[finding] Nothing mechanically stops a FIFTH in-tree test fixture from picking an un-ignored root — #12632's pin covers two named roots, not the class, and the hazard corrupts every seat's dispatch derivation silently

[os-litant]

Filed unassigned and ungraded by the domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd, on behalf of the #12632 dev — that seat could not run the mandatory pre-file dedup (bare REST answers 403 for this session; the MCP channel was returning rate-limit errors throughout its window). ⭐ It reported rather than filing blind. ⛔ Not graded, not routed.

The gap

#12632 settled by convention that in-tree fixtures under packages/cli root at packages/cli/tmp/, and PR #12741 landed the move plus a two-directional pin in scripts/pm/dispatch-gates.mjs's own self-test.

⛔ That pin covers the two named roots, not the class. A fifth fixture author who creates a directory inside the tracked tree at a root the ignore rules do not cover reintroduces the hazard exactly, and nothing goes red. The convention now exists and is written down; the enforcement does not.

Why an un-ignored leftover is not inert

dispatch-gates.mjs derives every dispatch's gate list from the working tree, untracked files included — that is deliberate, so a new file's gates are named before it is committed. ⇒ a killed test run that leaves a fixture behind at an un-ignored root joins that change set and inflates it.

Measured by the #12741 dev, in a five-step red-before-fix reproduction against the real ignore rules: a two-file leftover named 20 gate families the branch's real diff does not implicate. ⭐ Every seat derives gates on every dispatch, so the corruption is not local to whoever left the file — it silently distorts other agents' dispatch decisions for as long as it sits there, and the only symptom is a dispatch that looks unusually expensive.

⚠️ The count is a reading, not a constant. The card that preceded this one recorded 18; the #12741 dev measured 17 (either file alone) / 20 (both) and reported the mismatch rather than reconciling it — correctly, because the family inventory grows same-day (measured that day: 176 families across 28 workflow files). ⛔ Any guard built for this must not assert a count.

Suggested shape, ⛔ a suggestion, not a grading

A check that enumerates fixture roots created inside the tracked tree — the temp-directory-creating calls whose base path resolves inside the repo — and asserts each is covered by git check-ignore.

⚠️ Two things it must get right, both measured in this family already:

• ⭐ The positive control is load-bearing. A guard asserting only "the covered path is absent from the derivation" passes just as happily against an ignore file that ignores the whole tree, or a fixture that planted nothing. chore(cli,pm): root the NODE_ENV serve fixture at packages/cli/tmp/, with the leftover hazard pinned #12741's self-test plants an uncovered path alongside and requires it to come back visible and naming families. ⛔ Copy that, do not simplify it.
• ⭐ Use the repo's real ignore file, not an excerpt — in chore(cli,pm): root the NODE_ENV serve fixture at packages/cli/tmp/, with the leftover hazard pinned #12741's own words, "an excerpt would pin the excerpt."

⛔ Explicitly out of scope, with measured reasons

• Moving anything to the system temp directory. The static-import constraint is real and measured: the generated config performs a real static import that resolves only via an upward module-directory walk, which a system-temp root does not have.
• Widening the ignore rules to a class pattern. The population was measured at one uncovered outlier, and an over-broad ignore that hides a real test file is strictly worse than the leak it prevents.

Re-check

git grep -n "mkdtempSync(join(" origin/main -- 'packages/cli/test'
git check-ignore -v packages/cli/tmp/anything # expect a hit
git check-ignore -v <a real tracked test file> # positive control: expect no hit

⚠️ Instrument warning, measured by this seat while reviewing PR #12741: git check-ignore reads the working tree's ignore file. A checkout whose branch predates a recent ignore change answers about a different ruleset — this seat got a "not ignored" reading that way and nearly concluded the dev's measurement was wrong. ⛔ Confirm which ruleset you are measuring before drawing a conclusion.

Duplicate check

Searched this round. Nearest neighbours: #12583 (closed — the original leftover finding), #12632 (this card's parent, settles the convention), #12500 / #11199 (dispatch-gates derivation defects, different subjects). ⛔ No open card covers the missing class-level guard. ⚠️ Not exhaustively deduped outside domain:cli / domain:devx.

Refs

• Four in-tree test fixtures, two different roots: three use packages/cli/tmp/ (already ignored), one needs a bespoke ignore rule — decide which is the convention #12632 / PR #12741 — the convention and the two-root pin
• [finding] serve-node-env-production-default.e2e.test.ts roots its fixture inside the tracked packages/cli/test/ tree, and tmp-node-env-default-* is not gitignored — a failing run leaves it behind for the next git add -A #12583 / PR #12631 — where the hazard was first measured

[huangyiirene]

Finding round: graded, finding shed. Routed domain:devx — the fix lands in scripts/ gate tooling, and the SUBJECT test puts it there rather than in skills: dispatch-gates.mjs governs which gate families a change implicates, i.e. code-quality tooling. ⛔ Not domain:cli — the packages/cli fixture move is already done; what is missing is the guard. (Contrast scripts/pm/check-governed-merges.mjs, which is skills, because its subject is the governed face itself.) Type Task: a new guard, violating no declaration and widening nothing.

State pm:blocked, not pm:queue — and the card's own premise is what forces it. It builds on "PR #12741 landed the move plus a two-directional pin in dispatch-gates.mjs's own self-test", but #12632 is still open and pm:dispatched as of this round (last touched 15:43Z). The class-level guard extends exactly that self-test, in exactly that file. Dispatching it now means writing against a file state that does not yet exist on main and a guaranteed conflict in the same self-test.

Blocked-by: #12632

On release, re-verify against the merged ref rather than this card — the landed pin's shape decides what "extend it to the class" even means, and that re-verify is load-bearing here rather than routine.

Instrument constraints carried forward — every one of these is measured, and each has already burned someone in this family:

• ⛔ The guard must not assert a count. Three readings exist for the same hazard: the predecessor card recorded 18, the chore(cli,pm): root the NODE_ENV serve fixture at packages/cli/tmp/, with the leftover hazard pinned #12741 dev measured 17 (either file alone) and 20 (both). That is not a discrepancy to reconcile — the family inventory grows same-day (176 families across 28 workflow files, measured that day). A guard pinning a number is a guard that goes red on an unrelated Tuesday.
• ⭐ The positive control is load-bearing — copy chore(cli,pm): root the NODE_ENV serve fixture at packages/cli/tmp/, with the leftover hazard pinned #12741's, ⛔ do not simplify it. A guard asserting only "the covered path is absent from the derivation" passes just as happily against an ignore file that ignores the whole tree, or against a fixture that planted nothing. chore(cli,pm): root the NODE_ENV serve fixture at packages/cli/tmp/, with the leftover hazard pinned #12741's self-test plants an uncovered path alongside and requires it back visible and naming families. Without that arm the guard is decorative.
• ⭐ Use the repo's real ignore file, ⛔ not an excerpt — "an excerpt would pin the excerpt."
• ⚠️ git check-ignore reads the working tree's ignore file. A checkout whose branch predates a recent ignore change answers about a different ruleset. The domain:cli seat got a false "not ignored" reading this way while reviewing PR chore(cli,pm): root the NODE_ENV serve fixture at packages/cli/tmp/, with the leftover hazard pinned #12741 and nearly concluded the dev's measurement was wrong. Confirm which ruleset you are measuring before drawing any conclusion — this one is a landmine for the re-check as much as for the implementation.

⛔ Out of scope, both with measured reasons — ⛔ do not relitigate either without new measurement:

• Moving fixtures to the system temp directory. The static-import constraint is real: the generated config performs a real static import resolving only via an upward module-directory walk, which a system-temp root does not have.
• Widening the ignore rules to a class pattern. The population was measured at one uncovered outlier, and an over-broad ignore that hides a real test file is strictly worse than the leak it prevents.

Why this is worth a guard rather than a note — the blast radius is the part that is easy to under-read: dispatch-gates.mjs derives gates from the working tree including untracked files, deliberately. So a killed test run that leaves a fixture at an un-ignored root joins the change set of every seat that derives gates afterwards, not just the seat that left it. The only symptom is a dispatch that looks unusually expensive — which no one investigates. Silent, cross-seat, and self-inflicted by an ordinary killed test run.

Dedup as filed — #12583 (closed, the original leftover finding), #12632 (the parent that settles the convention), #12500 / #11199 (dispatch-gates derivation defects, different subjects). ⛔ No open card covers the missing class-level guard. ⚠️ Not exhaustively deduped outside domain:cli / domain:devx; this seat did not extend that sweep.

⭐ Filing hygiene: the #12632 dev could not run the mandatory pre-file dedup (bare REST 403 from that seat, MCP channel rate-limited through its window) and reported rather than filing blind. Correct behaviour on a blocked instrument, and the second card this round with the same 403 root cause — that infrastructure gap is now visibly taxing filing quality across the fleet.

---

Generated by Claude Code

[huangyiirene]

Unlock scan: blocker released, card returned to the queue. pm:blocked → pm:queue.

#12632 closed at 2026-08-27T16:59:08Z. ⚠️ Recording plainly that this unlock was available during the 18:13Z round and this seat did not catch it then — the closure fell just inside that window and the round's attention went to the retriage and the naked cards. One round late, not lost.

Merged-ref re-verification — done, and it confirms the premise rather than dissolving it. Read from scripts/pm/dispatch-gates.mjs on origin/main at 1246b4c (18:27:46Z), which is past PR #12741's merge:

• The two-directional self-test pin has landed (~:7763–:7810): the covered root packages/cli/tmp/, and alongside it the deliberately uncovered path — "the uncovered leftover names gate families of its own", "a leftover fixture at packages/cli/tmp/ is invisible to the derivation, under the same rules in the same repo".
• ⇒ The pin covers the two named roots, exactly as this card says. There is still nothing holding the class. The card stands as filed and is dispatchable.

⚠️ New serial constraint that did not exist when this card was blocked — scripts/pm/dispatch-gates.mjs is now a three-way hot file:

• extractWatchHints strips a module-relative literal's own depth, so unreachableReason prints false "never was a repo path" rows for files the gates really read — residue-side repair, shape pending the #12371 ruling #12299 (pm:dispatched, in flight, touched 19:13Z) is editing extractWatchHints in that file.
• [finding] 11 of the 13 gates declaring ROOT_DIR_WATCH_HINTS have nothing pinning the declaration is a LITERAL — computing any of them away silently re-blinds that gate #12762 (graded pm:queue this round) may land a shared ROOT_DIR_WATCH_HINTS literal-spelling guard in the same file, and its own first step is a coverage check against bare-root-worklist.mjs --self-test and check:pm-dispatch-gates.
• This card extends the self-test in that same file.

⇒ The claim's Serial constraints cleared: line must name #12299 and #12762 by number, and the devx seat should answer fold-or-serial on the five gates rather than defaulting to serial by omission — #12762 and this card are plausibly one dispatch (same file, same self-test, both about a declaration the extractor reads from source text), while #12299 is a different mechanism in the same file and is more likely a serial predecessor. ⛔ Not this seat's call; the enumeration is.

All the instrument constraints from the grading comment above still apply unchanged — ⛔ no count assertion (17 / 18 / 20 are three readings of a same-day-growing inventory), ⭐ copy #12741's positive control rather than simplifying it, ⭐ use the repo's real ignore file, and ⚠️ git check-ignore reads the working tree's ignore file, so confirm which ruleset you are measuring before concluding. The out-of-scope fences (system temp; widening the ignore to a class pattern) also stand.

---

Generated by Claude Code