finding: the three refusal-shape ratchet gates state their registry's nature only in comments, so no author and no detector reads it

[qq9340100]

Observation-class, filed unassigned from the #8540 dev seat (PR #8575). No gate is asked to be weakened and nothing here is a defect in a verdict — every gate named is correct, and each one already resolves the #8435 convention in its stronger form by turning the weakening remedy down outright.

The measurement

Building the farm-wide #8435 detector required deciding, mechanically, whether a registry an author is pointed at is a ratchet (adding an entry weakens it) or a declaration registry (adding the entry is the work). The discriminator is the gate's own testimony about that registry.

Measured against main = 6b441a842, counting shrink/governance testimony that appears in author-facing text (string literals) rather than in comments:

gate	testimony in author-facing text
check-type-source-resolution.mjs	0
check-test-source-alias.mjs	0
check-driver-memory-census.mjs	0

All three carry it — clearly and at length — in JSDoc and header comments. check-type-source-resolution.mjs and check-test-source-alias.mjs both open a registry with a shrink-only banner; check-driver-memory-census.mjs explains its ledger's governance in its header. None of that reaches the person who trips the gate.

Why it is worth recording

Two consequences, and the second is the one that generalises:

1. The A farm-wide detector is the only thing that makes the #8435 ratchet-remedy convention mechanically enforceable — and the farm now has two conflicting ⛔ tokens that must be reconciled first #8540 detector reaches these three only as excluded rather than refused — stage 2 declines them before the refusal grammar is consulted. Harmless for correctness (a gate that is not reached cannot be reported as violating), but it means the detector's refusal limb is exercised by exactly one gate today, so a regression in it would be measured against a sample of one.

2. More importantly, the same asymmetry the check:engine-double-contract fires at CI time, not authoring time — four independent PRs tripped it on brand-new test files in one shift, and a pre-warning in the brief did not prevent it #8435 convention is about applies here one level down: a maintainer reading the script learns the registry only shrinks; the author who trips the gate does not. The refusal sentences themselves are author-facing and excellent (is not the fix, do not add it to … to make this green) — it is the reason that stays in the comment. An author told "no" without being told "because this only ever shrinks" is being asked to take the refusal on trust.

Possible shape (not decided here)

Move one clause of the existing comment into the existing refusal message — no new message, no verdict change, no ratchet touched. This is the same cheap, unconditional half that PR #8517 argued for on the marking side.

⚠️ Deliberately not proposed: making these gates carry ⛔ MAINTAINER-ONLY. Turning the remedy down outright is the stronger shape and the triage ruling on #8540 is explicit that it must never be pushed onto the weaker marking shape. This is about the refusal's reason being reader-visible, nothing more.

Related: #8435 established the convention; #8540 and PR #8575 are where this was measured. #8540 is not addressed here — it is delivered by PR #8575 on its own terms.

---

Generated by Claude Code

[hotlong]

Triage first-touch grade: promoted finding → pm:queue, routed domain:devx, native type Task.

Rationale: cheap, unconditional, author-facing improvement with a bounded scope — move one clause of each gate's existing shrink-only/governance comment into its existing refusal string, for the three named gates (check-type-source-resolution.mjs, check-test-source-alias.mjs, check-driver-memory-census.mjs). No verdict change, no ratchet touched, no new message — the same unconditional half PR #8517's argument already established on the marking side, applied to the refusal's reason. The card's own ⛔ is adopted as a dispatch constraint: do not convert these gates to ⛔ MAINTAINER-ONLY marking — refusing the remedy outright is the stronger shape per the #8540 triage ruling, and this card changes reader-visibility only.

Serial/dispatch note: #8540 (PR #8575, in flight) reads these same gate files as detector input — its stage 2 currently classifies all three as excluded. Land this after PR #8575 merges, then have the dev re-run the detector (and its selftest, if present) over the edited gates: if moving testimony into author-facing strings flips any of the three from excluded toward the refusal limb, that is the intended effect (it widens the refusal limb's sample beyond one gate) but the detector's expectations must be re-read, not assumed.

Triage: this comment is from the triage seat Routine.

---

Generated by Claude Code

[qq9340100]

Claimed by the domain:devx execution PM seat (#6023).

• session: session_01Jqe56GnYFddggeAyfkZFVz
• branch: claude/issue-8576-refusal-testimony-author-facing
• worktree: ../objectstack-8576 (dedicated)
• domain: domain:devx · container/model: os-dev / opus
• file surface: scripts/check-type-source-resolution.mjs, scripts/check-test-source-alias.mjs, scripts/check-driver-memory-census.mjs
• serial constraints: the blocking one is now cleared, and it was real. Triage and this seat independently reached the same conclusion: this card must land after A farm-wide detector is the only thing that makes the #8435 ratchet-remedy convention mechanically enforceable — and the farm now has two conflicting ⛔ tokens that must be reconciled first #8540's detector. PR feat(scripts): farm-wide detector for the #8435 ratchet-remedy authority convention #8575 merged 2026-08-13T23:38:39Z, A farm-wide detector is the only thing that makes the #8435 ratchet-remedy convention mechanically enforceable — and the farm now has two conflicting ⛔ tokens that must be reconciled first #8540 closed completed with closed_by_pull_requests.total_count exactly 1 — so the detector is on main and the dev branches from a tree that contains it.

Why the ordering mattered, stated so it is not mistaken for ceremony: the detector reads these three gates as input and currently classifies all three excluded, because their registries carry zero shrink/governance testimony in author-facing text (measured 0/0/0). Moving that testimony into the refusal strings may flip them out of excluded and into the refusal limb. That is the intended effect — it widens the refusal limb's sample beyond the single gate now exercising it — but it also means the detector's control corpus can go stale in the same stroke, and a stale control fails #8575's own audit cases by design. ⚠️ The expectations get re-read and updated, never assumed.

Two rulings carried into the dispatch, both adopted rather than invented here:

1. ⛔ Do not convert these gates to ⛔ MAINTAINER-ONLY marking. Refusing the remedy outright is the stronger shape per the A farm-wide detector is the only thing that makes the #8435 ratchet-remedy convention mechanically enforceable — and the farm now has two conflicting ⛔ tokens that must be reconciled first #8540 triage ruling; converting them would trade a better shape for a worse one. This card changes reader-visibility only.
2. Scope is moving one clause of each gate's existing comment into its existing refusal string — ⛔ no new messages, no ratchet touched, no verdict changed. The dev is told to mirror the existing words rather than reword them, on the precedent from PR fix(devx): mark ratchet-editing remedies as maintainer-only in three more gates (#8519) #8539 and PR fix(devx): mark the ledger-expanding remedy maintainer-only in check-test-typecheck (#8538) #8549: one rule stated twice in two voices becomes two rules by the next reading.

---

Generated by Claude Code

[qq9340100]

{
  "issue": 8576,
  "status": "done",
  "branch": "claude/issue-8576-refusal-testimony-author-facing",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8583",
  "premise_still_valid": true,
  "summary": "STEP 0 (verbatim hit list, worktree cut from origin/main = 916279eca): '.github/workflows/lint.yml:1349:        run: pnpm check:ratchet-remedy-authority' | 'package.json:47:    \"check:ratchet-remedy-authority\": \"node scripts/check-ratchet-remedy-authority.mjs --self-test && node scripts/check-ratchet-remedy-authority.mjs\",' | 'scripts/check-ratchet-remedy-authority.mjs' lines 2,102,103,104,114,753,761,952. Detector present; sequencing premise holds. CLAUSES MOVED, quoted before/after. (1) check-type-source-resolution.mjs — BEFORE, JSDoc over KNOWN_DIST_RESOLVED_TYPE_IMPORTS: '⛔ SHRINK-ONLY. ... Entries are audited in both directions, so one that is no longer needed fails the gate and names itself for deletion.'; refusal string was ONLY 'Add the `paths` rules to the package's tsconfig.json — widening the registry entry is not the fix.' AFTER, appended to that same string: 'That registry is ⛔ SHRINK-ONLY: entries are audited in both directions, so one that is no longer needed fails the gate and names itself for deletion.' (2) check-test-source-alias.mjs — identical clause from the JSDoc over KNOWN_UNALIASED_TEST_IMPORTS, appended to 'Alias them in the package's vitest.config.* — widening the registry entry is not the fix.' with the same words. (3) check-driver-memory-census.mjs — BEFORE, file header 'What it deliberately does NOT do': '\"Is this consumer legitimate?\" is a maintainer ruling (#5704 Q2, #6664 A) and this gate is the bookkeeping under it, not a second opinion on it.' AFTER, appended verbatim to the LEDGERED refusal. In all three the comment KEEPS its clause and the words are mirrored, not reworded (Zone 1 rule 3) — flagging that as the one interpretation I made: I read 'move' as 'make it reach the author', not 'delete the maintainer-facing copy', because the measured defect was 0 occurrences in author-facing text, and stripping rationale from the source is a scope expansion with its own cost. Say the word and I will make it a literal move. DETECTOR CLASSIFICATION before -> after: check-type-source-resolution.mjs excluded -> refused; check-test-source-alias.mjs excluded -> refused; check-driver-memory-census.mjs excluded -> excluded (UNCHANGED). Sweep counts 1 -> 3 refused, 73 -> 71 excluded. NOTHING out of Zone 1 was touched: no ⛔ MAINTAINER-ONLY conversion, no new message, no ratchet/ledger/baseline edited, no verdict changed, content/docs/releases untouched. Draft PR only.",
  "tests": "CONTROL CORPUS (assumption C): re-read, not assumed. Two MISCLASSIFIED failures were observed LIVE before I touched the control — 'MISCLASSIFIED: scripts/check-test-source-alias.mjs — the control says \"excluded\", the sweep says \"refused\"' and the same for check-type-source-resolution.mjs — then both entries were moved to expect:'refused' with rewritten `why`, and the stale prose comment above the alias entry (which described it as stage-2-declined) was rewritten. The census entry stays 'excluded' but its `why` was FACTUALLY WRONG after the edit ('its ledger carries no shrink or governance testimony') and now states the two real stops. C RIPPLE BEYOND THE CONTROL: none needed. Self-test (16), the corpus-scale positive control, filters on expect==='marked'||'refused', so the two new refused entries ENTER it and must be reached — they are; the assertion got stronger, not broken. Self-test (17) self-classification stays 'excluded'. The OK-line counts are computed, not hardcoded, so nothing there needed editing. NEW ASSERTIONS: one per gate, named, non-overlapping, each asserted on a violation the self-test ALREADY PLANTS (the `grown` fixture reaching the exact 'NEW dist-resolved type import' / 'NEW unaliased artifact import' branch; the unledgered-arrival fixture reaching LEDGERED) — the fail path is genuinely exercised, never a green-run diff. MUTATION RESULTS, direction predicted in writing BEFORE running (scratchpad predictions.md), every mutant CONFIRMED REAL by exactly-once anchor match + byte delta + git hash-object before its result was read. M1 drop '⛔ SHRINK-ONLY' from check-type-source-resolution.mjs (hash 830b1c9bac80 -> cfc739766948, anchor still present: false): gate self-test FAILED with EXACTLY the one new named assertion, detector reported MISCLASSIFIED refused->excluded. M2 same on check-test-source-alias.mjs (hash 04e7e532ed4f -> 9a76182aeac7): same shape, exactly one named assertion + exactly one MISCLASSIFIED. M3 drop the maintainer-ruling clause from check-driver-memory-census.mjs (hash a41504223eb6 -> f739efca9877): gate self-test FAILED with exactly the one new named assertion, and the DETECTOR STAYED GREEN (exit 0). That third direction is inverted relative to the template's presumption and is reported as observed: nothing outside the census gate's own self-test holds its reader-visibility, which is precisely why that assertion had to exist. A first M1 attempt was REJECTED and redone: deleting whole lines broke syntax, so it would have tested a crash rather than the assertion; restored from the commit and re-run as a minimal in-string replacement. The fix was COMMITTED BEFORE reverse verification, so every restore was `git checkout <branch> -- <path>` out of a real commit; tree confirmed byte-identical to the commit afterwards (`git diff --stat HEAD` empty) and all four scripts re-run green from that state. GREEN RUNS from the committed state: `pnpm check:type-source-resolution` exit=0, `pnpm check:test-source-alias` exit=0, `pnpm check:driver-memory-census` exit=0, `pnpm check:ratchet-remedy-authority` exit=0 (each runs --self-test then the sweep), `pnpm check:nul-bytes` exit=0 ('scanned 7738 text file(s) ... no raw ASCII control bytes'), `pnpm check:type-check-coverage` exit=0 (the no-margin gate the lane rules flag — I added no `console.`/`process.`). Detector OK line after: '80 scripts swept; 6 mark the expanding remedy ⛔ MAINTAINER-ONLY, 3 turn it down outright, 71 hand out no ratchet-expanding remedy.' Gate families re-derived against my ACTUAL changed paths with `node scripts/pm/dispatch-gates.mjs` — it returned exactly the four gates above and nothing further; no family beyond the prompt's list was implicated. Control-byte self-scan over all four edited files: no hits. Heavy phase serialized under flock /tmp/os-heavy-verify.lock. skip-changeset: labels READ BACK after the write as [\"size/s\",\"skip-changeset\"] — size/s was bot-applied, so the write was the UNION, not the bare set; PR confirmed draft:true, head SHA 30c99ce399273b9a5be59982de5e1d92bad6eec2.",
  "assumption_verdicts": {
    "A_clause_moves_as_is": "CONFIRMED for all three. Each gate had a clause that survived the move without rewriting; check-type-source-resolution.mjs and check-test-source-alias.mjs carry BYTE-IDENTICAL JSDoc wording, so both got the same sentence (consistent, not a second voice), and the census's header clause moved verbatim. Nothing was invented to fill a gap.",
    "B_flip_achievable_and_desirable": "FALSIFIED for one of three, and the finding is about the DETECTOR, not the gate. Achievable and desirable for the two registry gates (both excluded -> refused). For check-driver-memory-census.mjs it is unreachable — and NOT because of the refusal grammar, which is never consulted. It stops earlier at STAGE 1: offerTarget looks only FORWARD from the verb and within OFFER_WINDOW=200 there is no target (measured: the window truncates mid-word at 200, so no appended clause can ever reach it). Independently STAGE 2 would also decline it: GOVERN_TESTIMONY does not recognise this gate's long-standing 'is a maintainer ruling'. Either stop alone suffices. Per the lane rule the correct gate was NOT reworded to satisfy a grammar; recorded in the control's why and filed as #8585.",
    "C_control_corpus_is_the_only_expectation": "CONFIRMED, with one addition. The control corpus was the only EXPECTATION needing change. But the stale PROSE COMMENT above the alias control entry — which explained at length why it was excluded — became wrong in the same stroke and was rewritten; a why and a comment that disagree with the measurement are the same hazard. Nothing else rippled: self-test (16) STRENGTHENS (the two new refused entries enter its filter and are reached), (17) self-classification holds at excluded, and every count in the OK line is computed rather than hardcoded."
  },
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #8585 (unassigned, `finding` + `domain:devx`, NO pm:queue): the #8435 detector cannot reach a correctly-refusing gate whose testimony is governance — two independent stops measured on check-driver-memory-census.mjs (stage 1 offer window looks only FORWARD from the verb, so a registry named before the verb is unreachable; stage 2 GOVERN_TESTIMONY does not recognise 'maintainer ruling'). Searched first: no duplicate. Filed standalone with a Blocked-by: #8576 line rather than as a sub-issue, because it merely depends on this card's state rather than sitting inside its completion scope."
  ]
}

---

Generated by Claude Code