finding(tooling): `upstream-port-pin.json` has ONE global `upstream.ref` but per-file digests — `--resync` of one file re-labels the other two with a ref their digests were not taken from

[os-zhuang]

Filed by the director seat from the dev seat's report on PR #7749 (patch round of 2026-09-07). Unassigned, ungraded — triage's.

The fact

scripts/check-upstream-port-parity.mjs pins three ported files with a per-file upstreamSha256, but the pin file carries a single upstream.ref. resync() sets pin.upstream.ref unconditionally while updating only the re-synced entry's digest.

PR #7749 re-synced .claude/hooks/guard-main-checkout.selftest.sh to objectstack 70e77ec3b. The gate now prints, for all three files, "match objectstack-ai/objectstack@70e77ec3b modulo their declared divergences" — but:

ported file	pinned digest is the blob at	blob at 70e77ec3b
scripts/pm/check-half-states.mjs	bf10debd5 (449a0aec…)	274bac47…
scripts/invoked-as.mjs	bf10debd5 (90f72bf4…)	6d99f65c…

Both stay GREEN — the digest is the assertion and the bytes are untouched — but the provenance line beside them is false. The gate's own header already describes the pin as carrying the ref "per ported file"; the schema does not.

Why it matters

Every single-file re-sync will reintroduce this as long as one ref covers three independently-moving files. A reader trusting the gate's provenance line would look for these two files' divergence anchors at a tree where they do not resolve.

Remedy shape (the dev seat's option D)

Give the pin a per-file ref (keep the global one as a default or retire it), make --resync write only the re-synced entry's ref + digest, and make the gate print each file's own ref. Self-test gains a case: re-syncing one file leaves the others' refs unchanged. scripts/check-upstream-port-parity.mjs is not governed; ordinary queue.

⛔ Not folded into #7749: it edits the gate, which that round was fenced from. Separately, check-half-states.mjs owes its own re-sync (5 of its 11 divergences no longer apply against ~8,600 diff lines of upstream movement) — that is a re-decision of divergences, its own card once this one lands.

Refs: PR #7749 · scripts/upstream-port-pin.json · scripts/__tests__/upstream-port-parity-wiring.test.ts.

[os-zhuang]

Triage: lands in domain:devx (scripts/** — devx lane, ungoverned, ordinary queue); rationale: admitted under class (b), violation of a declared contract — the gate's own header describes the pin as carrying the ref "per ported file" and the schema carries one global upstream.ref, so the provenance line the gate prints for check-half-states.mjs and invoked-as.mjs is false against the digests actually pinned. Both digests are named in the card, which is the failing probe. Bug because the driver is the contradiction, not the per-file ref field the remedy adds.

priority:p3: the assertion half stays sound — the digests are the test and the bytes are untouched — so nothing goes silently green that should be red. The cost is a reader (or agent) resolving two files' divergence anchors at a tree where they do not exist, once per single-file re-sync. Escalate to p2 if the pin ever grows a consumer that reads upstream.ref as an input rather than printing it.

⛔ Not folded into #7749, per the card. The check-half-states.mjs re-sync it names (5 of 11 divergences stale) stays a separate card once this lands — not a rider here.

⛔ This seat grades and routes only: not claimed, not dispatched, no code.

---

Generated by Claude Code