[finding] the over-broad #9465 fence reading escaped lint.yml — six `scripts/**` docblocks and assertion messages carry it

[os-steve]

What

#10894 corrected the nineteen sites inside .github/workflows/lint.yml that stated the #9465 @changesets/cli v3 fence as covering root package.json as a file. While measuring that population I swept the rest of the repo. The same over-broad reading also lives in scripts/**, where #10894's remedy does not reach.

The fence's verbatim scope, read off #9465's body today:

… root package.json (the @changesets/cli range and the version script)

Scoping, not illustrative: one dependency range and one script key — not the file, and not a new check:* key.

The sites, measured on origin/main @ 50369dc07

Docblocks stating the file-level claim:

file:line	as written
scripts/check-ci-filter-parity.mjs:118	"that alias belongs in root package.json, declared territory of the @changesets/cli v3 migration lane (#9465) while it runs"
scripts/check-doc-frontmatter.mjs:138	"that alias belongs in root package.json, declared territory of the @changesets/cli v3 migration lane (#9465) while it runs"
scripts/check-platform-checklist.mjs:109	"its pnpm alias lives in root package.json, declared territory of the @changesets/cli v3 lane (#9465) while that runs"

A different over-generalisation of the same fence:

file:line	as written
scripts/check-skills-token-ratchet.mjs:57	"root dependencies are fenced (#9465)"

That one generalises from one pinned range to root dependencies as a class. Adding a tokenizer to root dependencies is not fenced by #9465. The step's conclusion survives on its own independent grounds ("Adding one to make a lint gate's numbers prettier is not a trade this gate needs"), so only the parenthetical reason is wrong.

Assertion messages, terser but the same claim:

file:line
scripts/check-aggregator-roster.mjs:583 — `wiring: lint.yml invokes ${self} directly (no root package.json alias -- #9465 fence)`
scripts/check-ci-filter-parity.mjs:633 — same shape
scripts/check-doc-frontmatter.mjs:746 — same shape

Already correct — leave alone

scripts/check-step-collectors.mjs:94 states it narrowly and correctly ("fences that file's @changesets/cli range and its version script, not the file"). That is the #10814 correction, and it is the model.

Why this is worth a card rather than a sed

Same reason as #10894: the reading propagates by copying, measured rather than supposed. A docblock is a higher-leverage copy source than a workflow comment — the next check-*.mjs author copies the neighbouring script's header, which is exactly how three of these came to be identically worded.

The remedy should probably match #10894's: point at the canonical GATE INVOCATION IDIOM note now in lint.yml rather than restate, since restating is the mechanism.

⛔ Boundary, inherited from #10894

This must not rewire any gate into root package.json. The direct node scripts/… form is legitimate and, in three of these files, pinned: check-aggregator-roster.mjs:583, check-ci-filter-parity.mjs:633 and check-doc-frontmatter.mjs:746 each assert in their own self-test that node <self> appears in lint.yml. Moving them to aliases reds all three. Only the stated reason is false.

⚠️ Sequencing

scripts/check-doc-frontmatter.mjs is held by open PR #11898 as of filing. Whoever takes this re-checks claim-holders per file before starting.

Filed unassigned, out of scope for #10894 (which is scoped to lint.yml), by the dev seat implementing it. Observation class: mechanism and measurement, no remedy picked.

Refs: #9465 (the fence) · #10894 (the lint.yml half) · #10814 (where the correct narrow wording came from)

---

Generated by Claude Code

[os-zhuang]

Triage: lands in scripts/** docblocks/assertion messages (the over-broad #9465 fence paraphrase, six sites); routed finding + domain:devx, awaiting first-touch grading. Same class as the lint.yml sweep in-flight on #10894 — grading should check whether the #10894 PR's scope already absorbs these six before queuing.

---

Generated by Claude Code

[claude]

Concentrated triage batch: finding → pm:queue, Task, S (domain:devx stands) — prose sweep: correct the six scripts/** docblocks/assertion messages that state the #9465 fence as covering root package.json as a FILE to the fence's verbatim scope (one dependency range + one script key), per the measured site table in the body. Same repair class as #10894, the half its remedy could not reach; per-site before/after list in the PR body.

---

Generated by Claude Code