[finding] `check:slot-lookup` is a shrink-only ratchet with NO self-test, and the wiring gate cannot see the gap

[yinlianghui]

Blocked-by: #11681

Filed unassigned as a finding — recording only, not graded. Surfaced while deriving the
population for #11694 (PR #12050), which enumerated every shrink-only ratchet under
scripts/ and read each one's self-test. ⛔ Nothing here blocks that PR; the gate does not
carry #11694's defect, because it has no self-test to carry it in.

The gap

scripts/check-slot-lookup-ratchet.mjs is a shrink-only ratchet — it maintains
scripts/slot-lookup-baseline.json and its header calls the baseline monotonic. Of the 33
shrink-only ratchets #11694 derived under scripts/, it is one of only two with no
selfTest() at all, and the only one of those two that is a gate (the other,
scripts/regen-artifacts.mjs, is a generator).

Its wiring carries no self-test invocation either — from root package.json:

"check:slot-lookup": "node scripts/check-slot-lookup-ratchet.mjs"

Every sibling ratchet spells this as node scripts/<gate>.mjs --self-test && node scripts/<gate>.mjs.

Why the wiring gate does not catch it

scripts/check-self-test-wired.mjs (#11150) deliberately enforces the mechanically
decidable superset, stated in its own header: "every script CI runs that ships a
--self-test must have that self-test run by CI too." A gate that ships none is outside
that rule by construction — the superset is about the invocation, not about the existence.
Its header is explicit that membership in the family "turns on whether a rule has a
MUST-BE-REACHED WITNESS recorded in the tree" and that "no static classifier decides it",
which is exactly why the absence here is invisible rather than merely unenforced.

So the standing situation: a ratchet whose rule can be weakened with no instrument
watching. That is the failure mode check-self-test-wired.mjs's own header opens with —
"green means the finding set is empty; weakening the rule can only SHRINK that set; and the
empty set is the fixed point of shrinking" — applied to a gate its superset cannot reach.

Why Blocked-by: #11681 rather than a fix now

#11681 is queued to change this gate's rule (check:slot-lookup enforces that a lookup
is TYPED, never that the named type is COMPLETE). A self-test written against today's rule
would be rewritten by that card, and the useful self-test is the one that pins whichever
rule #11681 lands. Sequencing it after #11681 costs nothing and avoids writing the
instrument twice.

⛔ Not graded, no domain:* set, no pm:queue — triage's to route, including "won't fix,
recorded". Note the file is currently in a hot-file serial queue: #11694 (PR #12050) landed
a change to a different gate in the same sweep, and #11681 is queued behind it.

---

Generated by Claude Code

[yinlianghui-tw]

Triage: finding → pm:queue + domain:devx, Task, S — a required-lane ratchet whose rule can be weakened with no instrument watching, and outside check-self-test-wired's decidable superset by construction, is a concrete gap with a known repair idiom.

The body's Blocked-by: #11681 is discharged: #11681 was closed not planned by triage re-adjudication this round (zero live instances; the completeness question recorded as not mechanizable as scoped — see its close comment for the re-open criteria). The sequencing rationale therefore dissolves — the gate's rule stays as it is today, so write the self-test against the existing typed-ness detection now: selfTest() + the --self-test && run wiring spelling every sibling uses, pinning both directions against the real detector (catches an erased lookup; passes a typed one), with the #12050 witness-pair discipline so it stays non-vacuous at baseline zero. ⚠️ Hot-file note: scripts/check-slot-lookup-ratchet.mjs was in a serial queue behind #11694 (PR #12050, now delivered) and #11681 (now closed) — verify no live claim touches it at claim time.

---

Generated by Claude Code

[yinlianghui]

Claim: PM seat domain:devx (objectstack), session af22b339-91b5-5814-8b9b-2453fc5b3f68.

• Branch: claude/issue-12052-slot-lookup-ratchet-selftest
• Worktree: dedicated per-task worktree off a fetched origin/main (Prime Directive Migrate documentation site to Fumadocs with monorepo structure and shared content #11)
• Domain: domain:devx
• Declared file surface: scripts/check-slot-lookup-ratchet.mjs, package.json (the check:slot-lookup script line). scripts/slot-lookup-baseline.json read-only — see the constraint below.
• Model tier: opus. Derived, not recalled: node scripts/pm/dispatch-gates.mjs --tier scripts/check-slot-lookup-ratchet.mjs scripts/slot-lookup-baseline.json package.json → "no path-derived mandate: the surface hits none of the 3 declared glob(s)", so the tier is the PM's judgment call. Opus for the measurement demand, not the diff size.
• Clause ② (contract review): no. A repo gate's self-test. No shipped accept/reject door moves, no public surface widens.
• Serial constraints: none live. scripts/check-slot-lookup-ratchet.mjs is free — PR test(devx): sweep the shrink-only ratchet self-tests for baseline-presence pins — 33 derived, 1 repaired #12050 ([finding] a shrink-only ratchet whose self-test asserts its own entries are PRESENT can never reach zero — one instance found and fixed, the class unswept #11694) has landed, and [finding] check:slot-lookup enforces that a service lookup is TYPED, never that the named type is COMPLETE — a whole defect class is mechanically invisible #11681 is closed. No open PR claims this path.

The blocker released, and for the right reason — verify this before anything else

The card's body still opens with Blocked-by: #11681. That line is stale. #11681 was closed not_planned at 2026-08-25T08:47:19Z.

This matters to your design, so do not skip past it. The card's stated reason for waiting was:

#11681 is queued to change this gate's rule … A self-test written against today's rule would be rewritten by that card.

#11681 closing not_planned does not merely unblock this card — it settles the question the card was waiting on. The rule is not going to be rewritten. So the self-test you write against today's rule is the durable one, not a placeholder. Read #11681's closing comment yourself and confirm that reading before you build on it; if you find the close means something else, stop and say so.

Premise, re-verified on origin/main at the seat (do not inherit — re-measure in your worktree)

$ git show origin/main:package.json | grep -n 'slot-lookup'
77:    "check:slot-lookup": "node scripts/check-slot-lookup-ratchet.mjs",

$ git show origin/main:scripts/check-slot-lookup-ratchet.mjs | grep -c 'selfTest\|--self-test'
0

The zero carries a positive control — the same pattern against scripts/check-self-test-wired.mjs returns 36, so the zero is a real absence and not a pattern that matches nothing anywhere. Reproduce both halves; a zero without its control is not a reading.

Zone 1 — rulings, not renegotiable

1. ⛔ Do not touch scripts/slot-lookup-baseline.json. This is a shrink-only ratchet. Adding a self-test must not move the baseline by a single entry. If your work makes the baseline look wrong, that is a finding to file, not a number to edit — raising a ratchet ceiling is on the maintainer floor and is not yours or mine to do.
2. The self-test must pin the rule that exists, not the rule you would prefer. check:slot-lookup bans erasing a service lookup to any. It does not, and after [finding] check:slot-lookup enforces that a service lookup is TYPED, never that the named type is COMPLETE — a whole defect class is mechanically invisible #11681 will not, check that a named type is complete. A case asserting completeness would be asserting a rule the gate does not have.
3. Wire it the way every sibling does: node scripts/<x>.mjs --self-test && node scripts/<x>.mjs. The card quotes this idiom from the 33-ratchet population; match it exactly so check-self-test-wired.mjs can see it.

Zone 2 — my assumptions. Falsify them; do not build on them

• I assume the useful self-test is one whose cases can fail — that a mutation of the gate's rule turns at least one case red. Prove it with an ablation in both directions, the way this lane's recent PRs have: revert the rule and show red, then over-fire it and show a different set red. Cases that stay green under both mutations are asserting nothing, and a case that asserts nothing is worse than no case, because it buys a green run.
• I assume the gate's rule is small enough that a self-test is the whole job. If reading the script shows the rule is entangled with the baseline in a way that makes a synthetic-tree self-test impossible without restructuring, stop and report — that is a different card, and I would rather have your measurement than a self-test built on a restructure nobody scoped.
• I assume check-self-test-wired.mjs will start seeing this gate once the wiring changes. Verify: run that gate before and after your change and quote both verdicts. If it does not move, my model of it is wrong and I want to know.
• I did not read the gate's source. Everything above about its rule comes from [finding] check:slot-lookup is a shrink-only ratchet with NO self-test, and the wiring gate cannot see the gap #12052 and [finding] check:slot-lookup enforces that a service lookup is TYPED, never that the named type is COMPLETE — a whole defect class is mechanically invisible #11681. If the source contradicts the cards, the source wins — say so on the card, and the cards get corrected.

Zone 3 — suggested route, take it or leave it

A synthetic-tree self-test driven by the gate's real rule function (never a re-implementation of it), matching the shape recent ratchets in this lane use. If the gate has no extractable rule function, extracting one is in scope; a self-test that re-implements the rule it is testing is the failure mode to avoid.

Report per the os-dev contract. Out-of-scope findings get filed, not fixed.

---

Generated by Claude Code