fix(pm): make dispatch-gates see the metadata TYPE registry's i18n coupling

[os-project-manager]

Fixes #9144

What

walkMetadataForms (packages/cli/src/utils/i18n-extract.ts) emits the metadataForms i18n surface from two producers. Only one — METADATA_FORM_REGISTRY's 17 *.form.ts modules — was discoverable by scripts/pm/dispatch-gates.mjs, via the edits a metadata form module CHANGE_KIND_GATES entry #9116 added. The second — DEFAULT_METADATA_TYPE_REGISTRY (packages/spec/src/kernel/metadata-plugin.zod.ts) and METADATA_FORM_REGISTRY itself (packages/spec/src/system/metadata-form-registry.ts, the map, not its *.form.ts leaves) — derived nothing: neither file carries the .form.ts filename convention, so editing a type-level label or adding/removing a registry entry moved the same platform-objects bundles PR #9113 had to regenerate, invisibly to the derivation.

Route taken, and why

Per the card's own analysis, this edge is not a runtime-enumerated population like the other two check:i18n CHANGE_KIND_GATES entries — it is exactly two known files. That is the shape SURFACE_MODULE (check-i18n-bundles.mjs, #9116) and check-type-check-coverage.mjs's ROOT_PROGRAM_COUPLED_SCRIPT already use, so this closes it the same way: two bare module-body path-literal constants (METADATA_TYPE_REGISTRY_MODULE, METADATA_FORM_REGISTRY_MODULE) declared directly in check-i18n-bundles.mjs — the one script check:i18n's invocation resolves to — read by the ordinary path-literal derivation. No new CHANGE_KIND_GATES entry, no matches function, nothing to keep in sync at runtime.

Identifier discovery (walking for the export const declarations) was the other live candidate and is genuinely more self-reporting, but the card measured no cheap bound on its ~925-file-per-run cost and this dispatch didn't find one either — a fixed two-file constant is exactly as expensive per run as identifier discovery would be per changed file, with none of the walk cost. Widening to packages/spec/src stays disqualified per #9116.

How the coupling constants are kept from rotting silently

This is the same open question every reader of SURFACE_MODULE/ROOT_PROGRAM_COUPLED_SCRIPT would ask, and the precedent's answer is copied exactly: scripts/pm/dispatch-gates.mjs's own self-test now pins, against the real files:

• check-i18n-bundles.mjs's live-extracted hints cover both declared paths;
• a card editing either path is classified matched through that exact hint (not silent);
• both declared paths existsSync on disk.

Delete either constant, rename either module, or let the registries merge, and this self-test reddens instead of the derivation silently going blind on this edge again — check:pm-dispatch-gates runs it unconditionally in CI.

Verified before building

Re-confirmed on origin/main @ 88f97d528 (post #9188, post #9202):

• both producers exist as the card describes and still feed walkMetadataForms (packages/cli/src/utils/i18n-extract.ts:919-947);
• the 17-files/17-entries coincidence still holds: find packages/spec/src -name '*.form.ts' | wc -l → 17, and METADATA_FORM_REGISTRY's object body → 17 keys, matching exactly;
• DEFAULT_METADATA_TYPE_REGISTRY carries 27 entries (17 with a form, 10 form-less — datasource, job, translation, etc.), consistent with the "every entry including form-less types" claim.

Reverse verification (commit-first, per AGENTS.md): checked out the pre-fix (origin/main) versions of all three touched files over the committed fix, confirmed node scripts/pm/dispatch-gates.mjs packages/spec/src/kernel/metadata-plugin.zod.ts and the form-registry-module equivalent both scored not matched (reproducing the exact #9144 gap), then restored the committed fix (git checkout HEAD -- <paths>) and re-confirmed both now score matched with hits[0].hint equal to the exact path.

Not in scope

• Neither scripts/pm/dispatch-gates.mjs does not derive check:liveness for a packages/objectql/** path, but CI's Spec property liveness job runs on one — every dispatch tells devs to trust that derivation #9171 nor dispatch-gates discovers no family for a workflow verification step whose script is not named check-* — docs-drift-check.yml runs one on packages/** and the tool cannot mention it in any bucket #9187 is touched — this is the third, split edge.
• No change to check-i18n-bundles.mjs's own drift-detection logic; it already re-extracts fresh on every run regardless of which producer moved. Only the derivation's visibility was broken.

Tests

At commit 19b18303e (git rev-parse --short HEAD), under the shared flock verify lock:

$ pnpm check:pm-dispatch-gates
✓ dispatch-gates self-test: 249 cases pass.   (6 new: the type/form-registry coupling pins)

$ pnpm check:i18n
✓ check:i18n --self-test — bundle-drift, undeclared-authoring-key, missing-CLI-build and
  stale-workspace-dist classifiers all go red, and stay distinct.
  platform-objects               in sync (8 bundle(s))
  plugins/plugin-approvals       in sync (4 bundle(s))
  plugins/plugin-audit           in sync (4 bundle(s))
  plugins/plugin-security        in sync (4 bundle(s))
  plugins/plugin-sharing         in sync (4 bundle(s))
  plugins/plugin-webhooks        in sync (4 bundle(s))
  services/service-messaging     in sync (4 bundle(s))
  services/service-realtime      in sync (4 bundle(s))
  services/service-storage       in sync (4 bundle(s))
check-i18n-bundles: OK (9 package(s) — all bundles in sync, no undeclared authoring keys).

$ node scripts/check-nul-bytes.mjs --self-test && node scripts/check-nul-bytes.mjs
✓ check-nul-bytes --self-test: 75 assertions over a temp git repo (real scan() path)
check-nul-bytes: OK (scanned 6030 text file(s) -- ... skipped 5 binary; no raw ASCII control bytes).

Gate derivation re-run against the actual changed paths at this head named exactly check:i18n and check:pm-dispatch-gates — both run above.

Changeset

scripts/** only, publishes nothing — no .changeset/*.md. Applying skip-changeset after this PR opens (reading back the full label set first, per repo convention).

Generated by Claude Code

---

Generated by Claude Code