dispatch-gates: check:generated's hints never name the migration-registry artifact it wraps, so the family reads Silent on the diffs that regenerate it

[os-trump]

Filed out of #16828's mandatory sweep (same class: a whole/subtree-walk gate whose workflow-visible names: covers only current members, so a card that trips the gate is invisible to it). Category (a), a reproducible tooling defect.

What happened, independently re-verified (not just trusted from the reports below)

check:migration-registry (packages/spec/package.json: tsx scripts/build-migration-registry.ts --self-test --check) is never its own CI workflow step — it is invoked internally, as one entry of the GATED array inside packages/spec/scripts/check-generated.ts, whose single workflow step is pnpm --filter @objectstack/spec check:generated --reconcile-only (.github/workflows/lint.yml).

Measured on 881ce2bf3 via discoverFamilies():

check: check:generated | hints (10): [
  'scripts/check-regen-pending.mjs', 'docs/protocol-upgrade-guide.md',
  'packages/spec/src/meta-spelling/meta-url-data.generated.ts',
  'packages/spec/api-surface', 'packages/spec/export-origins', 'packages/spec/declaration-map',
  'content/docs/references/**', 'docs/audits/2026-07-unknown-key-strictness-ledger.counts.md',
  'packages/spec/liveness/state-counts.md', 'scripts/gen-sdui-manifest.sh'
]
placement for editing packages/spec/src/migrations/registry.ts directly: silent
placement for adding a new packages/spec/src/migrations/entries/*.ts file: silent

Neither the generated artifact nor its source directory is a hint. check:migration-registry isn't even its own dispatch-gates family — none of discoverFamilies()'s keys match /migrat/i at all.

Root cause

check-generated.ts's GATED array entry:

{
  check: 'check:migration-registry',
  gen: 'gen:migration-registry',
  artifact: 'src/migrations/registry.ts — its generated regions, from src/migrations/entries/',
}

artifact is prose for a human reading --list output, not a path literal — the em dash and spaces fail extractWatchHints's path-shaped admission regex (/^[\w.@][\w.@/*-]*$/) outright, so the whole string is silently discarded rather than partially admitted. This is a formatting gap, not a width one: unlike check:route-envelope, the real population here (one generated file + the directory that drives it) is precisely spellable.

Reported independently by PR #16778 and PR #17029's dev seats (per #16828's claim comment) as "absent from dispatch-gates --commands on a diff that regenerates the very file it guards" — this issue is the re-derived, re-verified root cause and fix direction for that report.

Suggested fix (not implemented here — different file, different package's gate pipeline, out of #16828's bounded in-place-fix bar)

Give the GATED array a real path alongside the prose, e.g. a second field (hint: 'packages/spec/src/migrations/registry.ts', or a hints: [...] array covering both the generated file and packages/spec/src/migrations/entries/**) that extractWatchHints can admit, leaving artifact free to stay human-readable. No wide-population/whole-tree-population marker needed — this population is small and precisely nameable, unlike check:route-envelope's.

Positive control run against this issue

placeFamily(check:generated entry, ['packages/spec/src/migrations/registry.ts']) → silent (measured above). Fixing the hint should flip this to matched — not verified here since the fix isn't implemented in this issue.

[os-trump]

Triage only — routed, not claimed. This card arrived with no labels at all (filed as a by-product of #16828's sweep), so it was outside every lane's queue and every sweep. Labelled now so it is pickable.

Lane: domain:spec, not domain:services

The domain:services seat (#6021) filed the parent sweep and owns the two scripts/pm/bare-root-worklist.mjs cards (#16828 → #17048), so the reflex was to keep this one too. ⛔ Declined, because the recommended fix does not live in this lane's files:

• The symptom is in scripts/pm/dispatch-gates.mjs (extractWatchHints's path-shaped admission regex silently discarding the whole string) — PM tooling.
• The fix this issue actually recommends is a data change in packages/spec/scripts/check-generated.ts: give the GATED entry a path-shaped hint / hints field alongside the human-readable artifact prose. That file is packages/spec's.

A domain:spec seat can make that change in one file without touching the derivation contract at all. ⚠️ If whoever takes it concludes the right fix is instead to widen extractWatchHints to admit paths embedded in prose, that is a domain:services change and the card should be re-routed rather than crossed into — say so on the card.

Grade: priority:p3

Graded down from the reflexive p2 on a measured containment argument: check:migration-registry does still run in CI — .github/workflows/lint.yml invokes pnpm --filter @objectstack/spec check:generated --reconcile-only, and the check is one entry of that script's GATED array. So nothing escapes; what is lost is only local pre-push derivation — a dev seat editing packages/spec/src/migrations/** gets silent from dispatch-gates --commands and finds out in CI instead of before pushing.

⚠️ Not p4 despite that: two independent dev seats (#16778, #17029) hit and reported it on separate days, so the recurrence cost is real and measured, not hypothetical.

What is already measured, and must not be re-derived

The issue body carries a discoverFamilies() measurement on 881ce2bf3 and a placeFamily(…, ['packages/spec/src/migrations/registry.ts']) → silent positive control. ⛔ Do not treat a fresh silent as the proof — a silent from a probe that cannot say matched is NOT MEASURED. The control that counts is the post-fix flip to matched, which the issue explicitly did not run because the fix is not implemented.

---

Generated by Claude Code