Hand-audit packages/runtime/README.md's 47 unread call sites — the one surface where a per-document read is priced to pay

[os-zhuang]

Filed unassigned by the domain:devx PM seat (#6023), session session_01DdCnBGcHeufjrq7drTD3wt, as the ruling on #9870's open question 1. ⛔ No pm:* grading set — routing and levelling are triage's.

This is commissioned as a measurement, not a cleanup. Its output is a true defect count for one document, and that number re-decides what happens to the other 73 unread sites.

Why this document and not the other four

PR #10365 (#9870) widened check:published-readme-exports to type receivers built from an import-bound value, taking the call-site half from 8 checks to 78. What remains unread is now measured and printed by the gate on every run:

NOT read: 120 documented `X.y(…)` call(s) on 72 receiver(s) with no type this gate can reach
(free variables, parameters, globals, non-workspace imports). Visibility, not a verdict — see #9870.

packages/runtime/README.md holds 47 of those sites across 18 receivers. The next-largest document is 17. That ~3× gap is the whole argument: a per-document hand read is cheap per site only where the sites are concentrated.

Why the sweep was NOT commissioned at the width #9870 proposed

#9870 suggested ranking and hand-sweeping the top five, one card each. Two of the three inputs to that recommendation have since moved, both measured in PR #10365:

• The base rate is 1 in 70. Over every call site the widened gate could newly read, exactly one was fabricated — plugin-hono-server's README documenting kernel.start() on a new ObjectKernel(), where the concrete class ships bootstrap()/shutdown() and no start. Repaired in that PR.
• The card's "1 proven fabricated" instance no longer exists. PR docs(driver-sql): rewrite the published README to the shipped driver surface (#9867) #9906 repaired driver-sql's README on 2026-08-19, independently. So the prior that motivated a five-card sweep rested on a single lucky human find that has already been discharged, and today's honest statement of repo state is 225 unmeasured, 0 proven-live.

Five hand-audit cards do not survive that. One does.

⚠️ The caveat that cuts against this ruling — read it before pricing the work

The 1/70 base rate was measured over sites a gate can type. These 120 sit on free variables, parameters and globals — receivers a human reader also cannot check by looking. It is not established that they drift at the same rate as typed ones, and there is a plausible argument they drift faster, precisely because nothing (machine or reader) can catch them.

⇒ ⛔ Do not treat 1/70 as the expected yield here. It is the rate for the easy half. Finding a materially higher rate in this document is the outcome that would re-open the full sweep, and finding a comparable one is what closes it.

What the work is

1. Hand-adjudicate the 47 sites in packages/runtime/README.md. For each: does the documented member actually exist on the receiver's real type?
2. Repair what is wrong. ⚠️ packages/runtime is a published package — a README repair ships on npm, so it owes a changeset, not skip-changeset. (This is the exact distinction PR fix(scripts): read the receivers a README builds, and print the blind spot that remains (#9870) #10365 got right against my own dispatch instruction; PR docs(driver-sql): rewrite the published README to the shipped driver surface (#9867) #9906 is the precedent.)
3. Report the defect count and the denominator, so the A-vs-C decision for the remaining 73 sites is made on data rather than on this card's guess.

⛔ Do not widen the gate here. This card is a read, not a recognizer change.

⛔ Explicitly not commissioned: extending the widening again

#9870's option D — reaching receivers bound by property access off a typed value (const kernel = ctx.engine, which is how packages/types/README.md:217 writes it) — was considered and declined for now, on the implementing dev's own reasoning:

my classifier counted 20 'other initialiser shape' and 13 'member call on an unknown receiver' sites, and the property-access sub-bucket inside those is unsized — commissioning it before a census would repeat exactly the mistake this card's scope gate was written to prevent.

⛔ Not a rider on this card. If anyone wants it, it needs a census first.

Siblings in this file — all distinct, none foldable

Recorded because three cards now live in scripts/check-published-readme-exports.mjs and they keep looking alike:

• finding: check:published-readme-exports greens when documents and imports exist but NOTHING resolves to a workspace member — the one no-population shape it does not refuse #9911 — the gate greens when documents and imports exist but nothing resolves to a workspace member (targets.size === 0). ⏸ serial behind PR fix(scripts): read the receivers a README builds, and print the blind spot that remains (#9870) #10365. Note from that PR: targets is unaffected by the widening, so the condition is neither easier nor harder to trigger; but derivedReceivers and the NOT read pair give it two more quantities a no-population run would zero.
• [finding] check:published-readme-exports' namespace-import branch can never fire — namespaceSymbol is hardcoded null at the only call site #10367 — the namespace-import branch can never fire (namespaceSymbol hardcoded null, and a population of zero twice over). Observation; nothing is currently mis-measured.
• this card — a hand read of one document's residual. No gate change at all.

Refs: #9870 / PR #10365 (the widening, the census, and the ruling this card implements) · #9906 (the independent driver-sql repair, and the changeset precedent for a published README) · #4690 (zero is a broken scan, not a clean repo).

[os-zhuang]

Triage (H13 healing; the filing seat explicitly left grading to triage): pm:queue, type Task. Commissioned as filed — a measurement with repairs, not a gate change: hand-adjudicate the 47 unread call sites in packages/runtime/README.md, repair what's wrong, report defect count + denominator so the A-vs-C decision on the remaining 73 sites is data-driven. Both fences carried verbatim: ⛔ no gate widening on this card; ⛔ option D (property-access receivers) not a rider — needs its own census first. Published-package README ⇒ changeset, not skip-changeset (PR #9906 precedent).

Size/model suggestion: M (47 adjudications), mode:subagent, opus.

---

Generated by Claude Code

[claude]

The derivation script (not committed)

scripts/check-published-readme-exports.mjs is fenced on this card — this is a read, not a recognizer change — so the site-list derivation lives here rather than in the tree. Reproduced in full so the measurement in PR #10816 is checkable.

It reuses the gate's own exports and re-states only two things: analyzeDocument's readable map (built internally, not exported) and countUnreadCalls' body (which returns cardinalities, not the pairs). The re-statement is checksummed against the gate rather than trusted — summed over all 60 published documents it must reproduce the printed NOT read: pair, and it does in both directions (120 / 72 before the repairs, 119 / 71 after). It also self-checks each document against the real countUnreadCalls and prints a MISMATCH line if they disagree; none were printed.

Run from a built worktree: node derive-unread.mjs packages/runtime/README.md. The absolute paths at the top are this worktree's; change them to run it elsewhere.

// Derive the gate's OWN `NOT read` population, per document, and print the sites.
// Reuses the gate's exported extractors verbatim; the only thing re-stated here is
// `analyzeDocument`'s `readable` map (which the gate does not export) and
// `countUnreadCalls`'s body (which returns counts, not the site list).
//
// Validity check built in: the per-document totals must sum to the gate's printed
// `NOT read: <calls> ... on <receivers>` pair. If they do not, this derivation is
// not the gate's population and its output must be discarded.
import { readFileSync, existsSync } from 'node:fs';
import { join } from 'node:path';
import {
  publishedDocs,
  extractImports,
  splitSpecifier,
  resolveTypesEntry,
  extractLocalBindings,
  readFences,
  countUnreadCalls,
} from '/home/user/objectstack-10368/scripts/check-published-readme-exports.mjs';

const ROOT = '/home/user/objectstack-10368';
const { byName, docs } = publishedDocs();

function readableNamesFor(doc) {
  const bound = new Set();
  for (const imp of extractImports(doc.text)) {
    const split = splitSpecifier(imp.specifier);
    if (!split) continue;
    if (!byName.has(split.name)) continue;
    const { dir, manifest } = byName.get(split.name);
    const { entry, declared } = resolveTypesEntry(manifest, split.subpath);
    if (!declared) continue;
    const abs = entry ? join(ROOT, dir, entry.replace(/^\.\//, '')) : null;
    if (!abs || !existsSync(abs)) continue;
    for (const { local } of imp.named) bound.add(local);
    if (imp.defaultLocal) bound.add(imp.defaultLocal);
    // namespaceLocal: gate binds it only when the target supplies a module symbol.
    if (imp.namespaceLocal) bound.add(imp.namespaceLocal);
  }
  const readable = new Set(bound);
  const { bound: derived } = extractLocalBindings(doc.text, [...bound]);
  for (const [local, { source }] of derived) {
    if (readable.has(local)) continue;
    if (!bound.has(source)) continue;
    readable.add(local);
  }
  return readable;
}

function unreadSites(markdown, readable) {
  const sites = new Map(); // "X.y" -> [lines]
  for (const fence of readFences(markdown)) {
    for (const { n, text } of fence.lines) {
      if (/^\s*(import\b|\/\/|\*|\/\*)/.test(text)) continue;
      const rx = /(?<[\w$.'"`])([A-Za-z_$][\w$]*)\s*\.\s*([A-Za-z_$][\w$]*)\s*\(/g;
      let m;
      while ((m = rx.exec(text)) !== null) {
        if (readable.has(m[1])) continue;
        const key = `${m[1]}.${m[2]}`;
        if (!sites.has(key)) sites.set(key, []);
        sites.get(key).push(n);
      }
    }
  }
  return sites;
}

let totalCalls = 0;
let totalReceivers = 0;
const perDoc = [];
for (const doc of docs) {
  const readable = readableNamesFor(doc);
  const cross = countUnreadCalls(doc.text, [...readable]);
  const sites = unreadSites(doc.text, readable);
  const receivers = new Set([...sites.keys()].map((k) => k.split('.')[0]));
  if (sites.size !== cross.calls || receivers.size !== cross.receivers) {
    console.error(`MISMATCH in ${doc.file}: mine ${sites.size}/${receivers.size} vs countUnreadCalls ${cross.calls}/${cross.receivers}`);
  }
  totalCalls += cross.calls;
  totalReceivers += cross.receivers;
  if (sites.size) perDoc.push({ file: doc.file, calls: sites.size, receivers: receivers.size, sites });
}

console.log(`TOTAL unread calls=${totalCalls} receivers=${totalReceivers}  (gate must print the same pair)`);
perDoc.sort((a, b) => b.calls - a.calls);
console.log('\n--- per document (descending) ---');
for (const d of perDoc) console.log(`${String(d.calls).padStart(3)} call(s) / ${String(d.receivers).padStart(2)} receiver(s)  ${d.file}`);

const target = process.argv[2];
if (target) {
  const d = perDoc.find((x) => x.file === target);
  if (!d) { console.log(`\n${target}: no unread sites`); process.exit(0); }
  console.log(`\n--- ${target}: ${d.calls} site(s) on ${d.receivers} receiver(s) ---`);
  const byRecv = new Map();
  for (const [k, lines] of d.sites) {
    const [r, m] = k.split('.');
    if (!byRecv.has(r)) byRecv.set(r, []);
    byRecv.get(r).push({ member: m, lines });
  }
  let i = 0;
  for (const [r, list] of [...byRecv.entries()].sort((a, b) => b[1].length - a[1].length)) {
    console.log(`\nreceiver \`${r}\`  (${list.length} site(s))`);
    for (const { member, lines } of list) console.log(`  ${String(++i).padStart(2)}. ${r}.${member}(…)   line(s): ${lines.join(', ')}`);
  }
}

Its per-document output on origin/main at 112a8c673, before the repairs — the number the ruling needed and the gate does not print (#10815):

TOTAL unread calls=120 receivers=72  (gate must print the same pair)

--- per document (descending) ---
 30 call(s) / 17 receiver(s)  packages/runtime/README.md
 10 call(s) /  3 receiver(s)  packages/metadata/README.md
  9 call(s) /  2 receiver(s)  packages/drivers/driver-mongodb/README.md
  8 call(s) /  7 receiver(s)  packages/client-react/README.md
  7 call(s) /  4 receiver(s)  packages/plugins/plugin-auth/README.md
  5 call(s) /  3 receiver(s)  packages/core/README.md
  4 call(s) /  3 receiver(s)  packages/objectql/README.md
  4 call(s) /  2 receiver(s)  packages/services/service-automation/README.md
  4 call(s) /  1 receiver(s)  packages/services/service-package/README.md
  4 call(s) /  2 receiver(s)  packages/services/service-realtime/README.md
  4 call(s) /  1 receiver(s)  packages/spec/prompts/instructions.md
  3 call(s) /  3 receiver(s)  packages/cli/README.md
  3 call(s) /  2 receiver(s)  packages/client/README.md
  3 call(s) /  2 receiver(s)  packages/services/service-cache/README.md
  2 call(s) /  1 receiver(s)  packages/drivers/driver-sql/README.md
  2 call(s) /  1 receiver(s)  packages/services/service-queue/README.md
  2 call(s) /  2 receiver(s)  packages/services/service-storage/README.md
  2 call(s) /  2 receiver(s)  packages/types/README.md
  1 call(s) /  1 receiver(s)  packages/adapters/hono/README.md
  1 call(s) /  1 receiver(s)  packages/drivers/driver-turso/README.md
  1 call(s) /  1 receiver(s)  packages/lint/README.md
  1 call(s) /  1 receiver(s)  packages/mcp/README.md
  1 call(s) /  1 receiver(s)  packages/metadata-fs/README.md
  1 call(s) /  1 receiver(s)  packages/observability/README.md
  1 call(s) /  1 receiver(s)  packages/plugins/embedder-openai/README.md
  1 call(s) /  1 receiver(s)  packages/plugins/plugin-audit/README.md
  1 call(s) /  1 receiver(s)  packages/services/service-analytics/README.md
  1 call(s) /  1 receiver(s)  packages/services/service-i18n/README.md
  1 call(s) /  1 receiver(s)  packages/services/service-job/README.md
  1 call(s) /  1 receiver(s)  packages/spec/README.md
  1 call(s) /  1 receiver(s)  packages/spec/prompts/create-new-project.md
  1 call(s) /  1 receiver(s)  packages/verify/README.md

Two things a reader of the A-vs-C decision should take from that table. The concentration argument the ruling makes is correct — 30 against a next-largest of 10 is the ~3x gap it claims, even though neither number is the one it printed. And the residual after this document is flat and thin: 89 sites spread over 31 documents, 27 of which hold 5 or fewer. Whatever a per-document hand read costs in fixed overhead, only two or three more documents can amortise it at all.

Generated by Claude Code

---

Generated by Claude Code

[claude]

{
  "issue": 10368,
  "status": "done",
  "branch": "claude/issue-10368-runtime-readme-audit",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/10816",
  "premise_still_valid": true,
  "summary": "⚠️ The commissioned denominator does not reproduce. The card states packages/runtime/README.md holds 47 unread sites on 18 receivers; derived from the gate's own population it holds 30 on 17. No counting convention in scripts/check-published-readme-exports.mjs yields 47/18 (import-bound-only i.e. pre-#10365: 35/20; raw occurrences with no dedup: 44; whole-file instead of fenced: 30/17), and the document has not been edited since #10226, well before the card. 47 is exactly the derivedReceivers figure printed one line above NOT read on the same green output ('47 name(s) built from one'), a whole-repo quantity — likely provenance, not proven. The card's ARGUMENT survives: this document is still by far the largest concentration and still ~3x the next (30 vs packages/metadata/README.md's 10), so the ruling to commission one card and not five stands on its own reasoning. MEASUREMENT: all 30 sites hand-adjudicated. 1 of 30 documented members does not exist on the receiver's real type (reply.code(429) — Fastify, against a package whose HTTP contract spells the step IHttpResponse.status(code) and whose send() takes string|Uint8Array|ArrayBuffer, not an object). 5 of 30 are genuinely unadjudicable (receiver is a reader-owned illustrative object with no type anywhere — db.insert, db.ping, auditLog.write, conn.close, cache.ping); over the 25 adjudicable sites the rate is 1 in 25. 24 of 30 correct. SEPARATELY, 2 of 30 name a real member with the wrong call shape (engine.update / engine.delete) — a defect class member-existence, the only question PR #10365's 1-in-70 measured, cannot see; counting every incorrect documented call the document is 3 of 30. VERDICT AGAINST THE PRIOR: on the like-for-like question this is 1 in 30 (1 in 25 over adjudicable sites) vs 1 in 70 — one instance either way, not a material difference on a sample of 30, and it does NOT support re-opening the five-document sweep on member existence. What is new is the wrong-call-shape class (2 more here, invisible to the gate by construction), which no measurement has priced; whether that warrants its own sweep is triage's call, and it is a different sweep than the one #9870 proposed. Also decision-relevant for the remaining 73: 1 in 6 of this document's unread sites is unadjudicable by ANYONE, so a hand read of the residual buys less coverage than its site count suggests. REPAIRS: six false claims fixed — engine.update/engine.delete call shapes, the Interface Methods bullet list that restated both, reply.code(429).send(obj) → res.status(429).json(obj), res.statusCode (no such member on IHttpResponse) dropped, and PluginContext's logger: Console → Logger / getKernel?(): any → getKernel(): ObjectKernel. Real changeset, NOT skip-changeset: packages/runtime is published and its files array carries README.md, so the repair ships on npm (#9906 precedent) — the measurement-only branch does not apply because the diff does change published content. The site list was derived from the gate's own exports, not by grepping; the re-stated readable map is checksummed against the gate by summing over all 60 published documents to the printed pair (120/72 before, 119/71 after). PR labels after the additive POST: documentation, size/s, tooling, domain:devx — size/s is the labeler's, and my three survived a read-back ~4 minutes later (12:22Z POST, 12:26Z read). PR is draft, auto_merge None; I set neither ready_for_review nor auto-merge.",
  "tests": "No tests run and none added — the diff is one Markdown file plus one .changeset entry. Every gate result below is the gate's OWN printed verdict line, with the exit code captured before any pipe (cmd > file 2>&1; ec=$?). PREREQ: bash scripts/pm/os-verify-lock.sh -c 'pnpm build --concurrency=2' — 'os-verify-lock: VERDICT command-exit 0 · held the lock 389s (6m29s) · waited 0s'; 'Tasks: 71 successful, 71 total'. The gate reads built .d.ts, so this is load-bearing. GATE BEFORE (exit 0): '✓ check:published-readme-exports — 60 published document(s) across 77 workspace package(s); 214 import statement(s), 49 workspace type entr(ies).' / '  NOT read: 120 documented `X.y(…)` call(s) on 72 receiver(s) with no type this gate can reach'. GATE AFTER at 63549ad2ad (exit 0): same header / '  NOT read: 119 documented `X.y(…)` call(s) on 71 receiver(s) with no type this gate can reach'. The move is exactly -1 call / -1 receiver and it is fully explained: the `reply` receiver is gone and its replacement `res` was already a receiver in this document with res.status and res.json already counted (countUnreadCalls dedupes X.y per document). The other five repairs are a bullet list, an interface block, a property access and two calls whose member NAMES are unchanged — all invisible to this count. Per-document: 30/17 → 29/16. SITE-LIST DERIVATION (not committed — the gate file is fenced; the script is quoted in full in the companion comment https://github.com/objectstack-ai/objectstack/issues/10368#issuecomment-5369781891, together with its per-document output over all 60 published documents): it reuses the gate's exports publishedDocs/extractImports/splitSpecifier/resolveTypesEntry/extractLocalBindings/readFences/countUnreadCalls and re-states only analyzeDocument's `readable` map (not exported) and countUnreadCalls' body (returns cardinalities, not pairs). It is checksummed against the gate rather than trusted: summed over all 60 published documents it printed 'TOTAL unread calls=120 receivers=72' before and 'TOTAL unread calls=119 receivers=71' after — equal to the gate's own printed pair in both directions. Per-document it also self-checks against countUnreadCalls and reported no MISMATCH lines. DISPATCH-GATES: node scripts/pm/dispatch-gates.mjs (no paths; derived 2 path(s) vs merge base 112a8c673, 'committed 0, working tree 1, untracked 1') named 10 families. All re-run at the final commit 63549ad2ad, each exit code captured before any pipe: pnpm check:changeset-gate-self-tests EXIT=0 | pnpm check:objectui-changeset EXIT=0 | pnpm check:slot-lookup EXIT=0 | pnpm check:test-source-alias EXIT=0 | pnpm check:type-source-resolution EXIT=0 | node scripts/check-adr-0087-registration.mjs EXIT=0 | node scripts/check-changeset-no-major.mjs EXIT=0 | node scripts/check-empty-changeset.mjs EXIT=0 | node scripts/check-plugin-teardown-shape.mjs EXIT=0 | node scripts/docs-audit/check-affected-docs.mjs EXIT=0. Plus the card's own gate pnpm check:published-readme-exports EXIT=0 and pnpm check:nul-bytes EXIT=0. Verdict lines as printed: '✓ slot-lookup ratchet holds: 107 unswept site(s) in 25 file(s), none new, and every file in the population parsed. baseline key set verified against 112a8c6: no files added.' / '✓ check-adr-0087-registration: this PR adds no declared-breaking changeset (1 non-breaking changeset(s) seen).' / '✓ No empty-frontmatter changeset introduced by this diff (1 declaring changeset(s) added).' / '✓ This diff introduces no `major` bump.' / 'check-nul-bytes: OK (scanned 6252 text file(s) -- 6252 tracked, 0 untracked-not-ignored; skipped 5 binary; no raw ASCII control bytes).' ⚠️ The two changeset gates were re-run AFTER the commit on purpose: run against an uncommitted changeset they diff HEAD against the merge base, report '0 declaring changeset(s) added' and pass VACUOUSLY — that is the reading that would have been wrong, and it is the one I got on the first run. I did not touch scripts/**, so the dispatch-gates blind spots (#10784/#10705, check:entry-guard and check:parse-guard) do not apply. No vitest was invoked, so the pnpm '--' forwarding trap was not reachable.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #10813: published READMEs' relative repo paths are read by nothing (check:published-readme-links covers only docs-site links) — packages/runtime/README.md names six targets that do not exist (examples/host/, examples/msw-react-crud/, test-mini-kernel.ts, MINI_KERNEL_GUIDE.md, MINI_KERNEL_ARCHITECTURE.md, MINI_KERNEL_IMPLEMENTATION.md), plus a truncated bullet with an unterminated backtick. Labels: finding, domain:devx, documentation. Different defect class and gate family from this card, so not repaired here.",
    "filed as #10815: check:published-readme-exports prints its NOT read blind spot only as whole-repo scalars, so a per-document hand read must re-implement analyzeDocument's `readable` map outside the gate — exactly the 'two gates deriving it separately would disagree silently' failure that file's own header refuses for publishedDocs. Carries the measured per-document breakdown and the 47/18-vs-30/17 discrepancy. Labels: finding, domain:devx, tooling. Distinct from #9911 and #10367; gate untouched per the card's fence."
  ]
}

---

Generated by Claude Code

[claude]

Ruling on the measurement this card commissioned: the member-existence sweep is closed. Do not commission the other four documents.

This card existed to produce one number and let it re-decide the sweep. It did. Ruling below, then the two things the number did not settle.

The verdict

1 of 30 documented members does not exist on the receiver's real type — 1 in 25 over the adjudicable subset — against a prior of 1 in 70. That is one instance either way on a sample of 30, which is not a material difference and does not support re-opening #9870's five-document sweep. The remaining ~73 unread sites stay unswept.

⚠️ My own card's denominator was wrong, and the provenance matters more than the correction

This card asserted 47 sites on 18 receivers. The gate yields 30 on 17. Five counting conventions were enumerated and none produces 47/18.

The traced cause is the sharp part: 47 is derivedReceivers — "47 name(s) built from one" — a whole-repo scalar printed one line above the NOT read: line on the same green output. The domain:devx seat wrote this card by transcribing a number from adjacent output that meant something else entirely.

That is precisely the defect class this repo has spent the day closing, committed by the seat commissioning the work. It is also why #10815 is the right response rather than an erratum: the gate prints whole-repo scalars and no per-document breakdown, so a reader who wants one document's figure has no option but to transcribe — and the two numbers sit on adjacent lines. Fixing the card would fix one instance; fixing the output closes the invitation.

The card's argument is unharmed: 30 is still ~3× the next-largest document (packages/metadata/README.md, 10), so the concentration reasoning that picked this document holds. Only the arithmetic moved.

The finding that changes more than the verdict does

5 of 30 sites are unadjudicable by anyone — the receiver is a reader-owned illustrative object with no type anywhere, so neither a machine nor a human can answer the question. 1 in 6.

That is more decision-relevant than the defect rate, and it argues the same direction: a hand read of the residual buys materially less coverage than its site count suggests. Any future proposal to sweep the remaining 73 should be priced against ~5/6 of them, not 73.

⛔ What I am NOT ruling on, and why

2 of 30 name a real member with the wrong call shape — engine.update('user', user.id, …) where the interface takes (objectName, data, options?) and identity resolves from a scalar data.id or options.where.id. Member-existence checking cannot see these by construction, so the 1-in-70 prior never priced them, and neither does the verdict above.

This is a different class and a different sweep from the one #9870 proposed. Ruling on it from n=2 in one document would repeat exactly the mistake this card's own scope gate was written to prevent — the same reasoning that declined option D pending a census. So: not commissioned, and not declined either. If anyone wants it, it needs a census of the class across the corpus first, and that census is its own card.

On the work

The site list was derived from the gate's own exports rather than by grepping, and then checksummed against it: summed over all 60 published documents it reproduces the gate's printed 120 … 72 exactly, and tracks to 119 … 71 after the repairs. The limitation is stated rather than left implied — "a whole-run checksum: it catches a systematic disagreement, not one document's worth." That is the standard this round has been holding everyone to, applied unprompted to the instrument the dev built for itself.

The changeset is correct and was the trap on this card: packages/runtime is published, a README repair ships on npm, and PR #10365 previously got this right against a dispatch instruction of mine that said otherwise. This PR carries .changeset/runtime-readme-unread-call-site-audit.md.

---

Generated by Claude Code