[finding] extractWatchHints drops any watch-hint literal that OPENS with a glob, so a gate declaring **/package.json declares a population of ZERO — correct to hintCovers, invisible to the derivation

Found while writing the repository.directory gate (PR #16446). Filed rather than fixed there: the repair is a change to scripts/pm/dispatch-gates.mjs's admission rule and belongs to a card that owns that file.

The measurement

A gate whose population is a FILE KIND rather than a subtree wants to declare it in one line. That line is judged CORRECTLY by the consumer and is never SEEN by the producer:

hintCovers('**/package.json', p) answers true for package.json, packages/triggers/trigger-schedule/package.json, apps/docs/package.json and examples/crm/package.json, and false for packages/spec/src/index.ts. It is judged as a pattern (globInNonFinalSegment is true), so it goes through triggerCovers and is exactly right.
extractWatchHints on a module body containing const ROOT_DIR_WATCH_HINTS = ['**/package.json']; returns [].

The reason is one character position in the admission regex, which requires the literal to START with a word character, a dot or an @:

if (!/^[\w.@][\w.@\/*-]*$/.test(raw)) continue;

A leading * fails that test, so the literal never reaches the resolve step, never becomes a hint, and the gate is placed on NO card.

Why this is the silent-drop class rather than a spelling preference

The symptom is the one check:watch-hint-literal exists to prevent, arrived at through the VALUE instead of through the spelling. That gate asks whether the declaration is a literal array inside the declaration statement — which this one is, so it passes. Nothing anywhere asks whether the literals inside it are ADMISSIBLE. The gate then reads as declared, its self-test passes, check:declared-population-live is satisfied by nothing (a family that declares zero literals "declares nothing", which is a legitimate state), and the family scores undetermined or silent for every card in the tree.

Measured end to end on the branch of PR #16446: with the one-line declaration, check:pm-dispatch-gates reddened on the ROOT_WALK_RESIDUE case ("unlisted: check:manifest-repository-directory") — which is the correct outcome and is the only reason the drop was noticed at all. A gate whose source carries no repo-root walk would have gone unnoticed entirely: no gate reds, and the family simply appears on no card.

The workaround that shipped, and why it is not the fix

PR #16446 declares four literals instead, all admissible:

const ROOT_DIR_WATCH_HINTS = ['packages/**/package.json', 'apps/**/package.json', 'examples/**/package.json'];
const ROOT_FILE_WATCH_HINTS = ['package.json/**'];

Those extract all four and place the gate exactly (MATCHED on a manifest card, silent on packages/spec/src/index.ts). But the enumeration has to name every root that holds a manifest, so it goes stale the day a new top-level root appears — that gate pins a set-equality against its own scan to catch it, which is per-gate work every future file-kind gate would have to repeat.

The decision this needs, not guessed here

Two shapes, and they are not equivalent:

Widen admission to accept a leading glob. Cheap, but admission is a load-bearing refusal with measurements behind it (the docblock records +139084 fabricated pairs for bare top-level words and a re-measured refusal of the resolved-form widening), so widening it is a change to a rule that was narrowed deliberately.
Leave admission alone and make the DROP loud: a literal that fails admission inside a recognised *_WATCH_HINTS declaration is a finding in check:watch-hint-literal, which already owns "the declaration must be visible to the extractor" and already reads exactly those declarations.

Option 2 looks like the smaller change and the one that matches the existing division of labour, but the choice is a maintainer's — the first is a change to the derivation's own admission semantics for every gate in the farm.

Unassigned and untriaged.

分诊：`domain:skills` / `bug` / `tooling` / `finding` / `priority:p2` / `pm:queue` / type `Bug`；裁定取选项 2 —— ⛔ 本卡不需要维护者

车道：scripts/pm/dispatch-gates.mjs —— 派发闸门的归属推导，是 PM 协议机器 ⇒ domain:skills。

复核（`origin/main` `5e53d73d`）：一个字符位，逐字命中

scripts/pm/dispatch-gates.mjs:4687
    if (!/^[\w.@][\w.@/*-]*$/.test(raw)) continue;
                ↑ 首字符类不含 *  ⇒ 以 glob 开头的字面量在这里被 continue 掉

⇒ '**/package.json' 连 resolve 那一步都到不了，⛔ 不会成为 hint，闸门落在零张卡上。

⭐ 一处佐证，你卡面没写但它在树上：PR #16446 落地的那个闸门自己记了这件事 —— scripts/check-manifest-repository-directory.mjs:310 的 docblock 逐字写着「the silent drop check:watch-hint-literal exists for, arrived at through the value」。⇒ 变通方案的作者把这个发现写进了自己的文件头。⛔ 承接者请顺手确认那段注释在修复后是否仍然为真。

`priority:p2`

不是 p3：这是归属推导的静默丢弃，而它的失败方式是本会话反复出现的最坏那一种 —— 你自己把链条说全了：

the gate reads as declared, its self-test passes, check:declared-population-live is satisfied by nothing (a family that declares zero literals "declares nothing", which is a legitimate state), and the family scores undetermined or silent for every card in the tree.

⭐ 四道检查逐个放行，因为每一道问的都是它自己那一问，而没有一道问"这些字面量能不能被提取器看见"。 ⇒ 一个"零声明"与一个"声明了但被吃掉"在所有仪器上同色。

⚠️ 而你指出它这次只是走运才被发现：「A gate whose source carries no repo-root walk would have gone unnoticed entirely: no gate reds, and the family simply appears on no card.」⇒ 这次是因为该闸门恰好碰了 repo-root walk，撞红了 ROOT_WALK_RESIDUE。⛔ 下一个不会。

不是 p1：⛔ 无运行时影响、⛔ 无线上后果；受影响的是闸门归属，而 PR #16446 已用四条可接受字面量把当前这一个安置好了。

⭐ 裁定：取选项 2（让丢弃变响），⛔ 不取选项 1 —— 而且这个选择不需要维护者

你写「the choice is a maintainer's — the first is a change to the derivation's own admission semantics for every gate in the farm」。这句话对选项 1 成立，⛔ 对选项 2 不成立，而两者不必一起裁：

选项 2 什么都不放宽。 它 ⛔ 不改 admission、⛔ 不改任何闸门的归属、⛔ 不让任何今天被拒的字面量被接受。它只是让一个今天已经在发生的丢弃从静默变成一条 finding。⇒ 代价为零的收窄（收的是沉默，不是接受集）⇒ 确定，⛔ 无需裁决。
而且它落在正确的地方：check:watch-hint-literal 已经拥有「the declaration must be visible to the extractor」这条职责，且已经在读那些声明。⇒ 让它多问一句"里面的字面量能被提取吗"，是把一条它已有的职责补全，⛔ 不是给它新增职责。

⛔ 不取选项 1，理由是你自己给的读数：admission 是一条带测量的、有意收窄的拒绝（docblock 记着裸顶层词会造出 +139084 个虚假配对，以及一次对 resolved-form 放宽的复测拒绝）。⇒ 放宽它是在动一条被人量过之后才收紧的规则，且影响整个闸门农场。⛔ 不该由一张"发现了一个静默丢弃"的卡顺带做掉。

⇒ 本卡执行选项 2，⛔ 不入决策箱。 ⚠️ 若有人此后仍要做选项 1（例如 file-kind 闸门多到让枚举变得不可维护），那是另一张卡，且那张卡进决策箱 —— 它改的是每个闸门的 admission 语义，且要正面回应那 +139084 的测量。⛔ 不要把它折进本卡。

⚠️ 你标出的那个"变通会变陈"的问题，⛔ 本卡不解决，但要记在案

PR #16446 用三条 packages/** / apps/** / examples/** 加一条 package.json/** 绕开了 admission，并自己钉了一个 set-equality 来抓陈旧。你说得对：「the enumeration has to name every root that holds a manifest, so it goes stale the day a new top-level root appears … per-gate work every future file-kind gate would have to repeat」。

⇒ ⭐ 选项 2 落地后，这个成本仍然在：下一个 file-kind 闸门仍要枚举 + 自钉。但它不再是静默的 —— 作者写 '**/package.json' 会立刻拿到一条 finding 告诉他这条字面量提取不出来，⇒ 他会去枚举，而不是发出一个落在零张卡上的闸门。这正是选项 2 的全部价值：它不解决枚举的麻烦，它解决"你不知道自己需要枚举"。 ⛔ 承接者请把这一句写进 finding 的文案里。

验收口径（承接 PR 请照抄进 `## 验收备注`）

finding 必须先红：在 check:watch-hint-literal 的自测里加一条已知阳性 —— 一个含 '**/package.json' 的 *_WATCH_HINTS 声明必须报红。⛔ 先对未修的实现跑一次确认它不报，再修。
finding 的文案要说清补救：这条字面量提取不出来（首字符是 glob），请改为可枚举的根前缀形式；并说明为什么 admission 不放宽（引 +139084 那条测量）。⛔ 不要只说"不合法"。
阴性对照必测：
- PR feat(scripts): gate repository.directory against the manifest's own directory #16446 现在那四条可接受字面量 ⛔ 不得被报红；
- 一个声明零个 hint 的闸门族 ⛔ 仍是合法状态、不得被报红（你已指出这是 check:declared-population-live 认可的状态）；
- extractWatchHints 的输出对现有全部闸门逐字不变 —— 本卡 ⛔ 不改任何归属。
⛔ 不动 dispatch-gates.mjs:4687 的正则（见裁定）。若承接者认为必须动，回本卡说明，本席重判并送入决策箱。
顺手确认 check-manifest-repository-directory.mjs:310 的那段 docblock 在修复后是否仍准确（见上）。

本席权限声明：分诊席只分类/定级/定车道，以及裁定卡内补救的形状（选项 2）与哪一条需要送箱。⛔ 不认领、⛔ 不派发、⛔ 不写代码、⛔ 不合并、⛔ 不裁决决策箱卡。

Generated by Claude Code

Claim: PM loop round 1 — flight I: check:watch-hint-literal reports a *_WATCH_HINTS literal the extractor's admission would silently drop (one that opens with a glob), naming the remedy and the measurement behind the refusal; the admission rule itself untouched (triage's option 2)
Session: session_01P58euzUXCVJNwmhuPC9DXY
Branch: claude/issue-16447-watch-hint-admission-finding
Worktree: objectstack-issue-16447
Domain: domain:skills
File surface: scripts/check-watch-hint-literal.mjs (the new finding class, its remedy text, and its self-test cases — a known positive that reds on the UNFIXED checker first, PR #16446's four admissible literals as negatives, a zero-literal declaration kept a legitimate state) + scripts/check-manifest-repository-directory.mjs (the docblock near its line 310) ONLY if the fix makes that sentence untrue; ⛔ scripts/pm/dispatch-gates.mjs untouched — its admission regex is the ruling's exclusion (stop on breach; explain in the report)
Container & model: S (one checker gains one finding class with fixtures; no derivation change), mode:subagent, model: opus — --tier output at 04:58Z on tree 8b37a0973: "no path-derived mandate … floor sonnet · default opus · ceiling fable"; default judgement tier, this seat's contract-tier review is the compensating control
Clause-②: no
Thread-read: 5579014475
Serial constraints cleared: scripts/check-watch-hint-literal.mjs last touched before the 400-commit deepened window (git log on origin/main bottoms out at the shallow graft); on origin/main 8b37a0973 at 04:58Z it is 761 lines, imports maskComments from scripts/js-comment-mask.mjs, declares ROOT_DIR_WATCH_HINTS = ['scripts/**'] and carries a --self-test; scripts/check-manifest-repository-directory.mjs line 310 still reads "arrived at through the value"; open objectstack PRs by title at 05:02Z (19 PRs): none on either file (the dev takes the merge-tree reading before opening); no claude/issue-16447-* ref; not on the H17 trigger-file index; verify lock free at 04:58Z. Disjoint from flight J (#16398), which edits dispatch-gates.mjs text this flight only reads. finding cleared in the claim write: the seat confirms triage's grade (priority:p2, Bug) and its ruling (option 2; option 1 is another card and a decision-box one). Ungoverned (scripts/, no .md) ⇒ in-seat contract-tier review → ready → queue.

Generated by Claude Code

os-dev-report

{
 "issue": 16447,
 "status": "done",
 "branch": "claude/issue-16447-watch-hint-admission-finding",
 "head": "59a0adb3c",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/16799",
 "premise_still_valid": true,
 "summary": "check:watch-hint-literal now asks a second question of every *_WATCH_HINTS declaration it already reads: not only is the declaration a literal array (the spelling), but is every literal in it one the hint extractor ADMITS (the value). A literal opening with a glob yields no hint, so its gate lands on no card; the sweep now reds on that, naming the literal, the admission rule, the enumerable root-prefixed remedy, the +139084-pair measurement behind the refusal, and the ruling's own sentence about what the finding is for. The admission regex in scripts/pm/dispatch-gates.mjs is untouched -- triage's option 2, no widening. scripts/check-manifest-repository-directory.mjs's docblock stopped being accurate (it called this drop silent) and only that sentence was edited. Assignee was already set by the dispatch; no second claim posted.",
 "readings": {
  "step 1a (repro, origin/main 941232040)": "extractWatchHints on a module body carrying const ROOT_DIR_WATCH_HINTS = ['**/package.json'] returns [] -- with and without a scriptPath. The card's premise reproduces exactly.",
  "step 1b (the #16446 negatives)": "extractWatchHints on the four enumerated literals returns all four: packages/**/package.json, apps/**/package.json, examples/**/package.json, package.json/**.",
  "step 1c (the UNFIXED checker with the known positive added, commit 93f311eb6)": "node scripts/check-watch-hint-literal.mjs --self-test exit 1, output: \"  ✗ a declaration whose only literal opens with a glob is rejected\" / \"✗ check-watch-hint-literal self-test: 1 of 58 case(s) failed.\" -- the unfixed implementation does NOT report the drop. Acceptance item 1 first half.",
  "extraction checksum, whole corpus, BEFORE (941232040)": "226 gate files / 281 families. fileSha e0d470da99d3ed3732d56487c1cdaea38244a60982e84f789a4d77fbafed62be, famSha 2841c1c792dc15ccb90a7d682442df98ee27209e078f9c5a628fdd2ef5e68106.",
  "extraction checksum, whole corpus, AFTER (59a0adb3c)": "226 gate files / 281 families. fileSha f742faed3bea814d8454e7d345febab06170a0a8a825f811b7cae87ac825c2f1, famSha c3ccddfe4500b28822ccc58cf344d4ced3598b60ae1592c7b1445e85d6c46e4c. Per-row diff: 225 of 226 gate files byte-identical, 280 of 281 families byte-identical. The single delta is this gate itself -- see deviations.",
  "placement invariance (the half acceptance 3 is actually about)": "dispatch-gates --json before vs after, probes scripts/pm/dispatch-gates.mjs + scripts/check-watch-hint-literal.mjs + packages/spec/src/index.ts, and separately .github/workflows/lint.yml: matched column BYTE-IDENTICAL (81 families), alwaysRunsPopulation identical (7), widePopulation identical (10), counts identical, runnable union identical (82 commands). check:watch-hint-literal is an alwaysRunsPopulation family (it declares dispatch-gates: whole-tree-population), so it is placed by declaration and never by its hints -- in matched for no card, before or after.",
  "false-positive sweep of the two candidate predicates over the live tree": "66 declarations, 151 declared literals. Whole-module diff (the dispatch-suggested spelling): 1 false positive -- scripts/pm/dispatch-gates.mjs ROOT_DIR_WATCH_HINTS packages/drivers/**, a self-test FIXTURE the extractor blanks. Per-literal probe (what shipped): 0.",
  "cost": "module import of dispatch-gates.mjs: 36.9 ms, no output, no tree read, no module-scope work (its only top-level statement is the invokedDirectly guard). Whole-tree sweep: ~1535 ms before, ~1590 ms after (two runs each) -- about +55 ms, ~3.6%, for 151 probe calls.",
  "ablation (from the committed state)": "blob b129dfe8 -> 6d9673fc, anchor occurrences 1 -> 0, injected marker 0 -> 1, self-test 7 of 72 cases red. Restore via git checkout HEAD --: blob back to b129dfe8, git diff HEAD empty, 0 leftover markers, self-test back to 72 passing."
 },
 "mechanism_assumptions": {
  "1 (the checker already locates the four names and reads each literal)": "成立 -- DECL_NAMES rosters the four names and literalHints reads the values out of the declaration statement. Reading: the live sweep prints \"66 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 42, ROOT_FILE_WATCH_HINTS 13, ROOT_WATCH_HINTS 3, DECLARED_WATCH_HINTS 8\".",
  "2 (import extractWatchHints; diff declared literals against what it extracts)": "部分证伪, two ways. IMPORTABILITY 成立: 36.9 ms, side-effect free, cost acceptable (+3.6% on the sweep). THE COMPARISON 证伪: diffing the declared literals against the MODULE extraction falsely flags 1 of 151 live literals -- dispatch-gates.mjs spells a rostered declaration inside its own self-test, which extractWatchHints blanks -- and would falsely flag any module-relative declaration, whose extracted hint is the resolved path, not the literal. Replaced by a per-literal probe through the same extractor (still no copy of the admission regex): 0 of 151. SIDE EFFECT 证伪: the import specifier is itself a path-shaped literal, so this gate own extraction gains one hint -- see deviations.",
  "3 (a zero-literal declaration is legitimate and must not fire)": "成立, and it splits in two. A gate family that declares NO *_WATCH_HINTS constant produces no row at all and is untouched by this PR. A declaration spelled as an empty array [] was already refused before this PR (\"the declaration is EMPTY -- it names no subtree at all\") and still is, under that same remedy: the new question runs only after the array has at least one literal, so nothing is named under two remedies. Two self-test cases pin it.",
  "4 (the four #16446 literals extract and are the negatives)": "成立 -- all four extract; two self-test cases (together and individually) plus pnpm check:manifest-repository-directory exit 0."
 },
 "gates": [
  { "cmd": "node packages/lint/scripts/check-reference-carrier-shape.mjs", "exit": 0, "verdict": "check-reference-carrier-shape: OK — 6351 file(s) scanned, 616 `reference` site(s)." },
  { "cmd": "node packages/lint/scripts/check-reference-carrier-shape.mjs --self-test", "exit": 0, "verdict": "✅ self-test: flags an object / array / numeric carrier at a field-def position in all" },
  { "cmd": "node scripts/check-ci-filter-parity.mjs", "exit": 0, "verdict": "OK: all 173 declared cross-package glob(s) (124 unique) are covered by `core` or `crosspkg`, every `crosspkg` entry still covers one…" },
  { "cmd": "node scripts/check-closing-keyword-parity.mjs", "exit": 0, "verdict": "check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 8288 tracked file(s)…" },
  { "cmd": "node scripts/check-closing-keyword-parity.mjs --self-test", "exit": 0, "verdict": "✓ check-closing-keyword-parity --self-test: 24 assertions, 5 mutations of the shipped parsers each driven to red." },
  { "cmd": "node scripts/check-comment-mask-corpus.mjs", "exit": 0, "verdict": "✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 6351 files, 0 disagree, 0 unparseable, 113.6s (comparator self-test: 17 cases pass)." },
  { "cmd": "node scripts/check-declaration-mirrors.mjs", "exit": 0, "verdict": "OK: 9 hand-written declaration(s) agree with their modules on name, kind and required arity." },
  { "cmd": "node scripts/check-declaration-mirrors.mjs --self-test", "exit": 0, "verdict": "All 29 self-test cases passed." },
  { "cmd": "node scripts/check-scripts-symbol-anchors.mjs", "exit": 0, "verdict": "✅ check-scripts-symbol-anchors: 3011 anchors across 232 scripts resolve — 31 symbol (31 declaration, 0 literal), 2980 file-level, 0 cross-repo, 1 exempt, 2 continuation." },
  { "cmd": "node scripts/check-scripts-symbol-anchors.mjs --self-test", "exit": 0, "verdict": "✅ check-scripts-symbol-anchors --self-test: every finding class provoked, comment-prose projection wired, declined shapes counted not missed, allowance rows exact both ways…" },
  { "cmd": "node scripts/check-self-test-wired.mjs", "exit": 0, "verdict": "✓ check-self-test-wired: every one of the 190 script(s) CI runs that ship a `--self-test` has that self-test run by CI." },
  { "cmd": "node scripts/check-self-test-wired.mjs --self-test", "exit": 0, "verdict": "check-self-test-wired --self-test: 4 live ledger row(s) verified, plus the comment mask, the right boundary, alias resolution and both audit directions — 10 declared batteries…" },
  { "cmd": "node scripts/check-self-test-workflow-commands.mjs", "exit": 0, "verdict": "✓ check-self-test-workflow-commands: no self-test CI runs prints a line the Actions runner would parse as a workflow command." },
  { "cmd": "node scripts/check-self-test-workflow-commands.mjs --self-test", "exit": 0, "verdict": "check-self-test-workflow-commands --self-test: both measured parse rules pinned (legacy form anywhere in a line, current form only at line start)…" },
  { "cmd": "node scripts/check-whole-set-label-write.mjs", "exit": 0, "verdict": "✓ check-whole-set-label-write: 0 violations — 292 file(s) over 3 root(s) · 11 raw mention(s) · 11 in comments/prose" },
  { "cmd": "node scripts/check-whole-set-label-write.mjs --self-test", "exit": 0, "verdict": "✓ check-whole-set-label-write --self-test: all cases pass (24 fixture trees + 5 refusals + 1 allowlist hatch)" },
  { "cmd": "node scripts/pm/bare-root-worklist.mjs --self-test", "exit": 0, "verdict": "OK  self-test: 78 live row(s), 57 unreachable as spelled, 46 recorded verdict(s) — none stale, none missing, none contradicted…" },
  { "cmd": "pnpm check:agent-test-spelling", "exit": 0, "verdict": "✓ check-agent-test-spelling: 0 violations — 482 file(s) · 7422 bare `--` token(s) · 1603 launcher-rooted run(s) · 12 separator(s) JUDGED…" },
  { "cmd": "pnpm check:bash32-floor", "exit": 0, "verdict": "✓ check-bash32-floor: 31 tracked shell file(s) under scripts/**, .claude/hooks/**, .githooks/** name no bash 4+ construct outside a comment…" },
  { "cmd": "pnpm check:cli-command-ids", "exit": 0, "verdict": "✓ check-cli-command-ids: 433 command-id literal(s) across 128 file(s) outside packages/cli all resolve to a real command path (73 ids derived; 3 declared fixture exemptions)…" },
  { "cmd": "pnpm check:cross-package-test-inputs", "exit": 0, "verdict": "OK: 28 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob (6 of them on a split \"test:repo\" task)." },
  { "cmd": "pnpm check:driver-memory-census", "exit": 0, "verdict": "check-driver-memory-census: OK — every declaration is ledgered, every ledger entry is live, and every ruled file states \"#6664 census: 2 ruled consumers\"." },
  { "cmd": "pnpm check:entry-guard", "exit": 0, "verdict": "✓ check:entry-guard: 232 scripts/ file(s) — every entry guard goes through invoked-as.mjs; 176 export bindings, 176 of them inert on import (0 known-unsafe, ⛔ SHRINK-ONLY)." },
  { "cmd": "pnpm check:nul-bytes", "exit": 0, "verdict": "check-nul-bytes: OK (scanned 8281 text file(s) -- 8281 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes)." },
  { "cmd": "pnpm check:parse-guard", "exit": 0, "verdict": "✓ check:parse-guard: 231 scripts/ file(s) — every TypeScript parse goes through ts-parse.mjs." },
  { "cmd": "pnpm check:pnpm-filter-targets", "exit": 0, "verdict": "✓ check:pnpm-filter-targets: 144/190 `--filter` occurrence(s) across 37 file(s) resolve against 80 workspace package(s); 46 not judged…" },
  { "cmd": "pnpm check:ratchet-remedy-authority", "exit": 0, "verdict": "OK  check-ratchet-remedy-authority: 226 scripts swept; 14 mark the expanding remedy ⛔ MAINTAINER-ONLY, 6 turn it down outright…" },
  { "cmd": "pnpm check:refd-timer-probe", "exit": 0, "verdict": "OK  check-refd-timer-probe: 6346 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhere else." },
  { "cmd": "pnpm check:watch-hint-literal", "exit": 0, "verdict": "✓ check-watch-hint-literal: 66 declaration(s) across 4 rostered name(s) -- ROOT_DIR_WATCH_HINTS 42, ROOT_FILE_WATCH_HINTS 13, ROOT_WATCH_HINTS 3, DECLARED_WATCH_HINTS 8 -- all 151 of those literals admitted by the hint extractor." },
  { "cmd": "pnpm check:manifest-repository-directory", "exit": 0, "verdict": "✓ check:manifest-repository-directory — every one of 70 publishable manifest(s) declares repository.directory, and all 72 declarations across 82 tracked manifest(s) name their own directory." },
  { "cmd": "pnpm check:pm-dispatch-gates", "exit": 0, "verdict": "✓ dispatch-gates self-test: 1552 cases pass." },
  { "cmd": "pnpm exec eslint (the 2 changed files)", "exit": 0, "verdict": "2 files linted, 0 errors, 0 warnings (counted from --format json)" },
  { "cmd": "node scripts/pm/dispatch-gates.mjs --ran ran.txt --repo objectstack-ai/objectstack", "exit": 0, "verdict": "✓ dispatch-gates --ran: 31 derived famil(ies) accounted for — 31 run, 0 NOT-MEASURED." },
  { "cmd": "node scripts/pm/check-governed-merges.mjs --test (final file list)", "exit": 0, "verdict": "✅ NOT governed — ordinary queue landing applies to a PR with exactly this file list." }
 ],
 "line_budget": "n/a",
 "files_changed": [
  "scripts/check-watch-hint-literal.mjs (+183/-11)",
  "scripts/check-manifest-repository-directory.mjs (+13/-2, the one stale docblock sentence)"
 ],
 "tests": "Self-test 72 cases pass (was 57); new battery \"literals the extractor admission DROPS\" carries 14 cases and the live-tree battery gained one. Known positive proved red-first against the UNFIXED implementation at commit 93f311eb6 (exit 1, \"1 of 58 case(s) failed\") before the finding class existed. Ablation from the committed state with on-disk proof: blob b129dfe8 -> 6d9673fc, anchor 1 -> 0, marker 0 -> 1, 7 of 72 cases red; restored by git checkout HEAD -- to blob b129dfe8 with git diff HEAD empty and 0 leftover markers, self-test back to 72. 31 derived gate families run, reconciled with --ran: 31 derived, 31 run, 0 NOT-MEASURED, 0 UNRUN. eslint as a PROVEN narrowing at 59a0adb3c: population read from eslint own config (6347 tracked JS/TS files, 6347 of 6347 not ignored per ESLint#isPathIgnored), files linted counted from --format json = 2 with 0 errors and 0 warnings, and the invariance statement -- eslint.config.mjs enables type-aware linting for NO file (calculateConfigForFile on the changed file returns parserOptions ecmaVersion latest / sourceType module, no parserOptions.project, no typed rules), so this diff cannot move the verdict on any untouched file.",
 "deviations": [
  "ROUTE (declared): the dispatch route compares declared literals against the MODULE extraction. Measured on this tree that has 1 false positive of 151 and a latent second class (module-relative declarations). Shipped a per-literal probe through the same extractor instead -- 0 false positives, still no copy of the admission regex. Judgement criteria unchanged.",
  "ACCEPTANCE 3, third bullet (declared, NOT silently chosen): \"extractWatchHints 的输出对现有全部闸门逐字不变\" does not hold byte-for-byte. 225 of 226 gate files and 280 of 281 families are byte-identical; the one delta is check:watch-hint-literal itself, which gains scripts/pm/dispatch-gates.mjs (the import specifier) and .github/workflows (through the import follow). It is structural: a gate that CALLS the extractor cannot be invisible to it. The clause second half -- 本卡不改任何归属 -- does hold and is measured: this family declares whole-tree-population, so it is placed by declaration and sits in alwaysRunsPopulation for every card and in matched for none; the matched column is byte-identical before and after, as are all counts and the 82-command runnable union. Four-axis reading of the alternative (a shim module whose specifier carries no slash): business need -- the dependency on the extractor is REAL, so hiding it makes the tree describe itself falsely; long-term -- a file whose only purpose is to be invisible to a detector is the workaround Prime Directive #5 refuses; AI-error -- the next author copies the dodge, which is worse than the hint; startup focus -- a new file and a new surface for zero capability. Rejected on all four. If the seat reads the clause as absolute, the remedy is the seat re-judging where the check lives, not the shim.",
  "REST: repo-scoped REST is 403 in this container (probed once: \"GitHub access is not enabled for this session\"), so labels went through the MCP fallback -- read current set, union, whole-set write, comparative read-back. Read-back equals union(read set, target): [size/m, skip-changeset], nothing stripped.",
  "The derivation warns STALE TREE (HEAD 3 commits behind origin/main b38821d1c; the one changed file it names, scripts/check-partof-closing-keyword.mjs, is not among my 31 families). Not merged: the merge-tree probe against b38821d1c from a driver-free bare clone is clean (exit 0, no conflicted paths), and CI re-derives on the PR generation."
 ],
 "mcp_calls": "8 -- create_pull_request, pull_request_read(get), issue_read(get_labels, refused for a PR number), list_pull_requests(labels), issue_write(update labels), list_pull_requests(read-back), add_issue_comment(this report), issue_read(get_comments, read-back). Card body and all 15 timeline items came from the zero-quota payload channel (totalCount 15, hasNextPage false).",
 "open_questions": [],
 "out_of_scope_findings": [
  "noted, not filed: check-watch-hint-literal counts a self-test FIXTURE in scripts/pm/dispatch-gates.mjs as a live rostered declaration (the scan masks comments but not string literals, a hazard its own docblock records). Today it is harmless -- ROOT_DIR_WATCH_HINTS has 42 real declarers -- but it means a fixture could one day satisfy the per-name floor that exists to catch a vanished constant. Undrilled drift, not a reproducible defect, so no card. Carrier: this PR names both files, and the next author of either a fixture in that self-test or a roster entry here reads it.",
  "noted, not filed: triage option 1 (widening admission to accept a leading glob) stays a separate, decision-box card by the ruling; the enumeration cost it would remove is still paid per file-kind gate. No card opened -- the ruling on this card is its own record, and the ruling did not ask for one."
 ]
}

Generated by Claude Code

ACCEPT — skills seat (hotlong, session session_01P58euzUXCVJNwmhuPC9DXY), in-seat contract-tier review of PR #16799 at head 59a0adb3c, 2026-09-08T06:08Z. Report (the dev's final JSON, mirrored on this card) read against GitHub and the branch.

Card relation. Fixes #16447 on line 1 — correct: triage's option 2 is delivered in full; option 1 stays, by the ruling, a separate decision-box card that nobody has asked for, and the ruling itself is that record. No other issue number sits next to a closing keyword (PR #16446 is cited with no verb).

Scope. merge-base...59a0adb3c is two files, +198/−13: scripts/check-watch-hint-literal.mjs (the value-side question, droppedByAdmission, the remedy text, a 14-case battery, the live-tree assertion) and scripts/check-manifest-repository-directory.mjs (only the docblock sentence that called the drop silent — acceptance item 5, taken exactly as written). ⛔ scripts/pm/dispatch-gates.mjs untouched — verified on the diff. No content/docs/releases/ change; skip-changeset correct. check-governed-merges.mjs --test: NOT governed.

Acceptance items, verified on the branch. (1) red first: the known positive was added at commit 93f311eb6 against the unfixed checker and read 1 of 58 case(s) failed; with the finding class it passes, and the ablation (blob b129dfe8 → 6d9673fc, 7 of 72 red, restored by state) shows the class does the work. (2) the remedy names the literal, the admission rule, the enumerable root-prefixed spelling plus the self-pin, the +139084 measurement and the "every gate in the farm" cost, and ends with the ruling's sentence rendered in the checker's register — five self-test cases hold those five properties. (3) negatives: PR #16446's four literals accepted together and individually; a zero-literal array keeps its own remedy and a computed one keeps its own (the value question runs only after the spelling one passes, so no declaration is named twice); placement invariance measured with --json before and after on four probe paths — matched column byte-identical (81 families), always-runs 7, wide 10, the 82-command runnable union identical. (4) the admission regex untouched. (5) done.

The route, accepted with the dev's correction. This dispatch suggested diffing declared literals against the module's extraction; measured on the live tree that spelling falsely accuses 1 of 151 literals (a self-test fixture in dispatch-gates.mjs, which the extractor blanks) and would falsely accuse any module-relative declaration. The per-literal probe through the same extractor — 0 of 151 — is the correct shape and still copies no regex. The extractor import is side-effect free (36.9 ms, no tree read, the only top-level statement is the entry guard) and costs the sweep about 55 ms.

The declared deviation — the seat's reading. Acceptance item 3's third bullet asks that extractWatchHints' output be byte-identical over every gate. It is byte-identical over 225 of 226 gate files and 280 of 281 families; the one delta is this checker's own family, which now imports the extractor and so necessarily spells its path (plus .github/workflows through the import follow). The bullet's stated purpose — 「本卡 ⛔ 不改任何归属」 — is what the seat holds it to, and that is measured to hold: check:watch-hint-literal declares whole-tree-population, sits in the always-runs column for every card and in matched for none, before and after; no card's brief moves. The alternative the dev priced (a shim module so the specifier carries no slash) is a file whose only purpose is to hide a real dependency from the detector — refused on all four axes and by Prime Directive #5. Accepted as a measured, declared deviation; if triage reads its bullet as absolute, the answer is where the check lives, not a shim, and that is a new card.

Evidence. 31/31 derived families (the derivation added check:manifest-repository-directory, green); check:pm-dispatch-gates 1552 cases; check:entry-guard "176 export bindings, 176 inert on import" and check:parse-guard green — the two most likely to speak to a new cross-module import did not; eslint as a proven narrowing (population from eslint's own config, 2 files linted, no type-aware rules); merge-tree against b38821d1c from a driver-free bare clone clean; the STALE TREE warning named a file outside these 31 families, so not merging main was the right call.

Recorded, not rework. (1) Mechanism assumption 2 (module-diff route) was the seat's and was wrong; corrected by measurement. (2) One issue_read get_labels on a PR number errored — ledger leg ①; the head-filter leg was used. (3) The noted, not filed fixture-counted-as-declarer hazard is left where the dev put it: undrilled drift, no card.

Landing. On 59a0adb3c at 06:08Z: Lint & Repo Gates and three type-check lanes in_progress; every completed run success or skipped. Once Lint & Repo Gates and TypeScript Type Check both read completed: success and nothing else is red, the seat flips ready and arms auto-merge (SQUASH); the queue ref is the landing reading; pm:dispatched and the assignee clear on the merge.

Generated by Claude Code

os-closed-card-sweep — machine-findable marker for this generated comment.

Removed the pm-loop state label(s) this closed card no longer claims: pm:dispatched.

Closing pull request: fix(check-watch-hint-literal): red on a declared watch-hint literal the extractor drops at admission #16799, merged.
Closing commit 83863b2dfe, merged into main.
Left untouched: bug, tooling, priority:p2, domain:skills — ownership, priority and outcome are not state claims.
The label set was read back after the write and matched.

A state label claims work is in flight. This card is closed on a merged delivery, so the claim
is stale; every other label is left exactly as it was found. Nothing here is a judgement about
the card, and no verdict-bearing label is ever touched by this sweep.

posted by half-state-patrol run 34200831142 · trigger schedule

Generated by Claude Code

Landed (skills seat, 2026-09-08T08:45Z; late record — the seat's GitHub channel was down 06:32–08:38Z). PR #16799 (ungoverned, scripts/**): the seat flipped it ready at 06:20:15Z once Lint & Repo Gates read completed: success (06:19:41Z) with all 34 check runs green or skipped, armed auto-merge (SQUASH) at 06:20:23Z, GitHub enqueued it at 06:21:30Z, and it merged at 06:52:47Z. Landing reading: origin/main carries 83863b2df = "fix(check-watch-hint-literal): red on a declared watch-hint literal the extractor drops at admission (#16799)" as the last touch of both files; droppedByAdmission is on main. pm:dispatched was removed by the patrol's closed-card sweep at 07:50Z; the seat clears the assignee now; bug, tooling, priority:p2, domain:skills stay.

Generated by Claude Code

Navigation Menu

Repository navigation

[finding] extractWatchHints drops any watch-hint literal that OPENS with a glob, so a gate declaring `**/package.json` declares a population of ZERO — correct to hintCovers, invisible to the derivation #16447

The measurement

Why this is the silent-drop class rather than a spelling preference

The workaround that shipped, and why it is not the fix

The decision this needs, not guessed here

分诊：`domain:skills` / `bug` / `tooling` / `finding` / `priority:p2` / `pm:queue` / type `Bug`；裁定取选项 2 —— ⛔ 本卡不需要维护者

复核（`origin/main` `5e53d73d`）：一个字符位，逐字命中

`priority:p2`

⭐ 裁定：取选项 2（让丢弃变响），⛔ 不取选项 1 —— 而且这个选择不需要维护者

⚠️ 你标出的那个"变通会变陈"的问题，⛔ 本卡不解决，但要记在案

验收口径（承接 PR 请照抄进 `## 验收备注`）

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] extractWatchHints drops any watch-hint literal that OPENS with a glob, so a gate declaring **/package.json declares a population of ZERO — correct to hintCovers, invisible to the derivation #16447

Description

The measurement

Why this is the silent-drop class rather than a spelling preference

The workaround that shipped, and why it is not the fix

The decision this needs, not guessed here

Activity

os-zhuang commented on Sep 8, 2026

分诊：domain:skills / bug / tooling / finding / priority:p2 / pm:queue / type Bug；裁定取选项 2 —— ⛔ 本卡不需要维护者

复核（origin/main 5e53d73d）：一个字符位，逐字命中

priority:p2

⭐ 裁定：取选项 2（让丢弃变响），⛔ 不取选项 1 —— 而且这个选择不需要维护者

⚠️ 你标出的那个"变通会变陈"的问题，⛔ 本卡不解决，但要记在案

验收口径（承接 PR 请照抄进 ## 验收备注）

hotlong commented on Sep 8, 2026

hotlong commented on Sep 8, 2026

hotlong commented on Sep 8, 2026

github-actions commented on Sep 8, 2026

hotlong commented on Sep 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] extractWatchHints drops any watch-hint literal that OPENS with a glob, so a gate declaring `**/package.json` declares a population of ZERO — correct to hintCovers, invisible to the derivation #16447

分诊：`domain:skills` / `bug` / `tooling` / `finding` / `priority:p2` / `pm:queue` / type `Bug`；裁定取选项 2 —— ⛔ 本卡不需要维护者

复核（`origin/main` `5e53d73d`）：一个字符位，逐字命中

`priority:p2`

验收口径（承接 PR 请照抄进 `## 验收备注`）