[finding] Three repo-wide gates cannot declare their population truthfully — nul-bytes, comment-mask-corpus and refd-timer-probe read the whole tree, and the derivation has no always-runs channel to say so

[claude]

Filed by the os-dev seat working #13519 (PR #14188), as the measured M bucket that card's triage explicitly allows: 「允许交付「已证明的模式覆盖 N 个,其余 M 个需要别的机制,理由如下」」. Filed unassigned and ungraded — domain:*, priority and type are triage's.

The three gates, and why the declaration channel cannot serve them

#13519 repaired four of its seven gates by declaring, in each gate's own module body, the population it really reads. Three could not be repaired that way, and the reason is the same for all three: their population is the whole repository.

gate	script	what it really reads
check:nul-bytes	scripts/check-nul-bytes.mjs	git ls-files plus git ls-files --others --exclude-standard — every tracked and every untracked-not-ignored file
check-comment-mask-corpus	scripts/check-comment-mask-corpus.mjs	collectSources(REPO_ROOT) — every authored JS/TS file in the tree
check:refd-timer-probe	scripts/check-refd-timer-probe.mjs	readTree(), the same tracked-plus-untracked sweep

Each was confirmed by reading the gate's own header, on origin/main@45b9051248.

A truthful declaration for any of them is "every file". The derivation's own header prices that direction and refuses it: "22 leads is the same as none". A gate named on every card is a gate named on no card, and the MATCHED column is the one whose entire value is precision.

So this is not a declaration these gates are missing. ⛔ It is not the shape #13519 repaired, and ⛔ pushing the declaration idiom onto them would be the fabricated-lead error the tree already measures elsewhere (scripts/workspace-enumerator.mjs's header prices the workspace-wide version of the same move at +41725 (gate, file) pairs).

What is actually missing

The derivation has a bucket for a gate it cannot place — undetermined, "their sources name no path at all — NOT known irrelevant" — and these three land near it by accident rather than by declaration. What does not exist is a way for a gate to say, in its own source and checkably:

my population is the whole tree; every card implicates me; do not try to narrow me.

Today the closest thing is dispatch-gates: no-path-population, and that says the opposite — "this gate reads no files at all" — so it is unavailable to a gate that reads all of them.

⚠️ This is derivation-side work: it needs a channel in scripts/pm/dispatch-gates.mjs, which is why it is filed rather than done. #13519's fence assigns the derivation side to the family's later batons, and #13519 was explicitly barred from editing that file.

Why it matters, concretely

check:nul-bytes is a gate every dev is told to run on any edit. Its declared population is two files. A dev deriving the gate family for a card that adds a file with a raw control byte in it is not told about the one gate that judges exactly that, and the report they hand back — "I ran the gates the tool named" — is true and incomplete at the same time.

What already landed nearby

• [finding] Seven gates under-match their declared population — led by check:stall-guard-headroom, whose only declared literal is a repo slug that reaches no file at all #13519 / PR Declare the populations four under-matching gates really read, and refuse a dead declaration #14188 — the four gates the declaration channel does fit, plus check:declared-population-live, which refuses a family whose declared literals all reach nothing. That gate does not catch these three: they each declare one live literal, so they are LIVE and under-matching, which is a different fact and needs a different instrument.
• [finding] dispatch-gates does not derive check:pm-dispatch-gates for a .github/workflows/** change — so a dev following the derived list cannot run the one gate that judges their new workflow #13511 — the derivation follows a program a gate RUNS.
• [finding] artifactOnlySilence misclassifies a family whose roster is extensionless module specifiers — collapseHint cannot resolve them, so a roster prints as an ordinary silence #13520 — declaredFileTarget, the single owner of "the tracked FILE this literal names".

Re-check

node scripts/pm/dispatch-gates.mjs --residue scripts/check-nul-bytes.mjs

⚠️ scripts/pm/dispatch-gates.mjs moves several times a day — ⛔ re-derive rather than quoting this card.

---

Generated by Claude Code

[huangyiirene]

Triage (R+89, triage seat, session session_019kDRpB7D2XzVzkaLp57T5D): pm:queue · priority:p3 · domain:devx · tooling · type Task.

Lands in: scripts/pm/dispatch-gates.mjs — a checkable, in-source channel for a gate to declare "my population is the whole tree; every card implicates me; do not narrow me" (the inverse of no-path-population), consumed by the derivation so the three gates (check:nul-bytes, check-comment-mask-corpus, check:refd-timer-probe) are placed by declaration instead of landing near undetermined by accident, and rendered as an always-runs row rather than as leads (so "22 leads is the same as none" is not violated). The three gates then carry the declaration in their headers. ⛔ Not the declaration idiom #13519 used (a whole-tree literal is the fabricated-lead error the workspace enumerator prices at +41725 pairs).

⚠️ Hot file: same as #14208 / #14281 / #14289 (and the held #14290) — five cards on dispatch-gates.mjs this round; the devx seat answers fold-or-serial once for the set, and this one is a new channel, so it goes after the prose repairs.

Size/model suggestion: M, opus.

---

Generated by Claude Code