`Test (shard 1/4)` and `Test (shard 2/4)` are red on `main`: the generator-template dependency ratchets were not moved by this morning's dependabot bumps

[yinlianghui]

Found while verifying PR #4095 (issue #4086). Filed unassigned — not caused by that
PR, which changes only e2e/smoke.spec.ts and .github/workflows/ci.yml, but it
turns two required test shards red on every PR branched off current main.

What fails

Two independent assertions, same mechanism, one in each of two shards
(run 31368183507):

FAIL  unit  packages/cli/src/__tests__/app-generator.test.ts
  generated app manifests > sources every range from this repo instead of inventing one
AssertionError: routed manifest's lucide-react must match its in-repo range:
  expected '^1.28.0' to be '^1.29.0'
  at packages/cli/src/__tests__/app-generator.test.ts:542:68

FAIL  unit  packages/create-plugin/src/__tests__/templates.test.ts
  generated package.json > sources every devDependency range from this repo instead of inventing them
AssertionError: vite range must match the repo root:
  expected '^8.2.0' to be '^8.2.1'
  at packages/create-plugin/src/__tests__/templates.test.ts:356:75

Each shard is otherwise fully green — 1 failed | 288 passed (289) on both.

Where it came from

A wave of dependabot merges landed on main between 07:45Z and 08:03Z today:

PR	Bump	Merge
#4091	lucide-react 1.28.0 → 1.29.0	a49a3a008
(patch-updates group, #4093)	vite 8.2.0 → 8.2.1	—
#4090 / #4092 / #4089 / #4094	shiki, maplibre-gl, react-hook-form, next	—

Both failing assertions are ratchets that hold a generator template's hard-coded
range equal to the range the repo itself uses. Dependabot moves the repo's manifests
and does not know the templates exist, so each of these bumps breaks its ratchet on
landing. lucide-react at a49a3a008 and vite in the patch group are simply the
two that have a ratchet pointed at them.

The reds are not visible on main's own history yet, which is worth noting on its
own: the bumps merged fast enough that each push run was cancelled by the next
(31368102651, 31368084472, 31367809591, 31367599374, 31367158099 — all
cancelled). So the first place this surfaces is on PRs, not on the branch that
broke.

Why it matters

These are required contexts, so every PR opened from current main inherits two red
shards it did not cause — the same "trains reviewers to merge past reds" condition
#4086 was filed for, arriving from a different direction while #4086 was being fixed.

Scope note

The ratchets are correct and should stay: a generated app whose manifest pins a range
the repo has moved past is exactly the drift they exist to catch (cf. #3855 for the
docs-side fossils of the same family). The fix is to move the templates with the bump,
and the durable question is whether that can be made automatic — a dependabot bump
touching a range that a template mirrors should either update the template in the same
PR or fail its own CI rather than a later, unrelated one.

Suggested first step

Sync the two templates to the current in-repo ranges (lucide-react ^1.29.0 in
packages/cli's routed app manifest, vite ^8.2.1 in packages/create-plugin),
then re-read both test files for any other range they pin that this morning's other
five bumps have already moved — shiki, maplibre-gl, react-hook-form and next all
landed in the same window and only the first mismatch in each file is reported.

---

Generated by Claude Code

[yinlianghui]

Claim: PM loop round 4 — main-health #2, dispatched at top priority (objectui whole-repo seat). target:v17: two red required shards on main block every open PR — #4095 (the Build & E2E fix) and #4084 both queue behind this.

Session: session_017Qqyix2QcnpUC9XeYVDzx3
Branch: claude/issue-4098-template-dep-ratchets
Worktree: objectui-issue-4098
Container & model: S, mode:subagent, model: opus
File surface: the two generator-template dependency declarations named in the body (packages/cli app-generator lucide-react range; packages/create-plugin templates vite range) + their ratchet tests. ⛔ Nothing else; no dependency bumps of the repo's own node_modules — the dependabot wave already landed those, this card only moves the template ranges to match.

---

Generated by Claude Code

[yinlianghui]

ACCEPT (objectui seat PM, session session_017Qqyix2QcnpUC9XeYVDzx3) — PR #4099.

The dispatch asked for the two named ratchets plus a sweep; the sweep is what earned the acceptance. Instead of fix-and-re-run (one drift revealed per lap, because the anchor test aborts at first mismatch), the dev replicated both anchor rules and judged all 21 anchored ranges across the four generator maps at once — surfacing a THIRD drift the issue never named (scaffold-dependencies.ts root vite anchor, masked by lucide-react sorting first). Fixing only the card's two would have turned shard 1 red again on the next lap; that second red lap was demonstrated (reverse-verified by restoring just the invisible drift) and avoided. Also de-fossilised app-generator.test.ts:1082's hard-coded ^1.28.0 — a weaker copy of the anchor rule pointing the other way that scored the correct fix as a regression; it now reads the same inRepoRangesOf anchor, so the next dependabot wave breaks one rule, not two contradicting ones. Fix direction confirmed from the ratchet's own docs (templates follow the repo), not from the dispatch prompt. The wave's other bumps (shiki, maplibre-gl, react-hook-form, next) are declared by no generator — swept, clean.

Both shards green exactly where main is red (each was 1 failed | 288 passed on main, now 289/289); all 20 checks on the PR completed green, Bump Policy arbitrated patch/patch. Flipping ready + auto-merge; when this lands, main heals and #4095 → #4084 queue behind it in that order.

---

Generated by Claude Code