[finding] dispatch-gates never routes a `.objectui-sha` change set to `check:objectui-pin-citations` — PR #15554's pin bump ran 47 derived commands green and CI redded on 8 stale spec citations

[claude]

Filed by the PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk, from a measured CI red on PR #15554 (#15422). Filed bare — domain:*, type and priority are triage's. Same class as #15501 (check:merge-driver, landed via #15538) and #15553 (check:declaration-mirrors, PR #15601 accepted): a gate whose population the derivation cannot see.

What happened

PR #15554 bumps .objectui-sha (00d3f09c5 → a472b0716) with a changeset and two JSON provenance records. Its derived family (47 commands) ran green. CI then redded on Type Check · source gates → "Check spec pin citations still name the pin this repo builds against" (pnpm --filter @objectstack/spec check:objectui-pin-citations, run 33919484147, job 101174258347):

✗ 8 spec source(s) assert an objectui pin this repo does NOT build against.
  .objectui-sha = a472b07167a39e55491109e864bb5a54027dcfbd
    packages/spec/src/data/api-methods-batch-conformance.test.ts:64 cites `00d3f09c5`
    packages/spec/src/ui/component.test.ts:281 / :370 / :2783 cites `00d3f09c5`
    packages/spec/src/ui/component.zod.ts:677 / :1736 / :1943 / :2578 cites `00d3f09c5`
  ⛔ Do NOT fix this by replacing the sha … RE-MEASURE each record at the current pin instead

The gate is right, and its instruction is the rework (in flight on the same branch). The derivation could not have named it: the gate reads .objectui-sha (a root FILE, not a directory) and walks packages/spec/src/** for citations, and its declared population — if any — does not reach the root file. A change set that consists ONLY of the pin file is exactly the class this gate exists for, and it is the class that never derives it.

What a fix owes (direction, not prescription)

Declare the population on the gate so a .objectui-sha change set derives it — the root-file idiom check:merge-driver adopted for package.json/** under #15501 (ROOT_FILE_WATCH_HINTS = ['package.json/**'], scripts/git-merge-regen.mjs:109) is the precedent: a root-file hint spelled as .objectui-sha/** (verify hintCovers admits the spelling and check:watch-hint-literal rosters the name), plus the packages/spec/src/** side it scans. ⛔ Not a hand list of citing files (they are discovered by regex on purpose). Note the gate lives under packages/spec/scripts/ and is invoked through a pnpm filter — check the derivation's handling of package-scoped gates.

Refs

#15501 / PR #15538 (root-file precedent), #15553 / PR #15601 (extension-discovered precedent), #15422 / PR #15554 (the specimen), #14918.

---

Generated by Claude Code

[os-zhuang]

分诊 · domain:devx / priority:p2 / pm:queue

Anchor read, not guessed. The fix declares a population on a gate, and the derivation lives in scripts/pm/dispatch-gates.mjs ⇒ domain:devx. Confirmed on origin/main f1d7872 (2026-09-05T00:28:44Z): the gate itself is packages/spec/scripts/check-objectui-pin-citations.ts.

Grade — p2

⭐ This is measured, not predicted: PR #15554 bumped .objectui-sha (00d3f09c5 → a472b0716), its derived family of 47 commands ran green, and CI then redded on run 33919484147 / job 101174258347 with 8 stale citations across api-methods-batch-conformance.test.ts and component.test.ts / component.zod.ts.

⭐ And the structural point is the sharp one: a change set consisting only of the pin file is exactly the class this gate exists for, and it is the class that never derives it. The gate reads .objectui-sha — a root FILE, not a directory — and walks packages/spec/src/**; the derivation cannot see the root file.

⇒ The cost is a full CI cycle discovered after 47 green commands, on precisely the PR shape the gate was written for. Not p1 (the gate did catch it, in CI, and the rework is in flight on the same branch); not p3 (it is the third measured instance of this class).

⛔ The gate is right and its instruction is the rework — "Do NOT fix this by replacing the sha … RE-MEASURE each record at the current pin instead." ⇒ ⛔ Nobody should read this card as a complaint about the gate.

⭐ Third instance of one class — that is what makes it worth a card rather than a one-off declaration

• [finding] dispatch-gates cannot route a card that ADDS a generator to check:merge-driver — its population is the artefacts already routed, so the 'no recorded merge disposition' clause only ever fires in CI #15501 — check:merge-driver, landed via fix(devx): declare check:merge-driver's manifest population, and re-measure the bounded-subtree walk specimen #15538 (root-file population).
• [finding] dispatch-gates never routes a .d.mts change set to check:declaration-mirrors — its corpus is discovered by extension, no path literal, so a drifted mirror only reds in CI #15553 — check:declaration-mirrors, PR fix(devx): check-declaration-mirrors declares the .d.mts/.mjs population it discovers, so a mirror edit derives it #15601 accepted (extension-discovered population).
• this card — check:objectui-pin-citations.

⇒ A gate whose population the derivation cannot see. ⚠️ Three in short succession means the next one is already out there. Worth asking, in the same pass, whether there is a mechanical way to find the rest — e.g. gates whose inputs include a root file or a non-packages/** path with no declared hint — rather than waiting for each to red a PR. ⛔ That is an observation, not a widening of this card's scope; ⭐ but if the taker can answer it cheaply, it is worth more than this one declaration.

⭐ Two precedents, not one — and the card names only the second

precedent	spelling
scripts/check-doc-anchors.mjs:191	const ROOT_FILE_WATCH_HINTS = ['README.md/**', 'ARCHITECTURE.md/**']; — with a consistency assertion at :670 (EXTRA_SOURCES.every(f => ROOT_FILE_WATCH_HINTS.includes(\${f}/**`))`)
scripts/git-merge-regen.mjs:109 (per the card)	ROOT_FILE_WATCH_HINTS = ['package.json/**'] under #15501

⇒ ⭐ The root-file idiom is established in at least two places, and check-doc-anchors.mjs:670 shows the self-consistency assertion that should ride along: the hint list and the actual extra sources are pinned against each other, so the declaration cannot drift from what the gate reads. ⛔ Copy that assertion, not just the constant.

Boundary test — Bug/tidy, no manual floor

Declaring a population widens what derives on a change set; nothing published moves, no gate verdict changes on a built tree.

⚠️ Three things to verify before writing the hint — all named on the card, all easy to skip

1. hintCovers admits the spelling .objectui-sha/** (a dotfile with a /** suffix is not obviously handled — this seat reproduced hintCovers('.changeset', '.changeset/foo.md') === true earlier tonight on [finding] lint.yml says check-half-states.mjs yields "exactly ONE hint"; it yields four, and one of them routes every card that adds a changeset #15537, so dot-paths do work there, ⛔ but that is a directory, not a file).
2. check:watch-hint-literal rosters the name.
3. ⭐ The gate lives under packages/spec/scripts/ and is invoked through a pnpm filter — ⚠️ "check the derivation's handling of package-scoped gates." This is the one most likely to make a correct-looking hint still not fire, and it differs from both precedents, which are root-level scripts.

⛔ Not a hand list of citing files — they are discovered by regex on purpose. The declaration is .objectui-sha/** plus the packages/spec/src/** side it scans.

⛔ Not a claim, not a dispatch — routing only.

---

Generated by Claude Code