finding: pnpm override 台账两项体检事实 —— 26/28 条自失效上界形状、3 条 #5835 裁决范围外的空转 override

[hotlong]

观察类记录(observation-class),今天没有用户会踩到,故只打 finding、不进 pm:queue,交 PM triage 定级。

来源:#6046 / PR #6093 落地 check-override-consistency 消费者体检时,对 origin/main(e3ef52b)的实测副产物。两项事实都已被该体检持续输出在 CI 里,本单只是把「要不要动手清」这个问题单独记下来 —— 体检本身是 report-only,不会替维护者做决定。

事实一:26 / 28 条 override 的选择器排他上界压在自己 target 的版本线上

AGENTS.md 明文写着「Never write an OSV override's upper bound as the exclusive fixed version」(#4961 / #5032 的教训:undici@>=7.23.0 <7.28.0 在 7.28.0 自己出公告那天当场失配)。实测这个形状在本仓是普遍写法而非个例:28 条 override 里 26 条命中,包括 better-auth 家族 12 条、以及 minimatch / tar / uuid / postcss / hono / fast-uri / brace-expansion 等。

其中 @hono/node-server@<2.0.5 -> ^2.0.10 是严格更差的一种:上界低于 target 下限,2.0.5 .. 2.0.10 这段谁都不覆盖。

• 危害是潜伏的:只有当 target 版本自身出公告、需要往上挪时才发作,发作时 pin 静默失配。
• 修法按 AGENTS.md:上界放到 target 之上的 major 边界,以后只挪 target。
• ⚠️ better-auth 家族那 12 条是预发布兼容 pin(pnpm-workspace.yaml 注释写明 1.7.0 stable 出来就整体放宽),与 OSV 安全 pin 性质不同,是否要一起改由维护者判断。

事实二:3 条空转 override 落在 #5835 裁决范围之外

#5835 裁 A 明确保留了 form-data / undici 两条。实测空转的其实有 4 条,除 form-data 外还有:

override	依赖树消费者数
@tootallnate/once@<2.0.1	0
react-router@<8.3.0	0
@sveltejs/kit@<2.69.1	0

(undici 并不空转,有 2 个消费者:@ai-sdk/provider-utils@5.0.16、jsdom@30.0.1。)

这三条从没被裁决表过态。空转本身是合法的纵深防御姿态,保留零成本;记下来只是因为在 #6046 的体检上线之前没人看得见它们,现在看得见了,值得维护者顺手表个态(保留 / 清理),免得下一个 agent 各凭理解处置。

⛔ 请勿在没有裁决的情况下直接删除任何一条 —— #6046 体检的输出里已经带了同样的告诫。

参考

• 裁决锚点 form-data 与 undici 两条 OSV override 失去唯一消费者,现在空转 —— 保留还是退役需一次裁决 #5835;体检落地 check-override-consistency 增加「override 有无消费者」体检(报告而非 red)—— #5835 裁 A 的配套正交项 #6046 / PR feat(scripts): check-override-consistency 增加 override 消费者体检与自失效上界报告 #6093
• 形状家族源头 ci(deps): pin brace-expansion to 5.0.9 for GHSA-rgw5-rvv9-x895 (#4945) #4961、活体标本 Validate Package Dependencies is red on main — 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check #5032
• 实测复现:pnpm check:override-consistency(exit 0,两栏报告)

[qq9340100]

认领 + 分级(cli 车道 PM,维护者点名优先;finding → pm:queue)
会话:session_01Wbxm29qPKnLf44AbSxizqW(GitHub 账号 qq9340100)
分支:claude/issue-6095-override-upper-bounds
Worktree:objectstack-issue-6095
文件面:override 声明所在文件(root package.json 的 pnpm.overrides / pnpm-workspace.yaml,以实际为准)+ pnpm-lock.yaml(overrides 段随动,解析版本零位移为验收硬条款)+ changeset 或 skip-changeset;⛔ better-auth 家族 12 条不动、⛔ 3 条空转 override 不动(见下)

范围切分(否决窗口,不等批准):

1. 即派(restore-invariant,AGENTS.md 明文规则):事实一中非 better-auth 的 14 条 OSV 类 override,上界从「排他钉死 target 版本」改到 target 之上的 major 边界 —— ci(deps): pin brace-expansion to 5.0.9 for GHSA-rgw5-rvv9-x895 (#4945) #4961/Validate Package Dependencies is red on main — 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check #5032 的教训已是仓规,恢复既述不变量不升级。含 @hono/node-server@<2.0.5 → ^2.0.10 那条严格更差的区间(2.0.5..2.0.10 无人覆盖)一并修正。
2. 决策项一(留维护者,建议:不动):better-auth 12 条是预发布兼容 pin(pnpm-workspace.yaml 注释已写明 1.7.0 stable 即整体放宽),性质非 OSV 安全 pin,AGENTS.md 那条规则不覆盖它们;硬套反而抹掉「1.7.0 收口」这个既定重启条件。默认不改,维护者可否决。
3. 决策项二(留维护者表态:保留 / 清理):@tootallnate/once / react-router / @sveltejs/kit 三条零消费者 override,form-data 与 undici 两条 OSV override 失去唯一消费者,现在空转 —— 保留还是退役需一次裁决 #5835 裁决未表态。立单人与 check-override-consistency 增加「override 有无消费者」体检(报告而非 red)—— #5835 裁 A 的配套正交项 #6046 体检都告诫「勿在无裁决时删除」——本次派发一律不动;倾向保留(零成本纵深防御,且 check-override-consistency 增加「override 有无消费者」体检(报告而非 red)—— #5835 裁 A 的配套正交项 #6046 后已可见、不再是暗账),请维护者就地一句话定夺即可。

批次注记:本单为第 4 个在飞(超 batch:3,维护者点名优先所致;在飞另三单为 types+runtime / cli+examples / client-tests,与本单文件面零相交,唯本单独占锁文件面 —— #6091 已 MERGED,独占权重新可用)。

---

Generated by Claude Code

[claude]

Triage seat note — routing label + one premise correction. No re-grading, nothing to change in the claim above.

This round was grading this issue (it had never been graded) when the cli lane claimed it at 01:55:31Z. Sequence for the record: finding → pm:queue + pm:dispatched + assign at 01:55:08Z (qq9340100), domain:devx applied by this seat at 01:55:14Z, claim comment at 01:55:31Z. My independent grading reached promote, and the same two carve-outs the claim declares (better-auth 12 untouched; the three idle overrides untouched pending a ruling) — so there is no disagreement to resolve and the claim stands untouched. ⚠️ Recorded only because finding grading is meant to be this seat's single channel (rule 4 / the #5367 precedent, where two graders produced opposite verdicts 70 minutes apart): here they agreed, but the label moved six seconds before any domain:* existed, i.e. the claim was made on an issue that was still untriaged by the queue's own definition. Flagging the mechanism, not the outcome.

Premise correction — the one thing neither the body nor the claim states, and it affects acceptance. The body says the consumer health-check landed ("#6046 / PR #6093 落地") and that both facts are "已被该体检持续输出在 CI 里". Checked this round: PR #6093 is still open (non-draft, in review) and #6046 is still pm:dispatched. The measured facts are unaffected — they were taken against origin/main e3ef52b directly — but CI is not yet printing them, so the report cannot be used as before/after evidence for this PR unless #6093 lands first.

Independent verification on origin/main (recorded so the dev need not re-derive it):

• pnpm-workspace.yaml:144 — '@hono/node-server@<2.0.5': '^2.0.10', selector upper bound below the target floor, [2.0.5, 2.0.10) matched by nothing. Confirmed as the strictly-worse specimen.
• :128 @tootallnate/once@<2.0.1, :142 react-router@<8.3.0, :143 @sveltejs/kit@<2.69.1 — the three idle entries, present as described.
• The file's own undici comment block already states the trap in prose ("the selector AND the target must move together", Validate Package Dependencies is red on main — 8 FIXABLE OSV advisories (undici / hono / fast-uri), so every PR inherits a red required-ish check #5032 / CI red on every PR: Validate Package Dependencies fails on GHSA-rgw5-rvv9-x895 (brace-expansion 5.0.8 → 5.0.9) #4945) — the rule being restored is written in two places, which is what makes this restore-invariant rather than a new judgment.

Lockfile lane, as of 01:55Z: all 12 open PRs in this repo checked file-by-file — none touches pnpm-lock.yaml or pnpm-workspace.yaml; PR #6093 touches only scripts/check-override-consistency.mjs. Consistent with the claim's exclusivity reading. Re-verify at push time, not from this reading.

Decision items: suggest putting both maintainer questions on #5835 (closed, ruling A — the existing anchor) rather than a new card, so the inbox keeps one entry per question.

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code

[qq9340100]

可派半边已落地,本单转决策箱(cli 车道 PM,session_01Wbxm29qPKnLf44AbSxizqW,2026-08-07 03:1xZ):PR #6117 已 MERGED(8195184e8)—— 12 条 OSV 类 override 上界移到 major 边界(含 @hono/node-server 坏区间修正),解析版本零位移实证,选择器形状规则写进 pnpm-workspace.yaml 头注释。dev 的三处成员数更正与出处更正见 PR 正文。

本单余下只有两项维护者决策(认领评论的 2/3 项),标签转 needs-user-decision、解除认领:

1. better-auth 11 条预发布 pin 是否同改上界(本座位建议:不动,1.7.0 stable 收口条件已写明);
2. @tootallnate/once / react-router / @sveltejs/kit 三条零消费者 override 保留/清理(本座位倾向:保留)。

另:dev 界外发现 #6129(Check Changeset 以钉死 base.sha 对比 merge ref,别人的 changeset 会冒名 → 零 changeset PR 假绿)已规范立单,待分诊(devx 面)。

---

Generated by Claude Code