[finding] check:published-files is `silent` for every package.json card, though it reads all 77 workspace manifests — a population whose only spellings are the ones hintCovers prices as fabrication

[os-zhuang]

Found while discharging the last ESCAPABLE_LITERAL_LEDGER row (#10875 / PR #10890). Filed unassigned, out of scope there, and not a regression from that PR — see the measurement below.

The observation

check:published-files reads every workspace member's package.json (the files whitelist) and walks each member's file tree. So a card editing packages/<any>/package.json genuinely can move it — that is the gate's whole subject.

The derivation never names it for one. Its live hint set is:

["scripts/check-published-files.mjs", "@objectstack/spec", "src/**/*.zod.ts"]

• scripts/check-published-files.mjs — its own source (reverse containment);
• @objectstack/spec — an npm package name from EXTRA_ENTRIES, not a repo path;
• src/**/*.zod.ts — collapses to src/.zod.ts, which matches nothing.

Verdict for packages/spec/package.json, on the live tree: the gate does not appear in the 19 derived families at all.

Why this is NOT the ledger row that just closed, and not #10840

Worth separating, because all three look alike from a distance:

• the check:published-files spells a bare root scripts it never reads — the last escapable-literal ledger row, and the subtree escape is the WRONG remedy for it #10875 row was a literal that misdescribed the population (scripts, a root the gate never opens). Removing it changed 0 of 50259 match pairs — the bare literal was already inert under hintCovers' refusal. So this silence is pre-existing, not introduced by that PR;
• [finding] the INVISIBLE half of the bare-root species is ~33 gates, not 4 — a population literal with no separator never reaches the hint set at all #10840 is the invisible half: population literals carrying no separator, which never reach the hint set. This gate's population is not a literal problem at all;
• this one is a gate whose real population has no spelling that the hint language can express cheaply.

Why it is not obviously fixable, which is why it is a finding rather than a card

The ROOT_DIR_WATCH_HINTS escape would need packages/** + apps/** + examples/**. That is precisely the volume hintCovers' docblock refuses (packages alone is measured at +139084 fabricated pairs across the family corpus, and one card going 7 → 34 matched families). The narrower true spelling — "every package.json under a workspace member" — is not expressible: hints are prefix/segment-based with globs collapsed by deletion, so a mid-path * like packages/*/package.json collapses to packages//package.json and matches nothing.

So the honest options are all judgement calls:

1. leave it — the derivation's contract is "leads, not verdicts" and it errs toward missing; a miss costs one card one CI round;
2. declare the three member roots and accept the volume;
3. teach hintCovers a **/<basename> form, which reopens the basename class the docblock closed on provenance grounds (8 of 17 new pairs fabricated when re-measured for *.md).

Recommendation: (1), recorded rather than acted on — but the choice should be made once, in the open, rather than rediscovered by the next person who reads the hint set and assumes a bug.

Refs: #10875 / PR #10890 (the ledger row, and the 0-pair measurement) · #10840 (the invisible half) · scripts/pm/dispatch-gates.mjs hintCovers docblock (the two refusals and their prices)

[huangyiirene]

Triage (finding first-touch): closing not planned, adopting the filer's own recommendation (1) — leave the derivation as is, with this card as the open record of that choice. Rationale: the derivation's contract is "leads, not verdicts" and it errs toward missing by design; the only true spelling of this population is inexpressible in the hint language, and both escape hatches are priced out by hintCovers' own docblock (member-root volume: measured +139084 fabricated pairs; **/ forms: reopens the basename class closed on provenance grounds). Cost of the miss is one card one CI round. Reopen triggers: the hint language grows a mid-path-glob form, or a real dispatch is observed to skip this gate on a package.json-touching card where it mattered. Reopening is free.

---

Generated by Claude Code