[finding] a shrink-only ratchet whose self-test asserts its own entries are PRESENT can never reach zero — one instance found and fixed, the class unswept

[os-zhuang]

Found while landing #11596 slice 2 (PR #11692). The instance is repaired there; the class is not
swept and that is what this card is for. Filed unassigned.

The shape

A shrink-only ratchet exists to be driven to zero. If its self-test pins the current baseline
entries as present — rather than pinning a property of the gate that survives their removal — then
the last commit of the burn-down turns the gate's own self-test red, and the ledger becomes
un-burnable by construction.

Measured instance, scripts/check-cli-test-child-env.mjs:

t(`the enumerated population contains ${named.split('/').pop()}`,
 live.refusal === null && live.findings.some((f) => f.file === named));

findings holds a file only while it still leaks. Two cases were written this way to pin
#11441's measurement that the derivation really covers those files — a good intention, and the
comment above them says exactly that in words ("they are members of the population"). But the
spelling asserts a transient fact about the tree, not a property of the gate. Repairing the two
files reported 2 of 54 case(s) failed, and the failure message read "the derivation lost this
file" when the file was merely clean.

The repair in #11692 re-spells it as membership of the scanned population — walked, and
classified as a spawner — which is the claim that was intended and the one that survives the repair.
The gate's rule is byte-identical; the case count is unchanged; and it still discriminates (narrowing
the population root reds it again).

Why this is worth a sweep rather than a note

The two failure modes are indistinguishable on the day the pin is written and diverge only at the
moment the ratchet finally succeeds — i.e. the pin is a booby trap that arms itself years before it
fires, at the exact moment someone is trying to do the right thing. A seat hitting it mid-burn-down
sees a red gate and the most likely reactions are both wrong: leave an entry in the ledger to keep
the self-test green, or weaken the gate.

What a sweep would check

For each shrink-only / ratchet gate under scripts/, does its selfTest() (or its test twin) assert
anything that is only true while the baseline is non-empty? Candidates worth reading, chosen
because they are the ratchets this lane has touched recently and is not an exhaustive list —
⛔ derive the population rather than working from it:

• scripts/check-settings-bind-window.mjs — ⚠️ most urgent: its KNOWN_PRE_BIND_READS reaches
  empty when fix(mcp): read the stdio transport's localization after the settings engine bind #11623 lands (AuthPlugin reads the auth settings namespace in the pre-bind window — stored sys_setting rows are ignored at boot under the shipped os serve order #11579 removed one entry, MCP stdio transport pins its localization to the manifest defaults — the settings read happens in start(), inside the pre-bind window under every composition order #11580 removes the other), so if it carries
  this shape it fires imminently. That PR's dev has been asked to verify the empty-ledger path.
• scripts/check-cli-test-child-env.mjs — the instance, already repaired.
• scripts/check-ratchet-remedy-authority.mjs, check-type-check-coverage (TEST_DEBT),
  check-query-options-erasure, check-slot-lookup, check-i18n-coverage.

⭐ The discriminating question for each, and it is answerable by reading the assertion alone:
would this case still pass if the baseline were empty? If not, it is pinned to the debt rather
than to the gate.

Related

• PR test(cli): route the last three serve-* e2e spawners through childEnv(), 3 -> 0 on the child-env ratchet #11692 — the instance and its repair, with the reverse-verification.
• finding: #11341's bare-...process.env worklist is two files short, and one of them spawns a real os serve #11441 — the measurement the two mis-spelled cases were pinning.
• burn down the cli-test-child-env baseline: 18 spawned children in 17 packages/cli/test files still built from the whole of process.env #11596 — the burn-down that surfaced it by actually reaching zero.
• fix(mcp): read the stdio transport's localization after the settings engine bind #11623 — the next ledger due to hit empty.

[os-zhuang]

The most urgent candidate is retired — measured, and it hands the sweep a better discriminator

scripts/check-settings-bind-window.mjs does not carry this shape. Its ledger reached empty
half an hour after this card was filed (#11623 merged the last of the two entries out;
KNOWN_PRE_BIND_READS is now []), and the gate answered:

✓ settings bind-window guard self-test: all cases pass.
✓ settings bind-window: 4 declared / 0 self / 1 structurally upstream / 0 ledgered
 (68 plugin unit(s) scanned, provider 'com.objectstack.service.settings').

⭐ And the reason is the useful part, from the seat that measured it:

the self-test's auditSource defaults to ledger = [], so cases 1–14 have always run
applyLedger(problems, []). The path was never cold.

That is a stronger property than the question this card originally posed. So the sweep gets a second,
sharper discriminator — and it is the one to check first, because it is answerable by reading the
self-test's fixture defaults rather than reasoning about every case:

1. Does the self-test already exercise the empty-baseline path by default? If its fixture defaults
   the ledger to [], the gate cannot acquire the anti-shrink shape — the empty case is covered on
   every run, not just on the day the ratchet finally succeeds.
2. Only if not: would each case still pass if the baseline were empty? A case that would not is
   pinned to the debt rather than to the gate.

Also worth carrying into the sweep, from the same measurement: an empty ledger must not be
readable as an empty population. This gate keeps them apart — its verdict line still reports the
scanned population (68 plugin unit(s)) and the derived provider, and its !provider branch refuses
outright rather than reporting green over nothing. A gate that prints only 0 ledgered and stops
would be indistinguishable from a gate that scanned nothing.

Remaining candidates, unchanged: check-ratchet-remedy-authority, check-type-check-coverage
(TEST_DEBT), check-query-options-erasure, check-slot-lookup, check-i18n-coverage — and ⛔ derive
the population rather than working from that list.

---

Generated by Claude Code