fix(tooling): re-derive the #5499 denominator over the whole tree, retire the present-tense freeze claims, and name the un-fireable-latch class

[os-elon]

Fixes #13211

Not a fourth sweep. The deliverable is a stated population and the class-level repair of the
un-fireable-latch trap; the site edits are what that population then compels.

1. The population, decided first

The three cards in this family (#13089 -> #13168 -> #13194) measured completeness with
grep -rn 5499 packages --include=*.ts. That population cannot contain a .mjs gate script, a
.yml workflow, a .json ledger or a .md doc — by construction, not by oversight. Re-running it
with more extensions is how a fifth card gets discovered, so the denominator is redefined instead:

Denominator: every tracked file in the repo — git grep -n 5499 -- ., no --include, no
directory filter. Matching LINES, tracked files only.

Numerator: each hit triaged on two axes, never on file extension.

axis	question
CLAIM	does the text assert the freeze is IN FORCE NOW (present tense, or a live condition a machine evaluates), or does it RECORD that it once was (past tense, dated)?
VENUE	is the text hand-maintained and read as current, or a FROZEN RECORD — a generated artifact, a CHANGELOG, a landed ADR-0087 migration entry, a published upgrade guide?

Only CLAIM = present and VENUE = live is in the numerator. Everything else is correct as
written and is excluded by rule and permanently — not by having been forgotten.

Why this cannot produce a fifth card: the denominator is the whole tracked tree, so no extension can
hide a site; and the exclusions are rules with reasons, so re-deriving them returns the same answer
instead of a new discovery.

2. Re-derived on this tree (74049254d4), because no recorded number is definitive

The card measured 143 repo-wide on its tree and triage 162 on another. Different trees — not a
disagreement to settle by picking one. On mine:

bucket	lines
repo-wide, all tracked files, no --include	147
CHANGELOG.md (release records)	58
generated artifacts + landed migration entries	19
packages/**/*.ts — what all three cards measured	43
scripts/**	22
.github/**	2
docs/adr/**	3

The buckets partition exactly (58+19+43+22+2+3 = 147). The uncontested direction holds: the shared
denominator saw under a third of the population, and 27 lines of live, hand-maintained text
(scripts + .github + docs/adr) were outside every card's reach.

3. The PM's four assumptions, measured

• A2.1 — docs(drivers): retire the dissolved #5499 freeze claims at the 15 untriaged group-A sites #13210 did not close this card. Commit 96d8b20ee4 (2026-08-29 12:19:29Z) touches
  14 files, every one of them a .ts file under packages/. It reaches no .mjs, no .yml, no
  .json ledger, no doc. The reading was right; the card is not smaller than filed.
• A2.2 — anchored on content, not line numbers. All three named sentences were found verbatim;
  the repairs are anchored on the sentence text, and every anchor matched exactly once.
• A2.3 — issue 5499 re-read, comments included. state: open, labels tracking +
  domain:engine, 12 comments. The dissolution is comments 8 and 9 (5249019855 mongodb,
  5252526378 driver-memory, both 2026-08-11), the second saying outright that the freeze "is
  fully dissolved ... it no longer gates anything." The issue itself never reached a terminal
  state and, being tracking, is not meant to.
• A2.4 — the CHANGELOG hits: confirmed out of scope, on a better reason than the one inherited.
  Not "they are all past tense" — one is not. packages/drivers/driver-mongodb/CHANGELOG.md:1145
  reads "driver-memory's half of drivers(memory, mongodb): the $contains family still folds case — the last two backends left on the wrong side of #4706 Q2 = A #6682 stays open under the [裁决] driver-memory / driver-mongodb 投入冻结 —— 维护者 2026-08-05 口径（跨单锚点） #5499 freeze", present tense, inside
  a shipped release entry. It stays because of venue: a CHANGELOG entry records the state at
  release time, and rewriting one rewrites history — the same discipline that keeps
  content/docs/releases/ out of code PRs. A frozen record making a present-tense claim is a
  drafting defect in a document nobody may amend, which is exactly the case A2.4 asked about.

4. What changed — 11 sentence sites in 6 files, plus the class

(a) A green gate printing a false sentence on every successful run.
scripts/check-driver-memory-census.mjs built its own OK line ending
"Nothing here invests in the driver (#5499 freeze)." It now ends "This gate polices the census,
never investment." — true, and true regardless of any freeze.

(b) The mirrored pair, both sides, identically. check-driver-memory-census.mjs (header) and
.github/workflows/lint.yml (the census step's comment) both said "which stays frozen under
#5499." Both now carry the dated history instead. The mirror question was measured before either
edit — see section 5.

(c) The restart latch — the instance is not what the card thought, and the class is worse.
Measured: at scripts/pm/check-half-states.mjs the Restart-when: closure string is a self-test
fixture (inside function selfTest(), reached only via --self-test), a captured specimen driving
H17's trigger-file extractor. It is not evaluated as a latch, and its truth changes no assertion.
The card it was sampled from, #9276, was completed on 2026-08-27, so nothing is parked behind that
specific string.

The class is real and lives one level up, in H9's contract:

• H9 judges a hold legal iff a Restart-when: line is present and not manual. It never asks
  whether the line's target can be reached.
• The vocabulary the machinery advertises — and the form seats actually write — is
  Restart-when: closed OWNER/REPO#N, i.e. a ruling encoded as an issue closing.
• A tracking anchor stays open by design. A ruling recorded in one of its comments produces no
  close event, so the hold is parked forever — and H9 stays green the whole time, because a line
  is there.

So the repair is the class, not a new issue number: re-pointing the exit only moves the trap. H9's
section header now names the failure mode and the measured specimen; the finding sentence warns that
a closure form fires only if its target can reach a terminal state, and tells the seat to name the
ruling rather than the closure; and the fixture is labelled as a captured specimen so the next reader
is not the fourth to take it for live machinery.

Also in scope: scripts/check-driver-conformance.mjs gave two opposite answers. :384 and
:408 were present tense while :397/:490/:501 correctly said "unfroze this package on
2026-08-11". Repairing :408 truthfully exposed a second, harder staleness measured against the
code rather than the prose: the file's heading claimed "ONE DEBT row left" and "what remains is
driver-memory", while const LEDGER = []; — empty, under a note reading "the intended steady
state, reached on 2026-08-11". Both now say what the ledger says. :384 additionally corrected a
live instruction: it told readers un-freezing would re-run the mongo cells; the unfreeze happened
18 days ago and nothing re-ran, because the other half (funding the binary provisioning) was never
done.

And the same sentence in a second venue. docs/adr/0053 carried the :384 claim near-verbatim
plus two conditions waiting on the unfreeze (:867, :1016). Repairing only the script would have
recreated exactly the asymmetry item (b) is about, so all three moved with it.
scripts/driver-memory-census.ledger.json had one more: "the #5499 freeze is untouched."

5. The mirror question, answered by ablation rather than by reading

Prediction, written before the run: no mirror gate holds the census header and the lint.yml comment
equal — MIRRORS in check-published-list-mirrors.mjs holds exactly one pair
(AGENTS.md from check-cross-package-test-inputs.mjs), and check-declaration-mirrors.mjs names
neither file — so a one-sided repair trips nothing.

Ran it: reverted only .github/workflows/lint.yml to the retired sentence while the script kept
the repaired one; mutation proven on disk by decomposed counts (retired sentence 0 to 1, repaired
1 to 0) and git hash-object; restored under an absolute-path trap and proven byte-identical to
HEAD.

published-list-mirrors --self-test   EXIT=0     declaration-mirrors --self-test   EXIT=0
published-list-mirrors               EXIT=0     declaration-mirrors               EXIT=0
check:driver-memory-census EXIT=0 · check:required-contexts EXIT=0 · step-collectors EXIT=0
aggregator-roster EXIT=0 · self-test-workflow-commands EXIT=0 · ci-filter-parity EXIT=0

Prediction held. Both mirror gates' self-tests are green, so they can go red — they simply do not
cover this pair. Both sides were repaired anyway.

6. The card's central claim, measured rather than asserted

Prediction: restoring "Nothing here invests in the driver (#5499 freeze)." into the census gate's
own OK line leaves every gate green — because the gate is the thing saying it.

Mutation proven on disk (false sentence 0 to 1, repaired 1 to 0; blob b90b2090efd1 against HEAD's
8872cf1f49e6), restored under an absolute-path trap and proven byte-identical to HEAD. The
subject is a .mjs script node runs from source — no package exports to dist hop — so there is
no dist leg to rebuild on either the mutation or the restore.

check:driver-memory-census EXIT=0   check:agent-test-spelling EXIT=0   check:parse-guard EXIT=0
check:entry-guard EXIT=0            check:watch-hint-literal  EXIT=0   check:nul-bytes   EXIT=0
self-test-wired            EXIT=0

...and the green run's own log contained, verbatim:
Nothing here invests in the driver (#5499 freeze). Prediction held. Nothing could have caught this.

7. Clause 2: the behavioural half, and the line I stopped at

Prediction: the H9 edit changes no verdict — hasFireableRestartWhen accepts any non-manual
value, so the ruling spelling this change starts advertising was already legal.

Differential run of h9OnHoldNoRestartWhen at HEAD~1 against HEAD over 20 fixture shapes,
including the trap itself and the newly advertised spelling:

ABLATION3: 20 verdict(s) identical, 0 flipped, 9 finding-string(s) reworded.
ok CLEAN  ruling spelling (newly advertised)     # already legal before this PR
ok CLEAN  the trap itself: closure form on 5499  # H9 did not flag it, and still does not

The latch fires on exactly the inputs it fired on before. Teaching H9 to REFUSE a closure exit
whose target cannot reach a terminal state would be the real mechanical fix — and it is precisely
"makes the latch fire on an input it previously ignored", so it is named and not made here. It
needs a ruling, and there is a second reason to hold it: it would want the same widening in
.claude/skills/pm-dispatch/references/state-machine.md, whose line ceiling in
scripts/pm/check-skill-line-ratchet.mjs sits at headroom 0 — raising it is a maintainer ruling,
never a dev's.

8. Verification

Gate family derived, never recalled: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
on the final commit, 6 paths against merge base 74049254d. All 40 matched entries (several share
one npm script, e.g. check:required-contexts covers both derived lines) plus the two
convention-triggered ones (bare-root-worklist --self-test, check:pm-dispatch-gates, both fired by
"edits a GATE SCRIPT") were run. Exit codes captured by redirect-then-$?, never through a pipe.
Every one EXIT=0, including check:driver-conformance, check:driver-memory-census,
check:pm-half-states, check:adr-anchors, check:doc-authoring, check:required-contexts,
check:nul-bytes and check:doc-formula-expressions (green after building @objectstack/formula
and @objectstack/lint).

Three results that are NOT MEASURED, not reds:

• check:type-check-debt — its --self-test and coverage legs printed
  check-type-check-coverage: OK — 66/78 workspace packages type-checked, then --re-measure
  refused: "56 workspace dependencies ... have no built type entry point on disk". It needs the
  full ./packages/* built closure, which CI builds. This diff contains zero TypeScript and zero
  package sources, so it cannot move that ledger. Declared narrowing, not a skipped gate.
• check-test-completeness.mjs argument-less — EXIT=3, the documented refusal ([finding] check-test-completeness.mjs answers a standalone run with exit 1 + a usage line, so the derived gate family reads one false red — three independent devs paid for it in one session #13110).
• check:doc-formula-expressions on the first pass — PREREQUISITE NOT MET, then EXIT=0 once the
  two packages were built.

No changeset: this PR releases nothing — gate-script comments, a workflow comment, one ledger string
and one ADR. skip-changeset applies.

9. One residual, dispositioned rather than swept

The re-derivation found a site inside the three cards' own denominator that the group-A sweep
missed: packages/services/service-analytics/src/read-scope-sql.ts:180 still reads
"driver-memory / driver-mongodb stay pin-only under the #5499 freeze" — present tense — while
its own sibling src/__tests__/read-scope-undefined-comparand.test.ts:51, repaired hours earlier,
already carries the correct form ("were pin-only ... The thaw has arrived: the freeze dissolved
2026-08-11 ... that debt is now DUE rather than deferred"). A one-sided repair of a mirrored pair,
the same shape as item (b).

⛔ Not fixed here. The bounded-in-place exemption fails its fourth condition: editing a .ts file in
service-analytics adds that package's test and typecheck surface to a PR that currently has none.
It is handed to the PM to file: the repo-scoped REST channel answers 403 from this seat and the one
targeted MCP search_issues dedup call came back
API rate limit already exceeded, so this seat cannot search for a duplicate, and filing without a
dedup read is not an option this contract allows.

10. Proposal, not a decision

Triage noted item (c) is domain:skills shaped and did not adjudicate. With the measurement in hand
the split now looks unnecessary: the class repair landed entirely in scripts/pm/, one file, in
the same edit as the denominator re-evaluation — and the piece that would justify a separate card is
the behaviour change in section 7, which is a maintainer ruling rather than a lane routing question.
⛔ No domain:* label written, and no re-routing done.

---

Generated by Claude Code

[os-elon]

⚠️ Check Documentation Links was RED, and it is not this PR's. Re-run triggered — recording the justification, because a re-run needs one.

The gate's own output diagnoses it completely:

lychee was never executed, so no link in this repository was examined — this red says nothing about the documentation links, and nothing about the files this PR touches.

Both attempts failed while lycheeverse/lychee-action@v2 was downloading the v0.24.2 binary from the GitHub releases CDN (curl exit 22). This is a known transient failure (#8238); re-running the job is the expected remedy.

The gate remains fail-closed on purpose: a link check that could not run must not report success.

⇒ This is the died-before-any-test-body-ran class, not a red I am asking for a nicer answer:

• Nothing was measured. No link was examined, so there is no verdict about this diff to appeal.
• The failure is in the action's binary download, upstream of any repo content.
• The gate names the transient itself and states the remedy.
• It is fail-closed by design — exactly right, and the reason it went red rather than vacuously green (check:react-declaration-parity 是唯一没接进任何 workflow 的源码审计门禁,且无 MANIFEST 时静默 skip 退出 0 —— 它现在永远不可能红 #4690).

⛔ For the record, what I did not do: no empty commit, no close/reopen, no re-queue of a red test hoping for a different verdict. rerun_failed_jobs on run 33262557012, once. If it fails a second time, that is a real signal about #8238's frequency and not something to keep retrying.

⚠️ Two standing conditions worth stating together, since they bear on when this can land:

1. The repo has ~131 queued workflow runs against ~0 actually executing — the only in_progress run at 17:50Z was one started 2026-08-06. So this re-run will queue rather than start promptly.
2. LIVE: the merge queue has landed nothing since 14:13Z — merge_group runs conclude success and their PRs stay open, with the same batch rebuilt hourly #13281 is an open p0: the merge queue has landed nothing since 14:13Z, merge_group runs concluding success while their PRs stay open. Nothing merges today until that is resolved, whatever this PR's checks say.

I am adding one job to a deep backlog deliberately and once, because without it this PR has no path to green at all.

---

Generated by Claude Code