fix(pm): derive the always-runs tail dispatch-gates could never name

[claude]

Fixes #13333

Triage adjudicated option (b) on this card — have dispatch-gates enumerate the
unconditional Lint & Repo Gates steps as an "always runs" tail — and explicitly
refused option (a), adding check-reference-carrier-shape to the derivation. This
implements (b), derived rather than hand-listed.

What was measured first

Reproduced on current origin/main, with positive controls, because the card's own
figures had drifted:

reading	card	measured now
reference-carrier in dispatch-gates.mjs	0	0
positive control where-matcher, same file	12	14 (triage saw 14 too)
check-reference-carrier-shape in lint.yml	:3281-3284	:3338-3339
the gate anywhere in a full --residue universe of 187 families	—	0 hits; controls turbo-task-graph 1, where-matcher 2

So the gate is not in the silent bucket and not in undetermined — it is in no
bucket at all, the one output shape this file's contract forbids.

H1 as stated is FALSIFIED, and the falsification changes the fix

The sharpened mechanism on the card is "every package-local script invoked by path
inside a multi-line run: | block". Measured over all 26 workflows:

• the run: | half is already handled — runCommandTexts has read block-scalar
  bodies since [finding] dispatch-gates.mjs does not derive pr-automation.yml's Check Changeset for .changeset/ paths — a breaking changeset shipped locally-green and went red only in CI #8410, and 3 of the 5 invisible gates are plain one-line run: steps.
  It is not a reason today at all.
• the package-local-by-path half has population 1 — exactly this gate.
  (packages/cli/bin/run.js is the other package-local node invocation and is a CLI
  smoke run, not a gate.)

A fix built on that mechanism would therefore have been option (a) with extra steps.
The population that is real is the one triage named — unconditional steps — and
it is invisible for at least three unrelated reasons: a package-local path, an
interpreter that is not node, and a root script not named check:*. That is why no
fourth widening of the three matchers was going to be the last one.

The coverage measurement triage asked for

Derived live, on the merge commit of this branch:

1. unconditional steps CI runs on every PR — 191, across the pull-request workflows
   with no paths: filter, in jobs and steps with no if: (11 conditional jobs and 12
   conditional steps excluded, and both counts printed rather than dropped);
2. accounted for by a discovered family — 164;
3. named by nothing, i.e. the new tail — 27 step instances / 16 distinct commands.

Proof that it reaches the CLASS, not the instance

The tail names the card's gate and members invisible for different reasons:

- [lint.yml · Lint & Repo Gates] ESLint
      pnpm lint
- [lint.yml · Lint & Repo Gates] Verify-lock entry-point self-test
      bash scripts/pm/os-verify-lock.sh --self-test
- [lint.yml · Lint & Repo Gates] os-regen-merge self-test
      bash scripts/pm/os-regen-merge.sh --self-test
- [lint.yml · Lint & Repo Gates] Claude hook guard self-tests (worktree-first · stash ban)
- [lint.yml · Lint & Repo Gates] Relationship carriers are spelled as the string the spec declares
      node packages/lint/scripts/check-reference-carrier-shape.mjs --self-test
- [lint.yml · Type Check · consumer gates] Root-entry type nameability pin (built dist, declaration emit)
      pnpm --filter @objectstack/spec exec vitest run scripts/root-entry-type-nameability.pin.test.ts

pnpm lint and the two bash … --self-test steps are real verification that no
widening of the node scripts/… matchers would ever have reached.

That claim is a self-test case, derived live, not a sentence here: the tail must contain
a member whose interpreter is not node and that member must not be the card's own
gate. Reverse verification (ablation, run against the committed implementation, the
mutation confirmed on disk by object hash 8e8d9489 -> ac39a3df before any reading,
restored and re-proved byte-identical to the HEAD blob afterwards):

✗ a gate run by another interpreter IS in the tail
✗ the live tail reaches the CLASS: a second member invisible for a DIFFERENT reason (another interpreter)
✗ and that second member is not the card's own gate wearing a different name
✗ dispatch-gates self-test: 4 of 976 case(s) failed.

The instance case (a package-local gate invoked by path IS in the tail) stayed green
through that ablation — which is exactly the discriminator between (a) and (b).

Why this is not "22 leads is the same as none"

The header's refusal stands: 166 of 189 discovered families sit outside both path
declarations CI obeys, and naming them per card would say nothing. This tail is the
complement of that set, not a slice of it — a step leaves the list the moment the
derivation names any family for it, so it is bounded by the derivation's own blind spot
and shrinks as discovery improves. It carries no per-card claim and says so.

What it deliberately does NOT do

• ⛔ It does not touch check-reference-carrier-shape, or extend discovery to reach it.
• ⛔ It does not classify rows into "gate" and "setup". pnpm install and pnpm lint are
  both in the tail; every rule separating them is a guess about a step's intent.
• ⚠️ It answers one branch of the family-tree posted on the card. It says nothing
  about derivation on a stale tree ([finding] dispatch-gates.mjs EXITS 0 on a STALE TREE — a green-looking answer that silently omits newly-landed gate families; cost one CI cycle today, and was caught by luck on a second PR the same hour #13392), fabricated leads ([finding] dispatch-gates --residue prints THREE fabricated leads for check:query-options-erasure — literals naming files that have never existed, unannotated because one live sibling keeps the family reachable #13312, [finding] check:doc-anchors declares a fabricated watch hint scripts/scripts/check-doc-anchors.mjs — a remedy string meant to run from the repo root is resolved module-relative, doubling the prefix #13449) or
  downstream truncation (A pnpm check: harvest of dispatch-gates.mjs output silently drops a third of the gate list #13462), and a gate unreachable for the [finding] dispatch-gates never names a family for an edit to a first-party module its gate script IMPORTS — 228 (family, module) pairs unreached, measured #13126 reason is
  discovered, so the tail does not name it either. The header states this so a green tail
  is not read as the class being closed. [finding] an .objectui-sha diff derives NO pin-critical gate — the gates a pin bump most needs are the ones structurally excluded from path derivation, and one of them shipped a red on PR #12955 #12956 is not folded in and is not touched.

Verification

All on 263b4923, exit codes captured before any pipe.

• check:pm-dispatch-gates — EXIT=0, ✓ dispatch-gates self-test: 976 cases pass.
  (944 -> 976, +32 cases: the walk's fixtures, the renderer's refusals, and the live
  class pins.)
• bare-root-worklist.mjs --self-test — EXIT=0,
  OK self-test: 51 live row(s), 43 unreachable as spelled, 43 recorded verdict(s) — none stale, none missing, none contradicted.
• The 14 families dispatch-gates derives for this diff — all EXIT=0, including
  check:watch-hint-literal, check:entry-guard, check:parse-guard,
  check:self-test-wired (✓ every one of the 152 script(s) CI runs that ship a --self-test has that self-test run by CI)
  and check:nul-bytes.
• check-test-completeness.mjs — EXIT=3 = NOT MEASURED, neither red nor green, per
  its own printed refusal.
• ESLint, narrowed and declared: eslint scripts/pm/dispatch-gates.mjs --no-inline-config --format json -> EXIT=0, 1 file, 0 errors, 0 warnings, 0 suppressed. The narrowing is
  sound because (i) the linted population and the rules are read from ESLint's own
  --print-config for this path, not guessed — 2 rules apply,
  comment-swallow/no-code-inside-block-comment and no-restricted-imports; (ii) the file
  count is ESLint's own --format json output; (iii) eslint.config.mjs states, with a
  recorded positive-control measurement, that this repo never enables type-aware linting
  for any file (no parserOptions.project, no typed @typescript-eslint rules), confirmed
  live here (parserOptions.project present: false), so a one-file diff cannot move any
  untouched file's verdict. The repo-wide eslint . is CI's run.
• No changeset: the diff is scripts/pm/** only and publishes from no package, so
  skip-changeset is applied on this PR.

Generated by Claude Code

---

Generated by Claude Code