fix(spec): re-measure the four #9881/#9972 objectui pin citations at the current pin, and gate the class

.github/workflows/lint.yml

@@ -2103,6 +2103,34 @@ jobs:
  - name: Check every shipped template manifest satisfies TemplateManifestSchema
  run: pnpm --filter @objectstack/spec check:template-manifests
 
+ # [#10274] The read-point records in packages/spec/src cite the objectui
+ # commit their file:line anchors were counted in — "the objectui pin this
+ # repo builds against (`.objectui-sha` = `<sha>`)". That sentence is what
+ # makes a record RE-CHECKABLE, and it is the entire justification #9881 /
+ # #9972 were filed on after #9397 spent a full dispatch cycle re-deriving
+ # one read point from scratch.
+ #
+ # Nothing linked the sentence to the pin file. #10137 bumped `.objectui-sha`
+ # and four records went on naming a pin this repo does not build against —
+ # not WRONG (the anchors held) but UNVERIFIABLE, which is the exact state
+ # they were written to end. Prose has no dependency edge, so the class
+ # recurs silently on every bump. This gate is the edge.
+ #
+ # It checks only the ASSERTING spelling. `.objectui-sha` pin `<sha>` is a
+ # dated record of where a past measurement was taken (#5010 absorbed at
+ # `09987b68`, a renderer's branch semantics at `665661ab0932`) and a later
+ # bump does not falsify it; forcing those forward would demand re-measuring
+ # settled history on every bump. A sha named in NEITHER spelling fails
+ # loudly rather than being skipped — an unrecognised spelling is how a
+ # source scan loses a citation silently.
+ #
+ # Reads `src/` and the root pin file only — no build — so it belongs in
+ # this pre-build source-audit group. Unfiltered and required: a paths
+ # filter on packages/spec/** would go dormant on exactly the PR that moves
+ # `.objectui-sha`, which is the PR this exists to catch.
+ - name: Check spec pin citations still name the pin this repo builds against
+ run: pnpm --filter @objectstack/spec check:objectui-pin-citations
+
  # Lane 2 of 4 behind the required `TypeScript Type Check` context. The
  # aggregator job at the bottom of this file explains the split, holds the
  # contract, and is the thing the merge queue actually requires — read it

content/docs/references/ui/expression-bindable-text-keys.mdx

@@ -50,8 +50,8 @@ renderer happens to read.
 ## Why these rows (measured, not inferred)
 
 Rows are a RECORD of what each component renderer already reads back from
-the node's top level, measured at the objectui pin (`.objectui-sha`
-`82a9417`, re-verified identical at objectui `origin/main` `6c68b13` on
+the node's top level, measured at the `.objectui-sha` pin `82a9417`
+(re-verified identical at objectui `origin/main` `6c68b13` on
 2026-08-18) — declaring a key a renderer does not read back would recreate
 the evaluated-but-blank half of the objectui#4795 table:
 

packages/spec/package.json

@@ -217,6 +217,7 @@
  "check:exported-any": "tsx scripts/check-exported-any.ts --self-test && tsx scripts/check-exported-any.ts",
  "check:dual-source-exports": "tsx scripts/check-dual-source-exports.ts --self-test && tsx scripts/check-dual-source-exports.ts",
  "check:browser-reachable-entries": "tsx scripts/check-browser-reachable-entries.ts --self-test && tsx scripts/check-browser-reachable-entries.ts",
+ "check:objectui-pin-citations": "tsx scripts/check-objectui-pin-citations.ts --self-test && tsx scripts/check-objectui-pin-citations.ts",
  "check:authorable-surface": "OS_EAGER_SCHEMAS=1 tsx scripts/build-schemas.ts --check",
  "gen:migration-registry": "tsx scripts/build-migration-registry.ts",
  "check:migration-registry": "tsx scripts/build-migration-registry.ts --self-test --check",

packages/spec/scripts/check-generated.ts

@@ -260,6 +260,24 @@ const NO_GENERATOR: ReadonlyArray<{ check: string; why: string }> = [
  check: 'check:scripts-typecheck',
  why: 'type-checks packages/spec/scripts/** (the generators and gate scripts themselves) under tsconfig.scripts.json — no artifact, and no debt ledger by design (#5475)',
  },
+ // #10274. Audits this package's own PROSE: a read-point record that says
+ // "`.objectui-sha` = `<sha>`" is asserting the pin this repo builds against,
+ // and #10137 moved the pin under four such records without anything failing.
+ //
+ // NO_GENERATOR, and here the classification is the SAFETY PROPERTY rather than
+ // a bookkeeping choice. The `gen:` a reader would reach for — rewrite each
+ // cited sha to the pin file — is the one operation this gate must never offer:
+ // the sha is not the record, the objectui file:line anchors beside it are, and
+ // they are only true of the tree they were counted in. Regenerating the sha
+ // alone would leave every record CLAIMING the current pin while its anchors
+ // still described the old one, i.e. it would convert a loud "unverifiable" into
+ // a silent lie. #10274 measured that as real, not theoretical: re-measuring the
+ // four records found two anchors that had been wrong since they were written.
+ // A failure here is always a re-measurement, never a command.
+ {
+ check: 'check:objectui-pin-citations',
+ why: 'audits spec source prose: a citation in the asserting spelling (`.objectui-sha` = `<sha>`) must equal the root pin file — no artifact, and deliberately no `gen:`, because rewriting the sha without re-measuring the anchors beside it is the failure mode (#10274)',
+ },
 ];
 
 /**