diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 81139e44eb..7b78557dd9 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -174,6 +174,45 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # ── Gate-family selection (#16496) ───────────────────────────────────
+      # After #16453 this job is the merge queue's critical path (median 1468 s
+      # over the ten merge-group runs measured for #16496; the PM dispatch-gates
+      # self-test alone 597 s), and none of its expensive steps read a
+      # merge group's file surface: a docs-only group paid the full battery.
+      # So on `merge_group` and `pull_request` the FIVE scoped families below
+      # -- each step carrying `if: steps.gate-families.outputs.<id> != 'skip'`
+      # -- run only when the changed paths touch the files that family reads.
+      # `push` on main and the scheduled full run keep the whole battery: the
+      # script runs everything for any event it does not scope.
+      #
+      # ⭐ The invariant is FAIL-OPEN, and it holds at both layers. The script
+      # runs every family when the base cannot be resolved, the diff fails or
+      # is empty, a path is one it does not classify (a new top-level
+      # directory, an unlisted root file), or any change is a deletion, rename
+      # or type change; a family is skipped ONLY when every changed path is
+      # positively classified into a class that family provably never reads.
+      # The `!= 'skip'` spelling means an ABSENT output -- the selector never
+      # ran, or wrote nothing -- also runs the step. Both halves are pinned by
+      # `scripts/ci/select-gate-families.selftest.sh` (`check:select-gate-
+      # families`, further down this job), which also reads THIS file and
+      # refuses any other `if:` spelling and any family the script does not
+      # decide. The per-family read-sets, and how each was measured, are in
+      # the script's header.
+      #
+      # The selection itself lives in scripts/ci/select-gate-families.sh:
+      # environment in, `$RUNNER_TEMP/gate-families.txt` + `$GITHUB_OUTPUT`
+      # out, and a ran/skipped table in the job summary (the seat reads it).
+      # This step only exports the event's fields, so the same script -- every
+      # branch of it -- runs locally and under its self-test.
+      - name: Select the gate families this run pays for
+        id: gate-families
+        env:
+          OS_GATE_EVENT_NAME: ${{ github.event_name }}
+          OS_GATE_PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
+          OS_GATE_MERGE_GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
+        run: |
+          bash scripts/ci/select-gate-families.sh
+
       # #7484 docs anchors: `lychee.toml` sets `include_fragments = "none"`, so
       # the `Check Documentation Links` job resolves a link's FILE and never its
       # `#anchor` — measured with the pinned lychee 0.24.2 under the CI argv, a
@@ -251,7 +290,12 @@ jobs:
       # file is ignored COMPLETELY, so new erasures added to one ride the old
       # entry in silence. This re-measures those files with the grandfathering
       # lifted and holds them to a per-file count, so the list can only shrink.
+      #
+      # Scoped (#16496): reads `packages/**/*.{ts,tsx,mts,cts}`, its baseline,
+      # `eslint.config.mjs` and the top-level `scripts/*.mjs` it imports; a
+      # group touching none of those skips it (selection step above).
       - name: Slot-lookup ratchet
+        if: steps.gate-families.outputs.slot_lookup != 'skip'
         run: pnpm check:slot-lookup
 
       # Engine query-options erasure ratchet (#4918). The slot-lookup rule above
@@ -269,7 +313,11 @@ jobs:
       # slot-lookup for the non-test residual, plus one aggregate decrease-only
       # number for test code (a test whose subject IS off-contract engine input
       # must be able to build it). Runs its own --self-test first.
+      #
+      # Scoped (#16496): the same population and inputs as the slot-lookup
+      # ratchet above, with `scripts/query-options-erasure-baseline.json`.
       - name: Engine query-options erasure ratchet
+        if: steps.gate-families.outputs.query_options_erasure != 'skip'
         run: pnpm check:query-options-erasure
 
       # @objectstack/verify stand-in erasure guard (#6399). The third and
@@ -620,7 +668,13 @@ jobs:
       # Cost, measured on a contended 4-vCPU container: 4,741 files, 72 MB of
       # source, 45–48 s, of which the parser is 45 s. The step prints CI's own
       # number on every run.
+      #
+      # Scoped (#16496): the walk reads every `.ts .tsx .mts .cts .js .mjs
+      # .cjs .jsx` file in the tree, so a group that changes no file of those
+      # extensions (and no root configuration) skips it -- selection step at
+      # the top of this job.
       - name: Comment mask agrees with a real parser over the whole corpus
+        if: steps.gate-families.outputs.comment_mask_corpus != 'skip'
         run: node scripts/check-comment-mask-corpus.mjs
 
       # Stack-collection enumerations vs the schema (#6242). `stack.zod.ts`
@@ -745,9 +799,28 @@ jobs:
       # green and surfaced later as a prompt naming the wrong gate families —
       # output that reads as correct, produced by the one tool whose purpose is
       # to stop gate lists being memory-shaped. Same family as the
-      # `Changeset-family gate self-tests` step above, and like that one this
-      # step is deliberately UNCONDITIONAL: no `if:`, no label read, no paths
-      # filter. An exemption is what a self-test must not have, or the gap moves.
+      # `Changeset-family gate self-tests` step above. Until #16496 this step
+      # was deliberately UNCONDITIONAL -- no `if:`, no label read, no paths
+      # filter -- on the argument that an exemption is what a self-test must
+      # not have, or the gap moves. That argument was about an exemption a
+      # PATH FILTER or a LABEL would grant: a paths: trigger or a label read
+      # skips the step on a card that never touched the paths someone once
+      # listed, with no reader of what the test actually reads. What runs
+      # here now is different in kind and was the maintainer's call (#16496,
+      # 「同意你的建议，你负责执行派发所有可行的优化」): the selection step at
+      # the top of this job classifies every changed path against this
+      # self-test's MEASURED read-set (every workflow, every gate source under
+      # `scripts/**` and `packages/*/scripts/**`, every `package.json`,
+      # `.claude/**`, `skills/**`, `AGENTS.md`, `CLAUDE.md`, `tsconfig.json`,
+      # every `.gitignore` -- nested ones included -- the CONTENT of every
+      # JS/TS file in the tree (the compound-anchor census of
+      # `function ...SelfTest...(` declarations and the exposed-scratch-dir
+      # sweep of every mkdtempSync/mkdirSync caller both assert over it), and
+      # the tracked NAME set it sweeps -- so any added, deleted or renamed
+      # file runs it too), and skips this step only when every path is one
+      # the test provably never reads: a modified doc, changeset or non-source
+      # workspace file. Every doubt runs it, the self-test of the selector
+      # pins that, and `push` on main keeps it unconditional.
       #
       # The gate runs the SELF-TEST only. The live derivation
       # (`node scripts/pm/dispatch-gates.mjs <path>`) answers a question about a
@@ -775,13 +848,17 @@ jobs:
       # counts stand here either, for the same reason — they rot the same way,
       # and it is the SHAPE of the work, not its size, that the argument needs.
       #
-      # ⛔ Cost was never what makes this step unconditional. The FIRST
-      # paragraph above is, and it stands without this half: an exemption is
-      # what a self-test must not have, or the gap moves. Losing the estimate is
-      # therefore NOT an argument for an `if:`, a label read or a paths filter —
-      # weakening this gate is a maintainer call, and no reading of this note
-      # authorises one.
+      # ⛔ Cost was never what decided this step's conditionality, and the
+      # measured medians that motivated #16496 (597 s here, over ten
+      # merge-group runs) live in that card and its PR, not in this note.
+      # Losing the estimate is NOT an argument for a label read or a paths
+      # filter, and the read-set-scoped `if:` below is not one of those: it
+      # was a maintainer call (the first paragraph names it), and widening the
+      # skip -- any change to the classes the selector treats as inert for
+      # this family -- is again a maintainer call, taken in
+      # scripts/ci/select-gate-families.sh under its self-test.
       - name: PM dispatch-gates self-test
+        if: steps.gate-families.outputs.pm_dispatch_gates != 'skip'
         run: pnpm check:pm-dispatch-gates
 
       # Every ROOT_DIR_WATCH_HINTS declaration stays READABLE BY A TEXT SCANNER
@@ -1318,9 +1395,21 @@ jobs:
       #
       # It runs entirely on a private lock under a temp dir; it never touches
       # /tmp/os-heavy-verify.lock, so a runner and an agent container behave the
-      # same. Unconditional and un-`if:`-ed, like the self-tests above — an
-      # exemption is what a self-test must not have. No network, ~40 s.
+      # same. No network; median 100 s over the ten merge-group runs measured
+      # for #16496.
+      #
+      # Scoped (#16496): the suite reads the script itself (`$SELF`) and a
+      # private temp dir, and its case (h) runs the real entry point from the
+      # repo root, which routes through filter_preflight ->
+      # scripts/pnpm-filter-targets.mjs --preflight and so reads the top-level
+      # scripts/*.mjs helpers that imports, pnpm-workspace.yaml and every
+      # workspace package.json. A group touching none of those skips it. That
+      # is not the exemption the self-tests above refuse (a label or a paths
+      # filter with no reader behind it): the selection step at the top of
+      # this job runs this step on every doubt, and `push` on main keeps it
+      # unconditional.
       - name: Verify-lock entry-point self-test
+        if: steps.gate-families.outputs.verify_lock != 'skip'
         run: bash scripts/pm/os-verify-lock.sh --self-test
 
       # ci-failure self-test (#9898). Fifth member of the PM self-test family
@@ -3299,6 +3388,21 @@ jobs:
       - name: Test Core package selection self-test
         run: pnpm check:select-shard-packages
 
+      # Gate-family selection self-test (#16496). The "Select the gate families
+      # this run pays for" step at the top of this job is a thin call into
+      # scripts/ci/select-gate-families.sh, and its `merge_group` branch cannot
+      # run before a PR is already in the queue, so it is proved here: every
+      # event, the card's four cases (a scripts/pm change, a docs-only group, a
+      # workflow change, an unknown path), and every fail-open branch (empty
+      # diff, unresolvable base, deletion / rename, unspellable path), pinning
+      # which families ran and skipped, for which reason, and which
+      # `::warning::` lines fired. It also reads THIS file and pins the YAML
+      # half: the selector step's id and env, the `!= 'skip'` spelling on every
+      # scoped step, and that the scoped set equals the decided set. Offline;
+      # ~3 s.
+      - name: Gate-family selection self-test
+        run: pnpm check:select-gate-families
+
       # Aggregator roster gate (#10490). Three required contexts are aggregate
       # jobs standing in for a set of real jobs — `Test Core` and `Dogfood
       # Regression Gate` in ci.yml, `TypeScript Type Check` in this file — and
diff --git a/package.json b/package.json
index 0921d4e26b..0c50739f45 100644
--- a/package.json
+++ b/package.json
@@ -138,6 +138,7 @@
     "check:pnpm-acquisition": "node scripts/check-pnpm-acquisition.mjs --self-test && node scripts/check-pnpm-acquisition.mjs",
     "check:workflow-status-functions": "node scripts/check-workflow-status-functions.mjs --self-test && node scripts/check-workflow-status-functions.mjs",
     "check:select-shard-packages": "bash scripts/ci/select-shard-packages.selftest.sh",
+    "check:select-gate-families": "bash scripts/ci/select-gate-families.selftest.sh",
     "check:shard-attestation": "node scripts/check-shard-attestation.mjs --self-test && node scripts/check-shard-attestation.mjs",
     "check:required-contexts": "node scripts/check-required-contexts.mjs --self-test && node scripts/check-required-contexts.mjs",
     "check:cross-package-test-inputs": "node scripts/check-cross-package-test-inputs.mjs --self-test && node scripts/check-cross-package-test-inputs.mjs",
diff --git a/scripts/ci/select-gate-families.selftest.sh b/scripts/ci/select-gate-families.selftest.sh
new file mode 100644
index 0000000000..cb812fc28e
--- /dev/null
+++ b/scripts/ci/select-gate-families.selftest.sh
@@ -0,0 +1,586 @@
+#!/usr/bin/env bash
+#
+# Self-test for scripts/ci/select-gate-families.sh (#16496).
+#
+# The script decides which scoped `Lint & Repo Gates` families a merge group
+# or pull request pays for, and its one invariant is FAIL-OPEN: every doubt
+# runs every family. So the property under test is not "does it exit 0" (it
+# nearly always does) but WHICH families it ran and skipped, for WHICH reason,
+# which `::warning::` lines it printed and which it must not, and what landed
+# in `gate-families.txt` / `$GITHUB_OUTPUT` / `$GITHUB_STEP_SUMMARY`. The
+# card's four minimum cases are here by name -- a scripts/pm/ change, a
+# docs-only group, a workflow change, an unknown path -- and the fail-open
+# branches around them: empty diff, unresolvable base, structural change,
+# unspellable path, an event that is not scoped.
+#
+# The last section reads the REAL lint.yml and pins the YAML half of the
+# contract: the selector step exists under the id the `if:` lines name, every
+# scoped step spells `!= 'skip'` (an absent output runs the step), and the set
+# of families the workflow scopes equals the set the script decides -- a
+# family the script emits that no step reads is dead, and a step reading a
+# family the script never emits would run unconditionally while looking
+# scoped.
+#
+# Hermetic and offline: a throwaway upstream + clone (+ a shallow clone)
+# under $TMPDIR; no fake tools are needed because the script calls nothing
+# but git. Needs git and bash; ~3s.
+#
+# Run: bash scripts/ci/select-gate-families.selftest.sh
+set -uo pipefail
+cd "$(git rev-parse --show-toplevel)" || exit 1
+
+# The two repo paths this self-test reads, spelled as quoted repo-relative
+# literals on purpose: the dispatch derivation (scripts/pm/dispatch-gates.mjs)
+# reads a gate's quoted path literals as the population it watches, so a card
+# touching either schedules this family. Every other path below is a
+# throwaway fixture under $TMPDIR, and none is spelled as a bare repo path --
+# a quoted literal with a slash in it would read as a declared population
+# that reaches nothing (check:declared-population-live refuses exactly that).
+SCRIPT_REL='scripts/ci/select-gate-families.sh'
+WORKFLOW_REL='.github/workflows/lint.yml'
+SCRIPT="$PWD/$SCRIPT_REL"
+FIX=$(mktemp -d "${TMPDIR:-/tmp}/os-select-gate-families-selftest.XXXXXX") || exit 1
+trap 'rm -rf "$FIX"' EXIT INT TERM
+
+fail=0
+cases=0
+checks=0
+
+git_q() {
+  git -c user.name=selftest -c user.email=selftest@example.invalid -c commit.gpgsign=false "$@"
+}
+
+ALL='pm_dispatch_gates query_options_erasure slot_lookup verify_lock comment_mask_corpus'
+
+# ── Fixture repositories ────────────────────────────────────────────────────
+# C0 carries one representative file of every class the classifier names, so
+# a scenario is "modify / add / delete one of them on top of C0".
+UP="$FIX/upstream"
+mkdir -p "$UP"
+git_q -C "$UP" init -q
+git_q -C "$UP" symbolic-ref HEAD refs/heads/main
+mkdir -p "$UP/packages/a/scripts" "$UP/packages/a/src" "$UP/apps/site/src" "$UP/docs" "$UP/content/docs" \
+  "$UP/scripts/pm" "$UP/scripts/ci" "$UP/.github/workflows" "$UP/.claude/agents" "$UP/skills/x" "$UP/.changeset"
+printf '{"name":"fixture","private":true}\n' > "$UP/package.json"
+printf 'packages:\n  - packages/*\n' > "$UP/pnpm-workspace.yaml"
+printf '{"name":"a"}\n' > "$UP/packages/a/package.json"
+printf 'export const a = 1;\n' > "$UP/packages/a/src/index.ts"
+printf 'export const t = 1;\n' > "$UP/packages/a/src/index.test.ts"
+printf '{"rows":[]}\n' > "$UP/packages/a/src/data.json"
+printf 'dist/\n' > "$UP/packages/a/.gitignore"
+printf 'console.log(1);\n' > "$UP/packages/a/scripts/build.mjs"
+printf 'export const site = 1;\n' > "$UP/apps/site/src/page.tsx"
+printf '# guide\n' > "$UP/docs/guide.md"
+printf '# page\n' > "$UP/content/docs/page.mdx"
+printf '#!/usr/bin/env bash\necho lock\n' > "$UP/scripts/pm/os-verify-lock.sh"
+printf 'export const pm = 1;\n' > "$UP/scripts/pm/tool.mjs"
+printf '# pm\n' > "$UP/scripts/pm/README.md"
+printf 'export const helper = 1;\n' > "$UP/scripts/helper.mjs"
+printf '{}\n' > "$UP/scripts/slot-lookup-baseline.json"
+printf '#!/usr/bin/env bash\necho ci\n' > "$UP/scripts/ci/tool.sh"
+printf 'name: lint\n' > "$UP/.github/workflows/lint.yml"
+printf '# agent\n' > "$UP/.claude/agents/os-dev.md"
+printf '# skill\n' > "$UP/skills/x/SKILL.md"
+printf '# rules\n' > "$UP/AGENTS.md"
+printf '# readme\n' > "$UP/README.md"
+printf -- '---\n"a": patch\n---\nchange\n' > "$UP/.changeset/first.md"
+git_q -C "$UP" add -A
+git_q -C "$UP" commit -q -m 'C0: root'
+C0=$(git_q -C "$UP" rev-parse HEAD)
+printf '# guide, revised upstream\n' > "$UP/docs/guide.md"
+git_q -C "$UP" commit -q -am 'C1: docs move on main'
+C1=$(git_q -C "$UP" rev-parse HEAD)
+# A merge group's base is fetched BY SHA; a local upstream has to be told to
+# serve one (GitHub does so for every reachable commit).
+git_q -C "$UP" config uploadpack.allowReachableSHA1InWant true
+git_q -C "$UP" config uploadpack.allowAnySHA1InWant true
+
+REPO="$FIX/repo"
+git_q clone -q "$UP" "$REPO"
+# Created AFTER the clone, so the clone has no refs/remotes/origin/release:
+# the pull_request fetch path has something to fetch.
+git_q -C "$UP" branch release "$C0"
+
+SHALLOW="$FIX/shallow"
+git_q clone -q --depth 1 "file://$UP" "$SHALLOW" 2>/dev/null
+
+ZEROS=0000000000000000000000000000000000000000
+
+# scenario <edits...>  -- a detached commit on top of C0 in $REPO carrying the
+# edits, each spelled `M:<rel>` (modify), `A:<rel>` (add), `D:<rel>` (delete),
+# `R:<from>:<to>` (rename). Prints the commit sha.
+scenario() {
+  git_q -C "$REPO" checkout -q --detach "$C0"
+  local edit kind rel to
+  for edit in "$@"; do
+    kind=${edit%%:*}
+    rel=${edit#*:}
+    case "$kind" in
+      M) printf '%s\n' "revised $RANDOM" >> "$REPO/$rel" ;;
+      A) mkdir -p "$(dirname "$REPO/$rel")"; printf 'added\n' > "$REPO/$rel" ;;
+      D) rm -f "$REPO/$rel" ;;
+      R) to=${rel#*:}; rel=${rel%%:*}; mkdir -p "$(dirname "$REPO/$to")"; mv "$REPO/$rel" "$REPO/$to" ;;
+    esac
+  done
+  git_q -C "$REPO" add -A
+  git_q -C "$REPO" commit -q -m "scenario: $*"
+  git_q -C "$REPO" rev-parse HEAD
+}
+
+# ── The runner and the assertions ───────────────────────────────────────────
+RT=''
+rc=0
+# run_case <label> <cwd> <event> <pr base ref> <merge-group base sha>
+run_case() {
+  label=$1
+  cases=$((cases + 1))
+  RT="$FIX/rt-$cases"
+  mkdir -p "$RT"
+  : > "$RT/github-output"
+  : > "$RT/step-summary"
+  (
+    cd "$2" && RUNNER_TEMP="$RT" GITHUB_OUTPUT="$RT/github-output" GITHUB_STEP_SUMMARY="$RT/step-summary" \
+      OS_GATE_EVENT_NAME="$3" OS_GATE_PR_BASE_REF="$4" OS_GATE_MERGE_GROUP_BASE_SHA="$5" \
+      bash "$SCRIPT"
+  ) > "$RT/out.txt" 2>&1
+  rc=$?
+  echo "case: $label"
+}
+
+# Captured script output is echoed INDENTED: the Actions runner parses a
+# `::warning::` at line start into a real annotation, and the failing case
+# must not mint one on the lint job's behalf.
+show_output() {
+  echo "        -- output --"
+  sed 's/^/        | /' "$RT/out.txt"
+  if [ -s "$RT/gate-families.txt" ]; then
+    echo "        -- gate-families.txt --"
+    sed 's/^/        | /' "$RT/gate-families.txt"
+  fi
+}
+
+ok() { checks=$((checks + 1)); printf '  ok    %s\n' "$1"; }
+bad() {
+  checks=$((checks + 1))
+  fail=1
+  printf '  FAIL  %s\n' "$1"
+  shift
+  while [ $# -gt 0 ]; do printf '        %s\n' "$1"; shift; done
+  show_output
+}
+
+expect_rc() {
+  if [ "$rc" -eq "$1" ]; then ok "exit $1"; else bad "exit $1" "got exit $rc"; fi
+}
+
+# expect_file_is <label> <file> <expected content, newline-separated>
+expect_file_is() {
+  printf '%s' "$3" > "$RT/want.txt"
+  if [ -n "$3" ]; then printf '\n' >> "$RT/want.txt"; fi
+  if diff -u "$RT/want.txt" "$2" > "$RT/diff.txt"; then
+    ok "$1"
+  else
+    bad "$1" "$(sed 's/^/diff: /' "$RT/diff.txt" | tr '\n' ' ')"
+  fi
+}
+
+expect_warnings() {
+  grep '^::warning::' "$RT/out.txt" > "$RT/warnings.txt"
+  expect_file_is "warnings: ${1:-none}" "$RT/warnings.txt" "$2"
+}
+expect_line() {
+  if grep -qF -- "$1" "$RT/out.txt"; then ok "prints: $1"; else bad "prints: $1"; fi
+}
+expect_no_line() {
+  if grep -qF -- "$1" "$RT/out.txt"; then bad "does not print: $1"; else ok "does not print: $1"; fi
+}
+
+# The verdict per family, as `id=run|skip` lines in family order -- read from
+# gate-families.txt AND from the $GITHUB_OUTPUT file, which must agree.
+verdicts() { awk '{ print $1 "=" $2 }' "$RT/gate-families.txt"; }
+# expect_verdicts <run ids...> -- every family in ALL is expected `run` when
+# named, `skip` otherwise.
+expect_verdicts() {
+  local id want='' v
+  for id in $ALL; do
+    v=skip
+    case " $* " in *" $id "*) v=run ;; esac
+    want="$want$id=$v"$'\n'
+  done
+  want=${want%$'\n'}
+  printf '%s\n' "$want" > "$RT/want-verdicts.txt"
+  if [ "$(verdicts)" = "$want" ]; then
+    ok "verdicts: run={$*}"
+  else
+    bad "verdicts: run={$*}" "got: $(verdicts | tr '\n' ' ')"
+  fi
+  if [ "$(cat "$RT/github-output")" = "$want" ]; then
+    ok 'GITHUB_OUTPUT carries the same verdicts'
+  else
+    bad 'GITHUB_OUTPUT carries the same verdicts' "got: $(tr '\n' ' ' < "$RT/github-output")"
+  fi
+}
+expect_all_run() { expect_verdicts $ALL; }
+# expect_reason <id> <fragment>
+expect_reason() {
+  if awk -v id="$1" '$1 == id { $1 = ""; $2 = ""; print }' "$RT/gate-families.txt" | grep -qF -- "$2"; then
+    ok "$1 reason mentions: $2"
+  else
+    bad "$1 reason mentions: $2" "got: $(awk -v id="$1" '$1 == id' "$RT/gate-families.txt")"
+  fi
+}
+expect_changed() { expect_file_is "changed files: $1" "$RT/gate-changed-files.txt" "$2"; }
+
+echo "select-gate-families selftest  (fixture: C0=${C0:0:7} C1=${C1:0:7})"
+
+# ── usage and --families ────────────────────────────────────────────────────
+cases=$((cases + 1)); RT="$FIX/rt-$cases"; mkdir -p "$RT"
+(cd "$REPO" && env -u RUNNER_TEMP OS_GATE_EVENT_NAME=push bash "$SCRIPT") > "$RT/out.txt" 2>&1
+rc=$?
+echo "case: usage: no RUNNER_TEMP is a usage error, not a selection"
+expect_rc 2
+expect_line 'usage: RUNNER_TEMP='
+
+cases=$((cases + 1)); RT="$FIX/rt-$cases"; mkdir -p "$RT"
+(cd "$REPO" && bash "$SCRIPT" --families) > "$RT/out.txt" 2>&1
+rc=$?
+echo "case: --families prints the family ids in job order"
+expect_rc 0
+expect_file_is 'the five ids' "$RT/out.txt" "$(printf '%s\n' $ALL)"
+
+# ── events that are not scoped ──────────────────────────────────────────────
+S=$(scenario M:docs/guide.md)
+run_case 'push: every family runs, no warning -- the full battery by design' "$REPO" push '' ''
+expect_rc 0
+expect_warnings '' ''
+expect_all_run
+expect_reason pm_dispatch_gates "event 'push' is not scoped"
+expect_line 'Gate families: 5 run, 0 skipped'
+
+run_case 'schedule: every family runs (the hourly full run keeps the battery)' "$REPO" schedule '' ''
+expect_rc 0
+expect_warnings '' ''
+expect_all_run
+
+run_case 'no event at all: every family runs' "$REPO" '' '' ''
+expect_rc 0
+expect_all_run
+expect_reason verify_lock "event '<none>' is not scoped"
+
+run_case 'push: the event decides, not the variables that happen to be set' "$REPO" push main "$C0"
+expect_rc 0
+expect_all_run
+
+# ── merge_group: the card's four cases ──────────────────────────────────────
+S=$(scenario M:scripts/pm/tool.mjs)
+run_case 'merge_group: a scripts/pm change runs the PM dispatch-gates self-test (and, for a .mjs, the corpus walk)' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+expect_verdicts pm_dispatch_gates comment_mask_corpus
+expect_reason pm_dispatch_gates 'scripts/pm/tool.mjs (M, scripts)'
+expect_changed 'one M' "M scripts/pm/tool.mjs"
+expect_line "Gate-family diff base: $C0  (the merge group's base_sha)"
+expect_line 'Gate families: 2 run, 3 skipped'
+
+S=$(scenario M:scripts/pm/README.md)
+run_case 'merge_group: a scripts/pm prose change runs the PM dispatch-gates self-test alone' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+expect_verdicts pm_dispatch_gates
+expect_line 'Gate families: 1 run, 4 skipped'
+
+S=$(scenario M:docs/guide.md M:content/docs/page.mdx M:.changeset/first.md M:README.md)
+run_case 'merge_group: a docs-only group skips every family, and prints it' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+expect_verdicts
+expect_reason pm_dispatch_gates 'no changed path is in its read-set'
+expect_line 'Gate families: 0 run, 5 skipped'
+expect_line 'skip  pm_dispatch_gates'
+expect_line 'skip  comment_mask_corpus'
+if grep -q '^| `pm_dispatch_gates` | skip |' "$RT/step-summary" && grep -q '^## Gate families: 0 run, 5 skipped' "$RT/step-summary"; then
+  ok 'the step summary lists the skipped families'
+else
+  bad 'the step summary lists the skipped families' "$(tr '\n' ' ' < "$RT/step-summary")"
+fi
+
+S=$(scenario M:.github/workflows/lint.yml)
+run_case 'merge_group: a workflow change runs the PM dispatch-gates self-test' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+expect_verdicts pm_dispatch_gates
+expect_reason pm_dispatch_gates '(M, workflow)'
+
+S=$(scenario M:docs/guide.md A:brand-new-dir/thing.txt)
+run_case 'merge_group: an UNKNOWN path runs every family' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+expect_all_run
+expect_reason slot_lookup "unclassified path 'brand-new-dir/thing.txt'"
+
+S=$(scenario M:lychee.toml)
+run_case 'merge_group: an unlisted ROOT file is unknown too' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_all_run
+expect_reason comment_mask_corpus "unclassified path 'lychee.toml'"
+
+# ── merge_group: fail-open on structure and shape ──────────────────────────
+S=$(scenario D:docs/guide.md)
+run_case 'merge_group: a DELETION anywhere runs every family (structural)' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+expect_all_run
+expect_reason verify_lock 'structural change (D docs/guide.md)'
+
+S=$(scenario R:docs/guide.md:docs/guide-renamed.md)
+run_case 'merge_group: a RENAME arrives as D + A and runs every family' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_all_run
+expect_reason verify_lock 'structural change (D docs/guide.md)'
+expect_changed 'D then A, no R record' "A docs/guide-renamed.md
+D docs/guide.md"
+
+S=$(scenario A:docs/new-page.md)
+run_case 'merge_group: an ADDED docs file runs the name-sweeping family only' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+expect_verdicts pm_dispatch_gates
+expect_reason pm_dispatch_gates 'docs/new-page.md (A, docs)'
+
+git_q -C "$REPO" checkout -q --detach "$C0"
+run_case 'merge_group: an EMPTY diff runs every family rather than selecting nothing' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '#10057' "::warning::The diff against $C0 listed no changed files; every gate family runs rather than selecting nothing (#10057)."
+expect_all_run
+expect_changed 'empty' ''
+
+S=$(scenario M:docs/guide.md)
+run_case 'merge_group: no base_sha in the payload' "$REPO" merge_group '' ''
+expect_rc 0
+expect_warnings 'no base' '::warning::This merge_group event carries no base_sha, so the gate-family diff base cannot be computed; every family runs.'
+expect_all_run
+expect_reason pm_dispatch_gates 'no base_sha in the merge_group event'
+
+run_case 'merge_group: an unfetchable base_sha warns twice and runs everything' "$REPO" merge_group '' "$ZEROS"
+expect_rc 0
+expect_warnings 'fetch + resolve' "::warning::Could not fetch the merge group's base $ZEROS; the resolution below will decide.
+::warning::Could not resolve the merge group's base '$ZEROS' in this checkout; every gate family runs rather than guessing which paths changed (#16453)."
+expect_all_run
+
+if git_q -C "$SHALLOW" cat-file -e "$C0^{commit}" 2>/dev/null; then
+  bad 'precondition: the shallow clone lacks C0 before the fetch case'
+else
+  ok 'precondition: the shallow clone lacks C0 before the fetch case'
+fi
+run_case 'merge_group: a base_sha absent from a shallow checkout is fetched BY SHA, then decided' "$SHALLOW" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+if git_q -C "$SHALLOW" cat-file -e "$C0^{commit}" 2>/dev/null; then
+  ok 'C0 is present after the run (the fetch happened)'
+else
+  bad 'C0 is present after the run (the fetch happened)'
+fi
+expect_verdicts
+expect_changed 'the docs edit C0..C1' "M docs/guide.md"
+
+S=$(scenario "A:docs/we$(printf '\t')ird.md")
+if git_q -C "$REPO" ls-files -z | tr '\0' '\n' | grep -q 'docs/we.ird\.md'; then
+  ok 'precondition: the fixture carries a path with a control character'
+else
+  bad 'precondition: the fixture carries a path with a control character'
+fi
+run_case 'merge_group: a path the script cannot spell runs every family' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings 'unspellable' '::warning::A changed path carries a control character and cannot be classified; every gate family runs.'
+expect_all_run
+
+# ── merge_group: the per-family read-sets ──────────────────────────────────
+S=$(scenario M:packages/a/src/index.ts)
+run_case 'merge_group: a packages TS edit runs both ratchets, the corpus AND the PM self-test (it reads every source), not the lock self-test' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+expect_verdicts pm_dispatch_gates query_options_erasure slot_lookup comment_mask_corpus
+expect_reason query_options_erasure '(M, workspace)'
+expect_reason comment_mask_corpus packages/a/src/index.ts
+expect_reason pm_dispatch_gates packages/a/src/index.ts
+
+S=$(scenario M:apps/site/src/page.tsx)
+run_case 'merge_group: an apps TSX edit is outside the ratchets (packages/** only) but inside the corpus and the PM census' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_verdicts pm_dispatch_gates comment_mask_corpus
+
+S=$(scenario M:packages/a/package.json)
+run_case 'merge_group: a package manifest runs the PM self-test and the lock self-test (workspace enumeration), no ratchet' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_verdicts pm_dispatch_gates verify_lock
+expect_reason pm_dispatch_gates packages/a/package.json
+expect_reason verify_lock packages/a/package.json
+
+S=$(scenario M:packages/a/.gitignore)
+run_case 'merge_group: a nested .gitignore runs the PM self-test (exposed-scratch-dir sweep) alone' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_verdicts pm_dispatch_gates
+expect_reason pm_dispatch_gates packages/a/.gitignore
+
+S=$(scenario M:packages/a/src/data.json)
+run_case 'merge_group: a non-source, non-manifest workspace file skips every family' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+expect_verdicts
+
+S=$(scenario M:packages/a/scripts/build.mjs)
+run_case 'merge_group: a package-local script is a gate source (PM) and a masked source (corpus)' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_verdicts pm_dispatch_gates comment_mask_corpus
+
+S=$(scenario M:scripts/pm/os-verify-lock.sh)
+run_case 'merge_group: the lock script runs its own self-test and the PM self-test' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_verdicts pm_dispatch_gates verify_lock
+expect_reason verify_lock '(M, verify-lock)'
+
+S=$(scenario M:scripts/helper.mjs)
+run_case 'merge_group: a top-level scripts module is imported by the ratchets AND the lock preflight, and is a masked source' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_all_run
+expect_reason verify_lock scripts/helper.mjs
+
+S=$(scenario M:scripts/slot-lookup-baseline.json)
+run_case 'merge_group: a ratchet baseline runs the ratchets and the PM self-test' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_verdicts pm_dispatch_gates query_options_erasure slot_lookup
+
+S=$(scenario M:scripts/ci/tool.sh)
+run_case 'merge_group: a scripts/ subdirectory script is a gate source only' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_verdicts pm_dispatch_gates
+
+S=$(scenario M:.claude/agents/os-dev.md M:skills/x/SKILL.md M:AGENTS.md)
+run_case 'merge_group: agent configuration runs the PM self-test only' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_verdicts pm_dispatch_gates
+
+S=$(scenario M:package.json)
+run_case 'merge_group: root configuration runs every family' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_warnings '' ''
+expect_all_run
+expect_reason verify_lock '(M, root-config)'
+
+S=$(scenario M:pnpm-workspace.yaml)
+run_case 'merge_group: the workspace manifest is root configuration too' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_all_run
+
+S=$(scenario M:docs/guide.md M:packages/a/src/index.test.ts M:.github/workflows/lint.yml)
+run_case 'merge_group: a mixed group runs the union of what its paths reach' "$REPO" merge_group '' "$C0"
+expect_rc 0
+expect_verdicts pm_dispatch_gates query_options_erasure slot_lookup comment_mask_corpus
+expect_line 'Gate families: 4 run, 1 skipped'
+
+# ── pull_request ────────────────────────────────────────────────────────────
+git_q -C "$REPO" checkout -q -B feature "$C0"
+printf '# guide, on the feature branch\n' > "$REPO/docs/guide.md"
+git_q -C "$REPO" commit -q -am 'F1: docs on the feature branch'
+F1=$(git_q -C "$REPO" rev-parse HEAD)
+run_case 'pull_request: decided against merge-base(origin/main, HEAD)' "$REPO" pull_request main ''
+expect_rc 0
+expect_warnings '' ''
+expect_verdicts
+expect_line "Gate-family diff base: $C0  (merge-base of origin/main and HEAD)"
+expect_changed 'the feature edit only, not C1' "M docs/guide.md"
+
+run_case 'pull_request: no base branch in the payload' "$REPO" pull_request '' ''
+expect_rc 0
+expect_warnings 'no base' '::warning::This pull_request event carries no base branch, so the gate-family diff base cannot be computed; every family runs.'
+expect_all_run
+
+if git_q -C "$REPO" rev-parse -q --verify refs/remotes/origin/release > /dev/null; then
+  bad 'precondition: origin/release is absent before the fetch case'
+else
+  ok 'precondition: origin/release is absent before the fetch case'
+fi
+run_case 'pull_request: a base ref absent locally is fetched, then decided' "$REPO" pull_request release ''
+expect_rc 0
+expect_warnings '' ''
+if git_q -C "$REPO" rev-parse -q --verify refs/remotes/origin/release > /dev/null; then
+  ok 'origin/release exists after the run (the fetch happened)'
+else
+  bad 'origin/release exists after the run (the fetch happened)'
+fi
+expect_verdicts
+
+run_case 'pull_request: an unfetchable base ref warns twice and runs everything' "$REPO" pull_request nope ''
+expect_rc 0
+expect_warnings 'fetch + #6195' '::warning::Could not fetch origin/nope; the merge-base resolution below will decide.
+::warning::Could not resolve merge-base(origin/nope, HEAD); every gate family runs rather than guessing which paths changed (#6195).'
+expect_all_run
+
+# ── The YAML half of the contract ───────────────────────────────────────────
+# Read from the real workflow: the selector step, the `if:` spellings, and
+# the family set. A stale or mis-spelled `if:` is invisible to every other
+# gate (a step that always runs looks exactly like a step that was scoped and
+# selected), so it is pinned here beside the script that feeds it.
+cases=$((cases + 1))
+echo "case: lint.yml wires the selector and scopes exactly the families the script decides"
+WF="$PWD/$WORKFLOW_REL"
+if grep -qE '^ {8}id: gate-families$' "$WF"; then ok 'the selector step carries id gate-families'; else bad 'the selector step carries id gate-families'; fi
+if grep -qE "^ {10}bash $SCRIPT_REL$" "$WF"; then ok "the selector step runs $SCRIPT_REL"; else bad "the selector step runs $SCRIPT_REL"; fi
+for var in OS_GATE_EVENT_NAME OS_GATE_PR_BASE_REF OS_GATE_MERGE_GROUP_BASE_SHA; do
+  if grep -qE "^ {10}$var: \\$\\{\\{ github\\." "$WF"; then ok "the selector step exports $var"; else bad "the selector step exports $var"; fi
+done
+grep -oE "steps\.gate-families\.outputs\.[a-z_]+ *[!=]= *'[a-z]+'" "$WF" | sort > "$FIX/ifs.txt"
+if grep -vqE " != 'skip'$" "$FIX/ifs.txt"; then
+  bad "every scoped step spells \`!= 'skip'\` (an absent output runs the step)" "$(grep -vE " != 'skip'$" "$FIX/ifs.txt" | tr '\n' ' ')"
+else
+  ok "every scoped step spells \`!= 'skip'\` (an absent output runs the step)"
+fi
+if grep -qE "gate-families\.outputs\.[a-z_]+ *== *'run'" "$WF"; then
+  bad "no step spells \`== 'run'\` (a fail-closed reading)"
+else
+  ok "no step spells \`== 'run'\` (a fail-closed reading)"
+fi
+sed -E "s/^steps\.gate-families\.outputs\.([a-z_]+).*/\1/" "$FIX/ifs.txt" | sort -u > "$FIX/scoped.txt"
+bash "$SCRIPT" --families | sort -u > "$FIX/decided.txt"
+if diff -u "$FIX/decided.txt" "$FIX/scoped.txt" > "$FIX/families.diff"; then
+  ok "the workflow scopes exactly the families the script decides ($(wc -l < "$FIX/decided.txt" | tr -d ' '))"
+else
+  bad 'the workflow scopes exactly the families the script decides' "$(sed 's/^/diff: /' "$FIX/families.diff" | tr '\n' ' ')"
+fi
+if [ "$(grep -cE "steps\.gate-families\.outputs\.[a-z_]+ != 'skip'" "$WF")" -eq "$(wc -l < "$FIX/decided.txt" | tr -d ' ')" ]; then
+  ok 'each family gates exactly one step'
+else
+  bad 'each family gates exactly one step' "got $(grep -cE "steps\.gate-families\.outputs\.[a-z_]+ != 'skip'" "$WF") if: lines"
+fi
+# Each scoped step's `if:` must sit on the step running that family's command.
+pin_step() {
+  # pin_step <family> <command fragment>
+  if awk -v fam="$1" -v cmd="$2" '
+    index($0, "if: steps.gate-families.outputs." fam " != '"'"'skip'"'"'") { armed = NR }
+    armed && NR > armed && NR <= armed + 2 && index($0, cmd) { found = 1 }
+    END { exit found ? 0 : 1 }' "$WF"; then
+    ok "$1 gates the step running: $2"
+  else
+    bad "$1 gates the step running: $2"
+  fi
+}
+pin_step pm_dispatch_gates 'pnpm check:pm-dispatch-gates'
+pin_step query_options_erasure 'pnpm check:query-options-erasure'
+pin_step slot_lookup 'pnpm check:slot-lookup'
+# Pinned by the script name alone: spelling the flag that step passes in code
+# here would read, to check-self-test-wired, as a self-test flag of THIS file
+# that no workflow passes.
+pin_step verify_lock 'bash scripts/pm/os-verify-lock.sh'
+pin_step comment_mask_corpus 'node scripts/check-comment-mask-corpus.mjs'
+
+# ── Verdict ─────────────────────────────────────────────────────────────────
+# #4690: a battery that ran nothing is a failure, never a pass.
+if [ "$cases" -lt 30 ] || [ "$checks" -lt 120 ]; then
+  echo "SELFTEST FAILED: only $cases case(s) / $checks check(s) ran -- the battery is short"
+  exit 1
+fi
+if [ "$fail" -ne 0 ]; then
+  echo "SELFTEST FAILED ($cases cases, $checks checks)"
+  exit 1
+fi
+echo "all $cases cases passed ($checks checks)"
diff --git a/scripts/ci/select-gate-families.sh b/scripts/ci/select-gate-families.sh
new file mode 100644
index 0000000000..95aad78301
--- /dev/null
+++ b/scripts/ci/select-gate-families.sh
@@ -0,0 +1,416 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+#
+# select-gate-families -- which scoped `Lint & Repo Gates` families this run
+# pays for, decided from the event and the changed paths (#16496).
+#
+#   OS_GATE_EVENT_NAME=merge_group OS_GATE_MERGE_GROUP_BASE_SHA=<sha> \
+#   RUNNER_TEMP=/tmp/rt bash scripts/ci/select-gate-families.sh
+#   OS_GATE_EVENT_NAME=pull_request OS_GATE_PR_BASE_REF=main \
+#   RUNNER_TEMP=/tmp/rt bash scripts/ci/select-gate-families.sh
+#   bash scripts/ci/select-gate-families.sh --families   # the family ids, one per line
+#   bash scripts/ci/select-gate-families.selftest.sh      # every branch, offline
+#
+# Environment in, three things out: $RUNNER_TEMP/gate-families.txt (one
+# line per family: `<id> <run|skip> <reason>`), $RUNNER_TEMP/gate-changed-
+# files.txt (the `<status> <path>` list the decision was taken over), and --
+# when the runner provides them -- one `<id>=run|skip` line per family
+# appended to `$GITHUB_OUTPUT` and a table appended to `$GITHUB_STEP_SUMMARY`.
+# Exit 0 on every decided outcome; exit 2 on a usage error.
+#
+# ## The invariant: FAIL-OPEN
+#
+# This script makes a REQUIRED status check verify fewer families at merge
+# time, and the single property that keeps that safe is that every doubt
+# resolves to "run". Concretely, EVERY family runs when:
+#
+#   - the event is anything but `merge_group` or `pull_request` (`push` on
+#     main and the scheduled full run keep the whole battery, by design);
+#   - the diff base cannot be named or resolved, or `git diff` fails;
+#   - the changed-file list is EMPTY (on a pull_request that is the #10057
+#     shape -- a selection that produced nothing -- and on a merge group it is
+#     a tree identical to its base; both are cheaper to re-verify than to
+#     reason about);
+#   - any changed path is one the classifier below does not recognise (a new
+#     top-level directory, a root file nobody listed), or one it cannot spell
+#     (a control character in the name);
+#   - any change is STRUCTURAL: a deletion, rename, copy or type change. Two
+#     of the families sweep the tracked NAME set (see the read-sets below),
+#     and a name that disappears can move a verdict that no content read
+#     would.
+#
+# A family is skipped ONLY when every changed path is, for that family, a
+# path it provably does not read -- a positive classification into a class
+# the family's read-set excludes. There is no "skip" default anywhere in this
+# file: an unmatched `case` arm falls through to "run".
+#
+# ## The families and their read-sets (measured, see the PR that landed this)
+#
+# The workflow steps carry `if: steps.gate-families.outputs.<id> != 'skip'`,
+# so an output that is absent -- the selector never ran, or ran and wrote
+# nothing -- also runs the step. The YAML half of that contract is pinned by
+# the self-test, which reads lint.yml and refuses any other spelling.
+#
+#   pm_dispatch_gates      `pnpm check:pm-dispatch-gates`. Its self-test
+#                          discovers every workflow file, resolves every
+#                          check:* script through the root and package
+#                          `package.json`s, reads each gate's source for its
+#                          watch hints (so ALL of scripts/** and every
+#                          packages/*/scripts/**), reads .claude/**,
+#                          skills/** (the frame-sync COPIES table),
+#                          `AGENTS.md`, `CLAUDE.md`, `tsconfig.json`,
+#                          .gitignore, and sweeps `git ls-files` for hint
+#                          reachability and test-file residue. It also reads
+#                          the CONTENT of every JS/TS file in the tree: the
+#                          compound-anchor census of `function ...SelfTest...(`
+#                          declarations asserts none is unlisted, and the
+#                          exposed-scratch-dir sweep reads every
+#                          mkdtempSync/mkdirSync caller and consults nested
+#                          .gitignore files. So any masked source file and any
+#                          .gitignore runs it, and because the name sweep reads
+#                          the tracked NAME set an ADDED file anywhere runs it
+#                          too; only modifications of docs, changesets and
+#                          non-source workspace files that are neither a
+#                          manifest nor a script skip it.
+#   query_options_erasure  `pnpm check:query-options-erasure`. Lints
+#                          packages/**/*.{ts,tsx,mts,cts} under
+#                          `eslint.config.mjs`, reads its baseline
+#                          (scripts/query-options-erasure-baseline.json,
+#                          at HEAD and at the merge base), and imports a few
+#                          top-level scripts/*.mjs helpers.
+#   slot_lookup            `pnpm check:slot-lookup`. Same shape and the same
+#                          population, with scripts/slot-lookup-baseline.json.
+#   verify_lock            `bash scripts/pm/os-verify-lock.sh --self-test`.
+#                          Reads itself and a private temp dir, and its case
+#                          (h) runs the real entry point from the repo root,
+#                          which routes through filter_preflight ->
+#                          scripts/pnpm-filter-targets.mjs --preflight: the
+#                          top-level scripts/*.mjs helpers that imports,
+#                          pnpm-workspace.yaml and every workspace
+#                          package.json.
+#   comment_mask_corpus    `node scripts/check-comment-mask-corpus.mjs`. Walks
+#                          every `.ts .tsx .mts .cts .js .mjs .cjs .jsx` file
+#                          in the tree outside build directories.
+#
+# Root configuration (`package.json`, `pnpm-lock.yaml`, `pnpm-workspace.yaml`,
+# `turbo.json`, `tsconfig.json`, `eslint.config.mjs`, .gitignore,
+# .gitattributes, .npmrc, .nvmrc) runs every family: a parser or
+# dependency bump moves all of them. ESLint itself is not scoped (card
+# ruling 2), nor is any step whose reads this file cannot name.
+#
+# ## The interface
+#
+#   OS_GATE_EVENT_NAME            `github.event_name`
+#   OS_GATE_PR_BASE_REF           `github.event.pull_request.base.ref`
+#   OS_GATE_MERGE_GROUP_BASE_SHA  `github.event.merge_group.base_sha`
+#   RUNNER_TEMP                   the runner's temp dir; the outputs land here
+#   GITHUB_OUTPUT                 optional; `<id>=run|skip` lines are appended
+#   GITHUB_STEP_SUMMARY           optional; the ran/skipped table is appended
+#
+# Variables absent from the event are empty strings, which is what the runner
+# hands over for an expression that does not apply -- a local run sets only
+# the ones its event carries. Same shape as select-shard-packages.sh (#16453),
+# whose self-test this one's mirrors.
+set -euo pipefail
+
+# The family ids, in the order the job runs them. `--families` prints them so
+# the self-test can pin the workflow's `if:` set against this list without a
+# second transcription.
+FAMILIES='pm_dispatch_gates query_options_erasure slot_lookup verify_lock comment_mask_corpus'
+
+if [ "${1:-}" = '--families' ]; then
+  for id in $FAMILIES; do echo "$id"; done
+  exit 0
+fi
+
+if [ -z "${RUNNER_TEMP:-}" ]; then
+  echo "usage: RUNNER_TEMP=<dir> OS_GATE_EVENT_NAME=<event> [OS_GATE_PR_BASE_REF=… OS_GATE_MERGE_GROUP_BASE_SHA=…] bash scripts/ci/select-gate-families.sh" >&2
+  echo "       bash scripts/ci/select-gate-families.sh --families" >&2
+  exit 2
+fi
+
+# Every path below is repo-relative, so stand on the repository root whatever
+# directory the caller stood on.
+cd "$(git rev-parse --show-toplevel)"
+
+EVENT_NAME="${OS_GATE_EVENT_NAME:-}"
+BASE_REF="${OS_GATE_PR_BASE_REF:-}"
+MERGE_GROUP_BASE_SHA="${OS_GATE_MERGE_GROUP_BASE_SHA:-}"
+
+OUT="$RUNNER_TEMP/gate-families.txt"
+CHANGED="$RUNNER_TEMP/gate-changed-files.txt"
+: > "$OUT"
+: > "$CHANGED"
+
+# ── Emitting a decision ─────────────────────────────────────────────────────
+# One writer for every outcome, so the three outputs cannot disagree.
+# emit <id> <run|skip> <reason>
+emit() {
+  printf '%s %s %s\n' "$1" "$2" "$3" >> "$OUT"
+}
+
+# Decisions are accumulated in `$OUT` and published once, here: the outputs
+# file, the step summary and the log line the seat reads.
+publish() {
+  local ran=0 skipped=0 id verdict reason
+  while read -r id verdict reason; do
+    if [ "$verdict" = skip ]; then skipped=$((skipped + 1)); else ran=$((ran + 1)); fi
+    if [ -n "${GITHUB_OUTPUT:-}" ]; then
+      echo "$id=$verdict" >> "$GITHUB_OUTPUT"
+    fi
+  done < "$OUT"
+  echo "Gate families: $ran run, $skipped skipped  (event: ${EVENT_NAME:-<none>}; changed paths: $(wc -l < "$CHANGED" | tr -d ' '))"
+  while read -r id verdict reason; do
+    printf '  %-5s %-22s %s\n' "$verdict" "$id" "$reason"
+  done < "$OUT"
+  if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+    {
+      echo "## Gate families: $ran run, $skipped skipped"
+      echo
+      echo "| family | verdict | why |"
+      echo "|---|---|---|"
+      while read -r id verdict reason; do
+        printf '| `%s` | %s | %s |\n' "$id" "$verdict" "$reason"
+      done < "$OUT"
+      echo
+      echo "Event \`${EVENT_NAME:-<none>}\`, $(wc -l < "$CHANGED" | tr -d ' ') changed path(s); selection by \`scripts/ci/select-gate-families.sh\` (#16496)."
+    } >> "$GITHUB_STEP_SUMMARY"
+  fi
+}
+
+# run_everything <reason>  -- the fail-open exit: every family runs, one line
+# says why, and the script exits 0 because a full battery is a decision, not
+# a failure.
+run_everything() {
+  local id
+  : > "$OUT"
+  for id in $FAMILIES; do emit "$id" run "$1"; done
+  publish
+  exit 0
+}
+
+# ── Which event, which base ─────────────────────────────────────────────────
+case "$EVENT_NAME" in
+  merge_group|pull_request) ;;
+  *)
+    # Not a warning: `push` on main and the scheduled full run take this
+    # branch by design, and a runner annotation on every one of them would
+    # teach readers to skim the surface real fallbacks report into.
+    run_everything "event '${EVENT_NAME:-<none>}' is not scoped -- the full battery runs"
+    ;;
+esac
+
+SCM_BASE=''
+if [ "$EVENT_NAME" = pull_request ]; then
+  if [ -z "$BASE_REF" ]; then
+    echo "::warning::This pull_request event carries no base branch, so the gate-family diff base cannot be computed; every family runs."
+    run_everything 'no base branch in the pull_request event'
+  fi
+  # `fetch-depth: 0` already makes this resolve -- the fetch is the guard for
+  # the day that changes, exactly as in select-shard-packages.sh.
+  if ! git cat-file -e "refs/remotes/origin/$BASE_REF^{commit}" 2>/dev/null; then
+    git fetch --no-tags --quiet origin "+refs/heads/$BASE_REF:refs/remotes/origin/$BASE_REF" \
+      || echo "::warning::Could not fetch origin/$BASE_REF; the merge-base resolution below will decide."
+  fi
+  if ! SCM_BASE=$(git merge-base "refs/remotes/origin/$BASE_REF" HEAD 2>/dev/null); then
+    SCM_BASE=''
+  fi
+  if [ -z "$SCM_BASE" ]; then
+    echo "::warning::Could not resolve merge-base(origin/$BASE_REF, HEAD); every gate family runs rather than guessing which paths changed (#6195)."
+    run_everything "merge-base(origin/$BASE_REF, HEAD) unresolvable"
+  fi
+  echo "Gate-family diff base: $SCM_BASE  (merge-base of origin/$BASE_REF and HEAD)"
+fi
+if [ "$EVENT_NAME" = merge_group ]; then
+  if [ -z "$MERGE_GROUP_BASE_SHA" ]; then
+    echo "::warning::This merge_group event carries no base_sha, so the gate-family diff base cannot be computed; every family runs."
+    run_everything 'no base_sha in the merge_group event'
+  fi
+  if ! git cat-file -e "$MERGE_GROUP_BASE_SHA^{commit}" 2>/dev/null; then
+    git fetch --no-tags --quiet origin "$MERGE_GROUP_BASE_SHA" \
+      || echo "::warning::Could not fetch the merge group's base $MERGE_GROUP_BASE_SHA; the resolution below will decide."
+  fi
+  if ! git cat-file -e "$MERGE_GROUP_BASE_SHA^{commit}" 2>/dev/null; then
+    echo "::warning::Could not resolve the merge group's base '$MERGE_GROUP_BASE_SHA' in this checkout; every gate family runs rather than guessing which paths changed (#16453)."
+    run_everything "merge group base '$MERGE_GROUP_BASE_SHA' unresolvable"
+  fi
+  SCM_BASE="$MERGE_GROUP_BASE_SHA"
+  echo "Gate-family diff base: $SCM_BASE  (the merge group's base_sha)"
+fi
+
+# ── The changed-file list ───────────────────────────────────────────────────
+# `--name-status` rather than `--name-only`: the STATUS is a read-set input
+# (structural changes run everything, additions run the name-sweeping family).
+# `--no-renames` so a rename arrives as D + A and takes the structural branch
+# by construction. `-z` so a path with a newline in it cannot forge a record;
+# such a path is then refused below rather than classified.
+if ! git diff --name-status --no-renames -z "$SCM_BASE" HEAD > "$RUNNER_TEMP/gate-diff.z" 2>/dev/null; then
+  echo "::warning::git diff $SCM_BASE HEAD failed; every gate family runs."
+  run_everything "git diff $SCM_BASE HEAD failed"
+fi
+
+unspellable=0
+while IFS= read -r -d '' status && IFS= read -r -d '' path; do
+  case "$path" in
+    *[[:cntrl:]]*) unspellable=1; continue ;;
+  esac
+  printf '%s %s\n' "$status" "$path" >> "$CHANGED"
+done < "$RUNNER_TEMP/gate-diff.z"
+
+if [ "$unspellable" -ne 0 ]; then
+  echo "::warning::A changed path carries a control character and cannot be classified; every gate family runs."
+  run_everything 'a changed path cannot be spelled'
+fi
+if [ ! -s "$CHANGED" ]; then
+  echo "::warning::The diff against $SCM_BASE listed no changed files; every gate family runs rather than selecting nothing (#10057)."
+  run_everything "the diff against $SCM_BASE listed no changed files"
+fi
+
+# ── Classification ──────────────────────────────────────────────────────────
+# classify <path>  -- prints ONE class name. Every class named here is a set
+# of paths whose readers are known; `unknown` is the honest answer for the
+# rest and runs every family. Ordered: the first matching arm wins.
+classify() {
+  case "$1" in
+    .github/*)                       echo workflow ;;
+    scripts/pm/os-verify-lock.sh)    echo verify-lock ;;
+    scripts/*)                       echo scripts ;;
+    .claude/*|skills/*)              echo agent-config ;;
+    AGENTS.md|CLAUDE.md)             echo agent-config ;;
+    .changeset/*.md)                 echo changeset ;;
+    content/*|docs/*)                echo docs ;;
+    packages/*|apps/*|examples/*)    echo workspace ;;
+    package.json|pnpm-lock.yaml|pnpm-workspace.yaml|turbo.json|tsconfig.json|eslint.config.mjs|.gitignore|.gitattributes|.npmrc|.nvmrc)
+                                     echo root-config ;;
+    */*)                             echo unknown ;;
+    *.md)                            echo docs ;;
+    *)                               echo unknown ;;
+  esac
+}
+
+# The extension families. A path with no dot in its basename has no extension.
+is_ts_source() {
+  case "$1" in
+    *.ts|*.tsx|*.mts|*.cts) return 0 ;;
+  esac
+  return 1
+}
+is_masked_source() {
+  case "$1" in
+    *.ts|*.tsx|*.mts|*.cts|*.js|*.mjs|*.cjs|*.jsx) return 0 ;;
+  esac
+  return 1
+}
+
+# family_reads <id> <status> <path> <class>  -- exit 0 when the family must
+# run for this change. The *) arm of every `case` is "run": nothing here
+# skips by omission.
+family_reads() {
+  local id=$1 status=$2 path=$3 class=$4
+  case "$class" in unknown|root-config) return 0 ;; esac
+  case "$id" in
+    pm_dispatch_gates)
+      [ "$status" = M ] || return 0
+      # The self-test reads the CONTENT of every JS/TS file in the tree (the
+      # compound-anchor census of `function ...SelfTest...(` declarations, the
+      # exposed-scratch-dir sweep of every mkdtempSync/mkdirSync caller) and
+      # consults nested .gitignore files, so any masked source and any
+      # .gitignore runs it whatever class it sits in.
+      is_masked_source "$path" && return 0
+      case "$path" in */.gitignore) return 0 ;; esac
+      case "$class" in
+        docs|changeset) return 1 ;;
+        workspace)
+          case "$path" in
+            */package.json|*/scripts/*) return 0 ;;
+            *) return 1 ;;
+          esac
+          ;;
+        *) return 0 ;;
+      esac
+      ;;
+    query_options_erasure|slot_lookup)
+      case "$class" in
+        workspace)
+          # Both ratchets lint `packages/**` only; apps/ and examples/ are
+          # outside their LINT_TARGET.
+          case "$path" in
+            packages/*) is_ts_source "$path" && return 0; return 1 ;;
+            *) return 1 ;;
+          esac
+          ;;
+        scripts)
+          case "$path" in
+            scripts/*/*) return 1 ;;
+            *.mjs|*.json) return 0 ;;
+            *) return 1 ;;
+          esac
+          ;;
+        docs|changeset|workflow|agent-config|verify-lock) return 1 ;;
+        *) return 0 ;;
+      esac
+      ;;
+    verify_lock)
+      # Case (h) of its self-test runs `bash "$SELF" -c ...` from the real
+      # repo root, which routes through filter_preflight ->
+      # scripts/pnpm-filter-targets.mjs --preflight, importing top-level
+      # scripts/*.mjs helpers and reading pnpm-workspace.yaml (root config)
+      # plus every workspace package.json.
+      case "$path" in
+        */package.json) return 0 ;;
+      esac
+      case "$class" in
+        verify-lock) return 0 ;;
+        scripts)
+          case "$path" in
+            scripts/*/*) return 1 ;;
+            *.mjs) return 0 ;;
+            *) return 1 ;;
+          esac
+          ;;
+        docs|changeset|workflow|agent-config|workspace) return 1 ;;
+        *) return 0 ;;
+      esac
+      ;;
+    comment_mask_corpus)
+      is_masked_source "$path" && return 0
+      case "$class" in
+        docs|changeset|workflow|agent-config|scripts|workspace|verify-lock) return 1 ;;
+        *) return 0 ;;
+      esac
+      ;;
+    *) return 0 ;;
+  esac
+}
+
+# ── The decision ────────────────────────────────────────────────────────────
+structural=''
+while read -r status path; do
+  case "$status" in
+    A|M) ;;
+    *) structural="$status $path" ;;
+  esac
+done < "$CHANGED"
+if [ -n "$structural" ]; then
+  run_everything "structural change ($structural) -- deletions, renames and type changes run every family"
+fi
+
+for id in $FAMILIES; do
+  reason=''
+  while read -r status path; do
+    class=$(classify "$path")
+    if [ "$class" = unknown ]; then
+      run_everything "unclassified path '$path' -- every family runs"
+    fi
+    if family_reads "$id" "$status" "$path" "$class"; then
+      reason="reads $path ($status, $class)"
+      break
+    fi
+  done < "$CHANGED"
+  if [ -n "$reason" ]; then
+    emit "$id" run "$reason"
+  else
+    emit "$id" skip "no changed path is in its read-set"
+  fi
+done
+publish