dispatch-gates will read PR #10801's module-scope self-test fixtures as a declared population — `packages/**` and `scripts/**` become fabricated MATCHED leads

[os-zhuang]

Measured while implementing #10705. Filed unassigned. Nothing is red today — the gate in
question has not merged yet. ⛔ I did not edit that branch and this is not a request to block it.

What was measured

scripts/check-ci-filter-parity.mjs (new gate on PR #10801, wired into lint.yml) was read
at that PR's head 806c4f0f52 and run through extractWatchHints from
scripts/pm/dispatch-gates.mjs. Four hints survive comment- and self-test-masking:

.github/workflows/ci.yml, packages/**, scripts/**, @objectstack/probe

Applying hintCovers to each, the derivation would name this gate for:

MATCHED   .github/workflows/ci.yml            <- its real population
MATCHED   packages/core/src/index.ts          <- fabricated
MATCHED   scripts/check-nul-bytes.mjs         <- fabricated
silent    .github/workflows/lint.yml
silent    content/docs/deployment/cli.mdx
silent    apps/console/src/main.tsx
silent    docker/README.md

So once it merges, every card under packages/** and scripts/** — two of the largest
directories in the tree — derives check:ci-filter-parity as a high-signal local gate it does
not need to run.

Where the two literals come from, and why masking misses them

They are default arguments of a module-scope fixture builder, not source inside selfTest():

    list(core ?? ['packages/**', '.github/workflows/ci.yml']),
    list(crosspkg ?? ['scripts/**']),

That is exactly the documented residue in extractWatchHints' own docblock:

What this does NOT remove: a fixture constant defined at module scope and used only by the
self-test still reads as a hint. That residue is bounded (measured below) and it is the same
shape the scan has always had.

The asymmetry confirms the mechanism rather than assuming it: that gate's other fixture globs
(content/**, tools/**, docker/**, packages/a/**, content/b.mdx, scripts/x.mjs) sit
inside its selfTest() and are correctly blanked — only the two at module scope survive.

Why this matters more than the residue note implies

The residue is documented as "bounded", and for a fixture naming one file it is. Here the
module-scope fixtures are top-level subtree globs, so the leak is not one path but two of
the biggest populations in the repo. This is the currency of hintCovers' +139084 measurement
arriving through the door the :920 refusal does not guard: the refusal filters bare words,
and these are well-formed globs that the covering rule is right to honour — they are simply not
this gate's population.

The failure direction is the expensive one the tool's header names: a fabricated lead is pasted
into every dispatch prompt whose surface brushes it, and the dev running it cannot tell it from
a real one.

Not asserted

No claim about which remedy is right, and it is deliberately not a change to :920. Three
shapes exist and the choice is a judgement:

• move the two defaults inside the gate's selfTest() (smallest, gate-local, matches how that
  file already treats its other fixtures);
• build them at runtime from unslashed halves, the way DEFAULT_BASE_REF in dispatch-gates.mjs
  already avoids entering its own hint set;
• teach maskSelfTests to reach module-scope constants used only by the self-test — the widest,
  and the one that would need its own measurement first.

The first two are the gate author's call; the third is a dispatch-gates card.

⚠️ Also checked and not a finding: PR #10802's scripts/check-release-section-coverage.mjs
was flagged to me as a suspected instance on the strength of its bare v17.mdx literal. It is
not one — measured at that PR's head, the gate carries content/docs/releases as a real hint
and the derivation MATCHES it for content/docs/releases/v17.mdx. The bare v17.mdx is
incidental and is not extractable as a hint at all (no separator), and the tree has no root file
by that name, so it would be the genuinely-dead species rather than the escapable one on two
independent grounds. Recording it so the same suspicion is not re-raised.

Refs

#10705 / PR #10839 (where this was measured) · PR #10801 (the gate; not blocked on this) ·
extractWatchHints and maskSelfTests docblocks in scripts/pm/dispatch-gates.mjs

---

Generated by Claude Code

[huangyiirene]

Triage first-touch: pm:blocked, type Task.

Blocked-by: #10801

The defect only materializes when PR #10801 merges, and the two cheapest remedies (move the module-scope fixture defaults inside selfTest(), or build them from unslashed halves) land in that PR's own file — the gate author folding either in pre-merge closes this card outright. Unlock-action when #10801 closes: re-verify on the merged ref whether check-ci-filter-parity still leaks packages/** + scripts/** through extractWatchHints before queueing; if the fix was folded, close as completed-upstream. The third remedy (teaching maskSelfTests to reach module-scope constants) is a separate dispatch-gates card and needs its own measurement first — do not fold it in here.

---

Generated by Claude Code

[huangyiirene]

Unlock scan (triage seat, 2026-08-21 ~16:0xZ): upstream PR #10801 is MERGED, and the premise was re-verified on the merged ref before returning this to the queue — the two module-scope fixture defaults survive exactly as measured, now at scripts/check-ci-filter-parity.mjs:401 (['packages/**', '.github/workflows/ci.yml']) and :403 (['scripts/**']), so the fabricated MATCHED leads for packages/** and scripts/** cards are live in dispatch-gates derivations as of this merge. pm:blocked → pm:queue.

Dispatch note: of the card's three remedy shapes, the first two (move the defaults inside selfTest(), or build them at runtime from unslashed halves per the DEFAULT_BASE_REF pattern) are gate-local and small; the third (teach maskSelfTests about module-scope self-test-only constants) is a dispatch-gates.mjs change wanting its own measurement first — dev picks, and picking the third means saying why the small ones don't suffice. Size/model suggestion: S–M.

---

Generated by Claude Code