fix(devx): the two corpus walkers skip .cache/, so a console pin bump no longer reds on objectui's files - #15596

Fixes #15557

scripts/build-console.sh materialises objectui at the pinned SHA into .cache/objectui-SHA/ — a whole foreign checkout, gitignored (.gitignore), that every console pin bump MUST create because the console cannot be built without it. Both repo-wide corpus walkers descended into it, so a pin bump read two reds against objectui's files, and one of them told the operator to go and pin a shape in this repo's masker.

Direction 1 of the card, per the dispatch ruling: both walkers add .cache to the directory-name skip set they already keep — the node_modules class, "not our source". .gitignore-honouring (direction 2) is a wider contract change and is not attempted here.

Premise re-measured on a fresh origin/main tree

.cache/ was absent on this container, so the behaviour was reproduced by planting one: .cache/objectui-probe/{AGENTS.md, apps/console/src/pages/Probe.tsx, package.json}, the three shapes a real build worktree carries. Same tree, same commit, nothing else changed between the columns; the probe was deleted before the commit and git status is clean.

The premise holds, and the measurement found one consequence the card did not name: deriveVitestScripts walks the same tree, so a foreign package's script names silently widened the set of names this gate judges in our own corpus — a false-red channel in the opposite direction from the one that was reported.

The controls — both directions, in each gate's own fixture

Each --self-test now plants the SAME BYTES inside and outside .cache/ on a real temp tree, so the only variable is location and the exclusion cannot become a mute button:

• check-comment-mask-corpus — src/probe.tsx and .cache/objectui-pin/src/probe.tsx, identical, against a masker that disagrees with the parser on them. The copy outside is collected and reds; the copy inside never enters the corpus; and the same bytes, compared directly with compareFile, still disagree — so the exclusion is by location, not because those bytes happen to agree. 5 cases; the single battery's floor moves 12 → 17.
• check-agent-test-spelling — objectui's own instruction (pnpm --filter PKG test -- --run) in an AGENTS.md under .cache/objectui-pin/, plus a foreign manifest. Sweep is CLEAN, the walk never reaches the file, the manifest does not widen the derivation; the identical text one directory higher (vendor/objectui-pin/AGENTS.md) still reds and the finding names it. 5 cases in a new battery; SELF_TEST_BATTERY_FLOOR 12 → 13.

Ablation, trap-guarded, one set at a time, mutation confirmed on disk by anchor grep counts and restore proved by blob hash:

Neither gate is built: node runs scripts/*.mjs from source, so there is no dist/ leg to prove for either ablation.

Importer census — who else reads these sets

SKIPPED_DIRECTORIES is exported, so every importer was enumerated: git grep over scripts/, packages/, apps/ for SKIPPED_DIRECTORIES / CORPUS_FLOOR / collectSources returns no importer of this module's set — the other collectSources hits are unrelated local definitions (check-react-page-adapter-contract, tenant-audit-census, isystem-census, one plugin test). SKIP_DIRS is module-local and not exported. 43 scripts keep a private skip set of their own; no gate asserts agreement between them, and check-skill-identifier-liveness pins only its OWN set's contents. Independent evidence that no cross-walker parity gate exists: .git is already in SKIPPED_DIRECTORIES and already absent from the list js-comment-mask.mjs's header quotes, and main is green.

js-comment-mask.mjs's header quotes six directories as part of the 2026-08-21 measurement it records. That file is untouched (its PR is live); the corpus gate's own doc comment now says which of the two is the instrument and which is the history, so the claim it makes is true as written.

scripts/pm/dispatch-gates.mjs is untouched. Both new fixture path literals sit inside runSelfTestCases, which COMPOUND_ANCHOR_LEDGER already classifies (['scripts/check-comment-mask-corpus.mjs', 'runSelfTestCases', false]), so they are masked from hint extraction; check:pm-dispatch-gates is green.

Verification — all at 4eaa5de8f (merge of origin/main into this branch), exit codes captured before any pipe

The family is node scripts/pm/dispatch-gates.mjs --changed --commands --repo objectstack-ai/objectstack (exit 0, 24 commands, --repo … checked against this checkout's 'origin' remote — it holds), re-derived after merging origin/main: the first derivation warned ⚠️ STALE TREE and named scripts/pm/dispatch-gates.mjs itself as changed in that range. The post-merge list is byte-identical, and every one of the 24 commands was run. Nothing NOT MEASURED: no exit 3, no PREREQUISITE NOT MET, no ERR_MODULE_NOT_FOUND.

Neither edited script has a vitest suite — their tests ARE their --self-test, both of which were run and both of which served as the ablation instrument. The one file in the tree naming check-comment-mask-corpus.mjs in a test (packages/client/src/envelope-caller-census.test.ts) references it in prose only.

Lint: a declared narrowing, not a whole-repo run. eslint --no-inline-config over the two edited files: exit 0, and --format json reports 2 files, 0 errors, 0 warnings. The population is eslint's own flat config (both files matched it and were linted rather than ignored), and the config cannot move a verdict on any untouched file because this repo runs one eslint.config.mjs which "never enables type-aware linting (no parserOptions.project, no typed @typescript-eslint rules) for ANY file" — its own words, at eslint.config.mjs:326. CI runs the farm regardless.

No changeset: scripts/** only, nothing published from any package — skip-changeset applied and read back.

🤖 Generated with Claude Code

https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

Generated by Claude Code