fix(ci): make pre-install-import-graph.yml point at its population instead of counting it

[baozhoutao]

Fixes #8606

Clause-②: no

Base origin/main 4d65991c5 — tip committed 2026-09-10T15:31:10+00:00.
Head ded73e00d — committed 2026-09-10T16:03:55+00:00.

1. Both numbers, re-measured on a fresh tree

what	reading on 4d65991c5	control, same run
the header's stated population	24	the sentence is one line's grep, quoted below
.github/workflows/ actually holds	36	git ls-tree and an on-disk readdir agree; a nonsense directory returns 0, so 36 is a reading

git ls-tree --name-only HEAD -- .github/workflows/ | wc -l        ->  36
readdirSync('.github/workflows').filter(.yml/.yaml).length        ->  36
git ls-tree --name-only HEAD -- .github/zzqqnotadir/ | wc -l      ->   0   (control)

Stale by 12, not the 11 the card measured on 2026-09-08 and not the 11 triage re-measured on 2026-09-10T13:4xZ — the directory grew again between triage and this dispatch. That drift, inside two days, is the whole argument against writing the number back by hand.

The two numbers are the same measurement written twice: scripts/check-pre-install-import-graph.mjs derives the population (WORKFLOW_DIR = '.github/workflows', readWorkflows, readdirSync), and only one of the two copies was live.

2. The header, before and after

Before (lines 24-27):

# It needs no install and no build — a checkout plus one `node` call over 24
# workflow files and a dozen scripts, well under a second. Keep it that way: the
# gate exists to protect install-free gates, so an install here would be the
# joke telling itself.

After:

# It needs no install and no build — a checkout plus one `node` call over every
# file in `.github/workflows/` and the `scripts/` gates their pre-install steps
# name, well under a second. ⛔ No population count here, deliberately: this
# sentence used to state one as a literal, it went stale by double digits, and
# nothing went red over that whole distance, because nothing fails on a number
# written in a comment (objectui#8606, objectui#7448). The population is DERIVED
# from `.github/workflows/` on every run, so the live reading is a command —
# `node scripts/check-pre-install-import-graph.mjs --list` prints it — and
# `scripts/__tests__/check-pre-install-import-graph.test.ts` refuses a count
# written back here. Keep it that way: the gate exists to protect install-free
# gates, so an install here would be the joke telling itself.

⭐ Not a hand-correction to 36. The repository has converged on "point at the instrument, never copy its answer" three times independently, and this family has already spent two hand-corrections elsewhere (objectui#7837, objectui#7978) making exactly that point. The adjacent hand-count of scripts/ gates goes the same way: the header said "a dozen", the gate's own --list says 26 distinct scripts across 28 pre-install steps in 22 jobs — the same defect in the same sentence, one word later.

3. The unit, and why this one

The new pin reads the header as comment prose with the # marker stripped, then joined — never as raw lines.

Evidence, in the order it decided the question:

1. objectui#8629's thread measured the same subtlety from the documentation end. Its comment records that the carriers of objectui#7448's pin run their pattern over joined text rather than per line, so \s+ in the family pattern spans a line break. Under the carriers' own unit a wrapped sentence is readable; under a per-line unit it is not. Two of the three counts that card names were missed for that reason alone.
2. This header is the workflow-side instance of it. Its count wrapped a comment line: over 24 ended line 24 and workflow files opened line 25 behind a #.
3. Re-measured here, over all 36 headers, pattern taken byte-for-byte from origin/main:

	markers kept	markers stripped
document-count hits, whole corpus	9	11

The two only the stripping extraction sees are pre-install-import-graph.yml (24 workflow files) and shell-escape-residue.yml (200 markdown documents — approximate by construction, ⛔ untouched here, ⛔ not claimed stale). In-class control, same run, same instrument: a count wrapping a comment line reads [] kept and ["184 pages"] stripped ⇒ the []s above are readings, not silences.

4. All three existing carriers already strip the marker, and their own docstrings argue for it verbatim ("Stripped, not kept: a sentence that wraps across two comment lines has a # sitting in the middle of it…"). Choosing the stripping unit is following the family, not inventing a rule for it.

Both legs of the unit are now pinned as a test rather than left as prose, so it cannot drift back: the marker-keeping extraction is kept only as a control and is asserted to read [] on the wrapped fixture while the stripping one reads ["24 workflow files"]. "Clean" can never again mean "unreadable".

4. The pin — the fourth carrier of objectui#7448's family

Added to scripts/__tests__/check-pre-install-import-graph.test.ts, the test file that already owns this workflow. Four assertions:

• states no count that adding a workflow would falsify — over two surfaces (the workflow header and this test file's own leading block comment, the objectui#7825 lesson about the stale twin), each behind a MIN_HEADER_PROSE floor of 400 characters so an empty scan is a reading rather than a silence.
• names the directory the gate actually derives the population from — the path is read out of the gate's WORKFLOW_DIR, never spelled in the test, and the pointer is asserted to resolve to a directory that actually holds workflows.
• reads a count that wraps a comment line — the unit control above.
• fires on the shapes that rotted, and on none of the numbers this header may keep — positive controls (this header's own pre-fix sentence, and the family's) against negatives (objectui#6135, node-version: 22, timeout-minutes: 10, actions/checkout@v7, a 60-minute queue timeout).

⛔ Nothing existing was weakened. No pin edited, no threshold lowered, no check deleted, no scan surface narrowed. The diff is two files, both additive in effect.

5. Ablation — the pin can fail, proven on disk and restored

Both legs mutate the committed tree, prove the bytes actually changed, run the pin, restore against HEAD, and prove the restore. HEAD blob for the workflow: 16c81e79b5e3ba1a8e7eb1bbf31363c4cbf7c997.

Leg A — write the pre-fix count back into the header.

mutation written: 1 occurrence replaced
injected-text grep  : 1        deleted-text grep : 0
on-disk hash        : 4eb5b8930a40eae0ebaf6c58b8a2b23dddd13c68   (HEAD was 16c81e79b…)
what the OLD marker-keeping unit would see : []          <- the unit that was blind
what the stripping unit sees               : ["24 workflow files"]
LEG_A_VITEST_EXIT=1
  × states no count that adding a workflow would falsify
  AssertionError: pre-install-import-graph.yml states a population count (24 workflow files). …
  Test Files 1 failed (1)   Tests 1 failed | 36 passed (37)
RESTORE PROVEN: byte-identical to HEAD (16c81e79b…), `git diff HEAD` empty

Leg B — remove the pointer, so the header stops naming its measurement point.

mutation written: 3 comment line(s) de-pointed
injected-text grep : 3        deleted-text grep : 0
on-disk hash       : b43835d66c2c98a58eefba2053d232c4bc453777   (HEAD was 16c81e79b…)
LEG_B_VITEST_EXIT=1
  × names the directory the gate actually derives the population from
  AssertionError: pre-install-import-graph.yml's header must name `.github/workflows` — the population's one live source
  Test Files 1 failed (1)   Tests 1 failed | 36 passed (37)
RESTORE PROVEN: byte-identical to HEAD (16c81e79b…), `git diff HEAD` empty

Both scripts carried trap restore EXIT INT TERM with absolute paths, restored with git checkout HEAD -- PATH (never the bare form, which takes the polluted index), and treated an empty hash as failure rather than as nothing to compare.

6. The three existing carriers did not move

POPULATION_COUNT lives in exactly three files under scripts/__tests__/ — check-doc-component-types.test.ts, check-doc-fence-languages.test.ts, check-links-workflow.test.ts (git grep -l, exit 0, three hits; nonsense control ZZQQNOTATOKEN exits 1, so the three is a reading).

Run on the pre-change bytes and on the post-change bytes, same command, same tree:

	Test Files	Tests	exit
before (both changed files restored to 4d65991c5, byte-identical, hashes verified)	3 passed	97 passed	0
after (ded73e00d)	3 passed	97 passed	0

7. Every check, exit code captured before any pipe

command	exit	verdict line
pnpm exec vitest run scripts/__tests__/check-pre-install-import-graph.test.ts	0	1 file, 37 tests passed (33 before, 4 new)
pnpm exec vitest run scripts/__tests__/	0	136 passed, 2 skipped (138 files), 3995 tests
final run through the shared verify lock (this file plus all three carriers)	0	VERDICT command-exit 0 · held the lock 4s · waited 0s — 4 files, 134 tests
pnpm type-check:scripts	0	clean; --listFiles confirms the edited test file is in the program (count 1), so this is a measurement, not an assumption
pnpm lint:root	0	32 problems, 0 errors; none in either changed file
node scripts/check-pre-install-import-graph.mjs --self-test	0	16 cases pass
node scripts/check-pre-install-import-graph.mjs	0	OK — 28 pre-install steps in 22 jobs run 26 gates; 30 modules walked
node scripts/check-control-bytes.mjs	0	OK, 7200 tracked text files scanned
node scripts/check-changeset-presence.mjs	0	"No source or published contract of a released package changed in this range, so no changeset is owed" ⇒ verdict followed, no changeset added

Every exit code was captured with a redirect before any pipe (cmd greater-than file 2 greater-than ampersand 1; EXIT=dollar-question), never through cmd | tail, and a control-character self-scan over both changed files returned no hits.

Fences respected

⛔ content/docs/guide/ci-cd-pipeline.md untouched, and objectui#8629's counts are not addressed here — that card remains open. ⛔ content/docs/releases/** untouched. ⛔ scripts/__tests__/dist-pins-guard-message-8274.test.ts and the two network-escape-worker-coverage-8537.escape-*.test.ts files untouched (the sibling dev's set stays disjoint). ⛔ No existing pin, threshold, check or scan surface weakened — had the wrapped case required relaxing something that exists, this would have stopped and reported instead.

Diff: 2 files, +233 / -5. Draft on purpose — the PM runs the landing pipeline; this seat does not flip it ready, arm auto-merge or merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FhBNJcLRZLe8M87VcUgpKr

---

Generated by Claude Code

[claude]

Armed — SQUASH, in the queue, probe written BEFORE the merge

domain:devx @ objectui PM seat (session_01FhBNJcLRZLe8M87VcUgpKr), 2026-09-10T16:28Z. Card objectui#8606.

CI on ded73e00d: converged all green, 30 checks, Live E2E (informational) excluded — 16:26:54Z. Flip ready 16:27:02Z; post-flip Governed Surface Queue Guard completed/success @ 16:27:27Z; armed SQUASH; queue confirmed from the added_to_merge_queue timeline event.

The probe

Baselines on origin/main = 4d65991c5, tip committed 2026-09-10T15:31:10Z, read 16:27Z. Re-read after the merge on a re-fetched origin/main.

#	leg	today	expected after
A	「over 24」 in the workflow header	1	0
B	「No population count here, deliberately」 in the same header	0	1
C	files carrying POPULATION_COUNT under scripts/__tests__/	3	4

⭐ A and B are the same sentence from both sides — the point of this card is that the literal goes away, ⛔ not that a pointer is added next to it. Only the pair distinguishes a replacement from an addition.

⭐ C is the floor leg. This card's authorisation was to strengthen the instrument and ⛔ never to weaken one. 3 → 4 says a carrier was added; ⛔ any reading below 3 would mean one was removed, and that is the outcome this seat would treat as a defect regardless of what else the pull request achieved.

Control: the workflow file itself is present at baseline (1), so leg A's and B's readings are of a file that exists, ⛔ not of a missing path.

⚠️ ⛔ Not a probe leg: the directory's file count. It moved 35 → 36 between triage and dispatch on other people's work — ⭐ which is the card's own argument, and exactly why it is a terrible leg for judging this merge.

⇒ this card closes on the merge (Fixes #8606): LANDED, then strip pm:* + assignee.

---

Generated by Claude Code