Price the import-edge identity key at 232 novel leads and refuse it, pinned to the live tree (#13126)

[os-elon]

Fixes #13126

The card's first deliverable is a PRICE, and the price says do not add the key. This PR
ships the measurement and the refusal, pinned to the live tree so it cannot go stale — no
widening of coveringKey.

The measurement (re-run on today's tree, not the card's)

The card measured 228 at 8b4156139f. On this tree (183 families, 7347 tracked files) the
class is 234 raw edges / 232 deduped (family, imported module) pairs. The card's count
was a claim about a moved tree; this is the input.

The split the card asked for, with the method that separates the halves — every
(family, imported module) pair, classified by whether coveringKey answers it today:

(family, imported module) pairs      273
  ...another key already answers      41   15%  (25 `gate source`, 7 CI job filter,
                                                 8 inherited hint, 1 program-text read)
  ...NOVEL, no key reaches them      232   85%

⚠️ So the card's own premise that "the scripts/**-declaring gates already reach many of
these modules by another route" is falsified at pair granularity: only 15% are already
covered. The novel half is not a fraction of 232 — it is 232.

Swept over the whole corpus with the candidate key consulted LAST, exactly the way #13000's
was built:

ADDED 232   RE-ATTRIBUTED 0   LOST 0      (base: 144190 matched (family, file) pairs)

Additive by construction, and still refused.

Why it is refused: precision, and the numbers are not close

#13000 bought its class for 5 novel leads on this same corpus. This one costs 232,
and 201 of the 232 (87%) land on five shared utilities nearly every gate links:

edit this module	families named today	under the refused key
scripts/invoked-as.mjs	14	118
scripts/import-prerequisite.mjs	14	55
scripts/js-comment-mask.mjs	17	38
scripts/ts-parse.mjs	13	37
scripts/workspace-enumerator.mjs	12	23

Every one of those leads is TRUE — editing invoked-as.mjs really can turn all 118 red. A
118-gate list is still the failure this file's header names: the dev who gets one stops
reading it, which ends exactly where a list omitting the one gate that matters ends. The
tail is the opposite shape and is the half worth having: 21 modules carrying 31 pairs, the
median card moving from 14 families to 15.

The only property separating the two halves is fan-in. This file draws its lines on
provenance rather than on volume, and a fan-in cut has no provenance to state:
invoked-as.mjs and dispatch-gates.mjs are the same KIND of edge, one link apart.

Two narrowings measured, neither earns it either:

• importer is a --self-test family — 12 novel pairs, but 8 of the 12 are
  import of invoked-as.mjs, and the line is the INHERITANCE narrowing borrowed for the
  question [finding] dispatch-gates.mjs is a followable non-gate module, so its join bases and tier globs are inheritable — 2553 fabricated pairs for the next gate that imports it #11556 / [finding] Two gates import their shared glob helper and their shared declaration table OUT OF a gate script, which costs check:ci-filter-parity a 595-pair derivation lead #11511 settled separately. Identity is not that.
• target is not itself a gate file — 63 novel pairs, and it still takes an
  import-prerequisite.mjs card to 55.

The Zone-3 route does not close the card's own witness

Measured, then proven by ablation: a fifth key over entry.imports reaches 61 of the 232
pairs and misses the witness. entry.imports is empty for a --self-test family
(discoverFamilies short-circuits before the import follow), and
scripts/pm/bare-root-worklist.mjs --self-test is exactly that. The remaining 171: 12 from
self-test importers, 159 whose target is itself a gate file.

What the refusal costs, stated rather than implied

The witness holds on today's tree, reproduced in the real dispatch output for THIS card:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives 14 families
for a card editing scripts/pm/dispatch-gates.mjs, and bare-root-worklist --self-test —
which statically imports that file — appears 0 times. That gate is run by hand. The miss
costs one CI round, the side this file's header errs on everywhere, and it is far smaller
than the 118-lead card the general key prints for the module all 118 import.

What lands

scripts/pm/dispatch-gates.mjs only, 139 lines added, no behaviour change:

1. A priced-refusal section in coveringKey's docblock, in the register this file already
   uses for firstPartyImportTargets' and hintCovers' refusals.
2. Five live self-test cases that re-derive the price every run. Prose cannot notice the
   tree flattening under it, so the refusal is asserted rather than argued: the class is
   real and novel, the 41/232 split is real, the witness holds, the worst card would still
   name more than 44 families, and the class is still concentrated in 5 modules. A red
   there is not a broken derivation — it says the refusal is due a re-pricing.

⚠️ 232 is a LOWER bound. Two shapes stay unfollowed for their own measured reasons upstream:
a dynamic import() of a scripts/ module (3 live family-module pairs) and a relative
target outside scripts/ (3, all eslint.config.mjs). Declared, not hidden.

#13232 is not addressed here — those two stale docblock sites sit in CONVENTION_GATES,
which this PR does not touch.

Verification, all at 9ae9cfbd78

• node scripts/pm/dispatch-gates.mjs --self-test — 884 cases pass, the 5 new ones among
  them, and every number they print matches an independent out-of-tree measurement of the
  same corpus.
• Derived family (14) all green: check:agent-test-spelling, check:bash32-floor,
  check:cli-command-ids, check:cross-package-test-inputs, check:entry-guard,
  check:parse-guard, check:pm-dispatch-gates, check:pnpm-filter-targets,
  check:watch-hint-literal, check-ci-filter-parity.mjs,
  check-cross-package-test-inputs.mjs, check-self-test-wired.mjs,
  check-shard-attestation.mjs. Plus check:nul-bytes and the convention pair
  (bare-root-worklist.mjs --self-test: OK self-test: 50 live rows).
  check-test-completeness.mjs exits 3 — the [finding] check-test-completeness.mjs answers a standalone run with exit 1 + a usage line, so the derived gate family reads one false red — three independent devs paid for it in one session #13110 argument-less refusal, not a red.
• Ablation A (predicted before the run: witness pin stays GREEN, novel 232 to 171,
  covered 41 to 102) — implemented the Zone-3 route on disk, mutation proven by decomposed
  grep counts plus git hash-object (63161a12 to 9ef1e80c), restored under an
  absolute-path trap and proven back to the HEAD blob. Observed: exactly that. This is the
  mechanical proof that the route as written misses the witness.
• Ablation B (predicted: novel to 0, so 4 of the 5 pins go RED and the split pin stays
  green at 273) — implemented the full raw-edge key, mutation proven the same way
  (63161a12 to 7b171364), restored and proven byte-identical to HEAD. Observed:
  5 of 884 cases failed — my 4, plus dispatch-gates cannot see runtime staging dependencies between gate scripts (digest sandbox broke on a staged gate's new import) #13000's own additivity pin naming the single pair
  where the two classes overlap (check:template-version-sync and scripts/invoked-as.mjs).
  The pins are falsifiable, not green-over-nothing.

No changeset: internal PM tooling, nothing published. skip-changeset applies.

Generated by Claude Code

---

Generated by Claude Code