ci(console): add the six other packed manifests to the console-dist key and the console filter (#24470)

Fixes #24441
Clause-②: no

## What changes

One file, `.github/workflows/ci.yml` (+15 / -4):

- The console-dist cache key now hashes
`packages/{core,types,client,formula,sdui-parser,lint}/package.json`
next to `packages/spec/package.json`. The `console-pin` job spells the
key in three places, and all three change: the restore step's `key`, the
verify step's `CONSOLE_DIST_CACHE_KEY` env, and the save step's `key`.
The three stay byte-identical: the key expression has one distinct
string, found 3 times.
- The `console` path filter now names the same six paths. A push that
moves only one of them now selects Console Pin Gate.
- Two comments say what the six paths are and what they cost.

There is no new gate and no script edit. Workflows publish nothing, so
there is no changeset (`skip-changeset`).

## Why

`scripts/build-console.sh` packs every `@objectstack/*` package that
objectui overrides into objectui's install, from this tree
(`OBJECTSTACK_ROOT=... node scripts/objectstack-pin.mjs build`). It does
this on a pin that carries `.objectstack-sha`. objectui's pin script
refuses a packed manifest in two cases: its runtime dependency names
differ from what objectui's lockfile records, or an entry file is
missing. Before this change, the key and the filter named only spec's
manifest:

- A push that moved only `packages/core/package.json` skipped Console
Pin Gate on that push, because the filter did not match.
- The hourly full-battery run selects the job anyway. But it hit the old
dist cache entry and skipped `build-console.sh`, so the pin script never
ran.

The refusal first fired at `cut-rc.yml`'s `pnpm objectui:build`, or at
the publish step.

## Premise check (measured at origin/main `ec951e29e`)

1. **Key spellings.** `grep -n console-dist .github/workflows/ci.yml`
finds three: the restore `key` (line 3011), the verify env
`CONSOLE_DIST_CACHE_KEY` (3075) and the save `key` (3088). All three
were identical. `release.yml` keeps its own narrower key
(`.objectui-sha`, `build-console.sh` and the zod range) on purpose. It
is not touched.
2. **The seven-package set, re-derived from the script, not from the
card.** `build-console.sh` reads the set at run time from objectui's
root `package.json`: the `pnpm.overrides` names that start with
`@objectstack/`. At objectui `origin/main` `29c19cc1a6` the set is
exactly client, core, formula, lint, sdui-parser, spec and types.
- ⚠️ The pin this tree carries today (`.objectui-sha` = `0707b4ae37`)
has no `.objectstack-sha` and no `@objectstack/*` override, so the
OBJECTSTACK_ROOT block does not run at this pin.
- `.objectstack-sha` arrived in objectui at `749ed76` (objectui#12963),
34 commits after the pin. The six manifests start to matter at the first
pin bump to that commit or later.
- The bump itself moves `.objectui-sha`, which is already in the key.
What this change catches is a manifest change that lands after the bump.
3. **Fixed group.** `.changeset/config.json` has one fixed group of 73
packages, and all seven are in group 0. So a Version Packages merge
moves all seven manifests in one commit, spec's included, and costs one
rebuild, not seven.
4. **Effect on the hit rate.** The window was proved by
`scripts/pm/git-history.mjs` (`--since=2026-09-19 --until=2026-10-19
--ref=ec951e29e`, first-parent; the floor, 2026-09-05, predates the
window; no fetch):

| first-parent commits on `main`, 2026-09-19 to 2026-10-19 | count |
|---|---|
| all | 2727 |
| moved an input the key already had | 54 |
| moved one of the six manifests | 11 |
| ... of those, also moved an input the key already had | 10 (7 Version
Packages merges and 3 dependency bumps, each touching
`packages/spec/package.json`) |
| moved one of the six and no input the key already had | 1
(`54d32e514`: a new `exports` entry in `packages/lint/package.json`) |

So the key now moves on 55 commits instead of 54: one extra cold console
build in 30 days, +1.9%. The one extra commit is a manifest entry
change, which is one of the things the pin script checks.

## Verification (head `33a410f07`)

- `node scripts/check-ci-filter-parity.mjs`: exit 0 before and after the
change.
- Before: `all 9 console entr(ies) are literal paths; 6 are build inputs
the console dist key hashes and 3 are declared guards; the key is
spelled one way in all 3 place(s)`.
- After: `all 15 console entr(ies) are literal paths; 12 are build
inputs the console dist key hashes and 3 are declared guards; the key is
spelled one way in all 3 place(s) the console-pin job uses it.`
- `node scripts/check-ci-filter-parity.mjs --self-test`: exit 0, 131
assertions. The anchor line its report-path fixture looks for
(`packages/spec/tsup.config.ts` in the filter) is unchanged.
- `ci.yml` still parses (`yaml`: 10 jobs).
- Derived gates (`node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` against merge base `ec951e29e`; 1 path, 19
changed lines):
  - 49 commands. 45 exit 0.
- 4 exit 3 with `PREREQUISITE NOT MET`, because they need a full `pnpm
build`: `check:dts-closure`, `check:dual-build-cjs-loads`,
`check:lean-entry-closure` and `check:sourcemap-no-sources-content`.
These are Build Core's dist guards. This diff changes no package source
and no build config, and CI's Build Core runs them on this PR. Declared
as a narrowing: NOT MEASURED locally.
- `--ran` reconciliation: `49 derived famil(ies) accounted for — 45 run,
4 NOT-MEASURED`, exit 0.
- Roster families under `.github/workflows`:
`check-platform-checklist-watchdog` (gate and self-test), and the
self-tests of `select-shard-timings-run`, `pr-labels` and
`release-verify-npm`. All exit 0.
- `check:console-injection` and `check:console-sha` exit 0 but passed
vacuously, because there is no local console dist.
- Console Pin Gate runs only in the full battery, not on `pull_request`
or `merge_group`. Its first run on this change is `main`'s push battery
after the merge. A cold `build-console.sh` (clone plus vite build) is
NOT MEASURED locally.

## Acceptance notes

- The six paths are a hand copy of objectui's override list at the pin,
which `build-console.sh` derives at run time. If objectui adds an eighth
`@objectstack/*` override, the key will not name it until someone adds
it here. No gate holds the two lists together, and the card rules out a
new gate. Carrier: none.
- The key watches manifests only. A change to the tsup entry list of one
of the six could also cause the pin script's missing-entry-file refusal.
Spec's `tsup.config.ts` is keyed for that reason; the other six are not.
No such change appeared in the window. Noted, not filed. Carrier: none.
- Two older comments in the job are now less accurate, and are left as
they are to stay inside this card's line budget:
- the header's measurement (`32 of the 3219 first-parent commits ...
moved one`, dated 2026-08-31 to `9905e61ca2`);
- the save step's line that `this key moves only when the pin does`.
That was already inexact before this change, because spec's manifest was
in the key.

## 维护者速读(草稿)

**改了什么**
CI 里有一套控制台(Console)构建缓存。原来它的缓存钥匙和触发条件只看 spec
一个包的清单文件(package.json)。现在把另外六个包的清单文件也算进去:core、types、client、formula、sdui-parser、lint。控制台构建会把这六个包和
spec 一起装进 objectui。本次只改一个 workflow 文件,共 19 行。

**为什么改**
控制台构建会把这七个包从本仓库打包,装进 objectui。objectui
那边会核对这些包的依赖是否和它的锁文件一致,不一致就拒绝构建。原来这六个包的依赖一变,CI 既不触发控制台构建,也不让缓存失效,问题要等到切
RC 发版时才第一次暴露。改完以后,问题会在合入 main 的那次推送上暴露。

**风险与代价(含回滚)**
- 代价:控制台冷构建偶尔多一次。过去 30 天 main 上有 2727 次提交,缓存失效的次数从 54 次变成 55 次,也就是多一次约
20 分钟的构建。
- 七个包的版本号一起升(同一个 fixed group),所以发版合并只算一次失效。
- 这个门禁是建议性的,红了也不挡合并。
- 注意:当前 pin 的 objectui 版本还没有 `.objectstack-sha`,所以这次改动要等下一次把 objectui
pin 升到 `749ed76` 或更新之后才真正起作用。
- 回滚:revert 这一个提交即可。不涉及数据,也不影响发布内容。

**席位意见**

**你要做的**
看一眼 diff。同意就在本 PR 上给一个 APPROVED 审批。之后由席位负责落地。

---
_Generated by [Claude
Code](https://claude.ai/code/session_01FM29ZqLTrnPNXxijioZwMp)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.github/workflows/ci.yml

@@ -305,6 +305,11 @@ jobs:
             # ⛔ Not packages/spec/**: the rest of the spec is bundled CONTENT, and
             # its lag behind a cached dist is the ruled cache design (#9667, #9706;
             # see scripts/check-console-injection.mjs).
+            # The six other manifests are what build-console.sh packs into objectui's
+            # install on a pin carrying .objectstack-sha; objectui's objectstack-pin.mjs
+            # refuses one whose dependency names its lockfile does not record. All seven
+            # are changesets fixed group 0: of the 2727 first-parent commits on main in the
+            # 30 days to ec951e29e, 11 moved one of the six, 10 with spec's: 54 key moves -> 55.
             console:
               - '.objectui-sha'
               - 'scripts/build-console.sh'
@@ -314,6 +319,12 @@ jobs:
               - 'scripts/assert-console-spec-injection.mjs'
               - 'packages/spec/package.json'
               - 'packages/spec/tsup.config.ts'
+              - 'packages/core/package.json'
+              - 'packages/types/package.json'
+              - 'packages/client/package.json'
+              - 'packages/formula/package.json'
+              - 'packages/sdui-parser/package.json'
+              - 'packages/lint/package.json'
               - '.github/workflows/ci.yml'
             # Test inputs that live OUTSIDE every package (#9829, #10015). Packages
             # whose suites read across their own boundary declare that radius in
@@ -2983,7 +2994,7 @@ jobs:
 
       # Keyed on every BUILD INPUT the `filter` job's `console` list names (the
       # pin, the build script, the two scripts that derive and stamp the injection
-      # probes, and the spec's entry layout) and on nothing else.
+      # probes, the spec's entry layout, the six other packed manifests) and on nothing else.
       # scripts/check-ci-filter-parity.mjs holds this key and that list in step
       # (#20765). A head that moves a build input MISSES, so the build and the
       # assertion inside it judge the change on the PR head, not first in the
@@ -3008,7 +3019,7 @@ jobs:
         uses: actions/cache/restore@v6
         with:
           path: packages/console/dist
-          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh', 'scripts/assert-console-spec-injection.mjs', 'scripts/console-spec-probes.mjs', 'packages/spec/package.json', 'packages/spec/tsup.config.ts') }}
+          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh', 'scripts/assert-console-spec-injection.mjs', 'scripts/console-spec-probes.mjs', 'packages/spec/package.json', 'packages/spec/tsup.config.ts', 'packages/core/package.json', 'packages/types/package.json', 'packages/client/package.json', 'packages/formula/package.json', 'packages/sdui-parser/package.json', 'packages/lint/package.json') }}
 
       # The gate. Shallow-clones objectui at the pinned SHA, builds
       # @object-ui/console against this tree's client, copies the dist into
@@ -3072,7 +3083,7 @@ jobs:
       # a poisoned entry is reachable from here and must not pass quietly.
       - name: Verify the restored Console dist bundles this tree's spec
         env:
-          CONSOLE_DIST_CACHE_KEY: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh', 'scripts/assert-console-spec-injection.mjs', 'scripts/console-spec-probes.mjs', 'packages/spec/package.json', 'packages/spec/tsup.config.ts') }}
+          CONSOLE_DIST_CACHE_KEY: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh', 'scripts/assert-console-spec-injection.mjs', 'scripts/console-spec-probes.mjs', 'packages/spec/package.json', 'packages/spec/tsup.config.ts', 'packages/core/package.json', 'packages/types/package.json', 'packages/client/package.json', 'packages/formula/package.json', 'packages/sdui-parser/package.json', 'packages/lint/package.json') }}
         run: pnpm check:console-injection --require-stamp
 
       # Reached only with every assertion above green (see the split-restore note).
@@ -3085,4 +3096,4 @@ jobs:
         uses: actions/cache/save@v6
         with:
           path: packages/console/dist
-          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh', 'scripts/assert-console-spec-injection.mjs', 'scripts/console-spec-probes.mjs', 'packages/spec/package.json', 'packages/spec/tsup.config.ts') }}
+          key: ${{ runner.os }}-console-dist-${{ hashFiles('.objectui-sha', 'scripts/build-console.sh', 'scripts/assert-console-spec-injection.mjs', 'scripts/console-spec-probes.mjs', 'packages/spec/package.json', 'packages/spec/tsup.config.ts', 'packages/core/package.json', 'packages/types/package.json', 'packages/client/package.json', 'packages/formula/package.json', 'packages/sdui-parser/package.json', 'packages/lint/package.json') }}