feat(scripts): check-override-consistency 增加 override 消费者体检与自失效上界报告 (#6093)

按 #5835 裁 A 的配套正交项(#6046):override 只在「可发布包 declared range 里
出现过」时才被校验,没有消费者的 override 会被直接跳过 —— 于是一条不可见的安全
声明两头都危险,既可能被误信为在生效,也可能被下一个 agent 顺手删掉。

新增两份体检,都是 report,⛔ 一律不改退出码:

1. 消费者普查:从本地 pnpm-lock.yaml 的 importers + snapshots 统计每条 override
   的消费者数,零消费者点名报告,并写明「#5835 裁 A 决定保留」的姿态指引。
   普查刻意做在包名一级:pnpm-lock.yaml 记的是 override 生效之后的解析结果,
   一条正在干活的 override 早已把命中项抬到 target 之上、抬出了 selector,
   实测「落在 selector 内的解析数」对 28 条 override 全为 0(包括在干活的),
   根本分不出「空转」和「正在生效」。包名的有无是 lockfile 唯一能诚实给出的信号。

2. 自失效上界:selector 的排他上界 `<V` 落在 target 下限之上或与之相等时点名 ——
   target 所在版本线整条不在 scope 内,target 自身出公告要挪时 pin 会当场失配,
   即 #4961 / #5032 里 `undici@>=7.23.0 <7.28.0` 的形状。

`--self-test` 17 条断言双向立住(有消费者不报 / 零消费者报出 / 自失效形状报出 /
上界高于 target 版本线不报 / lockfile 不可解析时降级不崩),并把既有的 declared
range 主规则一并补上双向覆盖。self-test 接进新增的 `check:override-consistency`
命令链,validate-deps 工作流改调该命令链而非裸脚本 —— 不接线即 phantom check。


Claude-Session: https://claude.ai/code/session_01BDmDsu2575gDxeMCxXhDE3

Co-authored-by: Claude <noreply@anthropic.com>

Author: hotlong

.github/workflows/validate-deps.yml

@@ -72,9 +72,17 @@ jobs:
       # another (the 15.1.0 quickstart shipped exactly that: plugin-auth
       # declared better-auth ^1.6.23 while CI ran the 1.7.0-rc.1 override,
       # and every fresh project 500'd on auth).
+      #
+      # The same run also prints two informational censuses (#6046): overrides
+      # nothing in the dependency tree consumes, and selectors whose upper
+      # bound excludes their own target (#4961 / #5032). Both are REPORTS and
+      # never fail the job — an unconsumed override is a legitimate posture
+      # (#5835 ruling A). `--self-test` proves the check in both directions,
+      # so run the `check:override-consistency` chain rather than the bare
+      # script: a self-test nothing invokes is a phantom check.
       - name: Verify overrides are reflected in published manifests
-        run: node scripts/check-override-consistency.mjs
-          
+        run: pnpm check:override-consistency
+
       # Fail the workflow if known vulnerabilities are found — enforces
       # security compliance before merging.
       #

package.json

@@ -55,6 +55,7 @@
     "check:objectui-pin-fresh": "node scripts/check-objectui-pin-fresh.mjs --self-test && node scripts/check-objectui-pin-fresh.mjs",
     "check:prerelease-pins": "node scripts/check-prerelease-pin-watch.mjs --self-test && node scripts/check-prerelease-pin-watch.mjs",
     "check:empty-changeset": "node scripts/check-empty-changeset.mjs --self-test && node scripts/check-empty-changeset.mjs",
+    "check:override-consistency": "node scripts/check-override-consistency.mjs --self-test && node scripts/check-override-consistency.mjs",
     "check:release-notes": "node scripts/check-release-notes.mjs",
     "check:release-body": "node scripts/release-github-releases.mjs --self-test",
     "check:node-version": "node scripts/check-node-version.mjs",