Verdict handshake for 134 scripts/** self-tests that exit 0 on an early return

[claude]

Part of #13798 (batch 1)

Transplants the verdict handshake PR #13797 landed on check-self-test-wired.mjs and
check-self-test-workflow-commands.mjs to every other scripts/** gate the census
instrument reads as DEFEATED, minus the files held by other lanes' open PRs. Nothing
inside any self-test body changes — no battery, no floor, no case is touched. The
strictly-sequenced sibling #13799 (hole 1, the roster floor) is deliberately NOT in this
diff and stays in pm:queue; per triage 5478876397 the handshake must land before or with
the floor on any given file, so this PR is first and #13799 rebases onto it.

The reading, measured — not re-derived from the card

The card's 144/154 was taken on 597020aa5. The population has moved since. Both numbers
below come from node scripts/measure-self-test-floor.mjs --probe on this branch's own
merge base, 96b627d13, which is also the commit the dispatch was cut against.

	population	DEFEATED	HELD	NOT MEASURED
before (96b627d13)	164	150	9	5
after (this branch, pre-merge)	164	16	143	5

142 of the 150 defeated printed nothing at all and still exited 0.

The 16 that remain are exactly the excluded set — set equality asserted, not eyeballed:
{DEFEATED after} == {DEFEATED before} \ {worklist}. Every one is held by another lane's
open PR or in-flight card, so a hunk here would collide:

file	why excluded
scripts/check-skill-identifier-liveness.mjs, scripts/check-skills-token-ratchet.mjs	PRs #14427 / #14351
scripts/check-type-check-coverage.mjs, scripts/check-type-source-resolution.mjs	PR #14420 (landing)
scripts/pm/bare-root-worklist.mjs, check-clause2-carriers.mjs, check-governed-merges.mjs, check-governed-prose.mjs, check-governed-queue-guard.mjs, check-half-states.mjs, check-label-desc-cap.mjs, check-skill-id-lint.mjs, check-skill-line-ratchet.mjs, ci-failure.mjs, git-history.mjs, release-rehearsal-clone.mjs	the whole scripts/pm/ directory is carved out of batch 1

They are batch 2, once their holding PRs land. scripts/pm/dispatch-gates.mjs is NOT
MEASURED, not clean, and is carved out separately in #13800 — it is not in the 16.

Four more exclusion-list entries never appear because they are not in the population at
all (no --self-test dispatch in code): regen-artifacts.mjs,
measure-durability-swallow-family.mjs, cross-package-test-inputs.mjs,
check-adr-symbol-anchors.mjs, symbol-anchors.mjs; build-console.sh is a shell script
and the census only walks .mjs/.mts/.js/.ts.

Two shapes, one per dispatch spelling

⛔ Candidates were taken with the AST, decided with the probe. The worklist is
DEFEATED − exclusions, never a grep for return selfTest().

Shape 1 — the returned sentinel (68 files). PR #13797's shape verbatim: a per-file
SELF_TEST_VERDICT naming the gate, returned as the last statement of the self-test after
its verdict line, compared at the dispatch. Applied where the dispatch discards the
result (selfTest();, await selfTest();, including as an unbraced else if body) and
the self-test does not already end in a return/process.exit that would make an appended
return unreachable.

Shape 2 — the verdict flag (66 files). A module-level selfTestReachedVerdict, set
only after the verdict prints and read at the dispatch. Applied wherever the self-test's
own exit code is load-bearing, because a returned sentinel would either destroy that
code or be unreachable:

dispatch spelling	files	what the rewrite does
process.exit(selfTest())	20	captures the code, reads the flag, re-exits the same code — process.exit(undefined) is exit 0, which is why this spelling reads like a handshake and is not one
return selfTest() (inside main())	22	reads the flag between the call and the return; the returned value is unchanged
process.exit(cond ? selfTest() : …) and const code = cond ? selfTest() : …	14	splits the ternary so the self-test arm can be handshaked; the production arm keeps its exact expression
dispatch discards, but the self-test ends in return EXITCODE / process.exit(…)	9	flag set immediately before that terminal statement — an appended sentinel return would be dead code
check-durability-degradation-log-level.mjs	1	see below

check-durability-degradation-log-level.mjs is the one Tier C file in the worklist: its
dispatch calls two self-test entries and combines them with
process.exit(a || b ? 1 : 0). An early return in either yields undefined, which that
|| reads as a pass. PR #13797 recorded the choice as "one handshake per callee, or one
wrapper". One handshake per callee is what landed — both entries are structurally
identical (verdict print, then return 0), so it stays a transplant rather than a
redesign. Only the first entry is what the probe measures; the second is repaired because
leaving half a dispatch handshaked is the same silence one call deeper.

Two mechanical traps the transplant had to survive

• An unbraced branch body. } else if (argv.includes('--self-test')) selfTest();
  becomes several statements, and without braces the following else re-binds to the
  handshake's own if. 51 of the 134 files needed the brace; they are braced.
• The temporal dead zone. 6 files dispatch above the self-test's definition, where
  the function is hoisted and a const/let is not. In those the declaration is placed
  before the dispatch's top-level statement instead of before the function, or the run
  would throw a ReferenceError where it used to handshake.

Reverse verification — four ablations, one per dispatch spelling

Each injects return; as the first statement of the entry function in a scratch copy
written beside the original (so relative imports and repo-root resolution answer
identically — the same placement the census instrument uses), runs it, then deletes the
copy. The tracked file is never mutated: the marker count is read back from disk on
both files before the reading is accepted (x1 in the copy, x0 in the original — an
editor step that matched nothing exits 0 exactly like one that landed), and
git status --porcelain was empty afterwards.

gate	dispatch spelling	baseline	with early return
check-nul-bytes.mjs	sentinel · discards	exit 0, ✓ … 75 assertions over a temp git repo	exit 1, ✗ check-nul-bytes self-test: selfTest() returned without reaching its verdict
check-cli-command-ids.mjs	flag · process.exit(selfTest())	exit 0, ✓ … 39 cases pass	exit 1, same refusal
check-error-code-casing.mjs	flag · return selfTest()	exit 0, ✓ … 46 recognizer + 5 registry case(s) pass	exit 1, same refusal
check-comment-mask-adoption.mjs	flag · ternary	exit 0, PASS … (0 failure(s))	exit 1, same refusal

There is no build or dist/ on this path — every gate runs from source — so there is no
rebuild leg to get wrong. The pre-fix direction needs no separate ablation: the before
column of the census is that measurement, and it recorded all four as DEFEATED,
printing nothing.

What did not change, asserted rather than assumed

• Every one of the 134 files still runs its own --self-test to the same exit code and
  byte-identical output. Captured before the codemod and again after, and diffed. Two
  files differ and neither is a behaviour change: objectui-changeset-digest.mjs prints
  fresh mktemp paths and fresh commit shas on every run, and
  check-plugin-teardown-shape.mjs was red before and after on a shallow checkout —
  its positive control is pinned to a commit a --depth=1 clone cannot reach. After
  git fetch --depth=6000 it is green (✓ … 47 cases pass). ⚠️ On a checkout too shallow
  to reach that commit the gate now prints its own "Deepen the clone" refusal and the
  handshake refusal, because it really does return 1 without reaching its verdict. Exit
  code is 1 either way; the extra line is noise on an already-red path, not a new failure.
• Hole 1 is untouched, measured both ways. The census's floor classification
  (ROSTER/COUNT/NONE) is byte-identical for all 164 files before and after. That is
  the mechanical proof this remedy is boundary-only, and it is why 155 of 158 scripts/** self-tests have no assertion floor: a battery that never ran is indistinguishable from one that passed #13799 still has its
  whole job to do.

Verification

Every exit code captured before any pipe, from a variable assigned directly after the
command.

Union re-derived and re-run after the final commit, on 83916a44b (this branch's head,
which is the merge of origin/main at a98b61b3e).

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — DG_EXIT=0,
  134 path(s) vs the merge base, 149 families (148 by path + 3 by change kind, 2 reached
  both ways). Every one was run from --commands, so the harvest cannot end at one section.

• 146 of the 149 exit 0. The other three are NOT MEASURED — never read as passes:

  family	exit	why it is not a verdict
  node scripts/check-partof-closing-keyword.mjs	2	NOT WIRED — neither PR_BODY nor PR_NUMBER is set; its own text says this is a usage failure, not a verdict. Re-run against this PR's body below.
  node scripts/check-single-claim-paths.mjs	2	NOT WIRED — PR_NUMBER is not set, same shape; needs the PR to exist
  node scripts/check-test-completeness.mjs	3	PREREQUISITE NOT MET — it grades a saved turbo run test log and no log exists locally. The same reading PR Survey: which scripts/** self-tests cannot prove they ran — and the two that now can #13797 recorded.

  ⚠️ Thirteen families first came back non-zero on an unbuilt tree — PREREQUISITE NOT MET
  / "Run pnpm build first", not findings. pnpm build (exit 0, 71/71 tasks) turned
  twelve of them green; the thirteenth was a real red and is fixed in this branch, below.

• Named because the dispatch names them, all exit 0: pnpm check:ratchet-remedy-authority,
  pnpm check:declared-population-live, pnpm check:nul-bytes,
  node scripts/pm/bare-root-worklist.mjs --self-test, and
  pnpm check:pm-dispatch-gates — the ~13-minute one, run to completion (781s).

• The two precedent gates in both modes, no pnpm alias, the way lint.yml runs them:
  node scripts/check-self-test-wired.mjs --self-test exit 0
  (6 declared batteries, 43 cases registered) then node scripts/check-self-test-wired.mjs
  exit 0; node scripts/check-self-test-workflow-commands.mjs --self-test exit 0
  (6 declared batteries, 23 cases registered) then the production run exit 0.

• pnpm lint — eslint . --no-inline-config over the whole repo, not narrowed:
  exit 0, 5703 files, 0 errors, 0 warnings (count read from --format json).

• pnpm check:nul-bytes exit 0; the touched files were additionally swept directly for
  raw control bytes (grep -naP '[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]') — no match.

The one real red this produced, and why it was fixed rather than ledgered

pnpm check:type-check-debt reddened at exit 1:
@objectstack/spec-monorepo: DEBT records 26 raw tsc error(s), tsc --noEmit now reports 28 (+2).

scripts/check-test-typecheck.mts is the one TypeScript file in this diff and it lives in
the root tsc program — the convention block of the derivation names it for exactly this
reason. Its selfTest() is annotated : void, so returning the sentinel produced
TS2322: Type 'string' is not assignable to type 'void' and the comparison at the dispatch
produced TS2367.

⛔ Raising the ledger entry is MAINTAINER-ONLY and was not taken. The gate's own author
remedy — fix the errors — is what landed: the annotation now says : string, which is what
the function returns. Root tsc --noEmit -p tsconfig.json is back to 26 errors, equal
to the frozen entry, and the single remaining one (TS2550 Object.hasOwn at line 368) is
pre-existing and untouched. pnpm check:type-check-debt exit 0 on the final head.

No changeset, and the label

scripts/** publishes nothing from any package, so this releases nothing — the closed
skip-changeset list in lint.yml names exactly this case ("this PR edits a CI-internal
script"), and PR #13797 took the same route for the same reason. No changeset is written;
the skip-changeset label is applied on the PR.

Not in this batch — named so it is not mistaken for done

• The 16 excluded gates above. Batch 2, after their holding PRs land.
• The five gates that hold today only by luck, named in 144 of 154 scripts/** self-tests exit 0 when an early return leaves them before their verdict — 137 printing nothing at all #13798's own notes and tabled
  in PR Survey: which scripts/** self-tests cannot prove they ran — and the two that now can #13797: check-osv-exemptions.mjs, typecheck-configs.mjs,
  check-exported-any-returns.mts (a downstream TypeError), checklist-select.mjs,
  run-with-stall-guard.mjs (a usage/argument error), plus
  check-page-declaration-shape.mjs whose process.exit(selfTest() ? 0 : 1) stops a bare
  return and prints nothing while doing it. The probe reads all six HELD, so they fall
  outside batch 1's stated surface — "every file that reads DEFEATED, minus the exclusion
  list" — and are not repaired here. Their green is still an accident one refactor
  deep; they need the same five-line transplant.
• The five NOT MEASURED files: check-platform-checklist.mjs (four callees combined),
  check-regen-pending.mjs, git-merge-regen.mjs, setup-git-hooks.mjs (inline top-level
  blocks with no callee to leave early) and scripts/pm/dispatch-gates.mjs (Four scripts/** gates hit by the #13489 survey were excluded by occupancy — carry them forward #13800). Each
  needs reshaping before the probe measures anything, which is a decision, not a
  transplant.
• Three gates (check-filter-alias-parity.mjs, check-meta-type-normalized.mjs,
  check-test-completeness.mjs) also call their self-test on the production path. That
  call still discards its result. It is the same silence, one seam over, and outside the
  measured surface; recorded here rather than fixed.

#13799 is not addressed here. #13014 (the empty-scan class) is not addressed here and does
not overlap: check-adr-links.mjs and check-doc-anchors.mjs both carry a full empty-scan
refusal and were both defeated by this hole.

🤖 Generated with Claude Code

https://claude.ai/code/session_013Euac24FtaPN3AXf9uiUWA

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e286e248866c40d2db662f69aa0ba6e71b4b096 → packageMentionDocs.