fix(tooling): re-derive the #5499 denominator over the whole tree, retire the present-tense freeze claims, and name the un-fireable-latch class

.github/workflows/lint.yml

@@ -3053,8 +3053,11 @@ jobs:
       # --self-test first: the detector can be broken while the census is fine,
       # and a scan that stops matching would report OK while reading nothing
       # (#4868's family — DISCOVERED refuses an empty scan for that reason).
-      # It polices the retirement programme's bookkeeping; it is not investment in
-      # the driver, which stays frozen under #5499.
+      # It polices the retirement programme's bookkeeping; it is not investment
+      # in the driver. (#5499 froze that investment on 2026-08-05 and the
+      # maintainer dissolved the freeze on 2026-08-11 -- in COMMENTS on #5499,
+      # which is a `tracking` anchor and is still open. This gate's scope is the
+      # same either way: bookkeeping, never investment.)
       - name: driver-memory census gate
         run: pnpm check:driver-memory-census
 

docs/adr/0053-date-and-datetime-semantics.md

@@ -855,17 +855,19 @@ MongoDB), the analytics preview evaluator, and `formula`'s write-side `check`.
 > surfaced as an unhandled rejection that turned all-green runs into `exit 1`
 > and ejected unrelated PRs from the merge queue. The maintainer retired the
 > download rather than fund single-flight or prewarm infrastructure for a
-> driver family whose investment is frozen (#5499); `test-mongod.ts` in that
-> package documents the mechanism.
+> driver family whose investment was frozen at the time (#5499);
+> `test-mongod.ts` in that package documents the mechanism.
 >
 > `scripts/check-driver-conformance.mjs` still reports these cells CONSUMED,
 > because that gate judges coverage by *import* and the files still import the
 > markers. Its ledger comment carries the per-marker state as measured on the
 > day of the change — read it before treating the mongo column as executed
 > coverage.
 >
-> Restoring these cells to CI hangs on #5499: whatever decision un-freezes that
-> family and provisions a mongod binary again also retires this note.
+> ⚠️ Restoring these cells to CI used to hang on two things: the #5499 freeze
+> lifting, and a mongod binary being provisioned again. The maintainer dissolved
+> the freeze on 2026-08-11; the provisioning half was never funded, and nothing
+> re-ran. So only the second half is left, and whoever funds it retires this note.
 
 It is modelled on `filter-logic-conformance.ts`, which exists for the same
 reason one layer down (#3774), and lives in `spec` for the D-D2 reason: every
@@ -1013,7 +1015,8 @@ mongod-backed suites are opt-in behind `OS_TEST_MONGODB_MEMORY_SERVER_ENABLED=1`
 `mongodb-temporal-conformance.test.ts` — which carries this axis's
 `TEMPORAL_TIME_CASES` and has no server-free half — skips with a named notice
 on every default run, whether or not a binary is reachable. It runs when a
-human asks for it, and returns to CI only if #5499 is un-frozen and something
-provisions a binary again. The conversion itself is pinned by
+human asks for it, and returns to CI only if something provisions a binary
+again — the #5499 freeze that used to be the other half of this condition was
+dissolved on 2026-08-11. The conversion itself is pinned by
 `mongodb-time-storage.test.ts`, which is unaffected: it is pure, needs no
 server, and still runs everywhere.

scripts/check-driver-conformance.mjs

@@ -381,10 +381,12 @@ const CASE_SETS = [
 // archive and the loser's `rename` blew up an all-green run as an unhandled
 // rejection, ejecting unrelated PRs from the merge queue. The maintainer retired
 // the download rather than fund single-flight/prewarm for a family whose
-// investment is frozen (#5499). Un-freezing it is what should re-run these cells
-// in CI; until then, this note is the honest state of the mongo column.
+// investment was frozen at the time (#5499, 2026-08-05). ⚠️ That freeze was
+// dissolved on 2026-08-11 and the download was NOT restored: what these cells
+// wait on now is someone funding the provisioning, not an unfreeze. Until then,
+// this note is the honest state of the mongo column.
 
-// ## FILTER_TEXT_CASES: ONE DEBT row left of the five #5701 opened
+// ## FILTER_TEXT_CASES: the five DEBT rows #5701 opened, and how each cleared
 //
 // The ledger was EMPTY (see the note above) until `FILTER_TEXT_CASES` arrived.
 // Those five rows were not a regression in coverage: the case-set is the
@@ -405,8 +407,11 @@ const CASE_SETS = [
 // opt-in, so a suite needing a server would not run in CI — and it evaluates
 // the emitted documents rather than pinning their spelling.
 //
-// What remains is `driver-memory`, still in the #5499 frozen family, where the
-// freeze rather than the difficulty is why the cell is open.
+// [#6682] `driver-memory`'s row is GONE too, and it was the LAST of the five —
+// requirement 2 below records the nine sites the `i` flag came off. ⚠️ The
+// #5499 freeze, not the difficulty, is why this cell stayed open longest; the
+// maintainer dissolved that freeze on 2026-08-11 and the cell cleared the same
+// day. `LEDGER` is empty again — see its steady-state note.
 //
 // What the case-set demands, and where each requirement stands:
 //

scripts/check-driver-memory-census.mjs

@@ -33,7 +33,10 @@
 //
 // So the census stops being prose and becomes this ledger + this gate. The gate
 // polices the RETIREMENT PROGRAMME's bookkeeping; it is not investment in the
-// driver, which stays frozen under #5499.
+// driver. (#5499 froze that investment on 2026-08-05 and the maintainer
+// dissolved the freeze on 2026-08-11 -- in COMMENTS on #5499, which is a
+// `tracking` anchor and is still open. This gate's scope is the same either
+// way: bookkeeping, never investment.)
 //
 // ## What counts as a DECLARATION
 //
@@ -418,8 +421,8 @@ export function reconcile(scan, ledger, read = (f) => readFileSync(join(ROOT, f)
     if (ledgeredM.has(mKey(d))) continue;
     problems.push(
       `LEDGERED: ${d.file} declares ${SPECIFIER} in ${d.field} (${d.range}) and the ledger does not cover it. `
-        + 'A manifest declaration outlives the consumer that justified it — that is exactly how a frozen package '
-        + 'stays installed everywhere after the last real use is gone (#5499). Record which consumer it serves.',
+        + 'A manifest declaration outlives the consumer that justified it — that is exactly how a package nobody '
+        + 'invests in any more stays installed everywhere after the last real use is gone. Record which consumer it serves.',
     );
   }
   for (const e of ledgerManifests) {
@@ -508,7 +511,7 @@ function report({ list = false } = {}) {
   for (const e of ruled) console.log(`  ruled    ${e.file}  (${e.ruling})`);
   console.log(
     `\ncheck-driver-memory-census: OK — every declaration is ledgered, every ledger entry is live, and every `
-      + `ruled file states "${censusMarker(ruled.length)}". Nothing here invests in the driver (#5499 freeze).\n`,
+      + `ruled file states "${censusMarker(ruled.length)}". This gate polices the census, never investment.\n`,
   );
 }
 

scripts/driver-memory-census.ledger.json

@@ -138,7 +138,7 @@
       "file": "packages/services/service-datasource/package.json",
       "field": "dependencies",
       "axis": "product-consumer",
-      "why": "serves the two UNGUARDED `await import()` sites ledgered above in this package: the `memory` arm of createDefaultDatasourceDriverFactory, and rung 3 of the sqlite step-down in sqlite-driver-fallback.ts. #10062 moved it out of devDependencies because neither load sits in a try/catch — a consumer reaching either path met ERR_MODULE_NOT_FOUND rather than a diagnosis, so the declaration is a runtime one and the manifest now says so. The sentence retired here claimed all five drivers were devDependencies by design, on the reasoning that the factory reaches every backend by dynamic import and the HOST supplies the one it uses; that argument survives only for the three GUARDED arms (driver-mongodb, driver-sqlite-wasm, driver-turso), each of which answers an absent package with a named error carrying its install command and is therefore still declared nowhere. No investment in the driver: the #5499 freeze is untouched, and this entry goes when the last consumer it serves goes."
+      "why": "serves the two UNGUARDED `await import()` sites ledgered above in this package: the `memory` arm of createDefaultDatasourceDriverFactory, and rung 3 of the sqlite step-down in sqlite-driver-fallback.ts. #10062 moved it out of devDependencies because neither load sits in a try/catch — a consumer reaching either path met ERR_MODULE_NOT_FOUND rather than a diagnosis, so the declaration is a runtime one and the manifest now says so. The sentence retired here claimed all five drivers were devDependencies by design, on the reasoning that the factory reaches every backend by dynamic import and the HOST supplies the one it uses; that argument survives only for the three GUARDED arms (driver-mongodb, driver-sqlite-wasm, driver-turso), each of which answers an absent package with a named error carrying its install command and is therefore still declared nowhere. No investment in the driver either way: this entry is bookkeeping, and it goes when the last consumer it serves goes."
     },
     {
       "file": "examples/embed-objectql/package.json",

scripts/pm/check-half-states.mjs

@@ -160,7 +160,10 @@
  *       the same TWO channels — body OR comment, the H4/H14 contract; a
  *       comment-parked exit fired and sat unnoticed ~2 days under the old
  *       body-only read) or a one-line executable predicate. A hold nothing can fire
- *       is indistinguishable from an abandoned card. `Restart-when: manual — …`
+ *       is indistinguishable from an abandoned card. ⚠️ A `closed …#N` exit
+ *       fires only if #N CAN close — a `tracking` anchor stays open by design,
+ *       so a ruling landing in its COMMENTS never fires it; see H9's section.
+ *       `Restart-when: manual — …`
  *       counts as MISSING, deliberately: the protocol says a card no mechanism
  *       can revive is closed `not planned` (reason + provenance in the closing
  *       comment), so accepting a `manual` line here would hand every seat a
@@ -1660,6 +1663,35 @@ export function h8MergedPrStillDispatched(issue, mergedPrs, openPrs) {
 // and H9 counts a comment-channel line as a line. Widening H9 alone would
 // have made the gauge claim coverage the machinery lacked — the split #10102
 // existed to prevent, run in the opposite direction.
+//
+// ## ⚠️ A `closed …#N` exit is only fireable if #N CAN close
+//
+// H9 judges the line's PRESENCE, never its target's REACHABILITY. So the one
+// shape it cannot see is an exit that is well-formed and unreachable, and the
+// measured specimen is `Restart-when: closed objectstack-ai/objectstack#5499`.
+// #5499 is a `tracking` ruling anchor: that state stays OPEN by design, and the
+// card's own thread says so. The freeze it anchors was dissolved on 2026-08-11
+// by two maintainer rulings recorded as COMMENTS on it; the issue never closed,
+// and on the current state never will. A hold written against that exit is
+// parked FOREVER — and H9 stays green the whole time, because a line is there.
+//
+// ⇒ The class, not the instance: ANY machine that encodes "a ruling" as "an
+// issue closing" is silently bypassed by a ruling recorded in a comment.
+// Re-pointing the exit at a different issue number only moves the trap. It is
+// not a machine-only failure either: three human readers took that same string
+// for a live latch in one day, by reading a STATE instead of a THREAD.
+//
+// What to write when the thing waited on is a RULING rather than a closure:
+// name the ruling and where it lands (`Restart-when: #N rules on X`). Any
+// non-`manual` value is fireable, so the vocabulary already admitted that
+// spelling — only the advertised one did not.
+//
+// ⛔ Nothing above changes a verdict. `hasFireableRestartWhen` accepted the
+// ruling spelling before this paragraph existed and accepts it now; the row
+// text gained a warning, not a new predicate. Teaching H9 to REFUSE an
+// unreachable `closed …#N` target would make it fire on an input it ignores
+// today, and that is a behaviour change nobody has ruled on — deliberately NOT
+// made here.
 // ---------------------------------------------------------------------------
 
 /**
@@ -1751,7 +1783,10 @@ export function h9OnHoldNoRestartWhen(issue, commentBodies) {
       : '';
   return (
     `\`pm:on-hold\` with ${shape} — the hold state is legal only with a machine-fireable exit ` +
-    `(\`Restart-when: closed <owner/repo>#N\`, or a one-line executable predicate).${unreadable}${unparsed} ` +
+    `(\`Restart-when: closed <owner/repo>#N\`, or a one-line executable predicate). ⚠️ A ` +
+    `\`closed …#N\` exit only fires if #N CAN close: a \`tracking\` ruling anchor stays open by ` +
+    `design, so a ruling recorded in one of its COMMENTS never produces the close event this form ` +
+    `waits for — name the ruling, not the closure.${unreadable}${unparsed} ` +
     `Add or repair the line first. Closing is the LAST resort and applies only to a card that ` +
     `genuinely has no fireable exit: such a card is closed \`not planned\` with reason + ` +
     `provenance in the closing comment (type:Bug holds re-route instead — see the state model's ` +
@@ -11123,6 +11158,12 @@ function selfTest() {
   // clause. Their exits are `Restart-when: closed …#N`, which H9 already
   // judges; H17 must contribute no row for them, or the index would tell a
   // dispatching seat to intersect against files nobody nominated.
+  //
+  // ⚠️ `c9276` is a CAPTURED SPECIMEN, not a live latch: it is fixture bytes,
+  // and its truth changes no assertion here (H17 must extract zero paths from
+  // it either way). Three readers took it for live PM machinery in one day on
+  // #13211; the card it was sampled from closed on 2026-08-27. Its exit is also
+  // this file's example of the unreachable-target class — see H9's header.
   const c9276 =
     'Restart-when: closed objectstack-ai/objectstack#5499\n\n' +
     '(Earlier restart is legitimate only if the freeze ruling is narrowed on #5499 to exclude ' +