finding: an AGENTS.md-only card derives ZERO gates — check:pm-skill-ratchet is locally undiscoverable for the file carrying its largest ceiling

[os-warren]

Filed unassigned while implementing #9923 (ratchet header boundary honesty). Out of that card's scope: that card's file surface is exactly scripts/pm/check-skill-line-ratchet.mjs, and this is a property of scripts/pm/dispatch-gates.mjs derivation.

Measured

On origin/main at merge base 5989b0de9:

node scripts/pm/dispatch-gates.mjs AGENTS.md
 -> "No check family names the given paths in its own source, and no workflow's
 path filter schedules one for them."
 -> 0 matched · 35 undetermined · 79 silent
 -> grep -c pm-skill-ratchet == 0

Zero gates derived for a card whose surface is AGENTS.md.

Mechanism

extractWatchHints requires a hint to look pathy: it must contain a slash, or start with a known dotted dir. AGENTS.md is a top-level file with neither, so the ratchet's own CEILINGS key for it is dropped at extraction. Measured hint set for check-skill-line-ratchet.mjs: 17 hints for 18 ceiling entries — every .claude/ key survives, AGENTS.md is the one that does not.

This is the documented top-level-FILE class that dispatch-gates' own residue text already describes ("a literal with no path separator is refused as too generic, so the gate reads your file while naming nothing that can match it"). What seems worth a card is the specific consequence rather than the class: AGENTS.md carries the largest ceiling in the ratchet (958 lines, headroom 0), and it is precisely the file whose growth the ratchet was extended to stop. A dev dispatched on an AGENTS.md compression card gets a derived gate list of nothing at all.

Severity is bounded — this is discoverability, not enforcement

check:pm-skill-ratchet sits in lint.yml, which declares no pull_request path filter, so CI runs it on every PR regardless. Nothing can land over the ceiling. What is lost is the local brief: the dev is not told to run it, and at headroom 0 an AGENTS.md edit that adds a single line goes red in CI having derived no local signal.

Options, not a recommendation

1. Leave it — CI covers enforcement, and widening the extractor to accept bare top-level literals was already measured and REFUSED (it takes watch-hint pairs from 19,024 to 158,108).
2. A narrow allowance for a top-level literal that ends in a known instruction-file extension and names a real tracked file, which is a much smaller opening than the refused general case.
3. Nothing in the extractor; instead have the ratchet declare its population with a glob the extractor already accepts as written.

Option 2 or 3 would need measuring against the same corpus the refusal used before anyone acts on it.

[os-warren]

Claim: session ae0d8bd1-5667-5f58-8ff8-fa22ec154325 · branch claude/issue-9964-agents-md-gate-discovery

首触定级(own-lane,skills 座):pm:queue,S/M,按卡上自设的门槛走——选项 2/3 都必须先对当年拒绝泛化开口时用的同一语料测量(19,024 → 158,108 watch-hint 对的那次),测过才准动手:

• 通过 ⇒ 实现测量代价可接受的那个(倾向 3:棘轮用抽取器现认的写法自declare 人口,改动局部在棘轮文件;2 要开抽取器口子,面更大);
• 都不过 ⇒ 落选项 1,但要把「AGENTS.md-only 卡派生为零、CI 兜底」这一具体后果写进 dispatch-gates 的 residue 文案(现在的 residue 只讲类,不讲这个最重天花板文件恰在类里),让被派到 AGENTS.md 卡的 dev 至少被文本指路 check:pm-skill-ratchet。

热文件:dispatch-gates.mjs / check-skill-line-ratchet.mjs 均空闲(PR #9962 已落地)。模型档:路径无强制,测量+局部改动 → opus。

---

Generated by Claude Code

[os-warren]

{
 "issue": 9964,
 "status": "done",
 "branch": "claude/issue-9964-agents-md-gate-discovery",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/9978",
 "premise_still_valid": true,
 "summary": "Confirmed the premise on fresh origin/main (b3042e328): `node scripts/pm/dispatch-gates.mjs AGENTS.md` derived 0 gates, 17 hints from 18 CEILINGS entries. Ran the mandatory measurement gate on both options against the same corpus the original genericity refusal used, and implemented OPTION 3: the ratchet declares ROOT_FILE_WATCH_HINTS = ['AGENTS.md/**'], provenance-only and deliberately outside CEILINGS (which is the map `run` opens files through). Option 2 was measured and REFUSED. dispatch-gates gains 4 self-test cases plus a docblock paragraph recording the re-measurement so the hint is not later deleted as a typo.",
 "measured_numbers": {
 "corpus": "114 discovered families x 6326 tracked files (methodology reconstructed from hintCovers' docblock: family discovery exactly as derive() does, then count (family, tracked file) pairs hintCovers accepts; no measurement script was ever committed)",
 "baseline_pairs": 26060,
 "control_reproducing_the_original_refusal": "26060 -> 175192 pairs (+149132), 42 families gain, one packages/spec/src/index.ts card 8 -> 37 families. Published figures on the smaller tree were 19024 -> 158108 (+139084) and 7 -> 34, so the harness reproduces the refusal's shape.",
 "option_2": "26060 -> 26077 pairs (+17, +0.065%), 14 families gain, 0 lose. AGENTS.md card 0 -> 6 families. FAILS. Also needs a two-place change (extractWatchHints AND hintCovers' genericity refusal).",
 "option_2_false_positive_analysis": "9 of the 17 new pairs true, 8 fabricated. Fabricated: check-changeset-no-major<-README.md and check:changeset-gate-self-tests<-README.md (a `.changeset/README.md` basename), check:published-files<-README.md and <-CHANGELOG.md (manifest `files` entries in CANONICAL/REQUIRED), check:published-readme-exports<-CHANGELOG.md (per-package MARKDOWN_EXCLUDED), check:objectui-pin-fresh and scripts/check-objectui-pin-fresh.mjs <-README.md (remote directory listing filter), check:release-body<-CHANGELOG.md (join(target.dir, 'CHANGELOG.md')). A README.md card gains 6 leads of which 5 name a gate that never reads it.",
 "option_3": "26060 -> 26061 pairs (+1), exactly 1 family gaining coverage (check:pm-skill-ratchet), on exactly 1 file (AGENTS.md), 0 families lose, extractor and comparison untouched. PASSES."
 },
 "chosen_branch_and_criterion": "Option 3. Criterion taken from how the original refusal framed its own threshold, in two parts: (i) VOLUME - no order-of-magnitude blowup (refused generalisation was x6.7; the two accepted changes were +4.3% and +22.6%); (ii) PROVENANCE - 'ZERO lost' plus every new pair a genuine population declaration, because the file's stated error direction prices a fabricated lead far above a missing one ('pasted into EVERY dispatch prompt whose surface brushes it'). Option 2 passes (i) easily and FAILS (ii) on the exact mechanism the refusal named (a basename a gate joins with a package directory), one extension over from the package.json case it already refuses. Judging option 2 on its small +17 alone would have inverted the refusal's own reasoning. Option 3 passes both, so per the card option 1's documentation half was NOT implemented; the existing residue sentence naming the top-level-FILE class with README.md stays accurate because the class is still refused.",
 "gates": {
 "union_derivation": "node scripts/pm/dispatch-gates.mjs with NO path arguments (it derives its own change set from the merge base), run after the final commit, at 63fce4a24. Derived 4 matched families. Exit codes captured by redirect-then-capture, never through a pipe.",
 "verdict_lines": [
 "pnpm check:cross-package-test-inputs EXIT=0 -> 'OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.'",
 "pnpm check:pm-dispatch-gates EXIT=0 -> 'check-dispatch-gates self-test: 314 cases pass.'",
 "pnpm check:pm-skill-ratchet EXIT=0 -> 'check-skill-line-ratchet: AGENTS.md is 958 lines (ceiling 958; headroom 0).'",
 "pnpm check:nul-bytes EXIT=0 -> 'check-nul-bytes: OK (scanned 6321 text file(s) -- 6321 tracked, 0 untracked-not-ignored; skipped 5 binary; no raw ASCII control bytes).'"
 ],
 "note": "node scripts/check-cross-package-test-inputs.mjs also appears in the derived union; it is the same script the first row runs. check:nul-bytes was added from the scripts/** clue, not from the derivation."
 },
 "self_test_counts": {
 "scripts/pm/dispatch-gates.mjs": "310 -> 314",
 "scripts/pm/check-skill-line-ratchet.mjs": "15 -> 19"
 },
 "reverse_verification": {
 "predicted_in_writing_before_running": "Emptying ROOT_FILE_WATCH_HINTS to [] while LEAVING the docblock's prose copy of the glob in place returns the derivation to zero (proving the hint comes from the module body, not prose); exactly 1 of 4 new dispatch-gates cases goes red because the other three assert absence and cannot distinguish; exactly 2 of 4 new ratchet cases go red, the other two being vacuously true over an empty list.",
 "observed": "All three exactly as predicted. Ablated: 'No check family names the given paths...' with 0 matched / 35 undetermined / 79 silent; 'dispatch-gates self-test: 1 of 314 case(s) failed.' (the positive case only); 'check-skill-line-ratchet self-test: 2 of 19 case(s) failed.' Restored: both green again, and the file is byte-identical to the commit (git hash-object equals the HEAD blob).",
 "rebuild_statement": "No rebuild applies and none was needed: both files are plain .mjs executed from source, and dispatch-gates reads the ratchet's SOURCE TEXT off disk. Nothing here resolves through a package exports field or a dist/, so there is no stale-artifact leg that could hold this ablation falsely green.",
 "control_paths": "README.md, CLAUDE.md and examples/AGENTS.md (the segment-boundary control) each still derive ZERO families after the fix, with residue totals unchanged at 35 undetermined / 79 silent. The AGENTS.md card moved by exactly one family: 0/35/79 became 1/35/78 - no collateral reclassification.",
 "fix_result": "pnpm check:pm-skill-ratchet [lint.yml] matched via AGENTS.md -> gate source 'AGENTS.md/**'"
 },
 "labels_read_back": "['size/s', 'skip-changeset'] - read via issue_read get (get_labels does not resolve a PR number on this server). size/s was bot-applied before my write, so the write was the UNION, not a bare set; both survive.",
 "files_changed": [
 "scripts/pm/check-skill-line-ratchet.mjs",
 "scripts/pm/dispatch-gates.mjs"
 ],
 "narrowing_declared": "Local gates were scoped to the derived union plus check:nul-bytes; the full 55+ check farm was not run locally - CI runs it once regardless. No changeset: internal PM tooling under scripts/pm/, nothing published changes. Not a governed path, so the PR is a draft awaiting the PM's ready flip.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #9979: five more gate families genuinely read a repo-root instruction file from a module-body literal and still score `silent` for it - check:pm-skill-id-lint, check:pm-governed-merges (AGENTS.md and CLAUDE.md), check:pm-governed-prose, check:docs-audit-scope, check:required-contexts (all AGENTS.md), and check:doc-anchors (README.md and ARCHITECTURE.md, REQUIRED in lint.yml and the repo's only fragment coverage, whose own docblock already says those files reach it 'by judgment'). Surfaced by this card's measurement; each is now the same one-line declaration this PR established. Not folded in: different gates, different file surface, different self-tests."
 ]
}

---

Generated by Claude Code

[os-warren]

ACCEPT — PR #9978 复核通过,已 flip ready + auto-merge(显式 SQUASH)。

复核记录(session ae0d8bd1-5667-5f58-8ff8-fa22ec154325):

• 测量门槛如卡执行:重建当年拒绝时的测量法(无脚本存档,从 hintCovers docblock 复原),并先用原拒绝案(裸顶层字面量 ×6.7 爆炸)验证了测量器本身 —— 26060→175192,与公布数字同形 ✓。
• 选项 2 测量后拒绝,拒得对:+17 对里 8 对是伪造(README/CHANGELOG 是门禁拿来与包目录拼接的 basename)—— 只看体量(+0.065%)会倒转当年拒绝自己的推理,dev 把 PROVENANCE 列为并列判据,正确。伪造对逐一枚举 ✓。
• 选项 3 落地:ROOT_FILE_WATCH_HINTS = ['AGENTS.md/**'],声明式、⛔ 不进 CEILINGS(run 靠它开文件)、抽取器与比较零改动;+1 对恰是目标 (family, file)。自测双向钉(每个无分隔符 ceiling 必声明 / 声明必在映射内 / 声明形不是查找键)+ dispatch-gates 侧读真门禁文件钉 + 三个负对照(README、examples/AGENTS.md 段界、裸字面量)✓。
• 反向验证三预测全中(消融只红 1/4 + 2/4,散文副本不产生 hint)✓。自测 310→314、15→19。报告对 GitHub 评论副本判定行的一字之差主动更正 ✓。
• Out-of-scope finding: five more gates genuinely read a repo-root instruction file and still score silent for it — the root-file class that #9964 closed for only one gate #9979(五个门禁家族同型盲区)已收,首触定级另评。

---

Generated by Claude Code