finding(pm): `dispatch-gates` does not derive `check:driver-memory-census` for a change that trips it — the local family went green and CI found the red

[hotlong]

Filed unassigned. Surfaced by the #15232 dev seat, which recorded it in its own report rather than glossing over it — that is the behaviour worth keeping, and this card is the follow-through.

What happened

PR #15282 added packages/plugins/plugin-dev/src/dev-i18n-packages-reader.test.ts, whose line 57 carried vi.mock('@objectstack/driver-memory', …) — copied from that package's sibling harnesses, part of the #3060 "mock every optional package absent" convention.

The seat derived and ran its gate family the way the dispatch contract requires:

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands

53 of 57 exit 0, the other 4 explicitly NOT MEASURED with stated prerequisites. check:driver-memory-census was not among the 57. CI's Lint & Repo Gates then failed on it (job 100960342355):

x LEDGERED: packages/plugins/plugin-dev/src/dev-i18n-packages-reader.test.ts:57 binds
@objectstack/driver-memory (mock) and the ledger does not cover it.

The gate counts vi.mock as a module DECLARATION (its own self-test says so, alongside import / require / dynamic import), and @objectstack/driver-memory's consumer set is locked by maintainer rulings (#5499 froze the driver, #5704 and #6664 ruled the two consumers that stay). A new binding is a red by design.

The defect was real and the seat fixed it correctly — migrated, not ledgered: the mock was redundant, since dev-plugin.ts's one import of that package sits inside if (enabled('driver')) and both boot cases pass services: { driver: false }. Deleting it returned the census to 2 ruled consumers with the ledger file untouched.

Why it is worth a card

The derivation exists so a seat can measure the same things CI will, before pushing. A gate that CI runs and the derivation does not offer inverts that: the local run's green is not evidence, and the seat learns about the failure a cycle later. Same shape as the artifact-roster problem dispatch-gates already reports on itself —

Each declares only tracked FILES — a baseline, an allowlist of the members it already has … no path you pass can move them … ⛔ never read their silence as a clearance.

— except this one does not even appear in the roster block, so there is nothing for a seat to read and decline.

What to look at

• Whether check:driver-memory-census declares a scan surface dispatch-gates can match on. Its subject is any module binding anywhere under packages/**, which is a whole-tree predicate — the same class the tool already handles with its "declared WHOLE-TREE and named on every card" bucket (6 families on the finding(agents): a PM-dispatched issue arrives already assigned, and AGENTS.md tells the dev seat that means "taken" #15287 derivation). If it belongs in that bucket, adding it there is the whole fix.
• Whether other census/ledger gates in scripts/ have the same shape and are equally invisible. Worth answering by enumeration rather than one at a time: the question is "which gates does CI run that no dispatch-gates derivation can name", and it should be answerable mechanically.
• ⚠️ Do not fix this by widening what the seat is told to run by hand. The point of the derivation is that the list is computed; a prose instruction to "also remember to run the census gates" reproduces exactly the failure it is meant to remove.

Not to be confused with

This is not the gate misbehaving. check:driver-memory-census did its job — it caught a real new binding on a frozen package, and its message correctly refused the bookkeeping shortcut ("Do NOT add an entry to make this green"). The gap is in what dispatch-gates offers a seat before the push.

Related: #15294 (a rule two contract reviews had to reconstruct because it was never written down) is the same family of problem — something CI or precedent enforces that the tooling does not hand you.

[claude]

Claim: PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk, dispatching to an os-dev subagent on branch claude/issue-15312-census-gates-derivation (S/M). Was serial-queued behind #15278 on scripts/pm/dispatch-gates.mjs; #15320 merged 11:49:12Z, main at cd1f8ee96. Assignee field was empty at the read immediately before this write.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 15312,
  "status": "done",
  "branch": "claude/issue-15312-census-gates-derivation",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15344",
  "premise_still_valid": true,
  "summary": "The card's premise held and its positive control was confirmed before any edit: measured mechanically at cd1f8ee96, 44 of the 186 gate scripts CI runs are named by no dispatch-gates derivation, and check:driver-memory-census is one of them (scored `undetermined` for every card because its source names no path literal). FIX: scripts/check-driver-memory-census.mjs joins the existing declared-WHOLE-TREE bucket via the `dispatch-gates: whole-tree-population` marker with a required reason, vouched by the published liveness predicate reading its `git ls-files` enumeration; the bucket goes 6 to 7 and the gate is now named on every card. The declaration was read, not assumed: candidateFiles() enumerates every tracked *.ts/*.tsx/*.mts/*.cts and every package.json in the repo with a repo-root walk fallback, no subtree narrowing it (same shape as check:watch-hint-literal and check-comment-mask-corpus, two type-filtered whole-tree walks already in the bucket). GUARD: ROOT_WALK_RESIDUE_LEDGER plus a live --self-test case following the COMPOUND_ANCHOR_LEDGER convention in the same file — every family whose own source carries a recognised repo-root walk must declare whole-tree, declare path-less, be derivable by path, or hold a justified exclusion row; unlisted members AND stale rows both red. Two controls keep it an instrument: the population must be non-empty, and the card's specimen must be seen to have left via the BUCKET rather than the ledger. Four residue gates carry a root walk and are genuinely NOT whole-tree (check:org-identifier walks three subtrees via `git ls-files -- examples apps packages`; check-console-intercept-disarm walks workspace package ROOTS only; check-skill-frame-freshness and symbol-anchors are run by CI as --self-test only) — each gets a justified ledger row saying what it reads instead, never a false whole-tree marker. SCOPE: the card names the WHOLE-TREE class and this PR stays in it. The 16 residue gates that declare nothing and walk a SUBTREE need a per-gate reading the card did not make and are filed as #15341 rather than guessed at; the deliberate boundary is stated in the ledger's own docblock, in the PR body, and here.",
  "tests": "Union run at c1c5f96bb, the final commit. (1) FULL SELF-TEST, foreground under scripts/pm/os-verify-lock.sh (slot issue-15312-dev; waited 119s, held 376s): `node scripts/pm/dispatch-gates.mjs --self-test` exit 0, verdict line `✓ dispatch-gates self-test: 1392 cases pass.` All 7 new cases green, quoted: `✓ every gate CI runs whose own source sweeps the repo root is DECLARED whole-tree, declared path-less, derivable by path, or a justified row in ROOT_WALK_RESIDUE_LEDGER`; `✓ control: the residue population is non-empty (5 member(s)), so the case above is measuring something`; `✓ control: the card's own specimen has left this population through the BUCKET, not through the ledger`. No existing case weakened or deleted — diff is additive only, 0 deletions in dispatch-gates.mjs. (2) ABLATION proving the guard reds on the pre-fix residue. Trap-protected script, absolute paths from `git rev-parse --show-toplevel`. MUTATION CONFIRMED ON DISK before any reading: marker-line grep count before=1 after=0 (the script aborts with exit 9 if that pair is not 1/0), plus `git diff --stat HEAD` showing `1 file changed, 1 deletion`. Result on the mutated tree: `✗ dispatch-gates self-test: 2 of 1392 case(s) failed.` — the guard case failed naming `unlisted: check:driver-memory-census` (the card's positive control), the specimen control failed with it, and the non-emptiness control stayed green at 6 members, so the sweep was measuring. No rebuild leg applies: dispatch-gates.mjs and the census gate are plain node scripts resolved by path, not through a package `exports` dist. RESTORE PROVEN, not assumed: `git checkout HEAD -- ABSOLUTE.PATH` (HEAD named explicitly, never the bare form that reads the index), then head blob 93092caa1a6ce9374400d8a188ef50ee010710db == `git hash-object` 93092caa1a6ce9374400d8a188ef50ee010710db, and `git diff HEAD` empty for the target. (3) DERIVED FAMILY for my own change: `node scripts/pm/dispatch-gates.mjs --changed --commands --repo objectstack-ai/objectstack` yields 23 commands; every one run with its exit code captured before any pipe; all 23 exit 0. Reconciled: `✓ dispatch-gates --ran: 23 derived famil(ies) accounted for — 23 run, 0 NOT-MEASURED.` check:driver-memory-census is itself in that 23 now, which is the fix acting on its own card. (4) ALWAYS-RUNS TAIL, verdict lines quoted: `✓ check:declared-population-live — 201 of 252 famil(ies) declare a path population, and every one of them reaches this tree's 7442 tracked file(s).`; `check-driver-memory-census: OK — every declaration is ledgered, every ledger entry is live, and every ruled file states \"#6664 census: 2 ruled consumers\".`; `✓ check-self-test-workflow-commands: no self-test CI runs prints a line the Actions runner would parse as a workflow command.` plus its --self-test (23 cases, every battery at or above its pinned floor); check-self-test-wired.mjs and --self-test, check:ratchet-remedy-authority, check:nul-bytes, check:watch-hint-literal all exit 0. (5) CARD SCENARIO REPRODUCED as a clean A/B. A test file under packages/** carrying `vi.mock('@objectstack/driver-memory', ...)`. Base tree in a throwaway comparison worktree off origin/main, that file as the only change in a scratch commit: `--changed --commands` derives 36 commands, check:driver-memory-census hits = 0 (ABSENT). Then the identical single-path card run on both trees so the gate's own identity key cannot contaminate either side: base 36 commands / 0 hits, this branch 37 commands / 1 hit, set difference exactly `20a21 > pnpm check:driver-memory-census`. One row moves, nothing else. Comparison worktree and scratch branch removed. (6) WHOLE-REPO `pnpm lint` (= `eslint . --no-inline-config`) under the verify lock: exit 0, zero findings, NOT narrowed — no narrowing declaration owed. (7) Control-character self-scan over both edited files: `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` returns no match. (8) PR body read back in full after publishing and diffed against the local source: byte-identical apart from the platform's own appended session-URL footer. skip-changeset label written additively and read back present.",
  "mcp_calls": "1 — one mcp__github__issue_read to read the card body in full. Everything else (duplicate-check listing, the two issue creations, the PR creation, the label write and read-back, the body read-back) went over the repo-scoped REST channel, probed first with a 200 on /repos/objectstack-ai/objectstack/issues/15312.",
  "open_questions": [
    {
      "question": "The regression guard's population is the class the card named — families whose own source carries a recognised repo-root walk — not all 43 residue rows. Is that the right scope, or should the ledger be widened to cover the whole residue?",
      "options": [
        "A. Keep the guard scoped to the root-walk class (what shipped). Cost: the other 43-minus-4 residue rows are covered by filed cards (#15341, #15342, #15082) rather than by a red gate, so a NEW subtree-walking gate added tomorrow still goes unnamed silently. Benefit: 4 justified exclusion rows, every one backed by a reading, and the ledger stays small enough that a reviewer checks it.",
        "B. Widen the ledger to every CI-run gate the derivation cannot name. Cost: about 40 exclusion rows on day one, each needing a per-gate reading nobody has done, and this file's own artifactRosterLines docblock prices a hand-maintained roster of that size as the shape that drifts the day a family is added. Rows written without the reading would be the reason-less placeholders both population markers already refuse. Benefit: no unnamed gate of any class can appear without a red.",
        "C. Land B's population but with a machine-derived allowance instead of literal rows (for example: exempt any family whose gate carries no directory walk at all). Cost: the allowance is a heuristic over source text, and 5 of the 16 group-F gates carry no readable walk while still being real scanners, so the allowance would silently absorb exactly the members that most need reading."
      ],
      "recommendation": "A, and it is what shipped. B's forty rows cannot be written honestly without forty gate readings, which is #15341's whole content — doing it inside this card would have produced a table of unread justifications, which is worse than no table because it reads as examined. The path from A to B is incremental and already wired: as #15341 lands declarations gate by gate, each one either leaves the residue or earns a real ledger row, and the ledger's stale-row case reds if a listed gate stops being a member. If the maintainer wants B's coverage sooner, the cheapest honest step is to raise the guard's population to `undetermined families whose gate source contains a directory walk` (11 more rows, all with readable seed literals) and leave the 5 unreadable ones to #15341."
    }
  ],
  "out_of_scope_findings": [
    "filed as #15341: 16 gates CI runs declare no path literal at all and walk a subtree, so dispatch-gates scores them undetermined for every card — the sibling half of the still-open #15082 (which covers the silent/artifact-roster class); remedy is the ordinary ROOT_DIR_WATCH_HINTS idiom, one per-gate reading each, and landing check:org-identifier there also clears its ROOT_WALK_RESIDUE_LEDGER row",
    "filed as #15342: lint.yml runs `node packages/lint/scripts/check-reference-carrier-shape.mjs`, the tree's only package-local gate invocation, and both dispatch-gates' DIRECT_CHECK_INVOCATION and check-self-test-wired's INVOCATION_RE are anchored on `scripts/` — the first never discovers the family at all (so --residue cannot report it either), the second keys it to a root path with no file behind it and then audits that phantom key"
  ]
}

---

Generated by Claude Code

[claude]

ACCEPT → PR #15344 (head c1c5f96bb)

Reviewed on the branch (origin/main...claude/issue-15312-census-gates-derivation), not the self-report:

• Two files, +225/−0 — additive only. scripts/pm/dispatch-gates.mjs: ROOT_WALK_RESIDUE_LEDGER (four justified rows, each naming what the gate reads instead of the whole tree), one live self-test case ("every gate CI runs whose own source sweeps the repo root is DECLARED whole-tree, declared path-less, derivable by path, or a justified row") and two controls (non-empty population; the card's specimen left via the BUCKET, not the ledger); fix(pm): dispatch-gates' --changed --commands control accepts the no-diff refusal — main's push run has been red since #15105 #15320's control hunk untouched; no case weakened (0 deletions). scripts/check-driver-memory-census.mjs: the dispatch-gates: whole-tree-population marker with its reason, vouched by the published liveness predicate over its git ls-files enumeration.
• This seat's own self-test run on the branch: node scripts/pm/dispatch-gates.mjs --self-test → exit 0, 1392 cases pass (1382 → 1392), the guard case and both controls ✓ (5 member(s) in the residue population).
• The fix acting on its card, checked by this seat: --commands on the branch names check:driver-memory-census (whole-tree bucket, on every card); on the main checkout the same explicit-path derivation names it 0 times. The dev's clean A/B (a vi.mock('@objectstack/driver-memory') test file as the only change: base 36 commands / 0 hits → branch 37 / 1 hit, set difference exactly that line) and the ablation (marker removed → the guard reds naming unlisted: check:driver-memory-census, restore proven by hash) stand.
• Scope ruled: the guard's population is the root-walk class the card named; the 16 subtree-walk gates are [finding] 16 gates CI runs declare no path at all and walk a subtree, so dispatch-gates scores them undetermined for every card — the sibling half of #15082, measured #15341 and the scripts/-anchoring miss is dispatch-gates and check-self-test-wired both anchor gate invocations on scripts/, so lint.yml's package-local check-reference-carrier-shape gate is invisible to one and mis-keyed by the other #15342 (both graded domain:devx + tooling + pm:queue); Q1 = A — widening the ledger to forty unread rows would be a table that reads as examined; the incremental path is wired (the stale-row case reds if a listed gate stops being a member).
• CI on c1c5f96bb: 22 success / 11 skipped, Lint & Repo Gates in progress at step 31; skip-changeset + size/m; Fixes #15312 in the PR body.
• Sequencing: main now carries 10c's ledger row in the same file (a different region); the queue merges on top — if it reports a conflict the dev merges main (never a rebase).

Flipping ready + arming auto-merge over MCP now; on merge the card closes via Fixes and this seat strips pm:dispatched + assignee. #15342 (same file) is next in the serial queue after this lands.

---

Generated by Claude Code