`check:type-check-debt --re-measure` trusts stale `dist/`: phantom upward drift for ledgered packages whose deps resolve to build artifacts, unless the caller builds the closure first

[hotlong]

Split out of #8235 (closed: its "red on main" premise measured false) per the services seat's referral (comment 5274624869 on #6015). The measurement establishing the mechanism is the services seat's stale-premise check, comment 5274598357 on #8235 — read it before re-deriving anything here.

The defect

KNOWN_UNALIASED_TEST_IMPORTS packages (e.g. @objectstack/service-analytics, listed at scripts/check-test-source-alias.mjs:279) resolve workspace deps through exports → dist/ — no vitest.config.ts, no paths in tsconfig.json.

• In CI (lint.yml), step 31 "Build the ledgered packages' dependencies" runs immediately before step 32's re-measure, so tsc always sees a dist/ matching current source.
• Locally, pnpm check:type-check-debt --re-measure performs no closure build. Against a dist/ predating a sibling package's change, it reports upward ledger drift that does not exist in source.

Measured consequence: #8235 was filed in good faith as a priority:p0 "main-red stanch" off exactly this — four phantom errors (TS2614/TS2339/TS7006 against pre-#8198 @objectstack/driver-sql artifacts) while main CI's step 32 was green on two consecutive runs.

Why it matters

The gate lies in the direction that manufactures false alarms: a careful reporter following the gate's own output escalates a queue-jumping p0 against a green gate. The mirror direction also holds — a stale dist/ can hide real drift locally until CI catches it, which defeats the point of running the gate before pushing.

Suggested directions (not prescriptive)

1. Make --re-measure build the ledgered packages' dep closure first (what CI step 31 does), or
2. Staleness detection: warn/refuse loudly when a resolved dep's dist/ is older than its src/, naming the un-built packages, or
3. Resolve through source — heavier; that is the Type-axis remediation worklist: 51 packages resolve a workspace dep's declarations through dist, per check:type-source-resolution's landing registry #8249 worklist's axis, not this card's.

Acceptance shape

A local --re-measure against a deliberately stale dist/ must either build the closure or name the staleness — it must not report phantom ledger drift. A regression fixture can stage this deterministically (touch a src/ file in a dep of any ledgered package, skip the build, run the gate).

Related (checked for duplicates before filing)

• Type-axis remediation worklist: 51 packages resolve a workspace dep's declarations through dist, per check:type-source-resolution's landing registry #8249 — tracking worklist, dist-resolution on the resolution side (51 packages); this card is the measurement side only.
• check-test-source-alias prints a remediation hint that cannot work for a subpath-only importer — following it verbatim leaves the gate red with no further guidance #8256 — check-test-source-alias remediation-hint defect; different gate.
• [finding][devx] check:type-check-debt 的 ledger 余量会让新写的 pin 变哑：mongodb 曾有 33 条余量吞掉一次真实回退，另有 5 条目前带 4–19 余量 #6376 — ledger-slack blindness; different failure mode of the same gate.

[os-zhuang]

Claim: PM loop round 1
Session: session_01KNfj35pXRxnF1D3gZN5zjc
Branch: claude/issue-8271-remeasure-stale-dist
Worktree: objectstack-issue-8271
Domain: domain:devx
File surface: scripts/check-type-check-coverage.mjs, .github/workflows/lint.yml (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus
Serial constraints cleared: predecessor PR #8260 (#8218) on scripts/check-type-check-coverage.mjs merged — the temp tsconfig now goes through mkdtempSync, so any line reference predating that is stale. #8189 targets the same file and is deliberately held out of this batch (hard serial, next round at the earliest). No other in-flight claim declares this file.

⚠️ Landing-spot correction recorded at claim time. The card is titled against check:type-check-debt, but that npm script is implemented by scripts/check-type-check-coverage.mjs — package.json:88 wires check:type-check-debt to node scripts/check-type-check-coverage.mjs --self-test && … --re-measure. There is no check-type-check-debt.mjs; searching for that spelling returns zero and the zero means nothing. Anyone picking this card up should start from the coverage file.

Verified at claim time on origin/main: .github/workflows/lint.yml:1329 still carries the "Build the ledgered packages' dependencies" step immediately before :1333's pnpm check:type-check-debt, which is the CI-side counterpart the card contrasts against the local path. The card's premise is intact.

---

Generated by Claude Code