ci: gate that every self-test CI ships is a self-test CI runs

A gate whose defect class is its matching rule cannot detect its own
regression on a clean tree: green means the finding set is empty,
weakening the rule can only shrink that set, and the empty set is the
fixed point of shrinking. `--self-test` is the only instrument watching
such a rule, and nothing required it to keep running.

Adds scripts/check-self-test-wired.mjs: every script a workflow runs
whose code carries `--self-test` must have that self-test run by CI,
with a shrink-only, evidence-checked ledger for the scripts whose
self-test CI runs by another route. Wires the one genuine gap the
enumeration found (the release-coverage renderer).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

Author: claude

.github/workflows/lint.yml

@@ -736,6 +736,58 @@ jobs:
           node scripts/check-step-collectors.mjs --self-test
           node scripts/check-step-collectors.mjs
 
+      # Self-test wiring gate (#11150) — the guard over the `--self-test` legs
+      # themselves, in this file and every other workflow.
+      #
+      # A gate whose defect class is its MATCHING RULE cannot detect its own
+      # regression on a clean tree. Green means the finding set is empty;
+      # weakening the rule can only SHRINK that set; and the empty set is the
+      # fixed point of shrinking. So the production verdict is byte-identical
+      # before and after the rule breaks, and `--self-test` — which supplies an
+      # adversarial input a clean tree by construction does not contain — is the
+      # ONLY instrument watching it.
+      #
+      # Measured rather than argued, one ablation per gate with the mutation
+      # confirmed on disk before any reading was taken: loosening
+      # `check-auth-mount-ledger`'s exact `METHOD path` accounting into a
+      # strict-prefix credit, and deleting the recognizer `check-error-code-
+      # casing` needed for the lowercase codes that shipped past it, each left
+      # the production run GREEN and reddened only the self-test. So the
+      # `<gate> --self-test` + `<gate>` steps throughout this file are not
+      # ceremony beside the live run — for that family the first line is the
+      # only line carrying coverage, and deleting it to save CI time would
+      # remove the coverage while every available signal still said the gate
+      # works.
+      #
+      # What this step holds is the mechanically decidable SUPERSET: every
+      # script CI runs that ships a `--self-test` must have that self-test run
+      # by CI too. Membership needs no classifier, and that is the point —
+      # membership in the family itself is NOT statically decidable. The same
+      # kind of ablation on `check-dispatcher-error-vocabulary` REDDENS its
+      # production run, because a row it declares stops being reached and its
+      # ledger is an equality rather than an emptiness; while a second rule
+      # inside `check-route-envelope` moves neither run. Two rules in one file
+      # can sit on opposite sides, so a family enumerated by name would wire the
+      # wrong set and then read as complete.
+      #
+      # Scripts whose self-test CI runs by some route other than the flag (a
+      # wrapper that spawns another tool's, a gate that runs its own cases on
+      # every invocation) are a shrink-only ledger inside the script, and every
+      # row carries evidence that is re-checked on each run rather than
+      # believed.
+      #
+      # ⚠️ No count is written into this comment on purpose: a number in CI
+      # prose goes stale in silence, which is the same class of defect as the
+      # card that produced this step. The gate prints its own scope line.
+      #
+      # Invoked as `node scripts/…` rather than through a `pnpm check:*` alias:
+      # see the GATE INVOCATION IDIOM note at the top of this file. Reads
+      # `scripts/` and `.github/workflows/` off disk, no network, ~1 s.
+      - name: Self-test wiring gate
+        run: |
+          node scripts/check-self-test-wired.mjs --self-test
+          node scripts/check-self-test-wired.mjs
+
       # Verify-lock entry-point self-test (#9661). `scripts/pm/os-verify-lock.sh`
       # is the ONE way an agent takes the container's shared heavy-verify lock,
       # and it is the enforcement of a rule that used to live only in prose: the

.github/workflows/release-coverage-patrol.yml

@@ -241,7 +241,16 @@ jobs:
           PROVENANCE: >-
             run [${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
             · commit `${{ github.sha }}` · trigger `${{ github.event_name }}`
-        run: node scripts/render-release-coverage-anchor.mjs > "$RUNNER_TEMP/body.md"
+        # Runs its own `--self-test` first (#11150). That leg is not ceremony
+        # here: the renderer's assertions pin `verdict()` — the mapping from the
+        # sweep's two exit codes onto did-not-run / findings / clean — and a
+        # broken mapping still renders a body. The live run below would stay
+        # exit 0 and publish a WRONG report, including the one reading #4690
+        # forbids, a broken instrument rendered as a clean corpus. Only the live
+        # run is redirected; the self-test's own verdict goes to the step log.
+        run: |
+          node scripts/render-release-coverage-anchor.mjs --self-test
+          node scripts/render-release-coverage-anchor.mjs > "$RUNNER_TEMP/body.md"
 
       # The rendered body is the product of the run, so it goes to the step
       # summary on EVERY trigger — including the pull_request runs that must not