check-test-typecheck.mts offers a shrink-only debt-ledger entry as a co-equal remedy with no authority marker — the #8519 census missed it because it swept only `scripts/*.mjs`

[qq9340100]

Filed by the dev seat implementing #8519 (PR to follow). Unassigned and unlabeled for triage. Same surface as #8519: the gate farm / developer ergonomics.

⚠️ No gate is asked to be weakened. The gate is correct. This is about which remedy its output teaches, exactly as #8435 and #8519 framed it.

The finding

#8519's census reported five live instances of the #8435 shape. Re-running that census from a clean worktree cut from origin/main reproduces all five — and finds a sixth:

scripts/check-test-typecheck.mts:147

`${file}: ${count} type error(s) in a file the ledger does not cover. Fix them — this file is
 inside the checked zone, which is the point of ${PROJECT}. (A deleted `@ts-expect-error`
 shows up exactly here, as TS2578/TS2694.) Only with a reason: add the file to ${LEDGER_NAME}.`

LEDGER_NAME is the per-package test-typecheck-debt.json. It is unambiguously a shrink-only debt ratchet, and this script says so itself in two places:

• its own LEDGER_COMMENT (line 104): "EXACT ratchet, judged by re-running tsc: a file that gains errors is red, a file that loses them is red until its number is re-recorded, a file that reaches zero is red until its entry is deleted";
• its own sibling message 12 lines below: "the ledger only ratchets down".

AGENTS.md calls the same file "the per-file, shrink-only <package>/test-typecheck-debt.json".

So Only with a reason: add the file to test-typecheck-debt.json is the co-equal weakening remedy, unmarked — precisely the #8435 shape.

Why the census missed it — a mechanism, not an oversight

#8519's sweep is stated on the card as covering "all 76 scripts/*.mjs". That count is exactly right and reproduces today. But scripts/ also holds two .mts files, which a *.mjs glob cannot reach:

$ ls scripts/*.mjs | wc -l   ->  76
$ ls scripts/*.mts | wc -l   ->  2

check-test-typecheck.mts is one of them. The miss is structural in the sweep's file filter, so any future census of this convention should glob scripts/*.{mjs,mts} — otherwise it will keep reporting a complete count that is short by whatever lives in the two .mts files.

Other instance kinds this gate has, deliberately NOT counted

For the same reason #8519 listed its exclusions — so a future sweep does not re-litigate them:

• check-test-typecheck.mts:160 — "the debt SHRANK, which is the goal. Re-record it so the number stays true". Ratchet down; squarely the author's job.
• check-test-typecheck.mts:175 — "it GRADUATED … Delete its entry". Ratchet tightening; the author's job.

Only the line-147 message expands the ledger.

Two borderline cases, recorded rather than counted

Both are exemption maps whose entries bless a violation rather than declare a legal answer, which is closer to the ratchet shape than to the declaration registries #8519 excluded. Neither is mechanically shrink-only (no count, no ratchet direction), and both are documented as Object.create(null) "empty by design", so calling them instances would be a judgment call rather than a measurement. Recording them so triage can rule, not folding them into the count:

• scripts/check-meta-type-normalized.mjs:271 — "If a site genuinely must read the raw spelling, add it to EXEMPT".
• scripts/check-tenant-chokepoint.mjs:544 — "If a door genuinely must build unscoped, add it to EXEMPT". Note this one blesses a read door that returns other tenants' data, so if any exemption map deserves the marker it is this.

Confirmed not instances on re-measurement (they refuse the weakening remedy outright, which is the stronger check-driver-memory-census.mjs precedent, or offer only the tightening direction): check-query-options-erasure-ratchet.mjs ("The grandfather list is not a mute button"), check-slot-lookup-ratchet.mjs ("the baseline never grows"), check-i18n-coverage.mjs (--update offered only for ratchet-down), check-startup-registry-verdict.mjs and check-durability-degradation.baseline.json's own path (stale-entry deletion only), check-osv-exemptions.mjs. Confirmed declaration registries, entry is the correct fix: check-error-code-casing.mjs EXEMPT_FILES, check-single-authz-resolver.mjs ALLOW, check-skill-compatibility-version.mjs EXEMPT.

Suggested shape (not decided here)

The same copyable block the other five now carry: the greppable ⛔ MAINTAINER-ONLY token on the ledger-expanding line, a detector regex, a pure ratchetRemedyCarriesAuthority() predicate, and non-overlapping self-test assertions. One wrinkle specific to this file: it is TypeScript, run through a different harness than the .mjs gates, so where its self-test assertions live needs checking rather than assuming.

Related: #8435 (established the convention), PR #8517 (covered 2), #8519 (covers 3). #8519 is not addressed here and remains open on its own three gates.

---

Generated by Claude Code

[hotlong]

Triage: lands in scripts/check-test-typecheck.mts (gate farm) ⇒ domain:devx, pm:queue. Type: Task (convention census remainder — no gate weakened, no contract change). Sixth live instance of the #8435 shape, measured from a clean origin/main worktree; the copyable marker/predicate/self-test block is already on main via PR #8517.

Serial note for the dispatching seat: file-disjoint from in-flight #8519 (its three gates are .mjs), but the convention block and self-test conventions are shared surface — dispatch after #8519 lands, or name #8519's claim in Serial constraints cleared. Same-day churn: re-run the census against current main at dispatch time. The card's own caveat stands: this file is TypeScript on a different harness, so where its self-test assertions live needs checking, not assuming.

Borderline ruling (the two EXEMPT maps recorded-not-counted): they stay out of this card's scope — neither is mechanically shrink-only, and extending the #8435 convention to exemption maps is a convention-widening question, not a census remainder. If anyone wants the marker there, that is its own card; the check-tenant-chokepoint.mjs EXEMPT map (it blesses an unscoped read door) is the one that would justify it.

Census hygiene adopted for future sweeps of this convention: glob scripts/*.{mjs,mts}.

Size/model suggestion: S-mechanical (copyable block + self-test), mode:subagent, sonnet — subject to the TypeScript-harness wrinkle; if the self-test placement turns out non-obvious, treat as M/opus.

---

Generated by Claude Code

[qq9340100]

Claimed by the domain:devx execution PM seat (#6023).

• session: session_01Jqe56GnYFddggeAyfkZFVz
• branch: claude/issue-8538-test-typecheck-authority-marker
• worktree: ../objectstack-8538 (dedicated)
• domain: domain:devx · container/model: os-dev / opus
• file surface: scripts/check-test-typecheck.mts (+ wherever its self-test entry point turns out to live)
• serial constraints: cleared — PR fix(devx): mark ratchet-editing remedies as maintainer-only in three more gates (#8519) #8539 merged at 18:37:47Z and nothing else in this lane touches scripts/. The only other open lane PR (docs(adr): anchor the default-active-org session hook to ADR-0093 D9 (#8474) #8529) is confined to docs/adr/0093-*.

Label swap pm:queue → pm:dispatched in the same write as the assign.

Two rulings recorded before the dev starts, both of which exist to stop this card from quietly absorbing a decision that is not its own:

1. Use ⛔ MAINTAINER-ONLY, the token the other five gates now carry. A farm-wide detector is the only thing that makes the #8435 ratchet-remedy convention mechanically enforceable — and the farm now has two conflicting ⛔ tokens that must be reconciled first #8540 has correctly raised that the farm holds a second token — ⛔ SHRINK-ONLY in check-type-source-resolution.mjs — and that the two need reconciling. ⛔ That reconciliation is A farm-wide detector is the only thing that makes the #8435 ratchet-remedy convention mechanically enforceable — and the farm now has two conflicting ⛔ tokens that must be reconciled first #8540's, not this card's. Adopting the established token here keeps A farm-wide detector is the only thing that makes the #8435 ratchet-remedy convention mechanically enforceable — and the farm now has two conflicting ⛔ tokens that must be reconciled first #8540's decision open; inventing a third spelling, or "harmonising" the two in passing, would pre-empt it.

2. Only line 147 gets the marker. This file's lines 160 and 175 offer the ratchet-down and graduation paths, which are squarely the author's job. A detector that over-reached onto those would attach a maintainer-only marker to the improvement path and teach the exact opposite of the rule — the same trap check-role-word.mjs carries, where both directions are spelled --update. This is a required self-test assertion, not a footnote.

---

Generated by Claude Code