local n="$#"

if (( n == 0 )); then printf 'none'; return 0; fi

local out

out="$(printf '%s, ' "${@:1:10}")"

out="${out%, }"

if (( n > 10 )); then out="${out} … (+$(( n - 10 )) more; ${n} total)"; fi

printf '%s' "$out"

local sha="$1"

local short="${sha:0:12}"

local rc=0

# Q1 — can this checkout answer the question AT ALL? Asked first because the

# later questions are meaningless without it: with no origin/main,

# `--is-ancestor` would report "the pin left main", which is this check's own

# overclaim wearing a new message.

if ! git -C "$OBJECTUI_ROOT" rev-parse --verify --quiet origin/main >/dev/null 2>&1; then

REACH_TAG=" (reachability UNKNOWN)"

REACH_RECALL=" — ⚠️ pin reachability UNKNOWN, see above"

{

echo

echo "⚠️ COULD NOT DETERMINE whether ${short} is on objectui main."

echo " ${OBJECTUI_ROOT} has no 'origin/main' ref, so the question cannot be asked"

echo " in this checkout at all."

echo " This is NOT 'the pin is fine' and NOT 'the pin left main'. It is unanswered,"

echo " and the pin is being written anyway."

echo " To make it answerable here: git -C ${OBJECTUI_ROOT} fetch origin main"

echo " (not run for you — this script stays usable offline.)"

echo " The release cut re-asks it against a fresh full clone and fails closed (#9450)."

echo

} >&2

return 0

fi

# Q2 — whether the object can be READ is deliberately NOT asked here. It is

# settled up front, by the read this bump actually needs (`git log -1

# --format=%s`), and an unreadable object REFUSES there with the working tree

# untouched (#10797) — so `--is-ancestor` below cannot meet an absent object on

# any path that reaches this function. Asking it a second time with a weaker

# probe (`cat-file -e` tests presence, not readability) would be a second

# implementation of one rule, free to drift from the thing it guards. If that

# ordering is ever broken, the rc-is-not-1 branch below is the backstop: it

# reports 128 as the error it is and never as a verdict.

# Q3 — the verdict. 0 / 1 / anything else, distinguished on purpose.

git -C "$OBJECTUI_ROOT" merge-base --is-ancestor "$sha" origin/main 2>/dev/null || rc=$?

if [[ "$rc" -eq 0 ]]; then

# Reachable. No banner — but the line that prints anyway says so, so that

# "checked, and fine" is stated rather than inferred from silence.

REACH_TAG=" (on origin/main)"

return 0

fi

if [[ "$rc" -ne 1 ]]; then

REACH_TAG=" (reachability UNKNOWN)"

REACH_RECALL=" — ⚠️ pin reachability UNKNOWN, see above"

{

echo

echo "⚠️ COULD NOT DETERMINE whether ${short} is on objectui main."

echo " 'git merge-base --is-ancestor ${short} origin/main' exited ${rc}; only 0"

echo " (is an ancestor) and 1 (is not) are verdicts. Anything else is an error,"

echo " and is being reported as one rather than folded into either answer."

echo " This is NOT 'the pin is fine' and NOT 'the pin left main'. It is unanswered."

echo

} >&2

return 0

fi

# rc == 1: a real verdict, and the one this card exists for.

REACH_TAG=" (NOT on origin/main)"

REACH_RECALL=" — ⚠️ pin is NOT on objectui origin/main, see above"

# Enumerated only on this branch: with ~941 branches a --contains walk is not

# free, and the healthy path must not pay for it.

#

# READ LOOP, NOT `mapfile` — THE BASH 3.2 FLOOR. `mapfile`/`readarray` are

# bash 4 builtins, and `/usr/bin/env bash` is bash 3.2.57 on macOS (Apple has

# not shipped bash 4+ for licensing reasons). This script is run BY HAND, BY

# AN OPERATOR, on a laptop — the pin-bump procedure in

# `docs/releases-maintenance.md` has no CI path — so a bash-4 builtin here

# does not fail on a fringe host, it fails on the ordinary one. And it fails

# on exactly the branch that must not fail: `mapfile` is only ever reached

# once the verdict is "NOT on origin/main", i.e. the #10495 warning is the

# single thing this shell cannot deliver. Measured with `mapfile` disabled:

# `mapfile: command not found`, then `set -e` kills the run at status

# 127 BEFORE the pin is written, and the operator is handed a bare builtin

# error where the warning should have been — an error whose obvious remedy

# (edit `.objectui-sha` by hand) walks around every guard in this file.

# CI runs bash 5, so neither the defect nor this repair is observable in a

# normal CI run; the digest self-test pins it with the builtin disabled

# (`enable -n mapfile readarray` via `BASH_ENV`) plus a static scan.

# Keep this loop bash-3.2-clean: no `mapfile`, no `readarray`, no

# `declare -A`, no `${x^^}`/`${x,,}`. The `if` (rather than `[[ … ]] &&`) is

# load-bearing under `set -e` — but NOT on an empty ref list: an all-empty

# read leaves the loop body unexecuted and the `while` exits 0 either way

# (measured, bash 5.2.21). The real trap is a NON-EMPTY read whose LAST

# line fails the `[[ -n … ]]` test, and only once that loop is the LAST

# command of a function: the `&&`-list's false status becomes the loop's

# exit status, which becomes the function's return, which `set -e` then

# kills the caller on. Measured over all four combinations (empty vs.

# non-empty-with-failing-last-line × loop-is-fn's-last-command vs. not):

# only that one combination dies (exit 1); the other three exit 0.

local -a local_refs=() remote_refs=()

local ref_line=''

while IFS= read -r ref_line; do

if [[ -n "$ref_line" ]]; then local_refs+=("$ref_line"); fi

done < <(

while IFS= read -r ref_line; do

if [[ -n "$ref_line" ]]; then remote_refs+=("$ref_line"); fi

done < <(

local main_tip

main_tip="$(git -C "$OBJECTUI_ROOT" log -1 --format='%h, committed %cr' origin/main 2>/dev/null || echo 'unknown')"

{

echo

echo "⚠️ objectui pin ${short} is NOT reachable from origin/main in"

echo " ${OBJECTUI_ROOT} — it names a revision that is not on objectui main."

echo " on local branches : $(reach_ref_list ${local_refs[@]+"${local_refs[@]}"})"

echo " on remote branches: $(reach_ref_list ${remote_refs[@]+"${remote_refs[@]}"})"

# Which of the two situations this is, said out loud, so the operator does

# not have to go and look: a branch that never merged and a commit that was

# never pushed take different remedies.

if (( ${#remote_refs[@]} > 0 )); then

echo " → It IS pushed, but only onto branch(es) that have not merged into main."

elif (( ${#local_refs[@]} > 0 )); then

echo " → It is on a LOCAL branch only — this commit has not been pushed to objectui."

else

echo " → No branch in this checkout contains it (detached HEAD on a discarded commit?)."

fi

echo " Or your origin/main is simply STALE: it points at ${main_tip}."

echo " Refresh it with: git -C ${OBJECTUI_ROOT} fetch origin main"

echo " (not run for you — this script stays usable offline, and the answer to"

echo " this question is yours to judge.)"

echo " Pinning it anyway. Downstream: the release cut re-asks this against a fresh"

echo " full clone and REFUSES to cut (#9450), so a bad pin surfaces at RC time at"

echo " the earliest; until then 'pnpm sdui:manifest' would ratchet spec↔registry"

echo " declaration parity against a tree that is not on main (ADR-0082 D4)."

echo

} >&2

return 0

echo

echo "→ NEXT STEP — regenerate the committed SDUI manifest (required lint gate):"

echo " node scripts/gen-sdui-manifest-node.mjs \\"

echo " --objectui-version {the @object-ui version the new pin ships}"

echo " Read that version from the objectui checkout's packages/core/package.json."

echo " It rewrites the tracked sdui.manifest.json and scripts/sdui-manifest.record.json;"

echo " scripts/check-sdui-manifest.mjs reds this bump PR until it does, and ADR-0082 D4's"

echo " declaration-parity ratchet reads the same tracked artefact. No browser needed."

echo " ⛔ 'pnpm sdui:manifest' does NOT write those files — it is the separate browser"

echo " dump to the gitignored packages/console/dist/ (needs Playwright chromium)."

echo " Procedure: docs/releases-maintenance.md → 'After the pin moves'."