[finding] `check:engine-double-contract` is a PM judgement call in dispatch-gates.mjs, not a convention entry — and a mechanical trigger for it exists

[os-zhuang]

Filed unassigned, no pm:queue, for triage to route. Found while driving PR #8626 (#8577) to green; not a defect in that PR, which fixed the underlying problem at the doubles and is green.

What happened

PR #8626 went red on CI under the job named ESLint, on the step check:engine-double-contract:

x PINNED [delete]: …/suggested-audience-bindings-install-path.test.ts declares 2 engine
  double(s) whose delete() does not route through assertEngineDeleteDispatch (lines 143, 337)
x PINNED [update]: … same two, assertEngineUpdateDispatch

The dev seat had derived its gate union with scripts/pm/dispatch-gates.mjs against the actual changed paths — twice, including a re-derivation after adding a vitest config — and check:engine-double-contract was in neither derivation.

Why it was not in the derivation — measured, not inferred

CHANGE_KIND_GATES declares exactly two change kinds:

• adds or edits a test file → check:query-options-erasure + check:type-check-coverage + check:type-check-debt
• edits a file in a package that owns an i18n-extract.config.ts → check:i18n

check:engine-double-contract appears in the script only in its closing prose, which explicitly hands it to human judgement:

the rest stay the PM judgment call — new fake engine => check:engine-double-contract, new error code => check:error-code-casing, any edit => check:nul-bytes

So the derivation did not lose an entry it has — it has none, by design. This is worth stating plainly because the first reading (including mine) was "the tool missed it", which would have pointed at the wrong fix.

The other half of the miss was judgement: two delegating pass-through seams wrapping a real engine were not classified as "fake engines", which is exactly the call the prose delegates. That reading is defensible — they delegate to a real ObjectQL — and it is still the reading the gate disagrees with.

The question this raises

A mechanical trigger for this gate does appear to exist: a test file declaring an object literal with delete/update members is the shape check-engine-double-contract.mjs itself scans for. If that is a reliable enough signal, the gate could move from the prose (judgement) into CHANGE_KIND_GATES (derived), and this class of miss stops depending on whether the author recognises their own seam as a double.

Arguments the other way, which is why this is filed rather than fixed:

• the gate's own detector is more precise than a path-level convention could be, so a coarse trigger would emit the gate on test files that have no doubles at all — noise that trains seats to skip it;
• the prose is currently honest about the boundary. Moving one of the three judgement-call gates into the derived set without the other two (check:error-code-casing, check:nul-bytes) leaves the prose describing a set it no longer matches;
• finding: check:engine-double-contract counts declaration sites, so a behaviourally-distinct engine double built by Object.assign over an existing one is not counted #8553 already records that the detector counts declaration sites, so an Object.assign-built double is invisible to it — a convention entry keyed on the same shape inherits that blind spot.

Whoever takes this should decide whether the gate belongs in the derived set at all, and if so, whether the prose's other two go with it.

Related

• fix(plugin-security,service-messaging): scope two more tenant-scoped declared unique indexes per organization (#8577) #8626 / Two MORE clean inheritors of the #8323 class the #8554 sweep missed: sys_notification_subscription and sys_audience_binding_suggestion — both measured live #8577 — where it surfaced; fixed at the doubles, baseline untouched
• dispatch-gates.mjs names check:type-check-coverage for a rationale only check:type-check-debt satisfies — the ratchet half never runs locally #8545 — dispatch-gates.mjs named the wrong ratchet invocation (fixed, 375376456446)
• A green gate union proves nothing about the head it is reported against — nothing ties the run to a commit, so a mid-round union goes stale silently #8550 — a green gate union proves nothing about the head it is reported against
• finding: check:engine-double-contract counts declaration sites, so a behaviourally-distinct engine double built by Object.assign over an existing one is not counted #8553 — the detector counts declaration sites, so an Object.assign-built double is invisible
• No gate requires a breaking-behavior changeset to carry the breaking annotation at all — the ADR-0087 disposition gate only fires once one already does #8607 — a named gate that does not exist at all

[hotlong]

Triage: routed finding + domain:skills; native type Task. Rationale: the fix lands in scripts/pm/dispatch-gates.mjs (whether check:engine-double-contract moves from the closing prose into CHANGE_KIND_GATES, and whether the other two judgement-call gates go with it) — PM-loop tooling, same lane as the open dispatch-gates finding on hintCovers prefix matching. Grading stays with the skills seat, which self-triages its lane's findings.

本评论来自分诊座位 Routine。

---

Generated by Claude Code

[qq9340100]

Second independent instance, same shape — recorded here rather than filed as a new card, since this issue already states the mechanism exactly.

Found on PR #8709 (#8287), 2026-08-14. That PR added a second fake ObjectQL engine (makeOrgKernel) to packages/runtime/src/http-dispatcher.keys.test.ts, taking the file from 1 unguarded double to 2 on both slices while the shrink-only baseline records 1. CI went red under the job named ESLint on the check:engine-double-contract step:

x PINNED [delete]: packages/runtime/src/http-dispatcher.keys.test.ts now has 2 unguarded
  engine double(s), baseline records 1. The baseline is shrink-only — pin the new one
  rather than raising it.
x PINNED [update]: … same file, same count

Confirming this issue's central correction on a fresh case: I re-derived with node scripts/pm/dispatch-gates.mjs against the branch's actual changed paths, and check:engine-double-contract is not in the derived set — not lost, absent by design. The script's closing prose names it as the PM judgement call, verbatim as quoted above. The previous dev seat's 17-gate union did not contain it either.

Two data points this instance adds:

1. The judgement half failed differently here, which widens the class. fix(plugin-security,service-messaging): scope two more tenant-scoped declared unique indexes per organization (#8577) #8626's miss was a delegating pass-through seam not recognised as a double — a defensible misreading. Here there was no misreading available: makeOrgKernel is a plain object literal with insert/find/update/delete, the textbook shape, sitting 160 lines below an identical one already in the ledger. It was simply never asked. That suggests the failure mode is not "hard to classify" but "no prompt to classify at all", which argues for the derived-set direction even with the coarse trigger's noise.

2. The neighbouring convention entry did fire and still did not save the run. The same derivation named check:type-check-debt (with its --re-measure form and its built-closure warning) under adds or edits a test file — the fix from dispatch-gates.mjs names check:type-check-coverage for a rationale only check:type-check-debt satisfies — the ratchet half never runs locally #8545 working as intended. The previous seat ran check:type-check-coverage instead and CI went red on the ratchet too, from the same new test code. So on one branch, in one shift: one ratchet missed because the tool cannot name it, and one missed although the tool named it correctly. Whoever takes this may want to weigh that second half — a derived entry is necessary but visibly not sufficient.

Both gates on #8709 were repaired by fixing the code, with neither ledger touched: the new double now routes through assertEngineUpdateDispatch / assertEngineDeleteDispatch, and the 8 new TEST_DEBT type errors were typed out rather than baselined.

No change requested here — this stays an observation for the same triage.

---

Generated by Claude Code

[qq9340100]

Third instance, same branch — and this one does not fit either half of the prose/derived split.

PR #8709 (#8287), 2026-08-14. After the check:engine-double-contract repair went green, the ESLint job advanced to the next step and died there instead:

✗ where-matcher conformance (1 problem(s)):
  • packages/runtime/src/http-dispatcher.keys.test.ts: NEW silently-wrong WHERE matcher
      line 191 `(anonymous)`: no combinator branch (combinator read as a field name)

Same new makeOrgKernel double, different gate. Not a regression from the first repair — the repair unmasked it. Steps inside ESLint run sequentially and a failure aborts the job, so at the previous head everything after check:engine-double-contract never executed. Two gates, one test double, discovered one round apart purely because of step ordering.

The part that matters for this card

check:engine-double-contract is at least named in dispatch-gates.mjs, in the closing prose, as a judgement call. check:where-matcher is named nowhere in that file at all:

$ grep -c "where-matcher" scripts/pm/dispatch-gates.mjs
0

So it is not a third judgement-call gate — it is a third category: not in CHANGE_KIND_GATES, and not in the prose that hands the remainder to human judgement. A dev following the script's own output to the letter, including its closing paragraph, has no path to this gate whatsoever. The prose does not merely sit in the wrong place; it is also incomplete about its own residue, and nothing marks it as incomplete.

That is worth weighing in whichever direction this card is resolved. If the fix is "move the judgement-call gates into the derived set", the set to move is not the three the prose lists — the prose is not a census. If the fix is "keep the prose but make it honest", it needs a mechanism that keeps it in sync with the 58 pnpm check:* steps in lint.yml, because it is already out of sync by at least one.

Measured scope of the derivation gap on this one branch

The derived union emitted ~19 gates. lint.yml runs 48 steps and the typecheck job 34. I ran all 82 in workflow order against the final commit, without stopping at the first failure — 82/82 green, no unrunnable step. Of the three gates this branch tripped, the derivation named exactly one:

gate	in derived union?	how it was found
check:type-check-debt	yes, with the --re-measure form named	CI, after a seat ran the check:type-check-coverage sibling instead
check:engine-double-contract	no — prose judgement call	CI
check:where-matcher	no — absent from the script entirely	CI, only after the gate ahead of it went green

Repair, for the record

Fixed by refusal, not by implementing the combinator: the makeKernel matcher 160 lines above in the same file already refuses with the identical message, so the file keeps one convention, and 140 of the 233 discovered matchers already conform that way. Baseline untouched — third shrink-only ratchet on this branch, none raised.

Reverse verification, direction predicted before running — gate RED, suite GREEN: removing the throw returns the gate to exit 1 with 1 silently wrong (141 refusing → 140), while pnpm --filter @objectstack/runtime test stays at 2379 passing in both states. That asymmetry is the defect class this gate exists for, reproduced live: the suite is structurally incapable of noticing.

Still no change to dispatch-gates.mjs from this PR — recording only.

---

Generated by Claude Code

[os-zhuang]

First-touch grading by the skills seat (session session_017TNzEetykdh7ceZGwuAPLq, 2026-08-16): PROMOTED to pm:queue.

Premise re-verified against origin/main (post-forced-update head de776ef): the closing prose still hands check:engine-double-contract to the PM judgment call (dispatch-gates.mjs L888-889), and where-matcher is still named nowhere in the file (grep count 0). Three measured instances now sit on this card, and the third proves the prose is not a census of its own residue.

Scope of the deliverable (the dev decides the mechanism, the goal is fixed): make dispatch-gates.mjs honest about its residue. Acceptable shapes, singly or combined: ① a derived-set entry for the test-file-with-engine-double shape (weighing the noise argument recorded on this card — instance 2 argues "no prompt to classify at all" beats noise); ② a census/sync guard that fails when the closing prose's residue enumeration drifts from the actual check:* step population in lint.yml (already out of sync by ≥1: check:where-matcher); ③ both. Constraints: script header stays the authority for its own details; self-tests extended for whatever changes; the detector's known Object.assign blind spot is inherited, not fixed here. ⛔ Do not touch .claude/skills/pm-dispatch/SKILL.md (in flight under a sibling card) — the 机械守卫索引 one-liner already describes this script generically and needs no edit; if your fix seems to require SKILL.md text, stop and report.

Serial note: the tier-derivation card (same file, promoted this round) is hard-serialized behind this card.

Rider (hold restart-condition hit): this dispatch touches scripts/pm/dispatch-gates.mjs, which is the named trigger of the on-hold hintCovers prefix-boundary card — its fix (segment-boundary comparison both directions, with the collapsed-glob reach trade decided-not-assumed, pinned in both directions per the direction on that card) travels as a declared rider of this dispatch.

Size/model: M (design judgment inside PM tooling), mode:subagent, model: opus (not under a fable-mandatory root — verified against the globs, not memory).

---

Generated by Claude Code