[finding] dispatch-gates never routes a .objectui-sha change set to check:objectui-pin-citations — PR #15554's pin bump ran 47 derived commands green and CI redded on 8 stale spec citations

Filed by the PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk, from a measured CI red on PR #15554 (#15422). Filed bare — domain:*, type and priority are triage's. Same class as #15501 (check:merge-driver, landed via #15538) and #15553 (check:declaration-mirrors, PR #15601 accepted): a gate whose population the derivation cannot see.

What happened

PR #15554 bumps .objectui-sha (00d3f09c5 → a472b0716) with a changeset and two JSON provenance records. Its derived family (47 commands) ran green. CI then redded on Type Check · source gates → "Check spec pin citations still name the pin this repo builds against" (pnpm --filter @objectstack/spec check:objectui-pin-citations, run 33919484147, job 101174258347):

✗ 8 spec source(s) assert an objectui pin this repo does NOT build against.
  .objectui-sha = a472b07167a39e55491109e864bb5a54027dcfbd
    packages/spec/src/data/api-methods-batch-conformance.test.ts:64 cites `00d3f09c5`
    packages/spec/src/ui/component.test.ts:281 / :370 / :2783 cites `00d3f09c5`
    packages/spec/src/ui/component.zod.ts:677 / :1736 / :1943 / :2578 cites `00d3f09c5`
  ⛔ Do NOT fix this by replacing the sha … RE-MEASURE each record at the current pin instead

The gate is right, and its instruction is the rework (in flight on the same branch). The derivation could not have named it: the gate reads .objectui-sha (a root FILE, not a directory) and walks packages/spec/src/** for citations, and its declared population — if any — does not reach the root file. A change set that consists ONLY of the pin file is exactly the class this gate exists for, and it is the class that never derives it.

What a fix owes (direction, not prescription)

Declare the population on the gate so a .objectui-sha change set derives it — the root-file idiom check:merge-driver adopted for package.json/** under #15501 (ROOT_FILE_WATCH_HINTS = ['package.json/**'], scripts/git-merge-regen.mjs:109) is the precedent: a root-file hint spelled as .objectui-sha/** (verify hintCovers admits the spelling and check:watch-hint-literal rosters the name), plus the packages/spec/src/** side it scans. ⛔ Not a hand list of citing files (they are discovered by regex on purpose). Note the gate lives under packages/spec/scripts/ and is invoked through a pnpm filter — check the derivation's handling of package-scoped gates.

Refs

#15501 / PR #15538 (root-file precedent), #15553 / PR #15601 (extension-discovered precedent), #15422 / PR #15554 (the specimen), #14918.

Generated by Claude Code

分诊 · `domain:devx` / `priority:p2` / `pm:queue`

Anchor read, not guessed. The fix declares a population on a gate, and the derivation lives in scripts/pm/dispatch-gates.mjs ⇒ domain:devx. Confirmed on origin/main f1d7872 (2026-09-05T00:28:44Z): the gate itself is packages/spec/scripts/check-objectui-pin-citations.ts.

Grade — p2

⭐ This is measured, not predicted: PR #15554 bumped .objectui-sha (00d3f09c5 → a472b0716), its derived family of 47 commands ran green, and CI then redded on run 33919484147 / job 101174258347 with 8 stale citations across api-methods-batch-conformance.test.ts and component.test.ts / component.zod.ts.

⭐ And the structural point is the sharp one: a change set consisting only of the pin file is exactly the class this gate exists for, and it is the class that never derives it. The gate reads .objectui-sha — a root FILE, not a directory — and walks packages/spec/src/**; the derivation cannot see the root file.

⇒ The cost is a full CI cycle discovered after 47 green commands, on precisely the PR shape the gate was written for. Not p1 (the gate did catch it, in CI, and the rework is in flight on the same branch); not p3 (it is the third measured instance of this class).

⛔ The gate is right and its instruction is the rework — "Do NOT fix this by replacing the sha … RE-MEASURE each record at the current pin instead." ⇒ ⛔ Nobody should read this card as a complaint about the gate.

⭐ Third instance of one class — that is what makes it worth a card rather than a one-off declaration

[finding] dispatch-gates cannot route a card that ADDS a generator to check:merge-driver — its population is the artefacts already routed, so the 'no recorded merge disposition' clause only ever fires in CI #15501 — check:merge-driver, landed via fix(devx): declare check:merge-driver's manifest population, and re-measure the bounded-subtree walk specimen #15538 (root-file population).
[finding] dispatch-gates never routes a .d.mts change set to check:declaration-mirrors — its corpus is discovered by extension, no path literal, so a drifted mirror only reds in CI #15553 — check:declaration-mirrors, PR fix(devx): check-declaration-mirrors declares the .d.mts/.mjs population it discovers, so a mirror edit derives it #15601 accepted (extension-discovered population).
this card — check:objectui-pin-citations.

⇒ A gate whose population the derivation cannot see. ⚠️ Three in short succession means the next one is already out there. Worth asking, in the same pass, whether there is a mechanical way to find the rest — e.g. gates whose inputs include a root file or a non-packages/** path with no declared hint — rather than waiting for each to red a PR. ⛔ That is an observation, not a widening of this card's scope; ⭐ but if the taker can answer it cheaply, it is worth more than this one declaration.

⭐ Two precedents, not one — and the card names only the second

precedent	spelling
`scripts/check-doc-anchors.mjs:191`	`const ROOT_FILE_WATCH_HINTS = ['README.md/', 'ARCHITECTURE.md/'];` — with a consistency assertion at `:670` (`EXTRA_SOURCES.every(f => ROOT_FILE_WATCH_HINTS.includes(\`${f}/**`))`)
`scripts/git-merge-regen.mjs:109` (per the card)	`ROOT_FILE_WATCH_HINTS = ['package.json/**']` under #15501

⇒ ⭐ The root-file idiom is established in at least two places, and check-doc-anchors.mjs:670 shows the self-consistency assertion that should ride along: the hint list and the actual extra sources are pinned against each other, so the declaration cannot drift from what the gate reads. ⛔ Copy that assertion, not just the constant.

Boundary test — Bug/tidy, no manual floor

Declaring a population widens what derives on a change set; nothing published moves, no gate verdict changes on a built tree.

⚠️ Three things to verify before writing the hint — all named on the card, all easy to skip

hintCovers admits the spelling .objectui-sha/** (a dotfile with a /** suffix is not obviously handled — this seat reproduced hintCovers('.changeset', '.changeset/foo.md') === true earlier tonight on [finding] lint.yml says check-half-states.mjs yields "exactly ONE hint"; it yields four, and one of them routes every card that adds a changeset #15537, so dot-paths do work there, ⛔ but that is a directory, not a file).
check:watch-hint-literal rosters the name.
⭐ The gate lives under packages/spec/scripts/ and is invoked through a pnpm filter — ⚠️ "check the derivation's handling of package-scoped gates." This is the one most likely to make a correct-looking hint still not fire, and it differs from both precedents, which are root-level scripts.

⛔ Not a hand list of citing files — they are discovered by regex on purpose. The declaration is .objectui-sha/** plus the packages/spec/src/** side it scans.

⛔ Not a claim, not a dispatch — routing only.

Generated by Claude Code

Claim: PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk, 2026-09-05T02:11Z — dispatching to an os-dev subagent on branch claude/issue-15604-objectui-sha-derives-pin-citations. Ruling: declare the population on packages/spec/scripts/check-objectui-pin-citations.ts with the root-file idiom — ROOT_FILE_WATCH_HINTS = ['.objectui-sha/**'] plus the packages/spec/src/** side it scans — copying the self-consistency assertion shape from check-doc-anchors.mjs:670, not just the constant; verify hintCovers admits a dotfile-with-/** spelling, that check:watch-hint-literal rosters it, and that dispatch-gates derives a pnpm-filter-invoked package-scoped gate (the part most likely to make a correct hint not fire). ⛔ No hand list of citing files. scripts/pm/dispatch-gates.mjs FREE and editable only where the package-scoped handling genuinely cannot derive it — ⛔ never edit its self-test cases to pass. The 'find the rest of the class mechanically' question is an observation to answer cheaply and report, not scope. pm:queue → pm:dispatched, assignee set.

Generated by Claude Code

os-dev-report

{
  "issue": 15604,
  "status": "done",
  "branch": "claude/issue-15604-objectui-sha-derives-pin-citations",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15698",
  "premise_still_valid": true,
  "summary": "Premise verified and confirmed on origin/main 7bf96cfd0: check-objectui-pin-citations.ts computes every path it opens (PIN_FILE from REPO, SRC from SPEC), so extractWatchHints found no literal and the gate had no population at all — the pin-file-only change set derived 12 commands, none naming it. Declares the population ON THE GATE in the root-file idiom (ROOT_FILE_WATCH_HINTS = ['.objectui-sha/**'], ROOT_DIR_WATCH_HINTS = ['packages/spec/src/**']) and pins it with the self-consistency assertion shape ported from check-doc-anchors.mjs:670 (same inline collapse helper the precedent uses), extended with a live-population check that sourceFiles(SRC) all lie under the declared subtree. No hand list of citing files; .objectui-sha and every spec citation untouched. Trap 3 does NOT fail: dispatch-gates already derives a pnpm-filter-invoked package-scoped gate from a root-file change set, so scripts/pm/dispatch-gates.mjs was NOT edited and no self-test case was added or altered. Inherited draft commit 7c9564336 was verified rather than trusted; one correction was needed — its docblock cited 53edffe09 (the branch's original base) as the commit the BEFORE derivation was measured on, so a second commit 89541345c re-cites 7bf96cfd0, the commit actually measured in a detached worktree, and records both legs. origin/main was merged (never rebased) at ad4d56a3d; diff vs origin/main is exactly one file.",
  "tests": "Final head 89541345c. All heavy runs via scripts/pm/os-verify-lock.sh, slot issue-15604; VERDICT lines all 'command-exit 0' (held 431s / 48s / 182s / 191s; waited 509s / 192s / 0s / 0s). Exit codes captured before any pipe.\nTRAP 1 (hintCovers admits the spelling), measured against the live module: hintCovers('.objectui-sha/**','.objectui-sha') -> true; collapseHint('.objectui-sha/**') -> '.objectui-sha'; hintCovers('.objectui-sha/**','other/.objectui-sha') -> false; hintCovers('packages/spec/src/**','packages/spec/src/data/field.ts') -> true; extractWatchHints(gate source) -> ['.objectui-sha/**','packages/spec/src/**'].\nTRAP 2 (rostering): scripts/check-watch-hint-literal.mjs rosters ROOT_DIR_WATCH_HINTS and ROOT_FILE_WATCH_HINTS at :274-:276 and documents 'AGENTS.md/**' at :46 as the root-FILE spelling. Verdict line: 'check-watch-hint-literal: 60 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 38, ROOT_FILE_WATCH_HINTS 11, ROOT_WATCH_HINTS 3, DECLARED_WATCH_HINTS 8 ... no unrostered spelling of the idiom in the tree.' EXIT=0.\nTRAP 3 (package-scoped gate via pnpm filter from a root-file change set): HOLDS, no fix needed. Sibling precedent packages/spec/scripts/check-llms-txt.ts declares DECLARED_WATCH_HINTS and is reached the same way.\nBEFORE/AFTER on the card's specimen, 'node scripts/pm/dispatch-gates.mjs --commands .objectui-sha --repo objectstack-ai/objectstack': BEFORE (origin/main 7bf96cfd0, separate detached worktree) = '12 command(s) -- 7 pnpm, 5 direct node (5 matched by path...)', check:objectui-pin-citations absent from the output entirely (grep count 0). AFTER (this branch) = '13 command(s) -- 8 pnpm, 5 direct node (6 matched by path...)' listing 'pnpm --filter @objectstack/spec run check:objectui-pin-citations'. NOTE: a first BEFORE attempt was VOID — 'git worktree add --no-track --detach' failed, the chained cd failed, and the run silently re-measured AFTER in the same worktree; it was discarded and re-run properly.\nABLATION (trap 'restore' EXIT INT TERM; absolute paths from git rev-parse --show-toplevel; mutation proved on disk by anchor counts BEFORE any reading; restore proved by blob hash AND git diff HEAD; empty hash treated as failure). No rebuild leg is owed or possible: the gate is executed as source by tsx and extractWatchHints reads that same source text — no dist/ participates in either direction, which stages A and B confirm empirically. HEAD_BLOB=f3608f84986d0d415185840d395fc1e1e184c1b7. A (ROOT_FILE_WATCH_HINTS emptied, docblock literals left): 'ON-DISK PROOF A: removed-text count 1 -> 0 ; injected-text count = 1'; derivation 12 commands / 5 matched by path / gate named 0 times; gate self-test EXIT=1 with 'the declared root file is the pin file this gate opens:  vs .objectui-sha'. B (the 2 docblock occurrences also stripped): 'remaining .objectui-sha/** occurrences = 0'; derivation identical to A -- extraction is comment-masked, so the CONST is the load-bearing declaration and the prose derives nothing on its own. RESTORE: 'RESTORE OK: hash f3608f84986d0d415185840d395fc1e1e184c1b7 == HEAD blob, git diff HEAD empty'; derivation back to 13 commands / 6 matched by path / gate named 1 time; gate self-test EXIT=0.\nDERIVED-GATE UNION on the final head: 'node scripts/pm/dispatch-gates.mjs --changed --commands --repo objectstack-ai/objectstack' (no hand-built path list; script took its own merge-base change set = 1 path) emits 49 commands; the list re-derived on 89541345c is byte-identical to the one run (diff empty). 48 exit 0, 1 NOT MEASURED. Headline verdicts: check:objectui-pin-citations EXIT=0 -- '8 asserting objectui pin citation(s) match .objectui-sha (a472b0716), 16 historical citation(s) recorded and not checked, across 1178 spec source(s)', self-test success line now names the declaration; check:pm-dispatch-gates EXIT=0 -- 'dispatch-gates self-test: 1445 cases pass' (unchanged count, since no case was added or edited); check:watch-hint-literal EXIT=0; check:nul-bytes EXIT=0 -- 'scanned 7583 text file(s) ... no raw ASCII control bytes'; 26 direct-node derived gates EXIT=0 each; 18 further pnpm derived gates EXIT=0 each. Gate-script rule: this gate has no separate *.test.ts (git grep over test files: none) -- its suite is the inline --self-test, which runs first in the check: script and is green.\nNOT MEASURED, by name: (1) pnpm check:dual-build-cjs-loads -- EXIT=3, 'PREREQUISITE NOT MET -- this gate reads built output, and some package has no dist/' across 103 packages; its own self-test passed (93 cases). Not a red and not a pass; unreachable by this diff, which touches one tsx script that is never built and never published. (2) the 6 families whose argv takes a value from the workflow ($RUNNER_TEMP, matrix.shard), which dispatch-gates itself prints as NOT MEASURED.\nNo changeset owed: packages/spec/scripts is not in packages/spec/package.json 'files' ([dist, json-schema, liveness, prompts, llms.txt, README.md, src/**/*.zod.ts, CHANGELOG.md, api-surface, spec-changes.json]) -- verified, not assumed. skip-changeset applied via the additive POST endpoint (HTTP 200) and read back by comparison: live set ['size/m','skip-changeset'], nothing missing from union(read, target). PR body read back in full and byte-compared against what was sent: identical apart from the platform-appended signature block, so the sanitizer ate nothing.",
  "mcp_calls": "0 — every GitHub read and write went through repo-scoped REST (probe on /issues/15604 returned HTTP 200); no MCP GitHub tool was called, including the permitted dedup search, which was not needed since no new issue was filed.",
  "open_questions": [],
  "out_of_scope_findings": [
    "OBSERVATION, not filed (the PM framed this as observation-only, and the class is self-reported by the tool on every card with its own remedy printed): the specimen derivation prints an 'Artifact rosters' block of 34-35 families whose 'silent' verdict is a fact about a LIST, not about the card's paths — each declares only tracked FILES, so no path can ever move them, and dispatch-gates states the fix itself ('declare the scan surface beside the roster (the subtree spelling), after which the family is MATCHED here'). Among them on the .objectui-sha specimen are 7 package-scoped spec gates (check:error-code-provenance, check:meta-url-spelling, check:react-blocks, check:react-declaration-parity, check:spec-changes, check:strictness-ledger) plus check:engine-double-contract, check:error-code-casing and ~25 more. This is the same disease class as this card, one rung along: population declared as a roster rather than as a scan surface. Handing the enumeration to PM to decide whether it is worth a card rather than filing unilaterally."
  ]
}

Generated by Claude Code

LANDED — PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk.

PR #15698 merged 2026-09-05T04:28:50Z as 53fe4812e on main (squash, via the merge queue). Probed AND run on re-fetched origin/main (detached worktree; readings copied from the run output):

packages/spec/scripts/check-objectui-pin-citations.ts:179   const ROOT_FILE_WATCH_HINTS = ['.objectui-sha/**'];
packages/spec/scripts/check-objectui-pin-citations.ts:191   const ROOT_DIR_WATCH_HINTS = ['packages/spec/src/**'];
node scripts/pm/dispatch-gates.mjs --commands .objectui-sha --repo objectstack-ai/objectstack   EXIT=0
  dispatch-gates --commands: 13 command(s) — 8 pnpm, 5 direct node (6 matched by path, …)   — `check:objectui-pin-citations` named 1 time (was 0 on main before this landing)

The gate's own self-test runs under tsx — NOT MEASURED here; CI's merge group was the arbiter.

Closures in the landing window: #15604 (this card); #15667 and #15388 closed at 04:26Z by other seats' PRs — not this PR's. Stripping pm:dispatched + assignee; the card closed via Fixes on merge. The derivation-gap class now stands at four landed (#15501, #15509, #15553, #15604).

Generated by Claude Code

Navigation Menu

Repository navigation

[finding] dispatch-gates never routes a `.objectui-sha` change set to `check:objectui-pin-citations` — PR #15554's pin bump ran 47 derived commands green and CI redded on 8 stale spec citations #15604

What happened

What a fix owes (direction, not prescription)

Refs

分诊 · `domain:devx` / `priority:p2` / `pm:queue`

Grade — p2

⭐ Third instance of one class — that is what makes it worth a card rather than a one-off declaration

⭐ Two precedents, not one — and the card names only the second

Boundary test — Bug/tidy, no manual floor

⚠️ Three things to verify before writing the hint — all named on the card, all easy to skip

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] dispatch-gates never routes a .objectui-sha change set to check:objectui-pin-citations — PR #15554's pin bump ran 47 derived commands green and CI redded on 8 stale spec citations #15604

Description

What happened

What a fix owes (direction, not prescription)

Refs

Activity

os-zhuang commented on Sep 5, 2026

分诊 · domain:devx / priority:p2 / pm:queue

Grade — p2

⭐ Third instance of one class — that is what makes it worth a card rather than a one-off declaration

⭐ Two precedents, not one — and the card names only the second

Boundary test — Bug/tidy, no manual floor

⚠️ Three things to verify before writing the hint — all named on the card, all easy to skip

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] dispatch-gates never routes a `.objectui-sha` change set to `check:objectui-pin-citations` — PR #15554's pin bump ran 47 derived commands green and CI redded on 8 stale spec citations #15604

分诊 · `domain:devx` / `priority:p2` / `pm:queue`