Declare the non-recursive scripts population check:ratchet-remedy-authority really sweeps

[claude]

Fixes #13813

check:ratchet-remedy-authority builds its corpus at runtime from
readdirSync(SCRIPTS_DIR), so the string naming that population appeared only in
the failure text, the --list banner and one header comment — never as a literal
extractWatchHints can read. The derivation therefore read no population, made
no claim, and the family landed in the residue's undetermined bucket: outside
the matched list a dispatch brief prints. That cost a real CI round on a PR
whose whole derived family was green locally.

What lands

scripts/check-ratchet-remedy-authority.mjs — the ROOT_DIR_WATCH_HINTS
declaration beside the constants the walk is a function of, plus a --self-test
pin in both directions.

const CORPUS_EXTENSIONS = ['.mjs', '.mts'];
const ROOT_DIR_WATCH_HINTS = ['scripts/*.mjs', 'scripts/*.mts'];

⛔ Not scripts/**. corpusFiles() is a NON-RECURSIVE readdirSync admitted
by extension: it reads the top level of scripts/ only, never scripts/pm/ or
scripts/docs-audit/. The subtree spelling would be the easy one and it would be
FALSE — it pastes this gate onto every card touching any nested script, for files
it never opens, which is the costlier error hintCovers' own docblock prices
above a missing declaration. A self-test case refuses the subtree form outright.

⚠️ Not scripts/*.{mjs,mts} either, however natural it looks beside the
header and the messages, which both spell the corpus that way for a human reader.
hintCovers has no brace expansion, so that single string reaches NOTHING — a
dead declaration, printed as the same silence as declaring nothing at all.
Measured, not assumed:

"scripts/*.mjs"        -> "scripts/check-self-test-wired.mjs"   = true
"scripts/*.mjs"        -> "scripts/pm/dispatch-gates.mjs"       = false
"scripts/*.mjs"        -> "scripts/check-test-typecheck.mts"    = false
"scripts/*.mts"        -> "scripts/check-test-typecheck.mts"    = true
"scripts/*.{mjs,mts}"  -> "scripts/check-self-test-wired.mjs"   = false

A self-test case pins the brace form as undeclared so the tidier-looking spelling
cannot quietly land.

scripts/pm/bare-root-worklist.mjs — the recorded row this declaration
falsifies, re-decided. See below; this is named here rather than left as a
silent rider.

The acceptance proof — the derivation's own predicates

Same probe the card specifies, on this branch, before and after.

BEFORE (66ecc50a, the branch point):

Undetermined (source names no path at all — NOT known irrelevant): 40 famil(ies).
  ...
  - pnpm check:ratchet-remedy-authority   [lint.yml]

No annotation beneath it — unlike its two neighbours, which carry an explicit
declared no path population marker with a reason.

AFTER (9ade670c), the same family, now inside the Local gates for this card
block:

  - pnpm check:ratchet-remedy-authority   [lint.yml]   matched via
      scripts/check-self-test-wired.mjs ⇢ gate source 'scripts/*.mjs';
      scripts/check-self-test-workflow-commands.mjs ⇢ gate source 'scripts/*.mjs';
      scripts/measure-self-test-floor.mjs ⇢ gate source 'scripts/*.mjs'

Undetermined: 40 → 39 famil(ies)
Reconciliation: 16 → 17 famil(ies)

undetermined → matched, and the card's whole runnable answer grew by exactly one.

The bare-root worklist row, re-decided (the other half, not a rider)

scripts/pm/bare-root-worklist.mjs recorded this population as:

REFUSE-UNSPELLABLE — "reads the TOP LEVEL of the root only, and only two
extensions … The idiom has no non-recursive spelling: a subtree hint claims
every nested directory too"

That reason was TRUE when written and is FALSE of this tree. It rested on the
deletion-collapse in its within-segment variant: collapseHint('scripts/*.mjs')
still returns scripts/.mjs, a string no tree can hold. #13448 retired that
collapse for exactly this shape — judgedAsPattern routes it to triggerCovers
now — which dispatch-gates.mjs itself calls "the same defect as the non-final
case one level finer". So this is the identical retired mechanism the seventeen
rows of 2026-08-26 and the eighteenth of 2026-08-29 were re-decided under, and
the row is re-decided under that same authorisation sentence and no wider one:
bringing a verdict back to truth after its definitional basis moved is not
loosening the map.

⚠️ Leaving it was not an option that stays honest. The row is UNCOVERED
(covered asks whether a hint reaches an arbitrary file at the top of the root;
these hints reach none), so no assertion fires either way — the self-test is
green before and after. That is precisely the prose-rot the file warns only
re-measuring can catch, and shipping the declaration alone would leave one row
asserting that this population cannot be spelled directly beside the gate that
now spells it.

DECLARED-NARROWER is the verdict defined for the state this creates: "the
gate took the escape, at a strictly narrower subtree than the bare word. The row
stays in the sweep because the bare root is still not covered." Both terms
re-measured together on this tree, never refreshed apart — 183 files admitted by
corpusFiles(), against 310 tracked under the bare root (59%) — and the pair of
hints is SET-EQUAL to that walk in both directions, 183 of 183, so 100% precise
and complete.

⛔ No spelling is recorded, deliberately: SPELLINGS holds one hint per entry
and this population needs one per extension. That is the
check:logger-receiver-detach / check:dual-build-cjs-loads shape, whose rows
carry no spelling for the same reason, and the liveness-and-precision coupling
therefore lives in the gate's own --self-test.

⛔ Out of scope and untouched, per triage: the other 39 undetermined
families, and the whole-surface-ratchet sub-class recorded in this card's
comments 2–4 (check:query-options-erasure, check:type-check-debt, the census
re-rot). Neither is this shape and neither is reached by this remedy.

Verification — all on 9ade670c, the final commit

The derived family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands,
15 families, derived from the real diff, not from the dispatch brief's list):

gate	exit
pnpm check:ratchet-remedy-authority (self-test + real corpus)	0
pnpm check:watch-hint-literal	0
pnpm check:declared-population-live	0
node scripts/pm/bare-root-worklist.mjs --self-test	0
pnpm check:pm-dispatch-gates	0
pnpm check:agent-test-spelling	0
pnpm check:bash32-floor	0
pnpm check:cli-command-ids	0
pnpm check:cross-package-test-inputs	0
pnpm check:entry-guard	0
pnpm check:parse-guard	0
pnpm check:pnpm-filter-targets	0
node scripts/check-ci-filter-parity.mjs	0
node scripts/check-cross-package-test-inputs.mjs	0
node scripts/check-shard-attestation.mjs	0
node scripts/check-nul-bytes.mjs	0

Each verdict quoted from the gate's own line, exit code captured before any pipe:

OK  check-ratchet-remedy-authority: 183 scripts swept (scripts/*.{mjs,mts}); 12 mark the
    expanding remedy ⛔ MAINTAINER-ONLY, 6 turn it down outright, 165 hand out no
    ratchet-expanding remedy. Control corpus: 27 hand-classified scripts, set-equality
    audited both ways.

✓ check-watch-hint-literal self-test: 57 cases pass -- ... the live repo-wide population judged.

✓ check:declared-population-live — 156 of 199 famil(ies) declare a path population, and every
    one of them reaches this tree's 7786 tracked file(s).

OK  self-test: 56 live row(s), 48 unreachable as spelled, 48 recorded verdict(s) — none stale,
    none missing, none contradicted.

✓ dispatch-gates self-test: 1140 cases pass.

node scripts/check-test-completeness.mjs exits 3 = NOT MEASURED, by its own
text: the family derivation names it with no argument, there is no local test log
to hand it, and it says in as many words that this is "not a red, and there is
nothing here to fix."

No *.test.ts in the tree names either edited script (git grep over test
globs: 0 hits) — these two gates are tested by their own --self-test, both run
above.

Scope: scripts/** only, publishes nothing from any package ⇒ skip-changeset,
matching every sibling gate PR (#14221, #14207, #14188 all carry no changeset).

Generated by Claude Code

---

Generated by Claude Code