fix(spec): re-measure the four #9881/#9972 objectui pin citations at the current pin, and gate the class (#10439)

* fix(spec): re-measure the four #9881/#9972 objectui pin citations and gate the class

Fixes #10274

* docs(spec): regenerate the expression-bindable-text-keys reference for the normalized pin citation

The module docblock feeds content/docs/references/ via gen:docs, so the
citation-spelling normalization propagates. Generated, not hand-edited:
pnpm --filter @objectstack/spec gen:schema && ... gen:docs

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Jack Q

.github/workflows/lint.yml

@@ -2147,6 +2147,34 @@ jobs:
       - name: Check every shipped template manifest satisfies TemplateManifestSchema
         run: pnpm --filter @objectstack/spec check:template-manifests
 
+      # [#10274] The read-point records in packages/spec/src cite the objectui
+      # commit their file:line anchors were counted in — "the objectui pin this
+      # repo builds against (`.objectui-sha` = `<sha>`)". That sentence is what
+      # makes a record RE-CHECKABLE, and it is the entire justification #9881 /
+      # #9972 were filed on after #9397 spent a full dispatch cycle re-deriving
+      # one read point from scratch.
+      #
+      # Nothing linked the sentence to the pin file. #10137 bumped `.objectui-sha`
+      # and four records went on naming a pin this repo does not build against —
+      # not WRONG (the anchors held) but UNVERIFIABLE, which is the exact state
+      # they were written to end. Prose has no dependency edge, so the class
+      # recurs silently on every bump. This gate is the edge.
+      #
+      # It checks only the ASSERTING spelling. `.objectui-sha` pin `<sha>` is a
+      # dated record of where a past measurement was taken (#5010 absorbed at
+      # `09987b68`, a renderer's branch semantics at `665661ab0932`) and a later
+      # bump does not falsify it; forcing those forward would demand re-measuring
+      # settled history on every bump. A sha named in NEITHER spelling fails
+      # loudly rather than being skipped — an unrecognised spelling is how a
+      # source scan loses a citation silently.
+      #
+      # Reads `src/` and the root pin file only — no build — so it belongs in
+      # this pre-build source-audit group. Unfiltered and required: a paths
+      # filter on packages/spec/** would go dormant on exactly the PR that moves
+      # `.objectui-sha`, which is the PR this exists to catch.
+      - name: Check spec pin citations still name the pin this repo builds against
+        run: pnpm --filter @objectstack/spec check:objectui-pin-citations
+
   # Lane 2 of 4 behind the required `TypeScript Type Check` context. The
   # aggregator job at the bottom of this file explains the split, holds the
   # contract, and is the thing the merge queue actually requires — read it

content/docs/references/ui/expression-bindable-text-keys.mdx

@@ -50,8 +50,8 @@ renderer happens to read.
 ## Why these rows (measured, not inferred)
 
 Rows are a RECORD of what each component renderer already reads back from
-the node's top level, measured at the objectui pin (`.objectui-sha`
-`82a9417`, re-verified identical at objectui `origin/main` `6c68b13` on
+the node's top level, measured at the `.objectui-sha` pin `82a9417`
+(re-verified identical at objectui `origin/main` `6c68b13` on
 2026-08-18) — declaring a key a renderer does not read back would recreate
 the evaluated-but-blank half of the objectui#4795 table:
 

packages/spec/package.json

@@ -217,6 +217,7 @@
     "check:exported-any": "tsx scripts/check-exported-any.ts --self-test && tsx scripts/check-exported-any.ts",
     "check:dual-source-exports": "tsx scripts/check-dual-source-exports.ts --self-test && tsx scripts/check-dual-source-exports.ts",
     "check:browser-reachable-entries": "tsx scripts/check-browser-reachable-entries.ts --self-test && tsx scripts/check-browser-reachable-entries.ts",
+    "check:objectui-pin-citations": "tsx scripts/check-objectui-pin-citations.ts --self-test && tsx scripts/check-objectui-pin-citations.ts",
     "check:authorable-surface": "OS_EAGER_SCHEMAS=1 tsx scripts/build-schemas.ts --check",
     "gen:migration-registry": "tsx scripts/build-migration-registry.ts",
     "check:migration-registry": "tsx scripts/build-migration-registry.ts --self-test --check",

packages/spec/scripts/check-generated.ts

@@ -260,6 +260,24 @@ const NO_GENERATOR: ReadonlyArray<{ check: string; why: string }> = [
     check: 'check:scripts-typecheck',
     why: 'type-checks packages/spec/scripts/** (the generators and gate scripts themselves) under tsconfig.scripts.json — no artifact, and no debt ledger by design (#5475)',
   },
+  // #10274. Audits this package's own PROSE: a read-point record that says
+  // "`.objectui-sha` = `<sha>`" is asserting the pin this repo builds against,
+  // and #10137 moved the pin under four such records without anything failing.
+  //
+  // NO_GENERATOR, and here the classification is the SAFETY PROPERTY rather than
+  // a bookkeeping choice. The `gen:` a reader would reach for — rewrite each
+  // cited sha to the pin file — is the one operation this gate must never offer:
+  // the sha is not the record, the objectui file:line anchors beside it are, and
+  // they are only true of the tree they were counted in. Regenerating the sha
+  // alone would leave every record CLAIMING the current pin while its anchors
+  // still described the old one, i.e. it would convert a loud "unverifiable" into
+  // a silent lie. #10274 measured that as real, not theoretical: re-measuring the
+  // four records found two anchors that had been wrong since they were written.
+  // A failure here is always a re-measurement, never a command.
+  {
+    check: 'check:objectui-pin-citations',
+    why: 'audits spec source prose: a citation in the asserting spelling (`.objectui-sha` = `<sha>`) must equal the root pin file — no artifact, and deliberately no `gen:`, because rewriting the sha without re-measuring the anchors beside it is the failure mode (#10274)',
+  },
 ];
 
 /**