feat(tooling): gate the swallow-census control families the repair programme cannot destroy (#13919)

[claude]

Fixes#13919

The #12981 census (scripts/measure-durability-swallow-family.mjs) declares four
control families and, measured on origin/main, nothing ran any of them — zero
references to the script anywhere in package.json or .github/**, counter-checked
against a control that must return non-zero (measure-stall-guard-headroom, 2 hits) so
the zero was a reading and not a broken query. Meanwhile the resolver those controls pin
was repaired three times (#13459, #13474, PR #13915), each time with no gate holding the
previous repair, and the census's numbers feed #12981's repair worklist — so a wrong
denominator propagates into that programme with nobody watching.

The ruling this implements (verbatim, unchanged — comment 5494601066, maintainer 2026-09-01 「同意」)

1. B:measure-durability-swallow-family.mjs 增一个轻量 flag,把 RESOLUTION_CONTROLS + NEGATIVE_CONTROLS + REGRESSION_CONTROLS 三族(修复计划不可能消灭的那三族)接为 check:* 进 CI —— 先例 check:stall-guard-headroom(package.json:150)同形;
2. 拆分单入口形状的授权:The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 裁定认可的单入口仪器形状由本裁决显式修订为「单入口 + 分族 flag」—— 仪器的测量属性不变,每次运行照印 "a MEASUREMENT, not a gate";
3. 三条边界(⛔ 均为硬边):
   • ⛔ POSITIVE_CONTROLS 不接线(在成功时变红的门不是门,还训练舰队绕门 —— A 由文件自己的记录证伪,永久排除);
   • ⛔ 本裁决不得被用来提前 The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 保留的交接步(tryInsert/tryUpdate 进 DURABILITY_CRITICAL_CALLEES,仍 gated on outstanding == 0);
   • ⚠️ 若实施发现拆分需重复自测报告逻辑、超出一个轻量 flag 的量级 ⇒ 停手,带实施成本读数回箱;
4. C(维持不接线)排除 —— 现状就是本卡的成因,三次无守护修复已实测。

What landed

One mode selector, no duplicated reporting.selfTestMode(argv) reads the mode;
selfTest(mode) takes one gated ? [] : POSITIVE_CONTROLS on the loop it must skip, one
extra success-print branch, and one refusal branch. The problem list, the failure
formatter, the census call and the other three family loops are the same code on both
paths. Implementation cost against ruling item 3, bullet 3: the stop condition was not
reached — the split needed no duplication of the self-test's reporting logic.

• --self-test=gated runs RESOLUTION + NEGATIVE + REGRESSION, plus the
  zero-member floor. Wired as root check:swallow-census-controls and run from
  lint.yml beside the sanctioned precedent check:stall-guard-headroom — the same
  shape and the same asymmetry: the self-test leg only, never a bare invocation.
• Bare --self-test is byte-identical (proof below); --self-test=all is its
  spelling. Print semantics of the bare legs are deliberately untouched — that surface
  belongs to [finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886, see the serial note.
• An unknown mode is REFUSED with exit 2 rather than falling through. Without this,
  --self-test=gatd would miss argv.includes('--self-test'), reach report(), exit 0
  and read in a CI log exactly like a self-test that passed.
• Ruling item 2, the measurement property: the gated run prints the instrument's own
  banner line, now a single constant shared with report() rather than a second copy.

Why POSITIVE stays out, in the file's own terms rather than restated: SELF_TEST_MODES
points at the dark control's recorded why, where batch 2 already turned this
self-test red for doing exactly what the ruling asked. The exclusion is written as
permanent, not pending — repairs move a member from tier dark to tier channelled
and it stays a member, so none of the three wired families can be destroyed by a
successful repair.

⛔ DURABILITY_CRITICAL_CALLEES is untouched, no entry was added to
durability-degradation.baseline.json, and the gate vocabulary is unchanged in either
direction (ruling item 3, bullet 2 — this PR must not be used to bring that step forward).

Readings

All on 93aecd5cf (the implementation commit; the two follow-ups touch only PM tooling). Every mutation confirmed on disk before the reading was taken
(injected marker counted and deleted text counted), every restore proved by hashing
the path against its HEAD blob, each harness carrying trap restore EXIT INT TERM with
absolute paths.

run	exit	verdict line
--self-test=gated on this branch	0	3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as declared, 56 member site(s) total
bare --self-test	0	4 positive, 3 negative, 2 regression, 6 resolution — the base branch's line, byte for byte
--self-test=gatd	2	x REFUSED: unknown self-test mode

Bare-output identity, measured not asserted. The base blob (e2a7fa5b8) was checked
out over the path, confirmed on disk by hash, run, and restored to the HEAD blob
(71f3ae1e5, verified). cmp on the two captures: identical.

Ablation A — the RESOLUTION family, on the defect it exists for. Reverted
indexFunctionBodies().get to the flat last-wins lookup (marker present 1, anchor
consumed). --self-test=gated → exit 1, four resolution controls firing:

 - resolution control moved: packages/objectql/src/engine.ts :: ObjectQL :: update()
-> expected `ObjectQL`, got ObjectRepository@7620, ObjectRepository@7722, ...
- resolution control moved: ... :: delete() -> got ObjectRepository@12213
- resolution control moved: ... :: transaction() -> got ScopedContext@12677
- resolution control moved: packages/runtime/src/app-plugin.ts :: resolveMappedObjects
:: push() -> expected REFUSAL, got collectBundleActions@457

Bare --self-test → exit 1 on the same tree. ⇒ the wired leg carries a real failure
signal into CI.

Ablation C — the hazard the ruling excluded POSITIVE for, reproduced. Simulated a
successful repair of the dark positive control's site by giving
share-link-service.ts :: resolveToken's telemetry catch a console.error (marker
present 1, original comment text consumed):

run	exit
bare --self-test	1	positive control found NO member: packages/plugins/plugin-sharing/src/share-link-service.ts
--self-test=gated	0	56 members becomes 55, and the gate stays green

⇒ this is the ruling's boundary 1 as a measurement: the full self-test reddens when the
repair programme succeeds, and the wired subset does not.

Ablation B — reported as a NULL result rather than dropped. Removing the #13459
bare-identifier refusal from the lexical walk landed on disk — marker 1, the deleted
return null; gone — and moved nothing: --json before and after is equal in every
stat (files 2193, guardedWrites 221, refusedShadowed 4, 56 members, empty symmetric
difference on the member set). The site the action-execution regression control pins is
answered a second time by the scope-aware body index, which refuses it too. So the two
departures are defence-in-depth there, and this ablation proves nothing about the
REGRESSION family in either direction. It is recorded because a discarded null ablation is
how a "we exercised that family" claim gets minted from a reading that never happened;
Ablation A is the failure proof.

Two things the wiring forced, both found by running the derived gates

Neither is scope creep: both are consequences of this card's own change, each caught by a
gate on this PR's derived list, and each landed with the repair the gate's own remedy text
names rather than the one that quiets it.

1. scripts/pm/dispatch-gates.mjs — the seam card is now a GATE SCRIPT. Its
--self-test went red in three cases. Wiring check:swallow-census-controls makes
measure-durability-swallow-family.mjs a file some discovered check family runs, so the
"adds or edits a GATE SCRIPT" convention KIND started hitting it — and that card is the
fixture chosen for the one assertion pair that needs the block harvest and --commands to
agree exactly, i.e. a card no convention KIND hits. Repointed at
measure-partial-retirement-annotation.mjs (block 13, commands 13, convention 0, four
node rows — measured), which is the very shape the census copied and which no check
family runs. ⛔ Not repaired by loosening the equality; the comment says so at the
constant. The third case is COMPOUND_ANCHOR_LEDGER: the new selfTestMode argv parser
matches the compound self-test name anchor and is classified accidental: true, which is
what that ledger's own "Maintaining this table" section prescribes — ⛔ explicitly not by
renaming the function to dodge the anchor.

2. scripts/pm/bare-root-worklist.mjs — a FRESH bare-root row. Wiring the family
makes the census's SCAN_ROOT visible to scripts/pm/bare-root-worklist.mjs
as a FRESH, unjudged row, and its --self-test reds until a verdict is recorded (it did,
on the first sweep). Recorded REFUSE-WIDE, measured on this tree in both terms and not
carried from a sibling row: the walk admits every non-test, non-declaration TypeScript
source under the root at four extensions — 2193 of 5755 (38%), numerator from the
instrument's own printed scan count, denominator from git ls-files packages. Same class
and nearly the same ratio as the check:authz-resolver row: a bare-root declaration would
be TRUE and is refused for width alone.

No changeset — skip-changeset

This diff publishes nothing from any package: a root check:* alias, a lint.yml step, a
repo-root measure-* script, and a PM worklist verdict. The precedent is exact —
0079e2585 (#13358), which wired this same family's precedent and touched precisely
.github/workflows/lint.yml + package.json + scripts/measure-stall-guard-headroom.mjs,
carried no changeset. An empty-frontmatter changeset is not the alternative:
scripts/check-empty-changeset.mjs rejects one, and its header records why (an empty
changeset is a real input to changesets/action and can stall a release, which the label
cannot). The label is applied on this PR.

Serial note — #13886 is next on this file

#13886 (same file, print semantics of the DARK worklist) is queued behind this card
(triage 2026-09-01, comment 5486764050) and is deliberately not folded in. That is also
why the bare self-test legs' output is left byte-identical here: changing print semantics
is that card's surface, not this one's. #13886 is not addressed by this PR and remains
open.

Gate record

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands
from the real change set (three-dot against merge base e80889095; the tool takes the
change set from git itself, no hand-written path list). Re-derived after each of the two
follow-up commits — the union stayed at 37 families throughout. All 37 were run, and
the union was re-run on the final commit 990649a77:

• 34 green, including the new check:swallow-census-controls itself,
  check:pm-dispatch-gates (✓ dispatch-gates self-test: 1232 cases pass.),
  check:self-test-wired and check:self-test-workflow-commands — the two the new step
  newly puts this script into the population of — plus
  check:declared-population-live, check:ratchet-remedy-authority,
  check:watch-hint-literal, check:entry-guard, check:parse-guard and
  node scripts/pm/bare-root-worklist.mjs --self-test (OK self-test: 57 live row(s), 49 unreachable as spelled, 49 recorded verdict(s) — none stale, none missing, none contradicted.).
• 3 NOT MEASURED, all exit 3 and none of them a finding, each quoting its own verdict
  line: check-test-completeness.mjs ("The log comes from a test RUN. This gate does not
  run tests and cannot produce one... the local reading for this gate is NOT MEASURED"),
  check:dual-build-cjs-loads and check:type-check-debt ("PREREQUISITE NOT MET... ⛔
  This is NOT a pass and NOT a finding: nothing was measured"). Structural — they need a
  built workspace or a real test-run log, which CI has and a local sweep does not.
• 2 were red, both on this card's own consequences, both repaired above:
  scripts/pm/bare-root-worklist.mjs --self-test (FRESH row) and
  check:pm-dispatch-gates (3 of 1232 cases). Both green on the final commit.

Exit codes were captured before any pipe (cmd > log 2>&1; rc=$?), never through one, and
every verdict quoted here is the gate's own printed line rather than a bare $?.

---

Generated by Claude Code

[claude]

Fixes#13919

The #12981 census (scripts/measure-durability-swallow-family.mjs) declares four
control families and, measured on origin/main, nothing ran any of them — zero
references to the script anywhere in package.json or .github/**, counter-checked
against a control that must return non-zero (measure-stall-guard-headroom, 2 hits) so
the zero was a reading and not a broken query. Meanwhile the resolver those controls pin
was repaired three times (#13459, #13474, PR #13915), each time with no gate holding the
previous repair, and the census's numbers feed #12981's repair worklist — so a wrong
denominator propagates into that programme with nobody watching.

The ruling this implements (verbatim, unchanged — comment 5494601066, maintainer 2026-09-01 「同意」)

1. B:measure-durability-swallow-family.mjs 增一个轻量 flag,把 RESOLUTION_CONTROLS + NEGATIVE_CONTROLS + REGRESSION_CONTROLS 三族(修复计划不可能消灭的那三族)接为 check:* 进 CI —— 先例 check:stall-guard-headroom(package.json:150)同形;
2. 拆分单入口形状的授权:The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 裁定认可的单入口仪器形状由本裁决显式修订为「单入口 + 分族 flag」—— 仪器的测量属性不变,每次运行照印 "a MEASUREMENT, not a gate";
3. 三条边界(⛔ 均为硬边):
   • ⛔ POSITIVE_CONTROLS 不接线(在成功时变红的门不是门,还训练舰队绕门 —— A 由文件自己的记录证伪,永久排除);
   • ⛔ 本裁决不得被用来提前 The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 保留的交接步(tryInsert/tryUpdate 进 DURABILITY_CRITICAL_CALLEES,仍 gated on outstanding == 0);
   • ⚠️ 若实施发现拆分需重复自测报告逻辑、超出一个轻量 flag 的量级 ⇒ 停手,带实施成本读数回箱;
4. C(维持不接线)排除 —— 现状就是本卡的成因,三次无守护修复已实测。

What landed

One mode selector, no duplicated reporting.selfTestMode(argv) reads the mode;
selfTest(mode) takes one gated ? [] : POSITIVE_CONTROLS on the loop it must skip, one
extra success-print branch, and one refusal branch. The problem list, the failure
formatter, the census call and the other three family loops are the same code on both
paths. Implementation cost against ruling item 3, bullet 3: the stop condition was not
reached — the split needed no duplication of the self-test's reporting logic.

• --self-test=gated runs RESOLUTION + NEGATIVE + REGRESSION, plus the
  zero-member floor. Wired as root check:swallow-census-controls and run from
  lint.yml beside the sanctioned precedent check:stall-guard-headroom — the same
  shape and the same asymmetry: the self-test leg only, never a bare invocation.
• Bare --self-test is byte-identical (proof below); --self-test=all is its
  spelling. Print semantics of the bare legs are deliberately untouched — that surface
  belongs to [finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886, see the serial note.
• An unknown mode is REFUSED with exit 2 rather than falling through. Without this,
  --self-test=gatd would miss argv.includes('--self-test'), reach report(), exit 0
  and read in a CI log exactly like a self-test that passed.
• Ruling item 2, the measurement property: the gated run prints the instrument's own
  banner line, now a single constant shared with report() rather than a second copy.

Why POSITIVE stays out, in the file's own terms rather than restated: SELF_TEST_MODES
points at the dark control's recorded why, where batch 2 already turned this
self-test red for doing exactly what the ruling asked. The exclusion is written as
permanent, not pending — repairs move a member from tier dark to tier channelled
and it stays a member, so none of the three wired families can be destroyed by a
successful repair.

⛔ DURABILITY_CRITICAL_CALLEES is untouched, no entry was added to
durability-degradation.baseline.json, and the gate vocabulary is unchanged in either
direction (ruling item 3, bullet 2 — this PR must not be used to bring that step forward).

Readings

All on 93aecd5cf (the implementation commit; the two follow-ups touch only PM tooling). Every mutation confirmed on disk before the reading was taken
(injected marker counted and deleted text counted), every restore proved by hashing
the path against its HEAD blob, each harness carrying trap restore EXIT INT TERM with
absolute paths.

run	exit	verdict line
--self-test=gated on this branch	0	3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as declared, 56 member site(s) total
bare --self-test	0	4 positive, 3 negative, 2 regression, 6 resolution — the base branch's line, byte for byte
--self-test=gatd	2	x REFUSED: unknown self-test mode

Bare-output identity, measured not asserted. The base blob (e2a7fa5b8) was checked
out over the path, confirmed on disk by hash, run, and restored to the HEAD blob
(71f3ae1e5, verified). cmp on the two captures: identical.

Ablation A — the RESOLUTION family, on the defect it exists for. Reverted
indexFunctionBodies().get to the flat last-wins lookup (marker present 1, anchor
consumed). --self-test=gated → exit 1, four resolution controls firing:

 - resolution control moved: packages/objectql/src/engine.ts :: ObjectQL :: update()
-> expected `ObjectQL`, got ObjectRepository@7620, ObjectRepository@7722, ...
- resolution control moved: ... :: delete() -> got ObjectRepository@12213
- resolution control moved: ... :: transaction() -> got ScopedContext@12677
- resolution control moved: packages/runtime/src/app-plugin.ts :: resolveMappedObjects
:: push() -> expected REFUSAL, got collectBundleActions@457

Bare --self-test → exit 1 on the same tree. ⇒ the wired leg carries a real failure
signal into CI.

Ablation C — the hazard the ruling excluded POSITIVE for, reproduced. Simulated a
successful repair of the dark positive control's site by giving
share-link-service.ts :: resolveToken's telemetry catch a console.error (marker
present 1, original comment text consumed):

run	exit
bare --self-test	1	positive control found NO member: packages/plugins/plugin-sharing/src/share-link-service.ts
--self-test=gated	0	56 members becomes 55, and the gate stays green

⇒ this is the ruling's boundary 1 as a measurement: the full self-test reddens when the
repair programme succeeds, and the wired subset does not.

Ablation B — reported as a NULL result rather than dropped. Removing the #13459
bare-identifier refusal from the lexical walk landed on disk — marker 1, the deleted
return null; gone — and moved nothing: --json before and after is equal in every
stat (files 2193, guardedWrites 221, refusedShadowed 4, 56 members, empty symmetric
difference on the member set). The site the action-execution regression control pins is
answered a second time by the scope-aware body index, which refuses it too. So the two
departures are defence-in-depth there, and this ablation proves nothing about the
REGRESSION family in either direction. It is recorded because a discarded null ablation is
how a "we exercised that family" claim gets minted from a reading that never happened;
Ablation A is the failure proof.

Two things the wiring forced, both found by running the derived gates

Neither is scope creep: both are consequences of this card's own change, each caught by a
gate on this PR's derived list, and each landed with the repair the gate's own remedy text
names rather than the one that quiets it.

1. scripts/pm/dispatch-gates.mjs — the seam card is now a GATE SCRIPT. Its
--self-test went red in three cases. Wiring check:swallow-census-controls makes
measure-durability-swallow-family.mjs a file some discovered check family runs, so the
"adds or edits a GATE SCRIPT" convention KIND started hitting it — and that card is the
fixture chosen for the one assertion pair that needs the block harvest and --commands to
agree exactly, i.e. a card no convention KIND hits. Repointed at
measure-partial-retirement-annotation.mjs (block 13, commands 13, convention 0, four
node rows — measured), which is the very shape the census copied and which no check
family runs. ⛔ Not repaired by loosening the equality; the comment says so at the
constant. The third case is COMPOUND_ANCHOR_LEDGER: the new selfTestMode argv parser
matches the compound self-test name anchor and is classified accidental: true, which is
what that ledger's own "Maintaining this table" section prescribes — ⛔ explicitly not by
renaming the function to dodge the anchor.

2. scripts/pm/bare-root-worklist.mjs — a FRESH bare-root row. Wiring the family
makes the census's SCAN_ROOT visible to scripts/pm/bare-root-worklist.mjs
as a FRESH, unjudged row, and its --self-test reds until a verdict is recorded (it did,
on the first sweep). Recorded REFUSE-WIDE, measured on this tree in both terms and not
carried from a sibling row: the walk admits every non-test, non-declaration TypeScript
source under the root at four extensions — 2193 of 5755 (38%), numerator from the
instrument's own printed scan count, denominator from git ls-files packages. Same class
and nearly the same ratio as the check:authz-resolver row: a bare-root declaration would
be TRUE and is refused for width alone.

No changeset — skip-changeset

This diff publishes nothing from any package: a root check:* alias, a lint.yml step, a
repo-root measure-* script, and a PM worklist verdict. The precedent is exact —
0079e2585 (#13358), which wired this same family's precedent and touched precisely
.github/workflows/lint.yml + package.json + scripts/measure-stall-guard-headroom.mjs,
carried no changeset. An empty-frontmatter changeset is not the alternative:
scripts/check-empty-changeset.mjs rejects one, and its header records why (an empty
changeset is a real input to changesets/action and can stall a release, which the label
cannot). The label is applied on this PR.

Serial note — #13886 is next on this file

#13886 (same file, print semantics of the DARK worklist) is queued behind this card
(triage 2026-09-01, comment 5486764050) and is deliberately not folded in. That is also
why the bare self-test legs' output is left byte-identical here: changing print semantics
is that card's surface, not this one's. #13886 is not addressed by this PR and remains
open.

Gate record

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands
from the real change set (three-dot against merge base e80889095; the tool takes the
change set from git itself, no hand-written path list). Re-derived after each of the two
follow-up commits — the union stayed at 37 families throughout. All 37 were run, and
the union was re-run on the final commit 990649a77:

• 34 green, including the new check:swallow-census-controls itself,
  check:pm-dispatch-gates (✓ dispatch-gates self-test: 1232 cases pass.),
  check:self-test-wired and check:self-test-workflow-commands — the two the new step
  newly puts this script into the population of — plus
  check:declared-population-live, check:ratchet-remedy-authority,
  check:watch-hint-literal, check:entry-guard, check:parse-guard and
  node scripts/pm/bare-root-worklist.mjs --self-test (OK self-test: 57 live row(s), 49 unreachable as spelled, 49 recorded verdict(s) — none stale, none missing, none contradicted.).
• 3 NOT MEASURED, all exit 3 and none of them a finding, each quoting its own verdict
  line: check-test-completeness.mjs ("The log comes from a test RUN. This gate does not
  run tests and cannot produce one... the local reading for this gate is NOT MEASURED"),
  check:dual-build-cjs-loads and check:type-check-debt ("PREREQUISITE NOT MET... ⛔
  This is NOT a pass and NOT a finding: nothing was measured"). Structural — they need a
  built workspace or a real test-run log, which CI has and a local sweep does not.
• 2 were red, both on this card's own consequences, both repaired above:
  scripts/pm/bare-root-worklist.mjs --self-test (FRESH row) and
  check:pm-dispatch-gates (3 of 1232 cases). Both green on the final commit.

Exit codes were captured before any pipe (cmd > log 2>&1; rc=$?), never through one, and
every verdict quoted here is the gate's own printed line rather than a bare $?.

---

Generated by Claude Code

[claude]

Fixes#13919

The #12981 census (scripts/measure-durability-swallow-family.mjs) declares four
control families and, measured on origin/main, nothing ran any of them — zero
references to the script anywhere in package.json or .github/**, counter-checked
against a control that must return non-zero (measure-stall-guard-headroom, 2 hits) so
the zero was a reading and not a broken query. Meanwhile the resolver those controls pin
was repaired three times (#13459, #13474, PR #13915), each time with no gate holding the
previous repair, and the census's numbers feed #12981's repair worklist — so a wrong
denominator propagates into that programme with nobody watching.

The ruling this implements (verbatim, unchanged — comment 5494601066, maintainer 2026-09-01 「同意」)

1. B:measure-durability-swallow-family.mjs 增一个轻量 flag,把 RESOLUTION_CONTROLS + NEGATIVE_CONTROLS + REGRESSION_CONTROLS 三族(修复计划不可能消灭的那三族)接为 check:* 进 CI —— 先例 check:stall-guard-headroom(package.json:150)同形;
2. 拆分单入口形状的授权:The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 裁定认可的单入口仪器形状由本裁决显式修订为「单入口 + 分族 flag」—— 仪器的测量属性不变,每次运行照印 "a MEASUREMENT, not a gate";
3. 三条边界(⛔ 均为硬边):
   • ⛔ POSITIVE_CONTROLS 不接线(在成功时变红的门不是门,还训练舰队绕门 —— A 由文件自己的记录证伪,永久排除);
   • ⛔ 本裁决不得被用来提前 The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 保留的交接步(tryInsert/tryUpdate 进 DURABILITY_CRITICAL_CALLEES,仍 gated on outstanding == 0);
   • ⚠️ 若实施发现拆分需重复自测报告逻辑、超出一个轻量 flag 的量级 ⇒ 停手,带实施成本读数回箱;
4. C(维持不接线)排除 —— 现状就是本卡的成因,三次无守护修复已实测。

What landed

One mode selector, no duplicated reporting.selfTestMode(argv) reads the mode;
selfTest(mode) takes one gated ? [] : POSITIVE_CONTROLS on the loop it must skip, one
extra success-print branch, and one refusal branch. The problem list, the failure
formatter, the census call and the other three family loops are the same code on both
paths. Implementation cost against ruling item 3, bullet 3: the stop condition was not
reached — the split needed no duplication of the self-test's reporting logic.

• --self-test=gated runs RESOLUTION + NEGATIVE + REGRESSION, plus the
  zero-member floor. Wired as root check:swallow-census-controls and run from
  lint.yml beside the sanctioned precedent check:stall-guard-headroom — the same
  shape and the same asymmetry: the self-test leg only, never a bare invocation.
• Bare --self-test is byte-identical (proof below); --self-test=all is its
  spelling. Print semantics of the bare legs are deliberately untouched — that surface
  belongs to [finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886, see the serial note.
• An unknown mode is REFUSED with exit 2 rather than falling through. Without this,
  --self-test=gatd would miss argv.includes('--self-test'), reach report(), exit 0
  and read in a CI log exactly like a self-test that passed.
• Ruling item 2, the measurement property: the gated run prints the instrument's own
  banner line, now a single constant shared with report() rather than a second copy.

Why POSITIVE stays out, in the file's own terms rather than restated: SELF_TEST_MODES
points at the dark control's recorded why, where batch 2 already turned this
self-test red for doing exactly what the ruling asked. The exclusion is written as
permanent, not pending — repairs move a member from tier dark to tier channelled
and it stays a member, so none of the three wired families can be destroyed by a
successful repair.

⛔ DURABILITY_CRITICAL_CALLEES is untouched, no entry was added to
durability-degradation.baseline.json, and the gate vocabulary is unchanged in either
direction (ruling item 3, bullet 2 — this PR must not be used to bring that step forward).

Readings

All on 93aecd5cf (the implementation commit; the two follow-ups touch only PM tooling). Every mutation confirmed on disk before the reading was taken
(injected marker counted and deleted text counted), every restore proved by hashing
the path against its HEAD blob, each harness carrying trap restore EXIT INT TERM with
absolute paths.

run	exit	verdict line
--self-test=gated on this branch	0	3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as declared, 56 member site(s) total
bare --self-test	0	4 positive, 3 negative, 2 regression, 6 resolution — the base branch's line, byte for byte
--self-test=gatd	2	x REFUSED: unknown self-test mode

Bare-output identity, measured not asserted. The base blob (e2a7fa5b8) was checked
out over the path, confirmed on disk by hash, run, and restored to the HEAD blob
(71f3ae1e5, verified). cmp on the two captures: identical.

Ablation A — the RESOLUTION family, on the defect it exists for. Reverted
indexFunctionBodies().get to the flat last-wins lookup (marker present 1, anchor
consumed). --self-test=gated → exit 1, four resolution controls firing:

 - resolution control moved: packages/objectql/src/engine.ts :: ObjectQL :: update()
-> expected `ObjectQL`, got ObjectRepository@7620, ObjectRepository@7722, ...
- resolution control moved: ... :: delete() -> got ObjectRepository@12213
- resolution control moved: ... :: transaction() -> got ScopedContext@12677
- resolution control moved: packages/runtime/src/app-plugin.ts :: resolveMappedObjects
:: push() -> expected REFUSAL, got collectBundleActions@457

Bare --self-test → exit 1 on the same tree. ⇒ the wired leg carries a real failure
signal into CI.

Ablation C — the hazard the ruling excluded POSITIVE for, reproduced. Simulated a
successful repair of the dark positive control's site by giving
share-link-service.ts :: resolveToken's telemetry catch a console.error (marker
present 1, original comment text consumed):

run	exit
bare --self-test	1	positive control found NO member: packages/plugins/plugin-sharing/src/share-link-service.ts
--self-test=gated	0	56 members becomes 55, and the gate stays green

⇒ this is the ruling's boundary 1 as a measurement: the full self-test reddens when the
repair programme succeeds, and the wired subset does not.

Ablation B — reported as a NULL result rather than dropped. Removing the #13459
bare-identifier refusal from the lexical walk landed on disk — marker 1, the deleted
return null; gone — and moved nothing: --json before and after is equal in every
stat (files 2193, guardedWrites 221, refusedShadowed 4, 56 members, empty symmetric
difference on the member set). The site the action-execution regression control pins is
answered a second time by the scope-aware body index, which refuses it too. So the two
departures are defence-in-depth there, and this ablation proves nothing about the
REGRESSION family in either direction. It is recorded because a discarded null ablation is
how a "we exercised that family" claim gets minted from a reading that never happened;
Ablation A is the failure proof.

Two things the wiring forced, both found by running the derived gates

Neither is scope creep: both are consequences of this card's own change, each caught by a
gate on this PR's derived list, and each landed with the repair the gate's own remedy text
names rather than the one that quiets it.

1. scripts/pm/dispatch-gates.mjs — the seam card is now a GATE SCRIPT. Its
--self-test went red in three cases. Wiring check:swallow-census-controls makes
measure-durability-swallow-family.mjs a file some discovered check family runs, so the
"adds or edits a GATE SCRIPT" convention KIND started hitting it — and that card is the
fixture chosen for the one assertion pair that needs the block harvest and --commands to
agree exactly, i.e. a card no convention KIND hits. Repointed at
measure-partial-retirement-annotation.mjs (block 13, commands 13, convention 0, four
node rows — measured), which is the very shape the census copied and which no check
family runs. ⛔ Not repaired by loosening the equality; the comment says so at the
constant. The third case is COMPOUND_ANCHOR_LEDGER: the new selfTestMode argv parser
matches the compound self-test name anchor and is classified accidental: true, which is
what that ledger's own "Maintaining this table" section prescribes — ⛔ explicitly not by
renaming the function to dodge the anchor.

2. scripts/pm/bare-root-worklist.mjs — a FRESH bare-root row. Wiring the family
makes the census's SCAN_ROOT visible to scripts/pm/bare-root-worklist.mjs
as a FRESH, unjudged row, and its --self-test reds until a verdict is recorded (it did,
on the first sweep). Recorded REFUSE-WIDE, measured on this tree in both terms and not
carried from a sibling row: the walk admits every non-test, non-declaration TypeScript
source under the root at four extensions — 2193 of 5755 (38%), numerator from the
instrument's own printed scan count, denominator from git ls-files packages. Same class
and nearly the same ratio as the check:authz-resolver row: a bare-root declaration would
be TRUE and is refused for width alone.

No changeset — skip-changeset

This diff publishes nothing from any package: a root check:* alias, a lint.yml step, a
repo-root measure-* script, and a PM worklist verdict. The precedent is exact —
0079e2585 (#13358), which wired this same family's precedent and touched precisely
.github/workflows/lint.yml + package.json + scripts/measure-stall-guard-headroom.mjs,
carried no changeset. An empty-frontmatter changeset is not the alternative:
scripts/check-empty-changeset.mjs rejects one, and its header records why (an empty
changeset is a real input to changesets/action and can stall a release, which the label
cannot). The label is applied on this PR.

Serial note — #13886 is next on this file

#13886 (same file, print semantics of the DARK worklist) is queued behind this card
(triage 2026-09-01, comment 5486764050) and is deliberately not folded in. That is also
why the bare self-test legs' output is left byte-identical here: changing print semantics
is that card's surface, not this one's. #13886 is not addressed by this PR and remains
open.

Gate record

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands
from the real change set (three-dot against merge base e80889095; the tool takes the
change set from git itself, no hand-written path list). Re-derived after each of the two
follow-up commits — the union stayed at 37 families throughout. All 37 were run, and
the union was re-run on the final commit 990649a77:

• 34 green, including the new check:swallow-census-controls itself,
  check:pm-dispatch-gates (✓ dispatch-gates self-test: 1232 cases pass.),
  check:self-test-wired and check:self-test-workflow-commands — the two the new step
  newly puts this script into the population of — plus
  check:declared-population-live, check:ratchet-remedy-authority,
  check:watch-hint-literal, check:entry-guard, check:parse-guard and
  node scripts/pm/bare-root-worklist.mjs --self-test (OK self-test: 57 live row(s), 49 unreachable as spelled, 49 recorded verdict(s) — none stale, none missing, none contradicted.).
• 3 NOT MEASURED, all exit 3 and none of them a finding, each quoting its own verdict
  line: check-test-completeness.mjs ("The log comes from a test RUN. This gate does not
  run tests and cannot produce one... the local reading for this gate is NOT MEASURED"),
  check:dual-build-cjs-loads and check:type-check-debt ("PREREQUISITE NOT MET... ⛔
  This is NOT a pass and NOT a finding: nothing was measured"). Structural — they need a
  built workspace or a real test-run log, which CI has and a local sweep does not.
• 2 were red, both on this card's own consequences, both repaired above:
  scripts/pm/bare-root-worklist.mjs --self-test (FRESH row) and
  check:pm-dispatch-gates (3 of 1232 cases). Both green on the final commit.

Exit codes were captured before any pipe (cmd > log 2>&1; rc=$?), never through one, and
every verdict quoted here is the gate's own printed line rather than a bare $?.

---

Generated by Claude Code

[claude]

Fixes#13919

The #12981 census (scripts/measure-durability-swallow-family.mjs) declares four
control families and, measured on origin/main, nothing ran any of them — zero
references to the script anywhere in package.json or .github/**, counter-checked
against a control that must return non-zero (measure-stall-guard-headroom, 2 hits) so
the zero was a reading and not a broken query. Meanwhile the resolver those controls pin
was repaired three times (#13459, #13474, PR #13915), each time with no gate holding the
previous repair, and the census's numbers feed #12981's repair worklist — so a wrong
denominator propagates into that programme with nobody watching.

The ruling this implements (verbatim, unchanged — comment 5494601066, maintainer 2026-09-01 「同意」)

1. B:measure-durability-swallow-family.mjs 增一个轻量 flag,把 RESOLUTION_CONTROLS + NEGATIVE_CONTROLS + REGRESSION_CONTROLS 三族(修复计划不可能消灭的那三族)接为 check:* 进 CI —— 先例 check:stall-guard-headroom(package.json:150)同形;
2. 拆分单入口形状的授权:The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 裁定认可的单入口仪器形状由本裁决显式修订为「单入口 + 分族 flag」—— 仪器的测量属性不变,每次运行照印 "a MEASUREMENT, not a gate";
3. 三条边界(⛔ 均为硬边):
   • ⛔ POSITIVE_CONTROLS 不接线(在成功时变红的门不是门,还训练舰队绕门 —— A 由文件自己的记录证伪,永久排除);
   • ⛔ 本裁决不得被用来提前 The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 保留的交接步(tryInsert/tryUpdate 进 DURABILITY_CRITICAL_CALLEES,仍 gated on outstanding == 0);
   • ⚠️ 若实施发现拆分需重复自测报告逻辑、超出一个轻量 flag 的量级 ⇒ 停手,带实施成本读数回箱;
4. C(维持不接线)排除 —— 现状就是本卡的成因,三次无守护修复已实测。

What landed

One mode selector, no duplicated reporting.selfTestMode(argv) reads the mode;
selfTest(mode) takes one gated ? [] : POSITIVE_CONTROLS on the loop it must skip, one
extra success-print branch, and one refusal branch. The problem list, the failure
formatter, the census call and the other three family loops are the same code on both
paths. Implementation cost against ruling item 3, bullet 3: the stop condition was not
reached — the split needed no duplication of the self-test's reporting logic.

• --self-test=gated runs RESOLUTION + NEGATIVE + REGRESSION, plus the
  zero-member floor. Wired as root check:swallow-census-controls and run from
  lint.yml beside the sanctioned precedent check:stall-guard-headroom — the same
  shape and the same asymmetry: the self-test leg only, never a bare invocation.
• Bare --self-test is byte-identical (proof below); --self-test=all is its
  spelling. Print semantics of the bare legs are deliberately untouched — that surface
  belongs to [finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886, see the serial note.
• An unknown mode is REFUSED with exit 2 rather than falling through. Without this,
  --self-test=gatd would miss argv.includes('--self-test'), reach report(), exit 0
  and read in a CI log exactly like a self-test that passed.
• Ruling item 2, the measurement property: the gated run prints the instrument's own
  banner line, now a single constant shared with report() rather than a second copy.

Why POSITIVE stays out, in the file's own terms rather than restated: SELF_TEST_MODES
points at the dark control's recorded why, where batch 2 already turned this
self-test red for doing exactly what the ruling asked. The exclusion is written as
permanent, not pending — repairs move a member from tier dark to tier channelled
and it stays a member, so none of the three wired families can be destroyed by a
successful repair.

⛔ DURABILITY_CRITICAL_CALLEES is untouched, no entry was added to
durability-degradation.baseline.json, and the gate vocabulary is unchanged in either
direction (ruling item 3, bullet 2 — this PR must not be used to bring that step forward).

Readings

All on 93aecd5cf (the implementation commit; the two follow-ups touch only PM tooling). Every mutation confirmed on disk before the reading was taken
(injected marker counted and deleted text counted), every restore proved by hashing
the path against its HEAD blob, each harness carrying trap restore EXIT INT TERM with
absolute paths.

run	exit	verdict line
--self-test=gated on this branch	0	3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as declared, 56 member site(s) total
bare --self-test	0	4 positive, 3 negative, 2 regression, 6 resolution — the base branch's line, byte for byte
--self-test=gatd	2	x REFUSED: unknown self-test mode

Bare-output identity, measured not asserted. The base blob (e2a7fa5b8) was checked
out over the path, confirmed on disk by hash, run, and restored to the HEAD blob
(71f3ae1e5, verified). cmp on the two captures: identical.

Ablation A — the RESOLUTION family, on the defect it exists for. Reverted
indexFunctionBodies().get to the flat last-wins lookup (marker present 1, anchor
consumed). --self-test=gated → exit 1, four resolution controls firing:

 - resolution control moved: packages/objectql/src/engine.ts :: ObjectQL :: update()
-> expected `ObjectQL`, got ObjectRepository@7620, ObjectRepository@7722, ...
- resolution control moved: ... :: delete() -> got ObjectRepository@12213
- resolution control moved: ... :: transaction() -> got ScopedContext@12677
- resolution control moved: packages/runtime/src/app-plugin.ts :: resolveMappedObjects
:: push() -> expected REFUSAL, got collectBundleActions@457

Bare --self-test → exit 1 on the same tree. ⇒ the wired leg carries a real failure
signal into CI.

Ablation C — the hazard the ruling excluded POSITIVE for, reproduced. Simulated a
successful repair of the dark positive control's site by giving
share-link-service.ts :: resolveToken's telemetry catch a console.error (marker
present 1, original comment text consumed):

run	exit
bare --self-test	1	positive control found NO member: packages/plugins/plugin-sharing/src/share-link-service.ts
--self-test=gated	0	56 members becomes 55, and the gate stays green

⇒ this is the ruling's boundary 1 as a measurement: the full self-test reddens when the
repair programme succeeds, and the wired subset does not.

Ablation B — reported as a NULL result rather than dropped. Removing the #13459
bare-identifier refusal from the lexical walk landed on disk — marker 1, the deleted
return null; gone — and moved nothing: --json before and after is equal in every
stat (files 2193, guardedWrites 221, refusedShadowed 4, 56 members, empty symmetric
difference on the member set). The site the action-execution regression control pins is
answered a second time by the scope-aware body index, which refuses it too. So the two
departures are defence-in-depth there, and this ablation proves nothing about the
REGRESSION family in either direction. It is recorded because a discarded null ablation is
how a "we exercised that family" claim gets minted from a reading that never happened;
Ablation A is the failure proof.

Two things the wiring forced, both found by running the derived gates

Neither is scope creep: both are consequences of this card's own change, each caught by a
gate on this PR's derived list, and each landed with the repair the gate's own remedy text
names rather than the one that quiets it.

1. scripts/pm/dispatch-gates.mjs — the seam card is now a GATE SCRIPT. Its
--self-test went red in three cases. Wiring check:swallow-census-controls makes
measure-durability-swallow-family.mjs a file some discovered check family runs, so the
"adds or edits a GATE SCRIPT" convention KIND started hitting it — and that card is the
fixture chosen for the one assertion pair that needs the block harvest and --commands to
agree exactly, i.e. a card no convention KIND hits. Repointed at
measure-partial-retirement-annotation.mjs (block 13, commands 13, convention 0, four
node rows — measured), which is the very shape the census copied and which no check
family runs. ⛔ Not repaired by loosening the equality; the comment says so at the
constant. The third case is COMPOUND_ANCHOR_LEDGER: the new selfTestMode argv parser
matches the compound self-test name anchor and is classified accidental: true, which is
what that ledger's own "Maintaining this table" section prescribes — ⛔ explicitly not by
renaming the function to dodge the anchor.

2. scripts/pm/bare-root-worklist.mjs — a FRESH bare-root row. Wiring the family
makes the census's SCAN_ROOT visible to scripts/pm/bare-root-worklist.mjs
as a FRESH, unjudged row, and its --self-test reds until a verdict is recorded (it did,
on the first sweep). Recorded REFUSE-WIDE, measured on this tree in both terms and not
carried from a sibling row: the walk admits every non-test, non-declaration TypeScript
source under the root at four extensions — 2193 of 5755 (38%), numerator from the
instrument's own printed scan count, denominator from git ls-files packages. Same class
and nearly the same ratio as the check:authz-resolver row: a bare-root declaration would
be TRUE and is refused for width alone.

No changeset — skip-changeset

This diff publishes nothing from any package: a root check:* alias, a lint.yml step, a
repo-root measure-* script, and a PM worklist verdict. The precedent is exact —
0079e2585 (#13358), which wired this same family's precedent and touched precisely
.github/workflows/lint.yml + package.json + scripts/measure-stall-guard-headroom.mjs,
carried no changeset. An empty-frontmatter changeset is not the alternative:
scripts/check-empty-changeset.mjs rejects one, and its header records why (an empty
changeset is a real input to changesets/action and can stall a release, which the label
cannot). The label is applied on this PR.

Serial note — #13886 is next on this file

#13886 (same file, print semantics of the DARK worklist) is queued behind this card
(triage 2026-09-01, comment 5486764050) and is deliberately not folded in. That is also
why the bare self-test legs' output is left byte-identical here: changing print semantics
is that card's surface, not this one's. #13886 is not addressed by this PR and remains
open.

Gate record

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands
from the real change set (three-dot against merge base e80889095; the tool takes the
change set from git itself, no hand-written path list). Re-derived after each of the two
follow-up commits — the union stayed at 37 families throughout. All 37 were run, and
the union was re-run on the final commit 990649a77:

• 34 green, including the new check:swallow-census-controls itself,
  check:pm-dispatch-gates (✓ dispatch-gates self-test: 1232 cases pass.),
  check:self-test-wired and check:self-test-workflow-commands — the two the new step
  newly puts this script into the population of — plus
  check:declared-population-live, check:ratchet-remedy-authority,
  check:watch-hint-literal, check:entry-guard, check:parse-guard and
  node scripts/pm/bare-root-worklist.mjs --self-test (OK self-test: 57 live row(s), 49 unreachable as spelled, 49 recorded verdict(s) — none stale, none missing, none contradicted.).
• 3 NOT MEASURED, all exit 3 and none of them a finding, each quoting its own verdict
  line: check-test-completeness.mjs ("The log comes from a test RUN. This gate does not
  run tests and cannot produce one... the local reading for this gate is NOT MEASURED"),
  check:dual-build-cjs-loads and check:type-check-debt ("PREREQUISITE NOT MET... ⛔
  This is NOT a pass and NOT a finding: nothing was measured"). Structural — they need a
  built workspace or a real test-run log, which CI has and a local sweep does not.
• 2 were red, both on this card's own consequences, both repaired above:
  scripts/pm/bare-root-worklist.mjs --self-test (FRESH row) and
  check:pm-dispatch-gates (3 of 1232 cases). Both green on the final commit.

Exit codes were captured before any pipe (cmd > log 2>&1; rc=$?), never through one, and
every verdict quoted here is the gate's own printed line rather than a bare $?.

---

Generated by Claude Code

[claude]

Fixes#13919

The #12981 census (scripts/measure-durability-swallow-family.mjs) declares four
control families and, measured on origin/main, nothing ran any of them — zero
references to the script anywhere in package.json or .github/**, counter-checked
against a control that must return non-zero (measure-stall-guard-headroom, 2 hits) so
the zero was a reading and not a broken query. Meanwhile the resolver those controls pin
was repaired three times (#13459, #13474, PR #13915), each time with no gate holding the
previous repair, and the census's numbers feed #12981's repair worklist — so a wrong
denominator propagates into that programme with nobody watching.

The ruling this implements (verbatim, unchanged — comment 5494601066, maintainer 2026-09-01 「同意」)

1. B:measure-durability-swallow-family.mjs 增一个轻量 flag,把 RESOLUTION_CONTROLS + NEGATIVE_CONTROLS + REGRESSION_CONTROLS 三族(修复计划不可能消灭的那三族)接为 check:* 进 CI —— 先例 check:stall-guard-headroom(package.json:150)同形;
2. 拆分单入口形状的授权:The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 裁定认可的单入口仪器形状由本裁决显式修订为「单入口 + 分族 flag」—— 仪器的测量属性不变,每次运行照印 "a MEASUREMENT, not a gate";
3. 三条边界(⛔ 均为硬边):
   • ⛔ POSITIVE_CONTROLS 不接线(在成功时变红的门不是门,还训练舰队绕门 —— A 由文件自己的记录证伪,永久排除);
   • ⛔ 本裁决不得被用来提前 The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 保留的交接步(tryInsert/tryUpdate 进 DURABILITY_CRITICAL_CALLEES,仍 gated on outstanding == 0);
   • ⚠️ 若实施发现拆分需重复自测报告逻辑、超出一个轻量 flag 的量级 ⇒ 停手,带实施成本读数回箱;
4. C(维持不接线)排除 —— 现状就是本卡的成因,三次无守护修复已实测。

What landed

One mode selector, no duplicated reporting.selfTestMode(argv) reads the mode;
selfTest(mode) takes one gated ? [] : POSITIVE_CONTROLS on the loop it must skip, one
extra success-print branch, and one refusal branch. The problem list, the failure
formatter, the census call and the other three family loops are the same code on both
paths. Implementation cost against ruling item 3, bullet 3: the stop condition was not
reached — the split needed no duplication of the self-test's reporting logic.

• --self-test=gated runs RESOLUTION + NEGATIVE + REGRESSION, plus the
  zero-member floor. Wired as root check:swallow-census-controls and run from
  lint.yml beside the sanctioned precedent check:stall-guard-headroom — the same
  shape and the same asymmetry: the self-test leg only, never a bare invocation.
• Bare --self-test is byte-identical (proof below); --self-test=all is its
  spelling. Print semantics of the bare legs are deliberately untouched — that surface
  belongs to [finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886, see the serial note.
• An unknown mode is REFUSED with exit 2 rather than falling through. Without this,
  --self-test=gatd would miss argv.includes('--self-test'), reach report(), exit 0
  and read in a CI log exactly like a self-test that passed.
• Ruling item 2, the measurement property: the gated run prints the instrument's own
  banner line, now a single constant shared with report() rather than a second copy.

Why POSITIVE stays out, in the file's own terms rather than restated: SELF_TEST_MODES
points at the dark control's recorded why, where batch 2 already turned this
self-test red for doing exactly what the ruling asked. The exclusion is written as
permanent, not pending — repairs move a member from tier dark to tier channelled
and it stays a member, so none of the three wired families can be destroyed by a
successful repair.

⛔ DURABILITY_CRITICAL_CALLEES is untouched, no entry was added to
durability-degradation.baseline.json, and the gate vocabulary is unchanged in either
direction (ruling item 3, bullet 2 — this PR must not be used to bring that step forward).

Readings

All on 93aecd5cf (the implementation commit; the two follow-ups touch only PM tooling). Every mutation confirmed on disk before the reading was taken
(injected marker counted and deleted text counted), every restore proved by hashing
the path against its HEAD blob, each harness carrying trap restore EXIT INT TERM with
absolute paths.

run	exit	verdict line
--self-test=gated on this branch	0	3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as declared, 56 member site(s) total
bare --self-test	0	4 positive, 3 negative, 2 regression, 6 resolution — the base branch's line, byte for byte
--self-test=gatd	2	x REFUSED: unknown self-test mode

Bare-output identity, measured not asserted. The base blob (e2a7fa5b8) was checked
out over the path, confirmed on disk by hash, run, and restored to the HEAD blob
(71f3ae1e5, verified). cmp on the two captures: identical.

Ablation A — the RESOLUTION family, on the defect it exists for. Reverted
indexFunctionBodies().get to the flat last-wins lookup (marker present 1, anchor
consumed). --self-test=gated → exit 1, four resolution controls firing:

 - resolution control moved: packages/objectql/src/engine.ts :: ObjectQL :: update()
-> expected `ObjectQL`, got ObjectRepository@7620, ObjectRepository@7722, ...
- resolution control moved: ... :: delete() -> got ObjectRepository@12213
- resolution control moved: ... :: transaction() -> got ScopedContext@12677
- resolution control moved: packages/runtime/src/app-plugin.ts :: resolveMappedObjects
:: push() -> expected REFUSAL, got collectBundleActions@457

Bare --self-test → exit 1 on the same tree. ⇒ the wired leg carries a real failure
signal into CI.

Ablation C — the hazard the ruling excluded POSITIVE for, reproduced. Simulated a
successful repair of the dark positive control's site by giving
share-link-service.ts :: resolveToken's telemetry catch a console.error (marker
present 1, original comment text consumed):

run	exit
bare --self-test	1	positive control found NO member: packages/plugins/plugin-sharing/src/share-link-service.ts
--self-test=gated	0	56 members becomes 55, and the gate stays green

⇒ this is the ruling's boundary 1 as a measurement: the full self-test reddens when the
repair programme succeeds, and the wired subset does not.

Ablation B — reported as a NULL result rather than dropped. Removing the #13459
bare-identifier refusal from the lexical walk landed on disk — marker 1, the deleted
return null; gone — and moved nothing: --json before and after is equal in every
stat (files 2193, guardedWrites 221, refusedShadowed 4, 56 members, empty symmetric
difference on the member set). The site the action-execution regression control pins is
answered a second time by the scope-aware body index, which refuses it too. So the two
departures are defence-in-depth there, and this ablation proves nothing about the
REGRESSION family in either direction. It is recorded because a discarded null ablation is
how a "we exercised that family" claim gets minted from a reading that never happened;
Ablation A is the failure proof.

Two things the wiring forced, both found by running the derived gates

Neither is scope creep: both are consequences of this card's own change, each caught by a
gate on this PR's derived list, and each landed with the repair the gate's own remedy text
names rather than the one that quiets it.

1. scripts/pm/dispatch-gates.mjs — the seam card is now a GATE SCRIPT. Its
--self-test went red in three cases. Wiring check:swallow-census-controls makes
measure-durability-swallow-family.mjs a file some discovered check family runs, so the
"adds or edits a GATE SCRIPT" convention KIND started hitting it — and that card is the
fixture chosen for the one assertion pair that needs the block harvest and --commands to
agree exactly, i.e. a card no convention KIND hits. Repointed at
measure-partial-retirement-annotation.mjs (block 13, commands 13, convention 0, four
node rows — measured), which is the very shape the census copied and which no check
family runs. ⛔ Not repaired by loosening the equality; the comment says so at the
constant. The third case is COMPOUND_ANCHOR_LEDGER: the new selfTestMode argv parser
matches the compound self-test name anchor and is classified accidental: true, which is
what that ledger's own "Maintaining this table" section prescribes — ⛔ explicitly not by
renaming the function to dodge the anchor.

2. scripts/pm/bare-root-worklist.mjs — a FRESH bare-root row. Wiring the family
makes the census's SCAN_ROOT visible to scripts/pm/bare-root-worklist.mjs
as a FRESH, unjudged row, and its --self-test reds until a verdict is recorded (it did,
on the first sweep). Recorded REFUSE-WIDE, measured on this tree in both terms and not
carried from a sibling row: the walk admits every non-test, non-declaration TypeScript
source under the root at four extensions — 2193 of 5755 (38%), numerator from the
instrument's own printed scan count, denominator from git ls-files packages. Same class
and nearly the same ratio as the check:authz-resolver row: a bare-root declaration would
be TRUE and is refused for width alone.

No changeset — skip-changeset

This diff publishes nothing from any package: a root check:* alias, a lint.yml step, a
repo-root measure-* script, and a PM worklist verdict. The precedent is exact —
0079e2585 (#13358), which wired this same family's precedent and touched precisely
.github/workflows/lint.yml + package.json + scripts/measure-stall-guard-headroom.mjs,
carried no changeset. An empty-frontmatter changeset is not the alternative:
scripts/check-empty-changeset.mjs rejects one, and its header records why (an empty
changeset is a real input to changesets/action and can stall a release, which the label
cannot). The label is applied on this PR.

Serial note — #13886 is next on this file

#13886 (same file, print semantics of the DARK worklist) is queued behind this card
(triage 2026-09-01, comment 5486764050) and is deliberately not folded in. That is also
why the bare self-test legs' output is left byte-identical here: changing print semantics
is that card's surface, not this one's. #13886 is not addressed by this PR and remains
open.

Gate record

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands
from the real change set (three-dot against merge base e80889095; the tool takes the
change set from git itself, no hand-written path list). Re-derived after each of the two
follow-up commits — the union stayed at 37 families throughout. All 37 were run, and
the union was re-run on the final commit 990649a77:

• 34 green, including the new check:swallow-census-controls itself,
  check:pm-dispatch-gates (✓ dispatch-gates self-test: 1232 cases pass.),
  check:self-test-wired and check:self-test-workflow-commands — the two the new step
  newly puts this script into the population of — plus
  check:declared-population-live, check:ratchet-remedy-authority,
  check:watch-hint-literal, check:entry-guard, check:parse-guard and
  node scripts/pm/bare-root-worklist.mjs --self-test (OK self-test: 57 live row(s), 49 unreachable as spelled, 49 recorded verdict(s) — none stale, none missing, none contradicted.).
• 3 NOT MEASURED, all exit 3 and none of them a finding, each quoting its own verdict
  line: check-test-completeness.mjs ("The log comes from a test RUN. This gate does not
  run tests and cannot produce one... the local reading for this gate is NOT MEASURED"),
  check:dual-build-cjs-loads and check:type-check-debt ("PREREQUISITE NOT MET... ⛔
  This is NOT a pass and NOT a finding: nothing was measured"). Structural — they need a
  built workspace or a real test-run log, which CI has and a local sweep does not.
• 2 were red, both on this card's own consequences, both repaired above:
  scripts/pm/bare-root-worklist.mjs --self-test (FRESH row) and
  check:pm-dispatch-gates (3 of 1232 cases). Both green on the final commit.

Exit codes were captured before any pipe (cmd > log 2>&1; rc=$?), never through one, and
every verdict quoted here is the gate's own printed line rather than a bare $?.

---

Generated by Claude Code

[claude]

Fixes#13919

The #12981 census (scripts/measure-durability-swallow-family.mjs) declares four
control families and, measured on origin/main, nothing ran any of them — zero
references to the script anywhere in package.json or .github/**, counter-checked
against a control that must return non-zero (measure-stall-guard-headroom, 2 hits) so
the zero was a reading and not a broken query. Meanwhile the resolver those controls pin
was repaired three times (#13459, #13474, PR #13915), each time with no gate holding the
previous repair, and the census's numbers feed #12981's repair worklist — so a wrong
denominator propagates into that programme with nobody watching.

The ruling this implements (verbatim, unchanged — comment 5494601066, maintainer 2026-09-01 「同意」)

1. B:measure-durability-swallow-family.mjs 增一个轻量 flag,把 RESOLUTION_CONTROLS + NEGATIVE_CONTROLS + REGRESSION_CONTROLS 三族(修复计划不可能消灭的那三族)接为 check:* 进 CI —— 先例 check:stall-guard-headroom(package.json:150)同形;
2. 拆分单入口形状的授权:The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 裁定认可的单入口仪器形状由本裁决显式修订为「单入口 + 分族 flag」—— 仪器的测量属性不变,每次运行照印 "a MEASUREMENT, not a gate";
3. 三条边界(⛔ 均为硬边):
   • ⛔ POSITIVE_CONTROLS 不接线(在成功时变红的门不是门,还训练舰队绕门 —— A 由文件自己的记录证伪,永久排除);
   • ⛔ 本裁决不得被用来提前 The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 保留的交接步(tryInsert/tryUpdate 进 DURABILITY_CRITICAL_CALLEES,仍 gated on outstanding == 0);
   • ⚠️ 若实施发现拆分需重复自测报告逻辑、超出一个轻量 flag 的量级 ⇒ 停手,带实施成本读数回箱;
4. C(维持不接线)排除 —— 现状就是本卡的成因,三次无守护修复已实测。

What landed

One mode selector, no duplicated reporting.selfTestMode(argv) reads the mode;
selfTest(mode) takes one gated ? [] : POSITIVE_CONTROLS on the loop it must skip, one
extra success-print branch, and one refusal branch. The problem list, the failure
formatter, the census call and the other three family loops are the same code on both
paths. Implementation cost against ruling item 3, bullet 3: the stop condition was not
reached — the split needed no duplication of the self-test's reporting logic.

• --self-test=gated runs RESOLUTION + NEGATIVE + REGRESSION, plus the
  zero-member floor. Wired as root check:swallow-census-controls and run from
  lint.yml beside the sanctioned precedent check:stall-guard-headroom — the same
  shape and the same asymmetry: the self-test leg only, never a bare invocation.
• Bare --self-test is byte-identical (proof below); --self-test=all is its
  spelling. Print semantics of the bare legs are deliberately untouched — that surface
  belongs to [finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886, see the serial note.
• An unknown mode is REFUSED with exit 2 rather than falling through. Without this,
  --self-test=gatd would miss argv.includes('--self-test'), reach report(), exit 0
  and read in a CI log exactly like a self-test that passed.
• Ruling item 2, the measurement property: the gated run prints the instrument's own
  banner line, now a single constant shared with report() rather than a second copy.

Why POSITIVE stays out, in the file's own terms rather than restated: SELF_TEST_MODES
points at the dark control's recorded why, where batch 2 already turned this
self-test red for doing exactly what the ruling asked. The exclusion is written as
permanent, not pending — repairs move a member from tier dark to tier channelled
and it stays a member, so none of the three wired families can be destroyed by a
successful repair.

⛔ DURABILITY_CRITICAL_CALLEES is untouched, no entry was added to
durability-degradation.baseline.json, and the gate vocabulary is unchanged in either
direction (ruling item 3, bullet 2 — this PR must not be used to bring that step forward).

Readings

All on 93aecd5cf (the implementation commit; the two follow-ups touch only PM tooling). Every mutation confirmed on disk before the reading was taken
(injected marker counted and deleted text counted), every restore proved by hashing
the path against its HEAD blob, each harness carrying trap restore EXIT INT TERM with
absolute paths.

run	exit	verdict line
--self-test=gated on this branch	0	3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as declared, 56 member site(s) total
bare --self-test	0	4 positive, 3 negative, 2 regression, 6 resolution — the base branch's line, byte for byte
--self-test=gatd	2	x REFUSED: unknown self-test mode

Bare-output identity, measured not asserted. The base blob (e2a7fa5b8) was checked
out over the path, confirmed on disk by hash, run, and restored to the HEAD blob
(71f3ae1e5, verified). cmp on the two captures: identical.

Ablation A — the RESOLUTION family, on the defect it exists for. Reverted
indexFunctionBodies().get to the flat last-wins lookup (marker present 1, anchor
consumed). --self-test=gated → exit 1, four resolution controls firing:

 - resolution control moved: packages/objectql/src/engine.ts :: ObjectQL :: update()
-> expected `ObjectQL`, got ObjectRepository@7620, ObjectRepository@7722, ...
- resolution control moved: ... :: delete() -> got ObjectRepository@12213
- resolution control moved: ... :: transaction() -> got ScopedContext@12677
- resolution control moved: packages/runtime/src/app-plugin.ts :: resolveMappedObjects
:: push() -> expected REFUSAL, got collectBundleActions@457

Bare --self-test → exit 1 on the same tree. ⇒ the wired leg carries a real failure
signal into CI.

Ablation C — the hazard the ruling excluded POSITIVE for, reproduced. Simulated a
successful repair of the dark positive control's site by giving
share-link-service.ts :: resolveToken's telemetry catch a console.error (marker
present 1, original comment text consumed):

run	exit
bare --self-test	1	positive control found NO member: packages/plugins/plugin-sharing/src/share-link-service.ts
--self-test=gated	0	56 members becomes 55, and the gate stays green

⇒ this is the ruling's boundary 1 as a measurement: the full self-test reddens when the
repair programme succeeds, and the wired subset does not.

Ablation B — reported as a NULL result rather than dropped. Removing the #13459
bare-identifier refusal from the lexical walk landed on disk — marker 1, the deleted
return null; gone — and moved nothing: --json before and after is equal in every
stat (files 2193, guardedWrites 221, refusedShadowed 4, 56 members, empty symmetric
difference on the member set). The site the action-execution regression control pins is
answered a second time by the scope-aware body index, which refuses it too. So the two
departures are defence-in-depth there, and this ablation proves nothing about the
REGRESSION family in either direction. It is recorded because a discarded null ablation is
how a "we exercised that family" claim gets minted from a reading that never happened;
Ablation A is the failure proof.

Two things the wiring forced, both found by running the derived gates

Neither is scope creep: both are consequences of this card's own change, each caught by a
gate on this PR's derived list, and each landed with the repair the gate's own remedy text
names rather than the one that quiets it.

1. scripts/pm/dispatch-gates.mjs — the seam card is now a GATE SCRIPT. Its
--self-test went red in three cases. Wiring check:swallow-census-controls makes
measure-durability-swallow-family.mjs a file some discovered check family runs, so the
"adds or edits a GATE SCRIPT" convention KIND started hitting it — and that card is the
fixture chosen for the one assertion pair that needs the block harvest and --commands to
agree exactly, i.e. a card no convention KIND hits. Repointed at
measure-partial-retirement-annotation.mjs (block 13, commands 13, convention 0, four
node rows — measured), which is the very shape the census copied and which no check
family runs. ⛔ Not repaired by loosening the equality; the comment says so at the
constant. The third case is COMPOUND_ANCHOR_LEDGER: the new selfTestMode argv parser
matches the compound self-test name anchor and is classified accidental: true, which is
what that ledger's own "Maintaining this table" section prescribes — ⛔ explicitly not by
renaming the function to dodge the anchor.

2. scripts/pm/bare-root-worklist.mjs — a FRESH bare-root row. Wiring the family
makes the census's SCAN_ROOT visible to scripts/pm/bare-root-worklist.mjs
as a FRESH, unjudged row, and its --self-test reds until a verdict is recorded (it did,
on the first sweep). Recorded REFUSE-WIDE, measured on this tree in both terms and not
carried from a sibling row: the walk admits every non-test, non-declaration TypeScript
source under the root at four extensions — 2193 of 5755 (38%), numerator from the
instrument's own printed scan count, denominator from git ls-files packages. Same class
and nearly the same ratio as the check:authz-resolver row: a bare-root declaration would
be TRUE and is refused for width alone.

No changeset — skip-changeset

This diff publishes nothing from any package: a root check:* alias, a lint.yml step, a
repo-root measure-* script, and a PM worklist verdict. The precedent is exact —
0079e2585 (#13358), which wired this same family's precedent and touched precisely
.github/workflows/lint.yml + package.json + scripts/measure-stall-guard-headroom.mjs,
carried no changeset. An empty-frontmatter changeset is not the alternative:
scripts/check-empty-changeset.mjs rejects one, and its header records why (an empty
changeset is a real input to changesets/action and can stall a release, which the label
cannot). The label is applied on this PR.

Serial note — #13886 is next on this file

#13886 (same file, print semantics of the DARK worklist) is queued behind this card
(triage 2026-09-01, comment 5486764050) and is deliberately not folded in. That is also
why the bare self-test legs' output is left byte-identical here: changing print semantics
is that card's surface, not this one's. #13886 is not addressed by this PR and remains
open.

Gate record

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands
from the real change set (three-dot against merge base e80889095; the tool takes the
change set from git itself, no hand-written path list). Re-derived after each of the two
follow-up commits — the union stayed at 37 families throughout. All 37 were run, and
the union was re-run on the final commit 990649a77:

• 34 green, including the new check:swallow-census-controls itself,
  check:pm-dispatch-gates (✓ dispatch-gates self-test: 1232 cases pass.),
  check:self-test-wired and check:self-test-workflow-commands — the two the new step
  newly puts this script into the population of — plus
  check:declared-population-live, check:ratchet-remedy-authority,
  check:watch-hint-literal, check:entry-guard, check:parse-guard and
  node scripts/pm/bare-root-worklist.mjs --self-test (OK self-test: 57 live row(s), 49 unreachable as spelled, 49 recorded verdict(s) — none stale, none missing, none contradicted.).
• 3 NOT MEASURED, all exit 3 and none of them a finding, each quoting its own verdict
  line: check-test-completeness.mjs ("The log comes from a test RUN. This gate does not
  run tests and cannot produce one... the local reading for this gate is NOT MEASURED"),
  check:dual-build-cjs-loads and check:type-check-debt ("PREREQUISITE NOT MET... ⛔
  This is NOT a pass and NOT a finding: nothing was measured"). Structural — they need a
  built workspace or a real test-run log, which CI has and a local sweep does not.
• 2 were red, both on this card's own consequences, both repaired above:
  scripts/pm/bare-root-worklist.mjs --self-test (FRESH row) and
  check:pm-dispatch-gates (3 of 1232 cases). Both green on the final commit.

Exit codes were captured before any pipe (cmd > log 2>&1; rc=$?), never through one, and
every verdict quoted here is the gate's own printed line rather than a bare $?.

---

Generated by Claude Code

[claude]

Fixes#13919

The #12981 census (scripts/measure-durability-swallow-family.mjs) declares four
control families and, measured on origin/main, nothing ran any of them — zero
references to the script anywhere in package.json or .github/**, counter-checked
against a control that must return non-zero (measure-stall-guard-headroom, 2 hits) so
the zero was a reading and not a broken query. Meanwhile the resolver those controls pin
was repaired three times (#13459, #13474, PR #13915), each time with no gate holding the
previous repair, and the census's numbers feed #12981's repair worklist — so a wrong
denominator propagates into that programme with nobody watching.

The ruling this implements (verbatim, unchanged — comment 5494601066, maintainer 2026-09-01 「同意」)

1. B:measure-durability-swallow-family.mjs 增一个轻量 flag,把 RESOLUTION_CONTROLS + NEGATIVE_CONTROLS + REGRESSION_CONTROLS 三族(修复计划不可能消灭的那三族)接为 check:* 进 CI —— 先例 check:stall-guard-headroom(package.json:150)同形;
2. 拆分单入口形状的授权:The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 裁定认可的单入口仪器形状由本裁决显式修订为「单入口 + 分族 flag」—— 仪器的测量属性不变,每次运行照印 "a MEASUREMENT, not a gate";
3. 三条边界(⛔ 均为硬边):
   • ⛔ POSITIVE_CONTROLS 不接线(在成功时变红的门不是门,还训练舰队绕门 —— A 由文件自己的记录证伪,永久排除);
   • ⛔ 本裁决不得被用来提前 The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 保留的交接步(tryInsert/tryUpdate 进 DURABILITY_CRITICAL_CALLEES,仍 gated on outstanding == 0);
   • ⚠️ 若实施发现拆分需重复自测报告逻辑、超出一个轻量 flag 的量级 ⇒ 停手,带实施成本读数回箱;
4. C(维持不接线)排除 —— 现状就是本卡的成因,三次无守护修复已实测。

What landed

One mode selector, no duplicated reporting.selfTestMode(argv) reads the mode;
selfTest(mode) takes one gated ? [] : POSITIVE_CONTROLS on the loop it must skip, one
extra success-print branch, and one refusal branch. The problem list, the failure
formatter, the census call and the other three family loops are the same code on both
paths. Implementation cost against ruling item 3, bullet 3: the stop condition was not
reached — the split needed no duplication of the self-test's reporting logic.

• --self-test=gated runs RESOLUTION + NEGATIVE + REGRESSION, plus the
  zero-member floor. Wired as root check:swallow-census-controls and run from
  lint.yml beside the sanctioned precedent check:stall-guard-headroom — the same
  shape and the same asymmetry: the self-test leg only, never a bare invocation.
• Bare --self-test is byte-identical (proof below); --self-test=all is its
  spelling. Print semantics of the bare legs are deliberately untouched — that surface
  belongs to [finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886, see the serial note.
• An unknown mode is REFUSED with exit 2 rather than falling through. Without this,
  --self-test=gatd would miss argv.includes('--self-test'), reach report(), exit 0
  and read in a CI log exactly like a self-test that passed.
• Ruling item 2, the measurement property: the gated run prints the instrument's own
  banner line, now a single constant shared with report() rather than a second copy.

Why POSITIVE stays out, in the file's own terms rather than restated: SELF_TEST_MODES
points at the dark control's recorded why, where batch 2 already turned this
self-test red for doing exactly what the ruling asked. The exclusion is written as
permanent, not pending — repairs move a member from tier dark to tier channelled
and it stays a member, so none of the three wired families can be destroyed by a
successful repair.

⛔ DURABILITY_CRITICAL_CALLEES is untouched, no entry was added to
durability-degradation.baseline.json, and the gate vocabulary is unchanged in either
direction (ruling item 3, bullet 2 — this PR must not be used to bring that step forward).

Readings

All on 93aecd5cf (the implementation commit; the two follow-ups touch only PM tooling). Every mutation confirmed on disk before the reading was taken
(injected marker counted and deleted text counted), every restore proved by hashing
the path against its HEAD blob, each harness carrying trap restore EXIT INT TERM with
absolute paths.

run	exit	verdict line
--self-test=gated on this branch	0	3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as declared, 56 member site(s) total
bare --self-test	0	4 positive, 3 negative, 2 regression, 6 resolution — the base branch's line, byte for byte
--self-test=gatd	2	x REFUSED: unknown self-test mode

Bare-output identity, measured not asserted. The base blob (e2a7fa5b8) was checked
out over the path, confirmed on disk by hash, run, and restored to the HEAD blob
(71f3ae1e5, verified). cmp on the two captures: identical.

Ablation A — the RESOLUTION family, on the defect it exists for. Reverted
indexFunctionBodies().get to the flat last-wins lookup (marker present 1, anchor
consumed). --self-test=gated → exit 1, four resolution controls firing:

 - resolution control moved: packages/objectql/src/engine.ts :: ObjectQL :: update()
-> expected `ObjectQL`, got ObjectRepository@7620, ObjectRepository@7722, ...
- resolution control moved: ... :: delete() -> got ObjectRepository@12213
- resolution control moved: ... :: transaction() -> got ScopedContext@12677
- resolution control moved: packages/runtime/src/app-plugin.ts :: resolveMappedObjects
:: push() -> expected REFUSAL, got collectBundleActions@457

Bare --self-test → exit 1 on the same tree. ⇒ the wired leg carries a real failure
signal into CI.

Ablation C — the hazard the ruling excluded POSITIVE for, reproduced. Simulated a
successful repair of the dark positive control's site by giving
share-link-service.ts :: resolveToken's telemetry catch a console.error (marker
present 1, original comment text consumed):

run	exit
bare --self-test	1	positive control found NO member: packages/plugins/plugin-sharing/src/share-link-service.ts
--self-test=gated	0	56 members becomes 55, and the gate stays green

⇒ this is the ruling's boundary 1 as a measurement: the full self-test reddens when the
repair programme succeeds, and the wired subset does not.

Ablation B — reported as a NULL result rather than dropped. Removing the #13459
bare-identifier refusal from the lexical walk landed on disk — marker 1, the deleted
return null; gone — and moved nothing: --json before and after is equal in every
stat (files 2193, guardedWrites 221, refusedShadowed 4, 56 members, empty symmetric
difference on the member set). The site the action-execution regression control pins is
answered a second time by the scope-aware body index, which refuses it too. So the two
departures are defence-in-depth there, and this ablation proves nothing about the
REGRESSION family in either direction. It is recorded because a discarded null ablation is
how a "we exercised that family" claim gets minted from a reading that never happened;
Ablation A is the failure proof.

Two things the wiring forced, both found by running the derived gates

Neither is scope creep: both are consequences of this card's own change, each caught by a
gate on this PR's derived list, and each landed with the repair the gate's own remedy text
names rather than the one that quiets it.

1. scripts/pm/dispatch-gates.mjs — the seam card is now a GATE SCRIPT. Its
--self-test went red in three cases. Wiring check:swallow-census-controls makes
measure-durability-swallow-family.mjs a file some discovered check family runs, so the
"adds or edits a GATE SCRIPT" convention KIND started hitting it — and that card is the
fixture chosen for the one assertion pair that needs the block harvest and --commands to
agree exactly, i.e. a card no convention KIND hits. Repointed at
measure-partial-retirement-annotation.mjs (block 13, commands 13, convention 0, four
node rows — measured), which is the very shape the census copied and which no check
family runs. ⛔ Not repaired by loosening the equality; the comment says so at the
constant. The third case is COMPOUND_ANCHOR_LEDGER: the new selfTestMode argv parser
matches the compound self-test name anchor and is classified accidental: true, which is
what that ledger's own "Maintaining this table" section prescribes — ⛔ explicitly not by
renaming the function to dodge the anchor.

2. scripts/pm/bare-root-worklist.mjs — a FRESH bare-root row. Wiring the family
makes the census's SCAN_ROOT visible to scripts/pm/bare-root-worklist.mjs
as a FRESH, unjudged row, and its --self-test reds until a verdict is recorded (it did,
on the first sweep). Recorded REFUSE-WIDE, measured on this tree in both terms and not
carried from a sibling row: the walk admits every non-test, non-declaration TypeScript
source under the root at four extensions — 2193 of 5755 (38%), numerator from the
instrument's own printed scan count, denominator from git ls-files packages. Same class
and nearly the same ratio as the check:authz-resolver row: a bare-root declaration would
be TRUE and is refused for width alone.

No changeset — skip-changeset

This diff publishes nothing from any package: a root check:* alias, a lint.yml step, a
repo-root measure-* script, and a PM worklist verdict. The precedent is exact —
0079e2585 (#13358), which wired this same family's precedent and touched precisely
.github/workflows/lint.yml + package.json + scripts/measure-stall-guard-headroom.mjs,
carried no changeset. An empty-frontmatter changeset is not the alternative:
scripts/check-empty-changeset.mjs rejects one, and its header records why (an empty
changeset is a real input to changesets/action and can stall a release, which the label
cannot). The label is applied on this PR.

Serial note — #13886 is next on this file

#13886 (same file, print semantics of the DARK worklist) is queued behind this card
(triage 2026-09-01, comment 5486764050) and is deliberately not folded in. That is also
why the bare self-test legs' output is left byte-identical here: changing print semantics
is that card's surface, not this one's. #13886 is not addressed by this PR and remains
open.

Gate record

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands
from the real change set (three-dot against merge base e80889095; the tool takes the
change set from git itself, no hand-written path list). Re-derived after each of the two
follow-up commits — the union stayed at 37 families throughout. All 37 were run, and
the union was re-run on the final commit 990649a77:

• 34 green, including the new check:swallow-census-controls itself,
  check:pm-dispatch-gates (✓ dispatch-gates self-test: 1232 cases pass.),
  check:self-test-wired and check:self-test-workflow-commands — the two the new step
  newly puts this script into the population of — plus
  check:declared-population-live, check:ratchet-remedy-authority,
  check:watch-hint-literal, check:entry-guard, check:parse-guard and
  node scripts/pm/bare-root-worklist.mjs --self-test (OK self-test: 57 live row(s), 49 unreachable as spelled, 49 recorded verdict(s) — none stale, none missing, none contradicted.).
• 3 NOT MEASURED, all exit 3 and none of them a finding, each quoting its own verdict
  line: check-test-completeness.mjs ("The log comes from a test RUN. This gate does not
  run tests and cannot produce one... the local reading for this gate is NOT MEASURED"),
  check:dual-build-cjs-loads and check:type-check-debt ("PREREQUISITE NOT MET... ⛔
  This is NOT a pass and NOT a finding: nothing was measured"). Structural — they need a
  built workspace or a real test-run log, which CI has and a local sweep does not.
• 2 were red, both on this card's own consequences, both repaired above:
  scripts/pm/bare-root-worklist.mjs --self-test (FRESH row) and
  check:pm-dispatch-gates (3 of 1232 cases). Both green on the final commit.

Exit codes were captured before any pipe (cmd > log 2>&1; rc=$?), never through one, and
every verdict quoted here is the gate's own printed line rather than a bare $?.

---

Generated by Claude Code

[claude]

Fixes#13919

The #12981 census (scripts/measure-durability-swallow-family.mjs) declares four
control families and, measured on origin/main, nothing ran any of them — zero
references to the script anywhere in package.json or .github/**, counter-checked
against a control that must return non-zero (measure-stall-guard-headroom, 2 hits) so
the zero was a reading and not a broken query. Meanwhile the resolver those controls pin
was repaired three times (#13459, #13474, PR #13915), each time with no gate holding the
previous repair, and the census's numbers feed #12981's repair worklist — so a wrong
denominator propagates into that programme with nobody watching.

The ruling this implements (verbatim, unchanged — comment 5494601066, maintainer 2026-09-01 「同意」)

1. B:measure-durability-swallow-family.mjs 增一个轻量 flag,把 RESOLUTION_CONTROLS + NEGATIVE_CONTROLS + REGRESSION_CONTROLS 三族(修复计划不可能消灭的那三族)接为 check:* 进 CI —— 先例 check:stall-guard-headroom(package.json:150)同形;
2. 拆分单入口形状的授权:The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 裁定认可的单入口仪器形状由本裁决显式修订为「单入口 + 分族 flag」—— 仪器的测量属性不变,每次运行照印 "a MEASUREMENT, not a gate";
3. 三条边界(⛔ 均为硬边):
   • ⛔ POSITIVE_CONTROLS 不接线(在成功时变红的门不是门,还训练舰队绕门 —— A 由文件自己的记录证伪,永久排除);
   • ⛔ 本裁决不得被用来提前 The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 保留的交接步(tryInsert/tryUpdate 进 DURABILITY_CRITICAL_CALLEES,仍 gated on outstanding == 0);
   • ⚠️ 若实施发现拆分需重复自测报告逻辑、超出一个轻量 flag 的量级 ⇒ 停手,带实施成本读数回箱;
4. C(维持不接线)排除 —— 现状就是本卡的成因,三次无守护修复已实测。

What landed

One mode selector, no duplicated reporting.selfTestMode(argv) reads the mode;
selfTest(mode) takes one gated ? [] : POSITIVE_CONTROLS on the loop it must skip, one
extra success-print branch, and one refusal branch. The problem list, the failure
formatter, the census call and the other three family loops are the same code on both
paths. Implementation cost against ruling item 3, bullet 3: the stop condition was not
reached — the split needed no duplication of the self-test's reporting logic.

• --self-test=gated runs RESOLUTION + NEGATIVE + REGRESSION, plus the
  zero-member floor. Wired as root check:swallow-census-controls and run from
  lint.yml beside the sanctioned precedent check:stall-guard-headroom — the same
  shape and the same asymmetry: the self-test leg only, never a bare invocation.
• Bare --self-test is byte-identical (proof below); --self-test=all is its
  spelling. Print semantics of the bare legs are deliberately untouched — that surface
  belongs to [finding] the #12981 census prints 5 DARK sites as "the repair worklist" when 4 are settled determinations — an annotation cannot move a site out of the bucket #13886, see the serial note.
• An unknown mode is REFUSED with exit 2 rather than falling through. Without this,
  --self-test=gatd would miss argv.includes('--self-test'), reach report(), exit 0
  and read in a CI log exactly like a self-test that passed.
• Ruling item 2, the measurement property: the gated run prints the instrument's own
  banner line, now a single constant shared with report() rather than a second copy.

Why POSITIVE stays out, in the file's own terms rather than restated: SELF_TEST_MODES
points at the dark control's recorded why, where batch 2 already turned this
self-test red for doing exactly what the ruling asked. The exclusion is written as
permanent, not pending — repairs move a member from tier dark to tier channelled
and it stays a member, so none of the three wired families can be destroyed by a
successful repair.

⛔ DURABILITY_CRITICAL_CALLEES is untouched, no entry was added to
durability-degradation.baseline.json, and the gate vocabulary is unchanged in either
direction (ruling item 3, bullet 2 — this PR must not be used to bring that step forward).

Readings

All on 93aecd5cf (the implementation commit; the two follow-ups touch only PM tooling). Every mutation confirmed on disk before the reading was taken
(injected marker counted and deleted text counted), every restore proved by hashing
the path against its HEAD blob, each harness carrying trap restore EXIT INT TERM with
absolute paths.

run	exit	verdict line
--self-test=gated on this branch	0	3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as declared, 56 member site(s) total
bare --self-test	0	4 positive, 3 negative, 2 regression, 6 resolution — the base branch's line, byte for byte
--self-test=gatd	2	x REFUSED: unknown self-test mode

Bare-output identity, measured not asserted. The base blob (e2a7fa5b8) was checked
out over the path, confirmed on disk by hash, run, and restored to the HEAD blob
(71f3ae1e5, verified). cmp on the two captures: identical.

Ablation A — the RESOLUTION family, on the defect it exists for. Reverted
indexFunctionBodies().get to the flat last-wins lookup (marker present 1, anchor
consumed). --self-test=gated → exit 1, four resolution controls firing:

 - resolution control moved: packages/objectql/src/engine.ts :: ObjectQL :: update()
-> expected `ObjectQL`, got ObjectRepository@7620, ObjectRepository@7722, ...
- resolution control moved: ... :: delete() -> got ObjectRepository@12213
- resolution control moved: ... :: transaction() -> got ScopedContext@12677
- resolution control moved: packages/runtime/src/app-plugin.ts :: resolveMappedObjects
:: push() -> expected REFUSAL, got collectBundleActions@457

Bare --self-test → exit 1 on the same tree. ⇒ the wired leg carries a real failure
signal into CI.

Ablation C — the hazard the ruling excluded POSITIVE for, reproduced. Simulated a
successful repair of the dark positive control's site by giving
share-link-service.ts :: resolveToken's telemetry catch a console.error (marker
present 1, original comment text consumed):

run	exit
bare --self-test	1	positive control found NO member: packages/plugins/plugin-sharing/src/share-link-service.ts
--self-test=gated	0	56 members becomes 55, and the gate stays green

⇒ this is the ruling's boundary 1 as a measurement: the full self-test reddens when the
repair programme succeeds, and the wired subset does not.

Ablation B — reported as a NULL result rather than dropped. Removing the #13459
bare-identifier refusal from the lexical walk landed on disk — marker 1, the deleted
return null; gone — and moved nothing: --json before and after is equal in every
stat (files 2193, guardedWrites 221, refusedShadowed 4, 56 members, empty symmetric
difference on the member set). The site the action-execution regression control pins is
answered a second time by the scope-aware body index, which refuses it too. So the two
departures are defence-in-depth there, and this ablation proves nothing about the
REGRESSION family in either direction. It is recorded because a discarded null ablation is
how a "we exercised that family" claim gets minted from a reading that never happened;
Ablation A is the failure proof.

Two things the wiring forced, both found by running the derived gates

Neither is scope creep: both are consequences of this card's own change, each caught by a
gate on this PR's derived list, and each landed with the repair the gate's own remedy text
names rather than the one that quiets it.

1. scripts/pm/dispatch-gates.mjs — the seam card is now a GATE SCRIPT. Its
--self-test went red in three cases. Wiring check:swallow-census-controls makes
measure-durability-swallow-family.mjs a file some discovered check family runs, so the
"adds or edits a GATE SCRIPT" convention KIND started hitting it — and that card is the
fixture chosen for the one assertion pair that needs the block harvest and --commands to
agree exactly, i.e. a card no convention KIND hits. Repointed at
measure-partial-retirement-annotation.mjs (block 13, commands 13, convention 0, four
node rows — measured), which is the very shape the census copied and which no check
family runs. ⛔ Not repaired by loosening the equality; the comment says so at the
constant. The third case is COMPOUND_ANCHOR_LEDGER: the new selfTestMode argv parser
matches the compound self-test name anchor and is classified accidental: true, which is
what that ledger's own "Maintaining this table" section prescribes — ⛔ explicitly not by
renaming the function to dodge the anchor.

2. scripts/pm/bare-root-worklist.mjs — a FRESH bare-root row. Wiring the family
makes the census's SCAN_ROOT visible to scripts/pm/bare-root-worklist.mjs
as a FRESH, unjudged row, and its --self-test reds until a verdict is recorded (it did,
on the first sweep). Recorded REFUSE-WIDE, measured on this tree in both terms and not
carried from a sibling row: the walk admits every non-test, non-declaration TypeScript
source under the root at four extensions — 2193 of 5755 (38%), numerator from the
instrument's own printed scan count, denominator from git ls-files packages. Same class
and nearly the same ratio as the check:authz-resolver row: a bare-root declaration would
be TRUE and is refused for width alone.

No changeset — skip-changeset

This diff publishes nothing from any package: a root check:* alias, a lint.yml step, a
repo-root measure-* script, and a PM worklist verdict. The precedent is exact —
0079e2585 (#13358), which wired this same family's precedent and touched precisely
.github/workflows/lint.yml + package.json + scripts/measure-stall-guard-headroom.mjs,
carried no changeset. An empty-frontmatter changeset is not the alternative:
scripts/check-empty-changeset.mjs rejects one, and its header records why (an empty
changeset is a real input to changesets/action and can stall a release, which the label
cannot). The label is applied on this PR.

Serial note — #13886 is next on this file

#13886 (same file, print semantics of the DARK worklist) is queued behind this card
(triage 2026-09-01, comment 5486764050) and is deliberately not folded in. That is also
why the bare self-test legs' output is left byte-identical here: changing print semantics
is that card's surface, not this one's. #13886 is not addressed by this PR and remains
open.

Gate record

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands
from the real change set (three-dot against merge base e80889095; the tool takes the
change set from git itself, no hand-written path list). Re-derived after each of the two
follow-up commits — the union stayed at 37 families throughout. All 37 were run, and
the union was re-run on the final commit 990649a77:

• 34 green, including the new check:swallow-census-controls itself,
  check:pm-dispatch-gates (✓ dispatch-gates self-test: 1232 cases pass.),
  check:self-test-wired and check:self-test-workflow-commands — the two the new step
  newly puts this script into the population of — plus
  check:declared-population-live, check:ratchet-remedy-authority,
  check:watch-hint-literal, check:entry-guard, check:parse-guard and
  node scripts/pm/bare-root-worklist.mjs --self-test (OK self-test: 57 live row(s), 49 unreachable as spelled, 49 recorded verdict(s) — none stale, none missing, none contradicted.).
• 3 NOT MEASURED, all exit 3 and none of them a finding, each quoting its own verdict
  line: check-test-completeness.mjs ("The log comes from a test RUN. This gate does not
  run tests and cannot produce one... the local reading for this gate is NOT MEASURED"),
  check:dual-build-cjs-loads and check:type-check-debt ("PREREQUISITE NOT MET... ⛔
  This is NOT a pass and NOT a finding: nothing was measured"). Structural — they need a
  built workspace or a real test-run log, which CI has and a local sweep does not.
• 2 were red, both on this card's own consequences, both repaired above:
  scripts/pm/bare-root-worklist.mjs --self-test (FRESH row) and
  check:pm-dispatch-gates (3 of 1232 cases). Both green on the final commit.

Exit codes were captured before any pipe (cmd > log 2>&1; rc=$?), never through one, and
every verdict quoted here is the gate's own printed line rather than a bare $?.

---

Generated by Claude Code