docs(check-type-source-resolution): name the paths precondition and the maintainer-only closure at the point of refusal - #16257

Fixes #16000

check-type-source-resolution names paths as its first remedy when a registered
package acquires a NEW dist-resolved type import. That remedy has a precondition the
message never stated: the consuming program's rootDir has to contain the
dependency's source. Where it does not, the author walks into a second wall that
nothing at the point of refusal mentioned — and past that wall every remaining route
is maintainer-only, so the message recommended a path and then named no remaining
self-serve option.

The knowledge was already in this file the whole time — its header records the
with-paths red at :27-28, and the registry doc-block states that paths is
"additionally the WRONG tool, measured on PR #12570". None of it was in the text an
author actually reads. The #15978 round paid a full cycle discovering it.

Message only. The verdict is untouched, per the card and its triage: what the gate
judges, the shrink-only registry and every tsconfig*.json in the repo are unchanged.

The card's hard precondition: the paths leg, re-measured here

The card asks for the closure to be reproduced before it is written into a message
("A message that overstates the closure would be worse than the current silence").
Reproduced on this branch, on the same pair and through the same program —
@objectstack/runtime reaching @objectstack/service-realtime via
tsconfig.test.json, with this gate's own remedy applied to
packages/runtime/tsconfig.json and one new cross-package import type:

+13, all of them TS6059, and not one new code error — every other diagnostic
code's count is identical across the two legs (TS18048 x91, TS18046 x27, TS2339 x17,
TS2493 x15, TS2345 x10, TS6133 x6, TS2322 x6 … unchanged). All 13 name
packages/services/service-realtime/src/**, billed into packages/runtime's
test-typecheck ledger, which service-realtime cannot see. That confirms the card's
measured 13 exactly, and the 191 baseline matches the count tsconfig.test.json's own
header records for this program.

The mutation was proven to land on disk before either reading (grep counts on both
touched files plus git hash-object), and restoration was proven byte-identical
against the HEAD blob hashes with a scoped git diff HEAD of 0 bytes. Nothing from
the reproduction is committed.

What changed, and what deliberately did not

Added to the refusal's remedy paragraph, after the existing re-baseline limb: the
paths precondition, the TS6059-into-the-ledger outcome it produces when the
precondition fails, and the remaining option stated plainly — do not take the
dependency (reach the subject through in-package source), or escalate, because the
ledger and rootDir are both maintainer-only.

Written as a CONDITION, never as a blanket closure. paths stays the correct remedy
wherever the consuming program's rootDir does contain the source; a message
overstating the closure would turn an author away from a route that is open, which is
worse than today's silence.

Three literals were kept intact because they are a cross-gate contract:
widening the registry entry is not the fix (the PREDICATION shape
check-ratchet-remedy-authority classifies this file as refused from), the
SHRINK-ONLY testimony, and the ONBOARDED exception. The new sentences are added
around them, never in place of them, and the two new negations are bound to their
verbs ("Never widen that ledger", "never widen a rootDir") so every offer this
message makes is still refused. check:ratchet-remedy-authority confirms it: 6 gates
still turn the expanding remedy down outright, unchanged.

Two self-test pins added, in the existing the registry, audited in BOTH directions
battery — one that the failure text names TS6059, one that it names the
maintainer-only closure. They fail independently because the halves fail
independently. That battery's floor is raised 10 to 12 to match, never loosened.

Gates

All 31 commands derived by node scripts/pm/dispatch-gates.mjs --changed --commands --repo objectstack-ai/objectstack on the merged tree, reconciled with --ran.
Every one exit 0, exit codes captured before any pipe. The load-bearing verdict lines:

• check-type-source-resolution --self-test OK
• check-type-source-resolution OK — 125 tsc program(s) across 78 packages scanned … 61 registered (the production verdict, unchanged by this diff)
• OK check-ratchet-remedy-authority: 213 scripts swept … 6 turn it down outright
• check-nul-bytes: OK (scanned 7959 text file(s) … no raw ASCII control bytes)

No publish surface, so skip-changeset is applied. #16215 remains open and is
unrelated to this diff.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vbw3RPgdtqesx4azk9SbW8

Generated by Claude Code