release workflow: publish pushes tags + npm but its version commit never reaches main — twice now (rc.3 c6a52d3, rc.4 a10cbc77); landing the commit must be part of the publish lane

[hotlong]

The recurring defect

Two releases, same shape:

release	publish commit	published	landed on main?	cleanup cost
17.0.0-rc.3 (2026-08-03)	c6a52d3	69 tags + npm ✅	❌ never	#6135 → #6149 (68-file field reconciliation, 4 days later)
17.0.0-rc.4 (2026-08-07 04:17Z)	a10cbc77	69 tags + npm ✅	❌ never	#6169 (merge-back, same day)

The lane that runs changeset version && changeset publish pushes tags (unprotected) and publishes to npm, but the version commit itself never reaches protected main — presumably the bot's direct push is rejected by branch protection and the failure is swallowed. Verify against the run logs around 2026-08-07T04:17:39Z.

Left unfixed, every publish poisons the next one: main keeps stale versions, changeset-release/main recomputes an npm-occupied version, and someone hand-reconciles after the fact. The compiled CHANGELOGs and pre.json bookkeeping live only on orphaned commits until then.

Second defect in the same lane: it bypasses the release gates

check:objectui-pin-fresh is required on the Version Packages PR (#4935) precisely so a release cannot ship with a stale console pin (#3340, after v16 silently lost 4 frontend changes). The 04:17Z run did not go through #4935, so the gate never ran — and rc.4 shipped .objectui-sha = f995a452, dropping the 7-changeset objectui window (#6159) from the release record. A gate that is required on a PR the lane can skip is not a gate.

Options

1. Publish lane lands its own commit: instead of pushing main, push a branch + auto-open a PR (auto-merge via the queue). Mechanical, keeps the dispatch lane usable.
2. Forbid the bypass: publishing happens ONLY via merging the Version Packages PR (chore: version packages (rc) #4935 flow) — where the required checks (changeset gate, objectui-pin-freshness) actually run. The dispatch/manual lane, if kept at all, refuses to publish when its base ≠ current main or when the freshness gate would fail.
3. Both (2 as policy, 1 as the belt for whatever lane remains).

Recommendation: (3). The maintainer picks; whichever option, the invariant is: a publish that does not land its bookkeeping commit is a lie to the next release.

Related

#6169 (rc.4 instance, merge-back) · #6135 / #6149 (rc.3 instance) · #3340 (freshness gate) · #6121 (freshness workflow required-set observation) · #6162 (pin-watch mechanical output — closes the "nobody files the bump" half; this issue closes the "the lane can skip the gate" half)

[hotlong]

Root cause CONFIRMED — and it corrects this issue's original hypothesis

The body's hypothesis ("branch protection rejects the bot's push and the failure is swallowed") is wrong. Posting the correction here, where the wrong diagnosis was published. The measured mechanism, platform-stamped by run 31146224227 (event push, actor github-merge-queue[bot] — no human, no dispatch anywhere):

1. release.yml triggers on: push: branches: [main] — every merge-queue landing starts a Release run. This run was the landing of fix(cli): dev watcher 重建后不再无声——重建成功后自动重启 serve 子进程(默认开,--no-restart 可退) (#5148) #6150 (36fc938).
2. Step "Create Release Pull Request or Publish to npm" (changesets/action, 04:15:38–04:17:43Z): pending changesets → version-PR path → created version commit a10cbc77 (04:17:39Z, exact match with all 69 tags' target) and force-pushed changeset-release/main (chore: version packages (rc) #4935 updated_at 04:17:46Z). It leaves the workspace on the freshly versioned tree.
3. Step "Ensure this version actually shipped" (recover-publish, 04:17:43–04:25:35Z — ~8 minutes of real work, not a probe): read packages/cli/package.json from that workspace → 17.0.0-rc.4 → npm view → absent → its repair branch ("versioned in this repo but absent from npm — publishing it now") ran pnpm run release: 69 packages to npm, atomic tag push at a10cbc77, then GitHub Releases + ADR-0087 D4 attachment, and the Docker job pushed the rc.4 runtime image (04:27–04:31Z). The release is fully out.

The step documents itself as "a no-op on the normal path, where main's version IS the last released one" — the flaw: after the action's version pass the workspace is no longer main's state, so the step always reads the next version, which is always absent from npm. Its legitimate repair cases (#4898 empty-changeset no-publish, #4900 published-then-died) are "main's own version incomplete" — never the next one. This one mechanism explains all three observations:

• 2026-08-03: main rc.2 → computed rc.3 → absent → published rc.3 (c6a52d3, the 发版状态对账:main 的 fixed 组版本(rc.2)落后 npm 已发布的 rc.3 —— 版本 PR 因此计算出已占用的版本号,直合会静默丢失一次发布 #6135 incident);
• 08-03 → 08-07: computed rc.3 → present → quiet for 4 days;
• 2026-08-07 04:17Z: chore(release): 发版状态对账 —— main 版本对齐 2026-08-03 已发布的 17.0.0-rc.3 #6149 aligned main to rc.3 → computed rc.4 → absent → published rc.4 (a10cbc77).

Maintainer ruling (2026-08-07, verbatim)

刚才我也没提出要求,是哪个ai自己替我发了 rc.4,版本发布必须是人工的。这个要写入规范。

Answer to the "which AI" half, for the record: no session or seat clicked anything — the lane is fully automatic; both publishes were fired by ordinary merge-queue pushes. The ruling stands regardless and is now codified: pm-dispatch SKILL Guardrails gains "版本发布必须人工" (all AI seats ⛔ publish actions: changeset publish/pnpm run release, version tags, dispatching release workflows, merging Version Packages PRs; unauthorized publish traces are incident-filed, never "repaired" by a counter-publish) — lands via PR #6164.

Fix requirements (supersede the body's option list)

1. Immediate containment (maintainer, one click): disable the Release workflow (Actions → Release → ⋯ → Disable workflow) until this issue's fix lands. ⚠️ Without it, release: 17.0.0-rc.4 published from a10cbc77 but the version commit never landed on main — 2026-08-03 shape repeated; merge it back before ANY further release action #6169's merge-back auto-mints rc.5: main at rc.4 → next push → computed rc.5 → absent → recover-publish fires again.
2. recover-publish must never see a version main does not carry: reset the workspace to github.sha (or read the version from origin/main) before probing. Its two legitimate repair cases remain fully covered.
3. Human gate on every publish path: put the publishing steps behind a GitHub Environment (e.g. release) with required reviewers, so every actual publish waits for a human approval click — the mechanical half of the ruling.
4. The gates the lane bypassed (check:objectui-pin-fresh et al.) must sit on the publish path itself, not only on chore: version packages (rc) #4935.

---

Generated by Claude Code

[hotlong]

Claim: PM session (maintainer go in chat, 2026-08-07: 「所以 4935 也不需要关,你直接修复就可以」)
Session: session_01BickTBKm2JYSNnrtPT8ysa
Branch: claude/issue-6170-release-lane-human-gate
Worktree: objectstack-issue-6170
Domain: release workflow (.github/workflows/release.yml) — maintainer-directed dispatch from chat
File surface: .github/workflows/release.yml (+ at most a small helper under scripts/ if the version probe needs one); ⛔ no package code, ⛔ no .changeset/**
Serial constraints cleared: no open PR or claim touches release.yml (open-PR list checked ~06:20Z). #6169 (merge-back) is deliberately sequenced AFTER this PR merges — recorded on both issues. #4935 stays open per maintainer decision; once #6169 lands it regenerates in place as the rc.5 proposal.

---

Generated by Claude Code

[hotlong]

Review: ACCEPT → PR #6172, flipped ready and queued.

• Diff = declared file surface exactly: one file, .github/workflows/release.yml (+476/−211). No package code, no .changeset/**, no release docs. skip-changeset applied (workflow-only).
• All three requirements implemented structurally, not conditionally: R2 — release-integrity contains no changesets action, reads the version out of the object DB at github.sha, and carries a workspace-vs-sha tripwire (offline replay shows the old probe reproducing the rc.4 incident and the new probe turning that same state red); R3 — the push-lane changesets step has no publish: input (per the action's own hasPublishScript switch, runPublish is unreachable from any input state), and the only publish-capable job requires workflow_dispatch + environment: release; R4 — check:objectui-pin-fresh runs enforcing on the publish path, with the fixed-group check, console build/stamp and hotcrm smoke moved there too. Legitimate 空 changeset 会静默卡死已 version 的发布:Release run 全绿,但 npm 和 Docker 什么都没发(17.0.0-rc.2 现在就卡着) #4898/GitHub Release body 超 125k 上限:spec 的 rc 段已达 343k,RC 窗口内每次发布都会在 createGithubReleases 处失败(npm 已发出、Docker 被连带跳过) #4900 repairs preserved (backfill only for versions already on npm — cannot mint).
• Beyond spec, correctly: per-event concurrency groups so a burst of main pushes can never evict a maintainer's pending publish click; the PM's mechanism inference was re-verified against changesets/action v1 source instead of trusted.
• Verification checked, not just read: all 27 lint-job gates enumerated from the file and run (one caught a real YAML quoting bug in the draft — fixed); reverse verification predicted-then-red naming both halves; ESLint and TypeScript Type Check both success on the PR head (07:00:24Z / 07:03:42Z, verified independently); the Check Changeset red was the documented label race, superseded by the labeled-event run (skipped).
• Honesty item carried into the PR body: an unprotected release environment passes silently — the one-time Settings step (required reviewers) is stated as the maintainer's, with workflow_dispatch as the load-bearing YAML-only guarantee meanwhile.

Once merged: #6169 (merge back a10cbc77) unblocks and will be dispatched immediately; after it lands, the Version Packages PR regenerates as the rc.5 proposal, and publishing it is a human-only action per the ruling above.

---

Generated by Claude Code