fix(scripts): withdraw the wholesale-root hints refused by bare-root-worklist (#15341)

`scripts/pm/bare-root-worklist.mjs` carries the recorded, measured triage for
exactly this class, and its `--self-test` reds on a declaration that contradicts
a recorded refusal. Eleven of the sixteen gates the card names are refused there
by name: REFUSE-WIDE where the bare root is TRUE of the walk and refused for
width, REFUSE-UNSPELLABLE where the population is a file-kind filter no subtree
glob can spell. Two of those rows quote percentages for the exact spellings this
branch had declared.

Those eleven declarations are withdrawn and their gates left as they were. What
stays is the half neither map refuses: two enumerated FILE populations at 100%
precision, three families whose CI invocation is a fixture-only self-test and
which now say so, and check:org-identifier, whose ROOT_WALK_RESIDUE_LEDGER row
names this declaration as its remedy.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

Author: claude

scripts/check-declaration-mirrors.mjs

@@ -118,26 +118,6 @@ const HERE = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(HERE, '..');
 const SCRIPTS_DIR = join(REPO_ROOT, 'scripts');
 
-/**
- * The population this gate walks, declared for `scripts/pm/dispatch-gates.mjs`.
- *
- * `mirrorFiles()` walks `SCRIPTS_DIR` for every `*.d.mts` and opens the `.mjs`
- * beside each one — one subtree, `scripts/`. The walk root is assembled with
- * `join()`, so the derivation, which reads SOURCE TEXT, saw a bare word and no
- * path at all: both of this gate's CI invocations (the scan and its
- * `--self-test`) were scored `undetermined` for EVERY card, absent from every
- * dispatch brief and every `--commands` harvest, while CI ran them on each pull
- * request. `hintCovers` refuses a bare single-segment literal by design, so the
- * subtree spelling is the escape the idiom exists to be.
- *
- * ⛔ Not a whole-tree marker: `scripts/**` is a subtree, and this gate reads
- * nothing outside it.
- *
- * The self-test holds the declaration against the live walk rather than against
- * a second spelling of the root, so a moved corpus reds here.
- */
-const ROOT_DIR_WATCH_HINTS = ['scripts/**'];
-
 /**
  * The export spellings this parser recognises, in the words a declaration
  * author would write them. Published for the same reason the cross-package
@@ -623,24 +603,6 @@ async function selfTest() {
     mirrorFiles().every((f) => f.endsWith('.d.mts')),
   );
 
-  // ── the dispatch-gates population declaration ──
-  ok(
-    'the declared population is the subtree spelling of the walked root — a bare `scripts` literal is '
-      + 'refused by hintCovers as too generic, which is how this gate came to declare nothing at all',
-    ROOT_DIR_WATCH_HINTS.length === 1 && ROOT_DIR_WATCH_HINTS[0] === 'scripts/**',
-  );
-  ok(
-    'and the live walk agrees with it — every discovered mirror sits under the declared root, so a '
-      + 'moved corpus reds here instead of quietly re-emptying the declaration',
-    mirrorFiles().every((f) => relative(REPO_ROOT, f).split(sep).join('/')
-      .startsWith(`${ROOT_DIR_WATCH_HINTS[0].replace(/\/\*+$/, '')}/`)),
-  );
-  ok(
-    'the declared form is NOT the bare walk root — the glob form would send the walk at a directory '
-      + 'the tree does not have',
-    !ROOT_DIR_WATCH_HINTS.includes(relative(REPO_ROOT, SCRIPTS_DIR).split(sep).join('/')),
-  );
-
   // ── The floor: every declared battery RAN, and ran its cases (#13489) ────
   //
   // Evaluated after every battery has had its chance and BEFORE the verdict, so

scripts/check-init-service-contract.mjs

@@ -121,12 +121,11 @@ const SELF_TEST_BATTERIES = Object.freeze({
   '17. Every exemption is decided by WHEN the call runs, not by which accessor': 1,
   '18. `--list` and the problem text must quote the accessor actually called.': 1,
   '19. Nothing outside the vocabulary is invented: a lookup-shaped call on a': 1,
-  '20. The dispatch-gates population declaration.': 4,
 });
 
 // DELETING an entry silences that battery's floor exactly as effectively as
 // zeroing it, so the roster's own size is pinned too.
-const SELF_TEST_BATTERY_FLOOR = 20;
+const SELF_TEST_BATTERY_FLOOR = 19;
 
 // The key an assertion is filed under when no battery is open. It is not a
 // declared battery, so it reds by the same set difference rather than silently
@@ -135,27 +134,6 @@ const UNATTRIBUTED_BATTERY = '(no battery open)';
 
 const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 
-/** The trees this gate walks. Plugin units live under `packages/`. */
-const SCAN_ROOTS = ['packages'];
-
-/**
- * The population this gate walks, declared for `scripts/pm/dispatch-gates.mjs`.
- *
- * The walk root used to be an inline `'packages'` argument. The derivation reads
- * SOURCE TEXT and `hintCovers` refuses a bare single-segment literal by design
- * (admitting them was priced at +139084 fabricated (gate, file) pairs, because
- * `packages` is a path COMPONENT in dozens of gates that never read that root),
- * so this gate declared no path at all: scored `undetermined` for EVERY card,
- * absent from every dispatch brief and every `--commands` harvest, while CI ran
- * it on each pull request. The subtree spelling is the escape the idiom exists
- * to be, and `SCAN_ROOTS` is the constant it is held against — the walk now
- * reads the same constant, so a moved read reds in this file's own self-test.
- *
- * ⛔ Not a whole-tree marker: `packages/**` is a subtree, and a whole-tree row
- * appears on every card in the repo whether or not the gate reads the file.
- */
-const ROOT_DIR_WATCH_HINTS = ['packages/**'];
-
 const DECLARATION_FIELDS = ['dependencies', 'optionalDependencies', 'requiresServices', 'providesServices'];
 
 // ── Discovery ────────────────────────────────────────────────────────────────
@@ -174,7 +152,7 @@ function discoverFiles() {
       out.push(relative(ROOT, full).split(sep).join('/'));
     }
   };
-  for (const root of SCAN_ROOTS) walk(join(ROOT, root));
+  walk(join(ROOT, 'packages'));
   return out.sort();
 }
 
@@ -946,30 +924,6 @@ function selfTest() {
     assert(problems.length === 0, 'hasService is not in the vocabulary (not plugin-reachable in packages/core)');
   }
 
-  // 20. The dispatch-gates population declaration.
-  battery('20. The dispatch-gates population declaration.');
-  assert(
-    SCAN_ROOTS.filter((r) => !r.includes('/')).every((r) => ROOT_DIR_WATCH_HINTS.includes(`${r}/**`)),
-    'every separator-less SCAN_ROOT is declared in the subtree spelling — a bare root is refused as '
-      + 'too generic, so without the glob the hint extractor reads nothing and this gate goes back to '
-      + 'scoring `undetermined` for every card',
-  );
-  assert(
-    ROOT_DIR_WATCH_HINTS.every((h) => SCAN_ROOTS.includes(h.replace(/\/\*+$/, ''))),
-    'no root is declared that this gate does not walk — a declaration that has drifted from the scan '
-      + 'replaces a silent gate with a lying one',
-  );
-  assert(
-    !SCAN_ROOTS.some((r) => ROOT_DIR_WATCH_HINTS.includes(r)),
-    'the declared form is NOT a SCAN_ROOTS entry — the glob form would send the walk at a directory '
-      + 'the tree does not have',
-  );
-  assert(
-    discoverFiles().every((f) => ROOT_DIR_WATCH_HINTS.some((h) => f.startsWith(`${h.replace(/\/\*+$/, '')}/`))),
-    'and the WALK agrees with the declaration on the live tree — this is the half the two assertions '
-      + 'above cannot hold, since both read the constant rather than what discoverFiles() returns',
-  );
-
   // ── The floor: every declared battery RAN, and ran its cases (#13489) ───
   //
   // Evaluated after every battery has had its chance and BEFORE the verdict, so

scripts/check-live-db-isolation.mjs

@@ -94,12 +94,11 @@ const SELF_TEST_BATTERIES = Object.freeze({
   '7. comments are not source -- the reason codeOf exists': 1,
   '8. the live-file needle must MATCH a real read and not the cell form': 2,
   '9. `use strict` and friends are not live DDL': 1,
-  '10. the dispatch-gates population declaration': 4,
 });
 
 // DELETING an entry silences that battery's floor exactly as effectively as
 // zeroing it, so the roster's own size is pinned too.
-const SELF_TEST_BATTERY_FLOOR = 10;
+const SELF_TEST_BATTERY_FLOOR = 9;
 
 // The key an assertion is filed under when no battery is open. It is not a
 // declared battery, so it reds by the same set difference rather than silently
@@ -175,29 +174,6 @@ function batteryFloorFailures() {
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const ROOTS = ['packages', 'apps', 'examples'];
-
-/**
- * The population this gate walks, declared for `scripts/pm/dispatch-gates.mjs`.
- *
- * `ROOTS` is a runtime constant, and the derivation reads SOURCE TEXT: three
- * bare top-level words carry no separator, and `hintCovers` refuses a bare
- * single-segment literal by design (accepting them was priced at +139084
- * fabricated (gate, file) pairs, because `packages`, `apps` and `examples` are
- * path COMPONENTS in dozens of gates that never read those roots). So this gate
- * declared no path at all and was scored `undetermined` for EVERY card: it
- * appeared in no dispatch brief and in no `--commands` harvest, while CI ran it
- * on every pull request. The subtree spelling is the escape the idiom exists to
- * be — the same claim `ROOTS` makes, written where a text scanner can read it.
- *
- * ⛔ Not a whole-tree marker: this gate reads three subtrees, and the liveness
- * predicate that vouches for a whole-tree declaration is documented as too weak
- * to tell a seeded subtree walk apart from a repo-root one.
- *
- * The self-test derives the coupling from `ROOTS` on both sides rather than
- * re-spelling it, so widening or renaming a root cannot leave this declaration
- * describing the old population.
- */
-const ROOT_DIR_WATCH_HINTS = ['packages/**', 'apps/**', 'examples/**'];
 const SKIP_DIRS = new Set(['node_modules', 'dist', '.turbo', 'coverage', '.next', 'build']);
 
 /**
@@ -460,29 +436,6 @@ function selfTest() {
   battery('9. `use strict` and friends are not live DDL');
   check('does not flag a non-identifier use', violationsIn(`'use strict';`).length === 0);
 
-  // 10. the dispatch-gates population declaration
-  battery('10. the dispatch-gates population declaration');
-  check(
-    'every separator-less ROOT is declared in the subtree spelling (a bare root is refused as too '
-      + 'generic, so it needs the glob)',
-    ROOTS.filter((r) => !r.includes('/')).every((r) => ROOT_DIR_WATCH_HINTS.includes(`${r}/**`)),
-  );
-  check(
-    'and it declares no root this gate does not walk — a declaration that can drift from the scan '
-      + 'replaces a silent gate with a lying one',
-    ROOT_DIR_WATCH_HINTS.every((h) => ROOTS.includes(h.replace(/\/\*+$/, ''))),
-  );
-  check(
-    'the declared form is NOT a ROOTS entry — the glob form would send the walk at a directory the '
-      + 'tree does not have',
-    !ROOTS.some((r) => ROOT_DIR_WATCH_HINTS.includes(r)),
-  );
-  check(
-    'the declaration is not empty — an empty hint list reads exactly like the undetermined verdict '
-      + 'it exists to leave',
-    ROOT_DIR_WATCH_HINTS.length === ROOTS.length,
-  );
-
   // The floor runs BEFORE the verdict below, so a success line can only be
   // printed by a run in which every declared battery registered its cases.
   for (const message of batteryFloorFailures()) cases.push({ label: message, ok: false });

scripts/check-meta-type-normalized.mjs

@@ -90,30 +90,6 @@ const ROOT = join(fileURLToPath(new URL('.', import.meta.url)), '..');
 /** Directories scanned. Route handlers that read `:type` live here. */
 const SCAN_DIRS = [join('packages', 'rest', 'src')];
 
-/**
- * The population this gate walks, declared for `scripts/pm/dispatch-gates.mjs`.
- *
- * `SCAN_DIRS` is assembled with `join()`, one SEGMENT per literal, so the
- * derivation — which reads SOURCE TEXT — sees three bare words and no path at
- * all. This gate was therefore scored `undetermined` for EVERY card, absent from
- * every dispatch brief and every `--commands` harvest, while CI ran it on each
- * pull request.
- *
- * ⚠️ The hint is `packages/rest/src/**`, NOT `packages/**`. The scan is one
- * package's source directory; the wider spelling would paste this gate onto
- * every card under `packages/`, which is the costlier error — a lead that is
- * wrong on thousands of files rather than a gate that is quiet.
- *
- * ⛔ And not a whole-tree marker for the same reason, one size up.
- *
- * The self-test derives the coupling from `SCAN_DIRS` on both sides rather than
- * re-spelling it, so a moved or widened scan directory cannot leave this
- * declaration describing the old population. The POSIX normalisation is
- * load-bearing: `join()` yields a platform separator, and the declaration is
- * read as text by a scanner that only knows `/`.
- */
-const ROOT_DIR_WATCH_HINTS = ['packages/rest/src/**'];
-
 /**
  * Blessed raw comparisons: `'<relative-path>::<trimmed source text>'` -> reason.
  * Empty by design — see the header.
@@ -242,12 +218,11 @@ const SELF_TEST_VERDICT = 'check-meta-type-normalized self-test reached its verd
 // to find what stopped registering.
 const SELF_TEST_BATTERIES = Object.freeze({
   'check-meta-type-normalized self-test': 4,
-  'the dispatch-gates population declaration': 3,
 });
 
 // DELETING an entry silences that battery's floor exactly as effectively as
 // zeroing it, so the roster's own size is pinned too.
-const SELF_TEST_BATTERY_FLOOR = 2;
+const SELF_TEST_BATTERY_FLOOR = 1;
 
 // The key an assertion is filed under when no battery is open. It is not a
 // declared battery, so it reds by the same set difference rather than silently
@@ -320,28 +295,6 @@ function selfTest() {
         if (hits.length !== 5) problems.push(`expected 5 findings total, saw ${hits.length} — a pass-through or a comment was flagged`);
     });
 
-    // ── The dispatch-gates population declaration ────────────────────────
-    battery('the dispatch-gates population declaration');
-    const scannedPosix = SCAN_DIRS.map((d) => d.split(sep).join('/'));
-    check(() => {
-        if (!scannedPosix.every((d) => ROOT_DIR_WATCH_HINTS.includes(`${d}/**`))) {
-            problems.push('a SCAN_DIRS entry is not declared in the subtree spelling — the hint extractor '
-                + 'reads source text, and a join()-assembled path is invisible to it');
-        }
-    });
-    check(() => {
-        if (!ROOT_DIR_WATCH_HINTS.every((h) => scannedPosix.includes(h.replace(/\/\*+$/, '')))) {
-            problems.push('ROOT_DIR_WATCH_HINTS declares a directory this gate does not walk — a declaration '
-                + 'that has drifted from the scan replaces a silent gate with a lying one');
-        }
-    });
-    check(() => {
-        if (ROOT_DIR_WATCH_HINTS.some((h) => !h.startsWith('packages/rest/src'))) {
-            problems.push('the declaration widened past this gate\'s own package — `packages/**` would paste '
-                + 'this gate onto every card under packages/, which is worse than the silence it replaces');
-        }
-    });
-
     // ── The floor: every declared battery RAN, and ran its cases (#13489) ────
     //
     // Evaluated after every battery has had its chance and BEFORE the verdict, so

scripts/check-optional-error-sink-contract.mjs

@@ -243,27 +243,6 @@ const BASELINE_PATH = join(HERE, 'optional-error-sink-contract.baseline.json');
 /** Where the PUBLISHED contracts live. See "Scope" in the header. */
 const SCAN_ROOTS = ['packages'];
 
-/**
- * The population this gate walks, declared for `scripts/pm/dispatch-gates.mjs`.
- *
- * `SCAN_ROOTS` is a runtime constant and the derivation reads SOURCE TEXT, so
- * the bare word `packages` contributes NOTHING: `hintCovers` refuses a
- * single-segment literal by design, because `packages` is a path COMPONENT in
- * dozens of gates that never read that root. This gate therefore declared no
- * path at all, was scored `undetermined` for EVERY card, and appeared in no
- * dispatch brief and no `--commands` harvest while CI ran it on every pull
- * request. The subtree spelling is the escape the idiom exists to be.
- *
- * ⛔ Not a whole-tree marker: `packages/**` is a subtree, and a whole-tree
- * declaration would put this gate on every card in the repo on a population it
- * does not read.
- *
- * The self-test derives the coupling from `SCAN_ROOTS` on both sides rather
- * than re-spelling it, so a widened or renamed root cannot leave this
- * declaration describing the old population.
- */
-const ROOT_DIR_WATCH_HINTS = ['packages/**'];
-
 const SKIP_DIRS = new Set([
     'node_modules', 'dist', 'build', 'coverage', '.turbo', '.next', '.cache', 'json-schema', '.git',
 ]);
@@ -847,12 +826,11 @@ let selfTestReachedVerdict = false;
 // to find what stopped registering.
 const SELF_TEST_BATTERIES = Object.freeze({
   'check-optional-error-sink-contract self-test': 66,
-  'the dispatch-gates population declaration': 4,
 });
 
 // DELETING an entry silences that battery's floor exactly as effectively as
 // zeroing it, so the roster's own size is pinned too.
-const SELF_TEST_BATTERY_FLOOR = 2;
+const SELF_TEST_BATTERY_FLOOR = 1;
 
 // The key an assertion is filed under when no battery is open. It is not a
 // declared battery, so it reds by the same set difference rather than silently
@@ -1168,36 +1146,6 @@ check(() => {
         }
     }
 
-    // ── The dispatch-gates population declaration ───────────────────────────
-    battery('the dispatch-gates population declaration');
-    const declFail = (msg) => { failures++; console.error(`  ✗ ${msg}`); };
-check(() => {
-        const separatorless = SCAN_ROOTS.filter((r) => !r.includes('/'));
-        if (!separatorless.every((r) => ROOT_DIR_WATCH_HINTS.includes(`${r}/**`))) {
-            declFail('a separator-less SCAN_ROOT is not declared in the subtree spelling — a bare root is '
-                + 'refused as too generic, so the hint extractor sees nothing and this gate goes back to '
-                + 'scoring `undetermined` for every card.');
-        }
-});
-check(() => {
-        if (!ROOT_DIR_WATCH_HINTS.every((h) => SCAN_ROOTS.includes(h.replace(/\/\*+$/, '')))) {
-            declFail('ROOT_DIR_WATCH_HINTS declares a root this gate does not walk — a declaration that has '
-                + 'drifted from the scan replaces a silent gate with a lying one.');
-        }
-});
-check(() => {
-        if (SCAN_ROOTS.some((r) => ROOT_DIR_WATCH_HINTS.includes(r))) {
-            declFail('the declared form is a SCAN_ROOTS entry — the glob form would send the walk at a '
-                + 'directory the tree does not have.');
-        }
-});
-check(() => {
-        if (ROOT_DIR_WATCH_HINTS.length !== SCAN_ROOTS.length) {
-            declFail('the declaration is not one hint per walked root — an empty or short hint list reads '
-                + 'exactly like the undetermined verdict it exists to leave.');
-        }
-});
-
     // ── The floor: every declared battery RAN, and ran its cases (#13489) ────
     //
     // Evaluated after every battery has had its chance and BEFORE the verdict, so