tooling(pm): render a value-bearing CI invocation instead of falling back to a bare key (#15114)

`dispatch-gates` keyed the argv half of `(script, args)` only when the tail was
a complete run of flag-shaped tokens. Every other invocation kept a BARE path
key — and for nine scripts that bare key is an invocation CI never makes.
Measured on this tree: `node scripts/check-test-completeness.mjs` exits 3 with
`PREREQUISITE NOT MET`; `check-required-contexts` runs the static pin check
while `required-set-patrol.yml` runs `--verify-required-set`; the three
`--base` gates answer against their default base while CI pins the merge base
or the cut snapshot.

Each argv token is now classified from the workflow text as a LITERAL (verbatim
in the workflow, same on every run) or a VARIABLE (`${{ … }}`, a shell
expansion, a step output). An all-literal invocation renders in full and enters
`--commands`; one carrying a variable renders with the variable's own name in
the value position, is marked NOT RUNNABLE LOCALLY on its own labelled line
under its own heading, and is kept out of `--commands`, out of the pasted block
and out of the published harvest — the same treatment `ciOnly` already gets,
reached by a different measurement. No per-script declaration table: the split
reads off the workflow for all fifteen live invocations.

Two mechanisms make the classification possible. `joinLineContinuations`
splices a continued command into one line before any matcher runs, so the tail
is the WHOLE argv rather than the first physical line of it (comments are never
joined — a `#` runs to the newline, so its backslash is comment text).
`tailBeforeRedirection` drops a redirection's file descriptor, which `2>&1` had
been leaving on the argv side of the boundary.

Measured, before -> after over the tracked tree:

  check families discovered      240 -> 249   (+9, ZERO lost)
  watch-hint (gate, file) pairs  1499 -> 1528 (+29, ZERO lost)
  re-attributed                  0 — every surviving family keeps its exact
                                 workflow set and hint count

Beyond the nine the card named, the same sweep at this commit finds
`scripts/pm/check-half-states.mjs` (a tenth member: `half-state-patrol.yml`
runs it `--format=markdown --provenance="$PROVENANCE"` and nowhere else), and
`check-release-section-coverage.mjs --strict` — a second invocation in
`release-coverage-patrol.yml` that had no entry of its own because a
continuation hid it.

Self-test: 1338 cases pass. Two cases that pinned the retired refusal are
rewritten on the same fixtures to the new expectation; four that named a bare
key now name the script or the keyed invocation. New cases pin one literal
kind, one variable kind, the bare-invocation control, the tokenizer, the
continuation join and the live class read from the real workflows.

`scripts/pm/bare-root-worklist.mjs` records the verdict rows this re-keying
owes, per that script's own printed remedy: three rows for the retired bare
`check-adr-0087-registration` key are deleted and six second-key twins recorded
in their place, one per workflow invocation. Verdict and spelling carried
whole; no count restated, because this pass measured none.


Claude-Session: https://claude.ai/code/session_019RfFHiRCSs3JXLK4cwcfox

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

scripts/pm/bare-root-worklist.mjs

@@ -812,23 +812,6 @@ const TRIAGE = new Map([
     why: 'workspace manifests only — 4 of 241 (1.7%), re-measured 2026-08-26; the spelling reaches '
       + '4 of 4, 100% precise and complete. Deferred with its packages half',
   }],
-  ['scripts/check-adr-0087-registration.mjs PACKAGE_ROOTS packages', {
-    verdict: 'SPELLABLE-UNDECLARED',
-    spelling: 'packages manifests',
-    why: 'workspace manifests only — 74 of 5275 (1.4%), re-measured 2026-08-26 rather than '
-      + 'inherited from the identically-shaped row above; the spelling reaches 74 of 74. Deferred '
-      + 'for the reason recorded there',
-  }],
-  ['scripts/check-adr-0087-registration.mjs PACKAGE_ROOTS apps', {
-    verdict: 'SPELLABLE-UNDECLARED',
-    spelling: 'apps manifests',
-    why: 'workspace manifests only — 1 of 40 (2.5%), re-measured 2026-08-26; 1 of 1 covered',
-  }],
-  ['scripts/check-adr-0087-registration.mjs PACKAGE_ROOTS examples', {
-    verdict: 'SPELLABLE-UNDECLARED',
-    spelling: 'examples manifests',
-    why: 'workspace manifests only — 4 of 241 (1.7%), re-measured 2026-08-26; 4 of 4 covered',
-  }],
   ['check:skill-compatibility PACKAGE_ROOTS packages', {
     verdict: 'SPELLABLE-UNDECLARED',
     spelling: 'packages manifests',
@@ -900,6 +883,67 @@ const TRIAGE = new Map([
       + 'row. Verdict and spelling carried as one decision about one population, counts '
       + 'deliberately not restated',
   }],
+  // ── The same twins, one turn further: an argv the workflow FILLS IN (#15083)
+  //
+  // The three rows these replace were keyed on `scripts/check-adr-0087-
+  // registration.mjs` with no argv, and they went STALE without the gate
+  // changing a byte. `dispatch-gates` now renders a value-bearing invocation
+  // instead of dropping back to a bare path key, and CI invokes this gate only
+  // as `--base "$MERGE_BASE"` (pr-automation.yml) and `--base "$SNAPSHOT_SHA"`
+  // (cut-rc.yml) — never bare — so the unflagged key stopped being derived at
+  // all and two keys arrived in its place. The `--self-test` twins above still
+  // say "the row keyed on this same script without the flag"; that row is
+  // these two, split by the workflow that runs it.
+  //
+  // ⛔ Still not new populations, and still no count restated: one literal, one
+  // constant, one file, read through more keys. The verdict and the spelling
+  // are the retired row's, carried whole, for the reason the block above gives
+  // — a different verdict on the same literal would have this map assert two
+  // decisions about one population.
+  ['scripts/check-adr-0087-registration.mjs --base "$MERGE_BASE" PACKAGE_ROOTS packages', {
+    verdict: 'SPELLABLE-UNDECLARED',
+    spelling: 'packages manifests',
+    why: 'the pr-automation.yml invocation of the row that used to be keyed on this script bare — '
+      + 'same file, same constant, same root, one population. It exists because the derivation '
+      + 'renders the argv CI actually passes, and this gate has no bare invocation to fall back '
+      + 'to. Verdict and spelling are that row decision, unchanged; ⛔ no count is restated here, '
+      + 'because this pass measured none',
+  }],
+  ['scripts/check-adr-0087-registration.mjs --base "$MERGE_BASE" PACKAGE_ROOTS apps', {
+    verdict: 'SPELLABLE-UNDECLARED',
+    spelling: 'apps manifests',
+    why: 'apps half of the pr-automation.yml invocation — same file, same constant, same root as '
+      + 'the retired bare row. Verdict and spelling carried as one decision about one population, '
+      + 'counts deliberately not restated',
+  }],
+  ['scripts/check-adr-0087-registration.mjs --base "$MERGE_BASE" PACKAGE_ROOTS examples', {
+    verdict: 'SPELLABLE-UNDECLARED',
+    spelling: 'examples manifests',
+    why: 'examples half of the pr-automation.yml invocation — same file, same constant, same root '
+      + 'as the retired bare row. Verdict and spelling carried as one decision about one '
+      + 'population, counts deliberately not restated',
+  }],
+  ['scripts/check-adr-0087-registration.mjs --base "$SNAPSHOT_SHA" PACKAGE_ROOTS packages', {
+    verdict: 'SPELLABLE-UNDECLARED',
+    spelling: 'packages manifests',
+    why: 'the cut-rc.yml invocation of the same literal — the release cut pins the base to its '
+      + 'snapshot instead of a merge base, which is a different ARGV and the same population. '
+      + 'Verdict and spelling carried whole, counts deliberately not restated',
+  }],
+  ['scripts/check-adr-0087-registration.mjs --base "$SNAPSHOT_SHA" PACKAGE_ROOTS apps', {
+    verdict: 'SPELLABLE-UNDECLARED',
+    spelling: 'apps manifests',
+    why: 'apps half of the cut-rc.yml invocation — same file, same constant, same root. Verdict '
+      + 'and spelling carried as one decision about one population, counts deliberately not '
+      + 'restated',
+  }],
+  ['scripts/check-adr-0087-registration.mjs --base "$SNAPSHOT_SHA" PACKAGE_ROOTS examples', {
+    verdict: 'SPELLABLE-UNDECLARED',
+    spelling: 'examples manifests',
+    why: 'examples half of the cut-rc.yml invocation — same file, same constant, same root. '
+      + 'Verdict and spelling carried as one decision about one population, counts deliberately '
+      + 'not restated',
+  }],
   ['scripts/check-declaration-mirrors.mjs --self-test SCRIPTS_DIR scripts', {
     verdict: 'REFUSE-UNSPELLABLE',
     why: 'second-key twin of the unflagged row for this script. The refusal is about the walk the '