Sweep the self-test-pinned-to-the-debt shape in packages/spec's ratchets and test twins (out-of-scripts half of #11694)

[yinlianghui]

Routed to the domain:spec seat by the domain:devx @ objectstack seat (#6023, session session_01UjM2ia8Av1v5NqfqQEQmC6), because five of the six carriers live under packages/spec/**, which has exactly one owner regardless of who found them. ⛔ This seat has not touched any of them.

⚠️ domain:* left unset deliberately — this seat does not produce routing labels. Triage: suggested domain:spec.

Origin, and the ruling that produced this card

Measured by the dev on #11694 / PR #12050, whose sweep was scoped to scripts/. Its open_questions asked whether to widen; this seat ruled "file the follow-up, do not widen" (#11694 comment 5406763583), and split it by lane rather than filing one cross-lane card.

The shape

A shrink-only ratchet exists to be driven to zero. If its self-test pins the current baseline entries as present — rather than pinning a property of the gate that survives their removal — then the last commit of the burn-down turns the gate's own self-test red, and the ledger becomes un-burnable by construction.

⭐ The failure arms itself years before it fires, at the exact moment someone is finally doing the right thing. A seat hitting it mid-burn-down sees a red gate, and both likely reactions are wrong: leave an entry in the ledger to keep the self-test green, or weaken the gate.

The carriers this card covers

Measured by #11694's dev while deriving its own population; not individually confirmed to carry the shape — that is this card's first job.

Ratchets (--self-test style):

• packages/spec/scripts/check-dual-source-exports.ts
• packages/spec/scripts/check-exported-any.ts
• packages/spec/liveness/check-liveness.mts

Test twins (vitest rather than --self-test):

• packages/spec/scripts/check-generated-ledger.test.ts
• packages/spec/scripts/check-react-blocks-declaration-parity.test.ts

⭐ The concrete lead, and the reason this is not "record and stop": check-generated-ledger.test.ts pins ledger bucket counts as exactly 1 — expect(output).toContain('1 explicit manual-only generators') and '1 needing an external input'. That is the same species as the instance repaired in PR #12050, in a test twin rather than a --self-test.

⚠️ The sixth carrier, packages/lint/scripts/check-doc-formula-expressions.mjs, is domain:devx and is filed separately by that seat. It is named here only so the population is not read as complete.

The discriminator, in the order it is cheapest to apply

Both steps come from #11694's own measurement — the second was contributed by a seat that measured a candidate and found the property already held:

1. Does the self-test already exercise the empty-baseline path by default? If its fixture defaults the ledger to [], the gate cannot acquire this shape — the empty case runs on every invocation, not only on the day the ratchet finally succeeds.
2. Only if not: would each case still pass if the baseline were empty? A case that would not is pinned to the debt rather than to the gate.

The repair shape, with a worked precedent

PR #12050 is the reference implementation, and its second-order detail is the part worth copying: [].every(...) is a pass that proves nothing, so the positive claim there is carried on a witness pair — a synthetic conforming row keeps the positive half exercised once the real ledger reaches zero, and a synthetic non-conforming row gives the case teeth at that point. ⇒ The repair must not merely avoid the original defect; it must avoid becoming vacuous at exactly the moment the burn-down succeeds.

Also carried from #11694: an empty ledger must not be readable as an empty population. A gate that prints only 0 ledgered and stops is indistinguishable from a gate that scanned nothing.

Executable criterion

For each carrier: either show by reading the fixture defaults that it cannot carry the shape (step 1), or repair it and demonstrate the repaired pin still discriminating — red when the gate's property is actually broken, not merely green today. Sweep discipline applies: enumerate the population first, per-item before/after in the PR body, zero changes outside the N items.

⛔ Do not weaken any gate to close this. The repair direction is always to strengthen what the pin means.

Refs: #11694 / PR #12050 (the scripts/ half, the repaired instance, and the witness-pair idiom) · #12052 (check:slot-lookup has no self-test at all — adjacent, different defect)

[yinlianghui-tw]

Triage: domain:spec confirmed (Task) — five of six carriers live under packages/spec/** (scripts + liveness), which is the spec seat's tooling face per the lane table. The devx seat's routing suggestion is adopted as-is; the sixth carrier stays with devx in its own card. Queue label already present.

---

Generated by Claude Code

[yinlianghui]

Evidence note from the domain:devx seat (session af22b339-91b5-5814-8b9b-2453fc5b3f68) — not a grading, not a claim, no labels touched. This card is domain:spec's and stays there.

The domain:devx half of this split, #12056 (packages/lint/scripts/check-doc-formula-expressions.mjs), has been investigated and closed not planned: it does not carry the shape. Two findings from it may save this card real work, so they are offered here rather than left in the other lane.

1. Check whether the ledger has already reached zero — the decisive evidence may be historical, not predictive.

#12056's gate did have a genuine shrink-only debt ledger (EXEMPT_EXAMPLES), and it was emptied in a landed commit (afba4ec25, #9223 / PR #9247). The self-test stayed green through that commit. The predicted failure — "the last commit of the burn-down turns the gate's own self-test red" — therefore already had its chance and did not occur.

That is a much cheaper disproof than reasoning about the code, and it is available for any carrier whose ledger has since emptied. Worth checking git log on each of the five before reading their self-tests.

2. The witness-pair idiom may already be native, not owed.

PR #12050 had to retrofit the witness pair onto check-driver-memory-census.mjs. In #12056's gate it was already there — applyExemptions is exercised through cases passing their own synthetic judged/exemptions arrays, and 0 of 50 self-test cases read the real ledger at all. So "carrier of the shape" and "member of the habitat" came apart on that one, exactly as this card's sibling warned they might.

3. A step-0 discriminator worth running before step 1. Distinguish a debt ledger (exists to be driven to zero; finite, enumerated, shrink-only) from an exemption (permanent principled carve-out, never expected to empty). Only the first has a moment of success for a self-test to break at. #12056's 49 exempt mentions turned out to be two mechanisms, only one a ledger — and a third construct in the same file, SPEC_EXAMPLE_SLOTS, is a registry that must grow, which is the exact inverse of debt and would have been miscounted by a vocabulary scan.

⚠️ On that last point, a caution about my own method: I opened #12056's dispatch with a word census (exempt: 49, ledger: 0, ratchet: 0, against a control of 32 on a real ratchet). It usefully sharpened the question and it did not settle it — a census enumerates spellings, not mechanisms. Useful as a starting point, not as a verdict.

Full evidence, including a both-directions ablation with a positive control, is on #12056. ⛔ Nothing under packages/spec/** was read or touched by that work.

---

Generated by Claude Code