[finding] the parity gate's own header says the tracked manifest was "dumped from" the pinned sha — it was generated from npm 17.6.0, which is the false equivalence the same header explains fifteen lines above #18632

Found by the CONTRACT_REVIEW_TIER review of PR #18608 (record 5712813406) and filed rather than sent back for a third patch round — the seat's reasoning for that trade is in 5712820318. ⛔ Not introduced by that PR.

The sentence

packages/spec/scripts/check-react-blocks-declaration-parity.ts, header (line ~118 at ae7e4c916d):

scripts/sdui-manifest.record.json pins it to the .objectui-sha it was dumped from

Why it is false

The tracked sdui.manifest.json was ⛔ not dumped from that sha. It was generated by the node producer from npm-published @object-ui 17.6.0, with the then-current pin merely recorded alongside it. Those are different provenances, and conflating them is exactly the false equivalence the same header now explains fifteen lines above: .objectui-sha names a COMMIT, while the version read off that commit's package.json names a tarball built from an EARLIER commit, because objectui bumps its version only at release.

⇒ The file now teaches the trap and then commits it, one screen apart.

Seat-verified before filing, so nobody re-derives it as introduced: it was dumped from is present at PR head and at origin/main — 1 and 1, control DECLARATION PARITY = 1. Pre-existing.

Fix shape

A one-clause correction: say the artefact is generated from the published packages and that the record pins the sha current at generation time — ⛔ not that it was dumped from it. The corrected sibling text in the same file (and in check-generated.ts, both landed by #18608) is the model to match.

⚠️ Read #17735 first. A decision card (5711529692) asks whether the producer of record should change (M1 point the node producer at the pin's built tree / M2 retire it for the browser dump / M3 keep the skew with a detector). If M1 or M2 lands, the artefact really will describe the pinned source and this sentence's correct wording changes with it. ⛔ Do not let that block the fix indefinitely — the sentence is false today under every option.

Dedupe words: parity header dumped from pin, sdui-manifest.record provenance false, generated from npm not dumped, .objectui-sha commit versus tarball, check-react-blocks-declaration-parity header.

Generated by Claude Code