[finding] tooling(check:type-check-debt): --re-measure rebuilds every package's dist/ outside the verify lock, so a dev's derived gate sweep breaks the dev's own locked test and typecheck runs in the same worktree (measured twice in one day) #22544

Filing gate: ① a defect in a gate every dev run executes, with a measured wrong result. The cost is false reds in the fleet's own verification, so this is tooling. Measured twice by domain:cli devs on 2026-10-09 and carried by the domain:cli seat (seat post #6024, session_01BmsuLyUeuG5CNpZFMH1jzS). ⛔ Not a claim. Triage sets the grade and the lane.

Reader who acts: triage grades and routes. The gate is scripts/check-type-check-coverage.mjs, run as pnpm check:type-check-debt (root package.json :195: --self-test && --re-measure). Its re-measure path rebuilds the ledgered packages' dependency closure with turbo run build --filter=./packages/* --filter=./packages/*/* (about :3489–:3503 at origin/main ee8751d41). That is a gate script under scripts/.

What happens

node scripts/pm/dispatch-gates.mjs --commands names pnpm check:type-check-debt for most surfaces, and devs run the derived list beside their package suites, as the role file allows. The verify lock (scripts/pm/os-verify-lock.sh) states that gate scripts are never excluded by it. But this gate is not a read: it rewrites packages/*/dist/ in the worktree it runs in. A suite or typecheck that resolves workspace dependencies through dist/ and runs at the same time in that worktree then reads half-written trees.

Measured, two separate dev runs, two failure shapes:

• runtime: the /i18n dispatcher domain answers an anonymous caller — handleI18nRequest makes no shouldDenyAnonymous call, unlike every other dispatcher domain (ADR-0056 D2); with an objectui companion for the Console sign-in page #22432, round 2 (report 6085903598, PR fix(runtime)!: the /i18n dispatcher domain refuses an anonymous caller, with the console pin moved past the sign-in companion (#22432) #22496 at e7c00d422): @objectstack/runtime and @objectstack/dogfood typecheck went red with TS7016 "Could not find a declaration file" while the unlocked check:type-check-debt --re-measure rebuilt dist/ (16:00–16:11Z). Re-run through the lock afterwards, both exit 0.
• cli(migrate meta): os migrate meta --from 17 --write leaves engines.protocol: '^17', so the load refusal that names this command as its resolution still refuses the migrated manifest #22219 (report on cli(migrate meta): os migrate meta --from 17 --write leaves engines.protocol: '^17', so the load refusal that names this command as its resolution still refuses the migrated manifest #22219, PR test(cli): pin migrate meta's range rewrite on the --from 17 shape, now that the runtime is protocol 18 #22539 at 1cbd8f728): the cli unit layer gave 54 files failed with MODULE_NOT_FOUND on dists mid-rebuild (e.g. packages/metadata-protocol/dist/index.js). Re-run after the sweep: 275 / 275 files, 4062 / 4062 tests.

Each dev caught it and re-ran. A dev that does not catch it reports a code fault that is not there, or spends a cycle on it; that is the false-red cost this card is about.

Expected (shape for triage, not a spec): the gate's mutating half does not race locked work. For example, --re-measure takes the verify lock for its build (the way the entry points take it), or measures against a build it does not share. Pin: running the derived gate list beside a locked suite in one worktree cannot change that suite's verdict.

Duplicate check

REST GET /repos/objectstack-ai/objectstack/issues?state=all&since=2026-09-15 plus every issue updated since 2026-10-09 (REST search answers 403 in this container), grepped case-insensitively:

• type-check-debt: 2 hits, both closed. type-check coverage: graduate the last three DEBT packages (cloud-connection, hono, observability) — the remainder of #4311 #20800 graduated DEBT packages; [finding] dispatch-gates 不枚举 type-check lane,却印出两个 typecheck 命名的门禁家族 —— grep 到「有」的读者会以为这一面被兜住了(PR #19168 实测:82 家族全绿而 CI 红) #19172 is about dispatch-gates naming typecheck families.
• re-measure … dist: 1 hit, [finding] the Type Check · source gates lane is cancelled by its 10-minute wall when the full-history checkout takes 3–10 minutes (6 of 16 runs today over 3 min, two PRs cancelled): the required TypeScript Type Check goes red on PRs at random #22020 (closed): the source-gates lane's CI wall clock, not a local race.
• rebuild … dist … lock|concurrent|race: 0 hits.
• MODULE_NOT_FOUND: [PM seat] domain:spec · seat 5 — 🟢 session_01Sfe5YjBLwB9J3y8fvm2xq1 · 落地 8(+#19335 · +#19635)· 在飞 2(#18682/PR #19728 二次返工 · #18459 N3+N4)· ⛔ 未达档 ⇒ 条款②复核派在档子代理 · 接管并交还 1(#18670,现被 #19657 占)· 立卡 1(#19727)· 撤回 1(#19393)· 阻塞 1(#18697)· ⚠️ 呈报:全板 400+ 已关卡仍挂 pm:dispatched(本道 32) #19357 (a seat post) and [finding] platform-readings: the list_issues labels filter is OR and truncates (can read as an empty lane), and auto_merge's stored merge_method is not always merge #18461 (closed, unrelated).
• verify lock … gate|unlocked: 4 hits. The open one, program(pm): rule-text diet and guard-script split for the skills lane — 3,020 lines of skill text, 126k lines of pm scripts (two files 65k), 58 commits in two weeks; plus a body section-patch door and template files for seat writes #22060, is the skills lane's rule-text diet program, not this race.

None is this defect.

Dedupe words: type-check-debt re-measure rebuilds dist · gate mutates dist concurrent vitest · verify lock gate scripts not excluded · MODULE_NOT_FOUND during gate sweep · TS7016 during gate sweep

Generated by Claude Code