fix(devx): refuse a pnpm --filter that matches nothing, instead of exiting 0 (#10853)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DdCnBGcHeufjrq7drTD3wt

Author: claude[bot]

.github/workflows/lint.yml

@@ -1971,6 +1971,37 @@ jobs:
       - name: Read-side tenant chokepoint gate
         run: pnpm check:tenant-chokepoint
 
+      # Every committed `pnpm --filter <name>` must name a real workspace
+      # package (#10853).
+      #
+      # ⛔ `pnpm --filter <name>` EXITS 0 when the filter matches nothing:
+      #
+      #     $ pnpm --filter @objectstack/definitely-not-a-package test; echo $?
+      #     No projects matched the filters in "..."
+      #     0
+      #
+      # So a step here, a package.json script or a `scripts/**` helper can name
+      # a package that does not exist and stay GREEN forever, measuring nothing
+      # and reporting success. `cmd > log 2>&1; ec=$?` captures the 0 perfectly;
+      # the log even says what happened and nothing reads it. Same family as the
+      # `--`-before-vitest-args trap: exit 0, nothing measured, output that reads
+      # like success — #4690, sitting underneath the command used to PROVE
+      # results.
+      #
+      # This gate reads SPELLINGS THAT ARE CHECKED IN, and that is the whole of
+      # its claim. It cannot see a filter an agent types at a prompt, which is
+      # the population that actually bit; that half is covered, only for callers
+      # of the shared verify lock, by `scripts/pm/os-verify-lock.sh`'s filter
+      # preflight. Disjoint populations, neither a substitute for the other.
+      #
+      # Reads package.json, pnpm-workspace.yaml and text under `scripts/**` and
+      # `.github/workflows/**`. No build, no pnpm invocation, no network,
+      # sub-second. The `check:` key runs the shared resolver's --self-test
+      # first, then the gate's, then the gate: a checker whose resolver is
+      # broken has no verdict worth printing.
+      - name: Every committed pnpm --filter names a real package
+        run: pnpm check:pnpm-filter-targets
+
   # Lane 1 of 4 behind the required `TypeScript Type Check` context. The
   # aggregator job at the bottom of this file explains the split, holds the
   # contract, and is the thing the merge queue actually requires — read it

package.json

@@ -61,6 +61,7 @@
     "check:pm-governed-prose": "node scripts/pm/check-governed-prose.mjs --self-test && node scripts/pm/check-governed-prose.mjs",
     "check:partof-closing-keyword": "node scripts/check-partof-closing-keyword.mjs --self-test",
     "check:single-claim-paths": "node scripts/check-single-claim-paths.mjs --self-test",
+    "check:pnpm-filter-targets": "node scripts/pnpm-filter-targets.mjs --self-test && node scripts/check-pnpm-filter-targets.mjs --self-test && node scripts/check-pnpm-filter-targets.mjs",
     "check:adr-anchors": "node scripts/check-adr-anchors.mjs --self-test && node scripts/check-adr-anchors.mjs",
     "check:adr-links": "node scripts/check-adr-links.mjs --self-test && node scripts/check-adr-links.mjs",
     "check:platform-checklist": "node scripts/checklist-select.mjs --self-test && node scripts/check-platform-checklist.mjs",