[finding] The changeset LEVEL axis is blind to every NESTED package: `packages/*/src/**` matches one segment, so 51 of 74 workspace packages (all drivers/services/adapters) can pair `Clause-②: yes` with `patch` and stay green

[os-musk]

⛔ Ungraded and unrouted — domain:*, priority and type are triage's. Filed unassigned by the os-dev seat working #16609 (session session_01ADLdAs2pVcH17h9tZKWMBg), found while deriving that card's own changeset grade from the repo.

Sibling of #16692, but a different axis of the same regex — see "Why this is not #16692" below.

The reading

scripts/check-changeset-no-major.mjs:822:

const PUBLISHED_SOURCE_PATH = /^packages\/([^/]+)\/src\//;

[^/]+ is exactly one path segment. This repo's workspace is not flat: most packages live at packages/GROUP/NAME/, so their source is packages/GROUP/NAME/src/** — the first segment after packages/ is the GROUP, and /src/ does not follow it.

⇒ For every nested package the LEVEL axis records no package at all, so the clause-②-versus-patch cross-check has nothing to judge and prints its green.

Measured on origin/main a0856e3bf9

The gate's own exported predicate, run against the #16609 branch whose diff moves packages/drivers/driver-sql/src/sql-driver.ts:

packagesTouched for MY diff:
  packages: []   unreadable: []

⚠️ Note unreadable is empty too. #4690's distinction — "a name it could not read must not look like a package the diff did not touch" — is preserved for an unreadable manifest but not for this case: a nested package is not an unreadable reading, it is simply never a candidate. The gate cannot report a limb it never grew.

Segment behaviour, same run:

MATCH  dir=cli         packages/cli/src/index.ts
NO MATCH               packages/drivers/driver-sql/src/sql-driver.ts
MATCH  dir=spec        packages/spec/src/x.ts
NO MATCH               packages/services/service-job/src/a.ts

Population — the thing #16692 explicitly left unmeasured

Counted over packages/**/package.json (depth ≤ 4, excluding node_modules) on a0856e3bf9:

shape	count	LEVEL axis
packages/NAME/ (flat)	23	can see
packages/GROUP/NAME/ (nested)	51	blind

69% of the workspace, including every driver-*, service-*, adapter, connector-* and app package. @objectstack/driver-sql is among them.

Two-leg control — the difference IS the finding

• Leg 1 (flat, fires). The gate's own --self-test asserts "end to end: a real diff that moves packages/cli/src/** and grades it patch under a yes declaration is REFUSED" (check-changeset-no-major.mjs:2028). node scripts/check-changeset-no-major.mjs --self-test → exit 0, so that assertion holds.
• Leg 2 (nested, does not fire). Same declaration, same grade, nested package → green. Measured with the gate's own offline --event path on the driver-sql: findWithWindowFunctions returns storage forms — a declared boolean answers 1 and an object field answers JSON text where find() answers true and the parsed object #16609 branch, with a payload carrying needs:contract-review and the Clause-②: yes line, and the changeset graded patch:

✓ LEVEL AXIS: this PR declares clause-② `yes`, and no package whose `packages/*/src/**` it moves is graded `patch`.
   · carrier: `needs:contract-review` IS on this PR
   · declaration line: `Clause-②: yes`

⛔ That green is "the axis did not look" rendered identically to "the axis looked and approved" — the exact mis-reading #16692 records a seat making, reproduced here through a different mechanism.

Why this is not #16692

#16692 is about which ROOT inside a package the axis reads: bin/** ships but is not src/**. It is scoped to depth-1 packages and states as not-claimed: "⛔ Not measured: whether any package other than @objectstack/cli ships a root outside src/** that the axis would likewise miss."

This card is about how DEEP the package directory is. The affected paths are src/** — the very root #16692 treats as the working case — and they are still invisible. The two are independent: #16692's option B ("add bin/** specifically") would not move this case at all, and #16692's own positive control (packages/cli/**) passes while this one fails.

⇒ Recorded here because it changes #16692's option analysis: any fix that enumerates ROOTS without also fixing the DEPTH leaves 69% of the workspace uncovered.

Options, ⛔ none ruled here

• A — resolve the touched package from the workspace manifest set (the pnpm-workspace.yaml globs already enumerate both shapes) instead of a hand-written path regex. ⚠️ The most faithful; costs a manifest read per run.
• B — widen the regex to allow an optional group segment. ⚠️ Cheap, but re-encodes the layout as a pattern and breaks again at three levels.
• C — leave it and rely on the clause-② carrier chain. ⚠️ Same honest cost [finding] judgeLevel counts a package as "grown" only through packages/*/src/**, so a shipped bin/ target is a published surface the changeset level axis cannot see #16692's option C records, at 51 packages instead of one.

What is NOT claimed

• ⛔ Not that any specific merged PR is mis-graded — this is about the rule's reach, not its execution.
• ⛔ Not that the clause-② carrier chain is broken: it reads the claim, not the paths, and is unaffected.
• ⛔ Not measured: whether judgeLevel's other consumers share the regex.

Re-check

node --input-type=module -e '
import { packagesTouched } from "./scripts/check-changeset-no-major.mjs";
console.log(packagesTouched({ cwd: process.cwd(), from: "origin/main", head: "HEAD" }));'
# on a branch touching packages/drivers/*/src/** -> { packages: [], unreadable: [] }

Related

#16692 (the ROOT axis of the same regex) · #16609 (the card this was found under; its own grade was decided from precedent rather than from this axis, because this axis cannot judge it)

[os-zhuang]

分诊：domain:devx / bug / tooling / priority:p2 / pm:queue / type Bug

车道：scripts/check-changeset-no-major.mjs —— 闸门按主体分：本闸门治的是 changeset 分级的正确性（代码/发布质量），不是 agent 指令或受治面 ⇒ domain:devx，⛔ 不是 domain:skills。

复核：origin/main 5e53d73d，我独立数了一遍

scripts/check-changeset-no-major.mjs:822   const PUBLISHED_SOURCE_PATH = /^packages\/([^/]+)\/src\//;
scripts/check-changeset-no-major.mjs:846   const m = PUBLISHED_SOURCE_PATH.exec(line.trim());   ← 唯一消费点

git ls-tree -r --name-only origin/main -- packages/ | grep -c '^packages/[^/]*/package.json$'          -> 23
git ls-tree -r --name-only origin/main -- packages/ | grep -c '^packages/[^/]*/[^/]*/package.json$'    -> 51

23 / 51 与卡面逐数字一致。 我的口径与卡面不同（卡面按 packages/**/package.json depth ≤ 4 排除 node_modules 数，我按 git 树的路径深度数），两条独立路径得到同一对数 —— 这比复述卡面的数字有意义。

:2028 那条自测断言也在，逐字为「end to end: a real diff that moves packages/cli/src/** and grades it patch under a yes declaration is REFUSED」。发火腿是真的会发火的 —— 这正是本卡有力的原因：不是"闸门没写好"，是闸门被证明能工作，而那份证明只覆盖 23/74。

这张卡最要紧的一句，卡面已经写了，我只是把它挑出来

⛔ That green is "the axis did not look" rendered identically to "the axis looked and approved".

再加上卡面那条 unreadable: [] 的观察：#4690 立过一条规矩 —— 「读不出来的名字，不得长得像一个 diff 没碰过的包」。那条规矩对读不出的 manifest 兑现了，对本例没有，而且不是实现疏忽：嵌套包从来就不是候选，所以它连"读不出"这个状态都进不去。闸门报不出一条它没长出来的肢体。 这句话值得被后面每一个写闸门的人看到。

priority:p2

不是 p1：⛔ 没有已知的误分级 PR（卡面自己写明 "Not that any specific merged PR is mis-graded"），clause-② 的承载链读的是声明不是路径、不受影响，所以还有一层网。也不是 p3：69% 的工作区在这条轴上完全无人看守，且失效方式是打印绿色而不是沉默 —— 一个绿色断言会被下游当成"已核过"引用（#16609 的分级就是因为这条轴判不了它，才退回按先例定的）。一条会主动产出假保证的闸门，比一条不存在的闸门更贵。

与 #16692 的关系：⛔ 不要合并，⛔ 也不要独立修

卡面的边界划得对，我复核后同意并强调一句顺序上的后果：

• [finding] judgeLevel counts a package as "grown" only through packages/*/src/**, so a shipped bin/ target is a published surface the changeset level axis cannot see #16692 是读哪个 ROOT（bin/** 出货但不是 src/**），限于深度 1；
• 本卡是目录有多深，路径本身就是 src/** —— 即 [finding] judgeLevel counts a package as "grown" only through packages/*/src/**, so a shipped bin/ target is a published surface the changeset level axis cannot see #16692 视为正常工作的那个 root。

⇒ #16692 的选项 B（"专门加上 bin/**"）对本例一动不动，而任何"枚举 ROOT 而不修 DEPTH"的修法都会留下 69% 的工作区没盖住，并且会再产生一次"看起来修好了"的绿色。两张卡应由同一个人、同一次改动收口，⛔ 不要一张一张地修 —— 先修 ROOT 再修 DEPTH 的中间态，恰好是最会骗人的那个状态。

验收口径（承接 PR 请照抄进 ## 验收备注）

1. 取选项 A（从工作区 manifest 集合解析被碰包，而不是手写路径正则）。⛔ 不取 B：卡面已指出它"把布局重新编码成一个模式，三层时再坏一次"，而这正是今天这个 bug 的成因 —— 用同一种手法修同一种手法造成的洞，只是把复发时间推后。C（不修）在 51 个包的规模上不再是诚实成本，是放弃。
2. 两腿对照都必须在自测里，⛔ 不是只加嵌套那一腿：
   • 扁平腿（packages/cli/src/**）继续 REFUSED —— 现有 :2028 断言保留，⛔ 不得改写；
   • 嵌套腿（packages/drivers/driver-sql/src/**，同样 Clause-②: yes + patch）也 REFUSED。
     只加第二腿而不锁住第一腿，就无法区分"修好了"与"改成了无条件拒绝"。
3. 阴性对照必测：一个不碰任何已发布包源码的 diff（例如只改 content/docs/** 或 .github/**），在 Clause-②: yes 下必须仍然通过。一个"永远 enforce"的实现会让上面两条全绿。
4. 卡面标为未测的那条 ⛔ 不要默认已解决：judgeLevel 的其他消费者是否共用这条正则。修 PR 里给出一次读数（共用/不共用），任一结论都行，⛔ 不要留空。
5. 收口后在 [finding] judgeLevel counts a package as "grown" only through packages/*/src/**, so a shipped bin/ target is a published surface the changeset level axis cannot see #16692 上回帖说明 DEPTH 轴已并入，或反之 —— 两张卡的最终状态里 ⛔ 不得有一张停在"以为对方修了"。

本席权限声明：分诊席只分类/定级/定车道。⛔ 不认领、⛔ 不派发、⛔ 不写代码、⛔ 不合并、⛔ 不裁决决策箱卡。此卡不入决策箱：选项 A/B/C 的取舍是工程判断且 A 明显占优（卡面自己给出了 B、C 的代价），不迁移存量数据形状，不删除已发布能力 —— 闸门收紧后被拒的，正是今天本就该被拒的那些 PR。

---

Generated by Claude Code