The SGLang manifest file count 3338 is gated only against itself, and appears in no executing code

[localai-bot]

Found by the fresh review of PR #1831 (row SGLANG-ORACLE-LEASE-WHEEL, W2). PRE-EXISTING and NOT fixed there: the number and the claim come from W1 (727efb39c), and W2's new suite does not close it. Repairing it needs a job on dgx:gpu0, which is orthogonal to W2's scope.

The claim

3338 is quoted as a measured file count of the installed sglang/ tree in three records:

• .agents/environment.md — "asserted the installed tree against a 3338-file manifest at IDENTITY_RC=0"
• .agents/oracles/sglang.md
• .agents/sglang-matrix.md — "3338 of 3338 manifest files, 0 missing, 0 extra, 0 differing"

What actually gates it: nothing

3338 appears in no executing code:

$ grep -rn '3338' scripts/ tests/scripts/ .github/ ; echo rc=$?
rc=1

The only test that touches the count compares the file to itself:

# tests/scripts/test_sglang_lease_identity.py:54-55
def test_file_count_agrees_with_the_file_table(self) -> None:
    self.assertEqual(self.manifest["file_count"], len(self.manifest["files"]))

That is a self-consistency check of one JSON document. It cannot see whether 3338 is the count of the real installed tree, only whether the manifest's header agrees with its own body.

Mutation, run on row/SGLANG-ORACLE-LEASE-WHEEL-W2 at 85c247580

Drop a real file from the manifest and decrement the header to match — the exact shape of a mis-generated manifest:

$ python3 -c "... del m['files']['sglang/README.md']; m['file_count']=len(m['files']) ..."
MUTATED: dropped sglang/README.md -> file_count 3337
$ python3 tests/scripts/test_sglang_lease_identity.py; echo rc=$?
Ran 14 tests in 0.274s
OK
rc=0

The suite stays green on a manifest that asserts a different tree. Tree restored byte-for-byte afterwards (git status --short clean, empty diffstat).

Why this is a real gap and not pedantry

The manifest is the whole identity assertion for the SGLang wheel oracle. sglang.__commit_id__ is None in the published wheel, so the manifest is the only assertion available that the installed tree is the pinned tree. A wrong manifest makes IDENTITY_RC=0 a tautology too, and every number taken through that route inherits it. 3338 is exactly the kind of value ["a number quoted often becomes treated as measured"] describes: it now reads as a measurement in three files while resting on one un-re-derived generation run.

What a repair looks like

The count cannot be pinned by a checker that only reads the committed JSON — that is the same tautology one level up. It needs a re-derivation: an rc job that installs the pinned wheels and regenerates the manifest from the installed tree, and reports the count and the per-file diff against the committed one. scripts/rc-sglang-oracle-lease.sh install already does the assertion half (scripts/sglang_lease_identity.py); what is missing is a run that regenerates rather than compares, on a second independent install, so the committed manifest is confirmed by something other than itself.

Until that runs, the honest record is "3338 files, from one generation run on 2026-08-19, not independently re-derived" rather than "3338 of 3338".

Owner: this issue. Listed under ## Owed of sglang-wheel-in-lease.md. Related: #1265, #1418.