Declare the scripts/ population two Silent gate families walk but never named#14692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
baozhoutao merged 2 commits into from
Sep 2, 2026
+212 −1
Merged

Declare the scripts/ population two Silent gate families walk but never named #14692

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a5d988e
Declare the scripts/ population two gates walk but never named
claude Sep 2, 2026
be6800e
Merge remote-tracking branch 'origin/main' into claude/issue-14325-si…
claude Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
107 changes: 106 additions & 1 deletion scripts/check-self-test-wired.mjs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -116,6 +116,41 @@ const RATCHET_AUTHORITY_MARKER = '⛔ MAINTAINER-ONLY';
/** Extensions whose files can be a `scripts/` entry point. */
const SCRIPT_EXT = /\.(mjs|mts|js|sh)$/;

/**
* POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
* gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
* nothing in this file reads this array.
*
* That tool builds every dispatch's gate list by scanning a gate's own source
* for the path literals it operates on, and "looks like a path" there means
* "carries a separator". This gate's corpus root arrives as
* `join(ROOT, 'scripts')` -- a bare single-segment word -- so the only literals
* the extractor could recover from this file were the workflow directory and
* the handful of individual scripts the ledger below cites BY NAME. That is an
* artifact roster, not a population: a list of the files that already exist can
* never contain the one added tomorrow. The measured result was a family that
* walks all of `scripts/` and appeared on no card that edited any of it.
*
* ⛔ NOT the bare subtree. One hint per admitted extension, following
* `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
* name this gate for the JSON, Markdown and text files under the root that
* `walkScripts` never opens. The declared set is SET-EQUAL to that walk --
* nothing walked left uncovered, nothing covered left unwalked -- which is what
* `--self-test` pins, in both directions and against the live tree.
*
* An extension `SCRIPT_EXT` admits but the tree does not yet HOLD is
* deliberately absent: a hint reaching nothing tracked is a dead lead, which
* the consumer reports as a population and is not one. The pin below reddens
* the day such a file lands, which is the coupling that keeps this honest.
*
* Spelled as a LITERAL array, never computed from `SCRIPT_EXT`: the extractor
* reads SOURCE TEXT, so a built spelling keeps this value identical at runtime,
* keeps every assertion about it green, and contributes ZERO hints.
* `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
* below holds the own-source half.
*/
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.mts', 'scripts/**/*.sh'];

/**
* A `scripts/...` path, optionally followed by `--self-test`.
*
Expand DownExpand Up@@ -463,14 +498,15 @@ const SELF_TEST_BATTERIES = Object.freeze({
'right boundary': 4,
'alias resolution': 4,
'population verdict': 4,
'population declaration': 7,
'ledger hygiene': 9,
'live ledger': 4,
});

// DELETING an entry silences that battery's floor exactly as effectively as
// zeroing it, so the registry's own size is pinned too. Adding a battery raises
// this number; removing one is the same ⛔ deliberate edit as lowering a count.
const SELF_TEST_BATTERY_FLOOR = 6;
const SELF_TEST_BATTERY_FLOOR = 7;

// The key an assertion is filed under when no battery is open. It is not a
// declared battery, so it reds by the same set difference rather than silently
Expand DownExpand Up@@ -597,6 +633,75 @@ function selfTest() {
);
}

// ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
//
// Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
// read by another tool entirely (`extractWatchHints` in
// `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
// forever and pays itself out as a dev dispatched on a `scripts/` card with
// this gate absent from the brief -- the exact round this declaration was
// added to end. So the pins below hold it against the LIVE WALK rather than
// against a fixture: a sandbox tree would keep them green while the real
// declaration drifted.
battery('population declaration');
{
const walked = walkScripts(join(ROOT, 'scripts'));
const extOf = (path) => path.slice(path.lastIndexOf('.'));
// Written INDEPENDENTLY of `hintCovers` on purpose: a pin that reuses the
// consumer's own matcher cannot catch the consumer changing under it.
const declares = (path) =>
path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

ok(
walked.length > 0,
'the population pin walked NO files — a broken walk proves nothing about the declaration (#4690)',
);
ok(
walked.every(declares),
'a file this gate WALKS is left undeclared — the declaration under-names the population it exists '
+ 'to publish, which is the silence it was added to end',
);
ok(
ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
'a declared hint reaches nothing this gate walks — a dead lead, which the consumer reports as a '
+ 'population and is not one',
);
ok(
ROOT_DIR_WATCH_HINTS.every((hint) => SCRIPT_EXT.test(hint)),
'a declared hint names an extension SCRIPT_EXT does not admit — the declaration over-names the walk, '
+ 'and a declaration that can drift from the walk is worse than none',
);
ok(
!ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
'the bare subtree or the repo root was declared — it would name this gate for every JSON, Markdown '
+ 'and text file under the root that this gate never opens',
);
ok(
ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
'a declared literal carries no separator, so the consumer refuses it as too generic and it reaches nothing',
);
// The literal SPELLING is the whole mechanism: a value built from
// SCRIPT_EXT would keep the runtime value identical, keep every assertion
// above green, and contribute ZERO hints. `check-watch-hint-literal` owns
// that rule fleet-wide; this is the own-source half.
let ownSource = null;
try {
ownSource = readFileSync(join(ROOT, 'scripts/check-self-test-wired.mjs'), 'utf8');
} catch {
ownSource = null;
}
const declSites = ownSource === null
? []
: [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
ok(
declSites.length === 1
&& ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
&& !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
'the declaration is not a single literal array of quoted strings — the extractor reads SOURCE TEXT, '
+ 'so a computed spelling contributes nothing while every assertion above stays green',
);
}

// ── Ledger hygiene: every row must still be true, and still be needed ────
battery('ledger hygiene');
{
Expand Down
106 changes: 106 additions & 0 deletions scripts/check-whole-set-label-write.mjs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -156,6 +156,42 @@ export const SCANNED_EXTENSIONS = new Set(['.yml', '.yaml', '.mjs', '.js', '.cjs

const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage']);

/**
* POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
* gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
* nothing in this file reads this array.
*
* That tool builds every dispatch's gate list by scanning a gate's own source
* for the path literals it operates on, and "looks like a path" there means
* "carries a separator". Two of the three `ROOTS` carry one and are recovered
* for free; the third is the bare single-segment word `scripts`, which the
* extractor cannot see AT ALL. So the only other literals this file offered it
* were two `owner/repo` action slugs and the sandbox filenames the fixtures
* build -- an artifact roster, not a population. The measured result was a gate
* that walks all of `scripts/` and appeared on no card that edited any of it,
* while its two `.github` roots were named correctly the whole time.
*
* ⛔ NOT the bare subtree. One hint per admitted extension, following
* `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
* name this gate for the JSON, Markdown and text files under the root that
* `walk` skips on `SCANNED_EXTENSIONS`. The declared set is SET-EQUAL to what
* that walk admits under this root -- nothing walked left uncovered, nothing
* covered left unwalked -- which is what `--self-test` pins, in both directions
* and against the live tree.
*
* An extension `SCANNED_EXTENSIONS` admits but the tree does not yet HOLD under
* this root is deliberately absent: a hint reaching nothing tracked is a dead
* lead, which the consumer reports as a population and is not one. The pin
* below reddens the day such a file lands.
*
* Spelled as a LITERAL array, never computed from `SCANNED_EXTENSIONS`: the
* extractor reads SOURCE TEXT, so a built spelling keeps this value identical
* at runtime, keeps every assertion about it green, and contributes ZERO hints.
* `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
* below holds the own-source half.
*/
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.ts', 'scripts/**/*.sh'];

/**
* How far apart the method slot and the `/labels` path may sit and still be
* read as one call. A backslash-continued `curl` puts them 1-3 lines apart; a
Expand DownExpand Up@@ -898,6 +934,76 @@ export function selfTest() {
failures.push(`WHOLE_SET_ACTIONS['${action}'] has no source-read reason`);
}

// ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
//
// Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
// read by another tool entirely (`extractWatchHints` in
// `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
// forever and pays itself out as a dev dispatched on a `scripts/` card with
// this gate absent from the brief. Held against the LIVE WALK rather than a
// fixture tree: the fixtures below build sandboxes, and a pin over one of
// those would stay green while the real declaration drifted.
{
const walked = [];
walk(REPO_ROOT, 'scripts', walked);
const extOf = (path) => path.slice(path.lastIndexOf('.'));
// Written INDEPENDENTLY of the consumer's `hintCovers`, deliberately: a pin
// that reuses the consumer's own matcher cannot catch it changing underneath.
const declares = (path) =>
path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

expect('POPULATION the declaration pin walked files at all (#4690)', walked.length > 0, true);
expect(
'POPULATION every file this gate walks under scripts/ is declared',
walked.every(declares),
true,
);
expect(
'POPULATION every declared hint reaches a file this gate walks (no dead lead)',
ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
true,
);
expect(
'POPULATION every declared hint names an extension SCANNED_EXTENSIONS admits',
ROOT_DIR_WATCH_HINTS.every((hint) => SCANNED_EXTENSIONS.has(extOf(hint))),
true,
);
expect(
'POPULATION the bare subtree and the repo root are NOT declared',
ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
false,
);
expect(
'POPULATION every declared literal carries a separator (a bare word reaches nothing)',
ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
true,
);
expect(
'POPULATION the scripts root is the one ROOTS entry the extractor cannot see, and it is the one declared',
ROOTS.filter((root) => !root.includes('/')).join(),
'scripts',
);
// The literal SPELLING is the whole mechanism: a value built from
// SCANNED_EXTENSIONS would keep every assertion above green and contribute
// ZERO hints. `check-watch-hint-literal` owns that rule fleet-wide.
let ownSource = null;
try {
ownSource = readFileSync(join(REPO_ROOT, 'scripts/check-whole-set-label-write.mjs'), 'utf8');
} catch {
ownSource = null;
}
const declSites = ownSource === null
? []
: [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
expect(
'POPULATION declared exactly once, as an array of quoted literals the text scan can read',
declSites.length === 1
&& ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
&& !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
true,
);
}

// The checked-in allowlist itself passes the reason rule.
for (const [index, entry] of ALLOWLIST.entries()) {
if (typeof entry.reason === 'string' && entry.reason.trim().length >= MIN_REASON_LENGTH) continue;
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Declare the scripts/ population two Silent gate families walk but never named#14692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

baozhoutao
merged 2 commits into

from

Sep 2, 2026

+212

−1

 Merged


Declare the scripts/ population two Silent gate families walk but never named
#14692
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a5d988e

Declare the scripts/ population two gates walk but never named


claude Sep 2, 2026
be6800e

Merge remote-tracking branch 'origin/main' into claude/issue-14325-si…


claude Sep 2, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


107 changes: 106 additions & 1 deletion
scripts/check-self-test-wired.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -116,6 +116,41 @@ const RATCHET_AUTHORITY_MARKER = '⛔ MAINTAINER-ONLY';
/** Extensions whose files can be a `scripts/` entry point. */
const SCRIPT_EXT = /\.(mjs|mts|js|sh)$/;

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". This gate's corpus root arrives as
 * `join(ROOT, 'scripts')` -- a bare single-segment word -- so the only literals
 * the extractor could recover from this file were the workflow directory and
 * the handful of individual scripts the ledger below cites BY NAME. That is an
 * artifact roster, not a population: a list of the files that already exist can
 * never contain the one added tomorrow. The measured result was a family that
 * walks all of `scripts/` and appeared on no card that edited any of it.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walkScripts` never opens. The declared set is SET-EQUAL to that walk --
 * nothing walked left uncovered, nothing covered left unwalked -- which is what
 * `--self-test` pins, in both directions and against the live tree.
 *
 * An extension `SCRIPT_EXT` admits but the tree does not yet HOLD is
 * deliberately absent: a hint reaching nothing tracked is a dead lead, which
 * the consumer reports as a population and is not one. The pin below reddens
 * the day such a file lands, which is the coupling that keeps this honest.
 *
 * Spelled as a LITERAL array, never computed from `SCRIPT_EXT`: the extractor
 * reads SOURCE TEXT, so a built spelling keeps this value identical at runtime,
 * keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.mts', 'scripts/**/*.sh'];

/**
 * A `scripts/...` path, optionally followed by `--self-test`.
 *
Expand DownExpand Up@@ -463,14 +498,15 @@ const SELF_TEST_BATTERIES = Object.freeze({
 'right boundary': 4,
 'alias resolution': 4,
 'population verdict': 4,
 'population declaration': 7,
 'ledger hygiene': 9,
 'live ledger': 4,
});

// DELETING an entry silences that battery's floor exactly as effectively as
// zeroing it, so the registry's own size is pinned too. Adding a battery raises
// this number; removing one is the same ⛔ deliberate edit as lowering a count.
const SELF_TEST_BATTERY_FLOOR = 6;
const SELF_TEST_BATTERY_FLOOR = 7;

// The key an assertion is filed under when no battery is open. It is not a
// declared battery, so it reds by the same set difference rather than silently
Expand DownExpand Up@@ -597,6 +633,75 @@ function selfTest() {
 );
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief -- the exact round this declaration was
 // added to end. So the pins below hold it against the LIVE WALK rather than
 // against a fixture: a sandbox tree would keep them green while the real
 // declaration drifted.
 battery('population declaration');
 {
 const walked = walkScripts(join(ROOT, 'scripts'));
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of `hintCovers` on purpose: a pin that reuses the
 // consumer's own matcher cannot catch the consumer changing under it.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 ok(
 walked.length > 0,
 'the population pin walked NO files — a broken walk proves nothing about the declaration (#4690)',
 );
 ok(
 walked.every(declares),
 'a file this gate WALKS is left undeclared — the declaration under-names the population it exists '
 + 'to publish, which is the silence it was added to end',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 'a declared hint reaches nothing this gate walks — a dead lead, which the consumer reports as a '
 + 'population and is not one',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => SCRIPT_EXT.test(hint)),
 'a declared hint names an extension SCRIPT_EXT does not admit — the declaration over-names the walk, '
 + 'and a declaration that can drift from the walk is worse than none',
 );
 ok(
 !ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 'the bare subtree or the repo root was declared — it would name this gate for every JSON, Markdown '
 + 'and text file under the root that this gate never opens',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 'a declared literal carries no separator, so the consumer refuses it as too generic and it reaches nothing',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCRIPT_EXT would keep the runtime value identical, keep every assertion
 // above green, and contribute ZERO hints. `check-watch-hint-literal` owns
 // that rule fleet-wide; this is the own-source half.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(ROOT, 'scripts/check-self-test-wired.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 ok(
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 'the declaration is not a single literal array of quoted strings — the extractor reads SOURCE TEXT, '
 + 'so a computed spelling contributes nothing while every assertion above stays green',
 );
 }

 // ── Ledger hygiene: every row must still be true, and still be needed ────
 battery('ledger hygiene');
 {
Expand Down

106 changes: 106 additions & 0 deletions
scripts/check-whole-set-label-write.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -156,6 +156,42 @@ export const SCANNED_EXTENSIONS = new Set(['.yml', '.yaml', '.mjs', '.js', '.cjs

const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage']);

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". Two of the three `ROOTS` carry one and are recovered
 * for free; the third is the bare single-segment word `scripts`, which the
 * extractor cannot see AT ALL. So the only other literals this file offered it
 * were two `owner/repo` action slugs and the sandbox filenames the fixtures
 * build -- an artifact roster, not a population. The measured result was a gate
 * that walks all of `scripts/` and appeared on no card that edited any of it,
 * while its two `.github` roots were named correctly the whole time.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walk` skips on `SCANNED_EXTENSIONS`. The declared set is SET-EQUAL to what
 * that walk admits under this root -- nothing walked left uncovered, nothing
 * covered left unwalked -- which is what `--self-test` pins, in both directions
 * and against the live tree.
 *
 * An extension `SCANNED_EXTENSIONS` admits but the tree does not yet HOLD under
 * this root is deliberately absent: a hint reaching nothing tracked is a dead
 * lead, which the consumer reports as a population and is not one. The pin
 * below reddens the day such a file lands.
 *
 * Spelled as a LITERAL array, never computed from `SCANNED_EXTENSIONS`: the
 * extractor reads SOURCE TEXT, so a built spelling keeps this value identical
 * at runtime, keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.ts', 'scripts/**/*.sh'];

/**
 * How far apart the method slot and the `/labels` path may sit and still be
 * read as one call. A backslash-continued `curl` puts them 1-3 lines apart; a
Expand DownExpand Up@@ -898,6 +934,76 @@ export function selfTest() {
 failures.push(`WHOLE_SET_ACTIONS['${action}'] has no source-read reason`);
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief. Held against the LIVE WALK rather than a
 // fixture tree: the fixtures below build sandboxes, and a pin over one of
 // those would stay green while the real declaration drifted.
 {
 const walked = [];
 walk(REPO_ROOT, 'scripts', walked);
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of the consumer's `hintCovers`, deliberately: a pin
 // that reuses the consumer's own matcher cannot catch it changing underneath.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 expect('POPULATION the declaration pin walked files at all (#4690)', walked.length > 0, true);
 expect(
 'POPULATION every file this gate walks under scripts/ is declared',
 walked.every(declares),
 true,
 );
 expect(
 'POPULATION every declared hint reaches a file this gate walks (no dead lead)',
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 true,
 );
 expect(
 'POPULATION every declared hint names an extension SCANNED_EXTENSIONS admits',
 ROOT_DIR_WATCH_HINTS.every((hint) => SCANNED_EXTENSIONS.has(extOf(hint))),
 true,
 );
 expect(
 'POPULATION the bare subtree and the repo root are NOT declared',
 ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 false,
 );
 expect(
 'POPULATION every declared literal carries a separator (a bare word reaches nothing)',
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 true,
 );
 expect(
 'POPULATION the scripts root is the one ROOTS entry the extractor cannot see, and it is the one declared',
 ROOTS.filter((root) => !root.includes('/')).join(),
 'scripts',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCANNED_EXTENSIONS would keep every assertion above green and contribute
 // ZERO hints. `check-watch-hint-literal` owns that rule fleet-wide.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(REPO_ROOT, 'scripts/check-whole-set-label-write.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 expect(
 'POPULATION declared exactly once, as an array of quoted literals the text scan can read',
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 true,
 );
 }

 // The checked-in allowlist itself passes the reason rule.
 for (const [index, entry] of ALLOWLIST.entries()) {
 if (typeof entry.reason === 'string' && entry.reason.trim().length >= MIN_REASON_LENGTH) continue;
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Declare the scripts/ population two Silent gate families walk but never named#14692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

baozhoutao
merged 2 commits into

from

Sep 2, 2026

+212

−1

 Merged


Declare the scripts/ population two Silent gate families walk but never named
#14692
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a5d988e

Declare the scripts/ population two gates walk but never named


claude Sep 2, 2026
be6800e

Merge remote-tracking branch 'origin/main' into claude/issue-14325-si…


claude Sep 2, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


107 changes: 106 additions & 1 deletion
scripts/check-self-test-wired.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -116,6 +116,41 @@ const RATCHET_AUTHORITY_MARKER = '⛔ MAINTAINER-ONLY';
/** Extensions whose files can be a `scripts/` entry point. */
const SCRIPT_EXT = /\.(mjs|mts|js|sh)$/;

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". This gate's corpus root arrives as
 * `join(ROOT, 'scripts')` -- a bare single-segment word -- so the only literals
 * the extractor could recover from this file were the workflow directory and
 * the handful of individual scripts the ledger below cites BY NAME. That is an
 * artifact roster, not a population: a list of the files that already exist can
 * never contain the one added tomorrow. The measured result was a family that
 * walks all of `scripts/` and appeared on no card that edited any of it.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walkScripts` never opens. The declared set is SET-EQUAL to that walk --
 * nothing walked left uncovered, nothing covered left unwalked -- which is what
 * `--self-test` pins, in both directions and against the live tree.
 *
 * An extension `SCRIPT_EXT` admits but the tree does not yet HOLD is
 * deliberately absent: a hint reaching nothing tracked is a dead lead, which
 * the consumer reports as a population and is not one. The pin below reddens
 * the day such a file lands, which is the coupling that keeps this honest.
 *
 * Spelled as a LITERAL array, never computed from `SCRIPT_EXT`: the extractor
 * reads SOURCE TEXT, so a built spelling keeps this value identical at runtime,
 * keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.mts', 'scripts/**/*.sh'];

/**
 * A `scripts/...` path, optionally followed by `--self-test`.
 *
Expand DownExpand Up@@ -463,14 +498,15 @@ const SELF_TEST_BATTERIES = Object.freeze({
 'right boundary': 4,
 'alias resolution': 4,
 'population verdict': 4,
 'population declaration': 7,
 'ledger hygiene': 9,
 'live ledger': 4,
});

// DELETING an entry silences that battery's floor exactly as effectively as
// zeroing it, so the registry's own size is pinned too. Adding a battery raises
// this number; removing one is the same ⛔ deliberate edit as lowering a count.
const SELF_TEST_BATTERY_FLOOR = 6;
const SELF_TEST_BATTERY_FLOOR = 7;

// The key an assertion is filed under when no battery is open. It is not a
// declared battery, so it reds by the same set difference rather than silently
Expand DownExpand Up@@ -597,6 +633,75 @@ function selfTest() {
 );
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief -- the exact round this declaration was
 // added to end. So the pins below hold it against the LIVE WALK rather than
 // against a fixture: a sandbox tree would keep them green while the real
 // declaration drifted.
 battery('population declaration');
 {
 const walked = walkScripts(join(ROOT, 'scripts'));
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of `hintCovers` on purpose: a pin that reuses the
 // consumer's own matcher cannot catch the consumer changing under it.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 ok(
 walked.length > 0,
 'the population pin walked NO files — a broken walk proves nothing about the declaration (#4690)',
 );
 ok(
 walked.every(declares),
 'a file this gate WALKS is left undeclared — the declaration under-names the population it exists '
 + 'to publish, which is the silence it was added to end',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 'a declared hint reaches nothing this gate walks — a dead lead, which the consumer reports as a '
 + 'population and is not one',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => SCRIPT_EXT.test(hint)),
 'a declared hint names an extension SCRIPT_EXT does not admit — the declaration over-names the walk, '
 + 'and a declaration that can drift from the walk is worse than none',
 );
 ok(
 !ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 'the bare subtree or the repo root was declared — it would name this gate for every JSON, Markdown '
 + 'and text file under the root that this gate never opens',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 'a declared literal carries no separator, so the consumer refuses it as too generic and it reaches nothing',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCRIPT_EXT would keep the runtime value identical, keep every assertion
 // above green, and contribute ZERO hints. `check-watch-hint-literal` owns
 // that rule fleet-wide; this is the own-source half.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(ROOT, 'scripts/check-self-test-wired.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 ok(
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 'the declaration is not a single literal array of quoted strings — the extractor reads SOURCE TEXT, '
 + 'so a computed spelling contributes nothing while every assertion above stays green',
 );
 }

 // ── Ledger hygiene: every row must still be true, and still be needed ────
 battery('ledger hygiene');
 {
Expand Down

106 changes: 106 additions & 0 deletions
scripts/check-whole-set-label-write.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -156,6 +156,42 @@ export const SCANNED_EXTENSIONS = new Set(['.yml', '.yaml', '.mjs', '.js', '.cjs

const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage']);

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". Two of the three `ROOTS` carry one and are recovered
 * for free; the third is the bare single-segment word `scripts`, which the
 * extractor cannot see AT ALL. So the only other literals this file offered it
 * were two `owner/repo` action slugs and the sandbox filenames the fixtures
 * build -- an artifact roster, not a population. The measured result was a gate
 * that walks all of `scripts/` and appeared on no card that edited any of it,
 * while its two `.github` roots were named correctly the whole time.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walk` skips on `SCANNED_EXTENSIONS`. The declared set is SET-EQUAL to what
 * that walk admits under this root -- nothing walked left uncovered, nothing
 * covered left unwalked -- which is what `--self-test` pins, in both directions
 * and against the live tree.
 *
 * An extension `SCANNED_EXTENSIONS` admits but the tree does not yet HOLD under
 * this root is deliberately absent: a hint reaching nothing tracked is a dead
 * lead, which the consumer reports as a population and is not one. The pin
 * below reddens the day such a file lands.
 *
 * Spelled as a LITERAL array, never computed from `SCANNED_EXTENSIONS`: the
 * extractor reads SOURCE TEXT, so a built spelling keeps this value identical
 * at runtime, keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.ts', 'scripts/**/*.sh'];

/**
 * How far apart the method slot and the `/labels` path may sit and still be
 * read as one call. A backslash-continued `curl` puts them 1-3 lines apart; a
Expand DownExpand Up@@ -898,6 +934,76 @@ export function selfTest() {
 failures.push(`WHOLE_SET_ACTIONS['${action}'] has no source-read reason`);
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief. Held against the LIVE WALK rather than a
 // fixture tree: the fixtures below build sandboxes, and a pin over one of
 // those would stay green while the real declaration drifted.
 {
 const walked = [];
 walk(REPO_ROOT, 'scripts', walked);
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of the consumer's `hintCovers`, deliberately: a pin
 // that reuses the consumer's own matcher cannot catch it changing underneath.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 expect('POPULATION the declaration pin walked files at all (#4690)', walked.length > 0, true);
 expect(
 'POPULATION every file this gate walks under scripts/ is declared',
 walked.every(declares),
 true,
 );
 expect(
 'POPULATION every declared hint reaches a file this gate walks (no dead lead)',
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 true,
 );
 expect(
 'POPULATION every declared hint names an extension SCANNED_EXTENSIONS admits',
 ROOT_DIR_WATCH_HINTS.every((hint) => SCANNED_EXTENSIONS.has(extOf(hint))),
 true,
 );
 expect(
 'POPULATION the bare subtree and the repo root are NOT declared',
 ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 false,
 );
 expect(
 'POPULATION every declared literal carries a separator (a bare word reaches nothing)',
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 true,
 );
 expect(
 'POPULATION the scripts root is the one ROOTS entry the extractor cannot see, and it is the one declared',
 ROOTS.filter((root) => !root.includes('/')).join(),
 'scripts',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCANNED_EXTENSIONS would keep every assertion above green and contribute
 // ZERO hints. `check-watch-hint-literal` owns that rule fleet-wide.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(REPO_ROOT, 'scripts/check-whole-set-label-write.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 expect(
 'POPULATION declared exactly once, as an array of quoted literals the text scan can read',
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 true,
 );
 }

 // The checked-in allowlist itself passes the reason rule.
 for (const [index, entry] of ALLOWLIST.entries()) {
 if (typeof entry.reason === 'string' && entry.reason.trim().length >= MIN_REASON_LENGTH) continue;
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Declare the scripts/ population two Silent gate families walk but never named#14692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

baozhoutao
merged 2 commits into

from

Sep 2, 2026

+212

−1

 Merged


Declare the scripts/ population two Silent gate families walk but never named
#14692
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a5d988e

Declare the scripts/ population two gates walk but never named


claude Sep 2, 2026
be6800e

Merge remote-tracking branch 'origin/main' into claude/issue-14325-si…


claude Sep 2, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


107 changes: 106 additions & 1 deletion
scripts/check-self-test-wired.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -116,6 +116,41 @@ const RATCHET_AUTHORITY_MARKER = '⛔ MAINTAINER-ONLY';
/** Extensions whose files can be a `scripts/` entry point. */
const SCRIPT_EXT = /\.(mjs|mts|js|sh)$/;

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". This gate's corpus root arrives as
 * `join(ROOT, 'scripts')` -- a bare single-segment word -- so the only literals
 * the extractor could recover from this file were the workflow directory and
 * the handful of individual scripts the ledger below cites BY NAME. That is an
 * artifact roster, not a population: a list of the files that already exist can
 * never contain the one added tomorrow. The measured result was a family that
 * walks all of `scripts/` and appeared on no card that edited any of it.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walkScripts` never opens. The declared set is SET-EQUAL to that walk --
 * nothing walked left uncovered, nothing covered left unwalked -- which is what
 * `--self-test` pins, in both directions and against the live tree.
 *
 * An extension `SCRIPT_EXT` admits but the tree does not yet HOLD is
 * deliberately absent: a hint reaching nothing tracked is a dead lead, which
 * the consumer reports as a population and is not one. The pin below reddens
 * the day such a file lands, which is the coupling that keeps this honest.
 *
 * Spelled as a LITERAL array, never computed from `SCRIPT_EXT`: the extractor
 * reads SOURCE TEXT, so a built spelling keeps this value identical at runtime,
 * keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.mts', 'scripts/**/*.sh'];

/**
 * A `scripts/...` path, optionally followed by `--self-test`.
 *
Expand DownExpand Up@@ -463,14 +498,15 @@ const SELF_TEST_BATTERIES = Object.freeze({
 'right boundary': 4,
 'alias resolution': 4,
 'population verdict': 4,
 'population declaration': 7,
 'ledger hygiene': 9,
 'live ledger': 4,
});

// DELETING an entry silences that battery's floor exactly as effectively as
// zeroing it, so the registry's own size is pinned too. Adding a battery raises
// this number; removing one is the same ⛔ deliberate edit as lowering a count.
const SELF_TEST_BATTERY_FLOOR = 6;
const SELF_TEST_BATTERY_FLOOR = 7;

// The key an assertion is filed under when no battery is open. It is not a
// declared battery, so it reds by the same set difference rather than silently
Expand DownExpand Up@@ -597,6 +633,75 @@ function selfTest() {
 );
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief -- the exact round this declaration was
 // added to end. So the pins below hold it against the LIVE WALK rather than
 // against a fixture: a sandbox tree would keep them green while the real
 // declaration drifted.
 battery('population declaration');
 {
 const walked = walkScripts(join(ROOT, 'scripts'));
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of `hintCovers` on purpose: a pin that reuses the
 // consumer's own matcher cannot catch the consumer changing under it.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 ok(
 walked.length > 0,
 'the population pin walked NO files — a broken walk proves nothing about the declaration (#4690)',
 );
 ok(
 walked.every(declares),
 'a file this gate WALKS is left undeclared — the declaration under-names the population it exists '
 + 'to publish, which is the silence it was added to end',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 'a declared hint reaches nothing this gate walks — a dead lead, which the consumer reports as a '
 + 'population and is not one',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => SCRIPT_EXT.test(hint)),
 'a declared hint names an extension SCRIPT_EXT does not admit — the declaration over-names the walk, '
 + 'and a declaration that can drift from the walk is worse than none',
 );
 ok(
 !ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 'the bare subtree or the repo root was declared — it would name this gate for every JSON, Markdown '
 + 'and text file under the root that this gate never opens',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 'a declared literal carries no separator, so the consumer refuses it as too generic and it reaches nothing',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCRIPT_EXT would keep the runtime value identical, keep every assertion
 // above green, and contribute ZERO hints. `check-watch-hint-literal` owns
 // that rule fleet-wide; this is the own-source half.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(ROOT, 'scripts/check-self-test-wired.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 ok(
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 'the declaration is not a single literal array of quoted strings — the extractor reads SOURCE TEXT, '
 + 'so a computed spelling contributes nothing while every assertion above stays green',
 );
 }

 // ── Ledger hygiene: every row must still be true, and still be needed ────
 battery('ledger hygiene');
 {
Expand Down

106 changes: 106 additions & 0 deletions
scripts/check-whole-set-label-write.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -156,6 +156,42 @@ export const SCANNED_EXTENSIONS = new Set(['.yml', '.yaml', '.mjs', '.js', '.cjs

const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage']);

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". Two of the three `ROOTS` carry one and are recovered
 * for free; the third is the bare single-segment word `scripts`, which the
 * extractor cannot see AT ALL. So the only other literals this file offered it
 * were two `owner/repo` action slugs and the sandbox filenames the fixtures
 * build -- an artifact roster, not a population. The measured result was a gate
 * that walks all of `scripts/` and appeared on no card that edited any of it,
 * while its two `.github` roots were named correctly the whole time.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walk` skips on `SCANNED_EXTENSIONS`. The declared set is SET-EQUAL to what
 * that walk admits under this root -- nothing walked left uncovered, nothing
 * covered left unwalked -- which is what `--self-test` pins, in both directions
 * and against the live tree.
 *
 * An extension `SCANNED_EXTENSIONS` admits but the tree does not yet HOLD under
 * this root is deliberately absent: a hint reaching nothing tracked is a dead
 * lead, which the consumer reports as a population and is not one. The pin
 * below reddens the day such a file lands.
 *
 * Spelled as a LITERAL array, never computed from `SCANNED_EXTENSIONS`: the
 * extractor reads SOURCE TEXT, so a built spelling keeps this value identical
 * at runtime, keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.ts', 'scripts/**/*.sh'];

/**
 * How far apart the method slot and the `/labels` path may sit and still be
 * read as one call. A backslash-continued `curl` puts them 1-3 lines apart; a
Expand DownExpand Up@@ -898,6 +934,76 @@ export function selfTest() {
 failures.push(`WHOLE_SET_ACTIONS['${action}'] has no source-read reason`);
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief. Held against the LIVE WALK rather than a
 // fixture tree: the fixtures below build sandboxes, and a pin over one of
 // those would stay green while the real declaration drifted.
 {
 const walked = [];
 walk(REPO_ROOT, 'scripts', walked);
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of the consumer's `hintCovers`, deliberately: a pin
 // that reuses the consumer's own matcher cannot catch it changing underneath.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 expect('POPULATION the declaration pin walked files at all (#4690)', walked.length > 0, true);
 expect(
 'POPULATION every file this gate walks under scripts/ is declared',
 walked.every(declares),
 true,
 );
 expect(
 'POPULATION every declared hint reaches a file this gate walks (no dead lead)',
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 true,
 );
 expect(
 'POPULATION every declared hint names an extension SCANNED_EXTENSIONS admits',
 ROOT_DIR_WATCH_HINTS.every((hint) => SCANNED_EXTENSIONS.has(extOf(hint))),
 true,
 );
 expect(
 'POPULATION the bare subtree and the repo root are NOT declared',
 ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 false,
 );
 expect(
 'POPULATION every declared literal carries a separator (a bare word reaches nothing)',
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 true,
 );
 expect(
 'POPULATION the scripts root is the one ROOTS entry the extractor cannot see, and it is the one declared',
 ROOTS.filter((root) => !root.includes('/')).join(),
 'scripts',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCANNED_EXTENSIONS would keep every assertion above green and contribute
 // ZERO hints. `check-watch-hint-literal` owns that rule fleet-wide.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(REPO_ROOT, 'scripts/check-whole-set-label-write.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 expect(
 'POPULATION declared exactly once, as an array of quoted literals the text scan can read',
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 true,
 );
 }

 // The checked-in allowlist itself passes the reason rule.
 for (const [index, entry] of ALLOWLIST.entries()) {
 if (typeof entry.reason === 'string' && entry.reason.trim().length >= MIN_REASON_LENGTH) continue;
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Declare the scripts/ population two Silent gate families walk but never named#14692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

baozhoutao
merged 2 commits into

from

Sep 2, 2026

+212

−1

 Merged


Declare the scripts/ population two Silent gate families walk but never named
#14692
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a5d988e

Declare the scripts/ population two gates walk but never named


claude Sep 2, 2026
be6800e

Merge remote-tracking branch 'origin/main' into claude/issue-14325-si…


claude Sep 2, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


107 changes: 106 additions & 1 deletion
scripts/check-self-test-wired.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -116,6 +116,41 @@ const RATCHET_AUTHORITY_MARKER = '⛔ MAINTAINER-ONLY';
/** Extensions whose files can be a `scripts/` entry point. */
const SCRIPT_EXT = /\.(mjs|mts|js|sh)$/;

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". This gate's corpus root arrives as
 * `join(ROOT, 'scripts')` -- a bare single-segment word -- so the only literals
 * the extractor could recover from this file were the workflow directory and
 * the handful of individual scripts the ledger below cites BY NAME. That is an
 * artifact roster, not a population: a list of the files that already exist can
 * never contain the one added tomorrow. The measured result was a family that
 * walks all of `scripts/` and appeared on no card that edited any of it.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walkScripts` never opens. The declared set is SET-EQUAL to that walk --
 * nothing walked left uncovered, nothing covered left unwalked -- which is what
 * `--self-test` pins, in both directions and against the live tree.
 *
 * An extension `SCRIPT_EXT` admits but the tree does not yet HOLD is
 * deliberately absent: a hint reaching nothing tracked is a dead lead, which
 * the consumer reports as a population and is not one. The pin below reddens
 * the day such a file lands, which is the coupling that keeps this honest.
 *
 * Spelled as a LITERAL array, never computed from `SCRIPT_EXT`: the extractor
 * reads SOURCE TEXT, so a built spelling keeps this value identical at runtime,
 * keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.mts', 'scripts/**/*.sh'];

/**
 * A `scripts/...` path, optionally followed by `--self-test`.
 *
Expand DownExpand Up@@ -463,14 +498,15 @@ const SELF_TEST_BATTERIES = Object.freeze({
 'right boundary': 4,
 'alias resolution': 4,
 'population verdict': 4,
 'population declaration': 7,
 'ledger hygiene': 9,
 'live ledger': 4,
});

// DELETING an entry silences that battery's floor exactly as effectively as
// zeroing it, so the registry's own size is pinned too. Adding a battery raises
// this number; removing one is the same ⛔ deliberate edit as lowering a count.
const SELF_TEST_BATTERY_FLOOR = 6;
const SELF_TEST_BATTERY_FLOOR = 7;

// The key an assertion is filed under when no battery is open. It is not a
// declared battery, so it reds by the same set difference rather than silently
Expand DownExpand Up@@ -597,6 +633,75 @@ function selfTest() {
 );
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief -- the exact round this declaration was
 // added to end. So the pins below hold it against the LIVE WALK rather than
 // against a fixture: a sandbox tree would keep them green while the real
 // declaration drifted.
 battery('population declaration');
 {
 const walked = walkScripts(join(ROOT, 'scripts'));
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of `hintCovers` on purpose: a pin that reuses the
 // consumer's own matcher cannot catch the consumer changing under it.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 ok(
 walked.length > 0,
 'the population pin walked NO files — a broken walk proves nothing about the declaration (#4690)',
 );
 ok(
 walked.every(declares),
 'a file this gate WALKS is left undeclared — the declaration under-names the population it exists '
 + 'to publish, which is the silence it was added to end',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 'a declared hint reaches nothing this gate walks — a dead lead, which the consumer reports as a '
 + 'population and is not one',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => SCRIPT_EXT.test(hint)),
 'a declared hint names an extension SCRIPT_EXT does not admit — the declaration over-names the walk, '
 + 'and a declaration that can drift from the walk is worse than none',
 );
 ok(
 !ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 'the bare subtree or the repo root was declared — it would name this gate for every JSON, Markdown '
 + 'and text file under the root that this gate never opens',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 'a declared literal carries no separator, so the consumer refuses it as too generic and it reaches nothing',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCRIPT_EXT would keep the runtime value identical, keep every assertion
 // above green, and contribute ZERO hints. `check-watch-hint-literal` owns
 // that rule fleet-wide; this is the own-source half.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(ROOT, 'scripts/check-self-test-wired.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 ok(
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 'the declaration is not a single literal array of quoted strings — the extractor reads SOURCE TEXT, '
 + 'so a computed spelling contributes nothing while every assertion above stays green',
 );
 }

 // ── Ledger hygiene: every row must still be true, and still be needed ────
 battery('ledger hygiene');
 {
Expand Down

106 changes: 106 additions & 0 deletions
scripts/check-whole-set-label-write.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -156,6 +156,42 @@ export const SCANNED_EXTENSIONS = new Set(['.yml', '.yaml', '.mjs', '.js', '.cjs

const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage']);

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". Two of the three `ROOTS` carry one and are recovered
 * for free; the third is the bare single-segment word `scripts`, which the
 * extractor cannot see AT ALL. So the only other literals this file offered it
 * were two `owner/repo` action slugs and the sandbox filenames the fixtures
 * build -- an artifact roster, not a population. The measured result was a gate
 * that walks all of `scripts/` and appeared on no card that edited any of it,
 * while its two `.github` roots were named correctly the whole time.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walk` skips on `SCANNED_EXTENSIONS`. The declared set is SET-EQUAL to what
 * that walk admits under this root -- nothing walked left uncovered, nothing
 * covered left unwalked -- which is what `--self-test` pins, in both directions
 * and against the live tree.
 *
 * An extension `SCANNED_EXTENSIONS` admits but the tree does not yet HOLD under
 * this root is deliberately absent: a hint reaching nothing tracked is a dead
 * lead, which the consumer reports as a population and is not one. The pin
 * below reddens the day such a file lands.
 *
 * Spelled as a LITERAL array, never computed from `SCANNED_EXTENSIONS`: the
 * extractor reads SOURCE TEXT, so a built spelling keeps this value identical
 * at runtime, keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.ts', 'scripts/**/*.sh'];

/**
 * How far apart the method slot and the `/labels` path may sit and still be
 * read as one call. A backslash-continued `curl` puts them 1-3 lines apart; a
Expand DownExpand Up@@ -898,6 +934,76 @@ export function selfTest() {
 failures.push(`WHOLE_SET_ACTIONS['${action}'] has no source-read reason`);
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief. Held against the LIVE WALK rather than a
 // fixture tree: the fixtures below build sandboxes, and a pin over one of
 // those would stay green while the real declaration drifted.
 {
 const walked = [];
 walk(REPO_ROOT, 'scripts', walked);
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of the consumer's `hintCovers`, deliberately: a pin
 // that reuses the consumer's own matcher cannot catch it changing underneath.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 expect('POPULATION the declaration pin walked files at all (#4690)', walked.length > 0, true);
 expect(
 'POPULATION every file this gate walks under scripts/ is declared',
 walked.every(declares),
 true,
 );
 expect(
 'POPULATION every declared hint reaches a file this gate walks (no dead lead)',
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 true,
 );
 expect(
 'POPULATION every declared hint names an extension SCANNED_EXTENSIONS admits',
 ROOT_DIR_WATCH_HINTS.every((hint) => SCANNED_EXTENSIONS.has(extOf(hint))),
 true,
 );
 expect(
 'POPULATION the bare subtree and the repo root are NOT declared',
 ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 false,
 );
 expect(
 'POPULATION every declared literal carries a separator (a bare word reaches nothing)',
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 true,
 );
 expect(
 'POPULATION the scripts root is the one ROOTS entry the extractor cannot see, and it is the one declared',
 ROOTS.filter((root) => !root.includes('/')).join(),
 'scripts',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCANNED_EXTENSIONS would keep every assertion above green and contribute
 // ZERO hints. `check-watch-hint-literal` owns that rule fleet-wide.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(REPO_ROOT, 'scripts/check-whole-set-label-write.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 expect(
 'POPULATION declared exactly once, as an array of quoted literals the text scan can read',
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 true,
 );
 }

 // The checked-in allowlist itself passes the reason rule.
 for (const [index, entry] of ALLOWLIST.entries()) {
 if (typeof entry.reason === 'string' && entry.reason.trim().length >= MIN_REASON_LENGTH) continue;
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Declare the scripts/ population two Silent gate families walk but never named#14692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

baozhoutao
merged 2 commits into

from

Sep 2, 2026

+212

−1

 Merged


Declare the scripts/ population two Silent gate families walk but never named
#14692
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a5d988e

Declare the scripts/ population two gates walk but never named


claude Sep 2, 2026
be6800e

Merge remote-tracking branch 'origin/main' into claude/issue-14325-si…


claude Sep 2, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


107 changes: 106 additions & 1 deletion
scripts/check-self-test-wired.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -116,6 +116,41 @@ const RATCHET_AUTHORITY_MARKER = '⛔ MAINTAINER-ONLY';
/** Extensions whose files can be a `scripts/` entry point. */
const SCRIPT_EXT = /\.(mjs|mts|js|sh)$/;

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". This gate's corpus root arrives as
 * `join(ROOT, 'scripts')` -- a bare single-segment word -- so the only literals
 * the extractor could recover from this file were the workflow directory and
 * the handful of individual scripts the ledger below cites BY NAME. That is an
 * artifact roster, not a population: a list of the files that already exist can
 * never contain the one added tomorrow. The measured result was a family that
 * walks all of `scripts/` and appeared on no card that edited any of it.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walkScripts` never opens. The declared set is SET-EQUAL to that walk --
 * nothing walked left uncovered, nothing covered left unwalked -- which is what
 * `--self-test` pins, in both directions and against the live tree.
 *
 * An extension `SCRIPT_EXT` admits but the tree does not yet HOLD is
 * deliberately absent: a hint reaching nothing tracked is a dead lead, which
 * the consumer reports as a population and is not one. The pin below reddens
 * the day such a file lands, which is the coupling that keeps this honest.
 *
 * Spelled as a LITERAL array, never computed from `SCRIPT_EXT`: the extractor
 * reads SOURCE TEXT, so a built spelling keeps this value identical at runtime,
 * keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.mts', 'scripts/**/*.sh'];

/**
 * A `scripts/...` path, optionally followed by `--self-test`.
 *
Expand DownExpand Up@@ -463,14 +498,15 @@ const SELF_TEST_BATTERIES = Object.freeze({
 'right boundary': 4,
 'alias resolution': 4,
 'population verdict': 4,
 'population declaration': 7,
 'ledger hygiene': 9,
 'live ledger': 4,
});

// DELETING an entry silences that battery's floor exactly as effectively as
// zeroing it, so the registry's own size is pinned too. Adding a battery raises
// this number; removing one is the same ⛔ deliberate edit as lowering a count.
const SELF_TEST_BATTERY_FLOOR = 6;
const SELF_TEST_BATTERY_FLOOR = 7;

// The key an assertion is filed under when no battery is open. It is not a
// declared battery, so it reds by the same set difference rather than silently
Expand DownExpand Up@@ -597,6 +633,75 @@ function selfTest() {
 );
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief -- the exact round this declaration was
 // added to end. So the pins below hold it against the LIVE WALK rather than
 // against a fixture: a sandbox tree would keep them green while the real
 // declaration drifted.
 battery('population declaration');
 {
 const walked = walkScripts(join(ROOT, 'scripts'));
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of `hintCovers` on purpose: a pin that reuses the
 // consumer's own matcher cannot catch the consumer changing under it.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 ok(
 walked.length > 0,
 'the population pin walked NO files — a broken walk proves nothing about the declaration (#4690)',
 );
 ok(
 walked.every(declares),
 'a file this gate WALKS is left undeclared — the declaration under-names the population it exists '
 + 'to publish, which is the silence it was added to end',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 'a declared hint reaches nothing this gate walks — a dead lead, which the consumer reports as a '
 + 'population and is not one',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => SCRIPT_EXT.test(hint)),
 'a declared hint names an extension SCRIPT_EXT does not admit — the declaration over-names the walk, '
 + 'and a declaration that can drift from the walk is worse than none',
 );
 ok(
 !ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 'the bare subtree or the repo root was declared — it would name this gate for every JSON, Markdown '
 + 'and text file under the root that this gate never opens',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 'a declared literal carries no separator, so the consumer refuses it as too generic and it reaches nothing',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCRIPT_EXT would keep the runtime value identical, keep every assertion
 // above green, and contribute ZERO hints. `check-watch-hint-literal` owns
 // that rule fleet-wide; this is the own-source half.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(ROOT, 'scripts/check-self-test-wired.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 ok(
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 'the declaration is not a single literal array of quoted strings — the extractor reads SOURCE TEXT, '
 + 'so a computed spelling contributes nothing while every assertion above stays green',
 );
 }

 // ── Ledger hygiene: every row must still be true, and still be needed ────
 battery('ledger hygiene');
 {
Expand Down

106 changes: 106 additions & 0 deletions
scripts/check-whole-set-label-write.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -156,6 +156,42 @@ export const SCANNED_EXTENSIONS = new Set(['.yml', '.yaml', '.mjs', '.js', '.cjs

const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage']);

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". Two of the three `ROOTS` carry one and are recovered
 * for free; the third is the bare single-segment word `scripts`, which the
 * extractor cannot see AT ALL. So the only other literals this file offered it
 * were two `owner/repo` action slugs and the sandbox filenames the fixtures
 * build -- an artifact roster, not a population. The measured result was a gate
 * that walks all of `scripts/` and appeared on no card that edited any of it,
 * while its two `.github` roots were named correctly the whole time.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walk` skips on `SCANNED_EXTENSIONS`. The declared set is SET-EQUAL to what
 * that walk admits under this root -- nothing walked left uncovered, nothing
 * covered left unwalked -- which is what `--self-test` pins, in both directions
 * and against the live tree.
 *
 * An extension `SCANNED_EXTENSIONS` admits but the tree does not yet HOLD under
 * this root is deliberately absent: a hint reaching nothing tracked is a dead
 * lead, which the consumer reports as a population and is not one. The pin
 * below reddens the day such a file lands.
 *
 * Spelled as a LITERAL array, never computed from `SCANNED_EXTENSIONS`: the
 * extractor reads SOURCE TEXT, so a built spelling keeps this value identical
 * at runtime, keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.ts', 'scripts/**/*.sh'];

/**
 * How far apart the method slot and the `/labels` path may sit and still be
 * read as one call. A backslash-continued `curl` puts them 1-3 lines apart; a
Expand DownExpand Up@@ -898,6 +934,76 @@ export function selfTest() {
 failures.push(`WHOLE_SET_ACTIONS['${action}'] has no source-read reason`);
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief. Held against the LIVE WALK rather than a
 // fixture tree: the fixtures below build sandboxes, and a pin over one of
 // those would stay green while the real declaration drifted.
 {
 const walked = [];
 walk(REPO_ROOT, 'scripts', walked);
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of the consumer's `hintCovers`, deliberately: a pin
 // that reuses the consumer's own matcher cannot catch it changing underneath.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 expect('POPULATION the declaration pin walked files at all (#4690)', walked.length > 0, true);
 expect(
 'POPULATION every file this gate walks under scripts/ is declared',
 walked.every(declares),
 true,
 );
 expect(
 'POPULATION every declared hint reaches a file this gate walks (no dead lead)',
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 true,
 );
 expect(
 'POPULATION every declared hint names an extension SCANNED_EXTENSIONS admits',
 ROOT_DIR_WATCH_HINTS.every((hint) => SCANNED_EXTENSIONS.has(extOf(hint))),
 true,
 );
 expect(
 'POPULATION the bare subtree and the repo root are NOT declared',
 ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 false,
 );
 expect(
 'POPULATION every declared literal carries a separator (a bare word reaches nothing)',
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 true,
 );
 expect(
 'POPULATION the scripts root is the one ROOTS entry the extractor cannot see, and it is the one declared',
 ROOTS.filter((root) => !root.includes('/')).join(),
 'scripts',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCANNED_EXTENSIONS would keep every assertion above green and contribute
 // ZERO hints. `check-watch-hint-literal` owns that rule fleet-wide.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(REPO_ROOT, 'scripts/check-whole-set-label-write.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 expect(
 'POPULATION declared exactly once, as an array of quoted literals the text scan can read',
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 true,
 );
 }

 // The checked-in allowlist itself passes the reason rule.
 for (const [index, entry] of ALLOWLIST.entries()) {
 if (typeof entry.reason === 'string' && entry.reason.trim().length >= MIN_REASON_LENGTH) continue;
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Declare the scripts/ population two Silent gate families walk but never named#14692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

baozhoutao
merged 2 commits into

from

Sep 2, 2026

+212

−1

 Merged


Declare the scripts/ population two Silent gate families walk but never named
#14692
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a5d988e

Declare the scripts/ population two gates walk but never named


claude Sep 2, 2026
be6800e

Merge remote-tracking branch 'origin/main' into claude/issue-14325-si…


claude Sep 2, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


107 changes: 106 additions & 1 deletion
scripts/check-self-test-wired.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -116,6 +116,41 @@ const RATCHET_AUTHORITY_MARKER = '⛔ MAINTAINER-ONLY';
/** Extensions whose files can be a `scripts/` entry point. */
const SCRIPT_EXT = /\.(mjs|mts|js|sh)$/;

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". This gate's corpus root arrives as
 * `join(ROOT, 'scripts')` -- a bare single-segment word -- so the only literals
 * the extractor could recover from this file were the workflow directory and
 * the handful of individual scripts the ledger below cites BY NAME. That is an
 * artifact roster, not a population: a list of the files that already exist can
 * never contain the one added tomorrow. The measured result was a family that
 * walks all of `scripts/` and appeared on no card that edited any of it.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walkScripts` never opens. The declared set is SET-EQUAL to that walk --
 * nothing walked left uncovered, nothing covered left unwalked -- which is what
 * `--self-test` pins, in both directions and against the live tree.
 *
 * An extension `SCRIPT_EXT` admits but the tree does not yet HOLD is
 * deliberately absent: a hint reaching nothing tracked is a dead lead, which
 * the consumer reports as a population and is not one. The pin below reddens
 * the day such a file lands, which is the coupling that keeps this honest.
 *
 * Spelled as a LITERAL array, never computed from `SCRIPT_EXT`: the extractor
 * reads SOURCE TEXT, so a built spelling keeps this value identical at runtime,
 * keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.mts', 'scripts/**/*.sh'];

/**
 * A `scripts/...` path, optionally followed by `--self-test`.
 *
Expand DownExpand Up@@ -463,14 +498,15 @@ const SELF_TEST_BATTERIES = Object.freeze({
 'right boundary': 4,
 'alias resolution': 4,
 'population verdict': 4,
 'population declaration': 7,
 'ledger hygiene': 9,
 'live ledger': 4,
});

// DELETING an entry silences that battery's floor exactly as effectively as
// zeroing it, so the registry's own size is pinned too. Adding a battery raises
// this number; removing one is the same ⛔ deliberate edit as lowering a count.
const SELF_TEST_BATTERY_FLOOR = 6;
const SELF_TEST_BATTERY_FLOOR = 7;

// The key an assertion is filed under when no battery is open. It is not a
// declared battery, so it reds by the same set difference rather than silently
Expand DownExpand Up@@ -597,6 +633,75 @@ function selfTest() {
 );
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief -- the exact round this declaration was
 // added to end. So the pins below hold it against the LIVE WALK rather than
 // against a fixture: a sandbox tree would keep them green while the real
 // declaration drifted.
 battery('population declaration');
 {
 const walked = walkScripts(join(ROOT, 'scripts'));
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of `hintCovers` on purpose: a pin that reuses the
 // consumer's own matcher cannot catch the consumer changing under it.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 ok(
 walked.length > 0,
 'the population pin walked NO files — a broken walk proves nothing about the declaration (#4690)',
 );
 ok(
 walked.every(declares),
 'a file this gate WALKS is left undeclared — the declaration under-names the population it exists '
 + 'to publish, which is the silence it was added to end',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 'a declared hint reaches nothing this gate walks — a dead lead, which the consumer reports as a '
 + 'population and is not one',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => SCRIPT_EXT.test(hint)),
 'a declared hint names an extension SCRIPT_EXT does not admit — the declaration over-names the walk, '
 + 'and a declaration that can drift from the walk is worse than none',
 );
 ok(
 !ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 'the bare subtree or the repo root was declared — it would name this gate for every JSON, Markdown '
 + 'and text file under the root that this gate never opens',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 'a declared literal carries no separator, so the consumer refuses it as too generic and it reaches nothing',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCRIPT_EXT would keep the runtime value identical, keep every assertion
 // above green, and contribute ZERO hints. `check-watch-hint-literal` owns
 // that rule fleet-wide; this is the own-source half.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(ROOT, 'scripts/check-self-test-wired.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 ok(
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 'the declaration is not a single literal array of quoted strings — the extractor reads SOURCE TEXT, '
 + 'so a computed spelling contributes nothing while every assertion above stays green',
 );
 }

 // ── Ledger hygiene: every row must still be true, and still be needed ────
 battery('ledger hygiene');
 {
Expand Down

106 changes: 106 additions & 0 deletions
scripts/check-whole-set-label-write.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -156,6 +156,42 @@ export const SCANNED_EXTENSIONS = new Set(['.yml', '.yaml', '.mjs', '.js', '.cjs

const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage']);

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". Two of the three `ROOTS` carry one and are recovered
 * for free; the third is the bare single-segment word `scripts`, which the
 * extractor cannot see AT ALL. So the only other literals this file offered it
 * were two `owner/repo` action slugs and the sandbox filenames the fixtures
 * build -- an artifact roster, not a population. The measured result was a gate
 * that walks all of `scripts/` and appeared on no card that edited any of it,
 * while its two `.github` roots were named correctly the whole time.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walk` skips on `SCANNED_EXTENSIONS`. The declared set is SET-EQUAL to what
 * that walk admits under this root -- nothing walked left uncovered, nothing
 * covered left unwalked -- which is what `--self-test` pins, in both directions
 * and against the live tree.
 *
 * An extension `SCANNED_EXTENSIONS` admits but the tree does not yet HOLD under
 * this root is deliberately absent: a hint reaching nothing tracked is a dead
 * lead, which the consumer reports as a population and is not one. The pin
 * below reddens the day such a file lands.
 *
 * Spelled as a LITERAL array, never computed from `SCANNED_EXTENSIONS`: the
 * extractor reads SOURCE TEXT, so a built spelling keeps this value identical
 * at runtime, keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.ts', 'scripts/**/*.sh'];

/**
 * How far apart the method slot and the `/labels` path may sit and still be
 * read as one call. A backslash-continued `curl` puts them 1-3 lines apart; a
Expand DownExpand Up@@ -898,6 +934,76 @@ export function selfTest() {
 failures.push(`WHOLE_SET_ACTIONS['${action}'] has no source-read reason`);
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief. Held against the LIVE WALK rather than a
 // fixture tree: the fixtures below build sandboxes, and a pin over one of
 // those would stay green while the real declaration drifted.
 {
 const walked = [];
 walk(REPO_ROOT, 'scripts', walked);
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of the consumer's `hintCovers`, deliberately: a pin
 // that reuses the consumer's own matcher cannot catch it changing underneath.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 expect('POPULATION the declaration pin walked files at all (#4690)', walked.length > 0, true);
 expect(
 'POPULATION every file this gate walks under scripts/ is declared',
 walked.every(declares),
 true,
 );
 expect(
 'POPULATION every declared hint reaches a file this gate walks (no dead lead)',
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 true,
 );
 expect(
 'POPULATION every declared hint names an extension SCANNED_EXTENSIONS admits',
 ROOT_DIR_WATCH_HINTS.every((hint) => SCANNED_EXTENSIONS.has(extOf(hint))),
 true,
 );
 expect(
 'POPULATION the bare subtree and the repo root are NOT declared',
 ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 false,
 );
 expect(
 'POPULATION every declared literal carries a separator (a bare word reaches nothing)',
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 true,
 );
 expect(
 'POPULATION the scripts root is the one ROOTS entry the extractor cannot see, and it is the one declared',
 ROOTS.filter((root) => !root.includes('/')).join(),
 'scripts',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCANNED_EXTENSIONS would keep every assertion above green and contribute
 // ZERO hints. `check-watch-hint-literal` owns that rule fleet-wide.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(REPO_ROOT, 'scripts/check-whole-set-label-write.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 expect(
 'POPULATION declared exactly once, as an array of quoted literals the text scan can read',
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 true,
 );
 }

 // The checked-in allowlist itself passes the reason rule.
 for (const [index, entry] of ALLOWLIST.entries()) {
 if (typeof entry.reason === 'string' && entry.reason.trim().length >= MIN_REASON_LENGTH) continue;
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Declare the scripts/ population two Silent gate families walk but never named#14692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

baozhoutao
merged 2 commits into

from

Sep 2, 2026

+212

−1

 Merged


Declare the scripts/ population two Silent gate families walk but never named
#14692
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
a5d988e

Declare the scripts/ population two gates walk but never named


claude Sep 2, 2026
be6800e

Merge remote-tracking branch 'origin/main' into claude/issue-14325-si…


claude Sep 2, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


107 changes: 106 additions & 1 deletion
scripts/check-self-test-wired.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -116,6 +116,41 @@ const RATCHET_AUTHORITY_MARKER = '⛔ MAINTAINER-ONLY';
/** Extensions whose files can be a `scripts/` entry point. */
const SCRIPT_EXT = /\.(mjs|mts|js|sh)$/;

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". This gate's corpus root arrives as
 * `join(ROOT, 'scripts')` -- a bare single-segment word -- so the only literals
 * the extractor could recover from this file were the workflow directory and
 * the handful of individual scripts the ledger below cites BY NAME. That is an
 * artifact roster, not a population: a list of the files that already exist can
 * never contain the one added tomorrow. The measured result was a family that
 * walks all of `scripts/` and appeared on no card that edited any of it.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walkScripts` never opens. The declared set is SET-EQUAL to that walk --
 * nothing walked left uncovered, nothing covered left unwalked -- which is what
 * `--self-test` pins, in both directions and against the live tree.
 *
 * An extension `SCRIPT_EXT` admits but the tree does not yet HOLD is
 * deliberately absent: a hint reaching nothing tracked is a dead lead, which
 * the consumer reports as a population and is not one. The pin below reddens
 * the day such a file lands, which is the coupling that keeps this honest.
 *
 * Spelled as a LITERAL array, never computed from `SCRIPT_EXT`: the extractor
 * reads SOURCE TEXT, so a built spelling keeps this value identical at runtime,
 * keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.mts', 'scripts/**/*.sh'];

/**
 * A `scripts/...` path, optionally followed by `--self-test`.
 *
Expand DownExpand Up@@ -463,14 +498,15 @@ const SELF_TEST_BATTERIES = Object.freeze({
 'right boundary': 4,
 'alias resolution': 4,
 'population verdict': 4,
 'population declaration': 7,
 'ledger hygiene': 9,
 'live ledger': 4,
});

// DELETING an entry silences that battery's floor exactly as effectively as
// zeroing it, so the registry's own size is pinned too. Adding a battery raises
// this number; removing one is the same ⛔ deliberate edit as lowering a count.
const SELF_TEST_BATTERY_FLOOR = 6;
const SELF_TEST_BATTERY_FLOOR = 7;

// The key an assertion is filed under when no battery is open. It is not a
// declared battery, so it reds by the same set difference rather than silently
Expand DownExpand Up@@ -597,6 +633,75 @@ function selfTest() {
 );
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief -- the exact round this declaration was
 // added to end. So the pins below hold it against the LIVE WALK rather than
 // against a fixture: a sandbox tree would keep them green while the real
 // declaration drifted.
 battery('population declaration');
 {
 const walked = walkScripts(join(ROOT, 'scripts'));
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of `hintCovers` on purpose: a pin that reuses the
 // consumer's own matcher cannot catch the consumer changing under it.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 ok(
 walked.length > 0,
 'the population pin walked NO files — a broken walk proves nothing about the declaration (#4690)',
 );
 ok(
 walked.every(declares),
 'a file this gate WALKS is left undeclared — the declaration under-names the population it exists '
 + 'to publish, which is the silence it was added to end',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 'a declared hint reaches nothing this gate walks — a dead lead, which the consumer reports as a '
 + 'population and is not one',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => SCRIPT_EXT.test(hint)),
 'a declared hint names an extension SCRIPT_EXT does not admit — the declaration over-names the walk, '
 + 'and a declaration that can drift from the walk is worse than none',
 );
 ok(
 !ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 'the bare subtree or the repo root was declared — it would name this gate for every JSON, Markdown '
 + 'and text file under the root that this gate never opens',
 );
 ok(
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 'a declared literal carries no separator, so the consumer refuses it as too generic and it reaches nothing',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCRIPT_EXT would keep the runtime value identical, keep every assertion
 // above green, and contribute ZERO hints. `check-watch-hint-literal` owns
 // that rule fleet-wide; this is the own-source half.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(ROOT, 'scripts/check-self-test-wired.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 ok(
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 'the declaration is not a single literal array of quoted strings — the extractor reads SOURCE TEXT, '
 + 'so a computed spelling contributes nothing while every assertion above stays green',
 );
 }

 // ── Ledger hygiene: every row must still be true, and still be needed ────
 battery('ledger hygiene');
 {
Expand Down

106 changes: 106 additions & 0 deletions
scripts/check-whole-set-label-write.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -156,6 +156,42 @@ export const SCANNED_EXTENSIONS = new Set(['.yml', '.yaml', '.mjs', '.js', '.cjs

const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage']);

/**
 * POPULATION DECLARATION -- what `scripts/pm/dispatch-gates.mjs` is told this
 * gate reads, in the subtree spelling that tool compares in. Provenance ONLY:
 * nothing in this file reads this array.
 *
 * That tool builds every dispatch's gate list by scanning a gate's own source
 * for the path literals it operates on, and "looks like a path" there means
 * "carries a separator". Two of the three `ROOTS` carry one and are recovered
 * for free; the third is the bare single-segment word `scripts`, which the
 * extractor cannot see AT ALL. So the only other literals this file offered it
 * were two `owner/repo` action slugs and the sandbox filenames the fixtures
 * build -- an artifact roster, not a population. The measured result was a gate
 * that walks all of `scripts/` and appeared on no card that edited any of it,
 * while its two `.github` roots were named correctly the whole time.
 *
 * ⛔ NOT the bare subtree. One hint per admitted extension, following
 * `check-ratchet-remedy-authority.mjs` at this same root: `scripts/**` would
 * name this gate for the JSON, Markdown and text files under the root that
 * `walk` skips on `SCANNED_EXTENSIONS`. The declared set is SET-EQUAL to what
 * that walk admits under this root -- nothing walked left uncovered, nothing
 * covered left unwalked -- which is what `--self-test` pins, in both directions
 * and against the live tree.
 *
 * An extension `SCANNED_EXTENSIONS` admits but the tree does not yet HOLD under
 * this root is deliberately absent: a hint reaching nothing tracked is a dead
 * lead, which the consumer reports as a population and is not one. The pin
 * below reddens the day such a file lands.
 *
 * Spelled as a LITERAL array, never computed from `SCANNED_EXTENSIONS`: the
 * extractor reads SOURCE TEXT, so a built spelling keeps this value identical
 * at runtime, keeps every assertion about it green, and contributes ZERO hints.
 * `check-watch-hint-literal.mjs` holds that rule fleet-wide; the self-test
 * below holds the own-source half.
 */
const ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.ts', 'scripts/**/*.sh'];

/**
 * How far apart the method slot and the `/labels` path may sit and still be
 * read as one call. A backslash-continued `curl` puts them 1-3 lines apart; a
Expand DownExpand Up@@ -898,6 +934,76 @@ export function selfTest() {
 failures.push(`WHOLE_SET_ACTIONS['${action}'] has no source-read reason`);
 }

 // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──
 //
 // Nothing in this file can ENFORCE the declaration: `ROOT_DIR_WATCH_HINTS` is
 // read by another tool entirely (`extractWatchHints` in
 // `scripts/pm/dispatch-gates.mjs`), so a stale or wrong one runs green here
 // forever and pays itself out as a dev dispatched on a `scripts/` card with
 // this gate absent from the brief. Held against the LIVE WALK rather than a
 // fixture tree: the fixtures below build sandboxes, and a pin over one of
 // those would stay green while the real declaration drifted.
 {
 const walked = [];
 walk(REPO_ROOT, 'scripts', walked);
 const extOf = (path) => path.slice(path.lastIndexOf('.'));
 // Written INDEPENDENTLY of the consumer's `hintCovers`, deliberately: a pin
 // that reuses the consumer's own matcher cannot catch it changing underneath.
 const declares = (path) =>
 path.startsWith('scripts/') && ROOT_DIR_WATCH_HINTS.includes(`scripts/**/*${extOf(path)}`);

 expect('POPULATION the declaration pin walked files at all (#4690)', walked.length > 0, true);
 expect(
 'POPULATION every file this gate walks under scripts/ is declared',
 walked.every(declares),
 true,
 );
 expect(
 'POPULATION every declared hint reaches a file this gate walks (no dead lead)',
 ROOT_DIR_WATCH_HINTS.every((hint) => walked.some((path) => declares(path) && `scripts/**/*${extOf(path)}` === hint)),
 true,
 );
 expect(
 'POPULATION every declared hint names an extension SCANNED_EXTENSIONS admits',
 ROOT_DIR_WATCH_HINTS.every((hint) => SCANNED_EXTENSIONS.has(extOf(hint))),
 true,
 );
 expect(
 'POPULATION the bare subtree and the repo root are NOT declared',
 ROOT_DIR_WATCH_HINTS.some((hint) => hint === 'scripts' || hint.endsWith('/**') || hint === '.' || hint === '**'),
 false,
 );
 expect(
 'POPULATION every declared literal carries a separator (a bare word reaches nothing)',
 ROOT_DIR_WATCH_HINTS.every((hint) => hint.includes('/')),
 true,
 );
 expect(
 'POPULATION the scripts root is the one ROOTS entry the extractor cannot see, and it is the one declared',
 ROOTS.filter((root) => !root.includes('/')).join(),
 'scripts',
 );
 // The literal SPELLING is the whole mechanism: a value built from
 // SCANNED_EXTENSIONS would keep every assertion above green and contribute
 // ZERO hints. `check-watch-hint-literal` owns that rule fleet-wide.
 let ownSource = null;
 try {
 ownSource = readFileSync(join(REPO_ROOT, 'scripts/check-whole-set-label-write.mjs'), 'utf8');
 } catch {
 ownSource = null;
 }
 const declSites = ownSource === null
 ? []
 : [...ownSource.matchAll(/\bconst\s+ROOT_DIR_WATCH_HINTS\s*=\s*([^;]*);/g)];
 expect(
 'POPULATION declared exactly once, as an array of quoted literals the text scan can read',
 declSites.length === 1
 && ROOT_DIR_WATCH_HINTS.every((hint) => declSites[0][1].includes(`'${hint}'`))
 && !/[A-Za-z_$][\w$]*\s*\./.test(declSites[0][1]),
 true,
 );
 }

 // The checked-in allowlist itself passes the reason rule.
 for (const [index, entry] of ALLOWLIST.entries()) {
 if (typeof entry.reason === 'string' && entry.reason.trim().length >= MIN_REASON_LENGTH) continue;
Expand Down
Loading