The invokedDirectly entry guard is spelled ~8 ways across scripts/, and every one of them makes its script silently inert (exit 0, no output) when reached through a symlink — including check-governed-merges.mjs, the governed-surface register

Measured while implementing the entry guard for #9757 (PR #10084). Not repaired there: that card's file surface is scripts/pm/dispatch-gates.mjs alone, and its dispatch ruled the repair comment/guard-only in that one file. Filed unassigned, severity for triage.

The measurement

Every entry guard in scripts/ compares process.argv[1] against import.meta.url. Node resolves symlinks for the module graph but leaves process.argv[1] as the caller typed it, so when a script is reached through a symlink the two name different paths, the guard answers false, and the script does nothing at all — with exit 0 and no output.

Run on main (b1457ee), each script invoked directly and then through a symlink to the same file:

scripts/pm/check-governed-merges.mjs --self-test
  direct  : exit=0, 1 line   ✓ check-governed-merges --self-test: 81 assertions ...
  symlink : exit=0, 0 lines  (nothing at all)

scripts/js-comment-mask.mjs --self-test
  direct  : exit=0, 16 lines ✓ js-comment-mask self-test: 15 cases pass.
  symlink : exit=0, 0 lines  (nothing at all)

Both legs are exit 0. Nothing distinguishes "ran and passed" from "never ran" at the exit code, which is the only thing most of the CI wrappers hold.

Why it matters more than a cleanup

scripts/pm/check-governed-merges.mjs is the register behind Prime Directive #14 — its GOVERNED_SURFACES table is what AGENTS.md points at instead of its own prose, and its --test mode is the pre-arm predicate a seat is told to run on a PR's file list before arming auto-merge. Through a symlinked checkout that predicate prints nothing and exits 0, and EXIT_TEST_NOT_GOVERNED is 0 (pinned in its own self-test at line 924). So the inert run and the "NOT governed, ordinary queue landing applies" answer are the same exit code. A seat reading the exit code rather than the printed verdict gets a clearance from a tool that never ran.

The same shape sits under pnpm check:pm-dispatch-gates and its siblings: the CI wrapper spawns the tool and holds result.status only, so an inert child is a green gate.

The spellings, measured on this tree

grep -rn "process.argv\[1\]" scripts/ finds at least eight distinct forms. Grouped by what each gets wrong:

resolve(argv[1]) === resolve(fileURLToPath(import.meta.url)) — check-governed-merges.mjs:648, sync-template-versions.mjs:767, check-objectui-pin-fresh.mjs:848, sync-docs-image-tags.mjs:587, check-prerelease-pin-watch.mjs:889, check-skill-frame-freshness.mjs:1042, check-docs-image-tag.mjs:739, check-agent-model-declared.mjs:565. The best of them; still symlink-blind.
the same without resolve() on the right-hand side — release-github-releases.mjs:1012, ci-failure.mjs:1204, check-doc-anchors.mjs:607, check-docs-redirects.mjs:692, check-published-readme-exports.mjs:1320, check-adr-links.mjs:460, check-stack-collection-maps.mjs:829.
import.meta.url === pathToFileURL(argv[1]).href — check-kernel-hook-pairs.mjs:448.
import.meta.url === new URL(`file://${argv[1]}`).href — js-comment-mask.mjs:304. Breaks additionally on any path needing percent-encoding, since the template bypasses the encoder pathToFileURL applies.
new URL(import.meta.url).pathname === argv[1] — git-history.mjs:507. Compares a percent-encoded pathname against a raw argv.
basename matching — check-half-states.mjs:4149 (import.meta.url.endsWith(argv[1].split('/').pop())) and qa-rollup.mjs:944 (argv[1].endsWith('qa-rollup.mjs')). These answer true for any entry script sharing the basename, so they can fire on import as well as go inert.

The shape that survives

PR #10084 uses a two-comparison predicate in dispatch-gates.mjs and pins it with a real symlink fixture:

export function invokedAs(entryArg, selfPath) {
  if (!entryArg) return false;
  const entry = resolve(entryArg);
  const self = resolve(selfPath);
  if (entry === self) return true;
  try {
    return realpathSync(entry) === realpathSync(self);
  } catch {
    return false;
  }
}

Ablating the realpath half in that PR turns the symlink cases red (2 of 344), which is what establishes the case pins something rather than decorating the file.

Suggested shape for whoever takes this: one shared module exporting the predicate, imported by the scripts rather than re-typed — the same argument js-comment-mask.mjs and i18n-bundle-surface.mjs already won for their own duplicated judgments. A guard each file spells for itself is a guard each file can spell wrongly, and this one is wrong in a direction no gate can see.

Dedupe

search_issues for "entry guard spelling inconsistent across scripts, four different ways to compare process.argv[1] with import.meta.url, converge on one" returns 0 results. A second confirming search was refused by a GitHub API rate limit, so the dedupe rests on that one query plus #9757's own dedupe section, which found only the ADR-0087 precedent (#6566) and unrelated dispatch-gates derivation cards. #9757 names the spelling divergence in passing as "cheap while the file is open"; this card is that observation after measurement, and the measurement makes it larger than a tidy-up.

Generated by Claude Code

Claim: PM loop round 3
Session: session_01DdCnBGcHeufjrq7drTD3wt
Branch: claude/issue-10086-invoked-directly-entry-guard
Worktree: objectstack-issue-10086
Domain: domain:devx
Container & model: M, mode:subagent, model: opus
File surface: the scripts/** files carrying an invokedDirectly-style entry guard, plus whatever guard/test the fix needs (stop on breach; explain in the report)
Clause-②: no
Serial constraints cleared: No open PR touches scripts/*.mjs entry guards. ⚠️ FENCED, not merely declared: this round's siblings hold scripts/publish-smoke.sh (#10212) and content/docs/deployment/** (#10229); PR #10205 (#10032, in patch round) holds scripts/check-test-completeness.mjs and ci.yml. If any of those three files carries one of the ~8 spellings, ⛔ LEAVE IT and name it in your report — do not edit a file another dispatch is holding. H17 index intersected: empty.

Label note: this card carried finding and pm:queue simultaneously — a half-state flagged on the seat post earlier today. Grading already happened (it was promoted to pm:queue), so finding was stale and I dropped it in the same write as the dispatch. ⛔ Not a re-grade; the grade stands as triage set it.

Why this one matters more than "8 spellings of a guard"

every one of them makes its script silently inert (exit 0, no output) when reached through a symlink — including check-governed-merges.mjs, the governed-surface register

⭐ That is the load-bearing consequence. check-governed-merges.mjs is the audit half of the governed-surface regime — the one that replaced a per-PR gate. Per the standing rule, human merge is the review record and the audit list is the only after-the-fact defence. A register that exits 0 with no output when invoked through a symlink does not report "no violations"; it reports nothing, and nothing reads identically to clean.

⇒ This is the same family as everything this lane has been filing today — a check that cannot reach its subject, whose silence is indistinguishable from a pass — sitting under the governance regime itself.

Acceptance criterion — ⛔ green is not it, and here it is especially not it

The defect is an exit-0-with-no-output. So a passing run is literally the symptom.

Required: reproduce the inertness — invoke at least one affected script through a symlink and show it exit 0 having done nothing, then show the same invocation actually running after the fix. Do it for check-governed-merges.mjs specifically, since that is the one with governance consequences.

⚠️ Anti-vacuity: any "0 occurrences remain" claim needs a control that could have returned non-zero for that specific pattern, pre-existing your change and surviving it. The card says ~8 spellings — ⛔ do not report "all fixed" from a grep for one spelling.

What the fix has to decide

The card names the shape but not the remedy. Weigh at least:

normalise the guard to one spelling that is symlink-correct (realpath-based comparison rather than a raw argv[1] string match), applied across all sites; and/or
a guard-of-the-guard: a check that every scripts/** entry point actually runs when invoked, which is what stops a ninth spelling appearing.

⭐ Relevant precedent from this lane today: #10196 filed the sixth instance of "a --self-test nothing runs" and argued for a class-closing guard rather than a seventh manual wiring. The same argument plausibly applies here — ⛔ but it is yours to judge from measurement, not a ruling from me. If you fix the sites without closing the class, say why.

PM 机制假设 (measure — falsifying these is a good run)

Read with git show origin/main:<path> — depth-50 shallow clone, git log lies about file history. Anchor by symbol.

~8 distinct spellings of the guard across scripts/.
Each is inert (exit 0, no output) when reached via symlink.
check-governed-merges.mjs is among them.

⚠️ The count and the roster are the card's, not a census — re-derive both. If it is 6 or 11 rather than 8, that is the finding.

Gates

node scripts/pm/dispatch-gates.mjs with no path args; run every family it names and quote each verdict line. ⚠️ A change across many scripts/** files may move gates no path derivation predicts — report anything extra you ran. skip-changeset expected (root scripts/) — judge from your diff.

Final report: structured JSON, returned AND posted here with first line . ⚠️ Sanitizer has eaten that marker three times today — read back and add a literal fallback if stripped.

Generated by Claude Code

fix(scripts): route every entry guard through one symlink-correct pre…

{
"issue": 10086,
"status": "done",
"branch": "claude/issue-10086-invoked-directly-entry-guard",
"pr": "#10275",
"premise_still_valid": true,
"summary": "The load-bearing premise held and is fixed: check-governed-merges.mjs was inert through a symlink, and because EXIT_TEST_NOT_GOVERNED is 0, --test AGENTS.md returned exit 0 with NO OUTPUT through a symlink - byte-identical in exit code to its 'NOT governed, ordinary queue landing applies' clearance, while running directly it exits 3 and prints the GOVERNED refusal. Three sub-premises moved, each re-derived not assumed. (1) COUNT: 11 distinct spellings across 33 files, not ~8; the card's roster also under-counted basename matchers 1 -> 3. (2) 'Every one is inert via symlink' is FALSE: the 3 basename matchers (check-half-states, check-partof-closing-keyword, check-single-claim-paths) survive a SAME-NAMED symlink and fail the opposite way - they fire on IMPORT - and qa-rollup.mjs was never symlink-inert at all. A fix chasing only inertness would have left 4 files broken in the other direction. (3) The percent-encoding claim holds for '#' but NOT for a space, which URL normalises - so that leg fails sporadically. Fix: added scripts/invoked-as.mjs as the one predicate (isEntrypoint(import.meta.url)), rewrote all 33 sites, and - following the #10196 class-closing precedent - added check:entry-guard, which permits process.argv[1] only inside invoked-as.mjs and also rejects require.main / import.meta.main / process.mainModule and any isEntrypoint call on someone else's url. Chose a SPELLING gate over a behavioural sweep because several scripts/ entry points have real side effects and 'produced output' is not decidable for an arbitrary tool; the behavioural evidence therefore lives once, at the predicate, whose self-test drives a real probe through a real symlink. Also found a THIRD implementation already in the tree - packages/cli/src/utils/invocation.ts exports isProcessEntry, citing this very card - carrying a directory leg (node <dir>) that scripts/ lacked; aligned invokedAs leg-for-leg with it rather than shipping two predicates that answer this question differently, which is the defect being closed. Three self-tests copy their own source into a synthetic checkout and spawn it there, so the new sibling import broke them (5 fixture sites across 3 files); repaired by making invoked-as.mjs travel with the copy.",
"tests": "GATES: node scripts/pm/dispatch-gates.mjs with no path args, derived AT THE FINAL COMMIT f9a72c2, named 43 families; all 43 run at that sha. 37 exit 0. Quoted verdict lines (each printed by the gate itself, exit codes captured before any pipe): '\u2713 check:entry-guard: 115 scripts/ file(s) - every entry guard goes through invoked-as.mjs.' | '\u2713 check-entry-guard self-test: 26 cases pass (all 11 measured spellings rejected, canonical form and masked prose/payloads accepted).' | '\u2713 invoked-as self-test: 11 cases pass (real symlink, different-name symlink, percent-encoding path, and both import directions).' | '\u2713 check-governed-merges --self-test: 81 assertions' | '\u2713 dispatch-gates self-test: 388 cases pass.' | 'check-nul-bytes: OK (scanned 6090 text file(s); no raw ASCII control bytes).' | ESLint over scripts/ via os-verify-lock.sh: 'os-verify-lock: VERDICT command-exit 0 - held the lock 4s - waited 0s'. The 6 non-zero are environmental, each CONFIRMED not assumed: check-partof-closing-keyword / check-single-claim-paths / check-half-states (bare live-mode) each print their own 'NOT WIRED - ... judged nothing ... This is a wiring or usage failure, NOT a verdict' for absent PR_BODY/PR_NUMBER, and their pnpm check:* self-test wrappers all exit 0; check-prerelease-pin-watch prints a standing board condition ('act on #3653'); check:published-readme-exports and check:type-check-debt both demand a built workspace ('whose type entry packages/.../dist/index.d.ts does not exist. Build first', '55 workspace dependenc(ies) ... have no built type entry point on disk') and both fail IDENTICALLY on unmodified origin/main, while this diff touches 0 files under packages/. REPRODUCTION (the acceptance criterion): on origin/main via symlink, check-governed-merges.mjs --test AGENTS.md -> output=[] exit=0; run directly -> exit=3 with '\u26d4 GOVERNED - a human merge is the review record for this PR'. On this branch via the same symlink -> exit=3 with the GOVERNED text. Also --self-test: symlink 0 lines / exit 0 before, 81 assertions after. FULL SWEEP, all 33 files x {direct, same-name symlink, different-name symlink} on both trees (second worktree at origin/main 923c424 as control): origin/main SYMLINK-INERT=31 of 33; this branch SYMLINK-INERT=0 of 33, with all three invocation paths producing identical output per script. The 2 non-inert on main are exactly the two the census predicts (dispatch-gates already fixed; qa-rollup a basename matcher). ANTI-VACUITY CONTROL: the NEW gate's own scanner run against the UNMODIFIED origin/main tree - same gate code, both trees - reports FILES=33 FINDINGS=50, versus 0 on this branch; and the gate's self-test drives all 11 measured spellings as fixture sources and asserts each is rejected, so the 0 is not a grep for one shape. ABLATION: invoked-as.mjs is loaded from source by node (no dist/ in its resolution path), so there is NO rebuild leg; instead each mutation was confirmed ON DISK by counting the removed text (-> 0) and the injected marker (-> 1) BEFORE running, and each restore by the reverse plus cmp against a pre-ablation snapshot (byte-identical, both times). Leg 1: replacing the realpath comparison with return false -> 2 of 11 cases red, both symlink legs, reported as {"out":"","status":0} - literally the defect shape. Leg 2: reducing the directory candidates to [entry] -> 1 of 11 red, the node <dir> case. Both restored and re-verified green. REGRESSIONS FOUND BY RUNNING (not by reading): sync-template-versions.mjs, check-adr-0087-registration.mjs and objectui-changeset-digest.mjs went red mid-change on ERR_MODULE_NOT_FOUND because their self-tests copy their own source into a synthetic checkout; 5 fixture sites repaired; all three green now.",
"open_questions": [],
"out_of_scope_findings": [
"filed as #10269: four more symlink-blind entry guards outside scripts/ where this gate's population cannot reach them - packages/objectql/scripts/dry-run-hash-compat.ts (regex basename), packages/core/examples/kernel-features-example.ts, packages/core/examples/phase2-integration.ts, examples/embed-objectql/src/index.ts (all three the file://${argv[1]} template, which also breaks on percent-encoding). Widening the gate is a design question, not mechanical: packages/** cannot import scripts/invoked-as.mjs, so the gate would have to accept isProcessEntry as a second legal spelling. The issue also notes invocation.ts's header repeats the card's '~8 spellings' estimate where the measurement is 11 across 33.",
"commented on #10196 rather than filing a duplicate: scripts/pm/git-history.mjs --self-test is CURRENTLY RED (3 cases, the shallow-clone deepening fixture), byte-identically on unmodified origin/main - pre-existing and untouched here. It corroborates that card's argument that a self-test no CI job runs can hide real breakage; whoever wires it should budget for fixing the fixture, not just the wiring.",
"no new issue for the fenced files: scripts/publish-smoke.sh (#10212), scripts/check-test-completeness.mjs and .github/workflows/ci.yml (PR #10205), content/docs/deployment/** (#10229) were each checked and carry ZERO occurrences of process.argv[1]. No fenced file was edited and there was no collision to report."
]
}

Generated by Claude Code

fix(create-objectstack): derive the fixture's script copy closure, no…

fix(turbo): hash scripts/invoked-as.mjs for create-objectstack#test

{
"issue": 10086,
"status": "done",
"branch": "claude/issue-10086-invoked-directly-entry-guard",
"pr": "#10275",
"premise_still_valid": true,
"summary": "PATCH ROUND — supersedes the report at issuecomment-5357761153. Head is now d3d528e. CI on f9a72c2 was red: 3 tests in packages/create-objectstack/src/template-version-stamps.test.ts failed with "Cannot find module './invoked-as.mjs'" from a /tmp fixture. Cause confirmed, not assumed: that test builds a synthetic checkout and copied exactly ONE named file, so the sibling import this PR added to sync-template-versions.mjs was never materialised. WHY ROUND ONE MISSED IT: my census enumerated copy-into-a-fixture consumers INSIDE scripts/ (the --self-test paths, 5 sites, 3 files) and never asked the wider question - what else in the repo materialises a copy of a scripts/.mjs. The answer included a vitest suite under packages/, a population dispatch-gates.mjs cannot reach because it derives repo GATE FAMILIES and runs no package test suite. Nothing I ran in round one executed that file. RE-DERIVED THE FULL POPULATION three independent ways (basename co-occurrence with a write verb; reads of a root-anchored scripts/ path feeding a write; mkdir/cpSync/symlinkSync targeting a synthetic 'scripts' dir). Outside scripts/ there are exactly 4 materialisations of the root scripts/ tree: template-version-stamps.test.ts (copies one named file - THE BREAK), packages/spec's dist-freshness.test.ts and dist-freshness-adoption.test.ts (symlink the WHOLE root scripts/ dir - safe by construction), and openapi-self-consistency.test.ts (copies packages/spec/scripts, not root - not in population). Four further packages/spec files import a root script IN PLACE, where the sibling resolves normally. So: one broken consumer, and the two safe ones are safe precisely because they take the whole directory rather than a hand-picked file. SHAPE: a second hand-listed sibling would be the same defect one turn later, so the fixture now DERIVES the closure - copy the script, then every relative import it makes, transitively - and the next sibling import travels on its own. Rejected on measurement: copying all of scripts/ (6 MB, 207 files for a two-file closure), and a directory symlink (node resolves symlinks for the module graph, so the script would self-locate to the REAL checkout instead of the fixture - the very thing the copy exists to prevent). Inlining the guard was rejected as reopening the class. A SECOND FINDING came out of the re-run: declaring scripts/invoked-as.mjs as a cross-package input made check:cross-package-test-inputs go red because turbo.json's create-objectstack#test inputs did not hash it - meaning the cache would not invalidate on a change to the sibling, so the test could go red on main while every PR reported green (#7802), which is the exact shape that caused this patch round. Added.",
"tests": "WHAT I RAN THAT ACTUALLY EXECUTES THE FAILING FILE (the round-one gap): pnpm --filter create-objectstack test --run. Round one ran none of it - only the 43 repo gate families, which never invoke a package test suite. REPRODUCED FIRST, on unmodified head f9a72c2: '❯ src/template-version-stamps.test.ts (8 tests | 3 failed) 216ms' / 'Test Files 1 failed | 6 passed (7)' / 'Tests 3 failed | 78 passed (81)' - matching CI exactly, same ERR_MODULE_NOT_FOUND on /tmp/sync-template-versions-9554-/scripts/invoked-as.mjs. GREEN AFTER: 'Test Files 7 passed (7)' / 'Tests 81 passed (81)'. Verbose run pins that the file EXECUTED and names all 8 cases green, including the exact three that were red: 'importing it against a STALE two-template checkout rewrites nothing', 'running the script stamps EVERY template, including the second one', 'covers every discovered template - the case a literal list fails'. ABLATION on the new helper: replacing the closure walk with a no-op reproduces the CI failure precisely - 'Tests 3 failed | 5 passed (8)' with the same ERR_MODULE_NOT_FOUND. No rebuild leg (the test runs from source). Mutation confirmed on disk before running (removed text -> 0, injected marker -> 1) and the restore likewise, plus a byte-identical cmp against the pre-ablation snapshot. EVERY PACKAGE THE CENSUS IMPLICATES, not just the failing one: create-objectstack (above) and @objectstack/spec - 'Test Files 415 passed (415)' / 'Tests 11049 passed (11049)', with zero ERR_MODULE_NOT_FOUND or invoked-as hits. GATES re-derived at the FINAL commit d3d528e: 45 families, up from 43, because the diff now reaches packages/create-objectstack/src/** - the 'gates no path derivation predicts' case, which is why the union was re-derived rather than reused. The two additions (pnpm check:slot-lookup, node scripts/docs-audit/check-affected-docs.mjs) were run and pass; check:slot-lookup prints '✓ slot-lookup ratchet holds: 107 unswept site(s) in 25 file(s), none new'. All 45 run at d3d528e: 39 pass. Quoted verdict lines: '✓ check:entry-guard: 115 scripts/ file(s) - every entry guard goes through invoked-as.mjs.' | 'OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.' | '✓ check-governed-merges --self-test: 81 assertions' | '✓ dispatch-gates self-test: 388 cases pass.' The 6 non-zero are the SAME environmental set as round one, each confirmed rather than assumed: check-partof-closing-keyword / check-single-claim-paths / check-half-states print their own 'NOT WIRED ... NOT a verdict' for absent PR_BODY/PR_NUMBER (their pnpm self-test wrappers pass); check-prerelease-pin-watch prints a standing board condition ('act on #3653'); check:published-readme-exports and check:type-check-debt demand a built workspace and fail identically on unmodified origin/main. ESLint over scripts/ plus the changed test: 'os-verify-lock: VERDICT command-exit 0'. Control-byte sweep over all 40 PR files: clean. Patch-round diff is 3 files / 51 insertions. Pushed fast-forward f9a72c2..d3d528e, no force. ROUND-ONE EVIDENCE STILL STANDS and was not re-derived: 11 spellings / 33 files, the 31-of-33 -> 0-of-33 symlink sweep, the anti-vacuity control (new gate vs unmodified origin/main: FILES=33 FINDINGS=50 vs 0), and both predicate ablation legs.",
"open_questions": [],
"out_of_scope_findings": [
"filed as #10269: four more symlink-blind entry guards outside scripts/ where this gate's population cannot reach them - packages/objectql/scripts/dry-run-hash-compat.ts (regex basename), packages/core/examples/kernel-features-example.ts, packages/core/examples/phase2-integration.ts, examples/embed-objectql/src/index.ts (the file://${argv[1]} template, which also breaks on percent-encoding). Widening the gate is a design question, not mechanical: packages/** cannot import scripts/invoked-as.mjs, so the gate would have to accept isProcessEntry as a second legal spelling.",
"commented on #10196 rather than filing a duplicate: scripts/pm/git-history.mjs --self-test is CURRENTLY RED (3 cases, the shallow-clone deepening fixture), byte-identically on unmodified origin/main - pre-existing and untouched here.",
"NOT filed, reported here as a process observation: no gate or derivation in this repo can tell you that a packages/** test copies a scripts/*.mjs into a fixture. check-cross-package-test-inputs.mjs comes closest, but its own header says it is a source scan that recognises a fixed list of spellings, and this fixture derives the path rather than quoting it - so the read was invisible to it until I declared it by hand. That is the same silence-reads-as-pass family this card is about, one level up, and it is what let round one land red. I did not file it because the remedy is not obvious and inventing one unprompted would widen this PR; flagging it for PM triage instead."
]
}

Generated by Claude Code

✅ ACCEPT — PR #10275, after one rework round

Reviewed against the tree at d3d528e9, not against the report. Flipped ready, auto-merge armed. Test Core (2/3) — the shard that was red — is green.

The rework answered the part that mattered

I asked for the census before the fix, because a point fix here is the same defect one turn later. It came back with the population derived three independent ways, and the fix shape follows from it: the fixture now derives the transitive relative-import closure instead of copying one hand-named file, so the next sibling import someone adds travels on its own.

I re-derived the population myself over all 2,472 test files outside scripts/ at d3d528e9, looking for files that both name a root scripts/ path and carry a materialising op:

file	verdict
`packages/create-objectstack/src/template-version-stamps.test.ts`	the break — now derives the closure
`packages/spec/scripts/dist-freshness.test.ts`	safe — `symlinkSync(REPO_ROOT/scripts, …, 'dir')`, whole directory
`packages/spec/scripts/dist-freshness-adoption.test.ts`	safe — same
`packages/spec/scripts/schema-tree-freshness.test.ts`	not in the population — imports `../../../scripts/check-regen-pending.mjs` in place; its `mkdtempSync` sandbox holds test data, not a copy

My sweep surfaced the fourth file and the dev's did not, so I checked it by hand: it belongs in their "imports in place, sibling resolves normally" bucket. Their classification was right and my heuristic was simply coarser. Nothing they missed.

Worth naming why the two safe ones are safe: they take the whole directory rather than picking files. And the dev's rejection of that approach here is not inconsistent with it — template-version-stamps needs the copied script to self-locate into the fixture, and node resolves symlinks for the module graph, so a directory symlink would send it back to the real checkout, defeating the copy's whole purpose. Both readings are correct because the two fixtures want opposite things.

The finding I did not ask for and am glad to have

Declaring scripts/invoked-as.mjs as a cross-package input turned check:cross-package-test-inputs red, because turbo.json's create-objectstack#test inputs did not hash it. Left alone, the cache would not invalidate on a change to the sibling — so the test could go red on main while every PR reported green, which is #7802's shape and is exactly what produced this patch round. Caught by re-running rather than by reading.

On why round one landed red

The dev's own account matches mine and was re-derived, not accepted from me: the round-one census covered copy-into-a-fixture consumers inside scripts/, and the population also contains vitest suites under packages/ — which dispatch-gates.mjs cannot reach, because it derives repo gate families and runs no package test suite. Nothing run locally in round one executed the failing file. That is a real gap in how this repo verifies a change to what scripts/ files import, not a lapse in care.

Carried forward

The dev flagged a process observation and deliberately declined to file it — "the remedy is not obvious and inventing one unprompted would widen this PR" — which was the right call. I have filed it as #10315: check-cross-package-test-inputs is a source scan over fixed spellings, so a derived path is invisible to it; the declaration had to be added by hand and nothing would have complained if it hadn't been. Same silence-reads-as-pass family as this card, one level up. Unassigned, with the population table and an explicit bound on the sweep, and ⛔ no remedy proposed as decided.

Also standing from round one, unchanged: #10269 (four symlink-blind entry guards outside scripts/, where widening the gate is a design question because packages/** cannot import scripts/invoked-as.mjs), and the note on #10196 that scripts/pm/git-history.mjs --self-test is red byte-identically on unmodified origin/main.

Generated by Claude Code

fix(devx): symlink-blind entry guards at the four sites outside scripts/

fix(cli): make the two invocation failures that read as a crashed boo…

fix(scripts): route every entry guard through one symlink-correct pre…

fix(devx): the four symlink-blind entry guards outside scripts/, wher…

Navigation Menu

Repository navigation

The `invokedDirectly` entry guard is spelled ~8 ways across `scripts/`, and every one of them makes its script silently inert (exit 0, no output) when reached through a symlink — including `check-governed-merges.mjs`, the governed-surface register #10086

The measurement

Why it matters more than a cleanup

The spellings, measured on this tree

The shape that survives

Dedupe

Why this one matters more than "8 spellings of a guard"

Acceptance criterion — ⛔ green is not it, and here it is especially not it

What the fix has to decide

PM 机制假设 (measure — falsifying these is a good run)

Gates

✅ ACCEPT — PR #10275, after one rework round

The rework answered the part that mattered

The finding I did not ask for and am glad to have

On why round one landed red

Carried forward

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

The invokedDirectly entry guard is spelled ~8 ways across scripts/, and every one of them makes its script silently inert (exit 0, no output) when reached through a symlink — including check-governed-merges.mjs, the governed-surface register #10086

Description

The measurement

Why it matters more than a cleanup

The spellings, measured on this tree

The shape that survives

Dedupe

Activity

os-zhuang commented on Aug 20, 2026

Why this one matters more than "8 spellings of a guard"

Acceptance criterion — ⛔ green is not it, and here it is especially not it

What the fix has to decide

PM 机制假设 (measure — falsifying these is a good run)

Gates

claude commented on Aug 20, 2026

claude commented on Aug 20, 2026

os-zhuang commented on Aug 20, 2026

✅ ACCEPT — PR #10275, after one rework round

The rework answered the part that mattered

The finding I did not ask for and am glad to have

On why round one landed red

Carried forward

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The `invokedDirectly` entry guard is spelled ~8 ways across `scripts/`, and every one of them makes its script silently inert (exit 0, no output) when reached through a symlink — including `check-governed-merges.mjs`, the governed-surface register #10086