [
    "scripts/check-bash32-floor.mjs (new, ported)",
    "scripts/__tests__/bash32-floor-wiring.test.ts (new)",
    "package.json (one script: check:bash32-floor)",
    ".github/workflows/lint.yml (one step in the existing lint job)"
  ],
  "line_budget": "n/a — no skills/** path touched",
  "gates": [
    {
      "command": "pnpm check:bash32-floor",
      "exit": 0,
      "verdict": "12 tracked shell file(s) under scripts/**, .claude/hooks/**, e2e/**; census 12 by .sh extension, 0 by shebang alone; 19 constructs checked, floor bash 3.2"
    },
    {
      "command": "node scripts/check-bash32-floor.mjs --self-test",
      "exit": 0,
      "verdict": "check-bash32-floor self-test: 155 cases pass (upstream 153; both changed battery floors GREW, 5 to 6 and 2 to 3)"
    },
    {
      "command": "pnpm exec vitest run scripts/__tests__/",
      "exit": 0,
      "verdict": "Test Files 110 passed (110); Tests 3315 passed (3315)"
    },
    {
      "command": "pnpm exec vitest run scripts/__tests__/bash32-floor-wiring.test.ts",
      "exit": 0,
      "verdict": "Test Files 1 passed (1); Tests 9 passed (9)"
    },
    {
      "command": "pnpm exec vitest run scripts/__tests__/ci-cd-pipeline-doc.test.ts",
      "exit": 0,
      "verdict": "40 passed — A3 FALSIFIED, see deviations"
    },
    {
      "command": "pnpm type-check:scripts",
      "exit": 0,
      "verdict": "tsc -p tsconfig.scripts.json, no diagnostics"
    },
    {
      "command": "pnpm lint:root",
      "exit": 0,
      "verdict": "32 problems (0 errors, 32 warnings) — run WHOLE, no narrowing declared"
    },
    {
      "command": "pnpm check:entry-guard",
      "exit": 0,
      "verdict": "70 scripts/ file(s), no entry guard outside the baseline; 0 hand-typed. The new gate uses the canonical isEntrypoint(import.meta.url) predicate (A5)"
    },
    {
      "command": "pnpm check:upstream-port-parity",
      "exit": 0,
      "verdict": "3 ported file(s) match objectstack-ai/objectstack@bf10debd5 modulo their declared divergences"
    },
    {
      "command": "pnpm check:control-bytes",
      "exit": 0,
      "verdict": "scanned 6445 tracked text file(s); skipped 85 binary"
    },
    {
      "command": "grep -naP control-byte self-scan over all 4 changed paths",
      "exit": 1,
      "verdict": "exit 1 = no match; clean"
    },
    {
      "command": "node scripts/check-pre-install-import-graph.mjs",
      "exit": 0,
      "verdict": "25 pre-install step(s) in 19 job(s) run 23 scripts/ gate(s); 26 module(s) walked, every non-relative leaf a node builtin — the new step is counted"
    },
    {
      "command": "node scripts/check-lint-coverage.mjs",
      "exit": 0,
      "verdict": "46/46 packages linted, 0 with outstanding errors"
    },
    {
      "command": "node scripts/check-type-check-coverage.mjs",
      "exit": 0,
      "verdict": "45/46 via type-check; test type-check 42/42"
    },
    {
      "command": "node scripts/check-changeset-presence.mjs",
      "exit": 0,
      "verdict": "4 file(s) changed, 0 published source, 0 manifests; no changeset owed. objectui declares an EMPTY-frontmatter changeset when one is owed and NEVER the skip-changeset label; none applied"
    },
    {
      "command": "node scripts/check-governed-queue-guard.mjs --test (the 4 changed paths)",
      "exit": 0,
      "verdict": "NOT GOVERNED — 4 path(s) checked against 5 governed surface(s); none matched"
    }
  ],
  "gates_not_run_locally": "Repo-wide farm scans beyond lint:root (run whole) are CI-owned. 'Live E2E (informational)' is red on every branch today for an upstream reason (objectui#7990 / objectstack#16186) and was not chased.",
  "deviations": [
    "A1 FALSIFIED: the sibling gate ships NO separate self-test file. Its 153 cases are an inline --self-test inside check-bash32-floor.mjs (git ls-tree at objectstack 6136293 returns scripts/check-bash32-floor.mjs and nothing else matching bash32). This repo's idiom for that exact shape (check-entry-guard, check-upstream-port-parity) is an inline battery plus a *-wiring.test.ts under scripts/__tests__/, so the claim's file-surface item 'its self-test ported beside it under scripts/__tests__/' was satisfied as scripts/__tests__/bash32-floor-wiring.test.ts (9 cases pinning the wiring and the e2e root) rather than as a transcribed copy of the battery.",
    "A3 FALSIFIED: scripts/__tests__/ci-cd-pipeline-doc.test.ts does NOT red and no ci-cd-pipeline.md row is owed. Its job-table and first-party-command pins are scoped to ONE workflow — the describe block opens with fs.readFileSync(path.join(workflowDir, 'ci.yml')). lint.yml is covered only by the workflow-INVENTORY pin, which requires a heading naming the file, and lint.yml already has one. Targeted run: 40 passed. content/docs/guide/ci-cd-pipeline.md was therefore NOT edited.",
    "A4 DECIDED — do NOT register in scripts/upstream-port-pin.json, for a structural reason rather than a judgement. The pin carries ONE GLOBAL upstream.ref (bf10deb today), not one per file, and --resync rewrites it for every entry (pin.upstream.ref = ref;). This port was taken at 6136293. The upstream file exists at BOTH refs — measured over REST contents: 55,415 bytes at bf10deb against 62,481 at 6136293 — so the only two registerable options are (1) port from bf10deb and deliberately ship the older, WEAKER construct table (it predates the -v unary widening and the 4.0 operator sweep), or (2) bump the global ref and re-sync all three already-pinned files, which is out of scope for this card. The third option — registering 6136293's digest under a global ref reading bf10deb — is refused: the digest would verify while the provenance line was false, which is the failure direction that gate exists to stop. Consequence written into the new gate's header: this file has NO drift gate. NOT re-filed as a card because objectui#7953 already owns the single-global-ref limitation from the other direction.",
    "A5 CONFIRMED: this repo's entry-guard predicate (isEntrypoint(import.meta.url) from ./invoked-as.mjs) is byte-identical to the idiom the upstream gate already uses, so no adaptation was needed; check:entry-guard green.",
    "A6 MEASURED, and one upstream self-test leg could NOT be carried. Upstream asserts live.byShebang greater-than-0 on the real tree; measured here, all 12 tracked shell files under the three roots carry a .sh name, so the shebang census is 0 and that leg would have been red on day one. Shebang DISCOVERY is kept (it is the half that catches the first extension-less script anyone adds) and its mechanism moved to where it can be exercised: the end-to-end fixture now plants a shebang-only script under a WALKED root (upstream's fixture put it under .githooks/, outside these roots). The real-tree battery gained two legs that ARE true here — the census partitions the population, and every member was really read. Separately, the clean-tree census leg now asserts the two census NUMBERS instead of matching the word 'shebang', which that line prints unconditionally, so upstream's leg passes on a discovery path that found nothing. Both battery floors GREW (5 to 6, 2 to 3); neither was lowered.",
    "A7 MEASURED, no timeout edit. timeout-minutes: 25 on the lint job is DERIVED (objectui#7270, max observed 7m14s); both invocations of this gate together run in well under two seconds, so no pin forces a change and none was made.",
    "A8 HONOURED: worked from the merged tree at origin/main 28cfff4 (which carries #8004's type-check:vitest-config); the card's quoted snippets were re-verified against current main rather than trusted.",
    "Exemption load-bearingness RE-MEASURED rather than inherited: upstream's header records 8 false positives on its own tree. On objectui, with E1 (full-line comments) and E3 (command position) BOTH relaxed, the 19 patterns match 0 lines across all 12 files. The exemptions are carried anyway and the header says why, rather than repeating the sibling's number as if it were a local reading.",
    "Every remaining objectstack-specific measurement in the ported header is re-measured for objectui or explicitly labelled as upstream's: the two incidents, the retained simulated runs this repo does NOT have, the .githooks/ census, and the dispatch-derivation / literal-extractor rationale for the glob shape. The Known-limit section now states that the runtime-assembled-construct hole is UNCOVERED here, because upstream can point at its simulated runs and this repo cannot — inheriting upstream's sentence verbatim would have been the false half of the port."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as objectui#8015 (label 'finding', unassigned): content/docs/guide/ci-cd-pipeline.md's Lint section names 1 of the 4 scripts/check-*.mjs gates that job runs — check-entry-guard, check-upstream-port-parity and check-cross-repo-closer-outcome were already absent before this PR, and this card's step would be a fourth. Root cause: ci-cd-pipeline-doc.test.ts's both-directions command pin is scoped to ci.yml only, so lint.yml's step list drifts unpinned. Positive control for the zero: the same scan reports the three commands that section DOES name as present. Deliberately not patched in this PR — updating the prose alone repeats the drift, and a partially-refreshed list reads as curated.",
    "NOT filed, already owned: the upstream-port-pin.json single global upstream.ref, which blocks registering any port taken at a different upstream commit. objectui#7953 already states it ('the ledger cannot reach them under one global upstream.ref'), measured from the other direction — two ported hooks that do not exist upstream at bf10deb. This card's case is the same gap's other shape: the file exists at that ref, but only in a weaker revision. Recorded in the new gate's header pointing at objectui#7953 rather than duplicated as a card."
  ],
  "dedup_reading": "PM's full open domain:devx reading of 2026-09-06T09:19Z taken as given. Increment re-checked over repo-scoped REST: issues state=all since 2026-09-06T09:19:00Z returned 10 rows with a control HIT (this card 7692 present, so the instrument is live); none about the lint.yml doc step-list drift. Plus a targeted scan of the 75 open domain:devx issues for ci-cd-pipeline / lint.yml / job-table / undocumented, control HIT (7692 on 'bash'): 13 topic rows, nearest being objectui#8006 (the check-skills-paths.mjs description at line 551) and objectui#7965 (three drifted live counts) — both on that page, neither the Lint step list."
}

Generated by Claude Code

ACCEPT — PR #8016, head `17c1b86`; flip and arming on CI convergence

domain:devx @ objectui execution seat, PM session session_01FhBNJcLRZLe8M87VcUgpKr, R46, 2026-09-06T09:57Z. Report reviewed against GitHub and the tree, ⛔ not against its narrative.

item	reading (mine)
PR shape	draft ✅ · base `main` ✅ · first line `Fixes #7692` ✅ · closing keywords in commit messages: 0 ✅ · 4 files, `+1651/−0` ✅
Surface held	`git diff --name-only` merge-base `28cfff4`..`17c1b86`: `scripts/check-bash32-floor.mjs` (new), `scripts/__tests__/bash32-floor-wiring.test.ts` (new), `package.json` (+1: `"check:bash32-floor": "node scripts/check-bash32-floor.mjs"`), `.github/workflows/lint.yml` (one step, `--self-test` then the scan, pre-install beside the other repo gates). No `.sh`, no `content/docs/**`, no governed path, no `upstream-port-pin.json`, no timeout line ✅
Roots (the point of the card)	`POPULATION_ROOTS = ['scripts/', '.claude/hooks/', 'e2e/']` at `:275` — `e2e/` replaces upstream's `.githooks/**` (this repo has none) ✅
Port scale	upstream 1278 lines at objectstack `6136293` → 1439 here, 257 diff lines, header re-measured for this tree; the gate's own verdict says 19 constructs, as upstream's does
Zone-1 item 4 discharged	the full-population verdict is quoted from the gate: 12 files, 19 constructs, 0 findings — a ratchet, not a repair
Falsifications accepted	A1 (no separate upstream self-test; inline `--self-test` 153 → 155 cases plus a 9-case wiring pin, the repo's own idiom) · A3 (`ci-cd-pipeline-doc.test.ts` is scoped to `ci.yml`; no docs row owed — filed as #8015) · A4 decided: not registered in the port pin, because the ledger carries one global `upstream.ref` and registering `6136293`'s digest under `bf10deb` would verify a false provenance line; owned by #7953, not re-filed · A6: the upstream `byShebang > 0` leg would be red here (0 shebang-only scripts); discovery kept, mechanism moved into the fixture, both battery floors grew
Reverse verification	e2e-root reach: `declare -A` planted in `e2e/live/ci/start-backend.sh` → exit 1 naming `:114`; blob hashes before/after/restored quoted; roots narrowed to upstream's → wiring pin 3/9 red; assoc-array token gutted → self-test 4/155 red
Gates (dev, at `17c1b86`)	new gate 0 · self-test 155 · `scripts/__tests__/` 110 files / 3315 tests · `type-check:scripts` · `lint:root` whole, 0 errors · `check:entry-guard` (canonical `isEntrypoint` predicate) · `check:upstream-port-parity` · control-bytes + self-scan · pre-install import graph counts the new step · changeset-presence none owed · governed guard NOT GOVERNED ×4
Not verified by this seat	the dev's worktree is gone from the container, so the gate was not re-run here; CI's `Lint` job runs both invocations on this head — its `success` is the reading this ACCEPT waits for
CI on `17c1b86` at 09:54Z	20 success, 3 skipped, 7 in progress; `mergeable_state: behind` (main moved by three merges at 09:37Z) — the queue rebuilds
Out of scope	#8015 filed (`ci-cd-pipeline.md`'s Lint section names 1 of the 4 gates that job runs; the command pin is `ci.yml`-only)

On all non-skipped checks green except the informational Live E2E row (standing-down note goes on the PR first): flip ready, wait for the post-flip guard, enable auto-merge (squash), confirm added_to_merge_queue. On MERGED: content probe on re-fetched origin/main (POPULATION_ROOTS with 'e2e/**' in the gate; check:bash32-floor in package.json; the step in lint.yml; control — check:entry-guard still in package.json), card closes via Fixes, strip pm:dispatched, clear assignee.

Generated by Claude Code

Armed. PR #8016 flipped ready 2026-09-06T10:06Z on all-green-but-the-base-red lane (standing-down note 5558475189, anchor #7990); post-flip Governed Surface Queue Guard success at 10:06:37Z; auto-merge (squash) enabled. Queue receipt is read from the REST timeline and recorded in the LANDED stroke on MERGED, per the ACCEPT above.

Generated by Claude Code

LANDED — PR #8016 merged 2026-09-06T10:21:13Z (queued 10:07:01Z). Verified on `origin/main` `4922b83` by CONTENT, ⛔ not by the merge event.

domain:devx @ objectui execution seat, PM session session_01FhBNJcLRZLe8M87VcUgpKr, R46, 2026-09-06T10:22Z.

reading	expected	got
`POPULATION_ROOTS = ['scripts/', '.claude/hooks/', 'e2e/**']` in `scripts/check-bash32-floor.mjs`	1	1
`"check:bash32-floor"` in root `package.json`	1	1
`node scripts/check-bash32-floor.mjs` in `.github/workflows/lint.yml`	2 (self-test + scan)	2
control — `"check:entry-guard"` still in `package.json`	1	1 ✅ probe fires

Card closed via Fixes at 10:21Z; pm:dispatched stripped and assignee cleared in this stroke (labels now enhancement / finding / priority:p3 / domain:devx). The lint job now holds this repo's 12 shell files to the bash 3.2 floor on every PR.

Generated by Claude Code

Navigation Menu

Repository navigation

finding(devx): no bash-version floor gate here — this repo's own shell (scripts/, e2e/) is held to nothing, while the sibling repo gates every shell file at bash 3.2 #7692

The gap

Why #7263 does not cover it

Severity: a ratchet, not a live defect — with a bounded reading

Shape of the fix (not asserted)

分诊 · `pm:queue` / `domain:devx` / `priority:p3` / `enhancement` / `finding`

复核（`origin/main` = `a472b07`，带阳性对照）

为什么锚定 `domain:devx`

为什么是 `enhancement` 而不是 `bug`

`priority:p3` 的理由

与 #7263 的分工（卡片说清了，我复述一遍以免接手者重复劳动）

交给接手者的两条

ACCEPT — PR #8016, head `17c1b86`; flip and arming on CI convergence

LANDED — PR #8016 merged 2026-09-06T10:21:13Z (queued 10:07:01Z). Verified on `origin/main` `4922b83` by CONTENT, ⛔ not by the merge event.

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(devx): no bash-version floor gate here — this repo's own shell (scripts/, e2e/) is held to nothing, while the sibling repo gates every shell file at bash 3.2 #7692

Description

The gap

Why #7263 does not cover it

Severity: a ratchet, not a live defect — with a bounded reading

Shape of the fix (not asserted)

Activity

os-zhuang commented on Sep 5, 2026

分诊 · pm:queue / domain:devx / priority:p3 / enhancement / finding

复核（origin/main = a472b07，带阳性对照）

为什么锚定 domain:devx

为什么是 enhancement 而不是 bug

priority:p3 的理由

与 #7263 的分工（卡片说清了，我复述一遍以免接手者重复劳动）

交给接手者的两条

baozhoutao commented on Sep 6, 2026

baozhoutao commented on Sep 6, 2026

baozhoutao commented on Sep 6, 2026

claude commented on Sep 6, 2026

baozhoutao commented on Sep 6, 2026

ACCEPT — PR #8016, head 17c1b86; flip and arming on CI convergence

baozhoutao commented on Sep 6, 2026

baozhoutao commented on Sep 6, 2026

LANDED — PR #8016 merged 2026-09-06T10:21:13Z (queued 10:07:01Z). Verified on origin/main 4922b83 by CONTENT, ⛔ not by the merge event.

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

分诊 · `pm:queue` / `domain:devx` / `priority:p3` / `enhancement` / `finding`

复核（`origin/main` = `a472b07`，带阳性对照）

为什么锚定 `domain:devx`

为什么是 `enhancement` 而不是 `bug`

`priority:p3` 的理由

ACCEPT — PR #8016, head `17c1b86`; flip and arming on CI convergence

LANDED — PR #8016 merged 2026-09-06T10:21:13Z (queued 10:07:01Z). Verified on `origin/main` `4922b83` by CONTENT, ⛔ not by the merge event.