Give dispatch-gates a machine-readable harvest, and a spelling footer

[claude]

Fixes#13462

Triage ruled the shape at R+50: 形 1 (machine-readable output) as the body, 形 2 (spelling footer) as a mandatory adjunct, 形 3 published only as a transitional measure. All three are here. .github/workflows/lint.yml is untouched — its GATE INVOCATION IDIOM comment is a legitimate idiom and not this card's business.

The defect, re-derived on current origin/main (H2)

The reproduction holds verbatim at 57827b617, and the four dropped names are unchanged:

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs
total rows: 12 · spelled 'pnpm …': 8 · spelled 'node scripts/…': 4
dropped by a `pnpm check:` harvest:
node scripts/check-ci-filter-parity.mjs
node scripts/check-cross-package-test-inputs.mjs
node scripts/check-shard-attestation.mjs
node scripts/check-test-completeness.mjs

⭐ Sharper than the card measured: the count is not a safe check either

A consumer greping pnpm check: over the whole output rather than over the block gets 12 rows — the right count and the wrong twelve. It drops all four direct rows and backfills with three families from the pending-changeset section (which do not apply yet) and one from the unreachable section (which is dead). So a footer printing only 12 families would have signed that harvest off. The distribution is what discriminates: that harvest is 12 pnpm and 0 direct, and the footer says 8 and 4. This is why 形 2 had to be the split rather than a count.

H1 — the half the card did not accuse still holds

lint.yml:72-73 claims the direct form loses no discovery. Re-measured at 57827b617: all 39 direct-form gate scripts in lint.yml are discovered by the derivation, 0 missing. The card's attribution boundary stands — the tool is right, the idiom is right, and the loss is at the seam.

What landed

• --commands — stdout carries one runnable command per line and nothing else. --json — the whole derivation as one document. The banner, the change-set provenance and the new accounting all stay on stderr, so a consumer redirecting stdout gets a file it can execute or parse with no filter in front of it. That is the mechanism that makes the hazard structurally unreachable: there is no prose in the stream to pattern-match, so there is no spelling for a pattern to prefer.
• Both modes union the matched families with the convention-triggered ones, deduplicated and sorted. Passing both flags refuses (exit 2) rather than silently preferring one.
• The footer prints the split on every default run — behind no flag, because it is worthless to an un-migrated consumer if it is hidden behind one.
• The published harvest. The correct form was already correct and already in use, as one agent's private discipline stated once in a PR body and enforced by nothing. It is now in the tool's own output and its own source.

What --commands deliberately leaves out, out loud

The pending-changeset families are disclosed (their own key in --json, a named stderr line in --commands) and kept out of the runnable list, because they are derived against a path that does not exist yet. The always-runs tail is likewise named on stderr. A quiet omission is the defect this mode was added to fix, and adding a new one inside the fix is how that defect reproduces itself one layer up.

⛔ The three non-empty controls

1 — --commands emits 12, not 8.

$ node scripts/pm/dispatch-gates.mjs --commands scripts/measure-durability-swallow-family.mjs | wc -l
12
$ ... 2>&1 >/dev/null | head -1
dispatch-gates --commands: 12 command(s) — 8 pnpm, 4 direct node (12 matched by path, 0 by change KIND).

2 — the OLD harvest is still short on the same input. Kept deliberately: a new mode returning 12 proves nothing on its own if the old one would too.

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs \
| awk '/^Local gates for this card/{f=1;next} /^$/{if(f)exit} f' | grep -c 'pnpm check:'
8

The defect is real, and it is untouched for a consumer that has not migrated. --commands is what bypasses it.

3 — the footer does not hardcode "there is always a direct form." On CLAUDE.md, a genuinely pure-pnpm surface:

3 families — 3 pnpm, 0 direct node.

The ⛔ shortfall line correctly does not fire there: with no direct row a one-spelling grep really loses nothing, and a warning that fired anyway would train the reader on a claim the run just measured as false. Both terms still print, at zero. Pinned as a unit case as well as observed live.

⭐ The footer could have broken the snippet it publishes — pinned so it cannot

The published harvest ends the block at the first empty line. A footer butted against the rows would be swallowed into it and read as more commands — the remedy breaking the transition it exists to cover. derive prints the separator first, and the self-test drives the real awk and sed over a real rendering and asserts every harvested row is still a runnable command. Measured after the change: the snippet still yields 12, byte-identical to --commands.

--commands is strictly better than the snippet, not merely equal

The snippet reads the matched block alone, so it silently drops the convention-triggered block printed beneath it. On packages/spec/scripts/authorable-defaults.test.ts: snippet 28 rows, --commands 32 — the four it drops are check:engine-double-contract, check:query-options-erasure, check:type-check-coverage, check:type-check-debt. Pinned end to end.

H3 — this settles #13511, and #13511 stands

PR #13500 added one file, .github/workflows/merged-branch-reaper.yml, and went red on check:pm-dispatch-gates. Replicating that exact surface at 57827b617:

• the derivation returns 17 families (matching [finding] dispatch-gates does not derive check:pm-dispatch-gates for a .github/workflows/** change — so a dev following the derived list cannot run the one gate that judges their new workflow #13511's own figure), and check:pm-dispatch-gates is not among them;
• lint.yml:649 spells it pnpm check:pm-dispatch-gates — the pnpm form.

⇒ A pnpm check: harvest would have kept that gate had it been derived. It was never in the list to be dropped. #13500's miss was a derivation gap, not a harvest drop — #13511 is correctly attributed and is not this card. The two are not folded.

Verification

All at a1ac525ab, exit codes captured before any pipe.

Both convention legs for editing a gate script, quoted from their own verdict lines:

✓ dispatch-gates self-test: 1014 cases pass. (check:pm-dispatch-gates, exit 0)
OK self-test: 51 live row(s), 43 unreachable as spelled, 43 recorded verdict(s)
— none stale, none missing, none contradicted. (bare-root-worklist --self-test, exit 0)

The self-test moved 976 → 1014 (38 new cases). bare-root-worklist.mjs is the tool's only real importer, which is why that leg is owed.

The derived family union for this diff, re-derived on the final commit and run against it — 14 families, all green, plus check:nul-bytes:

EXIT=0 node scripts/check-ci-filter-parity.mjs EXIT=0 pnpm check:cross-package-test-inputs
EXIT=0 node scripts/check-cross-package-test-inputs.mjs EXIT=0 pnpm check:entry-guard
EXIT=0 node scripts/check-self-test-wired.mjs EXIT=0 pnpm check:parse-guard
EXIT=0 node scripts/check-shard-attestation.mjs EXIT=0 pnpm check:pm-dispatch-gates
EXIT=3 node scripts/check-test-completeness.mjs EXIT=0 pnpm check:pnpm-filter-targets
EXIT=0 pnpm check:agent-test-spelling EXIT=0 pnpm check:watch-hint-literal
EXIT=0 pnpm check:bash32-floor EXIT=0 pnpm check:nul-bytes
EXIT=0 pnpm check:cli-command-ids

check-test-completeness.mjs exit 3 = NOT MEASURED — its own output says so, and it is neither red nor green.

Repo-wide ESLint ran in full rather than narrowed: os-verify-lock: VERDICT command-exit 0 · held the lock 68s.

One red, found and fixed, worth recording

check:pnpm-filter-targets went red on my first union run — from my own self-test fixture. That gate sweeps the whole tree for pnpm --filter TARGET and requires a live workspace package; unlike the watch-hint scanner it does not mask self-tests, so an invented @x in a fixture reddens it from inside this file. The fixture now names a real package and the reason is comments beside it. A fixture is still a literal in the tree.

Scope

One file, scripts/pm/dispatch-gates.mjs — exactly the declared surface, nothing spread. No changeset: the diff is scripts/pm/** only and publishes nothing from any package, so skip-changeset applies and is applied.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13462

Triage ruled the shape at R+50: 形 1 (machine-readable output) as the body, 形 2 (spelling footer) as a mandatory adjunct, 形 3 published only as a transitional measure. All three are here. .github/workflows/lint.yml is untouched — its GATE INVOCATION IDIOM comment is a legitimate idiom and not this card's business.

The defect, re-derived on current origin/main (H2)

The reproduction holds verbatim at 57827b617, and the four dropped names are unchanged:

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs
total rows: 12 · spelled 'pnpm …': 8 · spelled 'node scripts/…': 4
dropped by a `pnpm check:` harvest:
node scripts/check-ci-filter-parity.mjs
node scripts/check-cross-package-test-inputs.mjs
node scripts/check-shard-attestation.mjs
node scripts/check-test-completeness.mjs

⭐ Sharper than the card measured: the count is not a safe check either

A consumer greping pnpm check: over the whole output rather than over the block gets 12 rows — the right count and the wrong twelve. It drops all four direct rows and backfills with three families from the pending-changeset section (which do not apply yet) and one from the unreachable section (which is dead). So a footer printing only 12 families would have signed that harvest off. The distribution is what discriminates: that harvest is 12 pnpm and 0 direct, and the footer says 8 and 4. This is why 形 2 had to be the split rather than a count.

H1 — the half the card did not accuse still holds

lint.yml:72-73 claims the direct form loses no discovery. Re-measured at 57827b617: all 39 direct-form gate scripts in lint.yml are discovered by the derivation, 0 missing. The card's attribution boundary stands — the tool is right, the idiom is right, and the loss is at the seam.

What landed

• --commands — stdout carries one runnable command per line and nothing else. --json — the whole derivation as one document. The banner, the change-set provenance and the new accounting all stay on stderr, so a consumer redirecting stdout gets a file it can execute or parse with no filter in front of it. That is the mechanism that makes the hazard structurally unreachable: there is no prose in the stream to pattern-match, so there is no spelling for a pattern to prefer.
• Both modes union the matched families with the convention-triggered ones, deduplicated and sorted. Passing both flags refuses (exit 2) rather than silently preferring one.
• The footer prints the split on every default run — behind no flag, because it is worthless to an un-migrated consumer if it is hidden behind one.
• The published harvest. The correct form was already correct and already in use, as one agent's private discipline stated once in a PR body and enforced by nothing. It is now in the tool's own output and its own source.

What --commands deliberately leaves out, out loud

The pending-changeset families are disclosed (their own key in --json, a named stderr line in --commands) and kept out of the runnable list, because they are derived against a path that does not exist yet. The always-runs tail is likewise named on stderr. A quiet omission is the defect this mode was added to fix, and adding a new one inside the fix is how that defect reproduces itself one layer up.

⛔ The three non-empty controls

1 — --commands emits 12, not 8.

$ node scripts/pm/dispatch-gates.mjs --commands scripts/measure-durability-swallow-family.mjs | wc -l
12
$ ... 2>&1 >/dev/null | head -1
dispatch-gates --commands: 12 command(s) — 8 pnpm, 4 direct node (12 matched by path, 0 by change KIND).

2 — the OLD harvest is still short on the same input. Kept deliberately: a new mode returning 12 proves nothing on its own if the old one would too.

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs \
| awk '/^Local gates for this card/{f=1;next} /^$/{if(f)exit} f' | grep -c 'pnpm check:'
8

The defect is real, and it is untouched for a consumer that has not migrated. --commands is what bypasses it.

3 — the footer does not hardcode "there is always a direct form." On CLAUDE.md, a genuinely pure-pnpm surface:

3 families — 3 pnpm, 0 direct node.

The ⛔ shortfall line correctly does not fire there: with no direct row a one-spelling grep really loses nothing, and a warning that fired anyway would train the reader on a claim the run just measured as false. Both terms still print, at zero. Pinned as a unit case as well as observed live.

⭐ The footer could have broken the snippet it publishes — pinned so it cannot

The published harvest ends the block at the first empty line. A footer butted against the rows would be swallowed into it and read as more commands — the remedy breaking the transition it exists to cover. derive prints the separator first, and the self-test drives the real awk and sed over a real rendering and asserts every harvested row is still a runnable command. Measured after the change: the snippet still yields 12, byte-identical to --commands.

--commands is strictly better than the snippet, not merely equal

The snippet reads the matched block alone, so it silently drops the convention-triggered block printed beneath it. On packages/spec/scripts/authorable-defaults.test.ts: snippet 28 rows, --commands 32 — the four it drops are check:engine-double-contract, check:query-options-erasure, check:type-check-coverage, check:type-check-debt. Pinned end to end.

H3 — this settles #13511, and #13511 stands

PR #13500 added one file, .github/workflows/merged-branch-reaper.yml, and went red on check:pm-dispatch-gates. Replicating that exact surface at 57827b617:

• the derivation returns 17 families (matching [finding] dispatch-gates does not derive check:pm-dispatch-gates for a .github/workflows/** change — so a dev following the derived list cannot run the one gate that judges their new workflow #13511's own figure), and check:pm-dispatch-gates is not among them;
• lint.yml:649 spells it pnpm check:pm-dispatch-gates — the pnpm form.

⇒ A pnpm check: harvest would have kept that gate had it been derived. It was never in the list to be dropped. #13500's miss was a derivation gap, not a harvest drop — #13511 is correctly attributed and is not this card. The two are not folded.

Verification

All at a1ac525ab, exit codes captured before any pipe.

Both convention legs for editing a gate script, quoted from their own verdict lines:

✓ dispatch-gates self-test: 1014 cases pass. (check:pm-dispatch-gates, exit 0)
OK self-test: 51 live row(s), 43 unreachable as spelled, 43 recorded verdict(s)
— none stale, none missing, none contradicted. (bare-root-worklist --self-test, exit 0)

The self-test moved 976 → 1014 (38 new cases). bare-root-worklist.mjs is the tool's only real importer, which is why that leg is owed.

The derived family union for this diff, re-derived on the final commit and run against it — 14 families, all green, plus check:nul-bytes:

EXIT=0 node scripts/check-ci-filter-parity.mjs EXIT=0 pnpm check:cross-package-test-inputs
EXIT=0 node scripts/check-cross-package-test-inputs.mjs EXIT=0 pnpm check:entry-guard
EXIT=0 node scripts/check-self-test-wired.mjs EXIT=0 pnpm check:parse-guard
EXIT=0 node scripts/check-shard-attestation.mjs EXIT=0 pnpm check:pm-dispatch-gates
EXIT=3 node scripts/check-test-completeness.mjs EXIT=0 pnpm check:pnpm-filter-targets
EXIT=0 pnpm check:agent-test-spelling EXIT=0 pnpm check:watch-hint-literal
EXIT=0 pnpm check:bash32-floor EXIT=0 pnpm check:nul-bytes
EXIT=0 pnpm check:cli-command-ids

check-test-completeness.mjs exit 3 = NOT MEASURED — its own output says so, and it is neither red nor green.

Repo-wide ESLint ran in full rather than narrowed: os-verify-lock: VERDICT command-exit 0 · held the lock 68s.

One red, found and fixed, worth recording

check:pnpm-filter-targets went red on my first union run — from my own self-test fixture. That gate sweeps the whole tree for pnpm --filter TARGET and requires a live workspace package; unlike the watch-hint scanner it does not mask self-tests, so an invented @x in a fixture reddens it from inside this file. The fixture now names a real package and the reason is comments beside it. A fixture is still a literal in the tree.

Scope

One file, scripts/pm/dispatch-gates.mjs — exactly the declared surface, nothing spread. No changeset: the diff is scripts/pm/** only and publishes nothing from any package, so skip-changeset applies and is applied.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13462

Triage ruled the shape at R+50: 形 1 (machine-readable output) as the body, 形 2 (spelling footer) as a mandatory adjunct, 形 3 published only as a transitional measure. All three are here. .github/workflows/lint.yml is untouched — its GATE INVOCATION IDIOM comment is a legitimate idiom and not this card's business.

The defect, re-derived on current origin/main (H2)

The reproduction holds verbatim at 57827b617, and the four dropped names are unchanged:

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs
total rows: 12 · spelled 'pnpm …': 8 · spelled 'node scripts/…': 4
dropped by a `pnpm check:` harvest:
node scripts/check-ci-filter-parity.mjs
node scripts/check-cross-package-test-inputs.mjs
node scripts/check-shard-attestation.mjs
node scripts/check-test-completeness.mjs

⭐ Sharper than the card measured: the count is not a safe check either

A consumer greping pnpm check: over the whole output rather than over the block gets 12 rows — the right count and the wrong twelve. It drops all four direct rows and backfills with three families from the pending-changeset section (which do not apply yet) and one from the unreachable section (which is dead). So a footer printing only 12 families would have signed that harvest off. The distribution is what discriminates: that harvest is 12 pnpm and 0 direct, and the footer says 8 and 4. This is why 形 2 had to be the split rather than a count.

H1 — the half the card did not accuse still holds

lint.yml:72-73 claims the direct form loses no discovery. Re-measured at 57827b617: all 39 direct-form gate scripts in lint.yml are discovered by the derivation, 0 missing. The card's attribution boundary stands — the tool is right, the idiom is right, and the loss is at the seam.

What landed

• --commands — stdout carries one runnable command per line and nothing else. --json — the whole derivation as one document. The banner, the change-set provenance and the new accounting all stay on stderr, so a consumer redirecting stdout gets a file it can execute or parse with no filter in front of it. That is the mechanism that makes the hazard structurally unreachable: there is no prose in the stream to pattern-match, so there is no spelling for a pattern to prefer.
• Both modes union the matched families with the convention-triggered ones, deduplicated and sorted. Passing both flags refuses (exit 2) rather than silently preferring one.
• The footer prints the split on every default run — behind no flag, because it is worthless to an un-migrated consumer if it is hidden behind one.
• The published harvest. The correct form was already correct and already in use, as one agent's private discipline stated once in a PR body and enforced by nothing. It is now in the tool's own output and its own source.

What --commands deliberately leaves out, out loud

The pending-changeset families are disclosed (their own key in --json, a named stderr line in --commands) and kept out of the runnable list, because they are derived against a path that does not exist yet. The always-runs tail is likewise named on stderr. A quiet omission is the defect this mode was added to fix, and adding a new one inside the fix is how that defect reproduces itself one layer up.

⛔ The three non-empty controls

1 — --commands emits 12, not 8.

$ node scripts/pm/dispatch-gates.mjs --commands scripts/measure-durability-swallow-family.mjs | wc -l
12
$ ... 2>&1 >/dev/null | head -1
dispatch-gates --commands: 12 command(s) — 8 pnpm, 4 direct node (12 matched by path, 0 by change KIND).

2 — the OLD harvest is still short on the same input. Kept deliberately: a new mode returning 12 proves nothing on its own if the old one would too.

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs \
| awk '/^Local gates for this card/{f=1;next} /^$/{if(f)exit} f' | grep -c 'pnpm check:'
8

The defect is real, and it is untouched for a consumer that has not migrated. --commands is what bypasses it.

3 — the footer does not hardcode "there is always a direct form." On CLAUDE.md, a genuinely pure-pnpm surface:

3 families — 3 pnpm, 0 direct node.

The ⛔ shortfall line correctly does not fire there: with no direct row a one-spelling grep really loses nothing, and a warning that fired anyway would train the reader on a claim the run just measured as false. Both terms still print, at zero. Pinned as a unit case as well as observed live.

⭐ The footer could have broken the snippet it publishes — pinned so it cannot

The published harvest ends the block at the first empty line. A footer butted against the rows would be swallowed into it and read as more commands — the remedy breaking the transition it exists to cover. derive prints the separator first, and the self-test drives the real awk and sed over a real rendering and asserts every harvested row is still a runnable command. Measured after the change: the snippet still yields 12, byte-identical to --commands.

--commands is strictly better than the snippet, not merely equal

The snippet reads the matched block alone, so it silently drops the convention-triggered block printed beneath it. On packages/spec/scripts/authorable-defaults.test.ts: snippet 28 rows, --commands 32 — the four it drops are check:engine-double-contract, check:query-options-erasure, check:type-check-coverage, check:type-check-debt. Pinned end to end.

H3 — this settles #13511, and #13511 stands

PR #13500 added one file, .github/workflows/merged-branch-reaper.yml, and went red on check:pm-dispatch-gates. Replicating that exact surface at 57827b617:

• the derivation returns 17 families (matching [finding] dispatch-gates does not derive check:pm-dispatch-gates for a .github/workflows/** change — so a dev following the derived list cannot run the one gate that judges their new workflow #13511's own figure), and check:pm-dispatch-gates is not among them;
• lint.yml:649 spells it pnpm check:pm-dispatch-gates — the pnpm form.

⇒ A pnpm check: harvest would have kept that gate had it been derived. It was never in the list to be dropped. #13500's miss was a derivation gap, not a harvest drop — #13511 is correctly attributed and is not this card. The two are not folded.

Verification

All at a1ac525ab, exit codes captured before any pipe.

Both convention legs for editing a gate script, quoted from their own verdict lines:

✓ dispatch-gates self-test: 1014 cases pass. (check:pm-dispatch-gates, exit 0)
OK self-test: 51 live row(s), 43 unreachable as spelled, 43 recorded verdict(s)
— none stale, none missing, none contradicted. (bare-root-worklist --self-test, exit 0)

The self-test moved 976 → 1014 (38 new cases). bare-root-worklist.mjs is the tool's only real importer, which is why that leg is owed.

The derived family union for this diff, re-derived on the final commit and run against it — 14 families, all green, plus check:nul-bytes:

EXIT=0 node scripts/check-ci-filter-parity.mjs EXIT=0 pnpm check:cross-package-test-inputs
EXIT=0 node scripts/check-cross-package-test-inputs.mjs EXIT=0 pnpm check:entry-guard
EXIT=0 node scripts/check-self-test-wired.mjs EXIT=0 pnpm check:parse-guard
EXIT=0 node scripts/check-shard-attestation.mjs EXIT=0 pnpm check:pm-dispatch-gates
EXIT=3 node scripts/check-test-completeness.mjs EXIT=0 pnpm check:pnpm-filter-targets
EXIT=0 pnpm check:agent-test-spelling EXIT=0 pnpm check:watch-hint-literal
EXIT=0 pnpm check:bash32-floor EXIT=0 pnpm check:nul-bytes
EXIT=0 pnpm check:cli-command-ids

check-test-completeness.mjs exit 3 = NOT MEASURED — its own output says so, and it is neither red nor green.

Repo-wide ESLint ran in full rather than narrowed: os-verify-lock: VERDICT command-exit 0 · held the lock 68s.

One red, found and fixed, worth recording

check:pnpm-filter-targets went red on my first union run — from my own self-test fixture. That gate sweeps the whole tree for pnpm --filter TARGET and requires a live workspace package; unlike the watch-hint scanner it does not mask self-tests, so an invented @x in a fixture reddens it from inside this file. The fixture now names a real package and the reason is comments beside it. A fixture is still a literal in the tree.

Scope

One file, scripts/pm/dispatch-gates.mjs — exactly the declared surface, nothing spread. No changeset: the diff is scripts/pm/** only and publishes nothing from any package, so skip-changeset applies and is applied.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13462

Triage ruled the shape at R+50: 形 1 (machine-readable output) as the body, 形 2 (spelling footer) as a mandatory adjunct, 形 3 published only as a transitional measure. All three are here. .github/workflows/lint.yml is untouched — its GATE INVOCATION IDIOM comment is a legitimate idiom and not this card's business.

The defect, re-derived on current origin/main (H2)

The reproduction holds verbatim at 57827b617, and the four dropped names are unchanged:

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs
total rows: 12 · spelled 'pnpm …': 8 · spelled 'node scripts/…': 4
dropped by a `pnpm check:` harvest:
node scripts/check-ci-filter-parity.mjs
node scripts/check-cross-package-test-inputs.mjs
node scripts/check-shard-attestation.mjs
node scripts/check-test-completeness.mjs

⭐ Sharper than the card measured: the count is not a safe check either

A consumer greping pnpm check: over the whole output rather than over the block gets 12 rows — the right count and the wrong twelve. It drops all four direct rows and backfills with three families from the pending-changeset section (which do not apply yet) and one from the unreachable section (which is dead). So a footer printing only 12 families would have signed that harvest off. The distribution is what discriminates: that harvest is 12 pnpm and 0 direct, and the footer says 8 and 4. This is why 形 2 had to be the split rather than a count.

H1 — the half the card did not accuse still holds

lint.yml:72-73 claims the direct form loses no discovery. Re-measured at 57827b617: all 39 direct-form gate scripts in lint.yml are discovered by the derivation, 0 missing. The card's attribution boundary stands — the tool is right, the idiom is right, and the loss is at the seam.

What landed

• --commands — stdout carries one runnable command per line and nothing else. --json — the whole derivation as one document. The banner, the change-set provenance and the new accounting all stay on stderr, so a consumer redirecting stdout gets a file it can execute or parse with no filter in front of it. That is the mechanism that makes the hazard structurally unreachable: there is no prose in the stream to pattern-match, so there is no spelling for a pattern to prefer.
• Both modes union the matched families with the convention-triggered ones, deduplicated and sorted. Passing both flags refuses (exit 2) rather than silently preferring one.
• The footer prints the split on every default run — behind no flag, because it is worthless to an un-migrated consumer if it is hidden behind one.
• The published harvest. The correct form was already correct and already in use, as one agent's private discipline stated once in a PR body and enforced by nothing. It is now in the tool's own output and its own source.

What --commands deliberately leaves out, out loud

The pending-changeset families are disclosed (their own key in --json, a named stderr line in --commands) and kept out of the runnable list, because they are derived against a path that does not exist yet. The always-runs tail is likewise named on stderr. A quiet omission is the defect this mode was added to fix, and adding a new one inside the fix is how that defect reproduces itself one layer up.

⛔ The three non-empty controls

1 — --commands emits 12, not 8.

$ node scripts/pm/dispatch-gates.mjs --commands scripts/measure-durability-swallow-family.mjs | wc -l
12
$ ... 2>&1 >/dev/null | head -1
dispatch-gates --commands: 12 command(s) — 8 pnpm, 4 direct node (12 matched by path, 0 by change KIND).

2 — the OLD harvest is still short on the same input. Kept deliberately: a new mode returning 12 proves nothing on its own if the old one would too.

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs \
| awk '/^Local gates for this card/{f=1;next} /^$/{if(f)exit} f' | grep -c 'pnpm check:'
8

The defect is real, and it is untouched for a consumer that has not migrated. --commands is what bypasses it.

3 — the footer does not hardcode "there is always a direct form." On CLAUDE.md, a genuinely pure-pnpm surface:

3 families — 3 pnpm, 0 direct node.

The ⛔ shortfall line correctly does not fire there: with no direct row a one-spelling grep really loses nothing, and a warning that fired anyway would train the reader on a claim the run just measured as false. Both terms still print, at zero. Pinned as a unit case as well as observed live.

⭐ The footer could have broken the snippet it publishes — pinned so it cannot

The published harvest ends the block at the first empty line. A footer butted against the rows would be swallowed into it and read as more commands — the remedy breaking the transition it exists to cover. derive prints the separator first, and the self-test drives the real awk and sed over a real rendering and asserts every harvested row is still a runnable command. Measured after the change: the snippet still yields 12, byte-identical to --commands.

--commands is strictly better than the snippet, not merely equal

The snippet reads the matched block alone, so it silently drops the convention-triggered block printed beneath it. On packages/spec/scripts/authorable-defaults.test.ts: snippet 28 rows, --commands 32 — the four it drops are check:engine-double-contract, check:query-options-erasure, check:type-check-coverage, check:type-check-debt. Pinned end to end.

H3 — this settles #13511, and #13511 stands

PR #13500 added one file, .github/workflows/merged-branch-reaper.yml, and went red on check:pm-dispatch-gates. Replicating that exact surface at 57827b617:

• the derivation returns 17 families (matching [finding] dispatch-gates does not derive check:pm-dispatch-gates for a .github/workflows/** change — so a dev following the derived list cannot run the one gate that judges their new workflow #13511's own figure), and check:pm-dispatch-gates is not among them;
• lint.yml:649 spells it pnpm check:pm-dispatch-gates — the pnpm form.

⇒ A pnpm check: harvest would have kept that gate had it been derived. It was never in the list to be dropped. #13500's miss was a derivation gap, not a harvest drop — #13511 is correctly attributed and is not this card. The two are not folded.

Verification

All at a1ac525ab, exit codes captured before any pipe.

Both convention legs for editing a gate script, quoted from their own verdict lines:

✓ dispatch-gates self-test: 1014 cases pass. (check:pm-dispatch-gates, exit 0)
OK self-test: 51 live row(s), 43 unreachable as spelled, 43 recorded verdict(s)
— none stale, none missing, none contradicted. (bare-root-worklist --self-test, exit 0)

The self-test moved 976 → 1014 (38 new cases). bare-root-worklist.mjs is the tool's only real importer, which is why that leg is owed.

The derived family union for this diff, re-derived on the final commit and run against it — 14 families, all green, plus check:nul-bytes:

EXIT=0 node scripts/check-ci-filter-parity.mjs EXIT=0 pnpm check:cross-package-test-inputs
EXIT=0 node scripts/check-cross-package-test-inputs.mjs EXIT=0 pnpm check:entry-guard
EXIT=0 node scripts/check-self-test-wired.mjs EXIT=0 pnpm check:parse-guard
EXIT=0 node scripts/check-shard-attestation.mjs EXIT=0 pnpm check:pm-dispatch-gates
EXIT=3 node scripts/check-test-completeness.mjs EXIT=0 pnpm check:pnpm-filter-targets
EXIT=0 pnpm check:agent-test-spelling EXIT=0 pnpm check:watch-hint-literal
EXIT=0 pnpm check:bash32-floor EXIT=0 pnpm check:nul-bytes
EXIT=0 pnpm check:cli-command-ids

check-test-completeness.mjs exit 3 = NOT MEASURED — its own output says so, and it is neither red nor green.

Repo-wide ESLint ran in full rather than narrowed: os-verify-lock: VERDICT command-exit 0 · held the lock 68s.

One red, found and fixed, worth recording

check:pnpm-filter-targets went red on my first union run — from my own self-test fixture. That gate sweeps the whole tree for pnpm --filter TARGET and requires a live workspace package; unlike the watch-hint scanner it does not mask self-tests, so an invented @x in a fixture reddens it from inside this file. The fixture now names a real package and the reason is comments beside it. A fixture is still a literal in the tree.

Scope

One file, scripts/pm/dispatch-gates.mjs — exactly the declared surface, nothing spread. No changeset: the diff is scripts/pm/** only and publishes nothing from any package, so skip-changeset applies and is applied.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13462

Triage ruled the shape at R+50: 形 1 (machine-readable output) as the body, 形 2 (spelling footer) as a mandatory adjunct, 形 3 published only as a transitional measure. All three are here. .github/workflows/lint.yml is untouched — its GATE INVOCATION IDIOM comment is a legitimate idiom and not this card's business.

The defect, re-derived on current origin/main (H2)

The reproduction holds verbatim at 57827b617, and the four dropped names are unchanged:

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs
total rows: 12 · spelled 'pnpm …': 8 · spelled 'node scripts/…': 4
dropped by a `pnpm check:` harvest:
node scripts/check-ci-filter-parity.mjs
node scripts/check-cross-package-test-inputs.mjs
node scripts/check-shard-attestation.mjs
node scripts/check-test-completeness.mjs

⭐ Sharper than the card measured: the count is not a safe check either

A consumer greping pnpm check: over the whole output rather than over the block gets 12 rows — the right count and the wrong twelve. It drops all four direct rows and backfills with three families from the pending-changeset section (which do not apply yet) and one from the unreachable section (which is dead). So a footer printing only 12 families would have signed that harvest off. The distribution is what discriminates: that harvest is 12 pnpm and 0 direct, and the footer says 8 and 4. This is why 形 2 had to be the split rather than a count.

H1 — the half the card did not accuse still holds

lint.yml:72-73 claims the direct form loses no discovery. Re-measured at 57827b617: all 39 direct-form gate scripts in lint.yml are discovered by the derivation, 0 missing. The card's attribution boundary stands — the tool is right, the idiom is right, and the loss is at the seam.

What landed

• --commands — stdout carries one runnable command per line and nothing else. --json — the whole derivation as one document. The banner, the change-set provenance and the new accounting all stay on stderr, so a consumer redirecting stdout gets a file it can execute or parse with no filter in front of it. That is the mechanism that makes the hazard structurally unreachable: there is no prose in the stream to pattern-match, so there is no spelling for a pattern to prefer.
• Both modes union the matched families with the convention-triggered ones, deduplicated and sorted. Passing both flags refuses (exit 2) rather than silently preferring one.
• The footer prints the split on every default run — behind no flag, because it is worthless to an un-migrated consumer if it is hidden behind one.
• The published harvest. The correct form was already correct and already in use, as one agent's private discipline stated once in a PR body and enforced by nothing. It is now in the tool's own output and its own source.

What --commands deliberately leaves out, out loud

The pending-changeset families are disclosed (their own key in --json, a named stderr line in --commands) and kept out of the runnable list, because they are derived against a path that does not exist yet. The always-runs tail is likewise named on stderr. A quiet omission is the defect this mode was added to fix, and adding a new one inside the fix is how that defect reproduces itself one layer up.

⛔ The three non-empty controls

1 — --commands emits 12, not 8.

$ node scripts/pm/dispatch-gates.mjs --commands scripts/measure-durability-swallow-family.mjs | wc -l
12
$ ... 2>&1 >/dev/null | head -1
dispatch-gates --commands: 12 command(s) — 8 pnpm, 4 direct node (12 matched by path, 0 by change KIND).

2 — the OLD harvest is still short on the same input. Kept deliberately: a new mode returning 12 proves nothing on its own if the old one would too.

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs \
| awk '/^Local gates for this card/{f=1;next} /^$/{if(f)exit} f' | grep -c 'pnpm check:'
8

The defect is real, and it is untouched for a consumer that has not migrated. --commands is what bypasses it.

3 — the footer does not hardcode "there is always a direct form." On CLAUDE.md, a genuinely pure-pnpm surface:

3 families — 3 pnpm, 0 direct node.

The ⛔ shortfall line correctly does not fire there: with no direct row a one-spelling grep really loses nothing, and a warning that fired anyway would train the reader on a claim the run just measured as false. Both terms still print, at zero. Pinned as a unit case as well as observed live.

⭐ The footer could have broken the snippet it publishes — pinned so it cannot

The published harvest ends the block at the first empty line. A footer butted against the rows would be swallowed into it and read as more commands — the remedy breaking the transition it exists to cover. derive prints the separator first, and the self-test drives the real awk and sed over a real rendering and asserts every harvested row is still a runnable command. Measured after the change: the snippet still yields 12, byte-identical to --commands.

--commands is strictly better than the snippet, not merely equal

The snippet reads the matched block alone, so it silently drops the convention-triggered block printed beneath it. On packages/spec/scripts/authorable-defaults.test.ts: snippet 28 rows, --commands 32 — the four it drops are check:engine-double-contract, check:query-options-erasure, check:type-check-coverage, check:type-check-debt. Pinned end to end.

H3 — this settles #13511, and #13511 stands

PR #13500 added one file, .github/workflows/merged-branch-reaper.yml, and went red on check:pm-dispatch-gates. Replicating that exact surface at 57827b617:

• the derivation returns 17 families (matching [finding] dispatch-gates does not derive check:pm-dispatch-gates for a .github/workflows/** change — so a dev following the derived list cannot run the one gate that judges their new workflow #13511's own figure), and check:pm-dispatch-gates is not among them;
• lint.yml:649 spells it pnpm check:pm-dispatch-gates — the pnpm form.

⇒ A pnpm check: harvest would have kept that gate had it been derived. It was never in the list to be dropped. #13500's miss was a derivation gap, not a harvest drop — #13511 is correctly attributed and is not this card. The two are not folded.

Verification

All at a1ac525ab, exit codes captured before any pipe.

Both convention legs for editing a gate script, quoted from their own verdict lines:

✓ dispatch-gates self-test: 1014 cases pass. (check:pm-dispatch-gates, exit 0)
OK self-test: 51 live row(s), 43 unreachable as spelled, 43 recorded verdict(s)
— none stale, none missing, none contradicted. (bare-root-worklist --self-test, exit 0)

The self-test moved 976 → 1014 (38 new cases). bare-root-worklist.mjs is the tool's only real importer, which is why that leg is owed.

The derived family union for this diff, re-derived on the final commit and run against it — 14 families, all green, plus check:nul-bytes:

EXIT=0 node scripts/check-ci-filter-parity.mjs EXIT=0 pnpm check:cross-package-test-inputs
EXIT=0 node scripts/check-cross-package-test-inputs.mjs EXIT=0 pnpm check:entry-guard
EXIT=0 node scripts/check-self-test-wired.mjs EXIT=0 pnpm check:parse-guard
EXIT=0 node scripts/check-shard-attestation.mjs EXIT=0 pnpm check:pm-dispatch-gates
EXIT=3 node scripts/check-test-completeness.mjs EXIT=0 pnpm check:pnpm-filter-targets
EXIT=0 pnpm check:agent-test-spelling EXIT=0 pnpm check:watch-hint-literal
EXIT=0 pnpm check:bash32-floor EXIT=0 pnpm check:nul-bytes
EXIT=0 pnpm check:cli-command-ids

check-test-completeness.mjs exit 3 = NOT MEASURED — its own output says so, and it is neither red nor green.

Repo-wide ESLint ran in full rather than narrowed: os-verify-lock: VERDICT command-exit 0 · held the lock 68s.

One red, found and fixed, worth recording

check:pnpm-filter-targets went red on my first union run — from my own self-test fixture. That gate sweeps the whole tree for pnpm --filter TARGET and requires a live workspace package; unlike the watch-hint scanner it does not mask self-tests, so an invented @x in a fixture reddens it from inside this file. The fixture now names a real package and the reason is comments beside it. A fixture is still a literal in the tree.

Scope

One file, scripts/pm/dispatch-gates.mjs — exactly the declared surface, nothing spread. No changeset: the diff is scripts/pm/** only and publishes nothing from any package, so skip-changeset applies and is applied.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13462

Triage ruled the shape at R+50: 形 1 (machine-readable output) as the body, 形 2 (spelling footer) as a mandatory adjunct, 形 3 published only as a transitional measure. All three are here. .github/workflows/lint.yml is untouched — its GATE INVOCATION IDIOM comment is a legitimate idiom and not this card's business.

The defect, re-derived on current origin/main (H2)

The reproduction holds verbatim at 57827b617, and the four dropped names are unchanged:

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs
total rows: 12 · spelled 'pnpm …': 8 · spelled 'node scripts/…': 4
dropped by a `pnpm check:` harvest:
node scripts/check-ci-filter-parity.mjs
node scripts/check-cross-package-test-inputs.mjs
node scripts/check-shard-attestation.mjs
node scripts/check-test-completeness.mjs

⭐ Sharper than the card measured: the count is not a safe check either

A consumer greping pnpm check: over the whole output rather than over the block gets 12 rows — the right count and the wrong twelve. It drops all four direct rows and backfills with three families from the pending-changeset section (which do not apply yet) and one from the unreachable section (which is dead). So a footer printing only 12 families would have signed that harvest off. The distribution is what discriminates: that harvest is 12 pnpm and 0 direct, and the footer says 8 and 4. This is why 形 2 had to be the split rather than a count.

H1 — the half the card did not accuse still holds

lint.yml:72-73 claims the direct form loses no discovery. Re-measured at 57827b617: all 39 direct-form gate scripts in lint.yml are discovered by the derivation, 0 missing. The card's attribution boundary stands — the tool is right, the idiom is right, and the loss is at the seam.

What landed

• --commands — stdout carries one runnable command per line and nothing else. --json — the whole derivation as one document. The banner, the change-set provenance and the new accounting all stay on stderr, so a consumer redirecting stdout gets a file it can execute or parse with no filter in front of it. That is the mechanism that makes the hazard structurally unreachable: there is no prose in the stream to pattern-match, so there is no spelling for a pattern to prefer.
• Both modes union the matched families with the convention-triggered ones, deduplicated and sorted. Passing both flags refuses (exit 2) rather than silently preferring one.
• The footer prints the split on every default run — behind no flag, because it is worthless to an un-migrated consumer if it is hidden behind one.
• The published harvest. The correct form was already correct and already in use, as one agent's private discipline stated once in a PR body and enforced by nothing. It is now in the tool's own output and its own source.

What --commands deliberately leaves out, out loud

The pending-changeset families are disclosed (their own key in --json, a named stderr line in --commands) and kept out of the runnable list, because they are derived against a path that does not exist yet. The always-runs tail is likewise named on stderr. A quiet omission is the defect this mode was added to fix, and adding a new one inside the fix is how that defect reproduces itself one layer up.

⛔ The three non-empty controls

1 — --commands emits 12, not 8.

$ node scripts/pm/dispatch-gates.mjs --commands scripts/measure-durability-swallow-family.mjs | wc -l
12
$ ... 2>&1 >/dev/null | head -1
dispatch-gates --commands: 12 command(s) — 8 pnpm, 4 direct node (12 matched by path, 0 by change KIND).

2 — the OLD harvest is still short on the same input. Kept deliberately: a new mode returning 12 proves nothing on its own if the old one would too.

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs \
| awk '/^Local gates for this card/{f=1;next} /^$/{if(f)exit} f' | grep -c 'pnpm check:'
8

The defect is real, and it is untouched for a consumer that has not migrated. --commands is what bypasses it.

3 — the footer does not hardcode "there is always a direct form." On CLAUDE.md, a genuinely pure-pnpm surface:

3 families — 3 pnpm, 0 direct node.

The ⛔ shortfall line correctly does not fire there: with no direct row a one-spelling grep really loses nothing, and a warning that fired anyway would train the reader on a claim the run just measured as false. Both terms still print, at zero. Pinned as a unit case as well as observed live.

⭐ The footer could have broken the snippet it publishes — pinned so it cannot

The published harvest ends the block at the first empty line. A footer butted against the rows would be swallowed into it and read as more commands — the remedy breaking the transition it exists to cover. derive prints the separator first, and the self-test drives the real awk and sed over a real rendering and asserts every harvested row is still a runnable command. Measured after the change: the snippet still yields 12, byte-identical to --commands.

--commands is strictly better than the snippet, not merely equal

The snippet reads the matched block alone, so it silently drops the convention-triggered block printed beneath it. On packages/spec/scripts/authorable-defaults.test.ts: snippet 28 rows, --commands 32 — the four it drops are check:engine-double-contract, check:query-options-erasure, check:type-check-coverage, check:type-check-debt. Pinned end to end.

H3 — this settles #13511, and #13511 stands

PR #13500 added one file, .github/workflows/merged-branch-reaper.yml, and went red on check:pm-dispatch-gates. Replicating that exact surface at 57827b617:

• the derivation returns 17 families (matching [finding] dispatch-gates does not derive check:pm-dispatch-gates for a .github/workflows/** change — so a dev following the derived list cannot run the one gate that judges their new workflow #13511's own figure), and check:pm-dispatch-gates is not among them;
• lint.yml:649 spells it pnpm check:pm-dispatch-gates — the pnpm form.

⇒ A pnpm check: harvest would have kept that gate had it been derived. It was never in the list to be dropped. #13500's miss was a derivation gap, not a harvest drop — #13511 is correctly attributed and is not this card. The two are not folded.

Verification

All at a1ac525ab, exit codes captured before any pipe.

Both convention legs for editing a gate script, quoted from their own verdict lines:

✓ dispatch-gates self-test: 1014 cases pass. (check:pm-dispatch-gates, exit 0)
OK self-test: 51 live row(s), 43 unreachable as spelled, 43 recorded verdict(s)
— none stale, none missing, none contradicted. (bare-root-worklist --self-test, exit 0)

The self-test moved 976 → 1014 (38 new cases). bare-root-worklist.mjs is the tool's only real importer, which is why that leg is owed.

The derived family union for this diff, re-derived on the final commit and run against it — 14 families, all green, plus check:nul-bytes:

EXIT=0 node scripts/check-ci-filter-parity.mjs EXIT=0 pnpm check:cross-package-test-inputs
EXIT=0 node scripts/check-cross-package-test-inputs.mjs EXIT=0 pnpm check:entry-guard
EXIT=0 node scripts/check-self-test-wired.mjs EXIT=0 pnpm check:parse-guard
EXIT=0 node scripts/check-shard-attestation.mjs EXIT=0 pnpm check:pm-dispatch-gates
EXIT=3 node scripts/check-test-completeness.mjs EXIT=0 pnpm check:pnpm-filter-targets
EXIT=0 pnpm check:agent-test-spelling EXIT=0 pnpm check:watch-hint-literal
EXIT=0 pnpm check:bash32-floor EXIT=0 pnpm check:nul-bytes
EXIT=0 pnpm check:cli-command-ids

check-test-completeness.mjs exit 3 = NOT MEASURED — its own output says so, and it is neither red nor green.

Repo-wide ESLint ran in full rather than narrowed: os-verify-lock: VERDICT command-exit 0 · held the lock 68s.

One red, found and fixed, worth recording

check:pnpm-filter-targets went red on my first union run — from my own self-test fixture. That gate sweeps the whole tree for pnpm --filter TARGET and requires a live workspace package; unlike the watch-hint scanner it does not mask self-tests, so an invented @x in a fixture reddens it from inside this file. The fixture now names a real package and the reason is comments beside it. A fixture is still a literal in the tree.

Scope

One file, scripts/pm/dispatch-gates.mjs — exactly the declared surface, nothing spread. No changeset: the diff is scripts/pm/** only and publishes nothing from any package, so skip-changeset applies and is applied.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13462

Triage ruled the shape at R+50: 形 1 (machine-readable output) as the body, 形 2 (spelling footer) as a mandatory adjunct, 形 3 published only as a transitional measure. All three are here. .github/workflows/lint.yml is untouched — its GATE INVOCATION IDIOM comment is a legitimate idiom and not this card's business.

The defect, re-derived on current origin/main (H2)

The reproduction holds verbatim at 57827b617, and the four dropped names are unchanged:

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs
total rows: 12 · spelled 'pnpm …': 8 · spelled 'node scripts/…': 4
dropped by a `pnpm check:` harvest:
node scripts/check-ci-filter-parity.mjs
node scripts/check-cross-package-test-inputs.mjs
node scripts/check-shard-attestation.mjs
node scripts/check-test-completeness.mjs

⭐ Sharper than the card measured: the count is not a safe check either

A consumer greping pnpm check: over the whole output rather than over the block gets 12 rows — the right count and the wrong twelve. It drops all four direct rows and backfills with three families from the pending-changeset section (which do not apply yet) and one from the unreachable section (which is dead). So a footer printing only 12 families would have signed that harvest off. The distribution is what discriminates: that harvest is 12 pnpm and 0 direct, and the footer says 8 and 4. This is why 形 2 had to be the split rather than a count.

H1 — the half the card did not accuse still holds

lint.yml:72-73 claims the direct form loses no discovery. Re-measured at 57827b617: all 39 direct-form gate scripts in lint.yml are discovered by the derivation, 0 missing. The card's attribution boundary stands — the tool is right, the idiom is right, and the loss is at the seam.

What landed

• --commands — stdout carries one runnable command per line and nothing else. --json — the whole derivation as one document. The banner, the change-set provenance and the new accounting all stay on stderr, so a consumer redirecting stdout gets a file it can execute or parse with no filter in front of it. That is the mechanism that makes the hazard structurally unreachable: there is no prose in the stream to pattern-match, so there is no spelling for a pattern to prefer.
• Both modes union the matched families with the convention-triggered ones, deduplicated and sorted. Passing both flags refuses (exit 2) rather than silently preferring one.
• The footer prints the split on every default run — behind no flag, because it is worthless to an un-migrated consumer if it is hidden behind one.
• The published harvest. The correct form was already correct and already in use, as one agent's private discipline stated once in a PR body and enforced by nothing. It is now in the tool's own output and its own source.

What --commands deliberately leaves out, out loud

The pending-changeset families are disclosed (their own key in --json, a named stderr line in --commands) and kept out of the runnable list, because they are derived against a path that does not exist yet. The always-runs tail is likewise named on stderr. A quiet omission is the defect this mode was added to fix, and adding a new one inside the fix is how that defect reproduces itself one layer up.

⛔ The three non-empty controls

1 — --commands emits 12, not 8.

$ node scripts/pm/dispatch-gates.mjs --commands scripts/measure-durability-swallow-family.mjs | wc -l
12
$ ... 2>&1 >/dev/null | head -1
dispatch-gates --commands: 12 command(s) — 8 pnpm, 4 direct node (12 matched by path, 0 by change KIND).

2 — the OLD harvest is still short on the same input. Kept deliberately: a new mode returning 12 proves nothing on its own if the old one would too.

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs \
| awk '/^Local gates for this card/{f=1;next} /^$/{if(f)exit} f' | grep -c 'pnpm check:'
8

The defect is real, and it is untouched for a consumer that has not migrated. --commands is what bypasses it.

3 — the footer does not hardcode "there is always a direct form." On CLAUDE.md, a genuinely pure-pnpm surface:

3 families — 3 pnpm, 0 direct node.

The ⛔ shortfall line correctly does not fire there: with no direct row a one-spelling grep really loses nothing, and a warning that fired anyway would train the reader on a claim the run just measured as false. Both terms still print, at zero. Pinned as a unit case as well as observed live.

⭐ The footer could have broken the snippet it publishes — pinned so it cannot

The published harvest ends the block at the first empty line. A footer butted against the rows would be swallowed into it and read as more commands — the remedy breaking the transition it exists to cover. derive prints the separator first, and the self-test drives the real awk and sed over a real rendering and asserts every harvested row is still a runnable command. Measured after the change: the snippet still yields 12, byte-identical to --commands.

--commands is strictly better than the snippet, not merely equal

The snippet reads the matched block alone, so it silently drops the convention-triggered block printed beneath it. On packages/spec/scripts/authorable-defaults.test.ts: snippet 28 rows, --commands 32 — the four it drops are check:engine-double-contract, check:query-options-erasure, check:type-check-coverage, check:type-check-debt. Pinned end to end.

H3 — this settles #13511, and #13511 stands

PR #13500 added one file, .github/workflows/merged-branch-reaper.yml, and went red on check:pm-dispatch-gates. Replicating that exact surface at 57827b617:

• the derivation returns 17 families (matching [finding] dispatch-gates does not derive check:pm-dispatch-gates for a .github/workflows/** change — so a dev following the derived list cannot run the one gate that judges their new workflow #13511's own figure), and check:pm-dispatch-gates is not among them;
• lint.yml:649 spells it pnpm check:pm-dispatch-gates — the pnpm form.

⇒ A pnpm check: harvest would have kept that gate had it been derived. It was never in the list to be dropped. #13500's miss was a derivation gap, not a harvest drop — #13511 is correctly attributed and is not this card. The two are not folded.

Verification

All at a1ac525ab, exit codes captured before any pipe.

Both convention legs for editing a gate script, quoted from their own verdict lines:

✓ dispatch-gates self-test: 1014 cases pass. (check:pm-dispatch-gates, exit 0)
OK self-test: 51 live row(s), 43 unreachable as spelled, 43 recorded verdict(s)
— none stale, none missing, none contradicted. (bare-root-worklist --self-test, exit 0)

The self-test moved 976 → 1014 (38 new cases). bare-root-worklist.mjs is the tool's only real importer, which is why that leg is owed.

The derived family union for this diff, re-derived on the final commit and run against it — 14 families, all green, plus check:nul-bytes:

EXIT=0 node scripts/check-ci-filter-parity.mjs EXIT=0 pnpm check:cross-package-test-inputs
EXIT=0 node scripts/check-cross-package-test-inputs.mjs EXIT=0 pnpm check:entry-guard
EXIT=0 node scripts/check-self-test-wired.mjs EXIT=0 pnpm check:parse-guard
EXIT=0 node scripts/check-shard-attestation.mjs EXIT=0 pnpm check:pm-dispatch-gates
EXIT=3 node scripts/check-test-completeness.mjs EXIT=0 pnpm check:pnpm-filter-targets
EXIT=0 pnpm check:agent-test-spelling EXIT=0 pnpm check:watch-hint-literal
EXIT=0 pnpm check:bash32-floor EXIT=0 pnpm check:nul-bytes
EXIT=0 pnpm check:cli-command-ids

check-test-completeness.mjs exit 3 = NOT MEASURED — its own output says so, and it is neither red nor green.

Repo-wide ESLint ran in full rather than narrowed: os-verify-lock: VERDICT command-exit 0 · held the lock 68s.

One red, found and fixed, worth recording

check:pnpm-filter-targets went red on my first union run — from my own self-test fixture. That gate sweeps the whole tree for pnpm --filter TARGET and requires a live workspace package; unlike the watch-hint scanner it does not mask self-tests, so an invented @x in a fixture reddens it from inside this file. The fixture now names a real package and the reason is comments beside it. A fixture is still a literal in the tree.

Scope

One file, scripts/pm/dispatch-gates.mjs — exactly the declared surface, nothing spread. No changeset: the diff is scripts/pm/** only and publishes nothing from any package, so skip-changeset applies and is applied.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13462

Triage ruled the shape at R+50: 形 1 (machine-readable output) as the body, 形 2 (spelling footer) as a mandatory adjunct, 形 3 published only as a transitional measure. All three are here. .github/workflows/lint.yml is untouched — its GATE INVOCATION IDIOM comment is a legitimate idiom and not this card's business.

The defect, re-derived on current origin/main (H2)

The reproduction holds verbatim at 57827b617, and the four dropped names are unchanged:

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs
total rows: 12 · spelled 'pnpm …': 8 · spelled 'node scripts/…': 4
dropped by a `pnpm check:` harvest:
node scripts/check-ci-filter-parity.mjs
node scripts/check-cross-package-test-inputs.mjs
node scripts/check-shard-attestation.mjs
node scripts/check-test-completeness.mjs

⭐ Sharper than the card measured: the count is not a safe check either

A consumer greping pnpm check: over the whole output rather than over the block gets 12 rows — the right count and the wrong twelve. It drops all four direct rows and backfills with three families from the pending-changeset section (which do not apply yet) and one from the unreachable section (which is dead). So a footer printing only 12 families would have signed that harvest off. The distribution is what discriminates: that harvest is 12 pnpm and 0 direct, and the footer says 8 and 4. This is why 形 2 had to be the split rather than a count.

H1 — the half the card did not accuse still holds

lint.yml:72-73 claims the direct form loses no discovery. Re-measured at 57827b617: all 39 direct-form gate scripts in lint.yml are discovered by the derivation, 0 missing. The card's attribution boundary stands — the tool is right, the idiom is right, and the loss is at the seam.

What landed

• --commands — stdout carries one runnable command per line and nothing else. --json — the whole derivation as one document. The banner, the change-set provenance and the new accounting all stay on stderr, so a consumer redirecting stdout gets a file it can execute or parse with no filter in front of it. That is the mechanism that makes the hazard structurally unreachable: there is no prose in the stream to pattern-match, so there is no spelling for a pattern to prefer.
• Both modes union the matched families with the convention-triggered ones, deduplicated and sorted. Passing both flags refuses (exit 2) rather than silently preferring one.
• The footer prints the split on every default run — behind no flag, because it is worthless to an un-migrated consumer if it is hidden behind one.
• The published harvest. The correct form was already correct and already in use, as one agent's private discipline stated once in a PR body and enforced by nothing. It is now in the tool's own output and its own source.

What --commands deliberately leaves out, out loud

The pending-changeset families are disclosed (their own key in --json, a named stderr line in --commands) and kept out of the runnable list, because they are derived against a path that does not exist yet. The always-runs tail is likewise named on stderr. A quiet omission is the defect this mode was added to fix, and adding a new one inside the fix is how that defect reproduces itself one layer up.

⛔ The three non-empty controls

1 — --commands emits 12, not 8.

$ node scripts/pm/dispatch-gates.mjs --commands scripts/measure-durability-swallow-family.mjs | wc -l
12
$ ... 2>&1 >/dev/null | head -1
dispatch-gates --commands: 12 command(s) — 8 pnpm, 4 direct node (12 matched by path, 0 by change KIND).

2 — the OLD harvest is still short on the same input. Kept deliberately: a new mode returning 12 proves nothing on its own if the old one would too.

$ node scripts/pm/dispatch-gates.mjs scripts/measure-durability-swallow-family.mjs \
| awk '/^Local gates for this card/{f=1;next} /^$/{if(f)exit} f' | grep -c 'pnpm check:'
8

The defect is real, and it is untouched for a consumer that has not migrated. --commands is what bypasses it.

3 — the footer does not hardcode "there is always a direct form." On CLAUDE.md, a genuinely pure-pnpm surface:

3 families — 3 pnpm, 0 direct node.

The ⛔ shortfall line correctly does not fire there: with no direct row a one-spelling grep really loses nothing, and a warning that fired anyway would train the reader on a claim the run just measured as false. Both terms still print, at zero. Pinned as a unit case as well as observed live.

⭐ The footer could have broken the snippet it publishes — pinned so it cannot

The published harvest ends the block at the first empty line. A footer butted against the rows would be swallowed into it and read as more commands — the remedy breaking the transition it exists to cover. derive prints the separator first, and the self-test drives the real awk and sed over a real rendering and asserts every harvested row is still a runnable command. Measured after the change: the snippet still yields 12, byte-identical to --commands.

--commands is strictly better than the snippet, not merely equal

The snippet reads the matched block alone, so it silently drops the convention-triggered block printed beneath it. On packages/spec/scripts/authorable-defaults.test.ts: snippet 28 rows, --commands 32 — the four it drops are check:engine-double-contract, check:query-options-erasure, check:type-check-coverage, check:type-check-debt. Pinned end to end.

H3 — this settles #13511, and #13511 stands

PR #13500 added one file, .github/workflows/merged-branch-reaper.yml, and went red on check:pm-dispatch-gates. Replicating that exact surface at 57827b617:

• the derivation returns 17 families (matching [finding] dispatch-gates does not derive check:pm-dispatch-gates for a .github/workflows/** change — so a dev following the derived list cannot run the one gate that judges their new workflow #13511's own figure), and check:pm-dispatch-gates is not among them;
• lint.yml:649 spells it pnpm check:pm-dispatch-gates — the pnpm form.

⇒ A pnpm check: harvest would have kept that gate had it been derived. It was never in the list to be dropped. #13500's miss was a derivation gap, not a harvest drop — #13511 is correctly attributed and is not this card. The two are not folded.

Verification

All at a1ac525ab, exit codes captured before any pipe.

Both convention legs for editing a gate script, quoted from their own verdict lines:

✓ dispatch-gates self-test: 1014 cases pass. (check:pm-dispatch-gates, exit 0)
OK self-test: 51 live row(s), 43 unreachable as spelled, 43 recorded verdict(s)
— none stale, none missing, none contradicted. (bare-root-worklist --self-test, exit 0)

The self-test moved 976 → 1014 (38 new cases). bare-root-worklist.mjs is the tool's only real importer, which is why that leg is owed.

The derived family union for this diff, re-derived on the final commit and run against it — 14 families, all green, plus check:nul-bytes:

EXIT=0 node scripts/check-ci-filter-parity.mjs EXIT=0 pnpm check:cross-package-test-inputs
EXIT=0 node scripts/check-cross-package-test-inputs.mjs EXIT=0 pnpm check:entry-guard
EXIT=0 node scripts/check-self-test-wired.mjs EXIT=0 pnpm check:parse-guard
EXIT=0 node scripts/check-shard-attestation.mjs EXIT=0 pnpm check:pm-dispatch-gates
EXIT=3 node scripts/check-test-completeness.mjs EXIT=0 pnpm check:pnpm-filter-targets
EXIT=0 pnpm check:agent-test-spelling EXIT=0 pnpm check:watch-hint-literal
EXIT=0 pnpm check:bash32-floor EXIT=0 pnpm check:nul-bytes
EXIT=0 pnpm check:cli-command-ids

check-test-completeness.mjs exit 3 = NOT MEASURED — its own output says so, and it is neither red nor green.

Repo-wide ESLint ran in full rather than narrowed: os-verify-lock: VERDICT command-exit 0 · held the lock 68s.

One red, found and fixed, worth recording

check:pnpm-filter-targets went red on my first union run — from my own self-test fixture. That gate sweeps the whole tree for pnpm --filter TARGET and requires a live workspace package; unlike the watch-hint scanner it does not mask self-tests, so an invented @x in a fixture reddens it from inside this file. The fixture now names a real package and the reason is comments beside it. A fixture is still a literal in the tree.

Scope

One file, scripts/pm/dispatch-gates.mjs — exactly the declared surface, nothing spread. No changeset: the diff is scripts/pm/** only and publishes nothing from any package, so skip-changeset applies and is applied.

Generated by Claude Code

---

Generated by Claude Code