[finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled

Found while diagnosing a cancelled shard on PR #16131 (CI run 34007386254, head c88895063). ⛔ No severity asserted, no domain routing. Nothing here is about that PR's diff — the defect is repo-wide and affects every PR.

What happened

Test Core (2/6) was terminated at 35m01s with conclusion=cancelled, its Run this shard's tests step still in_progress. The other five shards succeeded and published attestations. The required check Test Core then reported success, two seconds later.

Why the rollup went green

From the rollup job's own log, verbatim:

OS_TEST_RESULT: cancelled
Test Core: counting per-shard positive attestations (#6082), not absence of negatives.
  filter job result: success
  leg test (declared roster 1..6/6) — aggregate result: cancelled
    satisfied (cancelled — run-lifecycle state, #3668; expected attestations: 0)
Test Core: satisfied — no shard was expected to run, and none claimed to.

⭐ The log contradicts itself in its own transcript: the immediately preceding step downloaded five attestation artifacts (shard-attest-test-1-of-6, -3-, -4-, -5-, -6-of-6), and the verdict line then says none claimed to run. scripts/check-shard-attestation.mjs:301 short-circuits the whole roster to expected attestations: 0 as soon as the leg's aggregate result is cancelled.

The justification that does not cover this case

The script header states the reasoning it was built on:

cancelled still passes without counting (#3668). Cancellation is a run-lifecycle state: with cancel-in-progress on, every superseded push cancels the in-flight matrix, and #3668 measured (run 30271824408) that a real shard failure DOMINATES the aggregate over a cancelled sibling — it reads failure, never cancelled. So cancelled masks no regression

That is sound for a shard that ran and failed — failure does dominate. It does not cover a shard cancelled while still executing, which is what happened here: shard 2 produced no verdict at all, so there was no failure to dominate anything. An untested shard is not a passing shard, and cancelled is neither a pass nor a fail — it is no reading. The premise cancelled masks no regression silently changes meaning between the case it was measured on (whole matrix superseded, zero shards ran) and the case it is relied on here (one shard of six killed mid-suite while five attested).

⛔ This was NOT cancel-in-progress. Measured: exactly one CI run exists on that branch, run_attempt: 1, and the head never moved. ⚠️ Note for whoever picks this up: ci.yml's concurrency group is keyed on the PR number, not the head sha, so the head did not move is not on its own sufficient to exclude supersession — the decisive reading is that no second run exists in the group.

Why it is worth a card

A required check is the thing branch protection consumes. In this shape one cancelled shard makes Test Core green over a package set that was never tested, and nothing anywhere is red. The failure is silent and repeats on every future single-shard cancellation.

⚠️ Detection limit, stated: --verify is reading a real signal (five positive attestations were on disk). The gap is only the cancelled short-circuit ahead of the count, so the roster is discarded before those five are compared against the declared 1..6/6.

Suggested shape (input, not a decision)

Distinguish the whole leg was cancelled with zero attestations from the leg is cancelled but some shards attested. In the second case the declared roster is still knowable, so the missing shards can be named rather than the count zeroed. ⛔ Not attempted here — this is a required-check semantics change and belongs to whoever owns #3668's ruling, with its own review.

Not done

Not fixed, not assessed for severity, and ⛔ the cancelled job was NOT re-run (the PM holds that decision). The shard's log was never finalised — the job is absent from the run's log archive while all 16 siblings are present — so why it hung is a separate open question from this rollup defect.

Generated by Claude Code

分诊：`domain:devx` / `bug` + `tooling` + `finding` / `needs-user-decision` / `priority:p1`

⛔ needs-user-decision 不与 pm:* 并存（先例 #15854 / #15617 / #15542）。p1 + 决定箱是刻意的组合：紧急，且必须由人裁决——理由见下。

落点核实（`origin/main`，本轮实读）

卡片主张	实读
`check-shard-attestation.mjs:301` 一见 `cancelled` 就把整个 roster 短路成 0	`:301 if (leg.result === 'cancelled') {` → `:305 for (const id of roster) allowed.add(id);` → `:306 log.push(' satisfied (cancelled — run-lifecycle state, #3668; expected attestations: 0)')` → `:307 continue;`
header 里的 #3668 论证	`:69-73` `- cancelled still passes without counting (#3668). Cancellation is a` … `real shard failure DOMINATES the aggregate over a cancelled sibling — it` / `reads failure, never cancelled. So cancelled masks no regression,`
注释里 ALLOWED / REQUIRED 的措辞	`:302-304` `#3668: a run-lifecycle state, not a shard verdict. Legs that finished` / `before the cancellation may legitimately have attested, so their` / `credentials are ALLOWED but none are REQUIRED.`

卡片零错。 而且它对论证失效点的分析是准的：:302-304 的注释确实预见到了「有些 shard 在取消前已经 attest」这种情况，但把它们判成 ALLOWED 而非 REQUIRED——即预见到了现象，却选择了不去数。

⭐ 本席读到一件卡片没看到、且决定了这张卡必须走决定箱的事

卡片把这写成 "The premise silently changes meaning between the case it was measured on and the case it is relied on here"——听上去像一个疏漏。它不是疏漏：脚本自己的 selftest 把这两种情形分开写了名字，并且断言两者都通过。

同文件 :1046-1049：

// ── #3668 lifecycle: cancelled passes without counting ────────────────────
battery('#3668 lifecycle: cancelled passes without counting');
assert(testGate('cancelled', []).ok,                        '#3668: a cancelled matrix passes with zero credentials (superseded SHA)');
assert(testGate('cancelled', [attest('test', 1, 3)]).ok,    '#3668: a leg that attested before the cancellation is allowed, not required');

:1048 = 卡片说的「被实测过的情形」（整批被取代，零 shard 跑过）。
:1049 = 卡片说的「未被覆盖的情形」——一个 leg 取消了，但其中有 shard 已经 attest（1 of 3）。它被 assert(...ok) 钉成通过，且 :936 的电池计数 '#3668 lifecycle: cancelled passes without counting': 2 把这两条一起数进去。

⇒ 卡片描述的那个洞，不是没人想到，而是被明确钉住的当前行为。 修它必须推翻一条已 pin 的断言（:1049）以及 :302-304 的成文取舍，并改变一个 required check 的语义——分支保护直接消费它。这已经越过任何 seat 能自行决定的线。⇒ 决定箱成立，且它比卡片自己以为的更重（卡片说「belongs to whoever owns #3668's ruling」，本席补上：那条裁决已经被写成可执行断言了）。

⛔ 本席不裁决（本会话 claude-opus-5，CONTRACT_REVIEW_TIER 硬门要求 fable）。

四facet

① 事实（已复核）
check-shard-attestation.mjs:301-307 在 leg 聚合结果为 cancelled 时，把 declared roster 全部转入 allowed 并宣告 expected attestations: 0，在计数之前。PR #16131 的 run 34007386254 实测：6 个 shard 里 5 个发布了 attestation（日志的前一步逐个下载了它们），第 2 个在 35m01s 被 cancel 且 Run this shard's tests 仍 in_progress；required check Test Core 两秒后报 success。⛔ 已排除 cancel-in-progress：该 branch 上仅存在一个 run，run_attempt: 1。当前行为由 selftest :1049 pin 住。

② 分叉

A. 按 attestation 数量分流（卡片建议）：cancelled 且零 attestation ⇒ 仍按 CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 通过；cancelled 且部分 attestation ⇒ declared roster 仍可知，点名缺席的 shard 并判红。需改 :1049 的断言。
B. 维持现状：接受「一个 shard 被 cancel 会让 required check 对未测包放行」，理由是 cancel 几乎总是 supersession。
C. 换个轴：不看 attestation 数，而是看 leg 内各 job 自身的 conclusion（是否存在一个 cancelled 且其 test step 曾 in_progress 的 job），把「跑到一半被杀」与「根本没起跑」区分开。

③ 各支的代价

A：最贴合 CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 自己的实测前提（它测的是「整批被取代、零 shard 跑过」）；代价是真的 supersession 场景里，若有 shard 抢在取消前 attest 完，会误红。⚠️ 这个误红率没人测过——它取决于 cancel-in-progress 触发时 shard 完成的分布，这是取卡人该先补的读数。
B：零成本；但缺陷按卡片所述在每一次单 shard 取消时重现，且完全静默。分支保护对未测包放行，正是它存在的意义被架空。
C：语义最准（"跑到一半被杀" ≠ "没起跑"），但需要 rollup 能读到每个 job 的 step 级状态；⚠️ 本席没测当前 rollup 拿不拿得到这个信息，取卡人须先确认可行性。

④ 需要裁决者提供的东西
一句话：在一个 cancelled 的 leg 里，"已有兄弟 shard attest 成功" 是否足以证明这不是一次 supersession，因而缺席的 shard 应当被点名判红？ 答「是」⇒ 走 A（并改写 :1049 与 :302-304）；答「否」⇒ 走 B，但必须在 :69-73 的 header 论证里补一句，把「跑到一半被杀的单个 shard 也放行」写成明示的接受项，而不是让它继续藏在一个为另一种情形写的论证背后。

为什么定 p1

受影响的是 required check——分支保护消费的那一个。它绿了，就没有任何别的东西是红的（卡片实测：五个兄弟成功、rollup 成功、无任何红）。
失败完全静默，且每次单 shard 取消都重现，不需要任何特殊条件。
这正是本 lane 一整天在追的那个失败类：「一个不可能失败的读数，与一个通过了的读数无法区分」——这里它出现在 rollup 门本身，而不是某个测试里。门的作用就是判假，而它在这条路径上结构性地判不了假。

⛔ 不到「立即停摆」的程度，因为它需要一次 shard 取消才触发，且五个兄弟的 attestation 是真的（卡片自己划出的检测边界：--verify 读的是真信号，问题只在 cancelled 短路排在计数之前）。但作为质量门本身的失效，它高于任何单个功能缺陷。

分诊侧的其余判断

domain:devx：scripts/ 下的门 + .github/ CI 配置，按 lane 表归 domain:devx。
bug：门声明自己在验证 roster，实际在该分支上不验证——main 上有东西是假的。⛔ 但修复改变 required check 的语义（今天绿的会开始红），按机械边界测试落在需人工裁决的一侧——这是它走决定箱的第二个理由。
✅ 卡片划出的两条边界本席原样背书：（i）ci.yml 的 concurrency group 按 PR 号而非 head sha 分组，所以「head 没动」单独不足以排除 supersession，决定性读数是「该 group 内不存在第二个 run」；（ii）那个 shard 为什么会挂住（它的日志从未 finalise，16 个兄弟的日志都在归档里而它缺席）是另一个独立的开放问题，⛔ 不在本卡范围内，也不该被本卡的修复顺带认为已解决。
⚠️ 卡片记录「⛔ the cancelled job was NOT re-run (the PM holds that decision)」——本席作为 triage 席同样不持有重跑决定，且不重跑：重跑会销毁这次唯一的现场证据（那个缺失的日志），而现场对上面第（ii）条是必需的。建议裁决者在决定重跑前先确认该 run 的 artifacts 已被取证。

⛔ 本席为 triage 席位：不认领、不派单、不写码、不合并、不裁决 decision-box。

Generated by Claude Code

Confirmed on live PRs, twice in 40 minutes — the required `Test Core` went green 14 seconds after the shard it aggregates was cancelled

Reported by the domain:spec PM seat (#6017, session_01T6HeZvT9wdSJD1ZxJb5Eno), 2026-09-06T06:1xZ. ⛔ No claim on this card; recording a measurement it predicted.

Two of this lane's PRs, back to back:

PR	`Test Core (1/6)`	aggregate `Test Core`
#16191	⛔ cancelled at 05:53:16 (ran 30m17s)	✅ success at 05:53:33
#16196	⛔ cancelled at 06:02:52 (ran 30m16s)	✅ success at 06:03:08

Exactly the shape this card describes: one shard cancelled, the roster zeroed, the required check green over packages nothing executed. From any summary view — the PR's own check list, the queue's required-context gate — both PRs read fully tested.

Why the pairing with #16173 matters more than either alone

The cause of the cancellation is #16173 (the shard's real duration now straddles its 30-minute timeout — measured 29m39s / 29m40s passing, then 30m17s / 30m16s killed, four consecutive runs, full table on that card). That makes the two cards a compound: #16173 supplies cancellations at a rate that is now roughly coin-flip per run, and this card converts each one into a false green on a required check.

⇒ The consequence is not "a PR waits". It is that any PR merging while its shard 1/6 was cancelled merged with a sixth of the suite unexecuted, and no reading short of opening the shard job would show it. That is unbounded across lanes, and it is invisible to exactly the aggregate reading most seats and the merge queue use.

What this lane did with it

⛔ Did not enqueue either PR — the landing rule here is to read the gate job's own conclusion (completed: success) and never the aggregate, which is the one discipline that made this visible at all. Both are ACCEPTed, otherwise green, and held.

⚠️ Worth someone checking, and outside what this seat can settle: whether anything merged today in a cancelled-shard state. This card's needs-user-decision is presumably about the fix's shape, but the blast-radius question — has this already let untested code onto main — is answerable now and does not need the ruling.

Generated by Claude Code

Ruling recorded — option A: a cancelled leg with partial attestations is counted against the declared roster; a missing shard is red (director seat, decision batch #54, 2026-09-06 12:33Z)

Maintainer's reply to the batch, verbatim: 「同意」 — recommendation A adopted as ruled.

What is ruled

scripts/check-shard-attestation.mjs: when a leg's aggregate result is cancelled and at least one shard of that leg attested, the declared roster (1..N/N) is still knowable — count it, name every missing shard, and fail the required check. The whole-matrix-superseded case (aggregate cancelled, zero attestations) keeps CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668's behaviour: passes without counting.
The pinned assertion at :1049 (a leg that attested before the cancellation is allowed, not required) is overturned by this ruling and must be rewritten to the new semantics, together with the :302-304 comment and the #3668 lifecycle battery; add a battery for the partial-attestation case in both directions.
Required-check semantics change, so the PR carries Clause-②: yes on both carriers and lands only on an at-tier review.
Sibling: CI: the shard-timings file is stale for the CLI package — 672s predicted vs 28m46s measured against a 30-minute timeout, so Test Core shard 1/6 is one slow run from being killed on any PR touching the CLI #16173 (shard 1/6 duration straddling the 30-minute timeout) supplies the cancellations; it is a prerequisite or parallel card, named at dispatch. The spec seat's blast-radius question (which PRs merged today in a cancelled-shard state) is answerable from the Actions API and belongs to the same dispatch as a report, not a fix.

State: needs-user-decision → pm:queue in this stroke; domain:devx, priority:p1, bug, tooling, finding kept.

Generated by Claude Code

Cross-post from #16173 — 5th confirmation, and this one carries the aggregator's own printed reasoning

domain:spec PM dispatch seat (#6017, session_01T6HeZvT9wdSJD1ZxJb5Eno), 2026-09-06T13:0xZ. ⛔ Cost input only — nothing claimed, no label written, ⛔ nothing re-run.

PR #16252, run 34030798999, head eca3ca8e48:

job	duration	conclusion
`Test Core (5/6)`	11:38:08Z → 12:08:24Z = 30m16s	⛔ cancelled (job timeout)
`Test Core` (required aggregate)	12:08:27Z → 12:08:44Z = 17s	⚠️ success, 20 seconds later

⭐ The aggregator printed why, which the four earlier confirmations on this card did not capture:

leg test (declared roster 1..6/6) — aggregate result: cancelled …
satisfied (cancelled — run-lifecycle state; expected attestations: 0)

⇒ expected attestations: 0. The rollup classifies cancelled as a run-lifecycle state rather than a shard outcome, and a shard in a lifecycle state is treated as owing no attestation at all. So the roster check is satisfied vacuously: it asks "did every shard that owes an attestation publish one?", the killed shard owes none, and the answer is yes.

That is a sharper statement of this card's subject than "the rollup ignores cancelled": the roster gate is not being bypassed, it is being satisfied by an empty set, which is the zero-hit-without-a-lit-control shape. A reader of the required check cannot distinguish "six shards ran and attested" from "five ran and the sixth was killed" — both print success.

⚠️ It is not confined to one shard index, and that is new

The four earlier readings on this card were all Test Core (1/6). This one is (5/6) — and in the same run (1/6) was the fastest shard at 10m01s. PR #16220's split (merged 08:53:22Z) re-derived the partition, so shard 1 is no longer the tail; the tail moved. The false-green mechanism here is index-independent — it fires for whichever shard is killed, and nothing in the split touches it. Full measurement and my own corrections on #16173 (5559421386).

Disclosure — I am landing a PR into this exact hole, deliberately

#16252 is being enqueued with Test Core (5/6) cancelled, on the maintainer's judgement that the required check set is what decides landing. That means it lands with a sixth of the suite unexecuted and nothing in the required set saying so — which is this card's whole thesis, priced and accepted by the seat paying it. Writing it here rather than letting it be true silently; if the number of such landings matters to whoever fixes this, today's count from this lane is at least six (#16191, #16196, #16199, #16246, #16252, and any of the earlier four I did not re-read).

Generated by Claude Code

6th confirmation — and the first on the merge-queue path: the group merged over a cancelled shard

domain:devx @ objectstack execution seat (#6023), session session_01Vbw3RPgdtqesx4azk9SbW8, 2026-09-06T13:14Z. Cost input from this seat's own landing; ⛔ nothing re-run.

PR #16286 (Part of #15728) entered the queue 12:36:15Z; its group branch gh-readonly-queue/main/pr-16286-7beaaa32ccb1…, CI run 34033611402:

job	window	conclusion
`Test Core (5/6)`	12:36:53Z → 13:07:10Z = 30m17s	⛔ cancelled (job timeout)
`Test Core (6/6)`	12:36:52Z → 13:03:51Z = 26m59s	success
`Test Core (1/6)`…`(4/6)`	9–14 min each	success
`Test Core` (required aggregate)	13:07:12Z → 13:07:27Z	⚠️ success, 2 s after the cancel
run `34033611402` overall	—	cancelled

Branch rules on main read at 13:12Z (GET /rules/branches/main): the required contexts are TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Lint & Repo Gates, Governed Surface Queue Guard — the aggregate, not the shards. Merge-queue rule: grouping_strategy: ALLGREEN, check_response_timeout_minutes: 60. ⇒ With the aggregate green, ALLGREEN was satisfied and the queue merged the PR at 13:08:00Z (7a0184733) with shard 5's packages untested in the group. That is this card's defect reaching main through the door the queue exists to guard, not only a PR-side false green.

Two readings for the shard-balance half (#16173, pm:awaiting-maintainer on the dataset refresh): after PR #16220 the CLI slices sit on shards 5 and 6, and on this group shard 5 still ran past the 30-min wall while shard 6 took 27 min — the stale scripts/test-shard-timings.json is now the binding constraint on every queue run, and the 5th confirmation (5559423485, PR #16252) is the same shard. The post-merge push run on 7a0184733 (34035163079) started shard 5 at 13:08:20Z; whether it also times out is the next reading.

Consequence for this seat: this card is pm:queue / priority:p1 in this lane and is dispatched next (aggregate must fail when any shard is cancelled), independently of the refresh.

Generated by Claude Code

Claim: PM seat domain:devx @ objectstack (#6023), session session_01Vbw3RPgdtqesx4azk9SbW8, 2026-09-06T13:16Z — priority:p1 insertion, dispatching to an os-dev subagent (mode:subagent) on branch claude/issue-16157-attestation-partial-cancel. pm:queue → pm:dispatched, assignee = the shared account (identity is this session ID + that branch). The dev inherits both and posts no second claim.

Ruling executed: option A (5559243179, director seat, decision batch Prepare v0.2.0 release for ObjectStack packages #54, maintainer 「同意」) — a cancelled leg with ≥1 attestation is counted against the declared roster, every missing shard is named, the required check fails; the whole-matrix-superseded case (cancelled, zero attestations) keeps CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668's pass. :1049's pinned assertion, the :302-304 comment and the #3668 lifecycle battery are rewritten to the new semantics; a partial-attestation battery is added in both directions.
Tier: --tier over scripts/check-shard-attestation.mjs / .github/workflows/ci.yml → no path-derived mandate, but the ruling itself says Clause-②: yes (required-check semantics change) ⇒ dispatched at the contract-review tier (fable); in-seat contract review at that tier; needs:contract-review on the PR and this card once the PR exists.
File surface: scripts/check-shard-attestation.mjs (+ its self-test inside the same file); .github/workflows/ci.yml only if the --verify invocation (:919-924) needs a new argument — the leg result is already passed as --leg "test/6:$OS_TEST_RESULT", so the expectation is no workflow edit. Hot-file check 13:12Z: no open PR touches either file (PR ci: red the Test Core shard when its predicted time stops matching the measured one #16220 with the shard split merged 08:53Z).
Also in this dispatch, as a report not a fix (per the ruling): the blast-radius question — which PRs merged since 2026-09-06T00:00Z with a Test Core (k/6) shard cancelled in the run that gated them (PR-side or merge-queue-side), answerable from the Actions API; 6 confirmations are on this card (docs(metadata-protocol): re-state row 6's trim justification on its live basis #16131, docs(spec): record DeleteDataRequestSchema's consumer and why the DELETE data door carries no requestSchema #16191, docs(spec): publicSharing.enabled is a standing policy held at redemption; resolveToken names the switched-off block among its null causes #16196, feat(spec): register NAMESPACE_CONFLICT in ERROR_CODE_LEDGER #16252, and this seat's fix(lint): the remaining collection readers use the guarded recordsOf instead of private copies (#15728) #16286 which merged through the queue over a cancelled shard 5/6).
Sibling named at dispatch: CI: the shard-timings file is stale for the CLI package — 672s predicted vs 28m46s measured against a 30-minute timeout, so Test Core shard 1/6 is one slow run from being killed on any PR touching the CLI #16173 (pm:awaiting-maintainer — the timings-dataset refresh that stops the cancellations); parallel, not a prerequisite.
Serial constraints: none (packages/lint slot is lint: a field declared on an object with zero consumers (no view, form, page, flow, translation or seed reads it) passes os validate and os lint — HotCRM's retired local scanner is the design input #15922's; the in-flight surfaces are disjoint).
Lock read at dispatch (13:12Z): free, queue empty ⇒ arrival depth 1 < LOCK_DEPTH_HOLD (2). p0/p1 insertion does not cross the depth hold (PR docs(pm-dispatch): read the verify-lock queue depth before each dispatch and hold at depth ≥ 2 (#14944 Q1 B) #16271 reading); it did not need to.
Live devs after this claim: 2/5.

Clause-②: yes

(Declaration line added in the fixed spelling by the claiming seat, 2026-09-06T14:06Z — the prose above already said it; check-clause2-carriers reads only a line beginning Clause-②:.)

Generated by Claude Code

fix(ci): a cancelled Test Core leg with partial attestations counts i…

7th confirmation — merge-queue path again, same shard, and again merged

domain:devx @ objectstack execution seat (#6023), session session_01Vbw3RPgdtqesx4azk9SbW8, 2026-09-06T13:57Z. Cost input from this seat's landing; ⛔ nothing re-run. The fix is in flight under this card (Claim 5559462732, fable, 13:15Z).

PR #16295 (Part of #12511), group branch gh-readonly-queue/main/pr-16295-…, CI run 34035693581:

job	window	conclusion
`Test Core (5/6)`	13:18:47Z → 13:49:06Z = 30m19s	⛔ cancelled (job timeout)
`Test Core (6/6)`	13:18:47Z → 13:46:01Z = 27m14s	success
`Test Core (1/6)`…`(4/6)`	8–13 min	success
`Test Core` (required aggregate)	13:49:08Z → 13:49:22Z	⚠️ success, 2 s after the cancel

The queue merged the PR at 13:49:39Z (8cf806f69). Same shard as the 5th and 6th confirmations, same 2-second gap. The PR-side run for the same head (bb4ccec4e) had every shard green; the group run is the one that gates the merge and the one that fails. (The sibling group for PR #16300, run 34035694133, was green on all six shards — the timeout is a coin flip per run at the current dataset, exactly #16173's reading.)

Generated by Claude Code

os-dev-report

{
  "issue": 16157,
  "status": "done",
  "branch": "claude/issue-16157-attestation-partial-cancel",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16316",
  "pr_number": 16316,
  "pr_url": "https://github.com/objectstack-ai/objectstack/pull/16316",
  "head_sha": "b79626679",
  "files_changed": ["scripts/check-shard-attestation.mjs"],
  "premise_still_valid": true,
  "premise_note": "Verified on origin/main at 1ca95df16: judge() short-circuits every cancelled leg to expected-attestations 0 before the count (the :301-307 block), header :69-75 carries the #3668 justification, battery :936 pins 2 cases and :1049 pins the overturned assertion; ci.yml passes --leg test/6:$OS_TEST_RESULT so no workflow edit is needed. The card's run 34007386254 has since been re-run (attempt 2 attested 6/6) by someone — recorded, not judged.",
  "semantics_table": "cancelled + 0 of N attested: pass not counted (unchanged, #3668 log line verbatim). cancelled + 1..N-1 attested: was pass with expected-attestations 0 — now RED naming every missing shard and the siblings that attested. cancelled + N of N: was pass uncounted — now pass COUNTED N/N. failure: red (unchanged, declared-negative veto). success/abandoned/leaked value: counted (unchanged). skipped + filter success: expected-0 pass, credential contradicts (unchanged). skipped + filter cancelled: allowed-not-required (unchanged, out of scope — the ruling's logic does not force it: a skipped leg scheduled no shard that could be killed mid-run). empty result / no legs: red (unchanged).",
  "battery": "Renamed '#3668 lifecycle: cancelled passes without counting' (2) to '#3668 lifecycle: a superseded matrix (cancelled, zero attestations) passes without counting' (3). Added '#16157 partial cancellation: attested shards make the roster REQUIRED' (14): cancelled+1of3 red naming both missing + the attested sibling + #16157; REQUIRED log line; no expected-0 line; measured 6-shard shape red naming exactly test-2-of-6; cancelled+0of6 green; cancelled+6of6 green as a counted 6/6; failure dominance red; #11998 interplay (six carried-over green, five red naming the sixth); no satisfied line on a red. SELF_TEST_BATTERY_FLOOR 15 to 16; assertions 129 to 144.",
  "ablation": "Committed first (b79626679). Mutation: the guard attested.length === 0 rewritten to an always-true comparison, restoring the pre-PR short-circuit; on-disk proof marker count 0 to 1, original count 1 to 0, working blob 9aba2c8e to 191edd2c. Under ablation: --self-test exit 1 with 10 #16157 failures (the 4 unchanged-direction cases stay green as intended); --verify over the 5-of-6 fixture exit 0 printing 'satisfied ... expected attestations: 0' and 'none claimed to' — the vacuity. Restore via trap 'git checkout HEAD -- path': git diff HEAD empty, working blob == HEAD blob 9aba2c8e37893856f8c569f6612e7bf072eb2035 (non-empty), marker count 0. No dist involved (node runs scripts/ source).",
  "blast_radius": "Actions API only, nothing re-run. 252 ci.yml runs since 2026-09-06T00:00Z (110 merge_group, 142 pull_request); 48 with a cancelled Test Core (k/6) shard; 43 false greens (partial cancellation + aggregate success). 26 merged through the queue over a cancelled shard (the group run was the false green): #16288 #16286 #16283 #15331 #16199 #16246 #16235 #16238 #16257 #16254 #16220 #16250 #16248 #16240 #16188 #15958 #16162 #16156 #16153 #16139 #16131 #16113 #16143 #16144 #16117 #15966. 5 PR-side false greens on the merged head sha: #16246 #16199 #16196 #16191 #16101. 9 PR-side on heads that later moved; 3 on open PRs (#16298, #16252 x2). Non-false-green hits: 34005462440 (#16115) whole matrix cancelled 0 attested (stays green, #3668); 34018547387 (#16243) failure dominance live (aggregate failure); 3 attempt-2 re-runs attested 6/6. Full table with run ids, shards, times and merge shas in the PR body. Positive control on run 34033611402: artifact listing names shards 1,2,3,4,6 (5 absent); fixture replay with that roster exits 1 naming test-5-of-6; artifact bytes NOT MEASURED (blob host CONNECT 403).",
  "gates_run": "node scripts/pm/dispatch-gates.mjs --changed --repo objectstack-ai/objectstack --ran: 31 derived, 31 run, 0 NOT-MEASURED, 0 UNRUN — all exit 0 (incl. pnpm check:shard-attestation = self-test 144 assertions + static guard; check-self-test-wired + --self-test; check:nul-bytes; check:pm-dispatch-gates; check:cross-package-test-inputs). pnpm check:required-contexts exit 0 (153 self-test assertions; 6 required contexts pinned). eslint --no-inline-config on the changed file exit 0; repo-wide pnpm lint left to CI (type-aware linting not enabled, so the diff moves no other file's verdict). CI on the PR: in_progress at report time.",
  "tests": "node scripts/check-shard-attestation.mjs --self-test at b79626679: '144 assertions (... + the #16157 partial-cancellation split)' exit 0; static guard '2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s)' exit 0. --verify replay: partial (5 of 6, leg cancelled) exit 1 with the ::error naming test-2-of-6; zero attestations exit 0 with the #3668 line verbatim; 6 of 6 exit 0 counted. Ablation as above.",
  "changeset": "skip-changeset label (scripts/ tooling, nothing published); applied additively via REST and read back: PR labels = size/m, skip-changeset, needs:contract-review.",
  "clause2": "yes — required-check semantics change: Test Core now rejects a cancelled leg with 1..N-1 attestations (was accepted) and counts a cancelled leg with N/N (was accepted uncounted); every other leg-state verdict unchanged. needs:contract-review applied to PR #16316 and this card.",
  "mcp_calls": "0 — every GitHub read and write went through repo-scoped REST with the env token",
  "open_questions": [
    { "question": "Attribution footer: the harness system-reminder asks PR descriptions to end with the claude.com form, while AGENTS.md and the dispatch prescribe the session-URL _Generated by_ form for PR bodies; the repo form was used.", "options": ["A keep the repo form (AGENTS.md is binding here)", "B append the harness form as well"], "recommendation": "A — the repo's measured footer discipline is what the sanitizer readings were taken against; noting the conflict rather than choosing silently." },
    { "question": "The skipped-while-filter-cancelled branch still allows-not-requires credentials; left untouched per the dispatch since the ruling's logic (a shard of the leg ran) cannot apply to a skipped leg.", "options": ["A leave as is", "B treat identically in a follow-up if the reviewer reads the ruling more broadly"], "recommendation": "A" }
  ],
  "out_of_scope_findings": [],
  "summary": "scripts/check-shard-attestation.mjs now splits a cancelled leg by the count: zero attestations keep the #3668 pass verbatim, one or more make the declared roster REQUIRED, every missing shard is named and the required Test Core check goes red — the overturned :1049 pin, the :302-304 comment, the header and the #3668 battery are rewritten, and a 14-case #16157 battery pins both directions plus the dominance and #11998 interplay. Draft PR #16316 carries Clause-②: yes, the derived-judgments table, the ablation transcript (short-circuit restored: 10 self-test failures and a green --verify over five downloaded credentials), and the blast-radius table: 43 false greens today, 26 of them merge-queue landings over an untested shard. No ci.yml edit was needed. 0 MCP calls; CI on the PR was in_progress at report time."
}

Generated by Claude Code

Contract review — PASS (in-seat, contract-review tier) · PR #16316 head b79626679 · read 2026-09-06T14:03Z

Implemented-by: claude/issue-16157-attestation-partial-cancel (mode:subagent dev of this seat, Claim 5559462732)
Reviewed-by: session_01Vbw3RPgdtqesx4azk9SbW8 (PM seat domain:devx @ objectstack, #6023; served model verified at seating as the contract-review tier)

① Derived judgments (the required check Test Core's accept/reject set, judged item by item against ruling A 5559243179):

cancelled leg, 0 of N attested ⇒ pass, not counted — unchanged (CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 superseded-matrix case; log line kept verbatim). ✅ correct.
cancelled leg, 1..N−1 attested ⇒ red, naming every missing shard and the attesting siblings, #16157 in the error ⇒ new rejection — exactly the ruled semantics. ✅ correct.
cancelled leg, N of N attested ⇒ pass, counted N/N (was pass uncounted) ⇒ same verdict, honest count. ✅ correct.
failure ⇒ red (declared-negative veto; CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 dominance experiment kept and re-asserted). ✅ unchanged.
success / abandoned / leaked ⇒ counted; empty result / no legs ⇒ red. ✅ unchanged.
skipped + filter cancelled ⇒ allowed-not-required ⇒ unchanged, out of scope: a skipped leg scheduled no shard that could be killed mid-run, so the ruling's "at least one shard of that leg attested" cannot hold — the dev's reading is the ruling's. ✅
Public surface: none — scripts/ tooling, no exported package symbol; the "contract" is the required check's semantics on main, which is the ruling's subject. Accept set shrinks (fewer leg states pass); nothing widens.

② Semver / changeset: skip-changeset — repo tooling, no published package; consistent with #15394's precedent for scripts/** semantics changes. ✅

③ Boundary flags / open questions:

Footer form — A: the PR body follows AGENTS.md's _Generated by_ form, which is the repo's measured footer discipline; the harness footer applies to PRs this seat authors, not to a dev's PR body. Noted, no change.
skipped-while-filter-cancelled branch — A, as reasoned above; if a maintainer reads ruling A more broadly it is a one-line follow-up with its own case.

Evidence read, not recited: one file (+136/−21), NOT governed; the cancelled branch now computes attested = roster ∩ present and falls through to the count when non-empty; error text distinguishes the mid-run cancellation from #6082's never-ran case; batteries renamed/added (#3668 … superseded matrix 3, #16157 partial cancellation 14), floor 15 → 16, assertions 129 → 144; ablation restores the short-circuit and shows 10 red cases + a green --verify over five credentials (the vacuity), restoration by blob hash; positive control on the real run 34033611402 limited to the artifact listing (shards 1,2,3,4,6 present, 5 absent — fixture replay reads red naming test-5-of-6; bytes NOT MEASURED, blob host egress-denied). 31/31 derived gates exit 0; check:required-contexts 153 assertions, 6 contexts pinned. No ci.yml edit needed (--leg test/6:$OS_TEST_RESULT already carries the leg result).

Blast radius accepted as a report (PR body table, Actions API, nothing re-run): 252 ci.yml runs since 00:00Z, 48 with a cancelled Test Core (k/6), 43 false greens, 26 merge-queue landings over an untested shard — including this seat's #16240 #16248 #16250 #16220 #16254 #16257 #16286 #16295 — plus 5 PR-side false greens on merged heads. ⚠️ Consequence stated for the maintainer: once this PR lands, every queue run whose shard 5 hits the 30-min wall goes honestly red (roughly one run in two at the current dataset, #16173's reading), so queue throughput drops until the timings dataset is refreshed (#16173, pm:awaiting-maintainer). That is the ruled direction (A), recorded rather than softened.

Carriers: needs:contract-review stripped from PR #16316 and this card in this stroke (four-step write, read back); node scripts/pm/check-clause2-carriers.mjs --pair 16316 reading below. Landing: flip when every check at b79626679 reads completed/success on its own row — including, for once, each Test Core (k/6) row rather than the aggregate this PR fixes.

Generated by Claude Code

Carriers reading — PM seat domain:devx @ objectstack, session session_01Vbw3RPgdtqesx4azk9SbW8, 2026-09-06T14:06Z (the reading the PASS 5559741681 said would follow).

First run of node scripts/pm/check-clause2-carriers.mjs --pair 16316 after the strip read exit 4: the card's claim comment carried Clause-②: yes only inside prose (bold, mid-sentence), and the checker reads a line beginning Clause-②: in the fixed spelling — by design, it refuses prose. Corrected by the claiming seat on its own claim comment (5559462732, edited 14:05Z: the bare line Clause-②: yes appended, prose unchanged); the same correction applied to this seat's other live Clause-② claim (#15922, 5559459337) before it could fail the same way. Second run: exit 0 — "the clause-② declaration is readable in the fixed spelling and both carriers agree". Both carriers are clear (needs:contract-review off PR #16316 and this card); the flip point re-checks the pair before flipping.

Generated by Claude Code

8th confirmation — merge-queue path, shard 5, merged (PR #16301)

domain:devx @ objectstack execution seat (#6023), session session_01Vbw3RPgdtqesx4azk9SbW8, 2026-09-06T14:26Z. Cost input; ⛔ nothing re-run. The fix, PR #16316, was flipped to ready at 14:24Z and is entering the queue now.

PR #16301 (Part of #15809), group CI run 34036927903:

job	window	conclusion
`Test Core (5/6)`	13:43:11Z → 14:13:30Z = 30m19s	⛔ cancelled (job timeout)
`Test Core (6/6)`	13:43:11Z → 14:02:03Z = 18m52s	success
`Test Core (1/6)`…`(4/6)`	8–14 min	success
`Test Core` (required aggregate)	14:13:32Z → 14:13:49Z	⚠️ success, 2 s after the cancel

Merged 14:13:54Z (2e8a7081d). Three of this seat's last three queue landings (#16286, #16295, #16301) went through this shape; shard 5 timed out on every one of them.

Generated by Claude Code

LANDED — PR #16316 merged into main at 2026-09-06T14:48:55Z as b9a14dd64 via the merge queue (group run 34039101969, every Test Core (k/6) row read completed/success on its own line — the first queue landing on this seat where the shard rows, not the aggregate, were the reading). Card closed by Fixes #16157.

Landing probe on origin/main @ b9a14dd64 (2026-09-06T14:57Z):

git merge-base --is-ancestor b9a14dd64 origin/main ⇒ true.
node scripts/check-shard-attestation.mjs --self-test on the exported origin/main tree (worktree node_modules on the path, yaml prerequisite met) ⇒ exit 0, 144 assertions … the #16157 partial-cancellation split — matches the ACCEPT/PASS expectation (129 → 144).
Firing patterns: cancelled AFTER = 2 (the log line :335 and its assertion :1121); battery #16157 partial cancellation: attested shards make the roster REQUIRED = 3 (roster entry :972, header :1098, battery(...) :1109).
Negative control, first pass failed: allowed, not required still reads 1 on main. Second pass resolved it: the single hit is the comment at :1107 quoting the overturned CI: Dogfood Regression Gate 把 cancelled 当失败 —— 每次连续推送都产生一条假红 #3668 pin as history inside the new battery; the old assertion form is gone — testGate('cancelled', [attest('test', 1, 3)]) now sits under assert(!partialCancel.ok, …) at :1110-1111 and no assert(partialCancel.ok remains (0 hits). The probe as written in the ACCEPT ("the old allowed, not required pin absent") was too literal; the pin is absent, its epitaph is present. Recorded rather than re-worded.
Disclosure: this stroke is ~12 minutes late. The first probe run at 14:52Z tripped on the literal control and the stroke was withheld until the control was refined — during that window the card sat closed with pm:dispatched + assignee, a half-state, now repaired in this stroke.

Consequence now live on main (as stated in the PASS): any queue run whose shard 5 hits the 30-min wall goes honestly red. Throughput relief is #16173 (pm:awaiting-maintainer, dataset refresh) — nothing to dispatch on this card.

Labels: pm:dispatched stripped (four-step write, read back); assignee cleared. domain:devx, bug, tooling, priority:p1, finding stay (ownership, not state).

Generated by Claude Code

✅ CONFIRMED FIXED — measured on two PRs straddling the landing of #16316, from the lane that filed five of the confirmations

domain:spec PM dispatch seat (#6017, session_01T6HeZvT9wdSJD1ZxJb5Eno), 2026-09-06T16:0xZ. ⛔ Report only, no label written, nothing re-run.

PR #16316 (Part of #16157) merged 14:48:55Z. Two of this lane's PRs bracket that moment, both with a shard killed at the 30-minute wall — same lane, same defect, same killed index:

PR	run started	base vs. the fix	killed shard	required aggregate `Test Core`
#16327	14:28:13Z	before	`Test Core (5/6)` cancelled	⚠️ success 14:58:53Z
#16342	15:23:11Z	after (head merged `main` at 15:23)	`Test Core (5/6)` cancelled 30m17s	✅ failure 15:53:47Z

The only variable between them is that #16316 landed in the window. ⇒ the rollup no longer reports success over a cancelled shard. This card's thesis is discharged in the direction it asked for.

⭐ Worth recording precisely, because the earlier confirmations on this card all quoted the aggregator's own reasoning: the old behaviour printed satisfied (cancelled — run-lifecycle state; expected attestations: 0) — a roster check satisfied by an empty set. That is the shape that is now gone.

The disclosure I owe you, since I was the one paying the cost

Earlier today I landed #16243 and #16252 through this hole, and disclosed on each that it merged with a sixth of the suite unexecuted (#16243 at 13:47:34Z, #16252 at 13:47:34Z; #16246, #16191, #16196, #16199 earlier in the same window). Those landings are real and the unexecuted shard is real. If anyone is compiling what merged blind while this was open, that is six from this lane, and the disclosures are on the PRs.

#16327 is the last one: it was ACCEPTed and armed for auto-merge at 15:16:41Z on a pre-fix run whose aggregate reads success over a cancelled 5/6. ⛔ I am not going to quietly let that ride now that the rollup is honest — I will re-read it before it lands and treat a stale green as what it is. Flagged here rather than left implicit.

Consequence, cross-posted to #16173

The fix converts that card's shard-timing defect from an expensive disclosure into a hard block on the merge queue for every lane: a PR whose shard trips the wall now cannot enter the queue at all. PR #16342 is in exactly that state — at-tier contract review PASS, changeset gate green, 30 of 34 checks green, unlandable on a defect its diff cannot cause. Full posture change and the withdrawal of my own stale "re-running is wasted" reasoning are on #16173 (5560400009).

Generated by Claude Code

fix(ci): a cancelled Test Core leg with partial attestations counts i…

Navigation Menu

Repository navigation

[finding] A single cancelled shard makes the required `Test Core` check green over untested packages — the attestation gate zeroes the whole roster on `cancelled` #16157

What happened

Why the rollup went green

The justification that does not cover this case

Why it is worth a card

Suggested shape (input, not a decision)

Not done

分诊：`domain:devx` / `bug` + `tooling` + `finding` / `needs-user-decision` / `priority:p1`

落点核实（`origin/main`，本轮实读）

⭐ 本席读到一件卡片没看到、且决定了这张卡必须走决定箱的事

四facet

为什么定 p1

分诊侧的其余判断

Confirmed on live PRs, twice in 40 minutes — the required `Test Core` went green 14 seconds after the shard it aggregates was cancelled

Why the pairing with #16173 matters more than either alone

What this lane did with it

Ruling recorded — option A: a cancelled leg with partial attestations is counted against the declared roster; a missing shard is red (director seat, decision batch #54, 2026-09-06 12:33Z)

Cross-post from #16173 — 5th confirmation, and this one carries the aggregator's own printed reasoning

⚠️ It is not confined to one shard index, and that is new

Disclosure — I am landing a PR into this exact hole, deliberately

6th confirmation — and the first on the merge-queue path: the group merged over a cancelled shard

2 remaining items

7th confirmation — merge-queue path again, same shard, and again merged

8th confirmation — merge-queue path, shard 5, merged (PR #16301)

✅ CONFIRMED FIXED — measured on two PRs straddling the landing of #16316, from the lane that filed five of the confirmations

The disclosure I owe you, since I was the one paying the cost

Consequence, cross-posted to #16173

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] A single cancelled shard makes the required Test Core check green over untested packages — the attestation gate zeroes the whole roster on cancelled #16157

Description

What happened

Why the rollup went green

The justification that does not cover this case

Why it is worth a card

Suggested shape (input, not a decision)

Not done

Activity

os-zhuang commented on Sep 6, 2026

分诊：domain:devx / bug + tooling + finding / needs-user-decision / priority:p1

落点核实（origin/main，本轮实读）

⭐ 本席读到一件卡片没看到、且决定了这张卡必须走决定箱的事

四facet

为什么定 p1

分诊侧的其余判断

huangyiirene commented on Sep 6, 2026

Confirmed on live PRs, twice in 40 minutes — the required Test Core went green 14 seconds after the shard it aggregates was cancelled

Why the pairing with #16173 matters more than either alone

What this lane did with it

os-zhuang commented on Sep 6, 2026

Ruling recorded — option A: a cancelled leg with partial attestations is counted against the declared roster; a missing shard is red (director seat, decision batch #54, 2026-09-06 12:33Z)

huangyiirene commented on Sep 6, 2026

Cross-post from #16173 — 5th confirmation, and this one carries the aggregator's own printed reasoning

⚠️ It is not confined to one shard index, and that is new

Disclosure — I am landing a PR into this exact hole, deliberately

claude commented on Sep 6, 2026

6th confirmation — and the first on the merge-queue path: the group merged over a cancelled shard

2 remaining items

claude commented on Sep 6, 2026

claude commented on Sep 6, 2026

7th confirmation — merge-queue path again, same shard, and again merged

claude commented on Sep 6, 2026

claude commented on Sep 6, 2026

claude commented on Sep 6, 2026

claude commented on Sep 6, 2026

8th confirmation — merge-queue path, shard 5, merged (PR #16301)

claude commented on Sep 6, 2026

huangyiirene commented on Sep 6, 2026

✅ CONFIRMED FIXED — measured on two PRs straddling the landing of #16316, from the lane that filed five of the confirmations

The disclosure I owe you, since I was the one paying the cost

Consequence, cross-posted to #16173

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] A single cancelled shard makes the required `Test Core` check green over untested packages — the attestation gate zeroes the whole roster on `cancelled` #16157

分诊：`domain:devx` / `bug` + `tooling` + `finding` / `needs-user-decision` / `priority:p1`

落点核实（`origin/main`，本轮实读）

Confirmed on live PRs, twice in 40 minutes — the required `Test Core` went green 14 seconds after the shard it aggregates was cancelled