tooling(pm): give dispatch-gates --ran an explained bucket for the value-bearing class - #15165

Fixes #15115

runReconciliation in scripts/pm/dispatch-gates.mjs classifies a command the
runner RECORDED that is not in the derived runnable set. It had three outcomes,
two of which are "explained, not a mistake": a CI-measured-only family, and a
pending-changeset family. The value-bearing class — an invocation whose argv
takes a value from the workflow, added by PR #15114 and subtracted from
--commands by the second subtraction in commandsFor — had no such bucket, so
a recorded one landed in extra.

Reproduced at the merge base, before any edit

Merge base 4283b72a. Record = the 15 commands --commands derives for a
changeset path, plus the live pr-automation.yml invocation
node scripts/check-empty-changeset.mjs --base "$MERGE_BASE":

$ node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack \
    --ran repro-ran.list .changeset/foo.md

Run reconciliation — 15 derived, 15 run, 0 NOT-MEASURED, 0 UNRUN.
  Outside this card's derivation (1) — recorded, and named by nothing this run derived. Not an error: a run beyond the union costs nothing.
    - node scripts/check-empty-changeset.mjs --base "$MERGE_BASE"
✓ dispatch-gates --ran: 15 derived famil(ies) accounted for — 15 run, 0 NOT-MEASURED.

That caption is the defect in one sentence: this run DID derive that family and
then classified it out of the union on purpose, so "named by nothing this run
derived" is the one thing that is false about it. No reason is attached, and the
runner is left to guess whether they typed something wrong.

The bucket

• runReconciliation takes notRunnableCommands, defaulting to an empty set so
  every existing caller's verdict is byte-identical.
• It is checked BESIDE ciOnlyCommands and before pendingCommands, because
  the file already groups those two: they are the two subtractions commandsFor
  makes from the runnable union, in that order, while the pending families are a
  different fact (a path that did not exist at derivation time). ciOnly keeps
  first precedence, matching commandsFor, so one command can never produce two
  counts for one omission.
• The set is built at the --ran call site by notRunnableCommandSet(matchedRows, alwaysRunsRows) — the SAME expression commandsFor subtracts with, off the
  same rows — so the union and the reconciliation cannot drift about which
  invocations are withheld.
• recon.ok still reads unrun.length only. --commands output, the
  classifier, the derivation keys and every live key are untouched.

Rendered on its own labelled line, in the shape the two beside it use. Same
record, same card, on this branch:

Run reconciliation — 15 derived, 15 run, 0 NOT-MEASURED, 0 UNRUN.
  Classified by this tool, no explanation owed (1) — VALUE-BEARING famil(ies): its argv takes a value from the workflow, so it is recorded, not derived as runnable:
    - node scripts/check-empty-changeset.mjs --base "$MERGE_BASE"
✓ dispatch-gates --ran: 15 derived famil(ies) accounted for — 15 run, 0 NOT-MEASURED.

The remainder heading is gone entirely and the verdict is unmoved.

Self-test — 7 new cases, 1353 total

Unit, beside the existing explained case (whose fixture now carries a fourth
recorded entry, the live value-bearing spelling):

• a recorded value-bearing command classifies into explainedNotRunnable and is
  NOT in extra;
• CONTROL: an unknown command recorded beside it still reads extra — the
  bucket explains its class and nothing else, which is the half that keeps this
  from deleting the remainder rather than shrinking it;
• the two existing buckets keep their verdicts in the same run
  (explainedCiOnly 1, explainedPending 1, extra 0);
• the bucket cannot move the verdict: ok true, unrun 0;
• the rendering carries its own labelled line, the reason, and the command, with
  the two neighbouring lines still present and the remainder heading absent.

End to end, a real CLI run (three cases), because every unit case above stays
green if the --ran call site never PASSES the set — a parameter defaulting to
empty is exactly the shape that keeps its own tests green while the live mode
still dumps the class in the remainder. Its fixture is the tool's own --json
answer on this tree rather than a spelling typed into the test, so it cannot
outlive a change to the renderer that produces the real invocation.

Gates — all green, run at head 5fb6e3a7

Re-derived from the real change set with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (no paths) after the commit; the
20 families match the dispatch list exactly, nothing added. Each exit code was
captured by redirecting first, never after a pipe; every line below is the
gate's own verdict line.

Repo-wide ESLint, not narrowed: pnpm lint (eslint . --no-inline-config) through
the shared verify lock — os-verify-lock: VERDICT command-exit 0 · held the lock 66s.
The dispatch-gates --self-test also ran through the lock: VERDICT command-exit 0 · held the lock 354s. Both wall-clock figures are shared-box seconds, as the lock's
own verdict line states.

NOT MEASURED, in its own words: check-test-completeness is itself one of this
diff's value-bearing families — its argv takes $RUNNER_TEMP from the workflow,
so it is outside --commands and has no local run. Same for
check-shard-attestation.mjs --emit ... and the --union-into spelling of
check-cross-package-test-inputs (the bare pnpm check:cross-package-test-inputs
spelling of that family IS in the table above and ran green).

Nothing is published from any package (scripts/pm/**, no .md), so
skip-changeset is applied.

Generated by Claude Code