feat(pm): wide-population, a third dispatch-gates derivation channel (#15737)

* wip(pm): wide-population channel in dispatch-gates + ten declarations

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

* feat(pm): teach bare-root-worklist the wide-population declaration

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

scripts/check-init-service-contract.mjs

@@ -78,6 +78,8 @@
  *     node scripts/check-init-service-contract.mjs --self-test # verify the checker
  */
 
+// dispatch-gates: wide-population -- walk(join(ROOT, 'packages')) admits every non-test .ts source under the packages root -- 2182 of 5837 tracked files (37.4%, base 2aa8456cf), recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE in scripts/pm/bare-root-worklist.mjs. The population is not a part of that root, it IS every source in it, so the only true subtree spelling is the bare root -- which would name this gate on every card touching a package. lint.yml carries no paths filter, so CI runs it on every PR regardless.
+
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-live-db-isolation.mjs

@@ -55,6 +55,8 @@
 // `--self-test`, and a live file whose DDL it cannot parse at all is reported,
 // never skipped.
 
+// dispatch-gates: wide-population -- ROOTS is packages, apps and examples, each walked recursively for every .ts/.mts source that is not a .d.ts -- 5269 of 5837 tracked packages/ files (90.3%, base 2aa8456cf), recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE in scripts/pm/bare-root-worklist.mjs. Whole-tree-adjacent across three top-level roots at once: the only spelling true of it is each bare root, which would name this gate on every card touching packages, apps or examples.
+
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-meta-type-normalized.mjs

@@ -78,6 +78,8 @@
  * A new entry needs a reason a reader can check, not a name.
  */
 
+// dispatch-gates: wide-population -- SCAN_DIRS is packages/rest/src, walked for non-test TypeScript sources only. The DIRECTORY is narrow enough to name and the glob would still be false six times in seven: that tree is 133 test files to 21 sources -- 21 of 154 (14%). What cannot be spelled here is the file-KIND filter, not the subtree, which is why the recorded verdict in scripts/pm/bare-root-worklist.mjs is REFUSE-UNSPELLABLE rather than REFUSE-WIDE.
+
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-optional-error-sink-contract.mjs

@@ -228,6 +228,8 @@
  * numbers in this header are stated with the tree they were measured on.
  */
 
+// dispatch-gates: wide-population -- SCAN_ROOTS is packages, walked for every non-test .ts source under it -- 1898 of 4903 (39%), recorded REFUSE-WIDE in scripts/pm/bare-root-worklist.mjs. The population is not a part of that root, it IS every non-test source in it, so a true declaration would name this gate on every card touching a package. This gate's own failure text already prints the subtree spelling, which is how close the shape sits to declaring itself by accident.
+
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-resume-authority-declared.mjs

@@ -102,6 +102,8 @@
 // JSON Schema, and it cannot tell which literal a match belongs to. Object
 // structure decides this, so the checker reads structure.
 
+// dispatch-gates: wide-population -- DEFAULT_SCAN_ROOTS is packages and examples, walked for every non-test TypeScript source -- 1898 of 4903 (39%) and 162 of 238 (68%), recorded REFUSE-WIDE in scripts/pm/bare-root-worklist.mjs on both halves. Refused together rather than split: declaring only the smaller root would read as a claim about where this gate bites, which is exactly what is not known.
+
 import { readFileSync, readdirSync } from 'node:fs';
 import { join, dirname, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-runner-env-posture.mjs

@@ -71,6 +71,8 @@
  * deleting the explanation is how the next author re-introduces the defect.
  */
 
+// dispatch-gates: wide-population -- SCANNED_ROOTS is packages, apps and examples, walked for non-test source beneath a src SEGMENT -- 1812 of 5241 (35%) under packages, 150 of 241 (62%) under examples, and MEASURED AT ZERO (0 of 35) under apps, which has no src tree today. Recorded REFUSE-UNSPELLABLE in scripts/pm/bare-root-worklist.mjs on all three: the narrowest live subtree spelling covers 4291 files to reach 1812 (42%), and 2466 of the files it over-names are the test files this gate deliberately skips -- the one filter no glob idiom can spell.
+
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import { join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-settings-bind-window.mjs

@@ -104,6 +104,8 @@
  *     node scripts/check-settings-bind-window.mjs --self-test # verify the checker
  */
 
+// dispatch-gates: wide-population -- walk(join(ROOT, 'packages')) admits every non-test .ts source under the packages root -- 2182 of 5837 tracked files (37.4%, base 2aa8456cf), recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE in scripts/pm/bare-root-worklist.mjs, the identical corpus its three census siblings walk. The population is every source in that root, so the only true subtree spelling is the bare root and it would name this gate on every card touching a package.
+
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-startup-registry-verdict.mjs

@@ -141,6 +141,8 @@
  * Deliberately no optional-root flag — see `assertRootsResolvable`.
  */
 
+// dispatch-gates: wide-population -- the scan root is join(ROOT, 'packages') and the walk admits every non-test .ts source under it -- 2182 of 5837 tracked files (37.4%, base 2aa8456cf), recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE in scripts/pm/bare-root-worklist.mjs. The population is every source in that root, so the only true subtree spelling is the bare root and it would name this gate on every card touching a package. (--packages-dir retargets that walk for the self-test fixture; the CI invocation walks the repo's own packages root.)
+
 import {
     existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync,
     writeFileSync,

scripts/check-verify-stand-in-erasure.mjs

@@ -69,6 +69,8 @@
 // through a typed helper is out of reach here exactly as it is for the ESLint
 // rule, and is stated in that rule's comment rather than implied.
 
+// dispatch-gates: wide-population -- SCAN_ROOTS is packages and examples, walked for every non-test TypeScript source -- 1898 of 4903 (39%) and 162 of 238 (68%), recorded REFUSE-WIDE in scripts/pm/bare-root-worklist.mjs on both halves. Refused together rather than split, for the reason recorded there: declaring only the smaller root would read as a claim about where the stand-ins land.
+
 import { readFileSync, readdirSync, existsSync, statSync } from 'node:fs';
 import { join, dirname, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-wildcard-fallthrough.mjs

@@ -74,6 +74,8 @@
  *     node scripts/check-wildcard-fallthrough.mjs --self-test # verify the checker
  */
 
+// dispatch-gates: wide-population -- walk(join(ROOT, 'packages')) admits every non-test .ts source under the packages root -- 2182 of 5837 tracked files (37.4%, base 2aa8456cf), recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE in scripts/pm/bare-root-worklist.mjs. The population is not a part of that root, it IS every source in it, so the only true subtree spelling is the bare root and it would name this gate on every card touching a package.
+
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';