test(scripts): instrument check-route-envelope's declared-vs-discovered correspondence

[yinlianghui]

Fixes#11920

Gives check-route-envelope.mjs's declared-vs-discovered correspondence the instrument it had none of — and closes the whole class rather than the one lookup the card measured.

The measurement — the card's scope was one lookup of nine

The card ablated one site (MODULES[file]). The dispatch asked whether the two sibling lookups carried the same defect. They do, and so does every other site that decides this correspondence. Measured on f7b25c546, one ablation per site, each mutation confirmed on disk (anchor 1 to 0, injected marker 0 to 1) before any reading was taken, each restored under a trap with git status clean afterwards:

ablated site	mutation	production	--self-test
MODULES[file] (surface 1, the card's)	basename credit	0 GREEN	0 GREEN
PLUGIN_ROUTE_MODULES[file] (surface 3)	basename credit	0 GREEN	0 GREEN
EXPRESS_RESPONSE_MODULES[file] (surface 4)	basename credit	0 GREEN	0 GREEN
DISPATCHER_DOMAINS[name] (surface 2)	prefix credit	0 GREEN	0 GREEN
discovered.includes(file) (surface 1 reverse)	basename credit	0 GREEN	0 GREEN
honoRoutes.includes(file) (surface 3 reverse)	basename credit	0 GREEN	0 GREEN
expressRoutes.includes(file) (surface 4 reverse)	basename credit	0 GREEN	0 GREEN
MODULES[rel] in discoverHonoRoutes (surface routing)	basename credit	0 GREEN	0 GREEN

Positive control, reproduced — same harness, same gate, a different mutation. Narrowing discover()'s convention so some modules stop being discovered:

production run, clean tree -> exit 1 (RED)
--self-test -> exit 0

So the harness can redden this gate, and the eight double-greens are a property of the rule rather than of a broken probe.

The reverse-direction and surface-routing rows are new: they do not match the const declared = TABLE[file] shape the card and the dispatch both grepped for, and they carry the identical defect.

Why the live run can never see it

Green means the finding set is empty; loosening a correspondence can only shrink that set; the empty set is the fixed point of shrinking. On a clean tree every discovered module already has an exact declaration, so a fallback never fires and the verdict is identical before and after the rule breaks. --self-test supplies the adversarial population a clean tree by construction cannot contain, and is the only instrument this rule has. That is the #11150 family shape.

What changed

Two pure exported functions become the one place the correspondence is decided, and every site above routes through them:

• declarationFor(table, key) — the declaration a discovered key is credited with, by exact key. Object.hasOwn rather than a bare index read, so a key naming something on Object.prototype answers undefined instead of a truthy inherited function.
• unfoundDeclarations(table, discovered) — the other direction, by exact key, in the table's own key order.

--self-test then drives them over the population the card names: a route module moved to another package keeping its file name. Under exact equality that is two findings at once — NOT DECLARED for the new path and declared ... but not found for the old one. Under a basename credit it is silently zero, each missing finding covering for the other's absence. Every negative case is paired with a positive control, both boundaries (#10534's longer-sibling shape and the prototype shape) are pinned, and a live-population case asserts the helper is wired to the real table rather than only to fixtures.

Reverse verification, from the committed state

Re-ablated at the extracted decision point, mutation confirmed on disk each time, restored from the commit:

mutation	production	--self-test
declarationFor to a basename fallback	0 GREEN	1 RED — a discovered path was credited to a same-named declaration at ANOTHER path
unfoundDeclarations to a basename comparison	0 GREEN	1 RED — the abandoned declaration must read as not found
declarationFor to a bare index read	0 GREEN	1 RED — a declaration table answered from Object.prototype
positive control re-run (narrowed discovery)	1 RED	0 GREEN

Production staying green under all three is the point, not a defect: it is the card's thesis, now carried by an instrument.

The gate's rules did not move

Strengthening only, as the card and the dispatch require. Proof rather than assertion: origin/main's gate and this branch's gate were both run over the same tree and their production output is byte-identical (diff exit 0, both exit 0). Same verdicts, same diagnostics, same tables, same counts — 10 route modules, 16 dispatcher domains, 12 Hono modules, the express walk unchanged.

Verification

All gates re-run on the final commit 86b5c3a2c, exit codes captured before any pipe:

check:agent-test-spelling exit=0
check:cross-package-test-inputs exit=0
check:entry-guard exit=0
check:parse-guard exit=0
check:pnpm-filter-targets exit=0
check:route-envelope exit=0
check-ci-filter-parity.mjs exit=0
check-cross-package-test-inputs exit=0
check:nul-bytes exit=0
check-self-test-wired (#11918) exit=0 both legs

Gate verdict lines, quoted from the gates themselves:

✓ check-route-envelope self-test passed
✓ Route-envelope conformance — 10 route module(s) audited: 7 conformant, 2 ratcheted, 1 exempt
✓ check-self-test-wired: every one of the 128 script(s) CI runs that ship a `--self-test` has that self-test run by CI.

The family list was derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack against this branch's own diff, not inherited.

Lint — a measured narrowing, not a skip. Ran on the changed file rather than the repo, with the three readings that make the narrowing checkable: (1) the receiving population read from eslint's own --print-config — 2 active rules, parserOptions.project and projectService both null, so type-aware linting is not enabled; (2) --format json reports 1 file linted, 0 errors, 0 warnings, exit 0; (3) with type-aware linting off, each file's verdict is computed from its own source plus the flat config, and this diff touches one file and no config file — so no untouched file's verdict can move. The repo-wide sweep is CI's run.

Determinations

• Bare-root obligation (scripts/pm/bare-root-worklist.mjs): does not apply. Verified rather than assumed — the sweep was run against this changed tree and reports 0 untriaged row(s), and check-route-envelope.mjs appears in no row. The change assembles no new scan root; discover(), discoverResponseWriters and discoverDomains are untouched in their root assembly.
• Changeset: skip-changeset, derived from the workflow's own prescription rather than inherited — lint.yml states that "this PR edits a CI-internal script" is the textbook case, since such a PR releases nothing. The diff is one CI-internal script under root scripts/; no package, no published surface, no skills/ file moves.
• Not a governed surface — no docs/adr/, no .claude/, no skills/, no root instruction file. Left draft for the PM seat to review and land.

---

Generated by Claude Code