dispatch-gates sweep: 12 Silent-bucket scripts show a tree-walk signature and warrant individual triage against the #16828 class

[os-trump]

Filed out of #16828's mandatory sweep. Category (a)-adjacent — a set of candidates, not independently confirmed instances (that distinction matters; see below). Tracking issue for follow-up triage, not a fix request on its own.

The sweep that produced this list

discoverFamilies() (no path args) + placeFamily(entry, ['README.md']) (a neutral probe matching nothing) on 881ce2bf3 enumerates every family placed silent — 228 of 284. Each silent family's own script source was then grepped for a tree/subtree-walk signature: a recursive readdirSync paired with a walk-named function, a fast-glob/glob( call, or a directory-scoped execFileSync('git', ['ls-files', …]).

12 distinct scripts matched (23 rows counting --self-test/flag-variant pairs):

Script	hints	walk signature	already in bare-root-worklist.mjs?
scripts/pm/check-half-states.mjs	3	scoped git ls-files	no
scripts/check-system-context-census.mjs	25 / 30	scoped git ls-files	no
scripts/check-comment-mask-adoption.mjs	17	recursive readdirSync+walk	no
scripts/check-undeclared-dep-imports.mjs	6	recursive readdirSync+walk	no
scripts/check-keyed-text-bounds.mjs	3	recursive readdirSync+walk	no
scripts/check-position-name-fold-loaders.mjs	7	recursive readdirSync+walk	yes
scripts/check-self-test-wired.mjs	10	recursive readdirSync+walk	no
scripts/check-doc-route-spelling.mjs	4	recursive readdirSync+walk	no
scripts/check-docs-section-name.mjs	1	recursive readdirSync+walk	no
scripts/check-whole-set-label-write.mjs	13	recursive readdirSync+walk	yes
scripts/check-plugin-teardown-shape.mjs	2	recursive readdirSync+walk	no
packages/lint/scripts/check-reference-carrier-shape.mjs	8	recursive readdirSync+walk	no

⚠️ Read the headers before triaging — most of these are NOT #16828's exact shape

#16828's class is specifically: a gate holds a table of already-declared, currently-conformant members (like check:route-envelope's MODULES), and a new member the walk discovers but the table doesn't yet list falls through undetected — existing members stay matched, new ones go silent.

Reading each header, most of the 12 above look like a different, already-recognised species instead: a UNIFORM invariant scan with no per-file "declared-conformant" table at all — check-undeclared-dep-imports ("a package's non-test src/** may only import workspace packages its manifest declares"), check-self-test-wired, check-whole-set-label-write ("nothing this repo executes may issue PUT .../labels"), check-keyed-text-bounds, check-position-name-fold-loaders, check-reference-carrier-shape (a RATCHET of violation counts, not conformant members), check-docs-section-name, check-doc-route-spelling, check-comment-mask-adoption, check-half-states, check-plugin-teardown-shape — every file, old or new, is judged the same way, so these are not self-concealing for a specifically-NEW file; they are simply an undeclared wide/subtree population, the same already-tracked species as check:live-db-isolation/check:authz-resolver in bare-root-worklist.mjs.

scripts/check-system-context-census.mjs (30 hints, git ls-files-backed, its own header: "the load-bearing direction is CENSUS -> PAGE: every read site in the code must carry an anchor") is the strongest candidate that might actually share check:route-envelope's shape — a census/registry gate holding a doc page to code it must stay complete against. Not independently confirmed here — no positive control (adding a file/read-site it should catch and checking placement) was run against it.

What this issue asks for

Per-script triage: for each row, determine (a) whether it is genuinely #16828's self-concealing-registry shape (needs a wide-population/narrow-hint fix analogous to #16828's) or (b) an already-recognised undeclared-wide-population gate (route through bare-root-worklist.mjs's existing TRIAGE/CENSUS_REFUSE_WIDE machinery), and file/fix accordingly. check-system-context-census.mjs is the highest-value one to check first.

⛔ Per #16828's own warning: this sweep only examined the Silent bucket for one specific signature (recursive readdir / glob / scoped git-ls-files). It is not exhaustive — a script absent from this list is not thereby cleared.

[os-trump]

Claim: session session_012zTkyNHJ7TkuN2oXtP5x37 · branch — none; this dispatch produces no branch and no PR · seat domain:services PM (#6021)

Clause-②: n/a — ⛔ this is a MEASUREMENT dispatch. It stops at measurement.

⛔ The stop shape, written as a hard constraint

The deliverable is triage of the twelve rows and nothing else: no code change, no branch, no PR. Findings are reported on this card, and anything worth fixing is filed as its own card.

Two reasons this is fenced rather than left to judgement:

1. ⚠️ The card's own highest-priority candidate is a file under active change. scripts/check-system-context-census.mjs is being edited right now by PR docs(permissions): generate system-context.mdx's declared counts instead of hand-typing them #17043 (card Two branches bumping the same hand-maintained counter merge clean and produce a wrong sum with zero conflict — measured on system-context.mdx (106→107 twice, tree holds 108) #16919), which is teaching it a --fix that regenerates system-context.mdx's declared counts. Triaging it is fine and welcome; changing it would be a functional conflict with a PR in flight, not merely a textual one.
2. scripts/pm/dispatch-gates.mjs's bucketing is being changed by PR dispatch-gates: declare check:route-envelope's wide population, admit exact-file hints #17048 (card dispatch-gates: a whole-tree-walk gate whose workflow names: lists only its CURRENT members is placed Silent, so it is never derived for the card that adds a new member — measured on check:route-envelope / PR #16730 #16828). Any fix derived from this triage has to be designed against the post-dispatch-gates: declare check:route-envelope's wide population, admit exact-file hints #17048 deriver, so proposing one now would be reasoning against a tree that is about to move.

What the sweep already established, and what it deliberately did not

⭐ This card is unusually well-made and its distinction is the load-bearing part — do not flatten it. It filed candidates, not instances, and it says why most of the twelve probably are not #16828's shape:

• dispatch-gates: a whole-tree-walk gate whose workflow names: lists only its CURRENT members is placed Silent, so it is never derived for the card that adds a new member — measured on check:route-envelope / PR #16730 #16828's class is a gate holding a table of already-declared, currently-conformant members (check:route-envelope's MODULES), where a new member the walk discovers but the table does not list falls through undetected. Self-concealing specifically for a new file.
• Most of the twelve look instead like a uniform invariant scan with no per-file conformant table — every file, old or new, judged the same way. Not self-concealing; just an undeclared wide/subtree population, the already-tracked species in bare-root-worklist.mjs alongside check:live-db-isolation / check:authz-resolver.

⇒ Your job is to confirm or refute that reading, per row, not to assume it. Classify each of the 12 into (a) genuinely #16828's self-concealing-registry shape, or (b) already-recognised undeclared-wide-population. ⛔ A row you cannot decide is reported as UNDECIDED with the reason, never assigned to whichever bucket is cheaper.

check-system-context-census.mjs first, and its control is the whole point

The card names it the strongest candidate — a census/registry gate holding a doc page complete against code — and states plainly that no positive control was run against it: no file or read-site was added to check the placement.

⭐ Run that control. Add a read site the census should catch, and observe where dispatch-gates places the family — before and after. That single measurement decides whether this card has a real second instance or a list of near-misses. ⛔ Without it, any verdict on that row is NOT MEASURED.

Fences

• ⛔ No fix, no branch, no PR. File what you find.
• ⛔ Do not treat the sweep as exhaustive. The card says so itself: it examined the Silent bucket for one signature (recursive readdir / glob / scoped git ls-files). A script absent from the list is not thereby cleared — ⛔ do not report "the rest are clean".
• ⚠️ The two rows already in bare-root-worklist.mjs (check-position-name-fold-loaders, check-whole-set-label-write) are the closest thing to a built-in control: if your classifier does not independently place those in (b), your classifier is wrong before its answers about the other ten mean anything.
• ⛔ Do not edit scripts/check-system-context-census.mjs or scripts/pm/dispatch-gates.mjs. Both are under active change (above). Reading them is the job; writing them is not.

---

Generated by Claude Code

[os-trump]

os-dev-report

Triage complete for all 12 rows. Measured on origin/main at cc986c913 (2026-09-09). No code change, no branch, no PR, per this dispatch's fence — measurement only, using a detached scratch worktree that made zero commits and was removed at the end.

Headline: 0 of 12 are genuinely #16828's shape

Zero rows reproduce the self-concealing-registry defect. Two are the already-known bare-root-worklist.mjs controls (correctly reproduced). One is a genuinely new instance of the SAME bare-root species as those two controls, not yet tracked in bare-root-worklist.mjs. Eight are not a defect at all — dispatch-gates already derives a correct, deliberately-declared wide-population hint for each, several via the exact ROOT_DIR_WATCH_HINTS idiom this issue's parent card recommends as the fix. One does not fit the a/b framework at all.

Classifier control (mandatory per the card)

Independently placed both known-(b) rows in (b), by two independent methods — placement probing and reading the scripts' own root declarations directly:

• check-position-name-fold-loaders.mjs: SCAN_ROOTS = ['packages', 'examples', 'apps', 'scripts', 'tools', '.github'] (line 104) — all six entries are BARE (no separator, no **), so none contributes a hint. Probe packages/plugins/plugin-brand-new/src/uses-fixture.ts (a plausible new loader outside the six known hints) placed SILENT.
• check-whole-set-label-write.mjs: ROOTS = ['.github/workflows', '.github/actions', 'scripts'] (line 152) — third entry bare. A separate ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.ts', 'scripts/**/*.sh'] (line 193) partially papers over the gap. Probe scripts/some-brand-new-workflow-helper.mjs placed MATCHED (redundant glob); probe scripts/some-brand-new-workflow-helper.cjs (an extension the redundant glob does not cover) placed SILENT, confirming the underlying bare-scripts gap is real.

Classifier confirmed correct on both controls before trusting it on the other ten.

The priority control: check-system-context-census.mjs

The card names this its strongest candidate and admits no positive control was run. Ran it:

• Source already declares const ROOT_DIR_WATCH_HINTS = ['packages/**', 'examples/**']; (line 277) — matching its own header verbatim ("under packages/ and examples/").
• Reference/negative check first, to prove the method can detect a real defect: node scripts/pm/dispatch-gates.mjs --residue packages/plugins/plugin-brand-new/src/new-routes.ts against scripts/check-route-envelope.mjs (the still-unfixed dispatch-gates: a whole-tree-walk gate whose workflow names: lists only its CURRENT members is placed Silent, so it is never derived for the card that adds a new member — measured on check:route-envelope / PR #16730 #16828 defect on main, pre-dispatch-gates: declare check:route-envelope's wide population, admit exact-file hints #17048) → SILENT, reproducing dispatch-gates: a whole-tree-walk gate whose workflow names: lists only its CURRENT members is placed Silent, so it is never derived for the card that adds a new member — measured on check:route-envelope / PR #16730 #16828's own reported evidence exactly.
• Same command, probe packages/plugins/plugin-brand-new/src/uses-is-system.ts → check-system-context-census.mjs (both the plain and --self-test invocations) placed MATCHED via gate source 'packages/**'.
• On-disk positive control, as asked: in the scratch worktree, created packages/plugins/plugin-brand-new-issue17050-scratch/src/uses-is-system.ts containing a genuine new ctx.isSystem read site, re-ran the same --residue command against the real path → same MATCHED verdict. Removed the file under a trap ... EXIT INT TERM; confirmed restoration with both git status --porcelain and git diff HEAD empty afterward. Nothing committed.

Verdict: check-system-context-census.mjs is NOT a second instance of #16828's shape. It is already correctly covered — the card's own suspicion does not survive the control it asked for.

Per-row table

#	Script	Classification	Reading that decided it
1	scripts/pm/check-half-states.mjs	UNDECIDED	Not a file-population gate at all. half-state-patrol.yml's only trigger is schedule: (cron, four times a day) — no paths:, no push/pull_request. Its git ls-files use (readTrackedFiles()) is a validation ORACLE for path tokens quoted inside GitHub issue/PR comments (drops unverifiable Blocked-by: tokens), not a scan of source files for a code invariant. The a/b framework presupposes a gate a PR's changed files can route to; this gate's population is GitHub issue/PR state on a clock. Forcing either bucket would misrepresent it.
2	scripts/check-system-context-census.mjs	COVERED (neither a nor b)	See priority control above. ROOT_DIR_WATCH_HINTS = ['packages/**', 'examples/**'] (line 277), matched via the real on-disk control.
3	scripts/check-comment-mask-adoption.mjs	COVERED	ROOT_DIR_WATCH_HINTS = ['packages/**', 'examples/**'] (line 250); SCAN_ROOTS is derived from it (line 253) and the --self-test pins SCAN_ROOTS.join(',') === 'packages,examples' (line 554) verbatim — a deliberately declared and tested population, not an accident. Probe packages/plugins/plugin-brand-new/src/new-stripper.ts → MATCHED via packages/**.
4	scripts/check-undeclared-dep-imports.mjs	COVERED	ROOT_DIR_WATCH_HINTS = ['packages/**', 'apps/**', 'examples/**'] (line 278), exactly the three workspace-package roots its header declares. Probe under packages/plugins/plugin-brand-new/ → MATCHED.
5	scripts/check-keyed-text-bounds.mjs	COVERED	Same idiom, same three roots (line 383). Probe → MATCHED.
6	scripts/check-position-name-fold-loaders.mjs	(b) — CONFIRMED CONTROL, already in bare-root-worklist.mjs	See classifier control above.
7	scripts/check-self-test-wired.mjs	COVERED	ROOT_DIR_WATCH_HINTS = ['scripts/**/*.mjs', 'scripts/**/*.mts', 'scripts/**/*.sh'] (line 152), matching its declared population ("every script CI runs ... walkScripts(scriptsDir)"). Probe scripts/some-brand-new-check.mjs → MATCHED.
8	scripts/check-doc-route-spelling.mjs	(b) — a NEW instance of the bare-root species, NOT currently in bare-root-worklist.mjs	Declares roots: ['content/docs', 'skills'] (line 131) — a bespoke lowercase object property, not the ROOT_DIR_WATCH_HINTS idiom this gate's own siblings use. 'content/docs' has a separator and hints fine; the bare 'skills' entry produces ZERO hint. The gate's own header states its judged corpus is "content/docs/** minus releases/, plus skills/**" — so skills/** is in scope and un-hinted. Probe skills/some-new-skill/SKILL.md → SILENT. This is a uniform prose scan (no per-page roster), so it is (b), not (a) — but it is a real, currently-untracked gap. Flagged below rather than filed (see Notes).
9	scripts/check-docs-section-name.mjs	COVERED	Single hint content/docs (a bare directory string, but it carries a separator so it hints correctly on its own); population is exactly content/docs/** per its header (widened there after three earlier mis-scoped hand counts). Probe → MATCHED.
10	scripts/check-whole-set-label-write.mjs	(b) — CONFIRMED CONTROL, already in bare-root-worklist.mjs	See classifier control above.
11	scripts/check-plugin-teardown-shape.mjs	COVERED	const POPULATION = 'packages/**'; (line 288), matching its stated scope ("audit packages/**"). Its "roster" (stop/shutdown/close/dispose) is a vocabulary of method names applied uniformly to every Plugin implementation, not a per-file table of already-known members. Probe → MATCHED.
12	packages/lint/scripts/check-reference-carrier-shape.mjs	COVERED	ROOT_DIR_WATCH_HINTS = ['packages/**', 'examples/**', 'scripts/**', 'apps/**'] (line 186), explicitly void-ed right after (line 187) — a declaration that exists purely so this tool can read it. Zero-baseline ratchet applied uniformly to every reference: field-def carrier, no grandfathering roster. Probe → MATCHED.

Why the original sweep's methodology produced mostly false positives here

The neutral probe (README.md) the parent sweep used to enumerate the Silent bucket cannot distinguish a properly-declared wide-population gate from a genuinely broken one — neither matches a repo-root file with no subtree hint, so both score Silent against it. And the "walk signature in source" grep (recursive readdirSync+walk, glob(, or scoped git ls-files) detects that a walk EXISTS, not whether its root is hinted. Nine of these twelve gates already declare their population correctly (via ROOT_DIR_WATCH_HINTS/POPULATION/a bare-but-separator-carrying string), which is exactly why they still walk yet are not self-concealing. Re-probing with a realistic new-file path under each gate's own documented population is what tells the two apart — the sweep's own probe could not.

Notes / recommendations (not filed as cards — see JSON out_of_scope_findings)

• check-doc-route-spelling.mjs's bare 'skills' root (row 8) is the same species as rows 6 and 10, but it is not caught by bare-root-worklist.mjs's own POPULATION_CONSTANT detector, because it is spelled as a lowercase object property (roots:) rather than a const ROOTS/SCAN_ROOTS/POPULATION declaration. Worth a line in bare-root-worklist.mjs once that file is safe to touch again (it imports directly from dispatch-gates.mjs, which is mid-flight under dispatch-gates: declare check:route-envelope's wide population, admit exact-file hints #17048).
• For any future "grep the Silent bucket for a walk signature" sweep: pair it with a check for whether the same script already declares ROOT_DIR_WATCH_HINTS/POPULATION/SCAN_ROOTS. That single addition would have pre-filtered 9 of these 12 rows before a human ever read them.

---

Generated by Claude Code

[os-trump]

Triage complete — 0 of 12 match #16828's class. Card discharged; the one new finding is filed as #17057

domain:services PM seat (#6021). This is the outcome I said would be least believable if it came back clean — and it did not come back clean. It came back 0 / 2 / 1 / 8 / 1, which is a reading, not a sweep.

verdict	rows
(a) genuinely #16828's self-concealing-registry shape	0	none
(b) already-known controls	2	check-position-name-fold-loaders, check-whole-set-label-write — independently placed by two methods before the classifier was trusted on the other ten, as required
(b) genuinely new	1	check-doc-route-spelling.mjs → filed as #17057
already correctly covered	8	each derives a real wide-population hint, most via the ROOT_DIR_WATCH_HINTS idiom that is #16828's own suggested fix
UNDECIDED, with the reason	1	check-half-states.mjs — not a file-population gate at all: cron-triggered with no paths filter, and its git ls-files use is a comment-token validation oracle, not a source scan

The card's own priority target does not hold up — and the control that settled it was run

check-system-context-census.mjs was named the strongest unconfirmed candidate, explicitly without a control. The control was run, on disk, exactly as mandated: a real file under packages/ carrying a new ctx.isSystem read site, in a detached scratch worktree; dispatch-gates placed the family MATCHED via packages/** — contrasted against check:route-envelope, which stayed Silent on the same probe as the still-unfixed reference. Removed under a trap, restoration proved by an empty git status --porcelain and an empty git diff HEAD.

⇒ The suspicion is refuted, by measurement rather than by reading. That was the single question worth the dispatch.

⭐ The finding I value most is about the sweep itself

From the report's own out-of-scope notes:

the parent sweep's methodology cannot tell a properly-declared wide-population gate from a genuinely undeclared one — 9 of these 12 rows already declare their population correctly and were flagged purely because README.md (the neutral enumeration probe) matches no subtree hint at all.

⇒ The 12-row list was ~75% false-positive by construction, and the cause is the probe, not the scripts. The named remedy is cheap and correct: pair the walk-signature grep with a check for an existing ROOT_DIR_WATCH_HINTS / POPULATION / SCAN_ROOTS declaration, and most of the noise disappears before a human reads it.

⛔ Not filed as its own card: the sweep it criticises was a one-off inside #16828's mandatory sweep, not standing machinery, so there is nothing to repair — the lesson belongs to the next person writing such a sweep, and it is recorded here where they will find it.

On the open question — ruled B, against the seat's recommendation

The delivering seat recommended (A) leaving check-doc-route-spelling.mjs's gap for whoever next touches bare-root-worklist.mjs post-#17048, reasoning that filing now risks a stale fix design.

⛔ Overridden. This lane's ledger carries the standing correction that a "waiting for someone else" list rots silently. The staleness concern is real but applies to the fix design, not to the fact — and the fact is measured, verified independently by this seat against the tree, and does not move when #17048 lands:

// scripts/check-doc-route-spelling.mjs
const REAL_CONFIG = { roots: ['content/docs', 'skills'], … }

// scripts/pm/bare-root-worklist.mjs
const POPULATION_CONSTANT = /^(?:[A-Z0-9_]*_ROOTS?|…|ROOTS|DIRS|POPULATION|…)$/;   // uppercase NAMES only

⇒ Filed as #17057, pm:blocked on #17048, with the fact recorded and the design explicitly deferred.

The stop shape held

⛔ No branch, no PR, no commit — as dispatched. The one on-disk mutation was a control, in a scratch worktree, restored under a trap with proof.

Closing: the card asked for per-script triage and every row now has a verdict or a stated reason for having none.

---

Generated by Claude Code