fix(pm-scripts): true-green ratchet row, shared repo resolver in ci-failure, measured worklist verdict

[claude]

Closes#11310, closes#11296, closes#11277

Three bounded scripts/pm/ fixes, folded into one PR because they share a surface and a gate family. Non-governed: no file in this diff is on the Prime Directive #14 register. No changeset — scripts/pm/ is PM-loop tooling and publishes nothing (skip-changeset).

Gate union re-run after the final commit, at 58d24e3c8.

Per item

• [finding] references/true-green.md carries no line-ratchet ceiling row — every sibling pm-dispatch references file does #11310 — check-skill-line-ratchet.mjs: CEILINGS row for references/true-green.md. Set at 34, the landed count read from the ratchet's own run (not wc): the row was first inserted at a deliberately low ceiling so the gate itself printed the measurement, true-green.md is 34 lines; the ratchet ceiling is 1, and 34 is that number. Headroom 0, same convention as every sibling references row, with the provenance comment the map's entries carry. The file also passes the 120-byte max-line rule unchanged — the run reports no length offender for it.
• [finding] ci-failure.mjs carries the same hardcoded repo default the sweeper just shed — a copy in a sibling repo would report on objectstack's CI and read as correct #11296 — ci-failure.mjs: import resolveSweepRepo, drop the hardcoded default. The seam already existed (five imports now cross it). PM_SWEEP_REPO then GITHUB_REPOSITORY then the literal default, so a verbatim copy in a sibling repo reads its own board instead of reporting confidently about objectstack's CI. The sweeper's malformed-value refusal is mirrored at the live entry point only — --self-test and --help stay exempt by construction, since they open no socket and must run in any container.
• finding: the bare-root worklist's recorded verdict for check-declaration-mirrors.mjs states a measurement that is wrong in both terms (recursive .d.mts walk, 2 of 236 — not "top-level-only, 115 of 226") #11277 — bare-root-worklist.mjs: the check-declaration-mirrorswhy, rewritten to measured terms, plus the sibling re-derivation. Details below.

#11296 landed-proof

The card names its own re-check grep. Before, one hit; after, none:

$ grep -n "OWNER_REPO = process.env" scripts/pm/*.mjs
scripts/pm/ci-failure.mjs:300:const OWNER_REPO = process.env.PM_SWEEP_REPO ?? 'objectstack-ai/objectstack'; # before
# after: no hits (exit 1)

The new refusal was exercised rather than assumed — it exits before any request, so this run is offline:

$ PM_SWEEP_REPO=objectui node scripts/pm/ci-failure.mjs --pr 1
ci-failure: PM_SWEEP_REPO="objectui" is not an `owner/name` repository. Refusing to fall back to a
different board — a report about the wrong repo reads exactly like a report about this one.
EXIT=2

#11277 re-derivation — every number, and where it came from

The card's row was wrong in both terms. Measured today: the walk is recursive (mirrorFiles() descends, and its docblock says so) and the filter is the .d.mts extension, admitting 2 files, not 115. The rewritten why also re-files the row into the right refusal class — the extension-filter class shared with check:driver-conformance CASE_SETS_DIR and check:skills-token-ratchet SKILLS_DIR, not the "no non-recursive spelling" class of the row above it that its text was copied from. That distinction is load-bearing: lifting the row-above limit would leave this row exactly as refused.

Per the card's rider, the siblings were re-derived in the same pass. Numerators come from each gate's own exported walk, denominators from the worklist's own trackedFiles() helper — never from a hand-reproduced filter, which would be the estimate the file's docblock refuses.

Row	Recorded	Re-derived	Source of numerator
scripts/check-declaration-mirrors.mjs SCRIPTS_DIR scripts	115 of 226 (51%)	2 of 261 (0.77%)	mirrorFiles()
check:ratchet-remedy-authority SCRIPTS_DIR scripts	115 of 226 (51%)	144 of 261 (55%)	corpusFiles()
check:runner-env-posture SCANNED_ROOTS packages	1757 of 5049 (35%)	1794 of 5185 (35%)	collectFiles()
check:runner-env-posture SCANNED_ROOTS examples	150 of 240 (63%)	150 of 241 (62%)	collectFiles()
check:runner-env-posture SCANNED_ROOTS apps	0 of 35	0 of 35 (unchanged)	collectFiles()
scripts/check-skills-token-ratchet.mjs SKILLS_DIR skills	11 of 50 (22%)	11 of 50 (22%) (unchanged)	discoverSkillFiles()

Two collateral figures inside the runner-env-posture packages row were re-derived with that gate's own predicates: the tests it deliberately skips, isTestFile admitting 2746 (recorded 2658), and isProductSource admitting 1794, which reconciles with its collectFiles() share.

Today's denominators, from trackedFiles(): packages 5185, examples 241, scripts 261, skills 50, apps 35.

What was deliberately NOT rewritten, and why. The remaining rows' gates export no walk to drive. Reproducing those filters by hand would be an estimate, and pairing today's denominator with an older numerator would mint a ratio nothing ever measured — the same defect in fresher digits. So those rows keep their original readings, and the docblock now says which rows carry a re-derived measurement, warns against refreshing a denominator alone, and records why --self-test cannot catch this class (it audits keys and verdicts, never what a why says — correct, since a prose assertion cannot be mechanised).

The verdicts themselves are untouched. Every row stays REFUSE-UNSPELLABLE; more strongly correct at 0.77% than at 51%.

Checks run — verdict lines quoted, exit codes captured before any pipe

Each touched script's own --self-test, plus the family derived by node scripts/pm/dispatch-gates.mjs with no paths (the script takes its own change set from the merge base; 10 families matched). All at 58d24e3c8, exit 0:

✓ check-skill-line-ratchet self-test: 71 cases pass.
✓ check-skill-line-ratchet: .claude/skills/pm-dispatch/references/true-green.md is 34 lines (ceiling 34; headroom 0).
OK self-test: 43 live row(s), 37 unreachable as spelled, 37 recorded verdict(s) — none stale, none missing.
✓ check-half-states self-test: 1193 cases pass.
OK self-test: supersession keeps the newest per name and reports the drops (ci-failure)
OK: all 96 declared cross-package glob(s) (81 unique) are covered by `core` or `crosspkg` (ci-filter-parity)

Also green at that head: check:agent-test-spelling, check:entry-guard, check:parse-guard, check:nul-bytes, check:cross-package-test-inputs, check:pnpm-filter-targets — each run as node scripts/... with its status captured before any pipe.

check-ci-filter-parity first exited 1 with PREREQUISITE NOT MET — the dependency yaml is not installed, which measures nothing; it is green above after pnpm install --frozen-lockfile (run through scripts/pm/os-verify-lock.sh, VERDICT command-exit 0 · held the lock 5s · waited 0s).

Control-character self-scan over the three touched files: clean.

Out of scope, filed not fixed

references/compile-surfaces.md is the last remaining pm-dispatch references file with no CEILINGS row — same class as #11310, found by enumerating the directory against the map. Dedup-searched; nothing open covers it. Filed unassigned rather than folded in: the dispatch declared a one-row scope, and the precedent in this map is that a missing row is triaged, not added in passing.

---

Generated by Claude Code