fix(pm): recognise a population declared as a lowercase object property

`scripts/pm/bare-root-worklist.mjs` recognised a gate's declared population by
the NAME of the `const` holding it, uppercase only, so a population spelled as
an object property could never match. `check-doc-route-spelling.mjs` declares
`roots: ['content/docs', 'skills']` inside `const REAL_CONFIG`, so its `skills`
root was invisible to the very instrument built to find undeclared roots — not
a different defect, the same one spelled differently.

`POPULATION_PROPERTY` mirrors `POPULATION_CONSTANT` term for term, the
camelCase hump doing the work the literal underscore does there; the bare
singular `root`/`dir` stay out for the reason `ROOT`/`DIR` do.

Dispositions for the three rows it surfaces, measured on 91f65c4:
- check-doc-route-spelling.mjs declares `skills/**` (46 of 47 tracked files),
  the idiom two sibling doc gates already carry at this root; the row is now
  REACHABLE and the family stops being Silent for skills-only cards.
- the two check-console-injection.mjs rows are `join()` path components in a
  gate that never walks the root; recorded in UNJUDGED with measured notes,
  which is what a widening pass owes and all it may write.
- the UNJUDGED shared base moved 66e68ad -> 91f65c4, re-read rather than
  re-judged; one cited line number corrected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

Author: claude

scripts/check-doc-route-spelling.mjs

@@ -147,6 +147,31 @@ const REAL_CONFIG = {
   occurrenceFloors: { 'content/docs': 100, skills: 10 },
 };
 
+/**
+ * The population declared for `scripts/pm/dispatch-gates.mjs`, which builds a
+ * dispatch's gate list by scanning each gate's source for the path literals it
+ * operates on. "Looks like a path" there means "carries a separator", so of the
+ * two roots above only `content/docs` reaches the hint set on its own —
+ * `skills` does not, and without this declaration a skills-only card is never
+ * told this gate reads its files. `check-corpus-claim-drift.mjs` and
+ * `check-doc-authoring.mjs` carry the identical declaration at this root for
+ * the identical reason.
+ *
+ * ⚠️ Spelled as a LITERAL array, never computed from `REAL_CONFIG.roots`: the
+ * extractor reads SOURCE TEXT, so `roots.map((r) => …)` would contribute
+ * nothing while every runtime assertion about the value stayed green.
+ * `check-watch-hint-literal` enforces that; the self-test below pins the
+ * coupling to `REAL_CONFIG.roots` in both directions.
+ *
+ * The subtree is what this gate reads: of the 47 files tracked under the root
+ * on 91f65c4ea, the walk admits 46 — every `.md`/`.mdx` at any depth, nothing
+ * under it skipped by `skipDirs` or `skipPaths` — so the declaration over-names
+ * by exactly one file (a `.json`), at 97.9% precision. ⛔ The bare root is NOT
+ * declared: it is the population, and the glob is the only spelling the
+ * extractor can turn into a hint.
+ */
+const ROOT_DIR_WATCH_HINTS = ['skills/**'];
+
 /** Segment-spelling variants the detector recognises as "same route, drifted
  * spelling". Plural/singular is computed; everything else is pinned HERE so a
  * new variant class is a reviewed one-line addition, never a loosened
@@ -819,6 +844,19 @@ function selfTest() {
       r.flags.some((f) => f.file.includes('releases')), false);
     expect('no verdict came from node_modules',
       r.flags.some((f) => f.file.includes('node_modules')), false);
+    // The dispatch declaration, pinned to REAL_CONFIG.roots in BOTH directions
+    // so it cannot rot: a root that stops being separatorless, or a hint whose
+    // root leaves the config, reds here rather than silently naming this gate
+    // for a tree it no longer reads.
+    const separatorless = REAL_CONFIG.roots.filter((root) => !root.includes('/'));
+    expect('every separatorless root the walk uses is declared as a watch hint',
+      separatorless.every((root) => ROOT_DIR_WATCH_HINTS.includes(`${root}/**`)), true);
+    expect('…and there is one, so the pin above is not holding over an empty list',
+      separatorless.length > 0, true);
+    expect('every declared hint names a root the walk actually uses',
+      ROOT_DIR_WATCH_HINTS.every((h) => REAL_CONFIG.roots.includes(h.replace(/\/\*+$/, ''))), true);
+    expect('the hint is the SUBTREE, not the bare root (a bare root builds no hint)',
+      REAL_CONFIG.roots.some((root) => ROOT_DIR_WATCH_HINTS.includes(root)), false);
 
     // ── The teeth: measured drift class flags, by name ───────────────────
     battery('The teeth: measured drift class flags, by name');

scripts/pm/bare-root-worklist.mjs

@@ -1382,9 +1382,9 @@ export const CENSUS_REFUSE_WIDE = new Map([
 ]);
 
 /**
- * SEEN, NOT YET JUDGED — the rows the widened recogniser made visible, named
+ * SEEN, NOT YET JUDGED — the rows a widened recogniser made visible, named
  * here so the worklist above does not read as complete while they sit outside
- * it (#15468).
+ * it (#15468, and #17057's property widening after it).
  *
  * ⛔ This is NOT a verdict table and NOT an exemption. An entry records exactly
  * one fact: the sweep SEES this row today and nobody has triaged it. This map
@@ -1414,6 +1414,20 @@ export const CENSUS_REFUSE_WIDE = new Map([
  * and its key is missing. The `base` is the tree the notes were measured on,
  * shared, and pinned to be shared, the way `CENSUS_REFUSE_WIDE` pins its own.
  *
+ * ⚠️ That shared base is what a SECOND widening costs, and the cost is the
+ * point rather than an obstacle to route around: a bucket may not carry notes
+ * measured on two different trees, so #17057's pass could not append its rows
+ * without re-reading every note already here against its own base. It did, and
+ * the base moved 66e68adc6 to 91f65c4ea. Seven of the eleven inherited entries
+ * name gate sources that are BYTE-IDENTICAL across those two commits (compared
+ * by blob id rather than by reading), so their notes could not have drifted; of
+ * the two files that did change, the live-db-isolation gate changed comment
+ * prose only, with no net line movement, and the doc-frontmatter gate grew
+ * ABOVE the line its note cites — the one note whose text this pass corrected,
+ * :436 to :446. ⛔ No `population` boolean and no recorded reason was otherwise
+ * rewritten: a re-measure that quietly re-judges is the thing this map exists
+ * to refuse.
+ *
  * ⚠️ Every path in the notes below is DESCRIBED rather than quoted — "a
  * two-segment path under the content root", not the literal. That is not
  * fussiness: a separator-carrying literal written here would enter THIS file's
@@ -1424,30 +1438,52 @@ export const CENSUS_REFUSE_WIDE = new Map([
 export const UNJUDGED = new Map([
   ['packages/lint/scripts/check-doc-security-posture.mjs ROOTS docs', {
     population: false,
-    base: '66e68adc6',
+    base: '91f65c4ea',
     why: 'the word is the `label` field at check-doc-security-posture.mjs:155, not a walk root: '
       + 'that entry\'s population is the `path` field one line above it, a two-segment path under '
       + 'the content root, which carries a separator and has always been visible to the '
       + 'derivation. The recogniser matched the LABEL because it sits inside the ROOTS span',
   }],
   ['packages/lint/scripts/check-doc-security-posture.mjs ROOTS skills', {
     population: true,
-    base: '66e68adc6',
+    base: '91f65c4ea',
     why: '`path: \'skills\'` at check-doc-security-posture.mjs:164, walked recursively by the `walk` '
       + 'at :189-:193 from the `for (const root of ROOTS)` at :462, for every `.md` file under it '
       + 'minus the entry\'s own `exclude` list',
   }],
+  ['scripts/check-console-injection.mjs distDir packages', {
+    population: false,
+    base: '91f65c4ea',
+    why: 'the word is a `join()` path COMPONENT at check-console-injection.mjs:940 — the gate '
+      + 'assembles the console dist directory from four bare single-segment words, so the extractor '
+      + 'sees the top-level one and nothing else. It never walks that root: `evaluate` at :247 opens '
+      + 'the index file at :252, the stamp beside it at :268, and every JavaScript asset directly '
+      + 'inside that directory\'s assets child at :269 — `readBundle` in console-spec-probes.mjs, '
+      + 'non-recursive. Surfaced by the #17057 property widening because the component sits inside '
+      + 'the `distDir` property of the argv object, which the recogniser now reads',
+  }],
+  ['scripts/check-console-injection.mjs specDir packages', {
+    population: false,
+    base: '91f65c4ea',
+    why: 'the same shape one line down, at check-console-injection.mjs:941: a `join()` component of '
+      + 'the spec package directory, assembled from bare words. The gate reads that package\'s '
+      + 'manifest and the built JavaScript its `exports` map points at — `readSpecBlob` in '
+      + 'console-spec-probes.mjs, reached at :348 — never an arbitrary file under the top-level '
+      + 'root. ⚠️ Both of this gate\'s real populations are themselves invisible to the derivation, '
+      + 'for the DIFFERENT reason that they are assembled rather than spelled; that is a fact this '
+      + 'note records and not a verdict on what, if anything, should be declared for them',
+  }],
   ['scripts/check-doc-frontmatter.mjs ROOTS docs', {
     population: false,
-    base: '66e68adc6',
-    why: 'the word is the `name` field at check-doc-frontmatter.mjs:436, not a walk root: that '
+    base: '91f65c4ea',
+    why: 'the word is the `name` field at check-doc-frontmatter.mjs:446, not a walk root: that '
       + 'entry\'s directory is a `join(REPO_ROOT, …)` of a two-segment path under the content root '
       + 'on the next line, and both of this gate\'s roots are separator-carrying paths under that '
       + 'root, which the derivation already sees',
   }],
   ['scripts/check-live-db-isolation.mjs ROOTS apps', {
     population: true,
-    base: '66e68adc6',
+    base: '91f65c4ea',
     why: 'one of `const ROOTS = [\'packages\', \'apps\', \'examples\']` at check-live-db-isolation.mjs:178, '
       + 'each walked recursively at :278-:282. The gate carries the #15341 `wide-population` marker '
       + 'at :58 and that marker is read here — but the marker excuses a COVERED row carrying a '
@@ -1458,15 +1494,15 @@ export const UNJUDGED = new Map([
   }],
   ['scripts/check-live-db-isolation.mjs ROOTS examples', {
     population: true,
-    base: '66e68adc6',
+    base: '91f65c4ea',
     why: 'the `examples` member of the same walked triple at check-live-db-isolation.mjs:178, with '
       + 'the same #15341 marker at :58 and the same reading — the marker resolves a contradiction '
       + 'between a declaration and a verdict, and this row has neither. No CENSUS row names '
       + '`examples` either',
   }],
   ['scripts/check-live-db-isolation.mjs ROOTS packages', {
     population: true,
-    base: '66e68adc6',
+    base: '91f65c4ea',
     why: 'the `packages` member of the same walked triple at check-live-db-isolation.mjs:178. This '
       + 'is the one of the three that IS judged somewhere: `check:live-db-isolation packages` is a '
       + 'recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE, at 90.3% of tracked packages/ files. It is '
@@ -1475,33 +1511,33 @@ export const UNJUDGED = new Map([
   }],
   ['scripts/check-vendor-version-stamps.mjs ROOTS apps', {
     population: true,
-    base: '66e68adc6',
+    base: '91f65c4ea',
     why: 'one of the four bare `path:` entries of `export const ROOTS` at '
       + 'check-vendor-version-stamps.mjs:232, read by `collectFiles()` at :916 and walked '
       + 'recursively at :885-:890 for the entry\'s own extension list',
   }],
   ['scripts/check-vendor-version-stamps.mjs ROOTS examples', {
     population: true,
-    base: '66e68adc6',
+    base: '91f65c4ea',
     why: 'the `examples` entry of the same walked list at check-vendor-version-stamps.mjs:232, on '
       + 'the same `collectFiles()` walk',
   }],
   ['scripts/check-vendor-version-stamps.mjs ROOTS packages', {
     population: true,
-    base: '66e68adc6',
+    base: '91f65c4ea',
     why: 'the `packages` entry of the same walked list at check-vendor-version-stamps.mjs:232, on '
       + 'the same `collectFiles()` walk',
   }],
   ['scripts/check-vendor-version-stamps.mjs ROOTS scripts', {
     population: true,
-    base: '66e68adc6',
+    base: '91f65c4ea',
     why: 'the `scripts` entry of the same walked list at check-vendor-version-stamps.mjs:232, on '
       + 'the same `collectFiles()` walk. The gate\'s fifth root is a two-segment path under the '
       + 'content root, which carries a separator and was already visible',
   }],
   ['scripts/check-whole-set-label-write.mjs ROOTS scripts', {
     population: true,
-    base: '66e68adc6',
+    base: '91f65c4ea',
     why: 'the third member of `export const ROOTS` at check-whole-set-label-write.mjs:152 — the '
       + 'other two are workflow and action directories under the dotted github root, which carry a '
       + 'separator and were already visible — walked at :492-:496. ⚠️ This gate already DECLARES at '
@@ -2018,6 +2054,43 @@ function selfTest() {
   t('control: the underscored spellings the restriction always admitted still match, so the case '
     + 'above is measuring an addition rather than a replacement',
     admits('SCAN_ROOTS') && admits('SCAN_DIRS') && admits('POPULATION'));
+
+  // The PROPERTY spelling, #17057, pinned the same way and for the same reason:
+  // what that card repaired is a judgement about how a population is SPELLED,
+  // so a row-shaped pin would hold it only while the tree happens to contain a
+  // gate spelled that way — and a gate spelled that way being unseen is the
+  // defect itself. The fixture is an object property inside a config literal,
+  // which is the shape the card was filed from, and its root is taken FROM THE
+  // TREE like every probe above so this file still declares no population.
+  const admitsProp = (name) => populationSpans(
+    `const CFG = {\n  ${name}: [${JSON.stringify(someRoot)}],\n};`,
+  ).length === 1;
+  t('the recogniser admits a population declared as a lowercase object property — `roots:` and '
+    + '`dirs:` inside a config literal (#17057)', admitsProp('roots') && admitsProp('dirs'));
+  t('…and the camelCase hump carries the weight the underscore carries above: `scanRoots`, '
+    + '`searchDirs`, `population` and a `…Scope` all match',
+    admitsProp('scanRoots') && admitsProp('searchDirs') && admitsProp('population')
+    && admitsProp('lintScope'));
+  t('…and it admits them EXACTLY: the bare singular `root` and `dir` stay OUT — the commonest '
+    + 'property names in this tree for one repo-root path fragment, the exact thing the '
+    + 'restriction exists to exclude — and so do a plain `label` and a suffixed `rootsX`',
+    !admitsProp('root') && !admitsProp('dir') && !admitsProp('label') && !admitsProp('rootsX'));
+  t('control: the property form is a TRANSLATION of the constant form and not a second, looser '
+    + 'judgement — `skipDirs` matches here exactly as `SKIP_DIRS` already matches there, so the '
+    + 'two spellings of one name are admitted or refused together',
+    admitsProp('skipDirs') === admits('SKIP_DIRS'));
+  t('…and the property span STOPS at its own value: a bare root sitting in the NEXT property of '
+    + 'the same literal is not swept in by the one before it',
+    bareRootLiterals(`const CFG = { roots: ['x/y'], label: [${JSON.stringify(someRoot)}] };`, dirs)
+      .every(({ index }) => !populationSpans(
+        `const CFG = { roots: ['x/y'], label: [${JSON.stringify(someRoot)}] };`,
+      ).some((s) => index > s.start && index < s.end)));
+  t('control: the same literal one property EARLIER, under a recognised key, IS swept in — so '
+    + 'the case above measures the span boundary rather than a recogniser that never fires',
+    bareRootLiterals(`const CFG = { roots: [${JSON.stringify(someRoot)}], label: ['x/y'] };`, dirs)
+      .some(({ index }) => populationSpans(
+        `const CFG = { roots: [${JSON.stringify(someRoot)}], label: ['x/y'] };`,
+      ).some((s) => index > s.start && index < s.end)));
   t('the live sweep is non-empty, so the cases below judge something', rows.length > 0);
 
   // ── The FOLD: one row per literal, however many invocations reach it ──────
@@ -2595,7 +2668,10 @@ function selfTest() {
       + 'constant-name restriction is proven to restrict, and neither the triage keys nor this '
       + 'file declare any population of their own. The recogniser is pinned to admit the '
       + 'bare ROOTS and DIRS spellings EXACTLY, singulars and unsuffixed neighbours refused '
-      + `(#15468). ${UNJUDGED.size} UNJUDGED row(s) — seen by that widened recogniser and judged `
+      + '(#15468), and to read a population declared as a lowercase object PROPERTY — the '
+      + 'camelCase mirror of the same judgement, bare singulars refused there too, its span '
+      + 'proven to stop at its own value (#17057). '
+      + `${UNJUDGED.size} UNJUDGED row(s) — seen by those widened recognisers and judged `
       + 'by nobody — are held SET-EQUAL, in both directions, to the open rows carrying no verdict, '
       + 'so none of them is exempted here and none of them is silently fresh. '
       + `${CENSUS_REFUSE_WIDE.size} CENSUS row(s) `