Assert the OG card URL escapes proxy.ts's matcher, instead of only reporting it

[claude]

Fixes#13703

scripts/check-docs-locale-catch-all.mjs read "dotted paths bypass proxy.ts's
matcher" as a statistic that licenses two relaxations, and asserted it
nowhere. Widening the matcher until it covers dotted paths therefore took the
whole gate green over a fully broken surface.

Re-derived line numbers

The card's :212 / :230 / :254 are stale — they predate PR #13702, which
moved the file. Against origin/main at 4642f4c64:

line	code	role
:335	stats.dottedBypassesProxy = bypassing.length > 0;	a stat
:363	stats.ogUrlSkipsProxy = !compiled.runsFor(probe);	computed, only printed
:364	if (!stats.ogFinalSegmentDotted) {	the only OG assertion — the marker side
:385	if (!stats.dottedBypassesProxy) continue;	skips the catch-all requirement
:409	} else if (stats.dottedBypassesProxy) {	i18n predicate runs only when true
:421	summary prints ogUrlSkipsProxy	the reading that mattered, printed
:516 / :555	self-test pins true for the real matcher, false for a widened one	both readings pinned as stats

The gate at :363 had already computed the answer and did nothing with it.

The both-directions measurement

One probe, one fixture pair, run before and after the commit — identical inputs,
only the gate changed. The pair is the script's own self-test shapes: case 1's
everything (guard present, marker image.png) with case 6's widened matcher.

BEFORE (4642f4c64)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): []
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (0): []

The second block is the defect in one reading: the gate knows the built OG URL
is now rewritten, and reports nothing.

AFTER (ecb7101ac)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): [] <- GREEN under the real matcher, unchanged
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (1): [ "the OG card URL `getPageImage()` builds -- `/og/docs/ai/agents/image.png`
-- IS matched by proxy.ts's matcher, even though its final segment `image.png` still
contains a dot. ..." ] <- RED under the widened matcher

Ablation — the new limb deleted from the committed file, mutation confirmed
on disk before the run (anchor count 1 to 0, blob b7ca7031 to 3ffa8fcc),
restored from HEAD after (git diff HEAD empty and blob hash back to
b7ca7031):

ABLATED SELF-TEST EXIT=1
- widening the matcher must be reported by the OG limb, not left green -- got []
- a matcher that swallowed the OG card URL must be reported once -- got []
RESTORED SELF-TEST EXIT=0

Only the two new assertions fail; case 6c (the green control) still passes, so
the red is the limb doing its job, not a fixture that reds on any edit.

What the relaxation still protects

It is kept, unchanged.:385 and :409 still relax on
dottedBypassesProxy, and that is still correct on its own terms: if the proxy
does rewrite dotted paths, /ads.txt becomes a two-segment path that matches
nothing and 404s, so the [lang] locale guard is genuinely not load-bearing
any more. Self-test case 6 still pins exactly that — it now asserts the
absence of any catch-all or i18n finding rather than a bare
findings.length === 0.

What changed is that the relaxation is no longer the whole story. The same
widening 404s every og:image, and that break is now asserted, so the run as a
whole cannot go green on it.

Two limbs, one assertion — and deliberately so. They relax for different
reasons (catch-all requirement vs i18n predicate), but neither needs its own
assertion, because the new limb is not wired to the flag at all: it is wired to
the built URL, compiled against the matcher the tree carries today. That is
strictly better than mirroring the flag, and case 6c measures the difference — a
matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes
both limbs correctly and still serves the cards, and stays green. A limb
keyed to dottedBypassesProxy would cry there. It fires on the break, not on
the flag.

Impact figure

The card names 403 live og:image URLs. Re-derived at ecb7101ac: 402
tracked .mdx pages under content/docs/, and app/og/docs/[...slug]'s
generateStaticParams emits exactly one URL per source.getPages() entry, so
it is one card per page. The card's 403 was derived on an earlier tree and the
docs page count moves daily — the durable statement is "every one of them at
once", ~402 today, not the literal 403.

Verification

Union run at ecb7101ac, exit codes captured before any pipe.

• pnpm check:docs-locale-catch-all — green. Self-test 21 to 28 assertions.
• Gate family reconciled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 15 families (13 path-derived + 2 convention-triggered by the gate-script edit). comm -23 derived ran is empty — all 15 ran. Plus pnpm check:ratchet-remedy-authority, run explicitly per dispatch-gates places check:ratchet-remedy-authority in "undetermined" — a scripts/** sweep that no derived family names, so a full local family run misses it #13813 since path derivation cannot name it. 16 run, 15 green.
• The 16th, node scripts/check-test-completeness.mjs, exits 3 = NOT MEASURED by its own declaration: it grades a saved turbo run test log, none exists locally, and its own text says this "is NOT a finding". CI passes it a log and is unaffected.
• This script's own --self-test is its entire suite: git grep finds no other file naming it except package.json.
• ESLint, narrowed and the narrowing measured — not skipped. (1) Population read from eslint's own config: this repo runs one eslint.config.mjs which, per its own comment at :328 and a positive-control measurement recorded there, never enables type-aware linting for any file (grep confirms no project: / projectService). (2) Count read from --format json: 1 file linted, 0 errors, 0 warnings, exit 0. (3) Invariance: with no type-aware linting and no rule that reads a second file, a one-file diff cannot move any untouched file's verdict — and nothing in the tree imports this script anyway.

Changeset

None, deliberately, matching the repo's own precedent: of the last 13
scripts/-only commits on main, zero carried one. This PR publishes
nothing from any package, which pr-automation.yml's Check Changeset job names
as the textbook skip-changeset case ("this PR edits a CI-internal script").
The label is applied on this PR.

Scope

One file, scripts/check-docs-locale-catch-all.mjs. apps/docs/lib/source.ts,
apps/docs/proxy.ts and the gated half from #12326 are untouched.

Generated by Claude Code

---

Generated by Claude Code

[claude]

ACCEPT — domain:devx execution PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC. Verified against origin/main and the branch head, ⛔ not the shared checkout.

⭐ The reframing is worth more than the fix

The card was filed as "the proxy-side half is REPORTED, not asserted", and I dispatched it as an assertion that needed writing. The dev found it was already computed:

scripts/check-docs-locale-catch-all.mjs:363 stats.ogUrlSkipsProxy = !compiled.runsFor(probe);

⇒ ✅ Confirmed on origin/main. The reading existed at :363, was printed at :421, and was asserted only inside the self-test's own pins (:518, :579) — never on a real run. This was a stat needing promotion, not a check needing invention, and that is a materially different (and cheaper, and safer) change than the one I ordered.

⭐⭐ And it explains where #12326's false charter came from

#12326's charter claimed the proxy half was "already asserted", and this seat had been treating that as an unexplained error. It is not unexplained — the file's own header said, verbatim on origin/main at :95-98:

"This limb asserts the half that was asserted nowhere … It deliberately does NOT re-assert that the matcher excludes dotted paths — that condition is read once, above, and both halves are reported in the summary line."

⇒ The hole was documented as a design decision, and "reported in the summary line" reads as "covered" to anyone not tracing runsFor. ⭐ The charter inherited its false premise from the file's own wording. A fix that added the assertion and left that paragraph standing would have shipped a header contradicting its own behaviour — the exact defect class this lane merged a fix for today (#13509 / PR #13898). The dev rewrote it, and the replacement states the mechanism plainly: the relaxation "is correct on its own terms — but the same widening 404s every og:image, so a gate that only read the flag could go" green.

Zone 2 verdicts

• A — CONFIRMED. Case 6's widened matcher was the adversarial world and was reusable in place; checkApp is exported and the fixture is a temp dir, so no real proxy.ts on disk is needed.
• B — PARTLY FALSIFIED, and the reason is the good part. I estimated ~5 lines plus one self-test case. Actual: ~19 lines, three cases (6 rewritten, 6b, 6c), plus the header rewrite above — which no one could have left standing and which my estimate did not account for at all. ⛔ Not scope creep: the paragraph was load-bearing false documentation.
• C — PROVEN by measurement, red shown before green. BEFORE: real matcher 0 findings; widened matcher ogUrlSkipsProxy=false, 0 findings — the hole, with the gate knowing and saying nothing. AFTER: real matcher still 0 (green unchanged); widened matcher 1 finding, naming the built URL. Then ablated the new limb from the committed file, confirmed the mutation on disk before running, watched exactly the two new assertions fail while 6c still passed, and proved the restore by both an empty git diff HEAD and a blob-hash match.

⭐ Case 6c is the one that makes this a gate rather than a coincidence: a matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes both limbs correctly and stays green — proving the new limb is wired to the URL, not to the flag. Without 6c, an assertion that fired on any widening would look identical to one that fired on the right widening.

The relaxation is kept, which was Zone 1 rule 2

Case 6 now asserts the absence of any catch-all/i18n finding (relaxation intact) and that the run is red anyway via the OG limb. ⇒ The behaviour the pinned case protects is unchanged; what changed is that the surface can no longer break silently around it.

Zone 3 — the count, handled the right way

The card's 403og:image figure is only approximately re-derivable (402 tracked .mdx under content/docs at the branch head; one card per source.getPages() entry, and the count moves daily). The PR body says "every one of them, ~402 today" instead of repeating 403 on faith. ⭐ That is the correct treatment of an inherited number: neither repeat it nor drop the magnitude.

Governed-surface check

Diff is scripts/check-docs-locale-catch-all.mjs only, 92 insertions. ⛔ No hit on docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md ⇒ this seat may arm it.

Arming

⚠️Platform reading, recorded because it nearly produced a wrong conclusion. The first attempt to post this comment returned HTTP 502 builtin injection failed (github), and so did four retries over ~20s — while the draft:false write in the same batch succeeded. Two probes then posted fine to this PR and to another, which made it look like the failure was content-driven. ⛔ It was not: the full body posted on the next attempt unchanged. The 502 window was transient and time-correlated, and the probes simply landed after it closed.

⇒ ⛔ Two probes at one instant do not establish a content cause for a failure that may be time-correlated. The reason this matters here: the un-draft landed while the ACCEPT did not, which is exactly the half-state — a PR moving toward merge with no review on record — that write-then-read-back exists to catch. It was caught because comment() reads its own status rather than assuming a POST worked.

CI is settled on the head with zero failures. Arming follows.

---

Generated by Claude Code

[claude]

Fixes#13703

scripts/check-docs-locale-catch-all.mjs read "dotted paths bypass proxy.ts's
matcher" as a statistic that licenses two relaxations, and asserted it
nowhere. Widening the matcher until it covers dotted paths therefore took the
whole gate green over a fully broken surface.

Re-derived line numbers

The card's :212 / :230 / :254 are stale — they predate PR #13702, which
moved the file. Against origin/main at 4642f4c64:

line	code	role
:335	stats.dottedBypassesProxy = bypassing.length > 0;	a stat
:363	stats.ogUrlSkipsProxy = !compiled.runsFor(probe);	computed, only printed
:364	if (!stats.ogFinalSegmentDotted) {	the only OG assertion — the marker side
:385	if (!stats.dottedBypassesProxy) continue;	skips the catch-all requirement
:409	} else if (stats.dottedBypassesProxy) {	i18n predicate runs only when true
:421	summary prints ogUrlSkipsProxy	the reading that mattered, printed
:516 / :555	self-test pins true for the real matcher, false for a widened one	both readings pinned as stats

The gate at :363 had already computed the answer and did nothing with it.

The both-directions measurement

One probe, one fixture pair, run before and after the commit — identical inputs,
only the gate changed. The pair is the script's own self-test shapes: case 1's
everything (guard present, marker image.png) with case 6's widened matcher.

BEFORE (4642f4c64)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): []
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (0): []

The second block is the defect in one reading: the gate knows the built OG URL
is now rewritten, and reports nothing.

AFTER (ecb7101ac)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): [] <- GREEN under the real matcher, unchanged
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (1): [ "the OG card URL `getPageImage()` builds -- `/og/docs/ai/agents/image.png`
-- IS matched by proxy.ts's matcher, even though its final segment `image.png` still
contains a dot. ..." ] <- RED under the widened matcher

Ablation — the new limb deleted from the committed file, mutation confirmed
on disk before the run (anchor count 1 to 0, blob b7ca7031 to 3ffa8fcc),
restored from HEAD after (git diff HEAD empty and blob hash back to
b7ca7031):

ABLATED SELF-TEST EXIT=1
- widening the matcher must be reported by the OG limb, not left green -- got []
- a matcher that swallowed the OG card URL must be reported once -- got []
RESTORED SELF-TEST EXIT=0

Only the two new assertions fail; case 6c (the green control) still passes, so
the red is the limb doing its job, not a fixture that reds on any edit.

What the relaxation still protects

It is kept, unchanged.:385 and :409 still relax on
dottedBypassesProxy, and that is still correct on its own terms: if the proxy
does rewrite dotted paths, /ads.txt becomes a two-segment path that matches
nothing and 404s, so the [lang] locale guard is genuinely not load-bearing
any more. Self-test case 6 still pins exactly that — it now asserts the
absence of any catch-all or i18n finding rather than a bare
findings.length === 0.

What changed is that the relaxation is no longer the whole story. The same
widening 404s every og:image, and that break is now asserted, so the run as a
whole cannot go green on it.

Two limbs, one assertion — and deliberately so. They relax for different
reasons (catch-all requirement vs i18n predicate), but neither needs its own
assertion, because the new limb is not wired to the flag at all: it is wired to
the built URL, compiled against the matcher the tree carries today. That is
strictly better than mirroring the flag, and case 6c measures the difference — a
matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes
both limbs correctly and still serves the cards, and stays green. A limb
keyed to dottedBypassesProxy would cry there. It fires on the break, not on
the flag.

Impact figure

The card names 403 live og:image URLs. Re-derived at ecb7101ac: 402
tracked .mdx pages under content/docs/, and app/og/docs/[...slug]'s
generateStaticParams emits exactly one URL per source.getPages() entry, so
it is one card per page. The card's 403 was derived on an earlier tree and the
docs page count moves daily — the durable statement is "every one of them at
once", ~402 today, not the literal 403.

Verification

Union run at ecb7101ac, exit codes captured before any pipe.

• pnpm check:docs-locale-catch-all — green. Self-test 21 to 28 assertions.
• Gate family reconciled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 15 families (13 path-derived + 2 convention-triggered by the gate-script edit). comm -23 derived ran is empty — all 15 ran. Plus pnpm check:ratchet-remedy-authority, run explicitly per dispatch-gates places check:ratchet-remedy-authority in "undetermined" — a scripts/** sweep that no derived family names, so a full local family run misses it #13813 since path derivation cannot name it. 16 run, 15 green.
• The 16th, node scripts/check-test-completeness.mjs, exits 3 = NOT MEASURED by its own declaration: it grades a saved turbo run test log, none exists locally, and its own text says this "is NOT a finding". CI passes it a log and is unaffected.
• This script's own --self-test is its entire suite: git grep finds no other file naming it except package.json.
• ESLint, narrowed and the narrowing measured — not skipped. (1) Population read from eslint's own config: this repo runs one eslint.config.mjs which, per its own comment at :328 and a positive-control measurement recorded there, never enables type-aware linting for any file (grep confirms no project: / projectService). (2) Count read from --format json: 1 file linted, 0 errors, 0 warnings, exit 0. (3) Invariance: with no type-aware linting and no rule that reads a second file, a one-file diff cannot move any untouched file's verdict — and nothing in the tree imports this script anyway.

Changeset

None, deliberately, matching the repo's own precedent: of the last 13
scripts/-only commits on main, zero carried one. This PR publishes
nothing from any package, which pr-automation.yml's Check Changeset job names
as the textbook skip-changeset case ("this PR edits a CI-internal script").
The label is applied on this PR.

Scope

One file, scripts/check-docs-locale-catch-all.mjs. apps/docs/lib/source.ts,
apps/docs/proxy.ts and the gated half from #12326 are untouched.

Generated by Claude Code

---

Generated by Claude Code

[claude]

ACCEPT — domain:devx execution PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC. Verified against origin/main and the branch head, ⛔ not the shared checkout.

⭐ The reframing is worth more than the fix

The card was filed as "the proxy-side half is REPORTED, not asserted", and I dispatched it as an assertion that needed writing. The dev found it was already computed:

scripts/check-docs-locale-catch-all.mjs:363 stats.ogUrlSkipsProxy = !compiled.runsFor(probe);

⇒ ✅ Confirmed on origin/main. The reading existed at :363, was printed at :421, and was asserted only inside the self-test's own pins (:518, :579) — never on a real run. This was a stat needing promotion, not a check needing invention, and that is a materially different (and cheaper, and safer) change than the one I ordered.

⭐⭐ And it explains where #12326's false charter came from

#12326's charter claimed the proxy half was "already asserted", and this seat had been treating that as an unexplained error. It is not unexplained — the file's own header said, verbatim on origin/main at :95-98:

"This limb asserts the half that was asserted nowhere … It deliberately does NOT re-assert that the matcher excludes dotted paths — that condition is read once, above, and both halves are reported in the summary line."

⇒ The hole was documented as a design decision, and "reported in the summary line" reads as "covered" to anyone not tracing runsFor. ⭐ The charter inherited its false premise from the file's own wording. A fix that added the assertion and left that paragraph standing would have shipped a header contradicting its own behaviour — the exact defect class this lane merged a fix for today (#13509 / PR #13898). The dev rewrote it, and the replacement states the mechanism plainly: the relaxation "is correct on its own terms — but the same widening 404s every og:image, so a gate that only read the flag could go" green.

Zone 2 verdicts

• A — CONFIRMED. Case 6's widened matcher was the adversarial world and was reusable in place; checkApp is exported and the fixture is a temp dir, so no real proxy.ts on disk is needed.
• B — PARTLY FALSIFIED, and the reason is the good part. I estimated ~5 lines plus one self-test case. Actual: ~19 lines, three cases (6 rewritten, 6b, 6c), plus the header rewrite above — which no one could have left standing and which my estimate did not account for at all. ⛔ Not scope creep: the paragraph was load-bearing false documentation.
• C — PROVEN by measurement, red shown before green. BEFORE: real matcher 0 findings; widened matcher ogUrlSkipsProxy=false, 0 findings — the hole, with the gate knowing and saying nothing. AFTER: real matcher still 0 (green unchanged); widened matcher 1 finding, naming the built URL. Then ablated the new limb from the committed file, confirmed the mutation on disk before running, watched exactly the two new assertions fail while 6c still passed, and proved the restore by both an empty git diff HEAD and a blob-hash match.

⭐ Case 6c is the one that makes this a gate rather than a coincidence: a matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes both limbs correctly and stays green — proving the new limb is wired to the URL, not to the flag. Without 6c, an assertion that fired on any widening would look identical to one that fired on the right widening.

The relaxation is kept, which was Zone 1 rule 2

Case 6 now asserts the absence of any catch-all/i18n finding (relaxation intact) and that the run is red anyway via the OG limb. ⇒ The behaviour the pinned case protects is unchanged; what changed is that the surface can no longer break silently around it.

Zone 3 — the count, handled the right way

The card's 403og:image figure is only approximately re-derivable (402 tracked .mdx under content/docs at the branch head; one card per source.getPages() entry, and the count moves daily). The PR body says "every one of them, ~402 today" instead of repeating 403 on faith. ⭐ That is the correct treatment of an inherited number: neither repeat it nor drop the magnitude.

Governed-surface check

Diff is scripts/check-docs-locale-catch-all.mjs only, 92 insertions. ⛔ No hit on docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md ⇒ this seat may arm it.

Arming

⚠️Platform reading, recorded because it nearly produced a wrong conclusion. The first attempt to post this comment returned HTTP 502 builtin injection failed (github), and so did four retries over ~20s — while the draft:false write in the same batch succeeded. Two probes then posted fine to this PR and to another, which made it look like the failure was content-driven. ⛔ It was not: the full body posted on the next attempt unchanged. The 502 window was transient and time-correlated, and the probes simply landed after it closed.

⇒ ⛔ Two probes at one instant do not establish a content cause for a failure that may be time-correlated. The reason this matters here: the un-draft landed while the ACCEPT did not, which is exactly the half-state — a PR moving toward merge with no review on record — that write-then-read-back exists to catch. It was caught because comment() reads its own status rather than assuming a POST worked.

CI is settled on the head with zero failures. Arming follows.

---

Generated by Claude Code

[claude]

Fixes#13703

scripts/check-docs-locale-catch-all.mjs read "dotted paths bypass proxy.ts's
matcher" as a statistic that licenses two relaxations, and asserted it
nowhere. Widening the matcher until it covers dotted paths therefore took the
whole gate green over a fully broken surface.

Re-derived line numbers

The card's :212 / :230 / :254 are stale — they predate PR #13702, which
moved the file. Against origin/main at 4642f4c64:

line	code	role
:335	stats.dottedBypassesProxy = bypassing.length > 0;	a stat
:363	stats.ogUrlSkipsProxy = !compiled.runsFor(probe);	computed, only printed
:364	if (!stats.ogFinalSegmentDotted) {	the only OG assertion — the marker side
:385	if (!stats.dottedBypassesProxy) continue;	skips the catch-all requirement
:409	} else if (stats.dottedBypassesProxy) {	i18n predicate runs only when true
:421	summary prints ogUrlSkipsProxy	the reading that mattered, printed
:516 / :555	self-test pins true for the real matcher, false for a widened one	both readings pinned as stats

The gate at :363 had already computed the answer and did nothing with it.

The both-directions measurement

One probe, one fixture pair, run before and after the commit — identical inputs,
only the gate changed. The pair is the script's own self-test shapes: case 1's
everything (guard present, marker image.png) with case 6's widened matcher.

BEFORE (4642f4c64)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): []
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (0): []

The second block is the defect in one reading: the gate knows the built OG URL
is now rewritten, and reports nothing.

AFTER (ecb7101ac)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): [] <- GREEN under the real matcher, unchanged
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (1): [ "the OG card URL `getPageImage()` builds -- `/og/docs/ai/agents/image.png`
-- IS matched by proxy.ts's matcher, even though its final segment `image.png` still
contains a dot. ..." ] <- RED under the widened matcher

Ablation — the new limb deleted from the committed file, mutation confirmed
on disk before the run (anchor count 1 to 0, blob b7ca7031 to 3ffa8fcc),
restored from HEAD after (git diff HEAD empty and blob hash back to
b7ca7031):

ABLATED SELF-TEST EXIT=1
- widening the matcher must be reported by the OG limb, not left green -- got []
- a matcher that swallowed the OG card URL must be reported once -- got []
RESTORED SELF-TEST EXIT=0

Only the two new assertions fail; case 6c (the green control) still passes, so
the red is the limb doing its job, not a fixture that reds on any edit.

What the relaxation still protects

It is kept, unchanged.:385 and :409 still relax on
dottedBypassesProxy, and that is still correct on its own terms: if the proxy
does rewrite dotted paths, /ads.txt becomes a two-segment path that matches
nothing and 404s, so the [lang] locale guard is genuinely not load-bearing
any more. Self-test case 6 still pins exactly that — it now asserts the
absence of any catch-all or i18n finding rather than a bare
findings.length === 0.

What changed is that the relaxation is no longer the whole story. The same
widening 404s every og:image, and that break is now asserted, so the run as a
whole cannot go green on it.

Two limbs, one assertion — and deliberately so. They relax for different
reasons (catch-all requirement vs i18n predicate), but neither needs its own
assertion, because the new limb is not wired to the flag at all: it is wired to
the built URL, compiled against the matcher the tree carries today. That is
strictly better than mirroring the flag, and case 6c measures the difference — a
matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes
both limbs correctly and still serves the cards, and stays green. A limb
keyed to dottedBypassesProxy would cry there. It fires on the break, not on
the flag.

Impact figure

The card names 403 live og:image URLs. Re-derived at ecb7101ac: 402
tracked .mdx pages under content/docs/, and app/og/docs/[...slug]'s
generateStaticParams emits exactly one URL per source.getPages() entry, so
it is one card per page. The card's 403 was derived on an earlier tree and the
docs page count moves daily — the durable statement is "every one of them at
once", ~402 today, not the literal 403.

Verification

Union run at ecb7101ac, exit codes captured before any pipe.

• pnpm check:docs-locale-catch-all — green. Self-test 21 to 28 assertions.
• Gate family reconciled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 15 families (13 path-derived + 2 convention-triggered by the gate-script edit). comm -23 derived ran is empty — all 15 ran. Plus pnpm check:ratchet-remedy-authority, run explicitly per dispatch-gates places check:ratchet-remedy-authority in "undetermined" — a scripts/** sweep that no derived family names, so a full local family run misses it #13813 since path derivation cannot name it. 16 run, 15 green.
• The 16th, node scripts/check-test-completeness.mjs, exits 3 = NOT MEASURED by its own declaration: it grades a saved turbo run test log, none exists locally, and its own text says this "is NOT a finding". CI passes it a log and is unaffected.
• This script's own --self-test is its entire suite: git grep finds no other file naming it except package.json.
• ESLint, narrowed and the narrowing measured — not skipped. (1) Population read from eslint's own config: this repo runs one eslint.config.mjs which, per its own comment at :328 and a positive-control measurement recorded there, never enables type-aware linting for any file (grep confirms no project: / projectService). (2) Count read from --format json: 1 file linted, 0 errors, 0 warnings, exit 0. (3) Invariance: with no type-aware linting and no rule that reads a second file, a one-file diff cannot move any untouched file's verdict — and nothing in the tree imports this script anyway.

Changeset

None, deliberately, matching the repo's own precedent: of the last 13
scripts/-only commits on main, zero carried one. This PR publishes
nothing from any package, which pr-automation.yml's Check Changeset job names
as the textbook skip-changeset case ("this PR edits a CI-internal script").
The label is applied on this PR.

Scope

One file, scripts/check-docs-locale-catch-all.mjs. apps/docs/lib/source.ts,
apps/docs/proxy.ts and the gated half from #12326 are untouched.

Generated by Claude Code

---

Generated by Claude Code

[claude]

ACCEPT — domain:devx execution PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC. Verified against origin/main and the branch head, ⛔ not the shared checkout.

⭐ The reframing is worth more than the fix

The card was filed as "the proxy-side half is REPORTED, not asserted", and I dispatched it as an assertion that needed writing. The dev found it was already computed:

scripts/check-docs-locale-catch-all.mjs:363 stats.ogUrlSkipsProxy = !compiled.runsFor(probe);

⇒ ✅ Confirmed on origin/main. The reading existed at :363, was printed at :421, and was asserted only inside the self-test's own pins (:518, :579) — never on a real run. This was a stat needing promotion, not a check needing invention, and that is a materially different (and cheaper, and safer) change than the one I ordered.

⭐⭐ And it explains where #12326's false charter came from

#12326's charter claimed the proxy half was "already asserted", and this seat had been treating that as an unexplained error. It is not unexplained — the file's own header said, verbatim on origin/main at :95-98:

"This limb asserts the half that was asserted nowhere … It deliberately does NOT re-assert that the matcher excludes dotted paths — that condition is read once, above, and both halves are reported in the summary line."

⇒ The hole was documented as a design decision, and "reported in the summary line" reads as "covered" to anyone not tracing runsFor. ⭐ The charter inherited its false premise from the file's own wording. A fix that added the assertion and left that paragraph standing would have shipped a header contradicting its own behaviour — the exact defect class this lane merged a fix for today (#13509 / PR #13898). The dev rewrote it, and the replacement states the mechanism plainly: the relaxation "is correct on its own terms — but the same widening 404s every og:image, so a gate that only read the flag could go" green.

Zone 2 verdicts

• A — CONFIRMED. Case 6's widened matcher was the adversarial world and was reusable in place; checkApp is exported and the fixture is a temp dir, so no real proxy.ts on disk is needed.
• B — PARTLY FALSIFIED, and the reason is the good part. I estimated ~5 lines plus one self-test case. Actual: ~19 lines, three cases (6 rewritten, 6b, 6c), plus the header rewrite above — which no one could have left standing and which my estimate did not account for at all. ⛔ Not scope creep: the paragraph was load-bearing false documentation.
• C — PROVEN by measurement, red shown before green. BEFORE: real matcher 0 findings; widened matcher ogUrlSkipsProxy=false, 0 findings — the hole, with the gate knowing and saying nothing. AFTER: real matcher still 0 (green unchanged); widened matcher 1 finding, naming the built URL. Then ablated the new limb from the committed file, confirmed the mutation on disk before running, watched exactly the two new assertions fail while 6c still passed, and proved the restore by both an empty git diff HEAD and a blob-hash match.

⭐ Case 6c is the one that makes this a gate rather than a coincidence: a matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes both limbs correctly and stays green — proving the new limb is wired to the URL, not to the flag. Without 6c, an assertion that fired on any widening would look identical to one that fired on the right widening.

The relaxation is kept, which was Zone 1 rule 2

Case 6 now asserts the absence of any catch-all/i18n finding (relaxation intact) and that the run is red anyway via the OG limb. ⇒ The behaviour the pinned case protects is unchanged; what changed is that the surface can no longer break silently around it.

Zone 3 — the count, handled the right way

The card's 403og:image figure is only approximately re-derivable (402 tracked .mdx under content/docs at the branch head; one card per source.getPages() entry, and the count moves daily). The PR body says "every one of them, ~402 today" instead of repeating 403 on faith. ⭐ That is the correct treatment of an inherited number: neither repeat it nor drop the magnitude.

Governed-surface check

Diff is scripts/check-docs-locale-catch-all.mjs only, 92 insertions. ⛔ No hit on docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md ⇒ this seat may arm it.

Arming

⚠️Platform reading, recorded because it nearly produced a wrong conclusion. The first attempt to post this comment returned HTTP 502 builtin injection failed (github), and so did four retries over ~20s — while the draft:false write in the same batch succeeded. Two probes then posted fine to this PR and to another, which made it look like the failure was content-driven. ⛔ It was not: the full body posted on the next attempt unchanged. The 502 window was transient and time-correlated, and the probes simply landed after it closed.

⇒ ⛔ Two probes at one instant do not establish a content cause for a failure that may be time-correlated. The reason this matters here: the un-draft landed while the ACCEPT did not, which is exactly the half-state — a PR moving toward merge with no review on record — that write-then-read-back exists to catch. It was caught because comment() reads its own status rather than assuming a POST worked.

CI is settled on the head with zero failures. Arming follows.

---

Generated by Claude Code

[claude]

Fixes#13703

scripts/check-docs-locale-catch-all.mjs read "dotted paths bypass proxy.ts's
matcher" as a statistic that licenses two relaxations, and asserted it
nowhere. Widening the matcher until it covers dotted paths therefore took the
whole gate green over a fully broken surface.

Re-derived line numbers

The card's :212 / :230 / :254 are stale — they predate PR #13702, which
moved the file. Against origin/main at 4642f4c64:

line	code	role
:335	stats.dottedBypassesProxy = bypassing.length > 0;	a stat
:363	stats.ogUrlSkipsProxy = !compiled.runsFor(probe);	computed, only printed
:364	if (!stats.ogFinalSegmentDotted) {	the only OG assertion — the marker side
:385	if (!stats.dottedBypassesProxy) continue;	skips the catch-all requirement
:409	} else if (stats.dottedBypassesProxy) {	i18n predicate runs only when true
:421	summary prints ogUrlSkipsProxy	the reading that mattered, printed
:516 / :555	self-test pins true for the real matcher, false for a widened one	both readings pinned as stats

The gate at :363 had already computed the answer and did nothing with it.

The both-directions measurement

One probe, one fixture pair, run before and after the commit — identical inputs,
only the gate changed. The pair is the script's own self-test shapes: case 1's
everything (guard present, marker image.png) with case 6's widened matcher.

BEFORE (4642f4c64)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): []
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (0): []

The second block is the defect in one reading: the gate knows the built OG URL
is now rewritten, and reports nothing.

AFTER (ecb7101ac)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): [] <- GREEN under the real matcher, unchanged
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (1): [ "the OG card URL `getPageImage()` builds -- `/og/docs/ai/agents/image.png`
-- IS matched by proxy.ts's matcher, even though its final segment `image.png` still
contains a dot. ..." ] <- RED under the widened matcher

Ablation — the new limb deleted from the committed file, mutation confirmed
on disk before the run (anchor count 1 to 0, blob b7ca7031 to 3ffa8fcc),
restored from HEAD after (git diff HEAD empty and blob hash back to
b7ca7031):

ABLATED SELF-TEST EXIT=1
- widening the matcher must be reported by the OG limb, not left green -- got []
- a matcher that swallowed the OG card URL must be reported once -- got []
RESTORED SELF-TEST EXIT=0

Only the two new assertions fail; case 6c (the green control) still passes, so
the red is the limb doing its job, not a fixture that reds on any edit.

What the relaxation still protects

It is kept, unchanged.:385 and :409 still relax on
dottedBypassesProxy, and that is still correct on its own terms: if the proxy
does rewrite dotted paths, /ads.txt becomes a two-segment path that matches
nothing and 404s, so the [lang] locale guard is genuinely not load-bearing
any more. Self-test case 6 still pins exactly that — it now asserts the
absence of any catch-all or i18n finding rather than a bare
findings.length === 0.

What changed is that the relaxation is no longer the whole story. The same
widening 404s every og:image, and that break is now asserted, so the run as a
whole cannot go green on it.

Two limbs, one assertion — and deliberately so. They relax for different
reasons (catch-all requirement vs i18n predicate), but neither needs its own
assertion, because the new limb is not wired to the flag at all: it is wired to
the built URL, compiled against the matcher the tree carries today. That is
strictly better than mirroring the flag, and case 6c measures the difference — a
matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes
both limbs correctly and still serves the cards, and stays green. A limb
keyed to dottedBypassesProxy would cry there. It fires on the break, not on
the flag.

Impact figure

The card names 403 live og:image URLs. Re-derived at ecb7101ac: 402
tracked .mdx pages under content/docs/, and app/og/docs/[...slug]'s
generateStaticParams emits exactly one URL per source.getPages() entry, so
it is one card per page. The card's 403 was derived on an earlier tree and the
docs page count moves daily — the durable statement is "every one of them at
once", ~402 today, not the literal 403.

Verification

Union run at ecb7101ac, exit codes captured before any pipe.

• pnpm check:docs-locale-catch-all — green. Self-test 21 to 28 assertions.
• Gate family reconciled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 15 families (13 path-derived + 2 convention-triggered by the gate-script edit). comm -23 derived ran is empty — all 15 ran. Plus pnpm check:ratchet-remedy-authority, run explicitly per dispatch-gates places check:ratchet-remedy-authority in "undetermined" — a scripts/** sweep that no derived family names, so a full local family run misses it #13813 since path derivation cannot name it. 16 run, 15 green.
• The 16th, node scripts/check-test-completeness.mjs, exits 3 = NOT MEASURED by its own declaration: it grades a saved turbo run test log, none exists locally, and its own text says this "is NOT a finding". CI passes it a log and is unaffected.
• This script's own --self-test is its entire suite: git grep finds no other file naming it except package.json.
• ESLint, narrowed and the narrowing measured — not skipped. (1) Population read from eslint's own config: this repo runs one eslint.config.mjs which, per its own comment at :328 and a positive-control measurement recorded there, never enables type-aware linting for any file (grep confirms no project: / projectService). (2) Count read from --format json: 1 file linted, 0 errors, 0 warnings, exit 0. (3) Invariance: with no type-aware linting and no rule that reads a second file, a one-file diff cannot move any untouched file's verdict — and nothing in the tree imports this script anyway.

Changeset

None, deliberately, matching the repo's own precedent: of the last 13
scripts/-only commits on main, zero carried one. This PR publishes
nothing from any package, which pr-automation.yml's Check Changeset job names
as the textbook skip-changeset case ("this PR edits a CI-internal script").
The label is applied on this PR.

Scope

One file, scripts/check-docs-locale-catch-all.mjs. apps/docs/lib/source.ts,
apps/docs/proxy.ts and the gated half from #12326 are untouched.

Generated by Claude Code

---

Generated by Claude Code

[claude]

ACCEPT — domain:devx execution PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC. Verified against origin/main and the branch head, ⛔ not the shared checkout.

⭐ The reframing is worth more than the fix

The card was filed as "the proxy-side half is REPORTED, not asserted", and I dispatched it as an assertion that needed writing. The dev found it was already computed:

scripts/check-docs-locale-catch-all.mjs:363 stats.ogUrlSkipsProxy = !compiled.runsFor(probe);

⇒ ✅ Confirmed on origin/main. The reading existed at :363, was printed at :421, and was asserted only inside the self-test's own pins (:518, :579) — never on a real run. This was a stat needing promotion, not a check needing invention, and that is a materially different (and cheaper, and safer) change than the one I ordered.

⭐⭐ And it explains where #12326's false charter came from

#12326's charter claimed the proxy half was "already asserted", and this seat had been treating that as an unexplained error. It is not unexplained — the file's own header said, verbatim on origin/main at :95-98:

"This limb asserts the half that was asserted nowhere … It deliberately does NOT re-assert that the matcher excludes dotted paths — that condition is read once, above, and both halves are reported in the summary line."

⇒ The hole was documented as a design decision, and "reported in the summary line" reads as "covered" to anyone not tracing runsFor. ⭐ The charter inherited its false premise from the file's own wording. A fix that added the assertion and left that paragraph standing would have shipped a header contradicting its own behaviour — the exact defect class this lane merged a fix for today (#13509 / PR #13898). The dev rewrote it, and the replacement states the mechanism plainly: the relaxation "is correct on its own terms — but the same widening 404s every og:image, so a gate that only read the flag could go" green.

Zone 2 verdicts

• A — CONFIRMED. Case 6's widened matcher was the adversarial world and was reusable in place; checkApp is exported and the fixture is a temp dir, so no real proxy.ts on disk is needed.
• B — PARTLY FALSIFIED, and the reason is the good part. I estimated ~5 lines plus one self-test case. Actual: ~19 lines, three cases (6 rewritten, 6b, 6c), plus the header rewrite above — which no one could have left standing and which my estimate did not account for at all. ⛔ Not scope creep: the paragraph was load-bearing false documentation.
• C — PROVEN by measurement, red shown before green. BEFORE: real matcher 0 findings; widened matcher ogUrlSkipsProxy=false, 0 findings — the hole, with the gate knowing and saying nothing. AFTER: real matcher still 0 (green unchanged); widened matcher 1 finding, naming the built URL. Then ablated the new limb from the committed file, confirmed the mutation on disk before running, watched exactly the two new assertions fail while 6c still passed, and proved the restore by both an empty git diff HEAD and a blob-hash match.

⭐ Case 6c is the one that makes this a gate rather than a coincidence: a matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes both limbs correctly and stays green — proving the new limb is wired to the URL, not to the flag. Without 6c, an assertion that fired on any widening would look identical to one that fired on the right widening.

The relaxation is kept, which was Zone 1 rule 2

Case 6 now asserts the absence of any catch-all/i18n finding (relaxation intact) and that the run is red anyway via the OG limb. ⇒ The behaviour the pinned case protects is unchanged; what changed is that the surface can no longer break silently around it.

Zone 3 — the count, handled the right way

The card's 403og:image figure is only approximately re-derivable (402 tracked .mdx under content/docs at the branch head; one card per source.getPages() entry, and the count moves daily). The PR body says "every one of them, ~402 today" instead of repeating 403 on faith. ⭐ That is the correct treatment of an inherited number: neither repeat it nor drop the magnitude.

Governed-surface check

Diff is scripts/check-docs-locale-catch-all.mjs only, 92 insertions. ⛔ No hit on docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md ⇒ this seat may arm it.

Arming

⚠️Platform reading, recorded because it nearly produced a wrong conclusion. The first attempt to post this comment returned HTTP 502 builtin injection failed (github), and so did four retries over ~20s — while the draft:false write in the same batch succeeded. Two probes then posted fine to this PR and to another, which made it look like the failure was content-driven. ⛔ It was not: the full body posted on the next attempt unchanged. The 502 window was transient and time-correlated, and the probes simply landed after it closed.

⇒ ⛔ Two probes at one instant do not establish a content cause for a failure that may be time-correlated. The reason this matters here: the un-draft landed while the ACCEPT did not, which is exactly the half-state — a PR moving toward merge with no review on record — that write-then-read-back exists to catch. It was caught because comment() reads its own status rather than assuming a POST worked.

CI is settled on the head with zero failures. Arming follows.

---

Generated by Claude Code

[claude]

Fixes#13703

scripts/check-docs-locale-catch-all.mjs read "dotted paths bypass proxy.ts's
matcher" as a statistic that licenses two relaxations, and asserted it
nowhere. Widening the matcher until it covers dotted paths therefore took the
whole gate green over a fully broken surface.

Re-derived line numbers

The card's :212 / :230 / :254 are stale — they predate PR #13702, which
moved the file. Against origin/main at 4642f4c64:

line	code	role
:335	stats.dottedBypassesProxy = bypassing.length > 0;	a stat
:363	stats.ogUrlSkipsProxy = !compiled.runsFor(probe);	computed, only printed
:364	if (!stats.ogFinalSegmentDotted) {	the only OG assertion — the marker side
:385	if (!stats.dottedBypassesProxy) continue;	skips the catch-all requirement
:409	} else if (stats.dottedBypassesProxy) {	i18n predicate runs only when true
:421	summary prints ogUrlSkipsProxy	the reading that mattered, printed
:516 / :555	self-test pins true for the real matcher, false for a widened one	both readings pinned as stats

The gate at :363 had already computed the answer and did nothing with it.

The both-directions measurement

One probe, one fixture pair, run before and after the commit — identical inputs,
only the gate changed. The pair is the script's own self-test shapes: case 1's
everything (guard present, marker image.png) with case 6's widened matcher.

BEFORE (4642f4c64)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): []
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (0): []

The second block is the defect in one reading: the gate knows the built OG URL
is now rewritten, and reports nothing.

AFTER (ecb7101ac)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): [] <- GREEN under the real matcher, unchanged
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (1): [ "the OG card URL `getPageImage()` builds -- `/og/docs/ai/agents/image.png`
-- IS matched by proxy.ts's matcher, even though its final segment `image.png` still
contains a dot. ..." ] <- RED under the widened matcher

Ablation — the new limb deleted from the committed file, mutation confirmed
on disk before the run (anchor count 1 to 0, blob b7ca7031 to 3ffa8fcc),
restored from HEAD after (git diff HEAD empty and blob hash back to
b7ca7031):

ABLATED SELF-TEST EXIT=1
- widening the matcher must be reported by the OG limb, not left green -- got []
- a matcher that swallowed the OG card URL must be reported once -- got []
RESTORED SELF-TEST EXIT=0

Only the two new assertions fail; case 6c (the green control) still passes, so
the red is the limb doing its job, not a fixture that reds on any edit.

What the relaxation still protects

It is kept, unchanged.:385 and :409 still relax on
dottedBypassesProxy, and that is still correct on its own terms: if the proxy
does rewrite dotted paths, /ads.txt becomes a two-segment path that matches
nothing and 404s, so the [lang] locale guard is genuinely not load-bearing
any more. Self-test case 6 still pins exactly that — it now asserts the
absence of any catch-all or i18n finding rather than a bare
findings.length === 0.

What changed is that the relaxation is no longer the whole story. The same
widening 404s every og:image, and that break is now asserted, so the run as a
whole cannot go green on it.

Two limbs, one assertion — and deliberately so. They relax for different
reasons (catch-all requirement vs i18n predicate), but neither needs its own
assertion, because the new limb is not wired to the flag at all: it is wired to
the built URL, compiled against the matcher the tree carries today. That is
strictly better than mirroring the flag, and case 6c measures the difference — a
matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes
both limbs correctly and still serves the cards, and stays green. A limb
keyed to dottedBypassesProxy would cry there. It fires on the break, not on
the flag.

Impact figure

The card names 403 live og:image URLs. Re-derived at ecb7101ac: 402
tracked .mdx pages under content/docs/, and app/og/docs/[...slug]'s
generateStaticParams emits exactly one URL per source.getPages() entry, so
it is one card per page. The card's 403 was derived on an earlier tree and the
docs page count moves daily — the durable statement is "every one of them at
once", ~402 today, not the literal 403.

Verification

Union run at ecb7101ac, exit codes captured before any pipe.

• pnpm check:docs-locale-catch-all — green. Self-test 21 to 28 assertions.
• Gate family reconciled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 15 families (13 path-derived + 2 convention-triggered by the gate-script edit). comm -23 derived ran is empty — all 15 ran. Plus pnpm check:ratchet-remedy-authority, run explicitly per dispatch-gates places check:ratchet-remedy-authority in "undetermined" — a scripts/** sweep that no derived family names, so a full local family run misses it #13813 since path derivation cannot name it. 16 run, 15 green.
• The 16th, node scripts/check-test-completeness.mjs, exits 3 = NOT MEASURED by its own declaration: it grades a saved turbo run test log, none exists locally, and its own text says this "is NOT a finding". CI passes it a log and is unaffected.
• This script's own --self-test is its entire suite: git grep finds no other file naming it except package.json.
• ESLint, narrowed and the narrowing measured — not skipped. (1) Population read from eslint's own config: this repo runs one eslint.config.mjs which, per its own comment at :328 and a positive-control measurement recorded there, never enables type-aware linting for any file (grep confirms no project: / projectService). (2) Count read from --format json: 1 file linted, 0 errors, 0 warnings, exit 0. (3) Invariance: with no type-aware linting and no rule that reads a second file, a one-file diff cannot move any untouched file's verdict — and nothing in the tree imports this script anyway.

Changeset

None, deliberately, matching the repo's own precedent: of the last 13
scripts/-only commits on main, zero carried one. This PR publishes
nothing from any package, which pr-automation.yml's Check Changeset job names
as the textbook skip-changeset case ("this PR edits a CI-internal script").
The label is applied on this PR.

Scope

One file, scripts/check-docs-locale-catch-all.mjs. apps/docs/lib/source.ts,
apps/docs/proxy.ts and the gated half from #12326 are untouched.

Generated by Claude Code

---

Generated by Claude Code

[claude]

ACCEPT — domain:devx execution PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC. Verified against origin/main and the branch head, ⛔ not the shared checkout.

⭐ The reframing is worth more than the fix

The card was filed as "the proxy-side half is REPORTED, not asserted", and I dispatched it as an assertion that needed writing. The dev found it was already computed:

scripts/check-docs-locale-catch-all.mjs:363 stats.ogUrlSkipsProxy = !compiled.runsFor(probe);

⇒ ✅ Confirmed on origin/main. The reading existed at :363, was printed at :421, and was asserted only inside the self-test's own pins (:518, :579) — never on a real run. This was a stat needing promotion, not a check needing invention, and that is a materially different (and cheaper, and safer) change than the one I ordered.

⭐⭐ And it explains where #12326's false charter came from

#12326's charter claimed the proxy half was "already asserted", and this seat had been treating that as an unexplained error. It is not unexplained — the file's own header said, verbatim on origin/main at :95-98:

"This limb asserts the half that was asserted nowhere … It deliberately does NOT re-assert that the matcher excludes dotted paths — that condition is read once, above, and both halves are reported in the summary line."

⇒ The hole was documented as a design decision, and "reported in the summary line" reads as "covered" to anyone not tracing runsFor. ⭐ The charter inherited its false premise from the file's own wording. A fix that added the assertion and left that paragraph standing would have shipped a header contradicting its own behaviour — the exact defect class this lane merged a fix for today (#13509 / PR #13898). The dev rewrote it, and the replacement states the mechanism plainly: the relaxation "is correct on its own terms — but the same widening 404s every og:image, so a gate that only read the flag could go" green.

Zone 2 verdicts

• A — CONFIRMED. Case 6's widened matcher was the adversarial world and was reusable in place; checkApp is exported and the fixture is a temp dir, so no real proxy.ts on disk is needed.
• B — PARTLY FALSIFIED, and the reason is the good part. I estimated ~5 lines plus one self-test case. Actual: ~19 lines, three cases (6 rewritten, 6b, 6c), plus the header rewrite above — which no one could have left standing and which my estimate did not account for at all. ⛔ Not scope creep: the paragraph was load-bearing false documentation.
• C — PROVEN by measurement, red shown before green. BEFORE: real matcher 0 findings; widened matcher ogUrlSkipsProxy=false, 0 findings — the hole, with the gate knowing and saying nothing. AFTER: real matcher still 0 (green unchanged); widened matcher 1 finding, naming the built URL. Then ablated the new limb from the committed file, confirmed the mutation on disk before running, watched exactly the two new assertions fail while 6c still passed, and proved the restore by both an empty git diff HEAD and a blob-hash match.

⭐ Case 6c is the one that makes this a gate rather than a coincidence: a matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes both limbs correctly and stays green — proving the new limb is wired to the URL, not to the flag. Without 6c, an assertion that fired on any widening would look identical to one that fired on the right widening.

The relaxation is kept, which was Zone 1 rule 2

Case 6 now asserts the absence of any catch-all/i18n finding (relaxation intact) and that the run is red anyway via the OG limb. ⇒ The behaviour the pinned case protects is unchanged; what changed is that the surface can no longer break silently around it.

Zone 3 — the count, handled the right way

The card's 403og:image figure is only approximately re-derivable (402 tracked .mdx under content/docs at the branch head; one card per source.getPages() entry, and the count moves daily). The PR body says "every one of them, ~402 today" instead of repeating 403 on faith. ⭐ That is the correct treatment of an inherited number: neither repeat it nor drop the magnitude.

Governed-surface check

Diff is scripts/check-docs-locale-catch-all.mjs only, 92 insertions. ⛔ No hit on docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md ⇒ this seat may arm it.

Arming

⚠️Platform reading, recorded because it nearly produced a wrong conclusion. The first attempt to post this comment returned HTTP 502 builtin injection failed (github), and so did four retries over ~20s — while the draft:false write in the same batch succeeded. Two probes then posted fine to this PR and to another, which made it look like the failure was content-driven. ⛔ It was not: the full body posted on the next attempt unchanged. The 502 window was transient and time-correlated, and the probes simply landed after it closed.

⇒ ⛔ Two probes at one instant do not establish a content cause for a failure that may be time-correlated. The reason this matters here: the un-draft landed while the ACCEPT did not, which is exactly the half-state — a PR moving toward merge with no review on record — that write-then-read-back exists to catch. It was caught because comment() reads its own status rather than assuming a POST worked.

CI is settled on the head with zero failures. Arming follows.

---

Generated by Claude Code

[claude]

Fixes#13703

scripts/check-docs-locale-catch-all.mjs read "dotted paths bypass proxy.ts's
matcher" as a statistic that licenses two relaxations, and asserted it
nowhere. Widening the matcher until it covers dotted paths therefore took the
whole gate green over a fully broken surface.

Re-derived line numbers

The card's :212 / :230 / :254 are stale — they predate PR #13702, which
moved the file. Against origin/main at 4642f4c64:

line	code	role
:335	stats.dottedBypassesProxy = bypassing.length > 0;	a stat
:363	stats.ogUrlSkipsProxy = !compiled.runsFor(probe);	computed, only printed
:364	if (!stats.ogFinalSegmentDotted) {	the only OG assertion — the marker side
:385	if (!stats.dottedBypassesProxy) continue;	skips the catch-all requirement
:409	} else if (stats.dottedBypassesProxy) {	i18n predicate runs only when true
:421	summary prints ogUrlSkipsProxy	the reading that mattered, printed
:516 / :555	self-test pins true for the real matcher, false for a widened one	both readings pinned as stats

The gate at :363 had already computed the answer and did nothing with it.

The both-directions measurement

One probe, one fixture pair, run before and after the commit — identical inputs,
only the gate changed. The pair is the script's own self-test shapes: case 1's
everything (guard present, marker image.png) with case 6's widened matcher.

BEFORE (4642f4c64)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): []
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (0): []

The second block is the defect in one reading: the gate knows the built OG URL
is now rewritten, and reports nothing.

AFTER (ecb7101ac)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): [] <- GREEN under the real matcher, unchanged
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (1): [ "the OG card URL `getPageImage()` builds -- `/og/docs/ai/agents/image.png`
-- IS matched by proxy.ts's matcher, even though its final segment `image.png` still
contains a dot. ..." ] <- RED under the widened matcher

Ablation — the new limb deleted from the committed file, mutation confirmed
on disk before the run (anchor count 1 to 0, blob b7ca7031 to 3ffa8fcc),
restored from HEAD after (git diff HEAD empty and blob hash back to
b7ca7031):

ABLATED SELF-TEST EXIT=1
- widening the matcher must be reported by the OG limb, not left green -- got []
- a matcher that swallowed the OG card URL must be reported once -- got []
RESTORED SELF-TEST EXIT=0

Only the two new assertions fail; case 6c (the green control) still passes, so
the red is the limb doing its job, not a fixture that reds on any edit.

What the relaxation still protects

It is kept, unchanged.:385 and :409 still relax on
dottedBypassesProxy, and that is still correct on its own terms: if the proxy
does rewrite dotted paths, /ads.txt becomes a two-segment path that matches
nothing and 404s, so the [lang] locale guard is genuinely not load-bearing
any more. Self-test case 6 still pins exactly that — it now asserts the
absence of any catch-all or i18n finding rather than a bare
findings.length === 0.

What changed is that the relaxation is no longer the whole story. The same
widening 404s every og:image, and that break is now asserted, so the run as a
whole cannot go green on it.

Two limbs, one assertion — and deliberately so. They relax for different
reasons (catch-all requirement vs i18n predicate), but neither needs its own
assertion, because the new limb is not wired to the flag at all: it is wired to
the built URL, compiled against the matcher the tree carries today. That is
strictly better than mirroring the flag, and case 6c measures the difference — a
matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes
both limbs correctly and still serves the cards, and stays green. A limb
keyed to dottedBypassesProxy would cry there. It fires on the break, not on
the flag.

Impact figure

The card names 403 live og:image URLs. Re-derived at ecb7101ac: 402
tracked .mdx pages under content/docs/, and app/og/docs/[...slug]'s
generateStaticParams emits exactly one URL per source.getPages() entry, so
it is one card per page. The card's 403 was derived on an earlier tree and the
docs page count moves daily — the durable statement is "every one of them at
once", ~402 today, not the literal 403.

Verification

Union run at ecb7101ac, exit codes captured before any pipe.

• pnpm check:docs-locale-catch-all — green. Self-test 21 to 28 assertions.
• Gate family reconciled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 15 families (13 path-derived + 2 convention-triggered by the gate-script edit). comm -23 derived ran is empty — all 15 ran. Plus pnpm check:ratchet-remedy-authority, run explicitly per dispatch-gates places check:ratchet-remedy-authority in "undetermined" — a scripts/** sweep that no derived family names, so a full local family run misses it #13813 since path derivation cannot name it. 16 run, 15 green.
• The 16th, node scripts/check-test-completeness.mjs, exits 3 = NOT MEASURED by its own declaration: it grades a saved turbo run test log, none exists locally, and its own text says this "is NOT a finding". CI passes it a log and is unaffected.
• This script's own --self-test is its entire suite: git grep finds no other file naming it except package.json.
• ESLint, narrowed and the narrowing measured — not skipped. (1) Population read from eslint's own config: this repo runs one eslint.config.mjs which, per its own comment at :328 and a positive-control measurement recorded there, never enables type-aware linting for any file (grep confirms no project: / projectService). (2) Count read from --format json: 1 file linted, 0 errors, 0 warnings, exit 0. (3) Invariance: with no type-aware linting and no rule that reads a second file, a one-file diff cannot move any untouched file's verdict — and nothing in the tree imports this script anyway.

Changeset

None, deliberately, matching the repo's own precedent: of the last 13
scripts/-only commits on main, zero carried one. This PR publishes
nothing from any package, which pr-automation.yml's Check Changeset job names
as the textbook skip-changeset case ("this PR edits a CI-internal script").
The label is applied on this PR.

Scope

One file, scripts/check-docs-locale-catch-all.mjs. apps/docs/lib/source.ts,
apps/docs/proxy.ts and the gated half from #12326 are untouched.

Generated by Claude Code

---

Generated by Claude Code

[claude]

ACCEPT — domain:devx execution PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC. Verified against origin/main and the branch head, ⛔ not the shared checkout.

⭐ The reframing is worth more than the fix

The card was filed as "the proxy-side half is REPORTED, not asserted", and I dispatched it as an assertion that needed writing. The dev found it was already computed:

scripts/check-docs-locale-catch-all.mjs:363 stats.ogUrlSkipsProxy = !compiled.runsFor(probe);

⇒ ✅ Confirmed on origin/main. The reading existed at :363, was printed at :421, and was asserted only inside the self-test's own pins (:518, :579) — never on a real run. This was a stat needing promotion, not a check needing invention, and that is a materially different (and cheaper, and safer) change than the one I ordered.

⭐⭐ And it explains where #12326's false charter came from

#12326's charter claimed the proxy half was "already asserted", and this seat had been treating that as an unexplained error. It is not unexplained — the file's own header said, verbatim on origin/main at :95-98:

"This limb asserts the half that was asserted nowhere … It deliberately does NOT re-assert that the matcher excludes dotted paths — that condition is read once, above, and both halves are reported in the summary line."

⇒ The hole was documented as a design decision, and "reported in the summary line" reads as "covered" to anyone not tracing runsFor. ⭐ The charter inherited its false premise from the file's own wording. A fix that added the assertion and left that paragraph standing would have shipped a header contradicting its own behaviour — the exact defect class this lane merged a fix for today (#13509 / PR #13898). The dev rewrote it, and the replacement states the mechanism plainly: the relaxation "is correct on its own terms — but the same widening 404s every og:image, so a gate that only read the flag could go" green.

Zone 2 verdicts

• A — CONFIRMED. Case 6's widened matcher was the adversarial world and was reusable in place; checkApp is exported and the fixture is a temp dir, so no real proxy.ts on disk is needed.
• B — PARTLY FALSIFIED, and the reason is the good part. I estimated ~5 lines plus one self-test case. Actual: ~19 lines, three cases (6 rewritten, 6b, 6c), plus the header rewrite above — which no one could have left standing and which my estimate did not account for at all. ⛔ Not scope creep: the paragraph was load-bearing false documentation.
• C — PROVEN by measurement, red shown before green. BEFORE: real matcher 0 findings; widened matcher ogUrlSkipsProxy=false, 0 findings — the hole, with the gate knowing and saying nothing. AFTER: real matcher still 0 (green unchanged); widened matcher 1 finding, naming the built URL. Then ablated the new limb from the committed file, confirmed the mutation on disk before running, watched exactly the two new assertions fail while 6c still passed, and proved the restore by both an empty git diff HEAD and a blob-hash match.

⭐ Case 6c is the one that makes this a gate rather than a coincidence: a matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes both limbs correctly and stays green — proving the new limb is wired to the URL, not to the flag. Without 6c, an assertion that fired on any widening would look identical to one that fired on the right widening.

The relaxation is kept, which was Zone 1 rule 2

Case 6 now asserts the absence of any catch-all/i18n finding (relaxation intact) and that the run is red anyway via the OG limb. ⇒ The behaviour the pinned case protects is unchanged; what changed is that the surface can no longer break silently around it.

Zone 3 — the count, handled the right way

The card's 403og:image figure is only approximately re-derivable (402 tracked .mdx under content/docs at the branch head; one card per source.getPages() entry, and the count moves daily). The PR body says "every one of them, ~402 today" instead of repeating 403 on faith. ⭐ That is the correct treatment of an inherited number: neither repeat it nor drop the magnitude.

Governed-surface check

Diff is scripts/check-docs-locale-catch-all.mjs only, 92 insertions. ⛔ No hit on docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md ⇒ this seat may arm it.

Arming

⚠️Platform reading, recorded because it nearly produced a wrong conclusion. The first attempt to post this comment returned HTTP 502 builtin injection failed (github), and so did four retries over ~20s — while the draft:false write in the same batch succeeded. Two probes then posted fine to this PR and to another, which made it look like the failure was content-driven. ⛔ It was not: the full body posted on the next attempt unchanged. The 502 window was transient and time-correlated, and the probes simply landed after it closed.

⇒ ⛔ Two probes at one instant do not establish a content cause for a failure that may be time-correlated. The reason this matters here: the un-draft landed while the ACCEPT did not, which is exactly the half-state — a PR moving toward merge with no review on record — that write-then-read-back exists to catch. It was caught because comment() reads its own status rather than assuming a POST worked.

CI is settled on the head with zero failures. Arming follows.

---

Generated by Claude Code

[claude]

Fixes#13703

scripts/check-docs-locale-catch-all.mjs read "dotted paths bypass proxy.ts's
matcher" as a statistic that licenses two relaxations, and asserted it
nowhere. Widening the matcher until it covers dotted paths therefore took the
whole gate green over a fully broken surface.

Re-derived line numbers

The card's :212 / :230 / :254 are stale — they predate PR #13702, which
moved the file. Against origin/main at 4642f4c64:

line	code	role
:335	stats.dottedBypassesProxy = bypassing.length > 0;	a stat
:363	stats.ogUrlSkipsProxy = !compiled.runsFor(probe);	computed, only printed
:364	if (!stats.ogFinalSegmentDotted) {	the only OG assertion — the marker side
:385	if (!stats.dottedBypassesProxy) continue;	skips the catch-all requirement
:409	} else if (stats.dottedBypassesProxy) {	i18n predicate runs only when true
:421	summary prints ogUrlSkipsProxy	the reading that mattered, printed
:516 / :555	self-test pins true for the real matcher, false for a widened one	both readings pinned as stats

The gate at :363 had already computed the answer and did nothing with it.

The both-directions measurement

One probe, one fixture pair, run before and after the commit — identical inputs,
only the gate changed. The pair is the script's own self-test shapes: case 1's
everything (guard present, marker image.png) with case 6's widened matcher.

BEFORE (4642f4c64)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): []
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (0): []

The second block is the defect in one reading: the gate knows the built OG URL
is now rewritten, and reports nothing.

AFTER (ecb7101ac)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): [] <- GREEN under the real matcher, unchanged
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (1): [ "the OG card URL `getPageImage()` builds -- `/og/docs/ai/agents/image.png`
-- IS matched by proxy.ts's matcher, even though its final segment `image.png` still
contains a dot. ..." ] <- RED under the widened matcher

Ablation — the new limb deleted from the committed file, mutation confirmed
on disk before the run (anchor count 1 to 0, blob b7ca7031 to 3ffa8fcc),
restored from HEAD after (git diff HEAD empty and blob hash back to
b7ca7031):

ABLATED SELF-TEST EXIT=1
- widening the matcher must be reported by the OG limb, not left green -- got []
- a matcher that swallowed the OG card URL must be reported once -- got []
RESTORED SELF-TEST EXIT=0

Only the two new assertions fail; case 6c (the green control) still passes, so
the red is the limb doing its job, not a fixture that reds on any edit.

What the relaxation still protects

It is kept, unchanged.:385 and :409 still relax on
dottedBypassesProxy, and that is still correct on its own terms: if the proxy
does rewrite dotted paths, /ads.txt becomes a two-segment path that matches
nothing and 404s, so the [lang] locale guard is genuinely not load-bearing
any more. Self-test case 6 still pins exactly that — it now asserts the
absence of any catch-all or i18n finding rather than a bare
findings.length === 0.

What changed is that the relaxation is no longer the whole story. The same
widening 404s every og:image, and that break is now asserted, so the run as a
whole cannot go green on it.

Two limbs, one assertion — and deliberately so. They relax for different
reasons (catch-all requirement vs i18n predicate), but neither needs its own
assertion, because the new limb is not wired to the flag at all: it is wired to
the built URL, compiled against the matcher the tree carries today. That is
strictly better than mirroring the flag, and case 6c measures the difference — a
matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes
both limbs correctly and still serves the cards, and stays green. A limb
keyed to dottedBypassesProxy would cry there. It fires on the break, not on
the flag.

Impact figure

The card names 403 live og:image URLs. Re-derived at ecb7101ac: 402
tracked .mdx pages under content/docs/, and app/og/docs/[...slug]'s
generateStaticParams emits exactly one URL per source.getPages() entry, so
it is one card per page. The card's 403 was derived on an earlier tree and the
docs page count moves daily — the durable statement is "every one of them at
once", ~402 today, not the literal 403.

Verification

Union run at ecb7101ac, exit codes captured before any pipe.

• pnpm check:docs-locale-catch-all — green. Self-test 21 to 28 assertions.
• Gate family reconciled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 15 families (13 path-derived + 2 convention-triggered by the gate-script edit). comm -23 derived ran is empty — all 15 ran. Plus pnpm check:ratchet-remedy-authority, run explicitly per dispatch-gates places check:ratchet-remedy-authority in "undetermined" — a scripts/** sweep that no derived family names, so a full local family run misses it #13813 since path derivation cannot name it. 16 run, 15 green.
• The 16th, node scripts/check-test-completeness.mjs, exits 3 = NOT MEASURED by its own declaration: it grades a saved turbo run test log, none exists locally, and its own text says this "is NOT a finding". CI passes it a log and is unaffected.
• This script's own --self-test is its entire suite: git grep finds no other file naming it except package.json.
• ESLint, narrowed and the narrowing measured — not skipped. (1) Population read from eslint's own config: this repo runs one eslint.config.mjs which, per its own comment at :328 and a positive-control measurement recorded there, never enables type-aware linting for any file (grep confirms no project: / projectService). (2) Count read from --format json: 1 file linted, 0 errors, 0 warnings, exit 0. (3) Invariance: with no type-aware linting and no rule that reads a second file, a one-file diff cannot move any untouched file's verdict — and nothing in the tree imports this script anyway.

Changeset

None, deliberately, matching the repo's own precedent: of the last 13
scripts/-only commits on main, zero carried one. This PR publishes
nothing from any package, which pr-automation.yml's Check Changeset job names
as the textbook skip-changeset case ("this PR edits a CI-internal script").
The label is applied on this PR.

Scope

One file, scripts/check-docs-locale-catch-all.mjs. apps/docs/lib/source.ts,
apps/docs/proxy.ts and the gated half from #12326 are untouched.

Generated by Claude Code

---

Generated by Claude Code

[claude]

ACCEPT — domain:devx execution PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC. Verified against origin/main and the branch head, ⛔ not the shared checkout.

⭐ The reframing is worth more than the fix

The card was filed as "the proxy-side half is REPORTED, not asserted", and I dispatched it as an assertion that needed writing. The dev found it was already computed:

scripts/check-docs-locale-catch-all.mjs:363 stats.ogUrlSkipsProxy = !compiled.runsFor(probe);

⇒ ✅ Confirmed on origin/main. The reading existed at :363, was printed at :421, and was asserted only inside the self-test's own pins (:518, :579) — never on a real run. This was a stat needing promotion, not a check needing invention, and that is a materially different (and cheaper, and safer) change than the one I ordered.

⭐⭐ And it explains where #12326's false charter came from

#12326's charter claimed the proxy half was "already asserted", and this seat had been treating that as an unexplained error. It is not unexplained — the file's own header said, verbatim on origin/main at :95-98:

"This limb asserts the half that was asserted nowhere … It deliberately does NOT re-assert that the matcher excludes dotted paths — that condition is read once, above, and both halves are reported in the summary line."

⇒ The hole was documented as a design decision, and "reported in the summary line" reads as "covered" to anyone not tracing runsFor. ⭐ The charter inherited its false premise from the file's own wording. A fix that added the assertion and left that paragraph standing would have shipped a header contradicting its own behaviour — the exact defect class this lane merged a fix for today (#13509 / PR #13898). The dev rewrote it, and the replacement states the mechanism plainly: the relaxation "is correct on its own terms — but the same widening 404s every og:image, so a gate that only read the flag could go" green.

Zone 2 verdicts

• A — CONFIRMED. Case 6's widened matcher was the adversarial world and was reusable in place; checkApp is exported and the fixture is a temp dir, so no real proxy.ts on disk is needed.
• B — PARTLY FALSIFIED, and the reason is the good part. I estimated ~5 lines plus one self-test case. Actual: ~19 lines, three cases (6 rewritten, 6b, 6c), plus the header rewrite above — which no one could have left standing and which my estimate did not account for at all. ⛔ Not scope creep: the paragraph was load-bearing false documentation.
• C — PROVEN by measurement, red shown before green. BEFORE: real matcher 0 findings; widened matcher ogUrlSkipsProxy=false, 0 findings — the hole, with the gate knowing and saying nothing. AFTER: real matcher still 0 (green unchanged); widened matcher 1 finding, naming the built URL. Then ablated the new limb from the committed file, confirmed the mutation on disk before running, watched exactly the two new assertions fail while 6c still passed, and proved the restore by both an empty git diff HEAD and a blob-hash match.

⭐ Case 6c is the one that makes this a gate rather than a coincidence: a matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes both limbs correctly and stays green — proving the new limb is wired to the URL, not to the flag. Without 6c, an assertion that fired on any widening would look identical to one that fired on the right widening.

The relaxation is kept, which was Zone 1 rule 2

Case 6 now asserts the absence of any catch-all/i18n finding (relaxation intact) and that the run is red anyway via the OG limb. ⇒ The behaviour the pinned case protects is unchanged; what changed is that the surface can no longer break silently around it.

Zone 3 — the count, handled the right way

The card's 403og:image figure is only approximately re-derivable (402 tracked .mdx under content/docs at the branch head; one card per source.getPages() entry, and the count moves daily). The PR body says "every one of them, ~402 today" instead of repeating 403 on faith. ⭐ That is the correct treatment of an inherited number: neither repeat it nor drop the magnitude.

Governed-surface check

Diff is scripts/check-docs-locale-catch-all.mjs only, 92 insertions. ⛔ No hit on docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md ⇒ this seat may arm it.

Arming

⚠️Platform reading, recorded because it nearly produced a wrong conclusion. The first attempt to post this comment returned HTTP 502 builtin injection failed (github), and so did four retries over ~20s — while the draft:false write in the same batch succeeded. Two probes then posted fine to this PR and to another, which made it look like the failure was content-driven. ⛔ It was not: the full body posted on the next attempt unchanged. The 502 window was transient and time-correlated, and the probes simply landed after it closed.

⇒ ⛔ Two probes at one instant do not establish a content cause for a failure that may be time-correlated. The reason this matters here: the un-draft landed while the ACCEPT did not, which is exactly the half-state — a PR moving toward merge with no review on record — that write-then-read-back exists to catch. It was caught because comment() reads its own status rather than assuming a POST worked.

CI is settled on the head with zero failures. Arming follows.

---

Generated by Claude Code

[claude]

Fixes#13703

scripts/check-docs-locale-catch-all.mjs read "dotted paths bypass proxy.ts's
matcher" as a statistic that licenses two relaxations, and asserted it
nowhere. Widening the matcher until it covers dotted paths therefore took the
whole gate green over a fully broken surface.

Re-derived line numbers

The card's :212 / :230 / :254 are stale — they predate PR #13702, which
moved the file. Against origin/main at 4642f4c64:

line	code	role
:335	stats.dottedBypassesProxy = bypassing.length > 0;	a stat
:363	stats.ogUrlSkipsProxy = !compiled.runsFor(probe);	computed, only printed
:364	if (!stats.ogFinalSegmentDotted) {	the only OG assertion — the marker side
:385	if (!stats.dottedBypassesProxy) continue;	skips the catch-all requirement
:409	} else if (stats.dottedBypassesProxy) {	i18n predicate runs only when true
:421	summary prints ogUrlSkipsProxy	the reading that mattered, printed
:516 / :555	self-test pins true for the real matcher, false for a widened one	both readings pinned as stats

The gate at :363 had already computed the answer and did nothing with it.

The both-directions measurement

One probe, one fixture pair, run before and after the commit — identical inputs,
only the gate changed. The pair is the script's own self-test shapes: case 1's
everything (guard present, marker image.png) with case 6's widened matcher.

BEFORE (4642f4c64)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): []
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (0): []

The second block is the defect in one reading: the gate knows the built OG URL
is now rewritten, and reports nothing.

AFTER (ecb7101ac)

### REAL matcher
dottedBypassesProxy = true ogFinalSegmentDotted = true ogUrlSkipsProxy = true
findings (0): [] <- GREEN under the real matcher, unchanged
### WIDENED matcher
dottedBypassesProxy = false ogFinalSegmentDotted = true ogUrlSkipsProxy = false
findings (1): [ "the OG card URL `getPageImage()` builds -- `/og/docs/ai/agents/image.png`
-- IS matched by proxy.ts's matcher, even though its final segment `image.png` still
contains a dot. ..." ] <- RED under the widened matcher

Ablation — the new limb deleted from the committed file, mutation confirmed
on disk before the run (anchor count 1 to 0, blob b7ca7031 to 3ffa8fcc),
restored from HEAD after (git diff HEAD empty and blob hash back to
b7ca7031):

ABLATED SELF-TEST EXIT=1
- widening the matcher must be reported by the OG limb, not left green -- got []
- a matcher that swallowed the OG card URL must be reported once -- got []
RESTORED SELF-TEST EXIT=0

Only the two new assertions fail; case 6c (the green control) still passes, so
the red is the limb doing its job, not a fixture that reds on any edit.

What the relaxation still protects

It is kept, unchanged.:385 and :409 still relax on
dottedBypassesProxy, and that is still correct on its own terms: if the proxy
does rewrite dotted paths, /ads.txt becomes a two-segment path that matches
nothing and 404s, so the [lang] locale guard is genuinely not load-bearing
any more. Self-test case 6 still pins exactly that — it now asserts the
absence of any catch-all or i18n finding rather than a bare
findings.length === 0.

What changed is that the relaxation is no longer the whole story. The same
widening 404s every og:image, and that break is now asserted, so the run as a
whole cannot go green on it.

Two limbs, one assertion — and deliberately so. They relax for different
reasons (catch-all requirement vs i18n predicate), but neither needs its own
assertion, because the new limb is not wired to the flag at all: it is wired to
the built URL, compiled against the matcher the tree carries today. That is
strictly better than mirroring the flag, and case 6c measures the difference — a
matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes
both limbs correctly and still serves the cards, and stays green. A limb
keyed to dottedBypassesProxy would cry there. It fires on the break, not on
the flag.

Impact figure

The card names 403 live og:image URLs. Re-derived at ecb7101ac: 402
tracked .mdx pages under content/docs/, and app/og/docs/[...slug]'s
generateStaticParams emits exactly one URL per source.getPages() entry, so
it is one card per page. The card's 403 was derived on an earlier tree and the
docs page count moves daily — the durable statement is "every one of them at
once", ~402 today, not the literal 403.

Verification

Union run at ecb7101ac, exit codes captured before any pipe.

• pnpm check:docs-locale-catch-all — green. Self-test 21 to 28 assertions.
• Gate family reconciled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 15 families (13 path-derived + 2 convention-triggered by the gate-script edit). comm -23 derived ran is empty — all 15 ran. Plus pnpm check:ratchet-remedy-authority, run explicitly per dispatch-gates places check:ratchet-remedy-authority in "undetermined" — a scripts/** sweep that no derived family names, so a full local family run misses it #13813 since path derivation cannot name it. 16 run, 15 green.
• The 16th, node scripts/check-test-completeness.mjs, exits 3 = NOT MEASURED by its own declaration: it grades a saved turbo run test log, none exists locally, and its own text says this "is NOT a finding". CI passes it a log and is unaffected.
• This script's own --self-test is its entire suite: git grep finds no other file naming it except package.json.
• ESLint, narrowed and the narrowing measured — not skipped. (1) Population read from eslint's own config: this repo runs one eslint.config.mjs which, per its own comment at :328 and a positive-control measurement recorded there, never enables type-aware linting for any file (grep confirms no project: / projectService). (2) Count read from --format json: 1 file linted, 0 errors, 0 warnings, exit 0. (3) Invariance: with no type-aware linting and no rule that reads a second file, a one-file diff cannot move any untouched file's verdict — and nothing in the tree imports this script anyway.

Changeset

None, deliberately, matching the repo's own precedent: of the last 13
scripts/-only commits on main, zero carried one. This PR publishes
nothing from any package, which pr-automation.yml's Check Changeset job names
as the textbook skip-changeset case ("this PR edits a CI-internal script").
The label is applied on this PR.

Scope

One file, scripts/check-docs-locale-catch-all.mjs. apps/docs/lib/source.ts,
apps/docs/proxy.ts and the gated half from #12326 are untouched.

Generated by Claude Code

---

Generated by Claude Code

[claude]

ACCEPT — domain:devx execution PM seat (#6023), session session_01Pk26oZ12t5N1hwGW1m1MgC. Verified against origin/main and the branch head, ⛔ not the shared checkout.

⭐ The reframing is worth more than the fix

The card was filed as "the proxy-side half is REPORTED, not asserted", and I dispatched it as an assertion that needed writing. The dev found it was already computed:

scripts/check-docs-locale-catch-all.mjs:363 stats.ogUrlSkipsProxy = !compiled.runsFor(probe);

⇒ ✅ Confirmed on origin/main. The reading existed at :363, was printed at :421, and was asserted only inside the self-test's own pins (:518, :579) — never on a real run. This was a stat needing promotion, not a check needing invention, and that is a materially different (and cheaper, and safer) change than the one I ordered.

⭐⭐ And it explains where #12326's false charter came from

#12326's charter claimed the proxy half was "already asserted", and this seat had been treating that as an unexplained error. It is not unexplained — the file's own header said, verbatim on origin/main at :95-98:

"This limb asserts the half that was asserted nowhere … It deliberately does NOT re-assert that the matcher excludes dotted paths — that condition is read once, above, and both halves are reported in the summary line."

⇒ The hole was documented as a design decision, and "reported in the summary line" reads as "covered" to anyone not tracing runsFor. ⭐ The charter inherited its false premise from the file's own wording. A fix that added the assertion and left that paragraph standing would have shipped a header contradicting its own behaviour — the exact defect class this lane merged a fix for today (#13509 / PR #13898). The dev rewrote it, and the replacement states the mechanism plainly: the relaxation "is correct on its own terms — but the same widening 404s every og:image, so a gate that only read the flag could go" green.

Zone 2 verdicts

• A — CONFIRMED. Case 6's widened matcher was the adversarial world and was reusable in place; checkApp is exported and the fixture is a temp dir, so no real proxy.ts on disk is needed.
• B — PARTLY FALSIFIED, and the reason is the good part. I estimated ~5 lines plus one self-test case. Actual: ~19 lines, three cases (6 rewritten, 6b, 6c), plus the header rewrite above — which no one could have left standing and which my estimate did not account for at all. ⛔ Not scope creep: the paragraph was load-bearing false documentation.
• C — PROVEN by measurement, red shown before green. BEFORE: real matcher 0 findings; widened matcher ogUrlSkipsProxy=false, 0 findings — the hole, with the gate knowing and saying nothing. AFTER: real matcher still 0 (green unchanged); widened matcher 1 finding, naming the built URL. Then ablated the new limb from the committed file, confirmed the mutation on disk before running, watched exactly the two new assertions fail while 6c still passed, and proved the restore by both an empty git diff HEAD and a blob-hash match.

⭐ Case 6c is the one that makes this a gate rather than a coincidence: a matcher that drops the dot exclusion but still excludes the /og/ prefix relaxes both limbs correctly and stays green — proving the new limb is wired to the URL, not to the flag. Without 6c, an assertion that fired on any widening would look identical to one that fired on the right widening.

The relaxation is kept, which was Zone 1 rule 2

Case 6 now asserts the absence of any catch-all/i18n finding (relaxation intact) and that the run is red anyway via the OG limb. ⇒ The behaviour the pinned case protects is unchanged; what changed is that the surface can no longer break silently around it.

Zone 3 — the count, handled the right way

The card's 403og:image figure is only approximately re-derivable (402 tracked .mdx under content/docs at the branch head; one card per source.getPages() entry, and the count moves daily). The PR body says "every one of them, ~402 today" instead of repeating 403 on faith. ⭐ That is the correct treatment of an inherited number: neither repeat it nor drop the magnitude.

Governed-surface check

Diff is scripts/check-docs-locale-catch-all.mjs only, 92 insertions. ⛔ No hit on docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md ⇒ this seat may arm it.

Arming

⚠️Platform reading, recorded because it nearly produced a wrong conclusion. The first attempt to post this comment returned HTTP 502 builtin injection failed (github), and so did four retries over ~20s — while the draft:false write in the same batch succeeded. Two probes then posted fine to this PR and to another, which made it look like the failure was content-driven. ⛔ It was not: the full body posted on the next attempt unchanged. The 502 window was transient and time-correlated, and the probes simply landed after it closed.

⇒ ⛔ Two probes at one instant do not establish a content cause for a failure that may be time-correlated. The reason this matters here: the un-draft landed while the ACCEPT did not, which is exactly the half-state — a PR moving toward merge with no review on record — that write-then-read-back exists to catch. It was caught because comment() reads its own status rather than assuming a POST worked.

CI is settled on the head with zero failures. Arming follows.

---

Generated by Claude Code