test(scripts): batch 10b pilot (Tier C) — floor git-merge-regen on its eleven named callees

[claude]

Part of #13799 — BATCH 10b, the Tier C PILOT for the callee-dispatch shape. One file: scripts/git-merge-regen.mjs.

All measurements below were taken on this PR's final commit, 839e77f, in an installed worktree pinned at 103677652, with a byte-comparison base worktree detached at the same pin and also installed.

What the file is, and why the callee is the battery

scripts/git-merge-regen.mjs (991 lines) has no self-test entry function, no verdict handshake and no named section banners. A top-level if (--self-test) block invokes eleven named callees, each of which prints its own line and returns a boolean, and the results are ANDed at the end. The AND site is the verdict site. Success was decided by results.every(Boolean) and nothing else, so "every sub-check held" and "the sub-checks never ran" printed the same line.

Per the batch-8 census row 14 and the PM's decision on design question 2, Tier C takes recipe A with the callee name in the role the table-row label plays: one battery per named callee, floor 1, roster = the literal callee-name list, registerCase('calleeName') as the first statement of each callee.

The roster comment states why the callee name is the battery: it is the label the source already carries, so nothing is invented and nothing is judged per comment, and a set difference names WHICH sub-check stopped rather than saying only that something did. Each floor is 1 because what the ledger records is that the callee RAN, not how many assertions it happens to contain.

The boundary this pilot is here to state

reconcileOwnership() holds a literal [name, ok] table, filtered eagerly. Its rows stay as they are and are NOT batteries, and the reason is written at the site: recipe A (PR #15271, check-sdui-manifest) makes a table row a battery for a file whose SELF-TEST is the table — one literal table, one driving loop, and a sink that writes only when a row fails. Here the table is a local of ONE callee among eleven, its rows are evaluated eagerly into booleans before anything loops, and the callee already reduces them to a single printed verdict of its own. Flooring those rows would floor one callee's internals while the other ten stayed at callee granularity — a roster whose unit changes per entry. The rule: the battery is the unit the DISPATCH names.

What landed

• Module-level SELF_TEST_BATTERIES (the eleven callee names, floor 1 each), SELF_TEST_BATTERY_FLOOR = 11, UNATTRIBUTED_BATTERY, the batterySeen ledger, and registerCase(name). Module-level rather than local because this file has no self-test body — the registrations happen inside eleven separate frames and the floor is read at the dispatch, so the ledger has to outlive all of them. The ledger is named for its role and deliberately not with a self-test spelling, because check:pm-dispatch-gates anchors on top-level declarations whose name spells self-test.
• registerCase('calleeName') as the first statement of each of the eleven callees, above any early return.
• The floor evaluated at the AND/verdict site, immediately before the success line, inside the --self-test branch only.
• The eleven bare invocations become a literal list of function references, so the names the dispatch invokes are data. results is that list mapped through run(); the cross-check reads run.name, so a renamed callee moves the list with it and cannot drift from the roster in silence.
• The roster ↔ dispatch cross-check in both directions, plus a duplicate refusal (two entries naming one callee are one battery, so the second can stop running while the first keeps the floor met), plus the roster ↔ ledger cross-check in both directions.

The size pin was measured, not assumed

Pinned at 9999 first and the breach line read back:

✗ self-test floor: SELF_TEST_BATTERIES declares 11 batteries, below the pinned 9999 — a battery deleted from the roster takes its own floor with it.

Pinned to 11, then restored byte-identically (cmp against a saved copy; blob back to 2eb532d3).

Deletions, declared

The only lines removed are the verdict lines. results.every(Boolean) becomes a failures count so a floor breach can red the verdict, and the red line takes recipe A's spelling:

• green line, byte-identical to origin/main: ✓ merge driver wiring is consistent (24 path(s) deliberately excluded).
• red line: ✗ merge driver wiring is inconsistent — N failure(s) (cases and floor); see above.

No assertion condition, message or argument was changed. No comment was promoted to a section head.

The production path is untouched

This script is wired as check:merge-driver and installed as a git merge driver, so its production path has to stay byte-identical.

A six-invocation production-mode harness was run against both worktrees from a throwaway git repo — no %P at all, a missing %P, two plain driver-managed rows, an unmapped path (the refusal arm) and the MIXED row (content/docs/permissions/system-context.mdx) — capturing stdout, stderr and every exit code, plus the resulting os-regen-pending marker:

cmp prod-base.out prod-br.out   -> IDENTICAL(stdout)   428 bytes
cmp prod-base.err prod-br.err   -> IDENTICAL(stderr)  1419 bytes
exits: 1, 1, 0, 0, 1, 0   (identical on both sides)

The green --self-test run is byte-identical too, stdout and stderr, exit 0 on both sides.

Ablation (f) — the floor cannot fire outside --self-test. With a guaranteed floor breach applied (leg b), --self-test exits 1 while the same six production invocations stay byte-identical to base on stdout and stderr. Structurally: the dispatch branch opens at line 1141 and the floor call sits at line 1171, inside it; the production else arm never reads the ledger.

Ablations

Every leg: mutation proven on disk (HEAD blob 2eb532d3 moves, plus a grep -cF count of the injected and of the removed text — an editor exit code is not evidence), restore proven by hash equality against the HEAD blob and an empty git diff HEAD, trap ... EXIT INT TERM with absolute paths, and the mutation applied on top of a committed implementation so the restore leg has a real reference.

leg	mutation	result
a	one callee renamed in the roster (reconcileScripts to reconcileScriptsRenamed)	exit 1, 5 breaches, both halves named
b	one callee's registerCase() removed (reconcileGenerators)	exit 1, that battery DID NOT RUN, all eleven other lines still green
c	one callee's invocation deleted from the dispatch (hookIsExecutable)	exit 1, DID NOT RUN + "the dispatch block does not invoke"
d	the floor check deleted at the verdict site, with (b) applied	exit 0, vacuous green — the defect this PR closes
e	registerCase() moved below an early return, with that early return forced	exit 1, DID NOT RUN while the callee printed its own ✓ and returned true
e-control	the early return forced, registerCase() left first	exit 0 — isolates the placement as the cause
f	leg (b), read on the production path	production output byte-identical; floor silent

Leg (a), both halves, verbatim:

✗ self-test floor: the dispatch invokes "reconcileScripts", which is not declared in SELF_TEST_BATTERIES — a callee nothing declares is a sub-check nothing floors.
✗ self-test floor: SELF_TEST_BATTERIES declares "reconcileScriptsRenamed", which the dispatch block does not invoke — a floor over a battery nothing can reach.
✗ self-test floor: self-test battery "reconcileScripts" registered 1 case(s) but is not declared in SELF_TEST_BATTERIES — a case attributed to no declared battery is one nothing floors.
✗ self-test battery "reconcileScriptsRenamed" DID NOT RUN — 0 cases registered, 1 pinned. The verdict below would have claimed that sub-check holds.

Leg (d) is the one worth reading twice: with the floor gone and one callee registering nothing, the run exits 0 and prints the ordinary green line. Restored.

Leg (e) needed two mutations, and this is declared rather than glossed: the early return in endToEndMixed() is not reached on a healthy tree, so it was forced as well. The e-control leg forces the same early return with registerCase() left in first position and comes back green, which is what makes the placement — not the forced branch — the cause of (e)'s red. The e-control leg is also the honest demonstration of why the call goes first: a callee that legitimately short-circuits still RAN.

Gates

Derived family, from node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack — no hand-built path list; the tool took its own change set from the merge base (1 path, scripts/git-merge-regen.mjs). 22 commands, every one run, all exit 0.

node scripts/check-ci-filter-parity.mjs                     0
node scripts/check-closing-keyword-parity.mjs               0
node scripts/check-closing-keyword-parity.mjs --self-test   0
node scripts/check-comment-mask-corpus.mjs                  0
node scripts/check-self-test-wired.mjs                      0
node scripts/check-self-test-wired.mjs --self-test          0
node scripts/check-whole-set-label-write.mjs                0
node scripts/check-whole-set-label-write.mjs --self-test    0
node scripts/pm/bare-root-worklist.mjs --self-test          0
pnpm check:agent-test-spelling                              0
pnpm check:bash32-floor                                     0
pnpm check:cli-command-ids                                  0
pnpm check:cross-package-test-inputs                        0
pnpm check:entry-guard                                      0
pnpm check:merge-driver                                     0
pnpm check:nul-bytes                                        0
pnpm check:parse-guard                                      0
pnpm check:pm-dispatch-gates                                0
pnpm check:pnpm-filter-targets                              0
pnpm check:ratchet-remedy-authority                         0
pnpm check:refd-timer-probe                                 0
pnpm check:watch-hint-literal                               0

Exit codes were captured before any pipe (redirect to a file, read the status, then read the file). Verdict lines, as the gates themselves printed them:

• ✓ dispatch-gates self-test: 1381 cases pass. — run in the foreground under the shared verify lock, which reported os-verify-lock: VERDICT command-exit 0 · held the lock 368s (6m08s) · waited 0s.
• check-self-test-workflow-commands --self-test: ... 6 declared batteries, 23 cases registered, every battery at or above its pinned floor.
• ✓ check:declared-population-live — 201 of 252 famil(ies) declare a path population, and every one of them reaches this tree's 7440 tracked file(s).
• check-nul-bytes: OK (scanned 7433 text file(s) -- 7433 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
• OK check-ratchet-remedy-authority: 202 scripts swept ...
• ✓ check-watch-hint-literal: 49 declaration(s) across 4 rostered name(s) ...
• The file's own suite: pnpm check:merge-driver (which is git-merge-regen.mjs --self-test && check-regen-pending.mjs --self-test) exits 0, printing all eleven ✓ lines and then ✓ merge driver wiring is consistent (24 path(s) deliberately excluded).

Whole-repo pnpm lint (eslint . --no-inline-config): exit 0. Not a narrowed run.

Nothing imports this script as a module (git grep "from '.*git-merge-regen" is empty); the only referencing runnables are check:merge-driver and check-regen-pending.mjs --self-test, both green above. scripts/regen-artifacts.mjs and scripts/doc-line-anchors.mjs name it in prose but are library modules with no --self-test entry point — invoking them with that flag exits 0 having printed nothing, which is NOT MEASURED, not a pass, and is recorded here as such rather than counted.

Instrument, before and after

node scripts/measure-self-test-floor.mjs --json, base worktree vs this branch, 170 rows on both sides. Exactly one row moved:

scripts/git-merge-regen.mjs   floor: NONE -> ROSTER

Buckets: base ROSTER 156 / NONE 13 / COUNT 1 to branch ROSTER 157 / NONE 12 / COUNT 1. This file leaves NONE; nothing enters NONE and no other row changed in any field.

extractWatchHints on this file is identical across base and branch: .gitattributes, .githooks/pre-commit, scripts/git-merge-regen.mjs.

Housekeeping

skip-changeset: this diff is one script under scripts/, publishing nothing from any package.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

---

Generated by Claude Code