check-cli-command-ids' "declaration is spelled as a LITERAL" self-test assertion cannot fail — the needle appears in the assertion's own source text

[yinlianghui]

Measured while landing the ROOT_DIR_WATCH_HINTS declarations for #12369. Filed unassigned; not touched there — that card's declared file surface is scripts/pm/bare-root-worklist.mjs plus the two gate scripts named in its ruling, and this is a third gate with a different defect class.

The shape

scripts/check-cli-command-ids.mjs:540 pins that the declaration is written as a source literal rather than computed:

t('the declaration is spelled as a LITERAL in this source, not computed',
 readFileSync(fileURLToPath(import.meta.url), 'utf8').includes("'scripts/**'"),
 'the hint extractor reads source text; a computed `${r}/**` builds no hint at all');

The needle 'scripts/**' is itself spelled as a literal inside the assertion, so readFileSync(own source).includes(...) finds it in the check rather than in the declaration. The assertion is satisfied by its own text.

Measured

'scripts/**' occurs 3 times in that file: the declaration at :176, this assertion at :540, and ROOT_DIR_WATCH_HINTS.includes('scripts/**') at :544. Rewriting only the declaration into the computed form the assertion exists to reject —

const ROOT_DIR_WATCH_HINTS = [`${WALK_ROOT}/**`];

— leaves the literal still present in the file, so the includes check stays green. That is the exact failure it names: a computed spelling builds no watch hint at all, dispatch-gates recovers nothing from the gate, and the gate goes back to being unnameable by every dispatch brief — silently, with --self-test green.

Note :544 does not cover the gap: it asserts the array's runtime value, which the computed form still satisfies. The literal-vs-computed distinction is precisely what nothing checks.

Cleared, for contrast

scripts/check-parse-guard.mjs carries the same idiom and is not affected — 'scripts/**' occurs once there (the declaration only), so it has no source-text includes pin of this shape to be phantom.

Repro

python3 - <<'PY'
f='scripts/check-cli-command-ids.mjs'
s=open(f).read()
print('occurrences:', s.count("'scripts/**'"))
m=s.replace("const ROOT_DIR_WATCH_HINTS = ['scripts/**'];",
 "const ROOT_DIR_WATCH_HINTS = [`${WALK_ROOT}/**`];")
print('literal still found after computing the declaration away:', "'scripts/**'" in m)
PY

The remedy that was measured to work

Assemble the needle instead of spelling it, so the searched byte sequence exists nowhere but the declaration. Landed in scripts/check-objectql-double-limit.mjs on the #12369 branch and ablated in both directions — the naive spelling survived deleting the whole declaration line; the assembled one reds on the computed form:

const declNeedle = `'${SCAN_ROOT}/` + '*'.repeat(2) + `/*${DECLARED_TAIL}'`;
expect('…', readFileSync(fileURLToPath(import.meta.url), 'utf8').includes(declNeedle));

Whether check-cli-command-ids wants that shape or a different one is a judgement for whoever picks this up; what is measured here is only that the assertion as written cannot fail.

Measured on objectstack-ai/objectstack at 68c5dbaab2.