From 025f15210d4517fea27f0f7faa264b9e89904ca0 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sat, 8 Aug 2026 19:30:59 -0300
Subject: [PATCH 01/12] fix(refs): ranking de churn sem contar hash nem linha
 em branco

O pipeline prescrito usava --format=%H --name-only, que joga o hash do
commit e a linha separadora no mesmo fluxo dos nomes de arquivo. O uniq -c
contava os tres como se fossem arquivos: a linha em branco liderava o
ranking e cada SHA empatava em 1 com os arquivos raros.

audit.md pedia os '20 mais modificados' sem dar receita nenhuma, entao
recebeu o mesmo one-liner corrigido em vez do convite a rederivar o
quebrado.

Closes #17
---
 references/audit.md                 | 10 ++++++----
 references/phase-2-consolidation.md |  9 +++++----
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/references/audit.md b/references/audit.md
index 2a2b0c8..5591c2b 100644
--- a/references/audit.md
+++ b/references/audit.md
@@ -17,10 +17,12 @@ paragraph mental model of the architecture as it actually is — you built
 most of it while configuring the phase 1 dead-code tool. If the model
 contradicts the README, the contradiction is itself a finding.
 
-Pull churn data: `git log --stat --since="6 months ago"`. Intersect the 20
-largest files with the 20 most modified — that intersection is where debt
-usually hides, and it is what separates "actually has debt" from "just looks
-messy".
+Pull churn data: `git log --stat --since="6 months ago"`, ranking the most
+modified files with
+`git log --no-merges --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn`.
+Intersect the 20 largest files with the 20 most modified — that intersection
+is where debt usually hides, and it is what separates "actually has debt"
+from "just looks messy".
 
 ## The nine dimensions
 
diff --git a/references/phase-2-consolidation.md b/references/phase-2-consolidation.md
index d9a0630..eac5856 100644
--- a/references/phase-2-consolidation.md
+++ b/references/phase-2-consolidation.md
@@ -48,11 +48,12 @@ Imagine deleting the module.
    set — ask for it explicitly with `npx knip --cycles` (shortcut for
    `--include cycles`), or a plain `npx knip` will report nothing about
    circular dependencies.
-2. **Cross with churn volume (file-level).** `git log --format=%H
-   --name-only | sort | uniq -c | sort -rn` — the intersection between
+2. **Cross with churn volume (file-level).** The intersection between
    "changed a lot" and "heavily coupled" is where consolidation pays the
-   most. This is a different, weaker signal than the pair-level co-change of
-   step 0: it says a file is hot, not that two files move together.
+   most. Rank the files by
+   `git log --no-merges --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn`.
+   This is a different, weaker signal than the pair-level co-change of step
+   0: it says a file is hot, not that two files move together.
 3. **Actually read the candidate clusters.** Do not judge by file name.
 4. **Rank by confidence**, not by size.
 

From a3fa74886d8c16c31a6bbec8b1d02ceff1257ba5 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sat, 8 Aug 2026 19:31:05 -0300
Subject: [PATCH 02/12] fix(fase-1): relatorio do knip nao e mais truncado
 antes de rodar

O redirecionamento direto abria e truncava knip-report.json antes de o
knip comecar, entao qualquer falha (config quebrada, plugin, OOM) apagava
o relatorio anterior e deixava um arquivo vazio, que o passo 1.3 le como
'nada a deletar'. Falha silenciosa em vez de erro visivel.

Passa a escrever em .tmp e mover so em caso de sucesso. --no-exit-code e
o que torna o && utilizavel: knip sai 1 sempre que encontra algo, que e o
caso normal aqui, e 2 so quando de fato falhou. Comando byte a byte igual
nos dois arquivos.

Closes #21
---
 SKILL.md                  | 12 +++++++++++-
 references/knip-config.md |  8 +++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/SKILL.md b/SKILL.md
index df8ce7b..a36d8bf 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -246,9 +246,19 @@ graph (entry, project, paths, plugin), not to silence the output.
 ## 1.2 Run in production mode
 
 ```bash
-npx knip --production --reporter json > knip-report.json
+npx knip --production --no-exit-code --reporter json > knip-report.json.tmp && mv knip-report.json.tmp knip-report.json
 ```
 
+Write to a temp file and move only on success. A plain `> knip-report.json`
+truncates the file before knip even starts, so a crash leaves an empty report
+that 1.3 reads as "nothing to delete" — a silent failure. `--no-exit-code` is
+what makes the `&&` usable: knip exits 1 whenever it finds issues, which is the
+normal case here, and 2 only when it actually failed.
+
+Check the report before 1.3 consumes it: `test -s knip-report.json` and it has
+to parse as JSON. If it does not, knip failed — fix that instead of proceeding
+with an empty list.
+
 Production mode excludes tests and devDependencies automatically. That matters
 because a function imported only by a test is technically alive, but it is dead
 as far as the application is concerned — and that is exactly the code you want
diff --git a/references/knip-config.md b/references/knip-config.md
index 22b9233..b0dc6a2 100644
--- a/references/knip-config.md
+++ b/references/knip-config.md
@@ -24,7 +24,13 @@ names. Adjust the `$schema` version below to the major in use.
 2. Resolve **every** configuration hint
 3. Only then write/adjust `knip.json`
 4. Repeat 2–3 until the hints reach zero
-5. `npx knip --production --reporter json > knip-report.json`
+5. `npx knip --production --no-exit-code --reporter json > knip-report.json.tmp && mv knip-report.json.tmp knip-report.json`
+6. Check the result before using it: non-empty file that parses as JSON
+
+The temp file plus `&&` is what keeps a crashed run from wiping the previous
+report — a plain `>` truncates it before knip starts. `--no-exit-code` is
+required there because knip exits 1 on every run that finds issues; only exit
+2 means it failed.
 
 The right mindset: when knip reports something unexpected, it is telling the
 truth about the module graph — it could not reach that code from an entry. A

From 08d02b8dc97e6a411cc1a935b630588d52f84840 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sat, 8 Aug 2026 19:38:39 -0300
Subject: [PATCH 03/12] fix(fase-1): knip re-rodado entre categorias e install
 depois de podar deps

As tres categorias liam um knip-report congelado. Elas se alimentam: apagar
arquivo orfao mata export que o relatorio ainda via vivo e libera dep que
via usada, e export listado como morto pode estar em arquivo ja removido
pela categoria anterior. O ciclo passa a regenerar o relatorio depois do
commit de cada categoria, e a contagem final vira estado medido.

Tirar a entrada do package.json nao tira o pacote do node_modules e o gate
nunca instala, entao typecheck e teste passavam com a dep removida por
engano e a quebra so aparecia na CI. O protocolo passa a rodar o install
simples do package manager antes do gate, com o lockfile entrando no commit
da categoria. Forma congelada fica de fora: --frozen-lockfile e --immutable
recusam manifesto podado, e npm ci deixa o lockfile obsoleto (medido em npm
11 e 12: sai 0, mas nao reescreve o lock). gate.sh nao muda.

Inclui o mkdir -p no exemplo de git mv da fase 3 (parte de #18), para casar
com references/phase-3-structure.md.

Closes #19, closes #20
---
 SKILL.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 49 insertions(+), 2 deletions(-)

diff --git a/SKILL.md b/SKILL.md
index a36d8bf..e4387bc 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -269,7 +269,8 @@ Never exclude tests with `ignore` to get the same effect.
 ## 1.3 Delete in atomic commits, one per category
 
 Run all three without asking (GREEN level) or the first two (YELLOW). Each one
-is: delete → `git add -A` → gate → commit. For the gate, use `scripts/gate.sh`
+is: delete → `git add -A` → gate → commit → regenerate the report. For the
+gate, use `scripts/gate.sh`
 (it detects the stack and the package manager and runs typecheck + tests in the
 right order); if it exits with code 3, run the stack's equivalent commands by
 hand.
@@ -288,12 +289,51 @@ of the user's.
 Kept separate because if something breaks in production two weeks from now, the
 user needs to revert *one* commit — not a 400-file cleanup.
 
+**Unused deps: install after pruning the manifest.** Removing an entry from
+`package.json` does not remove the package from `node_modules`, and the gate
+never installs — the resolver still finds the package on disk, typecheck and
+tests pass, and the break only surfaces on CI or on the next machine that
+installs from the pruned manifest. So, after editing the manifest and before
+`git add -A`, run the package manager's plain install:
+
+```bash
+npm install                          # npm
+pnpm install --no-frozen-lockfile    # pnpm
+yarn install --no-immutable          # yarn berry (yarn 1: yarn install)
+bun install                          # bun
+```
+
+Plain, never the frozen form. `--frozen-lockfile`, `--immutable` and the CI
+defaults that turn them on refuse a lockfile that no longer matches the
+manifest — which is exactly the state a correct prune produces, so a good
+deletion would come back as a red gate for the wrong reason. `npm ci` accepts
+the removal but never writes the lockfile, leaving a stale one in the commit.
+The updated lockfile goes in this category's commit: it is what carries the
+prune to every other machine.
+
+**Regenerate the report between categories.** After each category's commit, run
+the 1.2 command again — same hardened form, same file — and read the next
+category from the fresh report. The three feed each other: deleting orphan
+files kills exports the old report still saw as alive and frees deps it saw as
+used, while some exports it lists as dead live in files the previous category
+already removed. On a frozen report those second-order items survive the
+cleanup and a category tries to edit paths that no longer exist. The cost is
+two extra knip runs per cleanup.
+
+A category that is skipped (YELLOW does not run exports) or that fails its gate
+leaves no commit and nothing changed on disk, so there is nothing to regenerate
+from — keep the current report and go to the next category. The regeneration
+after the last category that did commit is the one the final report counts
+against.
+
 **If the gate fails:** `git restore --staged --worktree .`, record the category
 as failed in `CLEANUP_PROGRESS.md` along with the error, and **move on to the
 next category**.
 Do not stop the entire pipeline and do not try to fix it — if typecheck broke,
 knip was wrong about that category, and the useful information is which
-category, not a patch.
+category, not a patch. On the deps category, that restore brings back
+`package.json` and the lockfile but not `node_modules`: run the install again
+before starting orphan files.
 
 Do not run `knip --fix` until the config has settled for two or three rounds
 with no surprises.
@@ -420,6 +460,7 @@ structure with a rationale. Only then execute.
 GREEN level runs the whole plan without asking. One folder per commit:
 
 ```bash
+mkdir -p src/features/billing
 git mv src/utils/format.ts src/features/billing/format.ts   # always git mv
 ```
 
@@ -489,5 +530,11 @@ Branch: `cleanup/YYYYMMDD` · Level: GREEN · N commits
 - (nothing)
 ```
 
+The phase 1 line counts what each category actually removed, tallied per commit
+from the report that category ran on — not the numbers of the first report,
+which stopped describing the repo the moment the first commit landed. The last
+regeneration settles the rest: whatever it still lists is what survived, and it
+belongs under "Failed / not done", along with any category that was skipped.
+
 If the level was RED, the report is diagnosis only: list what you would do and
 what needs to exist (tests, typecheck) to make it possible.

From e3e1dd8bd5ee53e4fb1c18c6328f016980158db1 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sat, 8 Aug 2026 19:38:54 -0300
Subject: [PATCH 04/12] fix(fase-3): git mv precedido de mkdir -p, com
 invariante

O exemplo canonico de movimentacao nao criava o diretorio de destino, e a
fase 3 existe justamente para aplicar uma estrutura que ainda nao existe:
git mv para diretorio inexistente morre com exit 128, e o agente rodando
sem supervisao le isso como passo que falhou, ou parte para mv + git rm,
que a propria doc proibe por atrapalhar a deteccao de rename.

Secao 6 do coherence_test amarra as duas coisas: todo arquivo de protocolo
com linha de comando git mv precisa do mkdir -p na linha imediatamente
acima. Mencao em prosa nao conta (ancora em ^git mv). Piso derivado no
mesmo estilo da secao 4.

O item nao entrou na lista 'Do not forget': aquela lista e sobre o que
aponta para caminho antigo e quebra em silencio; diretorio faltando aborta
alto, antes de mover, e e lido depois do fato. Ficou junto do comando.

Closes #18
---
 references/phase-3-structure.md |  8 ++++++++
 scripts/coherence_test.sh       | 34 +++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/references/phase-3-structure.md b/references/phase-3-structure.md
index aa0f75a..b1e1586 100644
--- a/references/phase-3-structure.md
+++ b/references/phase-3-structure.md
@@ -56,9 +56,17 @@ return: anyone new understands it without explanation.
 One folder per commit. Always:
 
 ```bash
+mkdir -p src/features/billing
 git mv src/utils/format.ts src/features/billing/format.ts
 ```
 
+The `mkdir -p` is not decoration: phase 3 applies a structure that does not
+exist yet, and moving into a directory nobody created fails with `fatal:
+renaming ... failed: No such file or directory` and exit 128. That is a
+missing precondition, not a failed step — create the directory and repeat the
+move. Do not fall back to `mv` plus `git rm`/`git add`: that is `rm` +
+`create` under another name.
+
 `git mv` preserves history. `rm` + `create` destroys that file's `git blame` —
 exactly the information someone will want six months from now when asking "why
 is this like this".
diff --git a/scripts/coherence_test.sh b/scripts/coherence_test.sh
index 7c31951..3142b4c 100755
--- a/scripts/coherence_test.sh
+++ b/scripts/coherence_test.sh
@@ -283,6 +283,40 @@ for readme in README.md README.en.md; do
   done
 done
 
+# 6. Whoever shows a `git mv` also shows the mkdir -p it needs. ---------------
+# Phase 3 applies a structure that does not exist yet, so the destination
+# directory has to be created before the move: `git mv` into a missing
+# directory dies with exit 128, and an agent running unsupervised reads that
+# as a failed step. Only command lines count — a line that *starts* with
+# `git mv` — so the prose mentions in the READMEs and in the explanatory
+# paragraphs, where the phrase is named and not run, stay out of it.
+gitmv_files() {
+  grep -l -E '^git mv ' SKILL.md references/*.md 2>/dev/null | sort
+}
+
+moves=$(gitmv_files)
+
+# Floor, same reason as in section 4: a derivation that comes back without the
+# two files that carry the move today is broken, and the loop below would
+# assert over an empty list and pass.
+for f in SKILL.md references/phase-3-structure.md; do
+  if printf '%s\n' "$moves" | grep -qx -F -- "$f"; then
+    pass "$f is derived as a file that runs git mv"
+  else
+    fail "$f is derived as a file that runs git mv" \
+         "no git mv command line — derived list: $(printf '%s' "$moves" | tr '\n' ' ')"
+  fi
+done
+
+# The mkdir has to be on the line right above, not merely somewhere in the
+# file: what is being read is a snippet, not a page.
+for f in $moves; do
+  orphan=$(awk '/^git mv / && prev !~ /^mkdir -p / { print FILENAME ":" FNR ": " $0 }
+                { prev = $0 }' "$f")
+  check "git mv preceded by mkdir -p in $f" \
+        "$([[ -z $orphan ]] && echo 0 || echo 1)" "$orphan"
+done
+
 echo "----"
 echo "$((total-failures))/$total invariants held"
 [[ $failures -eq 0 ]]

From 5f35d1457dfc362c485f7cbcae69e7da96f62ec1 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sat, 8 Aug 2026 19:38:54 -0300
Subject: [PATCH 05/12] feat(gate): aceitar apelidos de script no stack JS/TS

O gate so reconhecia scripts com nome exato typecheck e test, entao
projeto com type-check ou test:unit caia em exit 3 e exigia gate manual
mesmo tendo rede de seguranca completa. Falhava fechado, nunca dava verde
falso, mas custava a autonomia que a skill promete.

Passa a aceitar typecheck/type-check/tsc/check-types e test/test:unit, com
o primeiro nome definido pelo projeto vencendo e os demais ignorados. O que
chega em run() e o KIND, nunca o apelido: run() classifica por kind, e
nome cru ali faria o check rodar, passar e nao contar, caindo em exit 3 do
mesmo jeito. checks= mantem o vocabulario canonico; o apelido aparece so na
linha humana. bash 3.2, sem arrays.

6 casos novos no gate_test (57 -> 63), incluindo o ramo yarn com lockfile,
que ate agora nao tinha teste nenhum.

Closes #23
---
 scripts/gate.sh      | 25 ++++++++++++++++-----
 scripts/gate_test.sh | 53 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+), 5 deletions(-)

diff --git a/scripts/gate.sh b/scripts/gate.sh
index b0c2bec..6f50bd9 100755
--- a/scripts/gate.sh
+++ b/scripts/gate.sh
@@ -242,11 +242,26 @@ if [[ -f package.json ]]; then
     echo "[gate] package.json unparseable — JS/TS checks skipped" >&2
     incomplete=1
   else
-    for script in typecheck test; do
-      if node -e "const s=require('./package.json').scripts||{};process.exit(s['$script']?0:1)" 2>/dev/null; then
-        if [[ $PM == yarn ]]; then run "$script" yarn "$script"
-        else run "$script" "$PM" run "$script"; fi
-      fi
+    # Each entry is "<kind>:<script names in precedence order>". Projects name
+    # these scripts freely ('type-check', 'test:unit'), and refusing anything
+    # but the canonical spelling made a fully covered repo look uncheckable.
+    # Two rules hold the semantics together: exactly one script runs per kind —
+    # the first name the project defines wins, the rest are ignored, so nothing
+    # runs or counts twice — and what reaches run() is the *kind*, never the
+    # alias, because run() classifies by kind and an unknown word there would
+    # run the check and count nothing. The alias stays visible in the human
+    # '[gate] <cmd>' line; checks= keeps its canonical vocabulary.
+    for js_spec in "typecheck:typecheck type-check tsc check-types" \
+                   "test:test test:unit"; do
+      js_kind=${js_spec%%:*}
+      # shellcheck disable=SC2086  # the name list is split on purpose (bash 3.2, no arrays)
+      for script in ${js_spec#*:}; do
+        if node -e "const s=require('./package.json').scripts||{};process.exit(s['$script']?0:1)" 2>/dev/null; then
+          if [[ $PM == yarn ]]; then run "$js_kind" yarn "$script"
+          else run "$js_kind" "$PM" run "$script"; fi
+          break
+        fi
+      done
     done
   fi
 fi
diff --git a/scripts/gate_test.sh b/scripts/gate_test.sh
index d0b3fb0..82ad217 100755
--- a/scripts/gate_test.sh
+++ b/scripts/gate_test.sh
@@ -186,6 +186,44 @@ EOF
 mkdir -p "$TMP/js-bad-json"
 printf '{"name":"f",\n' > "$TMP/js-bad-json/package.json"
 
+# Alias fixtures: a project that names its scripts 'type-check'/'test:unit' has
+# the same safety net as one that spells them canonically, and must reach the
+# same verdict — with checks= still using the canonical words.
+mkdir -p "$TMP/js-alias"
+cat > "$TMP/js-alias/package.json" <<'EOF'
+{"name":"f","scripts":{"type-check":"node -e 0","test:unit":"node -e 0"}}
+EOF
+
+mkdir -p "$TMP/js-alias-test-only"
+cat > "$TMP/js-alias-test-only/package.json" <<'EOF'
+{"name":"f","scripts":{"test:unit":"node -e 0"}}
+EOF
+
+mkdir -p "$TMP/js-alias-tsc"
+cat > "$TMP/js-alias-tsc/package.json" <<'EOF'
+{"name":"f","scripts":{"tsc":"node -e 0"}}
+EOF
+
+# Canonical and alias side by side: precedence says 'typecheck' wins and
+# 'type-check' never runs. The alias prints a marker so its silence is provable.
+mkdir -p "$TMP/js-alias-both"
+cat > "$TMP/js-alias-both/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","type-check":"node -e \"console.log('ALIAS_TYPECHECK_RAN')\"","test":"node -e 0"}}
+EOF
+
+mkdir -p "$TMP/js-alias-red"
+cat > "$TMP/js-alias-red/package.json" <<'EOF'
+{"name":"f","scripts":{"type-check":"node -e 0","test:unit":"node -e 'process.exit(1)'"}}
+EOF
+
+# yarn.lock picks the 'yarn <script>' invocation instead of '<pm> run <script>';
+# no fixture exercised that branch before, alias or not.
+mkdir -p "$TMP/js-yarn-alias"
+cat > "$TMP/js-yarn-alias/package.json" <<'EOF'
+{"name":"f","scripts":{"type-check":"node -e 0","test:unit":"node -e 0"}}
+EOF
+touch "$TMP/js-yarn-alias/yarn.lock"
+
 mkdir -p "$TMP/polyglot/tests"
 touch "$TMP/polyglot/pyproject.toml" "$TMP/polyglot/tests/test_x.py"
 printf 'module f\n\ngo 1.21\n' > "$TMP/polyglot/go.mod"
@@ -297,6 +335,12 @@ stub "$FAIL" dotnet 1
 stub_body "$HANG" go 'sleep 30'
 stub "$UV" uv 0
 GO="$TMP/stubs-go"; stub "$GO" go 0
+# yarn is not on every machine, and the branch under test is only *how* the
+# gate invokes it: a stub that always succeeds is enough, since the invocation
+# itself is echoed by run(). node stays real — the gate parses package.json with it.
+YARN="$TMP/stubs-yarn"
+link_bin "$YARN" bash sh env node perl ps find grep sleep true
+stub "$YARN" yarn 0
 CARGO="$TMP/stubs-cargo"; stub "$CARGO" cargo 0
 # pytest's "no tests collected" code, with a passing mypy next to it.
 PY5="$TMP/stubs-py5"; stub "$PY5" pytest 5; stub "$PY5" mypy 0
@@ -373,6 +417,15 @@ case_run js-test-only     0 "$TMP/js-test-only" -             "checks=test" "YEL
 case_run js-red           1 "$TMP/js-red"       -             "RED"
 case_run js-no-node       3 "$TMP/js-green"     "$NOTOOL"     "toolchain 'node' missing"
 case_run js-bad-json      3 "$TMP/js-bad-json"  -             "unparseable"
+case_run js-alias         0 "$TMP/js-alias"     -             "run type-check" "run test:unit" \
+         "checks=typecheck,test" "GREEN"
+case_run js-alias-test-only 0 "$TMP/js-alias-test-only" -     "run test:unit" "checks=test" "YELLOW"
+case_run js-alias-tsc     0 "$TMP/js-alias-tsc" -             "run tsc" "checks=typecheck" "YELLOW"
+case_run js-alias-both    0 "$TMP/js-alias-both" -            "run typecheck$" \
+         "checks=typecheck,test" "GREEN" '!run type-check' '!ALIAS_TYPECHECK_RAN'
+case_run js-alias-red     1 "$TMP/js-alias-red" -             "RED at 'npm run test:unit'"
+case_run js-yarn-alias    0 "$TMP/js-yarn-alias" "$YARN"      "yarn type-check" "yarn test:unit" \
+         "checks=typecheck,test" "GREEN" '!yarn run'
 case_run polyglot-partial 3 "$TMP/polyglot"     "$OK:$NOTOOL" "checks=test" "some detected stack"
 case_run partial-none-ran 3 "$TMP/go-only"      "$NOTOOL"     "nothing ran"
 case_run dotnet-green     0 "$TMP/dotnet-root"  "$OK:$BASE"   "checks=typecheck,test" "GREEN"

From 52a99b170bc011f029e152b802df2cf8d3f3e043 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sat, 8 Aug 2026 19:46:50 -0300
Subject: [PATCH 06/12] fix(niveis): YELLOW deixa de prometer commit que o gate
 nunca deixa acontecer

A tabela admitia 'tests exist but fail' em YELLOW e prometia rodar a fase 1
em deps e orfaos. Mas o gate sai 1 em qualquer check vermelho e o passo 1.3
exige gate verde antes de cada commit: com suite vermelha preexistente todo
gate falha, o protocolo manda reverter e seguir, e nenhuma categoria
commita. A skill anunciava YELLOW, gastava rodadas de knip e delecoes, e
entregava zero commits com tudo marcado como falha.

YELLOW passa a ser rede parcial, igual ao que os READMEs ja diziam, e
baseline vermelho vira RED com diagnostico: sem verde inicial nao da para
separar o que a faxina quebrou do que ja estava quebrado. Os READMEs
tambem paravam de mencionar que a fase 2 trava no checkpoint no nivel
GREEN - corrigido nos dois.

Secao 7 do coherence_test amarra as tres tabelas: mesma sequencia de niveis
nos tres arquivos e condicao canonica de YELLOW na linha da tabela, com o
PT casando a versao em portugues. O grep orfao do Step 0 e a redacao antiga
de YELLOW entraram na lista de strings mortas da secao 3.

Tambem remove o grep de package.json do Step 0 (resto de #23): nenhum dos
tres paragrafos seguintes o consumia, o papel passou para o gate.sh, e ele
casaria o nome de uma dependencia chamada 'test'.

Closes #22
---
 README.en.md              |  9 ++++--
 README.md                 |  9 ++++--
 SKILL.md                  | 24 +++++++++-------
 scripts/coherence_test.sh | 58 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 86 insertions(+), 14 deletions(-)

diff --git a/README.en.md b/README.en.md
index 99094ae..c5d6aca 100644
--- a/README.en.md
+++ b/README.en.md
@@ -155,9 +155,14 @@ into one of three levels:
 
 | Level | Condition | What it does |
 |---|---|---|
-| GREEN | typecheck and tests pass | runs the full phases without asking |
+| GREEN | typecheck and tests pass | runs the phases without asking; phase 2 stops at the checkpoint |
 | YELLOW | partial net, or no test file in the stack | only deps and orphan files, no touching exports |
-| RED | no tests and no typecheck | diagnoses only; nothing is deleted |
+| RED | no tests and no typecheck, or a baseline already failing | diagnoses only; nothing is deleted |
+
+A project that arrives with a red suite falls into RED, not YELLOW: with a
+broken baseline there is no telling what the cleanup broke from what was
+already broken, and since every commit demands a green gate, none of them would
+happen. The skill names the failing check and stops there.
 
 A stack with no test file at all does not count as tested: the gate does not
 run the empty suite and the level stays at YELLOW. That covers Go and .NET
diff --git a/README.md b/README.md
index 51932f4..2aac658 100644
--- a/README.md
+++ b/README.md
@@ -152,9 +152,14 @@ e se classifica em um de três níveis:
 
 | Nível | Condição | O que ela faz |
 |---|---|---|
-| GREEN | typecheck e testes passam | executa as fases inteiras sem perguntar |
+| GREEN | typecheck e testes passam | executa as fases sem perguntar; a fase 2 para no checkpoint |
 | YELLOW | rede parcial, ou nenhum arquivo de teste no stack | só deps e arquivos órfãos, sem mexer em exports |
-| RED | sem testes e sem typecheck | só diagnostica; nada é deletado |
+| RED | sem testes e sem typecheck, ou baseline já vermelho | só diagnostica; nada é deletado |
+
+Projeto que já chega com a suíte vermelha cai em RED, não em YELLOW: com o
+baseline quebrado não dá para separar o que a limpeza quebrou do que já estava
+quebrado, e como todo commit exige gate verde, nenhum deles aconteceria. A
+skill diz qual check falhou e para por aí.
 
 Stack sem nenhum arquivo de teste não conta como testado: o gate não roda a
 suíte vazia e o nível fica em YELLOW. Vale para Go e .NET sem arquivo de
diff --git a/SKILL.md b/SKILL.md
index e4387bc..91a19ac 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -60,7 +60,6 @@ of it, not a preference.
 git rev-parse --is-inside-work-tree       # is there a repo at all?
 git status --porcelain                    # anything uncommitted?
 git rev-parse --abbrev-ref HEAD           # current branch (HEAD = detached)
-[ -f package.json ] && grep -E '"(test|typecheck|lint|build)"' package.json
 ```
 
 Read those three answers before running anything else:
@@ -102,9 +101,10 @@ it finds (compiling counts as typecheck).
 Classify by the `[gate] checks=...` line, which lists what actually ran, and
 not by the exit code alone: GREEN requires `typecheck` and `test` in the list;
 a partial list caps at YELLOW, and the script itself says so. Exit 0 =
-everything that ran passed; 1 = something failed; 2 = bad path (the argument is
-not a directory the script can enter, so nothing was checked — fix the path and
-rerun); 3 = no runnable check **or** some detected stack had no toolchain
+everything that ran passed; 1 = something failed, which is RED whatever the
+list says; 2 = bad path (the argument is not a directory the script can enter,
+so nothing was checked — fix the path and rerun); 3 = no runnable check
+**or** some detected stack had no toolchain
 (`PARTIAL` — including in a polyglot repo where another stack passed); 4 = a
 check hit the watchdog (`GATE_TIMEOUT`, 900s per check by default, `0`
 disables). In the exit-3 cases, finish the gate by hand before classifying.
@@ -119,8 +119,8 @@ timeout: a check that legitimately exits 124 is read as a timeout.
 | Signal | Level | Behavior |
 |---|---|---|
 | Typecheck **and** tests pass | **GREEN** | Runs phases 1 and 3 in full without asking. Phase 2 stops at the checkpoint. |
-| Tests exist but fail, or typecheck only | **YELLOW** | Runs phase 1 (deps and orphan files only, **not** exports). Stops before phase 2 and reports. |
-| No tests and no typecheck | **RED** | Diagnoses only. Does not delete, does not move, does not commit. Delivers a report. |
+| A partial net, or no test file in the stack | **YELLOW** | Runs phase 1 (deps and orphan files only, **not** exports). Stops before phase 2 and reports. |
+| A check fails, or no tests and no typecheck | **RED** | Diagnoses only. Does not delete, does not move, does not commit. Delivers a report. |
 | No git repository | **RED** | Diagnoses only, regardless of the gate result — there is no HEAD to roll back to. |
 
 `checks=typecheck` because the stack has **no test file** is YELLOW, not GREEN,
@@ -129,9 +129,12 @@ script names the stack in the `'test' not counted` line. Only the user promotes
 it, by pointing at the suite that lives somewhere the gate does not look; the
 skill never promotes itself.
 
-If the baseline is already broken, **fix it or warn before touching
-anything**. You need an initial green to distinguish what you broke from what
-was already broken.
+**A baseline that already fails is RED, not YELLOW.** Exit 1 says a check
+broke, and a broken baseline leaves no way to tell what the cleanup broke from
+what was already broken. It also has nowhere to go: every commit here needs a
+green gate, so a run that starts red deletes, rolls back and commits nothing,
+category after category. **Fix it or warn before touching anything** — until
+then the deliverable is the diagnosis, naming the check that failed.
 
 Announce the detected level in one line and move on. Do not ask permission for
 the level.
@@ -537,4 +540,5 @@ regeneration settles the rest: whatever it still lists is what survived, and it
 belongs under "Failed / not done", along with any category that was skipped.
 
 If the level was RED, the report is diagnosis only: list what you would do and
-what needs to exist (tests, typecheck) to make it possible.
+what needs to exist or be fixed (tests, typecheck, a baseline that passes) to
+make it possible.
diff --git a/scripts/coherence_test.sh b/scripts/coherence_test.sh
index 3142b4c..ac5c444 100755
--- a/scripts/coherence_test.sh
+++ b/scripts/coherence_test.sh
@@ -222,6 +222,8 @@ Typecheck at the end of each folder
 one mandatory checkpoint
 typecheck and tests between each step
 only what has not been committed
+"(test|typecheck|lint|build)"
+Tests exist but fail
 DEAD
 
 # The exception: phase-3-structure.md explains why a "pure git mv" commit is
@@ -317,6 +319,62 @@ for f in $moves; do
         "$([[ -z $orphan ]] && echo 0 || echo 1)" "$orphan"
 done
 
+# 7. The level table says the same thing in the three files. -----------------
+# The level is the whole dispatch of the skill: SKILL.md's table decides what
+# runs, and both READMEs promise the user that same behavior. They drifted once
+# — SKILL.md called a failing suite YELLOW and sent it into phase 1, while the
+# protocol a few lines below refuses to commit without a green gate, so the
+# announced level was one no run could ever honor. README.md is in Portuguese,
+# so byte equality across the three is out; what is asserted instead is the part
+# that has to hold in any language.
+LEVEL_FILES="SKILL.md README.md README.en.md"
+
+# level_names <file> — the level of each row of the file's level table, in
+# order. Table rows are the only lines that start with `|`, and the first level
+# word on a row is that row's level, whichever column the file puts it in.
+level_names() {
+  awk '/^\|/ && match($0, /GREEN|YELLOW|RED/) { print substr($0, RSTART, RLENGTH) }' "$1"
+}
+
+# Consecutive repeats collapse on purpose: SKILL.md carries a fourth row (no git
+# repository, which is RED before the gate even runs) that the READMEs keep as a
+# bullet under known limits. That asymmetry is deliberate — the table is what an
+# agent dispatches on, the READMEs are prose for a human who already read the
+# requirement. What may not differ is which levels exist and how they escalate.
+level_shape() {
+  level_names "$1" |
+  awk 'NR == 1 || $0 != prev { print } { prev = $0 }' |
+  tr '\n' ' ' | sed 's/[[:space:]]*$//'
+}
+
+for f in $LEVEL_FILES; do
+  shape=$(level_shape "$f")
+  check "level table of $f reads GREEN YELLOW RED" \
+        "$([[ $shape == 'GREEN YELLOW RED' ]] && echo 0 || echo 1)" \
+        "levels in order: [$shape]"
+done
+
+# The condition that puts a run at YELLOW, in each file's own language, checked
+# against the YELLOW row itself and not merely somewhere in the file — the row
+# is what gets read at classification time.
+yellow_row() { grep -E '^\|' "$1" | grep -F -m1 -- 'YELLOW'; }
+
+for pair in \
+  'SKILL.md|partial net, or no test file in the stack' \
+  'README.en.md|partial net, or no test file in the stack' \
+  'README.md|rede parcial, ou nenhum arquivo de teste no stack'
+do
+  f=${pair%%|*}
+  cond=${pair#*|}
+  row=$(yellow_row "$f")
+  if printf '%s' "$row" | grep -q -F -- "$cond"; then
+    pass "YELLOW row of $f states the canonical condition"
+  else
+    fail "YELLOW row of $f states the canonical condition" \
+         "expected [$cond] — row reads: ${row:-<no YELLOW row>}"
+  fi
+done
+
 echo "----"
 echo "$((total-failures))/$total invariants held"
 [[ $failures -eq 0 ]]

From 84034892ff8e44ac6b972753736b819e992897a3 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sat, 8 Aug 2026 19:47:29 -0300
Subject: [PATCH 07/12] docs: atualiza a contagem da suite nos READMEs

Os numeros gravados (57/57, 5/5, 49/49) estavam corretos na base desta
branch e foram invalidados por ela: os casos do gate foram a 63 com os
apelidos de script, e os invariantes a 61 com as secoes 6 e 7.
---
 README.en.md | 2 +-
 README.md    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.en.md b/README.en.md
index c5d6aca..496338b 100644
--- a/README.en.md
+++ b/README.en.md
@@ -111,7 +111,7 @@ exercises the real GNU `timeout` instead of the perl backend:
 ```bash
 docker run --rm -v "$PWD":/repo:ro node:22-bookworm bash -c \
   'apt-get update -qq && apt-get install -y -qq procps && cd /repo && bash scripts/test.sh'
-# validated 2026-08: 57/57 cases, 5/5 properties, 49/49 invariants
+# validated 2026-08: 63/63 cases, 5/5 properties, 61/61 invariants
 ```
 
 The .NET heuristic was validated against the real SDK
diff --git a/README.md b/README.md
index 2aac658..0e83d5f 100644
--- a/README.md
+++ b/README.md
@@ -108,7 +108,7 @@ exercita o GNU `timeout` real em vez do backend perl:
 ```bash
 docker run --rm -v "$PWD":/repo:ro node:22-bookworm bash -c \
   'apt-get update -qq && apt-get install -y -qq procps && cd /repo && bash scripts/test.sh'
-# validado em 08/2026: 57/57 casos, 5/5 propriedades, 49/49 invariantes
+# validado em 08/2026: 63/63 casos, 5/5 propriedades, 61/61 invariantes
 ```
 
 A heurística .NET foi validada contra o SDK real (`mcr.microsoft.com/dotnet/sdk:8.0`

From 2f47f0dcb35d960b0b7241cdddc9a1ae937a470b Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sat, 8 Aug 2026 23:29:18 -0300
Subject: [PATCH 08/12] fix(revisao): fecha 13 achados da revisao do lote 3

O mais grave: a secao 7 do coherence_test era vazia para a propria
regressao que motivou a #22. O colapso de repeticoes consecutivas fazia
GREEN,YELLOW,YELLOW,RED ler como 'GREEN YELLOW RED', entao trocar a linha
RED por YELLOW passava 61/61 verde. Agora ancora na tabela de niveis e
checa a condicao canonica de YELLOW e de RED.

Secao 6 estava rigida e frouxa ao mesmo tempo: exigia mkdir -p na linha
imediatamente acima (reprovava um mkdir servindo dois moves, que e a forma
natural) e ancorava em coluna 0 (comando indentado dentro de lista passava
invisivel). Vira cobertura por bloco, sem ancora de coluna, com IFS preso
em newline para nao quebrar em caminho com espaco.

gate.sh: a string com dois-pontos vira run_first <kind> <nomes>, sem split
sem aspas e sem o comentario que dizia 'sem arrays' num arquivo que ja usa
array indexado. Comportamento identico.

SKILL.md: exit 1 nao emite linha checks=, entao classificar por ela nao
funcionava no vermelho; a validacao do relatorio passa a checar a ausencia
do .tmp, que e o unico sinal que distingue relatorio fresco de relatorio
velho; knip-report entra no .git/info/exclude para o git add -A nao
commitar artefato da ferramenta no repo do usuario; o install entra na
linha da sequencia de 1.3, nao so no paragrafo 20 linhas abaixo.

audit.md e phase-2-consolidation.md: --since restaurado no ranking de
churn, que tinha perdido a janela de 6 meses da propria frase.

Suite 61 -> 66 invariantes, com os dois extratores novos ganhando
autoteste na secao 0.
---
 README.en.md                        |   2 +-
 README.md                           |   2 +-
 SKILL.md                            |  37 +++++---
 references/audit.md                 |   5 +-
 references/phase-2-consolidation.md |   4 +-
 scripts/coherence_test.sh           | 126 ++++++++++++++++++++--------
 scripts/gate.sh                     |  39 +++++----
 scripts/gate_test.sh                |  16 ++--
 8 files changed, 157 insertions(+), 74 deletions(-)

diff --git a/README.en.md b/README.en.md
index 496338b..30e893e 100644
--- a/README.en.md
+++ b/README.en.md
@@ -111,7 +111,7 @@ exercises the real GNU `timeout` instead of the perl backend:
 ```bash
 docker run --rm -v "$PWD":/repo:ro node:22-bookworm bash -c \
   'apt-get update -qq && apt-get install -y -qq procps && cd /repo && bash scripts/test.sh'
-# validated 2026-08: 63/63 cases, 5/5 properties, 61/61 invariants
+# validated 2026-08: 63/63 cases, 5/5 properties, 66/66 invariants
 ```
 
 The .NET heuristic was validated against the real SDK
diff --git a/README.md b/README.md
index 0e83d5f..eb63a43 100644
--- a/README.md
+++ b/README.md
@@ -108,7 +108,7 @@ exercita o GNU `timeout` real em vez do backend perl:
 ```bash
 docker run --rm -v "$PWD":/repo:ro node:22-bookworm bash -c \
   'apt-get update -qq && apt-get install -y -qq procps && cd /repo && bash scripts/test.sh'
-# validado em 08/2026: 63/63 casos, 5/5 propriedades, 61/61 invariantes
+# validado em 08/2026: 63/63 casos, 5/5 propriedades, 66/66 invariantes
 ```
 
 A heurística .NET foi validada contra o SDK real (`mcr.microsoft.com/dotnet/sdk:8.0`
diff --git a/SKILL.md b/SKILL.md
index 91a19ac..bd599da 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -101,10 +101,11 @@ it finds (compiling counts as typecheck).
 Classify by the `[gate] checks=...` line, which lists what actually ran, and
 not by the exit code alone: GREEN requires `typecheck` and `test` in the list;
 a partial list caps at YELLOW, and the script itself says so. Exit 0 =
-everything that ran passed; 1 = something failed, which is RED whatever the
-list says; 2 = bad path (the argument is not a directory the script can enter,
-so nothing was checked — fix the path and rerun); 3 = no runnable check
-**or** some detected stack had no toolchain
+everything that ran passed; 1 = a check failed, which is RED — and the script
+stops at the first red, so there is no `checks=` line to classify by, only the
+`RED at '<cmd>'` line naming what broke; 2 = bad path (the argument is not a
+directory the script can enter, so nothing was checked — fix the path and
+rerun); 3 = no runnable check **or** some detected stack had no toolchain
 (`PARTIAL` — including in a polyglot repo where another stack passed); 4 = a
 check hit the watchdog (`GATE_TIMEOUT`, 900s per check by default, `0`
 disables). In the exit-3 cases, finish the gate by hand before classifying.
@@ -258,9 +259,12 @@ that 1.3 reads as "nothing to delete" — a silent failure. `--no-exit-code` is
 what makes the `&&` usable: knip exits 1 whenever it finds issues, which is the
 normal case here, and 2 only when it actually failed.
 
-Check the report before 1.3 consumes it: `test -s knip-report.json` and it has
-to parse as JSON. If it does not, knip failed — fix that instead of proceeding
-with an empty list.
+Check the report before 1.3 consumes it: `knip-report.json.tmp` has to be gone,
+and `knip-report.json` has to be non-empty and parse as JSON. The temp file is
+the check that catches a failed run — when knip breaks, the `&&` skips the `mv`
+and the *previous* report stays on disk, non-empty and perfectly parseable, so
+the content checks alone would wave a stale list through. A `.tmp` left behind
+means the run did not finish: delete it and fix knip instead of proceeding.
 
 Production mode excludes tests and devDependencies automatically. That matters
 because a function imported only by a test is technically alive, but it is dead
@@ -272,8 +276,8 @@ Never exclude tests with `ignore` to get the same effect.
 ## 1.3 Delete in atomic commits, one per category
 
 Run all three without asking (GREEN level) or the first two (YELLOW). Each one
-is: delete → `git add -A` → gate → commit → regenerate the report. For the
-gate, use `scripts/gate.sh`
+is: delete → (deps only: install) → `git add -A` → gate → commit → regenerate
+the report. For the gate, use `scripts/gate.sh`
 (it detects the stack and the package manager and runs typecheck + tests in the
 right order); if it exits with code 3, run the stack's equivalent commands by
 hand.
@@ -283,6 +287,13 @@ here precisely because Step 0 refused to start on a dirty tree: everything
 `git add -A` picks up was produced by this step, so the `-A` cannot swallow work
 of the user's.
 
+The one thing `-A` picks up that this step did not produce is knip's own
+output. Before the first category, put `knip-report.json` and
+`knip-report.json.tmp` in `.git/info/exclude` — repo-local, so the user's
+`.gitignore` stays untouched. Otherwise every category commits the report the
+previous one was read from, and the user reverting `chore: remove unused deps`
+gets a tool artifact back along with the dependencies.
+
 ```
 1. unused deps        → "chore: remove unused deps"
 2. orphan files       → "chore: remove orphan files"
@@ -321,11 +332,13 @@ files kills exports the old report still saw as alive and frees deps it saw as
 used, while some exports it lists as dead live in files the previous category
 already removed. On a frozen report those second-order items survive the
 cleanup and a category tries to edit paths that no longer exist. The cost is
-two extra knip runs per cleanup.
+one extra knip run per category that commits.
 
 A category that is skipped (YELLOW does not run exports) or that fails its gate
-leaves no commit and nothing changed on disk, so there is nothing to regenerate
-from — keep the current report and go to the next category. The regeneration
+leaves no commit and nothing in the tree for knip to read differently, so there
+is nothing to regenerate from — keep the current report and go to the next
+category. (The restore does not put `node_modules` back; that is a separate
+step, below.) The regeneration
 after the last category that did commit is the one the final report counts
 against.
 
diff --git a/references/audit.md b/references/audit.md
index 5591c2b..1a0771c 100644
--- a/references/audit.md
+++ b/references/audit.md
@@ -19,7 +19,10 @@ contradicts the README, the contradiction is itself a finding.
 
 Pull churn data: `git log --stat --since="6 months ago"`, ranking the most
 modified files with
-`git log --no-merges --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn`.
+`git log --no-merges --since="6 months ago" --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn`.
+The window has to be on both commands: without `--since` the ranking is
+lifetime touch count, and a file rewritten hard three years ago and untouched
+since outranks whatever is actually hot now.
 Intersect the 20 largest files with the 20 most modified — that intersection
 is where debt usually hides, and it is what separates "actually has debt"
 from "just looks messy".
diff --git a/references/phase-2-consolidation.md b/references/phase-2-consolidation.md
index eac5856..d96f4d5 100644
--- a/references/phase-2-consolidation.md
+++ b/references/phase-2-consolidation.md
@@ -51,7 +51,9 @@ Imagine deleting the module.
 2. **Cross with churn volume (file-level).** The intersection between
    "changed a lot" and "heavily coupled" is where consolidation pays the
    most. Rank the files by
-   `git log --no-merges --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn`.
+   `git log --no-merges --since="6 months ago" --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn`.
+   Keep the window: without `--since` the count is lifetime, and a file
+   rewritten hard years ago outranks whatever is hot now.
    This is a different, weaker signal than the pair-level co-change of step
    0: it says a file is hot, not that two files move together.
 3. **Actually read the candidate clusters.** Do not judge by file name.
diff --git a/scripts/coherence_test.sh b/scripts/coherence_test.sh
index ac5c444..d7e88c6 100755
--- a/scripts/coherence_test.sh
+++ b/scripts/coherence_test.sh
@@ -289,11 +289,13 @@ done
 # Phase 3 applies a structure that does not exist yet, so the destination
 # directory has to be created before the move: `git mv` into a missing
 # directory dies with exit 128, and an agent running unsupervised reads that
-# as a failed step. Only command lines count — a line that *starts* with
+# as a failed step. Only command lines count — a line whose first word is
 # `git mv` — so the prose mentions in the READMEs and in the explanatory
-# paragraphs, where the phrase is named and not run, stay out of it.
+# paragraphs, where the phrase is named and not run, stay out of it. Leading
+# whitespace is allowed: a move written as a step inside a numbered list is
+# still a command, and anchoring at column 0 would exempt it silently.
 gitmv_files() {
-  grep -l -E '^git mv ' SKILL.md references/*.md 2>/dev/null | sort
+  grep -l -E '^[[:space:]]*git mv ' SKILL.md references/*.md 2>/dev/null | sort
 }
 
 moves=$(gitmv_files)
@@ -310,14 +312,46 @@ for f in SKILL.md references/phase-3-structure.md; do
   fi
 done
 
-# The mkdir has to be on the line right above, not merely somewhere in the
-# file: what is being read is a snippet, not a page.
+# The mkdir has to be in the same block as the move, not merely somewhere in
+# the file: what is being read is a snippet, not a page. A fence or a blank
+# line ends the block, so a `git mv` in a later snippet cannot inherit an
+# earlier snippet's mkdir. Inside a block the mkdir covers every move that
+# follows it — one `mkdir -p` and three moves into that folder is the shape a
+# real plan has, and demanding a redundant mkdir per line would reject correct
+# documentation.
+gitmv_orphans() {
+  awk '
+    /^[[:space:]]*```/       { covered = 0; next }
+    /^[[:space:]]*$/         { covered = 0; next }
+    /^[[:space:]]*mkdir -p / { covered = 1; next }
+    /^[[:space:]]*git mv / && !covered { print FILENAME ":" FNR ": " $0 }
+  ' "$1"
+}
+
+# Section 0's rule: the invariant is only as good as the extractor. A scanner
+# that never reports anything would make the loop below pass over everything,
+# so it is exercised on a synthetic page first — one covered block, one bare
+# move in a later block, one indented bare move.
+printf '%s\n' '```bash' 'mkdir -p src/x' 'git mv a src/x/a' 'git mv b src/x/b' '```' \
+              '' '```bash' 'git mv c gone/c' '```' '' '   git mv d gone/d' \
+              > "$SELFTMP/moves.md"
+got=$(gitmv_orphans "$SELFTMP/moves.md" | grep -c .)
+check "git mv scanner flags the uncovered moves and only those" \
+      "$([[ $got -eq 2 ]] && echo 0 || echo 1)" \
+      "flagged $got line(s), expected 2:
+$(gitmv_orphans "$SELFTMP/moves.md")"
+
+# IFS is pinned to newline: the list comes from grep -l, and the default IFS
+# would split a path containing a space into pieces, leaving awk to fail on
+# stderr while $orphan stays empty — an "ok" for a file never read.
+old_ifs=$IFS
+IFS=$'\n'
 for f in $moves; do
-  orphan=$(awk '/^git mv / && prev !~ /^mkdir -p / { print FILENAME ":" FNR ": " $0 }
-                { prev = $0 }' "$f")
-  check "git mv preceded by mkdir -p in $f" \
+  orphan=$(gitmv_orphans "$f")
+  check "git mv covered by a mkdir -p in $f" \
         "$([[ -z $orphan ]] && echo 0 || echo 1)" "$orphan"
 done
+IFS=$old_ifs
 
 # 7. The level table says the same thing in the three files. -----------------
 # The level is the whole dispatch of the skill: SKILL.md's table decides what
@@ -329,11 +363,16 @@ done
 # that has to hold in any language.
 LEVEL_FILES="SKILL.md README.md README.en.md"
 
-# level_names <file> — the level of each row of the file's level table, in
-# order. Table rows are the only lines that start with `|`, and the first level
-# word on a row is that row's level, whichever column the file puts it in.
-level_names() {
-  awk '/^\|/ && match($0, /GREEN|YELLOW|RED/) { print substr($0, RSTART, RLENGTH) }' "$1"
+# level_rows <file> — the rows of the level table. Anchored to the table, not
+# to the file: the first run of consecutive `|` lines that mention a level is
+# the table, and the run ends at the first line that is not a table row. A
+# level word in some other table of the same file (an exit-code table, a
+# per-stack table) is then neither counted as a row nor picked up as one.
+level_rows() {
+  awk '
+    /^\|/ && /GREEN|YELLOW|RED/ { intable = 1; print; next }
+    intable && !/^\|/ { exit }
+  ' "$1"
 }
 
 # Consecutive repeats collapse on purpose: SKILL.md carries a fourth row (no git
@@ -342,11 +381,25 @@ level_names() {
 # agent dispatches on, the READMEs are prose for a human who already read the
 # requirement. What may not differ is which levels exist and how they escalate.
 level_shape() {
-  level_names "$1" |
-  awk 'NR == 1 || $0 != prev { print } { prev = $0 }' |
-  tr '\n' ' ' | sed 's/[[:space:]]*$//'
+  level_rows "$1" |
+  awk 'match($0, /GREEN|YELLOW|RED/) {
+         l = substr($0, RSTART, RLENGTH)
+         if (l != prev) { out = out sep l; sep = " " }
+         prev = l
+       } END { print out }'
 }
 
+# Same rule as section 0. The shape has to stop at the end of the table and it
+# has to keep a level that reappears after another one, or a table that lost a
+# level would still read GREEN YELLOW RED.
+printf '%s\n' '| a | GREEN | x |' '| b | YELLOW | x |' '| c | YELLOW | x |' \
+              '| d | RED | x |' '' 'prose' '| e | GREEN | x |' \
+              > "$SELFTMP/levels.md"
+got=$(level_shape "$SELFTMP/levels.md")
+check "level extractor collapses repeats and stops at the table" \
+      "$([[ $got == 'GREEN YELLOW RED' ]] && echo 0 || echo 1)" \
+      "read [$got], expected [GREEN YELLOW RED]"
+
 for f in $LEVEL_FILES; do
   shape=$(level_shape "$f")
   check "level table of $f reads GREEN YELLOW RED" \
@@ -354,25 +407,30 @@ for f in $LEVEL_FILES; do
         "levels in order: [$shape]"
 done
 
-# The condition that puts a run at YELLOW, in each file's own language, checked
-# against the YELLOW row itself and not merely somewhere in the file — the row
-# is what gets read at classification time.
-yellow_row() { grep -E '^\|' "$1" | grep -F -m1 -- 'YELLOW'; }
-
-for pair in \
-  'SKILL.md|partial net, or no test file in the stack' \
-  'README.en.md|partial net, or no test file in the stack' \
-  'README.md|rede parcial, ou nenhum arquivo de teste no stack'
+# The condition that puts a run at each level, in each file's own language,
+# checked against that level's own row and not merely somewhere in the file —
+# the row is what gets read at classification time. The shape check above
+# cannot carry this on its own: flipping the RED row to YELLOW leaves the
+# collapsed shape at GREEN YELLOW RED (SKILL.md's fourth row is RED too), which
+# is exactly the drift this section exists to catch.
+level_row() { level_rows "$1" | grep -F -m1 -- "$2"; }
+
+for triple in \
+  'SKILL.md|YELLOW|A partial net, or no test file in the stack' \
+  'SKILL.md|RED|A check fails, or no tests and no typecheck' \
+  'README.en.md|YELLOW|partial net, or no test file in the stack' \
+  'README.en.md|RED|no tests and no typecheck, or a baseline already failing' \
+  'README.md|YELLOW|rede parcial, ou nenhum arquivo de teste no stack' \
+  'README.md|RED|sem testes e sem typecheck, ou baseline já vermelho'
 do
-  f=${pair%%|*}
-  cond=${pair#*|}
-  row=$(yellow_row "$f")
-  if printf '%s' "$row" | grep -q -F -- "$cond"; then
-    pass "YELLOW row of $f states the canonical condition"
-  else
-    fail "YELLOW row of $f states the canonical condition" \
-         "expected [$cond] — row reads: ${row:-<no YELLOW row>}"
-  fi
+  f=${triple%%|*}
+  rest=${triple#*|}
+  level=${rest%%|*}
+  cond=${rest#*|}
+  row=$(level_row "$f" "$level")
+  check "$level row of $f states the canonical condition" \
+        "$(printf '%s' "$row" | grep -q -F -- "$cond" && echo 0 || echo 1)" \
+        "expected [$cond] — row reads: ${row:-<no $level row>}"
 done
 
 echo "----"
diff --git a/scripts/gate.sh b/scripts/gate.sh
index 6f50bd9..57847c0 100755
--- a/scripts/gate.sh
+++ b/scripts/gate.sh
@@ -242,27 +242,32 @@ if [[ -f package.json ]]; then
     echo "[gate] package.json unparseable — JS/TS checks skipped" >&2
     incomplete=1
   else
-    # Each entry is "<kind>:<script names in precedence order>". Projects name
-    # these scripts freely ('type-check', 'test:unit'), and refusing anything
-    # but the canonical spelling made a fully covered repo look uncheckable.
-    # Two rules hold the semantics together: exactly one script runs per kind —
-    # the first name the project defines wins, the rest are ignored, so nothing
-    # runs or counts twice — and what reaches run() is the *kind*, never the
-    # alias, because run() classifies by kind and an unknown word there would
-    # run the check and count nothing. The alias stays visible in the human
+    # run_first <kind> <script name...> — runs the first of those scripts the
+    # project actually defines, under the canonical <kind>. Projects name these
+    # scripts freely ('type-check', 'test:unit'), and refusing anything but the
+    # canonical spelling made a fully covered repo look uncheckable. Two rules
+    # hold the semantics together: exactly one script runs per kind — the first
+    # name the project defines wins, the rest are ignored, so nothing runs or
+    # counts twice — and what reaches run() is the *kind*, never the alias,
+    # because run() classifies by kind and an unknown word there would run the
+    # check and count nothing. The alias stays visible in the human
     # '[gate] <cmd>' line; checks= keeps its canonical vocabulary.
-    for js_spec in "typecheck:typecheck type-check tsc check-types" \
-                   "test:test test:unit"; do
-      js_kind=${js_spec%%:*}
-      # shellcheck disable=SC2086  # the name list is split on purpose (bash 3.2, no arrays)
-      for script in ${js_spec#*:}; do
+    run_first() {
+      local kind=$1 script
+      shift
+      for script in "$@"; do
         if node -e "const s=require('./package.json').scripts||{};process.exit(s['$script']?0:1)" 2>/dev/null; then
-          if [[ $PM == yarn ]]; then run "$js_kind" yarn "$script"
-          else run "$js_kind" "$PM" run "$script"; fi
-          break
+          if [[ $PM == yarn ]]; then run "$kind" yarn "$script"
+          else run "$kind" "$PM" run "$script"; fi
+          return 0
         fi
       done
-    done
+      # No script of this kind: not an error. checks= reports what ran and the
+      # verdict caps the level from there.
+      return 0
+    }
+    run_first typecheck typecheck type-check tsc check-types
+    run_first test test test:unit
   fi
 fi
 
diff --git a/scripts/gate_test.sh b/scripts/gate_test.sh
index 82ad217..879cd60 100755
--- a/scripts/gate_test.sh
+++ b/scripts/gate_test.sh
@@ -217,11 +217,11 @@ cat > "$TMP/js-alias-red/package.json" <<'EOF'
 EOF
 
 # yarn.lock picks the 'yarn <script>' invocation instead of '<pm> run <script>';
-# no fixture exercised that branch before, alias or not.
+# no fixture exercised that branch before, alias or not. The manifest is copied
+# from js-alias on purpose: the lockfile is the only difference the case is
+# about, and a second hand-written copy would let the two drift apart.
 mkdir -p "$TMP/js-yarn-alias"
-cat > "$TMP/js-yarn-alias/package.json" <<'EOF'
-{"name":"f","scripts":{"type-check":"node -e 0","test:unit":"node -e 0"}}
-EOF
+cp "$TMP/js-alias/package.json" "$TMP/js-yarn-alias/package.json"
 touch "$TMP/js-yarn-alias/yarn.lock"
 
 mkdir -p "$TMP/polyglot/tests"
@@ -337,9 +337,11 @@ stub "$UV" uv 0
 GO="$TMP/stubs-go"; stub "$GO" go 0
 # yarn is not on every machine, and the branch under test is only *how* the
 # gate invokes it: a stub that always succeeds is enough, since the invocation
-# itself is echoed by run(). node stays real — the gate parses package.json with it.
+# itself is echoed by run(). The dir is prepended to the real PATH rather than
+# replacing it, so the case runs node and the same watchdog backend as every
+# other JS case — a hand-built minimal PATH would silently drop timeout and
+# make this the one JS case gated by perl.
 YARN="$TMP/stubs-yarn"
-link_bin "$YARN" bash sh env node perl ps find grep sleep true
 stub "$YARN" yarn 0
 CARGO="$TMP/stubs-cargo"; stub "$CARGO" cargo 0
 # pytest's "no tests collected" code, with a passing mypy next to it.
@@ -424,7 +426,7 @@ case_run js-alias-tsc     0 "$TMP/js-alias-tsc" -             "run tsc" "checks=
 case_run js-alias-both    0 "$TMP/js-alias-both" -            "run typecheck$" \
          "checks=typecheck,test" "GREEN" '!run type-check' '!ALIAS_TYPECHECK_RAN'
 case_run js-alias-red     1 "$TMP/js-alias-red" -             "RED at 'npm run test:unit'"
-case_run js-yarn-alias    0 "$TMP/js-yarn-alias" "$YARN"      "yarn type-check" "yarn test:unit" \
+case_run js-yarn-alias    0 "$TMP/js-yarn-alias" "$YARN:$PATH" "yarn type-check" "yarn test:unit" \
          "checks=typecheck,test" "GREEN" '!yarn run'
 case_run polyglot-partial 3 "$TMP/polyglot"     "$OK:$NOTOOL" "checks=test" "some detected stack"
 case_run partial-none-ran 3 "$TMP/go-only"      "$NOTOOL"     "nothing ran"

From 8c355eb98b60910bdbc43100a125a46f83f76511 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sat, 8 Aug 2026 23:37:25 -0300
Subject: [PATCH 09/12] fix(gate): tira tsc dos apelidos e nao promove suite
 parcial a GREEN

Dois defeitos na lista de apelidos introduzida em 5f35d14.

tsc como nome de script normalmente e compilacao com emissao, nao check.
O gate escreveria .js/.d.ts/.tsbuildinfo ao lado dos fontes da arvore que
esta julgando, o git add -A do passo 1.3 levaria isso para o commit da
faxina, e o rollback documentado (git restore --staged --worktree .) nao
remove arquivo untracked. Ficam typecheck, type-check e check-types, que
nao sao ambiguos.

test:unit contava como suite canonica sem olhar o resto do manifesto,
entao projeto com test:unit e test:e2e e sem test ia a GREEN tendo rodado
so a fatia unitaria - e GREEN e o que libera delecao de export e as fases
2 e 3. Agora test simples sempre vence; na ausencia dele, um test:* so
conta se for o unico. Com duas ou mais fatias o gate nomeia as que achou,
nao conta nenhuma, e o projeto cai no teto YELLOW, que e o veredito
honesto para uma suite que ele nao consegue rodar inteira.

Regra generalizada para qualquer test:*, nao so test:unit: projeto cujo
unico ponto de entrada e test:integration continua funcionando, que era o
ganho de autonomia da #23.

5 casos novos (63 -> 68), incluindo check-types, que nao tinha fixture
nenhuma e podia ser removido da lista sem nenhum teste reclamar. O caso
js-alias-tsc virou fixture anti-regressao do comportamento oposto.
---
 scripts/gate.sh      | 58 +++++++++++++++++++++++++++++++++++---------
 scripts/gate_test.sh | 49 +++++++++++++++++++++++++++++++++++--
 2 files changed, 94 insertions(+), 13 deletions(-)

diff --git a/scripts/gate.sh b/scripts/gate.sh
index 57847c0..f9045b9 100755
--- a/scripts/gate.sh
+++ b/scripts/gate.sh
@@ -242,23 +242,33 @@ if [[ -f package.json ]]; then
     echo "[gate] package.json unparseable — JS/TS checks skipped" >&2
     incomplete=1
   else
-    # run_first <kind> <script name...> — runs the first of those scripts the
-    # project actually defines, under the canonical <kind>. Projects name these
-    # scripts freely ('type-check', 'test:unit'), and refusing anything but the
-    # canonical spelling made a fully covered repo look uncheckable. Two rules
-    # hold the semantics together: exactly one script runs per kind — the first
-    # name the project defines wins, the rest are ignored, so nothing runs or
-    # counts twice — and what reaches run() is the *kind*, never the alias,
+    # js_script <kind> <script> — invokes one package.json script under the
+    # canonical <kind>. What reaches run() is the *kind*, never the alias,
     # because run() classifies by kind and an unknown word there would run the
     # check and count nothing. The alias stays visible in the human
     # '[gate] <cmd>' line; checks= keeps its canonical vocabulary.
+    js_script() {
+      if [[ $PM == yarn ]]; then run "$1" yarn "$2"
+      else run "$1" "$PM" run "$2"; fi
+    }
+
+    # run_first <kind> <script name...> — runs the first of those scripts the
+    # project actually defines. Projects name these scripts freely
+    # ('type-check', 'check-types'), and refusing anything but the canonical
+    # spelling made a fully covered repo look uncheckable. Exactly one script
+    # runs per kind: the first name the project defines wins, the rest are
+    # ignored, so nothing runs or counts twice.
+    # 'tsc' is deliberately NOT an alias: as a script name it usually means an
+    # emitting compile ("tsc": "tsc -p ."), which would drop .js/.d.ts/.tsbuildinfo
+    # beside the sources of the tree being judged, right before phase 1.3 stages
+    # everything with 'git add -A' — and the documented rollback
+    # ('git restore --staged --worktree .') cannot remove untracked files.
     run_first() {
       local kind=$1 script
       shift
       for script in "$@"; do
         if node -e "const s=require('./package.json').scripts||{};process.exit(s['$script']?0:1)" 2>/dev/null; then
-          if [[ $PM == yarn ]]; then run "$kind" yarn "$script"
-          else run "$kind" "$PM" run "$script"; fi
+          js_script "$kind" "$script"
           return 0
         fi
       done
@@ -266,8 +276,34 @@ if [[ -f package.json ]]; then
       # verdict caps the level from there.
       return 0
     }
-    run_first typecheck typecheck type-check tsc check-types
-    run_first test test test:unit
+
+    # js_test_script — decides which script stands for the *whole* suite.
+    # A plain 'test' always wins. Failing that, a 'test:*' script counts as the
+    # canonical test only when it is the sole one in the manifest: a repo with
+    # 'test:unit' and 'test:e2e' would otherwise report checks=typecheck,test —
+    # GREEN, which unlocks dead-export deletion and phases 2 and 3 — on a net
+    # where half the suite never ran. Echoes 'run:<name>', or 'partial:<names>'
+    # when there is more than one slice and no whole, or nothing.
+    js_test_script() {
+      node -e 'const s=require("./package.json").scripts||{};
+if (s.test) { console.log("run:test"); }
+else {
+  const p = Object.keys(s).filter(function (k) { return k.indexOf("test:") === 0 && s[k]; });
+  if (p.length === 1) console.log("run:" + p[0]);
+  else if (p.length > 1) console.log("partial:" + p.join(" "));
+}' 2>/dev/null
+    }
+
+    run_first typecheck typecheck type-check check-types
+    js_test=$(js_test_script)
+    case $js_test in
+      run:*)
+        js_script test "${js_test#run:}" ;;
+      partial:*)
+        echo "[gate] no 'test' script and more than one test:* slice" \
+             "(${js_test#partial:}) — none of them covers the suite on its own," \
+             "so 'test' is not counted; run them all by hand" >&2 ;;
+    esac
   fi
 fi
 
diff --git a/scripts/gate_test.sh b/scripts/gate_test.sh
index 879cd60..5350b16 100755
--- a/scripts/gate_test.sh
+++ b/scripts/gate_test.sh
@@ -199,9 +199,42 @@ cat > "$TMP/js-alias-test-only/package.json" <<'EOF'
 {"name":"f","scripts":{"test:unit":"node -e 0"}}
 EOF
 
+# 'tsc' as a script name usually means an emitting compile, so it is not an
+# alias: a project whose only typecheck-ish script is 'tsc' gets no typecheck.
 mkdir -p "$TMP/js-alias-tsc"
 cat > "$TMP/js-alias-tsc/package.json" <<'EOF'
-{"name":"f","scripts":{"tsc":"node -e 0"}}
+{"name":"f","scripts":{"tsc":"node -e \"console.log('TSC_RAN')\"","test":"node -e 0"}}
+EOF
+
+mkdir -p "$TMP/js-alias-check-types"
+cat > "$TMP/js-alias-check-types/package.json" <<'EOF'
+{"name":"f","scripts":{"check-types":"node -e 0","test":"node -e 0"}}
+EOF
+
+# Plain 'test' next to a slice: 'test' wins and the slice stays silent.
+mkdir -p "$TMP/js-test-and-unit"
+cat > "$TMP/js-test-and-unit/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test":"node -e 0","test:unit":"node -e \"console.log('ALIAS_TEST_RAN')\""}}
+EOF
+
+# Two slices and no whole: neither stands for the suite, so 'test' is not
+# counted and the verdict falls back to the YELLOW cap.
+mkdir -p "$TMP/js-test-slices"
+cat > "$TMP/js-test-slices/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test:unit":"node -e \"console.log('UNIT_RAN')\"","test:e2e":"node -e \"console.log('E2E_RAN')\""}}
+EOF
+
+# ...and with the slices as the only scripts at all, nothing countable ran.
+mkdir -p "$TMP/js-test-slices-only"
+cat > "$TMP/js-test-slices-only/package.json" <<'EOF'
+{"name":"f","scripts":{"test:unit":"node -e 0","test:e2e":"node -e 0"}}
+EOF
+
+# A single slice that is not 'test:unit': the rule is about test:*, not about
+# one blessed name.
+mkdir -p "$TMP/js-test-integration"
+cat > "$TMP/js-test-integration/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test:integration":"node -e 0"}}
 EOF
 
 # Canonical and alias side by side: precedence says 'typecheck' wins and
@@ -422,7 +455,19 @@ case_run js-bad-json      3 "$TMP/js-bad-json"  -             "unparseable"
 case_run js-alias         0 "$TMP/js-alias"     -             "run type-check" "run test:unit" \
          "checks=typecheck,test" "GREEN"
 case_run js-alias-test-only 0 "$TMP/js-alias-test-only" -     "run test:unit" "checks=test" "YELLOW"
-case_run js-alias-tsc     0 "$TMP/js-alias-tsc" -             "run tsc" "checks=typecheck" "YELLOW"
+case_run js-alias-tsc     0 "$TMP/js-alias-tsc" -             "checks=test" "YELLOW" \
+         '!run tsc' '!TSC_RAN'
+case_run js-alias-check-types 0 "$TMP/js-alias-check-types" - "run check-types" \
+         "checks=typecheck,test" "GREEN"
+case_run js-test-and-unit 0 "$TMP/js-test-and-unit" -         "run test$" \
+         "checks=typecheck,test" "GREEN" '!run test:unit' '!ALIAS_TEST_RAN'
+case_run js-test-slices   0 "$TMP/js-test-slices" -           "checks=typecheck" "YELLOW" \
+         "more than one test:\* slice (test:unit test:e2e)" \
+         '!UNIT_RAN' '!E2E_RAN'
+case_run js-test-slices-only 3 "$TMP/js-test-slices-only" -   "no runnable checks" \
+         "more than one test:\* slice"
+case_run js-test-integration 0 "$TMP/js-test-integration" -   "run test:integration" \
+         "checks=typecheck,test" "GREEN"
 case_run js-alias-both    0 "$TMP/js-alias-both" -            "run typecheck$" \
          "checks=typecheck,test" "GREEN" '!run type-check' '!ALIAS_TYPECHECK_RAN'
 case_run js-alias-red     1 "$TMP/js-alias-red" -             "RED at 'npm run test:unit'"

From ec4f0903393559f34aa382f8c47790e093ff89e1 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sun, 9 Aug 2026 00:08:28 -0300
Subject: [PATCH 10/12] fix(revisao 2): fecha 14 achados da segunda passada

Defeito introduzido pela regra do test:* unico: script de watch era
promovido a suite inteira. Com {typecheck, test:watch} o gate rodava
npm run test:watch, que nunca termina, e saia 4 depois de 900s - que a
SKILL.md define como 'rede nao pode ser medida, nao rode sozinho'.
Reproduzido com GATE_TIMEOUT=3. test:watch, test:ui e test:debug ficam
de fora da promocao.

O ramo de multiplas fatias imprimia linha propria em vez de passar pelo
no_tests(), entao nunca emitia o marcador 'test' not counted que a
SKILL.md manda usar para classificar - o agente nao distinguia essa
YELLOW de um stack genuinamente sem suite, e o conselho de promover a
mao estava exatamente invertido. E js_test_script descartava o exit do
node: qualquer falha depois da sonda de parse virava string vazia, sem
diagnostico, o unico caminho mudo do script inteiro. Agora imprime e
seta incomplete.

coherence_test: o invariante do mkdir so exigia que ALGUM mkdir -p
precedesse o move, nao que ele criasse o destino daquele move - plano
com duas pastas passava verde com o segundo git mv morrendo em 128.
Dois autotestes eram vazios (provado por mutacao: apagar cada regra
mantinha a contagem) e level_row casava o nivel em qualquer lugar da
linha, entao prosa citando outro nivel sequestrava a assercao.

Secoes 8 e 9 novas: comandos canonicos de knip e churn, e a contagem de
casos dos READMEs derivada do gate_test - que e a classe de drift que
produziu o numero errado no commit 8403489 (63 gravado, 68 real).

Docs: vocabulario de apelidos e fatias documentado (so existia em
comentario do gate.sh), bullet RED dos limites conhecidos nos dois
READMEs ainda trazia a definicao antiga, .git/info/exclude nao cobre
arquivo ja rastreado, node_modules reinstalado antes do git add -A em
repo que depende de gitignore global, e o .tmp que faltava no passo 6
do knip-config.

Suite 68 -> 70 casos e 66 -> 77 invariantes.
---
 README.en.md                        |  16 ++-
 README.md                           |  16 ++-
 SKILL.md                            |  50 +++++++--
 references/audit.md                 |  18 +++-
 references/knip-config.md           |   8 +-
 references/phase-2-consolidation.md |  10 +-
 references/phase-3-structure.md     |   7 ++
 scripts/coherence_test.sh           | 159 +++++++++++++++++++++++-----
 scripts/gate.sh                     |  50 ++++++---
 scripts/gate_test.sh                |  19 +++-
 10 files changed, 277 insertions(+), 76 deletions(-)

diff --git a/README.en.md b/README.en.md
index 30e893e..b176e5f 100644
--- a/README.en.md
+++ b/README.en.md
@@ -111,7 +111,7 @@ exercises the real GNU `timeout` instead of the perl backend:
 ```bash
 docker run --rm -v "$PWD":/repo:ro node:22-bookworm bash -c \
   'apt-get update -qq && apt-get install -y -qq procps && cd /repo && bash scripts/test.sh'
-# validated 2026-08: 63/63 cases, 5/5 properties, 66/66 invariants
+# validated 2026-08: 70/70 cases, 5/5 properties, 77/77 invariants
 ```
 
 The .NET heuristic was validated against the real SDK
@@ -170,6 +170,13 @@ with no test file, a Rust crate with no `tests/*.rs` and no `#[test]`, and a
 pytest run that exits 5 having collected nothing. If your suite lives outside
 the usual place, promoting it is your call — the gate never promotes itself.
 
+In JS/TS the same cap covers a sliced suite: with no `test` script and both
+`test:unit` and `test:e2e` in the manifest, no slice answers for the whole
+suite and the gate counts none of them. Promoting by hand is the wrong move
+here, because the suite is not somewhere else, it is split; run every slice. A
+lone slice does count as the suite, with one exception: watch mode
+(`test:watch`, `test:ui`, `test:debug`) never exits, so the gate skips it.
+
 With the level announced, it creates the cleanup branch and proceeds:
 
 - **Phase 1 — dead code.** Configures knip until the hints reach zero, runs
@@ -223,9 +230,10 @@ rollback discards is what the skill itself created.
 - A dynamic import with a string assembled at runtime is invisible to the
   graph. The skill handles this by teaching knip (explicit entry) instead of
   deleting, but it is worth reviewing the generated `knip.json`.
-- RED level returns a report, not a cleanup. If the project has neither tests
-  nor typecheck, the first step is to create a minimal verification; the skill
-  points the way in the report itself.
+- RED level returns a report, not a cleanup. That covers a project with
+  neither tests nor typecheck, and one that arrives with a red suite. With no
+  tests, the first step is to create a minimal verification; with a broken
+  suite, it is to fix the check the report names.
 - Exit 124 is reserved for the watchdog, exactly as in GNU `timeout`: a
   check that legitimately exits 124 under an active watchdog reads as TIMEOUT.
 - With a single `.sln`/`.slnx` at the root the gate passes it explicitly to
diff --git a/README.md b/README.md
index eb63a43..dc094ed 100644
--- a/README.md
+++ b/README.md
@@ -108,7 +108,7 @@ exercita o GNU `timeout` real em vez do backend perl:
 ```bash
 docker run --rm -v "$PWD":/repo:ro node:22-bookworm bash -c \
   'apt-get update -qq && apt-get install -y -qq procps && cd /repo && bash scripts/test.sh'
-# validado em 08/2026: 63/63 casos, 5/5 propriedades, 66/66 invariantes
+# validado em 08/2026: 70/70 casos, 5/5 propriedades, 77/77 invariantes
 ```
 
 A heurística .NET foi validada contra o SDK real (`mcr.microsoft.com/dotnet/sdk:8.0`
@@ -167,6 +167,13 @@ teste, para crate Rust sem `tests/*.rs` nem `#[test]`, e para pytest que sai
 5 sem coletar nada. Se a sua suíte mora fora do lugar padrão, a promoção é
 sua — o gate não se promove sozinho.
 
+Em JS/TS o mesmo cap pega a suíte fatiada: sem script `test`, com `test:unit`
+e `test:e2e` no manifesto, nenhuma fatia responde pela suíte inteira e o gate
+não conta nenhuma delas. Promover à mão aqui é o caminho errado, porque a
+suíte não está fora do lugar, está dividida; rode as fatias todas. Uma fatia
+sozinha vale como a suíte, com uma exceção: modo watch (`test:watch`,
+`test:ui`, `test:debug`) nunca termina, então o gate não o executa.
+
 Com o nível anunciado, ela cria a branch de limpeza e segue:
 
 - **Fase 1 — código morto.** Configura o knip até os hints zerarem, roda em
@@ -218,9 +225,10 @@ rollback joga fora foi ela mesma que criou.
 - Import dinâmico com string montada em runtime é invisível ao grafo. A skill
   trata isso ensinando o knip (entry explícito) em vez de deletar, mas vale
   revisar o `knip.json` gerado.
-- Nível RED devolve relatório, não limpeza. Se o projeto não tem teste nem
-  typecheck, o primeiro passo é criar uma verificação mínima; a skill aponta o
-  caminho no próprio relatório.
+- Nível RED devolve relatório, não limpeza. Cai aí quem não tem teste nem
+  typecheck, e também quem chega com a suíte vermelha. Sem teste, o primeiro
+  passo é criar uma verificação mínima; com a suíte quebrada, é consertar o
+  check que o relatório nomeia.
 - Exit 124 é reservado ao watchdog, igual ao GNU `timeout`: um check que
   legitimamente sai 124 sob watchdog ativo é lido como TIMEOUT.
 - Com uma única `.sln`/`.slnx` na raiz o gate a passa explícita ao `dotnet`;
diff --git a/SKILL.md b/SKILL.md
index bd599da..ec0047d 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -126,9 +126,24 @@ timeout: a check that legitimately exits 124 is read as a timeout.
 
 `checks=typecheck` because the stack has **no test file** is YELLOW, not GREEN,
 even though the gate exits 0 — a suite that does not exist cannot pass. The
-script names the stack in the `'test' not counted` line. Only the user promotes
-it, by pointing at the suite that lives somewhere the gate does not look; the
-skill never promotes itself.
+script names the stack in the `'test' not counted` line, which is the marker
+for every YELLOW cap it produces. Only the user promotes it, by pointing at the
+suite that lives somewhere the gate does not look; the skill never promotes
+itself.
+
+**Which npm script the gate reads.** For typecheck it takes the first of
+`typecheck`, `type-check`, `check-types` the manifest defines, and stops there.
+`tsc` is deliberately not on that list: as a script name it usually means an
+emitting compile, and the output would land beside the sources right before
+`git add -A` stages everything. For the suite it takes `test`; failing that, a
+lone `test:*` script, since a repo that declares one slice and no whole is
+declaring its suite. Two or more slices and no `test` count as nothing — half a
+net classified GREEN would unlock dead-export deletion on code the other half
+covers — and a watch-mode slice (`test:watch`, `test:ui`, `test:debug`) is
+never run at all, because it does not exit. Both cases print the
+`'test' not counted` line naming the slices. That one is **not** promotable by
+hand: the suite is in the manifest, only split, so run every slice before
+deciding.
 
 **A baseline that already fails is RED, not YELLOW.** Exit 1 says a check
 broke, and a broken baseline leaves no way to tell what the cleanup broke from
@@ -277,10 +292,10 @@ Never exclude tests with `ignore` to get the same effect.
 
 Run all three without asking (GREEN level) or the first two (YELLOW). Each one
 is: delete → (deps only: install) → `git add -A` → gate → commit → regenerate
-the report. For the gate, use `scripts/gate.sh`
-(it detects the stack and the package manager and runs typecheck + tests in the
-right order); if it exits with code 3, run the stack's equivalent commands by
-hand.
+the report. For the gate, use `scripts/gate.sh` (it detects the stack and the
+package manager and runs typecheck + tests in the right order); if it exits
+with code 3, read `package.json` for the script names and run the stack's
+equivalent commands by hand.
 
 Staging before the gate is what makes the rollback complete, and it is safe
 here precisely because Step 0 refused to start on a dirty tree: everything
@@ -294,6 +309,21 @@ output. Before the first category, put `knip-report.json` and
 previous one was read from, and the user reverting `chore: remove unused deps`
 gets a tool artifact back along with the dependencies.
 
+That exclude only reaches **untracked** paths. If a previous run of this skill
+already committed `knip-report.json`, git keeps staging it no matter what the
+exclude says, and the regeneration below puts a fresh diff in every category
+commit. Check with `git status --porcelain` after writing the exclude lines; if
+the report still shows up, `git rm --cached knip-report.json` first. On the way
+out, delete the report and drop the two lines you added from
+`.git/info/exclude`: neither is the user's, and the exclude makes the leftover
+invisible to `git status`, so nobody would find it later.
+
+Two more things `-A` can swallow, both created by this step and neither
+committed on purpose: `node_modules` after the install below, and the empty
+directories `mkdir -p` leaves behind in phase 3. Confirm the repo ignores
+`node_modules` before the deps category — a global `.gitignore` does not travel
+with the repo — and add it to `.git/info/exclude` if it does not.
+
 ```
 1. unused deps        → "chore: remove unused deps"
 2. orphan files       → "chore: remove orphan files"
@@ -337,10 +367,8 @@ one extra knip run per category that commits.
 A category that is skipped (YELLOW does not run exports) or that fails its gate
 leaves no commit and nothing in the tree for knip to read differently, so there
 is nothing to regenerate from — keep the current report and go to the next
-category. (The restore does not put `node_modules` back; that is a separate
-step, below.) The regeneration
-after the last category that did commit is the one the final report counts
-against.
+category. The regeneration after the last category that did commit is the one
+the final report counts against.
 
 **If the gate fails:** `git restore --staged --worktree .`, record the category
 as failed in `CLEANUP_PROGRESS.md` along with the error, and **move on to the
diff --git a/references/audit.md b/references/audit.md
index 1a0771c..784baf0 100644
--- a/references/audit.md
+++ b/references/audit.md
@@ -17,12 +17,20 @@ paragraph mental model of the architecture as it actually is — you built
 most of it while configuring the phase 1 dead-code tool. If the model
 contradicts the README, the contradiction is itself a finding.
 
-Pull churn data: `git log --stat --since="6 months ago"`, ranking the most
-modified files with
-`git log --no-merges --since="6 months ago" --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn`.
-The window has to be on both commands: without `--since` the ranking is
+Pull churn data, then rank the most modified files:
+
+```bash
+git log --no-merges --stat --since="6 months ago"
+git log --no-merges --since="6 months ago" --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn
+```
+
+Both filters have to be on both commands. Without `--since` the ranking is a
 lifetime touch count, and a file rewritten hard three years ago and untouched
-since outranks whatever is actually hot now.
+since outranks whatever is actually hot now. Without `--no-merges` a merge
+commit re-attributes every file it brings in, so the two views end up
+describing different commit sets and the intersection below is skewed by
+exactly the noise the flag removes.
+
 Intersect the 20 largest files with the 20 most modified — that intersection
 is where debt usually hides, and it is what separates "actually has debt"
 from "just looks messy".
diff --git a/references/knip-config.md b/references/knip-config.md
index b0dc6a2..2e43c5d 100644
--- a/references/knip-config.md
+++ b/references/knip-config.md
@@ -25,12 +25,16 @@ names. Adjust the `$schema` version below to the major in use.
 3. Only then write/adjust `knip.json`
 4. Repeat 2–3 until the hints reach zero
 5. `npx knip --production --no-exit-code --reporter json > knip-report.json.tmp && mv knip-report.json.tmp knip-report.json`
-6. Check the result before using it: non-empty file that parses as JSON
+6. Check the result before using it: `knip-report.json.tmp` gone, and
+   `knip-report.json` non-empty and parsing as JSON
 
 The temp file plus `&&` is what keeps a crashed run from wiping the previous
 report — a plain `>` truncates it before knip starts. `--no-exit-code` is
 required there because knip exits 1 on every run that finds issues; only exit
-2 means it failed.
+2 means it failed. The missing `.tmp` is the load-bearing half of step 6: when
+knip breaks, the `&&` skips the `mv` and the *previous* report stays on disk,
+non-empty and perfectly parseable, so the content checks alone would wave a
+stale list through.
 
 The right mindset: when knip reports something unexpected, it is telling the
 truth about the module graph — it could not reach that code from an entry. A
diff --git a/references/phase-2-consolidation.md b/references/phase-2-consolidation.md
index d96f4d5..4a2ea5e 100644
--- a/references/phase-2-consolidation.md
+++ b/references/phase-2-consolidation.md
@@ -51,11 +51,17 @@ Imagine deleting the module.
 2. **Cross with churn volume (file-level).** The intersection between
    "changed a lot" and "heavily coupled" is where consolidation pays the
    most. Rank the files by
-   `git log --no-merges --since="6 months ago" --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn`.
+
+   ```bash
+   git log --no-merges --since="6 months ago" --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn
+   ```
+
    Keep the window: without `--since` the count is lifetime, and a file
    rewritten hard years ago outranks whatever is hot now.
    This is a different, weaker signal than the pair-level co-change of step
-   0: it says a file is hot, not that two files move together.
+   0: it says a file is hot, not that two files move together — and it is
+   windowed where step 0's ratio is not, so the two rankings are read side by
+   side, never subtracted from each other.
 3. **Actually read the candidate clusters.** Do not judge by file name.
 4. **Rank by confidence**, not by size.
 
diff --git a/references/phase-3-structure.md b/references/phase-3-structure.md
index b1e1586..8ec5c63 100644
--- a/references/phase-3-structure.md
+++ b/references/phase-3-structure.md
@@ -67,6 +67,13 @@ missing precondition, not a failed step — create the directory and repeat the
 move. Do not fall back to `mv` plus `git rm`/`git add`: that is `rm` +
 `create` under another name.
 
+Create exactly the directory the move lands in, and no others. Git tracks
+files, not directories, so a folder created for a move that never happened, or
+for a commit whose gate failed, is left behind as an empty untracked directory:
+`git restore --staged --worktree .` cannot remove it. Sweep the leftovers when
+a folder's commit does not land — `find src -type d -empty -delete`, or `rmdir`
+the path you just created.
+
 `git mv` preserves history. `rm` + `create` destroys that file's `git blame` —
 exactly the information someone will want six months from now when asking "why
 is this like this".
diff --git a/scripts/coherence_test.sh b/scripts/coherence_test.sh
index d7e88c6..e22b3b6 100755
--- a/scripts/coherence_test.sh
+++ b/scripts/coherence_test.sh
@@ -256,6 +256,12 @@ for f in SKILL.md references/phase-2-consolidation.md references/phase-3-structu
   fi
 done
 
+# IFS is pinned to newline for the same reason section 6 pins it: the list comes
+# from grep -l, and under the default IFS a path containing a space would split
+# into fragments, leaving grep to fail on stderr while the invariant reports a
+# verdict for a file it never opened.
+old_ifs=$IFS
+IFS=$'\n'
 for f in $derived; do
   if grep -q -F -- 'git add -A' "$f" 2>/dev/null; then
     pass "gate step pairs with git add -A in $f"
@@ -264,6 +270,7 @@ for f in $derived; do
          "runs the gate as a protocol step without staging first"
   fi
 done
+IFS=$old_ifs
 
 # 5. The file trees in the READMEs match what is on disk. --------------------
 for readme in README.md README.en.md; do
@@ -290,12 +297,15 @@ done
 # directory has to be created before the move: `git mv` into a missing
 # directory dies with exit 128, and an agent running unsupervised reads that
 # as a failed step. Only command lines count — a line whose first word is
-# `git mv` — so the prose mentions in the READMEs and in the explanatory
-# paragraphs, where the phrase is named and not run, stay out of it. Leading
+# `git mv` — so the prose mentions, where the phrase is named inside backticks
+# and not run, stay out of it. That is the whole filter: the READMEs are
+# scanned like everything else, because both already carry fenced bash blocks
+# and a move added to one of them would be read and run like any other. Leading
 # whitespace is allowed: a move written as a step inside a numbered list is
 # still a command, and anchoring at column 0 would exempt it silently.
 gitmv_files() {
-  grep -l -E '^[[:space:]]*git mv ' SKILL.md references/*.md 2>/dev/null | sort
+  grep -l -E '^[[:space:]]*git mv ' SKILL.md README.md README.en.md references/*.md \
+    2>/dev/null | sort
 }
 
 moves=$(gitmv_files)
@@ -312,34 +322,52 @@ for f in SKILL.md references/phase-3-structure.md; do
   fi
 done
 
-# The mkdir has to be in the same block as the move, not merely somewhere in
-# the file: what is being read is a snippet, not a page. A fence or a blank
-# line ends the block, so a `git mv` in a later snippet cannot inherit an
-# earlier snippet's mkdir. Inside a block the mkdir covers every move that
-# follows it — one `mkdir -p` and three moves into that folder is the shape a
-# real plan has, and demanding a redundant mkdir per line would reject correct
-# documentation.
+# The mkdir has to be in the same block as the move, and it has to have created
+# the directory that move lands in — not merely some directory. What is being
+# read is a snippet, not a page: a fence or a blank line ends the block, so a
+# `git mv` in a later snippet cannot inherit an earlier snippet's mkdir. Inside
+# a block one `mkdir -p` covers every move into that folder — one mkdir and
+# three moves is the shape a real plan has, and demanding a redundant mkdir per
+# line would reject correct documentation. Tracking the folders instead of a
+# bare "some mkdir happened" flag is what catches the realistic version of the
+# bug: a block that creates one destination and then moves into a second one.
+# A move with no `/` in the destination is a rename in place and needs no
+# directory, so it is never flagged.
 gitmv_orphans() {
   awk '
-    /^[[:space:]]*```/       { covered = 0; next }
-    /^[[:space:]]*$/         { covered = 0; next }
-    /^[[:space:]]*mkdir -p / { covered = 1; next }
-    /^[[:space:]]*git mv / && !covered { print FILENAME ":" FNR ": " $0 }
+    /^[[:space:]]*```/       { split("", made); next }
+    /^[[:space:]]*$/         { split("", made); next }
+    /^[[:space:]]*mkdir -p / { for (i = 3; i <= NF; i++) {
+                                 d = $i; gsub(/\/+$/, "", d); made[d] = 1
+                               }
+                               next }
+    /^[[:space:]]*git mv /   { dest = $4
+                               if (sub(/\/[^\/]*$/, "", dest) && !(dest in made))
+                                 print FILENAME ":" FNR ": " $0 }
   ' "$1"
 }
 
 # Section 0's rule: the invariant is only as good as the extractor. A scanner
 # that never reports anything would make the loop below pass over everything,
-# so it is exercised on a synthetic page first — one covered block, one bare
-# move in a later block, one indented bare move.
-printf '%s\n' '```bash' 'mkdir -p src/x' 'git mv a src/x/a' 'git mv b src/x/b' '```' \
-              '' '```bash' 'git mv c gone/c' '```' '' '   git mv d gone/d' \
+# so it is exercised on a synthetic page first. Every line of the fixture pays
+# for itself — delete any one rule of the scanner and the count moves:
+# `git mv c` catches the destination check, `git mv e` the fence reset (the
+# mkdir above it created the very folder it lands in, so only the fence can
+# uncover it), `git mv g` the blank-line reset for the same reason, `git mv d`
+# the leading-whitespace tolerance. `git mv h i` renames in place and must stay
+# unflagged even though no mkdir names `i`.
+printf '%s\n' '```bash' 'mkdir -p src/x' 'git mv a src/x/a' 'git mv b src/x/b' \
+              'git mv c src/y/c' '```' 'git mv e src/x/e' \
+              '```bash' 'mkdir -p src/y' 'git mv f src/y/f' '' 'git mv g src/y/g' '```' \
+              '' '   git mv d gone/d' \
+              '```bash' 'mkdir -p src/z' 'git mv h i' '```' \
               > "$SELFTMP/moves.md"
-got=$(gitmv_orphans "$SELFTMP/moves.md" | grep -c .)
+orphans=$(gitmv_orphans "$SELFTMP/moves.md")
+got=$(printf '%s' "$orphans" | grep -c .)
 check "git mv scanner flags the uncovered moves and only those" \
-      "$([[ $got -eq 2 ]] && echo 0 || echo 1)" \
-      "flagged $got line(s), expected 2:
-$(gitmv_orphans "$SELFTMP/moves.md")"
+      "$([[ $got -eq 4 ]] && echo 0 || echo 1)" \
+      "flagged $got line(s), expected 4:
+$orphans"
 
 # IFS is pinned to newline: the list comes from grep -l, and the default IFS
 # would split a path containing a space into pieces, leaving awk to fail on
@@ -389,16 +417,19 @@ level_shape() {
        } END { print out }'
 }
 
-# Same rule as section 0. The shape has to stop at the end of the table and it
-# has to keep a level that reappears after another one, or a table that lost a
-# level would still read GREEN YELLOW RED.
+# Same rule as section 0, and both halves have to be paid for. The trailing
+# GREEN outside the table is what proves the extractor stops at the table. The
+# YELLOW that comes back *after* the RED row, inside the table, is what proves
+# the collapse is of consecutive repeats and not a global dedupe: with a
+# seen-set the fixture would still read GREEN YELLOW RED and a real table that
+# lost a level would slip through the check unchanged.
 printf '%s\n' '| a | GREEN | x |' '| b | YELLOW | x |' '| c | YELLOW | x |' \
-              '| d | RED | x |' '' 'prose' '| e | GREEN | x |' \
+              '| d | RED | x |' '| e | YELLOW | x |' '' 'prose' '| f | GREEN | x |' \
               > "$SELFTMP/levels.md"
 got=$(level_shape "$SELFTMP/levels.md")
 check "level extractor collapses repeats and stops at the table" \
-      "$([[ $got == 'GREEN YELLOW RED' ]] && echo 0 || echo 1)" \
-      "read [$got], expected [GREEN YELLOW RED]"
+      "$([[ $got == 'GREEN YELLOW RED YELLOW' ]] && echo 0 || echo 1)" \
+      "read [$got], expected [GREEN YELLOW RED YELLOW]"
 
 for f in $LEVEL_FILES; do
   shape=$(level_shape "$f")
@@ -413,13 +444,22 @@ done
 # cannot carry this on its own: flipping the RED row to YELLOW leaves the
 # collapsed shape at GREEN YELLOW RED (SKILL.md's fourth row is RED too), which
 # is exactly the drift this section exists to catch.
-level_row() { level_rows "$1" | grep -F -m1 -- "$2"; }
+# The level is matched as a cell of its own — `| RED |` or `| **RED** |`, which
+# covers both layouts in use (the READMEs put the level first, SKILL.md second)
+# — and not as a substring of the row. A row is free to name another level in
+# its prose without stealing that level's assertion.
+level_row() {
+  level_rows "$1" | grep -E -m1 -- "\|[[:space:]]*\**$2\**[[:space:]]*\|"
+}
 
 for triple in \
+  'SKILL.md|GREEN|Typecheck **and** tests pass' \
   'SKILL.md|YELLOW|A partial net, or no test file in the stack' \
   'SKILL.md|RED|A check fails, or no tests and no typecheck' \
+  'README.en.md|GREEN|typecheck and tests pass' \
   'README.en.md|YELLOW|partial net, or no test file in the stack' \
   'README.en.md|RED|no tests and no typecheck, or a baseline already failing' \
+  'README.md|GREEN|typecheck e testes passam' \
   'README.md|YELLOW|rede parcial, ou nenhum arquivo de teste no stack' \
   'README.md|RED|sem testes e sem typecheck, ou baseline já vermelho'
 do
@@ -433,6 +473,67 @@ do
         "expected [$cond] — row reads: ${row:-<no $level row>}"
 done
 
+# 8. A command that lives in two files is one string, byte for byte. ---------
+# Same rule as the rollback in section 1, and the same reason: both of these
+# are copied by hand into two files, both get executed, and a flag fixed in one
+# copy and not the other leaves two protocols behind. The stale copy is the
+# dangerous one — the unhardened knip form (`> knip-report.json`) truncates the
+# report before knip starts, so a crash reads as "nothing to delete"; the
+# unwindowed churn command ranks by lifetime touch count, where a file rewritten
+# three years ago outranks whatever is hot now.
+KNIP_CMD='npx knip --production --no-exit-code --reporter json > knip-report.json.tmp && mv knip-report.json.tmp knip-report.json'
+KNIP_FILES="SKILL.md references/knip-config.md"
+
+CHURN_CMD='git log --no-merges --since="6 months ago" --format= --name-only | sed '\''/^$/d'\'' | sort | uniq -c | sort -rn'
+CHURN_FILES="references/audit.md references/phase-2-consolidation.md"
+
+for f in $KNIP_FILES; do
+  check "knip report command verbatim in $f" \
+        "$(grep -q -F -- "$KNIP_CMD" "$f" 2>/dev/null && echo 0 || echo 1)" \
+        "missing the canonical form: $KNIP_CMD"
+done
+
+for f in $CHURN_FILES; do
+  check "churn ranking command verbatim in $f" \
+        "$(grep -q -F -- "$CHURN_CMD" "$f" 2>/dev/null && echo 0 || echo 1)" \
+        "missing the canonical form: $CHURN_CMD"
+done
+
+# ...and no variant of either anywhere else in the repo. The markers are the
+# parts that only this command has a reason to use: knip only ever writes a
+# report through `--reporter json`, and nothing else counts with `uniq -c`.
+loose=$(count_matches '--reporter json')
+canon=$(count_matches "$KNIP_CMD")
+check "no knip report variant in the repo" \
+      "$([[ $loose -eq $canon ]] && echo 0 || echo 1)" \
+      "$loose uses of '--reporter json', $canon of them the canonical command"
+
+loose=$(count_matches 'uniq -c')
+canon=$(count_matches "$CHURN_CMD")
+check "no churn ranking variant in the repo" \
+      "$([[ $loose -eq $canon ]] && echo 0 || echo 1)" \
+      "$loose uses of 'uniq -c', $canon of them the canonical command"
+
+# 9. The validated-run line in the READMEs counts the suite that exists. ------
+# Both READMEs publish the result of a docker run ("N/N casos") as evidence the
+# contract was exercised. That number drifted once — the suite grew by eleven
+# cases and the line was bumped by six — and a stale count is worse than none,
+# because a reader who runs the command and gets a different total has to guess
+# which of the two is lying. gate_test.sh calls its counting helpers exactly
+# once per line, continuation lines included (they start with the argument, not
+# with the helper), so the call sites are the total without running anything.
+# The properties and invariants figures come from loops over derived lists and
+# have no static equivalent; they stay on the honour system.
+gate_cases=$(grep -cE '^[[:space:]]*(case_run|assert_log|assert_no_log|assert_reaped|elapsed_lt) ' \
+             scripts/gate_test.sh)
+for pair in 'README.md|casos' 'README.en.md|cases'; do
+  f=${pair%%|*}
+  word=${pair#*|}
+  check "$f quotes gate_test.sh's real case count" \
+        "$(grep -q -F -- "$gate_cases/$gate_cases $word" "$f" 2>/dev/null && echo 0 || echo 1)" \
+        "gate_test.sh has $gate_cases cases; the validated-run line of $f does not say so"
+done
+
 echo "----"
 echo "$((total-failures))/$total invariants held"
 [[ $failures -eq 0 ]]
diff --git a/scripts/gate.sh b/scripts/gate.sh
index f9045b9..c8f3185 100755
--- a/scripts/gate.sh
+++ b/scripts/gate.sh
@@ -180,12 +180,16 @@ missing() {
   incomplete=1
 }
 
-# no_tests <stack> <reason> — a green run with no test file is not a tested
-# repo. Does not set incomplete: the verdict stays exit 0 with checks=typecheck,
-# which is the YELLOW cap, and the user can promote it by hand.
+# no_tests <stack> <reason> [advice] — a green run with no test file is not a
+# tested repo. Does not set incomplete: the verdict stays exit 0 with
+# checks=typecheck, which is the YELLOW cap, and the user can promote it by
+# hand. Every producer of a YELLOW cap goes through here, because the literal
+# "'test' not counted" is the marker SKILL.md tells the agent to classify by.
+# <advice> is how the user gets past the cap; it defaults to promotion, which
+# is wrong for a suite that is present but sliced, so that caller passes its own.
 no_tests() {
-  echo "[gate] $1: $2 — 'test' not counted (YELLOW cap; promote by hand if the" \
-       "suite lives elsewhere)" >&2
+  local advice=${3:-"promote by hand if the suite lives elsewhere"}
+  echo "[gate] $1: $2 — 'test' not counted (YELLOW cap; $advice)" >&2
 }
 
 py_missing() {
@@ -279,30 +283,44 @@ if [[ -f package.json ]]; then
 
     # js_test_script — decides which script stands for the *whole* suite.
     # A plain 'test' always wins. Failing that, a 'test:*' script counts as the
-    # canonical test only when it is the sole one in the manifest: a repo with
-    # 'test:unit' and 'test:e2e' would otherwise report checks=typecheck,test —
-    # GREEN, which unlocks dead-export deletion and phases 2 and 3 — on a net
-    # where half the suite never ran. Echoes 'run:<name>', or 'partial:<names>'
-    # when there is more than one slice and no whole, or nothing.
+    # canonical test only when it is the sole candidate in the manifest: a repo
+    # with 'test:unit' and 'test:e2e' would otherwise report checks=typecheck,test
+    # — GREEN, which unlocks dead-export deletion and phases 2 and 3 — on a net
+    # where half the suite never ran.
+    # A watch/interactive slice ('test:watch', 'test:ui', 'test:debug') is not a
+    # candidate at all: it never exits, so running it as the gate's test can only
+    # ever end at the watchdog — 900s of stall for an exit 4 that reads as "the
+    # safety net could not be measured". It is still listed in the report, so the
+    # cap is explained instead of silent. Same reasoning as the 'tsc' exclusion
+    # above: a name that means "not a check" is not promoted to one.
+    # Echoes 'run:<name>', or 'partial:<names>' when nothing covers the whole
+    # suite, or nothing at all when the manifest has no test script.
     js_test_script() {
       node -e 'const s=require("./package.json").scripts||{};
 if (s.test) { console.log("run:test"); }
 else {
   const p = Object.keys(s).filter(function (k) { return k.indexOf("test:") === 0 && s[k]; });
-  if (p.length === 1) console.log("run:" + p[0]);
-  else if (p.length > 1) console.log("partial:" + p.join(" "));
+  const whole = p.filter(function (k) { return !/:(watch|ui|debug)$/.test(k); });
+  if (whole.length === 1) console.log("run:" + whole[0]);
+  else if (p.length > 0) console.log("partial:" + p.join(" "));
 }' 2>/dev/null
     }
 
     run_first typecheck typecheck type-check check-types
-    js_test=$(js_test_script)
+    # A node failure here used to be the one fully silent path in the gate: the
+    # empty answer is indistinguishable from "this manifest defines no test
+    # script", and the run would cap at YELLOW without a word about why.
+    if ! js_test=$(js_test_script); then
+      echo "[gate] package.json scripts unreadable — JS/TS test check skipped" >&2
+      incomplete=1
+      js_test=""
+    fi
     case $js_test in
       run:*)
         js_script test "${js_test#run:}" ;;
       partial:*)
-        echo "[gate] no 'test' script and more than one test:* slice" \
-             "(${js_test#partial:}) — none of them covers the suite on its own," \
-             "so 'test' is not counted; run them all by hand" >&2 ;;
+        no_tests js "no 'test' script; test:* slices found (${js_test#partial:})" \
+                 "none of them stands for the whole suite; run them by hand" ;;
     esac
   fi
 fi
diff --git a/scripts/gate_test.sh b/scripts/gate_test.sh
index 5350b16..b55636b 100755
--- a/scripts/gate_test.sh
+++ b/scripts/gate_test.sh
@@ -237,6 +237,16 @@ cat > "$TMP/js-test-integration/package.json" <<'EOF'
 {"name":"f","scripts":{"typecheck":"node -e 0","test:integration":"node -e 0"}}
 EOF
 
+# A lone watch slice is not a suite: it never exits, so promoting it would end
+# at the watchdog — GATE_TIMEOUT seconds of stall for an inconclusive exit 4 on
+# a repo that has a perfectly good gate otherwise. The script here really does
+# hang, so the case proves the gate never starts it: it has to come back fast,
+# exit 0, and explain the cap.
+mkdir -p "$TMP/js-test-watch"
+cat > "$TMP/js-test-watch/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test:watch":"node -e \"setInterval(function(){},1000)\""}}
+EOF
+
 # Canonical and alias side by side: precedence says 'typecheck' wins and
 # 'type-check' never runs. The alias prints a marker so its silence is provable.
 mkdir -p "$TMP/js-alias-both"
@@ -461,13 +471,16 @@ case_run js-alias-check-types 0 "$TMP/js-alias-check-types" - "run check-types"
          "checks=typecheck,test" "GREEN"
 case_run js-test-and-unit 0 "$TMP/js-test-and-unit" -         "run test$" \
          "checks=typecheck,test" "GREEN" '!run test:unit' '!ALIAS_TEST_RAN'
-case_run js-test-slices   0 "$TMP/js-test-slices" -           "checks=typecheck" "YELLOW" \
-         "more than one test:\* slice (test:unit test:e2e)" \
+case_run js-test-slices   0 "$TMP/js-test-slices" -           "checks=typecheck$" "YELLOW" \
+         "test:\* slices found (test:unit test:e2e)" "'test' not counted" \
          '!UNIT_RAN' '!E2E_RAN'
 case_run js-test-slices-only 3 "$TMP/js-test-slices-only" -   "no runnable checks" \
-         "more than one test:\* slice"
+         "test:\* slices found" "'test' not counted"
 case_run js-test-integration 0 "$TMP/js-test-integration" -   "run test:integration" \
          "checks=typecheck,test" "GREEN"
+case_run js-test-watch    0 "$TMP/js-test-watch" -            "checks=typecheck$" "YELLOW" \
+         "test:\* slices found (test:watch)" "'test' not counted" '!run test:watch'
+elapsed_lt js-test-watch-never-started 15
 case_run js-alias-both    0 "$TMP/js-alias-both" -            "run typecheck$" \
          "checks=typecheck,test" "GREEN" '!run type-check' '!ALIAS_TYPECHECK_RAN'
 case_run js-alias-red     1 "$TMP/js-alias-red" -             "RED at 'npm run test:unit'"

From 077a36bbeedc5f704540f7fe9fac2f6d5ec37f33 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sun, 9 Aug 2026 00:44:05 -0300
Subject: [PATCH 11/12] fix(revisao 3): veredito nao da GREEN com stack
 descoberto

O cap de suite fatiada era derrotado em repo poliglota: outro stack
fornecia test, checks= lia typecheck,test e o gate anunciava GREEN com a
suite JS inteira sem ter rodado. Mesma classe para go, rust, .NET e o
pytest-5, porque no_tests nao setava nada que o veredito lesse.

uncounted_suite() passa a marcar todo cap de stack inteiro, e o veredito
recusa GREEN quando a marca esta ligada, dizendo por que. O cap por
projeto do .NET fica no no_tests simples: projeto sem teste ao lado de
outro com teste e normal.

MUDANCA DE COMPORTAMENTO: repo poliglota que antes lia GREEN passa a
capar em YELLOW quando qualquer stack ficou descoberto. Modulo Go sem
*_test.go ao lado de app JS testado e o caso tipico.

Outros achados do proprio codigo novo: a exclusao de watch era ancorada
no fim, entao test:watch:all voltava a ser promovido e o gate travava
ate o timeout; fatia com comando vazio era filtrada por truthiness e
duas metades viravam uma so, devolvendo GREEN; run_first tratava
qualquer exit nao-zero do node como 'script nao definido' e derrubava o
typecheck em silencio - a mesma assimetria que a rodada anterior tinha
corrigido do lado do teste, um bloco abaixo. Manifesto sem nenhum script
de teste tambem nao emitia marcador nenhum, entao a frase da SKILL.md
sobre classificar por 'test' not counted era falsa.

coherence_test: gitmv_orphans lia o destino como , entao git mv -f,
caminho com aspas ou move de varias fontes eram checados contra o token
errado; level_rows ancorava na primeira linha com | citando um nivel, e
tabela vizinha sequestrava o extrator. Secao 9 contava 70 call sites dos
quais 10 vivem atras do guard de perl - a premissa agora esta escrita.

audit.md: a justificativa do --no-merges estava factualmente errada
sobre o git (log --stat nao imprime arquivo de merge por padrao); vale
o aviso contra -m no lugar dela.

Suite 70 -> 75 casos.
---
 README.en.md              |  17 ++++-
 README.md                 |  17 ++++-
 SKILL.md                  |  64 ++++++++++-------
 references/audit.md       |  14 ++--
 scripts/coherence_test.sh |  72 +++++++++++++++++---
 scripts/gate.sh           | 140 ++++++++++++++++++++++++--------------
 scripts/gate_test.sh      |  51 +++++++++++++-
 7 files changed, 275 insertions(+), 100 deletions(-)

diff --git a/README.en.md b/README.en.md
index b176e5f..2295c3d 100644
--- a/README.en.md
+++ b/README.en.md
@@ -111,7 +111,7 @@ exercises the real GNU `timeout` instead of the perl backend:
 ```bash
 docker run --rm -v "$PWD":/repo:ro node:22-bookworm bash -c \
   'apt-get update -qq && apt-get install -y -qq procps && cd /repo && bash scripts/test.sh'
-# validated 2026-08: 70/70 cases, 5/5 properties, 77/77 invariants
+# validated 2026-08: 75/75 cases, 5/5 properties, 77/77 invariants
 ```
 
 The .NET heuristic was validated against the real SDK
@@ -174,8 +174,14 @@ In JS/TS the same cap covers a sliced suite: with no `test` script and both
 `test:unit` and `test:e2e` in the manifest, no slice answers for the whole
 suite and the gate counts none of them. Promoting by hand is the wrong move
 here, because the suite is not somewhere else, it is split; run every slice. A
-lone slice does count as the suite, with one exception: watch mode
-(`test:watch`, `test:ui`, `test:debug`) never exits, so the gate skips it.
+lone slice does count as the suite, with one exception: watch mode never exits,
+so the gate skips it. `watch`, `ui` and `debug` are read as whole segments of
+the name, which catches `test:watch:all` and leaves `test:watchdog` alone.
+
+In a polyglot repo the cap survives the other stacks. Go with tests next to a
+JS half that was never counted still prints `checks=typecheck,test`, because
+each word came from a different manifest — and there the gate refuses to say
+GREEN, naming the stack that has no suite instead.
 
 With the level announced, it creates the cleanup branch and proceeds:
 
@@ -246,6 +252,11 @@ rollback discards is what the skill itself created.
 - A folder with no git falls into RED as well, even with typecheck and tests
   passing. With no commit there is no rollback, and the rollback is what holds
   up the autonomy of the rest of the pipeline.
+- The unused-deps category runs the package manager's plain install after
+  pruning the manifest, so the lockfile is rewritten and `node_modules`
+  re-resolved. That part is outside the rollback: `git restore` brings back
+  `package.json` and the lockfile, never the installed tree. Run the install
+  again if a category fails.
 
 ## Credits
 
diff --git a/README.md b/README.md
index dc094ed..eb7b019 100644
--- a/README.md
+++ b/README.md
@@ -108,7 +108,7 @@ exercita o GNU `timeout` real em vez do backend perl:
 ```bash
 docker run --rm -v "$PWD":/repo:ro node:22-bookworm bash -c \
   'apt-get update -qq && apt-get install -y -qq procps && cd /repo && bash scripts/test.sh'
-# validado em 08/2026: 70/70 casos, 5/5 propriedades, 77/77 invariantes
+# validado em 08/2026: 75/75 casos, 5/5 propriedades, 77/77 invariantes
 ```
 
 A heurística .NET foi validada contra o SDK real (`mcr.microsoft.com/dotnet/sdk:8.0`
@@ -171,8 +171,14 @@ Em JS/TS o mesmo cap pega a suíte fatiada: sem script `test`, com `test:unit`
 e `test:e2e` no manifesto, nenhuma fatia responde pela suíte inteira e o gate
 não conta nenhuma delas. Promover à mão aqui é o caminho errado, porque a
 suíte não está fora do lugar, está dividida; rode as fatias todas. Uma fatia
-sozinha vale como a suíte, com uma exceção: modo watch (`test:watch`,
-`test:ui`, `test:debug`) nunca termina, então o gate não o executa.
+sozinha vale como a suíte, com uma exceção: modo watch nunca termina, então o
+gate não o executa. `watch`, `ui` e `debug` são lidos como segmentos inteiros
+do nome, o que pega `test:watch:all` e deixa `test:watchdog` em paz.
+
+Em repositório poliglota o cap sobrevive aos outros stacks. Go com testes ao
+lado de uma metade JS que ninguém contou ainda imprime `checks=typecheck,test`,
+porque cada palavra veio de um manifesto diferente — e aí o gate se recusa a
+dizer GREEN, e nomeia o stack que ficou sem suíte.
 
 Com o nível anunciado, ela cria a branch de limpeza e segue:
 
@@ -241,6 +247,11 @@ rollback joga fora foi ela mesma que criou.
 - Pasta sem git também cai em RED, mesmo com typecheck e testes passando. Sem
   commit não existe rollback, e é o rollback que sustenta a autonomia do resto
   do pipeline.
+- A categoria de deps roda o install simples do gerenciador depois de podar o
+  manifesto, então o lockfile é reescrito e o `node_modules` é resolvido de
+  novo. Essa parte fica fora do rollback: o `git restore` traz de volta o
+  `package.json` e o lockfile, nunca a árvore instalada. Se uma categoria
+  falhar, rode o install outra vez.
 
 ## Créditos
 
diff --git a/SKILL.md b/SKILL.md
index ec0047d..0fa36a8 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -126,24 +126,33 @@ timeout: a check that legitimately exits 124 is read as a timeout.
 
 `checks=typecheck` because the stack has **no test file** is YELLOW, not GREEN,
 even though the gate exits 0 — a suite that does not exist cannot pass. The
-script names the stack in the `'test' not counted` line, which is the marker
-for every YELLOW cap it produces. Only the user promotes it, by pointing at the
-suite that lives somewhere the gate does not look; the skill never promotes
-itself.
+script names the stack in the `'test' not counted` line, and every stack whose
+suite could not be counted goes through it. Read those lines, not only
+`checks=`: in a polyglot repo one stack supplies the suite while another has
+none, so `checks=typecheck,test` can be describing two different stacks. The
+gate refuses to announce GREEN there and says why (`a detected stack has no
+countable suite`). Only the user promotes a cap, by pointing at the suite that
+lives somewhere the gate does not look; the skill never promotes itself.
 
 **Which npm script the gate reads.** For typecheck it takes the first of
 `typecheck`, `type-check`, `check-types` the manifest defines, and stops there.
 `tsc` is deliberately not on that list: as a script name it usually means an
 emitting compile, and the output would land beside the sources right before
-`git add -A` stages everything. For the suite it takes `test`; failing that, a
-lone `test:*` script, since a repo that declares one slice and no whole is
-declaring its suite. Two or more slices and no `test` count as nothing — half a
-net classified GREEN would unlock dead-export deletion on code the other half
-covers — and a watch-mode slice (`test:watch`, `test:ui`, `test:debug`) is
-never run at all, because it does not exit. Both cases print the
-`'test' not counted` line naming the slices. That one is **not** promotable by
-hand: the suite is in the manifest, only split, so run every slice before
-deciding.
+`git add -A` stages everything. The reverse is not covered: a script *named*
+`typecheck` whose body is `tsc -p .` with no `--noEmit` emits just the same, and
+the gate cannot tell. If the manifest has one, read it before phase 1.
+
+For the suite it takes `test`; failing that, a lone `test:*` script, since a
+repo that declares one slice and no whole is declaring its suite. Two or more
+slices and no `test` count as nothing — half a net classified GREEN would
+unlock dead-export deletion on code the other half covers — and a slice
+declared with an empty command still counts as one of them. A watch-mode slice
+never runs at all, because it does not exit: `watch`, `ui` and `debug` are
+matched as whole segments of the name, so `test:watch:all` is caught and
+`test:watchdog` is not. All of these print the `'test' not counted` line naming
+the slices, and so does a manifest that declares no test script at all. A split
+suite is **not** promotable by hand: it is in the manifest, only divided, so
+run every slice before deciding.
 
 **A baseline that already fails is RED, not YELLOW.** Exit 1 says a check
 broke, and a broken baseline leaves no way to tell what the cleanup broke from
@@ -294,8 +303,9 @@ Run all three without asking (GREEN level) or the first two (YELLOW). Each one
 is: delete → (deps only: install) → `git add -A` → gate → commit → regenerate
 the report. For the gate, use `scripts/gate.sh` (it detects the stack and the
 package manager and runs typecheck + tests in the right order); if it exits
-with code 3, read `package.json` for the script names and run the stack's
-equivalent commands by hand.
+with code 3, find the stack's own check commands — the `package.json` scripts,
+the tox env, the Makefile target, whatever this repo uses — and run them by
+hand.
 
 Staging before the gate is what makes the rollback complete, and it is safe
 here precisely because Step 0 refused to start on a dirty tree: everything
@@ -313,16 +323,20 @@ That exclude only reaches **untracked** paths. If a previous run of this skill
 already committed `knip-report.json`, git keeps staging it no matter what the
 exclude says, and the regeneration below puts a fresh diff in every category
 commit. Check with `git status --porcelain` after writing the exclude lines; if
-the report still shows up, `git rm --cached knip-report.json` first. On the way
-out, delete the report and drop the two lines you added from
-`.git/info/exclude`: neither is the user's, and the exclude makes the leftover
-invisible to `git status`, so nobody would find it later.
-
-Two more things `-A` can swallow, both created by this step and neither
-committed on purpose: `node_modules` after the install below, and the empty
-directories `mkdir -p` leaves behind in phase 3. Confirm the repo ignores
-`node_modules` before the deps category — a global `.gitignore` does not travel
-with the repo — and add it to `.git/info/exclude` if it does not.
+the report still shows up, untrack it in a commit of its own before the first
+category — `git rm --cached knip-report.json`, then `chore: untrack knip
+report`. Left staged, the next `git add -A` folds that deletion into the deps
+commit, and reverting the deps category hands the artifact back, which is the
+thing the exclude was for. On the way out, delete the report and drop the lines
+you added from `.git/info/exclude`: none of them is the user's, and the exclude
+makes the leftover invisible to `git status`, so nobody would find it later.
+
+One more thing `-A` can swallow, created by this step and not committed on
+purpose: `node_modules`, after the install below. Confirm the repo ignores it
+before the deps category — a global `.gitignore` does not travel with the repo
+— and add it to `.git/info/exclude` if it does not. Empty directories are not
+on this list: git tracks files, so `git add -A` never stages one. The leftovers
+`mkdir -p` creates in phase 3 are a working-tree problem and are swept there.
 
 ```
 1. unused deps        → "chore: remove unused deps"
diff --git a/references/audit.md b/references/audit.md
index 784baf0..a41a827 100644
--- a/references/audit.md
+++ b/references/audit.md
@@ -24,12 +24,14 @@ git log --no-merges --stat --since="6 months ago"
 git log --no-merges --since="6 months ago" --format= --name-only | sed '/^$/d' | sort | uniq -c | sort -rn
 ```
 
-Both filters have to be on both commands. Without `--since` the ranking is a
-lifetime touch count, and a file rewritten hard three years ago and untouched
-since outranks whatever is actually hot now. Without `--no-merges` a merge
-commit re-attributes every file it brings in, so the two views end up
-describing different commit sets and the intersection below is skewed by
-exactly the noise the flag removes.
+`--since` is the one that carries weight, and it has to be on both commands:
+without it the ranking is a lifetime touch count, and a file rewritten hard
+three years ago and untouched since outranks whatever is actually hot now.
+`--no-merges` does less than it looks. Git prints no diff for a merge unless
+asked with `-m` or `--cc`, so merges contribute no file names either way and
+the flag only keeps their empty entries out of the `--stat` read. Do not reach
+for `-m` to "fix" that: it credits the merge with every file it brought in, and
+one big merge then owns the top of the ranking.
 
 Intersect the 20 largest files with the 20 most modified — that intersection
 is where debt usually hides, and it is what separates "actually has debt"
diff --git a/scripts/coherence_test.sh b/scripts/coherence_test.sh
index e22b3b6..31d7559 100755
--- a/scripts/coherence_test.sh
+++ b/scripts/coherence_test.sh
@@ -333,15 +333,35 @@ done
 # bug: a block that creates one destination and then moves into a second one.
 # A move with no `/` in the destination is a rename in place and needs no
 # directory, so it is never flagged.
+# Both readers work on the last argument, not on a fixed field number: `git mv`
+# takes flags and takes several sources into one directory, and `dest = $4`
+# read the wrong token in either case — a flag shifted the fields, and the
+# wrong token usually has no `/`, so the move was quietly exempted instead of
+# checked. Trailing comments are cut first (the repo's own example carries one),
+# option words are skipped, and surrounding double quotes are stripped so a
+# quoted path registers under the name the move actually uses.
 gitmv_orphans() {
   awk '
+    function args(line,   i, n, out) {   # the words of <line>, comments and flags out
+      sub(/[[:space:]]+#.*$/, "", line)
+      n = split(line, out, "[[:space:]]+")   # a string, not a /literal/: mawk
+      argc = 0
+      for (i = 1; i <= n; i++) {
+        if (out[i] == "" || out[i] ~ /^-/) continue
+        gsub(/"/, "", out[i])
+        argv[++argc] = out[i]
+      }
+      return argc
+    }
     /^[[:space:]]*```/       { split("", made); next }
     /^[[:space:]]*$/         { split("", made); next }
-    /^[[:space:]]*mkdir -p / { for (i = 3; i <= NF; i++) {
-                                 d = $i; gsub(/\/+$/, "", d); made[d] = 1
+    /^[[:space:]]*mkdir -p/  { n = args($0)
+                               for (i = 2; i <= n; i++) {      # argv[1] is "mkdir"
+                                 d = argv[i]; gsub(/\/+$/, "", d); made[d] = 1
                                }
                                next }
-    /^[[:space:]]*git mv /   { dest = $4
+    /^[[:space:]]*git mv /   { n = args($0)
+                               dest = argv[n]                  # last word, never $4
                                if (sub(/\/[^\/]*$/, "", dest) && !(dest in made))
                                  print FILENAME ":" FNR ": " $0 }
   ' "$1"
@@ -356,17 +376,24 @@ gitmv_orphans() {
 # uncover it), `git mv g` the blank-line reset for the same reason, `git mv d`
 # the leading-whitespace tolerance. `git mv h i` renames in place and must stay
 # unflagged even though no mkdir names `i`.
+# The last block pays for the argument reader: `git mv j` is only unflagged if
+# the quotes came off the mkdir, and `git mv -f k` and the multi-source
+# `git mv l m src/s/` are only flagged if the destination is read as the last
+# word — a fixed `$4` reads `k` and `m`, neither of which has a `/`, so both
+# uncovered moves would slip through as renames in place.
 printf '%s\n' '```bash' 'mkdir -p src/x' 'git mv a src/x/a' 'git mv b src/x/b' \
               'git mv c src/y/c' '```' 'git mv e src/x/e' \
               '```bash' 'mkdir -p src/y' 'git mv f src/y/f' '' 'git mv g src/y/g' '```' \
               '' '   git mv d gone/d' \
               '```bash' 'mkdir -p src/z' 'git mv h i' '```' \
+              '```bash' 'mkdir -p "src/q"' 'git mv j src/q/j' 'git mv -f k src/r/k' \
+              'git mv l m src/s/' '```' \
               > "$SELFTMP/moves.md"
 orphans=$(gitmv_orphans "$SELFTMP/moves.md")
 got=$(printf '%s' "$orphans" | grep -c .)
 check "git mv scanner flags the uncovered moves and only those" \
-      "$([[ $got -eq 4 ]] && echo 0 || echo 1)" \
-      "flagged $got line(s), expected 4:
+      "$([[ $got -eq 6 ]] && echo 0 || echo 1)" \
+      "flagged $got line(s), expected 6:
 $orphans"
 
 # IFS is pinned to newline: the list comes from grep -l, and the default IFS
@@ -391,14 +418,26 @@ IFS=$old_ifs
 # that has to hold in any language.
 LEVEL_FILES="SKILL.md README.md README.en.md"
 
+# LEVEL_CELL — a level standing alone in its own cell, bold or not. Both
+# extractors below use it, and that is the point: naming a level in a row's
+# prose ("not GREEN, a partial net") must not make the row count as that level's
+# row for one of them and not the other. It is also what keeps some other table
+# from being mistaken for this one — references/other-stacks.md has rows like
+# `| Go | deadcode | yes, at GREEN |`, where GREEN is prose inside a cell, not
+# the cell.
+# Written with bracket expressions rather than backslash escapes: awk's `-v`
+# eats one level of backslash before the regex is ever compiled, so `\|` would
+# arrive as a bare alternation and the pattern would not compile.
+LEVEL_CELL='[|][[:space:]]*[*]*(GREEN|YELLOW|RED)[*]*[[:space:]]*[|]'
+
 # level_rows <file> — the rows of the level table. Anchored to the table, not
-# to the file: the first run of consecutive `|` lines that mention a level is
+# to the file: the first run of consecutive `|` lines carrying a level cell is
 # the table, and the run ends at the first line that is not a table row. A
 # level word in some other table of the same file (an exit-code table, a
 # per-stack table) is then neither counted as a row nor picked up as one.
 level_rows() {
-  awk '
-    /^\|/ && /GREEN|YELLOW|RED/ { intable = 1; print; next }
+  awk -v cell="$LEVEL_CELL" '
+    /^\|/ && $0 ~ cell { intable = 1; print; next }
     intable && !/^\|/ { exit }
   ' "$1"
 }
@@ -410,8 +449,10 @@ level_rows() {
 # requirement. What may not differ is which levels exist and how they escalate.
 level_shape() {
   level_rows "$1" |
-  awk 'match($0, /GREEN|YELLOW|RED/) {
+  awk -v cell="$LEVEL_CELL" 'match($0, cell) {
          l = substr($0, RSTART, RLENGTH)
+         match(l, /GREEN|YELLOW|RED/)
+         l = substr(l, RSTART, RLENGTH)
          if (l != prev) { out = out sep l; sep = " " }
          prev = l
        } END { print out }'
@@ -423,7 +464,13 @@ level_shape() {
 # the collapse is of consecutive repeats and not a global dedupe: with a
 # seen-set the fixture would still read GREEN YELLOW RED and a real table that
 # lost a level would slip through the check unchanged.
-printf '%s\n' '| a | GREEN | x |' '| b | YELLOW | x |' '| c | YELLOW | x |' \
+# The decoy row on top is the third half: it names a level inside a cell of
+# prose, the shape references/other-stacks.md already uses. Matching a level
+# anywhere in a `|` line would open the table there, and the blank line under it
+# would close the table again before the real one ever started — the extractor
+# would read [GREEN] and every assertion below it would be about the wrong rows.
+printf '%s\n' '| go | deadcode | yes, at GREEN |' '' \
+              '| a | GREEN | x |' '| b | YELLOW | x |' '| c | YELLOW | x |' \
               '| d | RED | x |' '| e | YELLOW | x |' '' 'prose' '| f | GREEN | x |' \
               > "$SELFTMP/levels.md"
 got=$(level_shape "$SELFTMP/levels.md")
@@ -522,6 +569,11 @@ check "no churn ranking variant in the repo" \
 # which of the two is lying. gate_test.sh calls its counting helpers exactly
 # once per line, continuation lines included (they start with the argument, not
 # with the helper), so the call sites are the total without running anything.
+# One assumption the count makes and cannot check: ten of those call sites are
+# inside gate_test.sh's `if command -v perl`, so the total counted here is the
+# one the documented docker image produces — node:22-bookworm ships perl. A host
+# without perl skips that block and prints ten fewer; the READMEs quote the
+# figure from the command they publish, which is the docker one.
 # The properties and invariants figures come from loops over derived lists and
 # have no static equivalent; they stay on the honour system.
 gate_cases=$(grep -cE '^[[:space:]]*(case_run|assert_log|assert_no_log|assert_reaped|elapsed_lt) ' \
diff --git a/scripts/gate.sh b/scripts/gate.sh
index c8f3185..207b900 100755
--- a/scripts/gate.sh
+++ b/scripts/gate.sh
@@ -23,6 +23,7 @@ cd "$target" || {
 ran_typecheck=0
 ran_test=0
 incomplete=0
+uncounted=0
 
 # --- Watchdog ---------------------------------------------------------
 # A hanging check (a test waiting on a port, a REPL, a prompt) would freeze the
@@ -161,7 +162,7 @@ run() {
     exit 4
   fi
   if [[ -n $no_tests_rc && $rc -eq $no_tests_rc ]]; then
-    no_tests "$nt_label" "no tests collected (exit $rc)"
+    uncounted_suite "$nt_label" "no tests collected (exit $rc)"
     return 0
   fi
   if [[ $rc -ne 0 ]]; then
@@ -181,17 +182,31 @@ missing() {
 }
 
 # no_tests <stack> <reason> [advice] — a green run with no test file is not a
-# tested repo. Does not set incomplete: the verdict stays exit 0 with
-# checks=typecheck, which is the YELLOW cap, and the user can promote it by
-# hand. Every producer of a YELLOW cap goes through here, because the literal
-# "'test' not counted" is the marker SKILL.md tells the agent to classify by.
+# tested repo. Does not set incomplete: the verdict stays exit 0, which is the
+# YELLOW cap, and the user can promote it by hand. Every stack whose suite could
+# not be counted goes through here, because the literal "'test' not counted" is
+# the marker SKILL.md tells the agent to classify by. A checks= list that is
+# merely short (checks=test, no typecheck) is also a YELLOW cap and does not
+# come through here — the missing word in checks= is its own marker.
 # <advice> is how the user gets past the cap; it defaults to promotion, which
-# is wrong for a suite that is present but sliced, so that caller passes its own.
+# is wrong for a suite that is present but sliced, so those callers pass their own.
 no_tests() {
   local advice=${3:-"promote by hand if the suite lives elsewhere"}
   echo "[gate] $1: $2 — 'test' not counted (YELLOW cap; $advice)" >&2
 }
 
+# uncounted_suite <stack> <reason> [advice] — no_tests for a whole stack, plus
+# the flag the verdict reads. Without it a polyglot repo hides the cap: another
+# stack supplies 'test', checks= reads typecheck,test and the run is announced
+# GREEN while this stack's suite never ran — which is exactly what GREEN is not
+# allowed to mean, since it unlocks dead-export deletion. Per-project caps
+# inside one stack (a .NET project with no test project next to one that has
+# them) are not this: there the stack's suite did run, so they call no_tests.
+uncounted_suite() {
+  uncounted=1
+  no_tests "$@"
+}
+
 py_missing() {
   echo "[gate] $1 present but toolchain '$2' missing — looked in \$VIRTUAL_ENV/bin," \
        ".venv/bin, venv/bin, uv/poetry and PATH — manual gate" >&2
@@ -256,29 +271,24 @@ if [[ -f package.json ]]; then
       else run "$1" "$PM" run "$2"; fi
     }
 
-    # run_first <kind> <script name...> — runs the first of those scripts the
-    # project actually defines. Projects name these scripts freely
+    # js_typecheck_script — the first of the accepted spellings the project
+    # actually defines, in a single node pass. Projects name this script freely
     # ('type-check', 'check-types'), and refusing anything but the canonical
     # spelling made a fully covered repo look uncheckable. Exactly one script
-    # runs per kind: the first name the project defines wins, the rest are
-    # ignored, so nothing runs or counts twice.
+    # runs: the first name the project defines wins, the rest are ignored, so
+    # nothing runs or counts twice.
     # 'tsc' is deliberately NOT an alias: as a script name it usually means an
     # emitting compile ("tsc": "tsc -p ."), which would drop .js/.d.ts/.tsbuildinfo
     # beside the sources of the tree being judged, right before phase 1.3 stages
     # everything with 'git add -A' — and the documented rollback
     # ('git restore --staged --worktree .') cannot remove untracked files.
-    run_first() {
-      local kind=$1 script
-      shift
-      for script in "$@"; do
-        if node -e "const s=require('./package.json').scripts||{};process.exit(s['$script']?0:1)" 2>/dev/null; then
-          js_script "$kind" "$script"
-          return 0
-        fi
-      done
-      # No script of this kind: not an error. checks= reports what ran and the
-      # verdict caps the level from there.
-      return 0
+    # Echoes the script name, or nothing when the manifest declares none.
+    js_typecheck_script() {
+      node -e 'var s = require("./package.json").scripts || {};
+var names = ["typecheck", "type-check", "check-types"];
+for (var i = 0; i < names.length; i++) {
+  if (s[names[i]]) { console.log(names[i]); break; }
+}' 2>/dev/null
     }
 
     # js_test_script — decides which script stands for the *whole* suite.
@@ -286,42 +296,60 @@ if [[ -f package.json ]]; then
     # canonical test only when it is the sole candidate in the manifest: a repo
     # with 'test:unit' and 'test:e2e' would otherwise report checks=typecheck,test
     # — GREEN, which unlocks dead-export deletion and phases 2 and 3 — on a net
-    # where half the suite never ran.
-    # A watch/interactive slice ('test:watch', 'test:ui', 'test:debug') is not a
-    # candidate at all: it never exits, so running it as the gate's test can only
-    # ever end at the watchdog — 900s of stall for an exit 4 that reads as "the
-    # safety net could not be measured". It is still listed in the report, so the
-    # cap is explained instead of silent. Same reasoning as the 'tsc' exclusion
-    # above: a name that means "not a check" is not promoted to one.
-    # Echoes 'run:<name>', or 'partial:<names>' when nothing covers the whole
-    # suite, or nothing at all when the manifest has no test script.
+    # where half the suite never ran. A slice declared with an empty command
+    # still counts towards that cardinality: dropping it would turn the same two
+    # halves into a lone slice and hand back the GREEN this rule exists to deny.
+    # A watch/interactive slice is not a candidate at all: it never exits, so
+    # running it as the gate's test can only ever end at the watchdog — 900s of
+    # stall for an exit 4 that reads as "the safety net could not be measured".
+    # 'watch', 'ui' and 'debug' are matched as whole segments of the name, so
+    # 'test:watch:all' and 'test:ui:headed' are caught too and 'test:watchdog'
+    # is not. Watch slices are still listed in the report, so the cap is
+    # explained instead of silent. Same reasoning as the 'tsc' exclusion above:
+    # a name that means "not a check" is not promoted to one.
+    # Echoes 'run:<name>'; 'partial:<names>' when two or more slices split the
+    # suite; 'watch:<names>' when every slice is watch mode; nothing at all when
+    # the manifest declares no test script.
     js_test_script() {
-      node -e 'const s=require("./package.json").scripts||{};
+      node -e 'var s = require("./package.json").scripts || {};
 if (s.test) { console.log("run:test"); }
 else {
-  const p = Object.keys(s).filter(function (k) { return k.indexOf("test:") === 0 && s[k]; });
-  const whole = p.filter(function (k) { return !/:(watch|ui|debug)$/.test(k); });
+  var p = Object.keys(s).filter(function (k) { return k.indexOf("test:") === 0; });
+  var whole = p.filter(function (k) { return !/(^|:)(watch|ui|debug)(:|$)/.test(k); });
   if (whole.length === 1) console.log("run:" + whole[0]);
-  else if (p.length > 0) console.log("partial:" + p.join(" "));
+  else if (whole.length > 1) console.log("partial:" + whole.join(" "));
+  else if (p.length > 0) console.log("watch:" + p.join(" "));
 }' 2>/dev/null
     }
 
-    run_first typecheck typecheck type-check check-types
-    # A node failure here used to be the one fully silent path in the gate: the
-    # empty answer is indistinguishable from "this manifest defines no test
-    # script", and the run would cap at YELLOW without a word about why.
+    # A node failure on either lookup used to be a fully silent path: the empty
+    # answer is indistinguishable from "this manifest declares no such script",
+    # and the run would cap at YELLOW without a word about why. Both lookups
+    # report it the same way now.
+    if ! js_tc=$(js_typecheck_script); then
+      echo "[gate] package.json scripts unreadable — JS/TS typecheck skipped" >&2
+      incomplete=1
+    elif [[ -n $js_tc ]]; then
+      js_script typecheck "$js_tc"
+    fi
+
     if ! js_test=$(js_test_script); then
       echo "[gate] package.json scripts unreadable — JS/TS test check skipped" >&2
       incomplete=1
-      js_test=""
+    else
+      case $js_test in
+        run:*)
+          js_script test "${js_test#run:}" ;;
+        partial:*)
+          uncounted_suite js "no 'test' script; test:* slices found (${js_test#partial:})" \
+                   "none of them stands for the whole suite; run them by hand" ;;
+        watch:*)
+          uncounted_suite js "no 'test' script; only watch-mode slices (${js_test#watch:})" \
+                   "a watch slice never exits; add a script that runs the suite once" ;;
+        *)
+          uncounted_suite js "no 'test' script in package.json" ;;
+      esac
     fi
-    case $js_test in
-      run:*)
-        js_script test "${js_test#run:}" ;;
-      partial:*)
-        no_tests js "no 'test' script; test:* slices found (${js_test#partial:})" \
-                 "none of them stands for the whole suite; run them by hand" ;;
-    esac
   fi
 fi
 
@@ -334,7 +362,7 @@ if [[ -f go.mod ]]; then
     if [[ -n $(find . -name '*_test.go' -not -path './vendor/*' -print -quit 2>/dev/null) ]]; then
       run test go test ./...
     else
-      no_tests go "no *_test.go found"
+      uncounted_suite go "no *_test.go found"
     fi
   else missing go.mod go; fi
 fi
@@ -360,7 +388,7 @@ if [[ -f Cargo.toml ]]; then
     if [[ -n $rust_tests ]]; then
       run test cargo test --quiet
     else
-      no_tests rust "no #[test] or tests/*.rs found"
+      uncounted_suite rust "no #[test] or tests/*.rs found"
     fi
   else missing Cargo.toml cargo; fi
 fi
@@ -377,6 +405,8 @@ if [[ -f pyproject.toml || -f setup.py || -f setup.cfg || -f requirements.txt ]]
   if [[ -f pytest.ini || -d tests || -d test ]] || grep -qs '^\[tool\.pytest' pyproject.toml \
       || grep -qs '^\[tool:pytest\]' setup.cfg || grep -qs '^\[pytest\]' tox.ini; then
     py_run "test:5:python" python-tests pytest -q
+  else
+    uncounted_suite python "no pytest config and no tests/ directory"
   fi
 fi
 
@@ -397,7 +427,8 @@ if [[ -f Gemfile ]]; then
   if command -v bundle >/dev/null; then
     [[ -f sorbet/config ]] && run typecheck bundle exec srb tc
     if [[ -d spec ]]; then run test bundle exec rspec
-    elif [[ -f Rakefile && -d test ]]; then run test bundle exec rake test; fi
+    elif [[ -f Rakefile && -d test ]]; then run test bundle exec rake test
+    else uncounted_suite ruby "no spec/ and no Rakefile with test/"; fi
   else missing Gemfile bundler; fi
 fi
 
@@ -451,7 +482,7 @@ if [[ ${#dotnet_targets[@]} -gt 0 ]]; then
         if [[ $has_tests -eq 1 ]]; then
           # shellcheck disable=SC2086  # same expansion, same reason
           run test dotnet test --nologo -v minimal ${dotnet_root_arg:+"$dotnet_root_arg"}
-        else no_tests dotnet "no test project found"; fi
+        else uncounted_suite dotnet "no test project found"; fi
       else
         run typecheck dotnet build --nologo -v minimal "$target"
         if grep -qsE "$DOTNET_TEST_MARKERS" "$target"; then
@@ -481,8 +512,13 @@ if [[ $incomplete -eq 1 ]]; then
   echo "[gate] PARTIAL — some detected stack had no toolchain; finish the gate manually" >&2
   exit 3
 fi
-if [[ $checks == "typecheck,test" ]]; then
+if [[ $checks == "typecheck,test" && $uncounted -eq 0 ]]; then
   echo "[gate] GREEN"
+elif [[ $uncounted -eq 1 ]]; then
+  # checks= can read typecheck,test in a polyglot repo where one stack supplied
+  # the suite and another has none. That is not GREEN: the stack without a suite
+  # would have its dead exports deleted with nothing to catch the mistake.
+  echo "[gate] OK — a detected stack has no countable suite (see 'test' not counted above); YELLOW cap"
 else
   echo "[gate] OK — only ran: $checks (missing full typecheck+test, YELLOW cap)"
 fi
diff --git a/scripts/gate_test.sh b/scripts/gate_test.sh
index b55636b..e9fead3 100755
--- a/scripts/gate_test.sh
+++ b/scripts/gate_test.sh
@@ -247,6 +247,41 @@ cat > "$TMP/js-test-watch/package.json" <<'EOF'
 {"name":"f","scripts":{"typecheck":"node -e 0","test:watch":"node -e \"setInterval(function(){},1000)\""}}
 EOF
 
+# ...and the mode word is a segment of the name, not a suffix of it: 'test:watch:all'
+# hangs exactly as hard as 'test:watch'. Anchoring the exclusion at the end of the
+# name let this one through and cost a full GATE_TIMEOUT before exit 4.
+mkdir -p "$TMP/js-test-watch-nested"
+cat > "$TMP/js-test-watch-nested/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test:watch:all":"node -e \"setInterval(function(){},1000)\""}}
+EOF
+
+# A slice declared with an empty command still splits the suite. Counting only
+# the non-empty ones turned two halves into a lone slice — and a lone slice is
+# promoted to the whole suite, which is the GREEN this rule exists to deny.
+mkdir -p "$TMP/js-slice-empty"
+cat > "$TMP/js-slice-empty/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test:unit":"node -e \"console.log('UNIT_RAN')\"","test:e2e":""}}
+EOF
+
+# A manifest with a typecheck script and no test script of any spelling: the
+# plainest YELLOW cap there is, and the one that used to produce no explanation
+# at all — the run ended at 'checks=typecheck' with nothing on stderr saying why
+# the suite was missing, while every other stack said so.
+mkdir -p "$TMP/js-typecheck-only"
+cat > "$TMP/js-typecheck-only/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","build":"node -e 0"}}
+EOF
+
+# Polyglot: the JS suite is sliced and never runs, Go's does. checks= then reads
+# typecheck,test from Go alone, and announcing GREEN off that would unlock
+# dead-export deletion over the JS half that nothing tested.
+mkdir -p "$TMP/js-poly-uncounted"
+cat > "$TMP/js-poly-uncounted/package.json" <<'EOF'
+{"name":"f","scripts":{"test:unit":"node -e 0","test:e2e":"node -e 0"}}
+EOF
+printf 'module f\n\ngo 1.21\n' > "$TMP/js-poly-uncounted/go.mod"
+printf 'package f\n' > "$TMP/js-poly-uncounted/x_test.go"
+
 # Canonical and alias side by side: precedence says 'typecheck' wins and
 # 'type-check' never runs. The alias prints a marker so its silence is provable.
 mkdir -p "$TMP/js-alias-both"
@@ -478,9 +513,23 @@ case_run js-test-slices-only 3 "$TMP/js-test-slices-only" -   "no runnable check
          "test:\* slices found" "'test' not counted"
 case_run js-test-integration 0 "$TMP/js-test-integration" -   "run test:integration" \
          "checks=typecheck,test" "GREEN"
+# Both watch fixtures hang for real, so they run under a short watchdog: if the
+# exclusion ever regresses the gate starts the script, and at the default 900s
+# the regression costs a quarter of an hour before elapsed_lt can report it.
+GATE_ENV="GATE_TIMEOUT=20"
 case_run js-test-watch    0 "$TMP/js-test-watch" -            "checks=typecheck$" "YELLOW" \
-         "test:\* slices found (test:watch)" "'test' not counted" '!run test:watch'
+         "only watch-mode slices (test:watch)" "'test' not counted" '!run test:watch'
 elapsed_lt js-test-watch-never-started 15
+GATE_ENV="GATE_TIMEOUT=20"
+case_run js-test-watch-nested 0 "$TMP/js-test-watch-nested" - "checks=typecheck$" "YELLOW" \
+         "only watch-mode slices (test:watch:all)" '!run test:watch:all'
+elapsed_lt js-test-watch-nested-never-started 15
+case_run js-slice-empty   0 "$TMP/js-slice-empty" -           "checks=typecheck$" "YELLOW" \
+         "test:\* slices found (test:unit test:e2e)" '!UNIT_RAN'
+case_run js-typecheck-only 0 "$TMP/js-typecheck-only" -       "checks=typecheck$" "YELLOW" \
+         "no 'test' script in package.json" "'test' not counted"
+case_run js-poly-uncounted 0 "$TMP/js-poly-uncounted" "$GO:$PATH" "checks=typecheck,test" \
+         "'test' not counted" "no countable suite" '!GREEN'
 case_run js-alias-both    0 "$TMP/js-alias-both" -            "run typecheck$" \
          "checks=typecheck,test" "GREEN" '!run type-check' '!ALIAS_TYPECHECK_RAN'
 case_run js-alias-red     1 "$TMP/js-alias-red" -             "RED at 'npm run test:unit'"

From 5e035d76e83f8319008e7b4cb2d05b71ba495146 Mon Sep 17 00:00:00 2001
From: Cleber Rangel <cleberrangelp@gmail.com>
Date: Sun, 9 Aug 2026 01:13:42 -0300
Subject: [PATCH 12/12] fix(revisao 4): fecha os buracos do uncounted_suite

A quarta passada auditou o que a terceira escreveu, e o uncounted_suite
tinha cinco veredictos falsos.

Regressao contra usuario existente, a mais grave: os caps novos de Python
e Ruby disparavam nos marcadores mais frouxos do script - requirements.txt
ou Gemfile soltos. Repo JS verde com um requirements.txt do build da doc
passava a capar em YELLOW para sempre, sem resposta possivel, quando antes
lia GREEN. Os caps agora exigem fonte .py de verdade, ou .rb com gemspec.

.NET por projeto chamava no_tests puro, entao stack .NET onde NENHUM
projeto tem teste nunca marcava uncounted e ainda anunciava GREEN - o
buraco exato que a marca existia para fechar. Vira acumulador
dotnet_counted; cap por projeto ao lado de projeto com teste continua
sendo no_tests simples, que e o caso normal.

JVM usava run both, que conta test incondicionalmente: pom.xml sem
src/test dava GREEN, e mvn -q test sai 0 em modulo sem classe de teste.
Ganhou varredura de evidencia de fonte de teste.

ui estava no mesmo denylist de watch e debug, mas denylist tira a fatia
da CONTAGEM, nao so da execucao: {test:unit, test:ui} virava fatia unica e
subia a GREEN com a metade de UI sem rodar. watch e debug sao modo da
mesma suite; ui e escopo proprio. Agora ui nao roda mas conta.

E o veredito com elif descartava metade da mensagem quando os dois caps
batiam junto - os testes so grepavam a substring YELLOW, presente nas
duas, entao nada reclamava.

Docs: npm ci nao 'aceita a remocao', ele falha com EUSAGE em manifesto
dessincronizado (a rodada 1 tinha medido npm 12 e escrito o contrario);
.git/info/exclude vira git rev-parse --git-path, que e o unico que
funciona em worktree e submodule; o find -type d -empty -delete da fase 3
era varredura cega em src/ e virou rmdir por nome.

11 casos novos (75 -> 86), um por defeito. A fixture jvm-hybrid ganhou
src/test/java: ela passava pegando carona no bug.
---
 README.en.md                    |  24 +++++--
 README.md                       |  27 +++++---
 SKILL.md                        |  52 ++++++++++-----
 references/phase-3-structure.md |   9 ++-
 scripts/gate.sh                 | 102 +++++++++++++++++++++++-------
 scripts/gate_test.sh            | 109 ++++++++++++++++++++++++++++++--
 6 files changed, 261 insertions(+), 62 deletions(-)

diff --git a/README.en.md b/README.en.md
index 2295c3d..00a0a37 100644
--- a/README.en.md
+++ b/README.en.md
@@ -111,7 +111,7 @@ exercises the real GNU `timeout` instead of the perl backend:
 ```bash
 docker run --rm -v "$PWD":/repo:ro node:22-bookworm bash -c \
   'apt-get update -qq && apt-get install -y -qq procps && cd /repo && bash scripts/test.sh'
-# validated 2026-08: 75/75 cases, 5/5 properties, 77/77 invariants
+# validated 2026-08: 86/86 cases, 5/5 properties, 77/77 invariants
 ```
 
 The .NET heuristic was validated against the real SDK
@@ -165,10 +165,15 @@ already broken, and since every commit demands a green gate, none of them would
 happen. The skill names the failing check and stops there.
 
 A stack with no test file at all does not count as tested: the gate does not
-run the empty suite and the level stays at YELLOW. That covers Go and .NET
-with no test file, a Rust crate with no `tests/*.rs` and no `#[test]`, and a
-pytest run that exits 5 having collected nothing. If your suite lives outside
-the usual place, promoting it is your call — the gate never promotes itself.
+count an empty suite, whether it declined to run it or ran it and got nothing
+back, and the level stays at YELLOW. That covers Go and .NET
+with no test file, a Rust crate with no `tests/*.rs` and no `#[test]`, a Maven
+or Gradle build with no `src/test` anywhere, and a pytest run that exits 5
+having collected nothing. A manifest carried for tooling and nothing else — a
+`requirements.txt` for the docs build, a `Gemfile` for fastlane — is not a stack
+without a suite: with no source of that language in the repo, the gate says
+nothing about it. If your suite lives outside the usual place, promoting it is
+your call — the gate never promotes itself.
 
 In JS/TS the same cap covers a sliced suite: with no `test` script and both
 `test:unit` and `test:e2e` in the manifest, no slice answers for the whole
@@ -176,7 +181,11 @@ suite and the gate counts none of them. Promoting by hand is the wrong move
 here, because the suite is not somewhere else, it is split; run every slice. A
 lone slice does count as the suite, with one exception: watch mode never exits,
 so the gate skips it. `watch`, `ui` and `debug` are read as whole segments of
-the name, which catches `test:watch:all` and leaves `test:watchdog` alone.
+the name, which catches `test:watch:all` and leaves `test:watchdog` alone. Being
+skipped and being uncounted are not the same, though: `watch` and `debug` are a
+mode of the suite, so `test:watch` next to a lone `test:unit` leaves that slice
+as the suite; `test:ui` may well be a suite of its own, so it is skipped and
+still counted, and `test:unit` next to it is a split.
 
 In a polyglot repo the cap survives the other stacks. Go with tests next to a
 JS half that was never counted still prints `checks=typecheck,test`, because
@@ -256,7 +265,8 @@ rollback discards is what the skill itself created.
   pruning the manifest, so the lockfile is rewritten and `node_modules`
   re-resolved. That part is outside the rollback: `git restore` brings back
   `package.json` and the lockfile, never the installed tree. Run the install
-  again if a category fails.
+  again if that category is the one that fails; the other two never touch the
+  manifest and do not need it.
 
 ## Credits
 
diff --git a/README.md b/README.md
index eb7b019..10f788d 100644
--- a/README.md
+++ b/README.md
@@ -108,7 +108,7 @@ exercita o GNU `timeout` real em vez do backend perl:
 ```bash
 docker run --rm -v "$PWD":/repo:ro node:22-bookworm bash -c \
   'apt-get update -qq && apt-get install -y -qq procps && cd /repo && bash scripts/test.sh'
-# validado em 08/2026: 75/75 casos, 5/5 propriedades, 77/77 invariantes
+# validado em 08/2026: 86/86 casos, 5/5 propriedades, 77/77 invariantes
 ```
 
 A heurística .NET foi validada contra o SDK real (`mcr.microsoft.com/dotnet/sdk:8.0`
@@ -161,11 +161,15 @@ baseline quebrado não dá para separar o que a limpeza quebrou do que já estav
 quebrado, e como todo commit exige gate verde, nenhum deles aconteceria. A
 skill diz qual check falhou e para por aí.
 
-Stack sem nenhum arquivo de teste não conta como testado: o gate não roda a
-suíte vazia e o nível fica em YELLOW. Vale para Go e .NET sem arquivo de
-teste, para crate Rust sem `tests/*.rs` nem `#[test]`, e para pytest que sai
-5 sem coletar nada. Se a sua suíte mora fora do lugar padrão, a promoção é
-sua — o gate não se promove sozinho.
+Stack sem nenhum arquivo de teste não conta como testado: o gate não conta
+suíte vazia, seja porque não a rodou, seja porque rodou e não voltou nada, e o
+nível fica em YELLOW. Vale para Go e .NET sem arquivo de
+teste, para crate Rust sem `tests/*.rs` nem `#[test]`, para build Maven ou
+Gradle sem nenhum `src/test`, e para pytest que sai 5 sem coletar nada.
+Manifesto que está ali só por ferramenta — um `requirements.txt` do build da
+documentação, um `Gemfile` do fastlane — não é stack sem suíte: sem código
+daquela linguagem no repositório, o gate não fala dele. Se a sua suíte mora
+fora do lugar padrão, a promoção é sua — o gate não se promove sozinho.
 
 Em JS/TS o mesmo cap pega a suíte fatiada: sem script `test`, com `test:unit`
 e `test:e2e` no manifesto, nenhuma fatia responde pela suíte inteira e o gate
@@ -173,7 +177,11 @@ não conta nenhuma delas. Promover à mão aqui é o caminho errado, porque a
 suíte não está fora do lugar, está dividida; rode as fatias todas. Uma fatia
 sozinha vale como a suíte, com uma exceção: modo watch nunca termina, então o
 gate não o executa. `watch`, `ui` e `debug` são lidos como segmentos inteiros
-do nome, o que pega `test:watch:all` e deixa `test:watchdog` em paz.
+do nome, o que pega `test:watch:all` e deixa `test:watchdog` em paz. Só que não
+executar e não contar são coisas diferentes: `watch` e `debug` são um modo da
+suíte, então `test:watch` ao lado de um `test:unit` sozinho deixa essa fatia
+valendo como a suíte; `test:ui` pode muito bem ser uma suíte à parte, então ele
+não roda e mesmo assim conta, e aí `test:unit` ao lado dele já é uma divisão.
 
 Em repositório poliglota o cap sobrevive aos outros stacks. Go com testes ao
 lado de uma metade JS que ninguém contou ainda imprime `checks=typecheck,test`,
@@ -250,8 +258,9 @@ rollback joga fora foi ela mesma que criou.
 - A categoria de deps roda o install simples do gerenciador depois de podar o
   manifesto, então o lockfile é reescrito e o `node_modules` é resolvido de
   novo. Essa parte fica fora do rollback: o `git restore` traz de volta o
-  `package.json` e o lockfile, nunca a árvore instalada. Se uma categoria
-  falhar, rode o install outra vez.
+  `package.json` e o lockfile, nunca a árvore instalada. Se for essa categoria
+  que falhar, rode o install outra vez; as outras duas não mexem no manifesto e
+  não precisam.
 
 ## Créditos
 
diff --git a/SKILL.md b/SKILL.md
index 0fa36a8..d49c7f6 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -149,8 +149,15 @@ unlock dead-export deletion on code the other half covers — and a slice
 declared with an empty command still counts as one of them. A watch-mode slice
 never runs at all, because it does not exit: `watch`, `ui` and `debug` are
 matched as whole segments of the name, so `test:watch:all` is caught and
-`test:watchdog` is not. All of these print the `'test' not counted` line naming
-the slices, and so does a manifest that declares no test script at all. A split
+`test:watchdog` is not. Not running one and not counting one are separate
+questions. `watch` and `debug` name a mode of the suite — the same tests,
+started so they never stop — so a `test:watch` beside a lone `test:unit` does
+not split anything and the real slice is still the suite. `ui` is not a mode
+word: `vitest --ui` does not exit either, but `test:ui` is just as often a scope
+of its own, so it is never run *and* never leaves the count — `test:unit` next
+to `test:ui` is two slices, not one. All of these print the `'test' not counted`
+line naming the slices, and so does a manifest that declares no test script at
+all. A split
 suite is **not** promotable by hand: it is in the manifest, only divided, so
 run every slice before deciding.
 
@@ -314,22 +321,32 @@ of the user's.
 
 The one thing `-A` picks up that this step did not produce is knip's own
 output. Before the first category, put `knip-report.json` and
-`knip-report.json.tmp` in `.git/info/exclude` — repo-local, so the user's
-`.gitignore` stays untouched. Otherwise every category commits the report the
-previous one was read from, and the user reverting `chore: remove unused deps`
-gets a tool artifact back along with the dependencies.
+`knip-report.json.tmp` in the repo's exclude file — repo-local, so the user's
+`.gitignore` stays untouched. Ask git where it is rather than typing the path:
+`git rev-parse --git-path info/exclude`, because in a linked worktree, a
+submodule or a `--separate-git-dir` checkout `.git` is a *file* and appending to
+`.git/info/exclude` fails with `Not a directory`. Otherwise every category
+commits the report the previous one was read from, and the user reverting
+`chore: remove unused deps` gets a tool artifact back along with the
+dependencies.
 
 That exclude only reaches **untracked** paths. If a previous run of this skill
 already committed `knip-report.json`, git keeps staging it no matter what the
 exclude says, and the regeneration below puts a fresh diff in every category
 commit. Check with `git status --porcelain` after writing the exclude lines; if
-the report still shows up, untrack it in a commit of its own before the first
-category — `git rm --cached knip-report.json`, then `chore: untrack knip
-report`. Left staged, the next `git add -A` folds that deletion into the deps
-commit, and reverting the deps category hands the artifact back, which is the
-thing the exclude was for. On the way out, delete the report and drop the lines
-you added from `.git/info/exclude`: none of them is the user's, and the exclude
-makes the leftover invisible to `git status`, so nobody would find it later.
+the report still shows up, find out whose it is first — `git log -1 --format=%s
+-- knip-report.json`. A previous run of this skill left `chore:` there and the
+file is a tool artifact: untrack it in a commit of its own before the first
+category (`git rm --cached knip-report.json`, then `chore: untrack knip
+report`). Anything else means the user tracks it on purpose: leave it tracked,
+say so in the report, and expect the report's diff in each commit. Do not
+untrack it either way as part of another category — left staged, the next `git
+add -A` folds that deletion into the deps commit, and reverting the deps
+category hands the artifact back, which is the thing the exclude was for. On
+the way out, delete the report and drop from the exclude file only the lines
+you added — leave anything that was already there, it is the user's — because
+the exclude makes a leftover invisible to `git status` and nobody would find it
+later.
 
 One more thing `-A` can swallow, created by this step and not committed on
 purpose: `node_modules`, after the install below. Confirm the repo ignores it
@@ -364,10 +381,11 @@ bun install                          # bun
 Plain, never the frozen form. `--frozen-lockfile`, `--immutable` and the CI
 defaults that turn them on refuse a lockfile that no longer matches the
 manifest — which is exactly the state a correct prune produces, so a good
-deletion would come back as a red gate for the wrong reason. `npm ci` accepts
-the removal but never writes the lockfile, leaving a stale one in the commit.
-The updated lockfile goes in this category's commit: it is what carries the
-prune to every other machine.
+deletion would come back as a red gate for the wrong reason. `npm ci` is the
+same refusal under another name: it aborts with `EUSAGE` when `package.json`
+and `package-lock.json` are out of sync, and it never writes the lockfile, so
+it cannot get the prune out of this state either. The updated lockfile goes in
+this category's commit: it is what carries the prune to every other machine.
 
 **Regenerate the report between categories.** After each category's commit, run
 the 1.2 command again — same hardened form, same file — and read the next
diff --git a/references/phase-3-structure.md b/references/phase-3-structure.md
index 8ec5c63..5815b08 100644
--- a/references/phase-3-structure.md
+++ b/references/phase-3-structure.md
@@ -70,9 +70,12 @@ move. Do not fall back to `mv` plus `git rm`/`git add`: that is `rm` +
 Create exactly the directory the move lands in, and no others. Git tracks
 files, not directories, so a folder created for a move that never happened, or
 for a commit whose gate failed, is left behind as an empty untracked directory:
-`git restore --staged --worktree .` cannot remove it. Sweep the leftovers when
-a folder's commit does not land — `find src -type d -empty -delete`, or `rmdir`
-the path you just created.
+`git restore --staged --worktree .` cannot remove it. Sweep the leftover when a
+folder's commit does not land, by name: `rmdir` the path you just created (and
+`rmdir -p` if the move created parents, which stops at the first one that is not
+empty). Never a blanket `find ... -type d -empty -delete`: it also takes empty
+directories that were already there and are not yours to remove, and nothing in
+this pipeline can put them back.
 
 `git mv` preserves history. `rm` + `create` destroys that file's `git blame` —
 exactly the information someone will want six months from now when asking "why
diff --git a/scripts/gate.sh b/scripts/gate.sh
index 207b900..01ade63 100755
--- a/scripts/gate.sh
+++ b/scripts/gate.sh
@@ -3,6 +3,8 @@
 # Detects the stack from the root manifest (there may be more than one; runs all).
 # Requires bash (macOS 3.2 is fine). Usage: gate.sh [dir]
 # Output: "[gate] checks=..." lists what actually ran (compiling counts as typecheck).
+#   The verdict line below it is GREEN only when checks=typecheck,test AND every
+#   detected stack had a countable suite; otherwise it names the cap(s).
 # Exit 0 = everything that ran passed · 1 = some check failed ·
 # 2 = bad path (the argument is not a reachable directory: nothing was checked) ·
 # 3 = no runnable check OR a detected stack has no toolchain (PARTIAL) —
@@ -304,20 +306,28 @@ for (var i = 0; i < names.length; i++) {
     # stall for an exit 4 that reads as "the safety net could not be measured".
     # 'watch', 'ui' and 'debug' are matched as whole segments of the name, so
     # 'test:watch:all' and 'test:ui:headed' are caught too and 'test:watchdog'
-    # is not. Watch slices are still listed in the report, so the cap is
-    # explained instead of silent. Same reasoning as the 'tsc' exclusion above:
-    # a name that means "not a check" is not promoted to one.
+    # is not. Not running one and not counting one are two different questions,
+    # though: 'watch' and 'debug' name a *mode* of the suite — the same tests,
+    # started so they never exit — so they do not split it. 'ui' is not a mode
+    # word: 'vitest --ui' never exits either, but 'test:ui' is just as often a
+    # scope of its own that runs once, and the gate cannot tell. So it neither
+    # runs it nor lets it vanish from the count: a lone 'test:unit' beside a
+    # 'test:ui' is half a net, and half a net announced GREEN is the one thing
+    # this rule exists to deny. Slices are still listed in the report, so the
+    # cap is explained instead of silent. Same reasoning as the 'tsc' exclusion
+    # above: a name that means "not a check" is not promoted to one.
     # Echoes 'run:<name>'; 'partial:<names>' when two or more slices split the
-    # suite; 'watch:<names>' when every slice is watch mode; nothing at all when
-    # the manifest declares no test script.
+    # suite; 'watch:<names>' when no slice can be run at all; nothing at all
+    # when the manifest declares no test script.
     js_test_script() {
       node -e 'var s = require("./package.json").scripts || {};
 if (s.test) { console.log("run:test"); }
 else {
   var p = Object.keys(s).filter(function (k) { return k.indexOf("test:") === 0; });
-  var whole = p.filter(function (k) { return !/(^|:)(watch|ui|debug)(:|$)/.test(k); });
-  if (whole.length === 1) console.log("run:" + whole[0]);
-  else if (whole.length > 1) console.log("partial:" + whole.join(" "));
+  var slices = p.filter(function (k) { return !/(^|:)(watch|debug)(:|$)/.test(k); });
+  var runnable = slices.filter(function (k) { return !/(^|:)ui(:|$)/.test(k); });
+  if (slices.length === 1 && runnable.length === 1) console.log("run:" + runnable[0]);
+  else if (slices.length > 1) console.log("partial:" + slices.join(" "));
   else if (p.length > 0) console.log("watch:" + p.join(" "));
 }' 2>/dev/null
     }
@@ -344,8 +354,11 @@ else {
           uncounted_suite js "no 'test' script; test:* slices found (${js_test#partial:})" \
                    "none of them stands for the whole suite; run them by hand" ;;
         watch:*)
-          uncounted_suite js "no 'test' script; only watch-mode slices (${js_test#watch:})" \
-                   "a watch slice never exits; add a script that runs the suite once" ;;
+          # Not "only watch mode": a lone 'test:ui' lands here too, and it may
+          # well be a suite that runs once — the gate declines it because it
+          # cannot tell, not because it knows the script hangs.
+          uncounted_suite js "no 'test' script; no slice the gate will run (${js_test#watch:})" \
+                   "watch mode never exits and a 'ui' slice may not either; add a script that runs the suite once" ;;
         *)
           uncounted_suite js "no 'test' script in package.json" ;;
       esac
@@ -405,22 +418,43 @@ if [[ -f pyproject.toml || -f setup.py || -f setup.cfg || -f requirements.txt ]]
   if [[ -f pytest.ini || -d tests || -d test ]] || grep -qs '^\[tool\.pytest' pyproject.toml \
       || grep -qs '^\[tool:pytest\]' setup.cfg || grep -qs '^\[pytest\]' tox.ini; then
     py_run "test:5:python" python-tests pytest -q
-  else
+  # A cap only means something where there is Python to clean. requirements.txt
+  # is the loosest stack marker in this script — a docs build, a pre-commit pin,
+  # a deploy helper — and capping on it alone drags an otherwise green JS or Go
+  # repo down to YELLOW forever, for a "stack" that is one pip file. Same
+  # evidence rule as Go and Rust: a source file, not a manifest.
+  # Pruned, not filtered: a virtualenv holds thousands of .py files that are
+  # someone else's, and descending into it to reject them costs the walk anyway.
+  elif [[ -n $(find . \( -name .venv -o -name venv -o -name node_modules \
+        -o -name .git \) -prune -o -name '*.py' -print -quit 2>/dev/null) ]]; then
     uncounted_suite python "no pytest config and no tests/ directory"
   fi
 fi
 
 # --- JVM (pom.xml and/or build.gradle — hybrid repos run both) ---
+# 'mvn test' and 'gradle test' on a project with no test source exit 0 having
+# run nothing — the same trap as 'go test' on a repo with no _test.go, except
+# that 'run both' has already counted 'test' by the time it shows. Both runners
+# take the standard layout, so a src/test directory is the evidence; without one
+# the run is capped and can no longer be announced GREEN. target/, build/ and a
+# vendored node_modules are output or someone else's code, never evidence, and
+# they are pruned rather than filtered so the walk does not enter them at all.
+jvm_ran=0
 if [[ -f pom.xml ]]; then
-  if [[ -x ./mvnw ]]; then run both ./mvnw -q test
-  elif command -v mvn >/dev/null; then run both mvn -q test
+  if [[ -x ./mvnw ]]; then run both ./mvnw -q test; jvm_ran=1
+  elif command -v mvn >/dev/null; then run both mvn -q test; jvm_ran=1
   else missing pom.xml mvn; fi
 fi
 if [[ -f build.gradle || -f build.gradle.kts ]]; then
-  if [[ -x ./gradlew ]]; then run both ./gradlew test
-  elif command -v gradle >/dev/null; then run both gradle test
+  if [[ -x ./gradlew ]]; then run both ./gradlew test; jvm_ran=1
+  elif command -v gradle >/dev/null; then run both gradle test; jvm_ran=1
   else missing build.gradle gradle; fi
 fi
+if [[ $jvm_ran -eq 1 ]] && [[ -z $(find . \( -name target -o -name build \
+      -o -name node_modules -o -name .git \) -prune -o -type d -path '*/src/test' \
+      -print -quit 2>/dev/null) ]]; then
+  uncounted_suite jvm "no src/test directory found"
+fi
 
 # --- Ruby (Gemfile) ---
 if [[ -f Gemfile ]]; then
@@ -428,7 +462,14 @@ if [[ -f Gemfile ]]; then
     [[ -f sorbet/config ]] && run typecheck bundle exec srb tc
     if [[ -d spec ]]; then run test bundle exec rspec
     elif [[ -f Rakefile && -d test ]]; then run test bundle exec rake test
-    else uncounted_suite ruby "no spec/ and no Rakefile with test/"; fi
+    # Same evidence rule as Python: a Gemfile alone (fastlane, Jekyll, danger)
+    # in a repo of another stack is not a Ruby stack without a suite, it is not
+    # a Ruby stack. Capping on it would pin that repo below GREEN forever.
+    elif [[ -n $(find . \( -name vendor -o -name node_modules -o -name .git \) \
+          -prune -o \( -name '*.rb' -o -name '*.gemspec' \) \
+          -print -quit 2>/dev/null) ]]; then
+      uncounted_suite ruby "no spec/ and no Rakefile with test/"
+    fi
   else missing Gemfile bundler; fi
 fi
 
@@ -460,6 +501,7 @@ else
 fi
 if [[ ${#dotnet_targets[@]} -gt 0 ]]; then
   if command -v dotnet >/dev/null; then
+    dotnet_counted=0
     for target in "${dotnet_targets[@]}"; do
       # 'dotnet test' on a solution with no test project is a no-op that exits
       # 0 — same trap as 'go test' on a repo with no _test.go file.
@@ -482,14 +524,22 @@ if [[ ${#dotnet_targets[@]} -gt 0 ]]; then
         if [[ $has_tests -eq 1 ]]; then
           # shellcheck disable=SC2086  # same expansion, same reason
           run test dotnet test --nologo -v minimal ${dotnet_root_arg:+"$dotnet_root_arg"}
+          dotnet_counted=1
         else uncounted_suite dotnet "no test project found"; fi
       else
         run typecheck dotnet build --nologo -v minimal "$target"
         if grep -qsE "$DOTNET_TEST_MARKERS" "$target"; then
           run test dotnet test --nologo -v minimal "$target"
+          dotnet_counted=1
         else no_tests dotnet "no test project found in '$target'"; fi
       fi
     done
+    # The per-project caps above really are per project: one project without a
+    # test project next to one that has them is a covered stack. No project with
+    # tests at all is not — that is the stack having no countable suite, and the
+    # verdict has to hear about it, or another stack's 'test' carries this one
+    # to GREEN and phase 1.3 deletes dead exports here with nothing to catch it.
+    [[ $dotnet_counted -eq 0 ]] && uncounted=1
   else missing 'sln/csproj' dotnet; fi
 fi
 
@@ -514,11 +564,19 @@ if [[ $incomplete -eq 1 ]]; then
 fi
 if [[ $checks == "typecheck,test" && $uncounted -eq 0 ]]; then
   echo "[gate] GREEN"
-elif [[ $uncounted -eq 1 ]]; then
-  # checks= can read typecheck,test in a polyglot repo where one stack supplied
-  # the suite and another has none. That is not GREEN: the stack without a suite
-  # would have its dead exports deleted with nothing to catch the mistake.
-  echo "[gate] OK — a detected stack has no countable suite (see 'test' not counted above); YELLOW cap"
 else
-  echo "[gate] OK — only ran: $checks (missing full typecheck+test, YELLOW cap)"
+  # Two independent caps, and one run can hit both, so they are reported
+  # together: an if/elif dropped whichever came second. The first is a short
+  # checks= list. The second is that checks= can read typecheck,test in a
+  # polyglot repo where one stack supplied the suite and another has none —
+  # not GREEN either, because the stack without a suite would have its dead
+  # exports deleted with nothing to catch the mistake.
+  caps=""
+  if [[ $checks != "typecheck,test" ]]; then
+    caps="only ran: $checks (missing full typecheck+test)"
+  fi
+  if [[ $uncounted -eq 1 ]]; then
+    caps="${caps:+$caps; }a detected stack has no countable suite (see 'test' not counted above)"
+  fi
+  echo "[gate] OK — $caps — YELLOW cap"
 fi
diff --git a/scripts/gate_test.sh b/scripts/gate_test.sh
index e9fead3..2ad3893 100755
--- a/scripts/gate_test.sh
+++ b/scripts/gate_test.sh
@@ -282,6 +282,29 @@ EOF
 printf 'module f\n\ngo 1.21\n' > "$TMP/js-poly-uncounted/go.mod"
 printf 'package f\n' > "$TMP/js-poly-uncounted/x_test.go"
 
+# 'ui' is excluded from *running* like 'watch' and 'debug', but not from the
+# count: 'vitest --ui' never exits, yet 'test:ui' is just as often a scope of
+# its own. Counting it as a mode turned this manifest into a lone slice and
+# announced GREEN with the UI half never run.
+mkdir -p "$TMP/js-test-ui"
+cat > "$TMP/js-test-ui/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test:unit":"node -e \"console.log('UNIT_RAN')\"","test:ui":"node -e \"console.log('UI_RAN')\""}}
+EOF
+
+# ...and a lone 'test:ui' is neither run nor called watch mode: the gate declines
+# it because it cannot tell whether it exits, and says so.
+mkdir -p "$TMP/js-test-ui-only"
+cat > "$TMP/js-test-ui-only/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test:ui":"node -e \"console.log('UI_RAN')\""}}
+EOF
+
+# ...while a watch slice beside a lone real one is still just a mode of it, so
+# the real slice is promoted and the watch one is neither run nor counted.
+mkdir -p "$TMP/js-test-unit-watch"
+cat > "$TMP/js-test-unit-watch/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test:unit":"node -e 0","test:watch":"node -e \"setInterval(function(){},1000)\""}}
+EOF
+
 # Canonical and alias side by side: precedence says 'typecheck' wins and
 # 'type-check' never runs. The alias prints a marker so its silence is provable.
 mkdir -p "$TMP/js-alias-both"
@@ -337,9 +360,57 @@ mkdir -p "$TMP/dotnet-no-tests" "$TMP/dotnet-sub-no-tests/src/App"
 printf '<Project></Project>\n' > "$TMP/dotnet-no-tests/App.csproj"
 printf '<Project></Project>\n' > "$TMP/dotnet-sub-no-tests/src/App/App.fsproj"
 
-mkdir -p "$TMP/jvm-hybrid"
+# The standard layout is the JVM's evidence of a suite: 'mvn test' and 'gradle
+# test' exit 0 on a project with no test source, and 'run both' has counted
+# 'test' by then. The hybrid fixture carries src/test so it is a real green.
+mkdir -p "$TMP/jvm-hybrid/src/test/java"
 touch "$TMP/jvm-hybrid/pom.xml" "$TMP/jvm-hybrid/build.gradle"
 
+# ...and the same repo without it is the cap: the build still runs, the verdict
+# refuses GREEN. Two modules deep, because a multi-module repo has no src/test
+# at the root and the scan has to reach the ones that do.
+mkdir -p "$TMP/jvm-no-tests"
+touch "$TMP/jvm-no-tests/pom.xml"
+
+mkdir -p "$TMP/jvm-module-tests/mod-a/src/test/java" "$TMP/jvm-module-tests/mod-b/src/main/java"
+touch "$TMP/jvm-module-tests/pom.xml"
+
+# Polyglot: JS supplies typecheck+test, the .NET half has no test project in any
+# of its projects. Announcing GREEN off the JS suite would unlock dead-export
+# deletion over C# that nothing tested — the same hole js-poly-uncounted covers
+# for the JS side, on the per-project .NET path that used to skip the flag.
+mkdir -p "$TMP/dotnet-poly-uncounted/src/App"
+cat > "$TMP/dotnet-poly-uncounted/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test":"node -e 0"}}
+EOF
+printf '<Project></Project>\n' > "$TMP/dotnet-poly-uncounted/src/App/App.csproj"
+
+# A bare requirements.txt (docs build, a pre-commit pin) is the loosest stack
+# marker gate.sh has. Capping on it alone pinned an otherwise green repo below
+# GREEN forever, for a Python "stack" that is one pip file and no Python.
+mkdir -p "$TMP/py-reqs-no-source"
+cat > "$TMP/py-reqs-no-source/package.json" <<'EOF'
+{"name":"f","scripts":{"typecheck":"node -e 0","test":"node -e 0"}}
+EOF
+printf 'mkdocs\n' > "$TMP/py-reqs-no-source/requirements.txt"
+
+# ...and with actual Python next to it the cap is right and still fires.
+mkdir -p "$TMP/py-reqs-with-source"
+cp "$TMP/py-reqs-no-source/package.json" "$TMP/py-reqs-with-source/package.json"
+printf 'mkdocs\n' > "$TMP/py-reqs-with-source/requirements.txt"
+printf 'def f():\n    pass\n' > "$TMP/py-reqs-with-source/tool.py"
+
+# Same rule for Ruby: a Gemfile carrying only fastlane/Jekyll is not a Ruby
+# stack without a suite, it is not a Ruby stack.
+mkdir -p "$TMP/rb-gemfile-only"
+cp "$TMP/py-reqs-no-source/package.json" "$TMP/rb-gemfile-only/package.json"
+printf "source 'https://rubygems.org'\n" > "$TMP/rb-gemfile-only/Gemfile"
+
+mkdir -p "$TMP/rb-source-no-spec"
+cp "$TMP/py-reqs-no-source/package.json" "$TMP/rb-source-no-spec/package.json"
+printf "source 'https://rubygems.org'\n" > "$TMP/rb-source-no-spec/Gemfile"
+printf 'def f; end\n' > "$TMP/rb-source-no-spec/tool.rb"
+
 mkdir -p "$TMP/py-setupcfg/test"
 printf '[mypy]\n' > "$TMP/py-setupcfg/setup.cfg"
 touch "$TMP/py-setupcfg/test/test_x.py"
@@ -408,7 +479,7 @@ printf 'package f\n' > "$TMP/go-hang/x_test.go"
 
 # stubs ----------------------------------------------------------------
 OK="$TMP/stubs-ok"; FAIL="$TMP/stubs-fail"; HANG="$TMP/stubs-hang"; UV="$TMP/stubs-uv"
-for t in pytest mypy pyright dotnet mvn gradle; do stub "$OK" "$t" 0; done
+for t in pytest mypy pyright dotnet mvn gradle bundle; do stub "$OK" "$t" 0; done
 stub "$FAIL" dotnet 1
 stub_body "$HANG" go 'sleep 30'
 stub "$UV" uv 0
@@ -506,8 +577,12 @@ case_run js-alias-check-types 0 "$TMP/js-alias-check-types" - "run check-types"
          "checks=typecheck,test" "GREEN"
 case_run js-test-and-unit 0 "$TMP/js-test-and-unit" -         "run test$" \
          "checks=typecheck,test" "GREEN" '!run test:unit' '!ALIAS_TEST_RAN'
+# Two caps at once — a short checks= list and an uncounted suite — and the
+# verdict has to carry both on one line: an if/elif reported whichever came
+# first and dropped the other, and every other assertion here passed anyway.
 case_run js-test-slices   0 "$TMP/js-test-slices" -           "checks=typecheck$" "YELLOW" \
          "test:\* slices found (test:unit test:e2e)" "'test' not counted" \
+         "only ran: typecheck (missing full typecheck+test); a detected stack has no countable suite" \
          '!UNIT_RAN' '!E2E_RAN'
 case_run js-test-slices-only 3 "$TMP/js-test-slices-only" -   "no runnable checks" \
          "test:\* slices found" "'test' not counted"
@@ -518,11 +593,11 @@ case_run js-test-integration 0 "$TMP/js-test-integration" -   "run test:integrat
 # the regression costs a quarter of an hour before elapsed_lt can report it.
 GATE_ENV="GATE_TIMEOUT=20"
 case_run js-test-watch    0 "$TMP/js-test-watch" -            "checks=typecheck$" "YELLOW" \
-         "only watch-mode slices (test:watch)" "'test' not counted" '!run test:watch'
+         "no slice the gate will run (test:watch)" "'test' not counted" '!run test:watch'
 elapsed_lt js-test-watch-never-started 15
 GATE_ENV="GATE_TIMEOUT=20"
 case_run js-test-watch-nested 0 "$TMP/js-test-watch-nested" - "checks=typecheck$" "YELLOW" \
-         "only watch-mode slices (test:watch:all)" '!run test:watch:all'
+         "no slice the gate will run (test:watch:all)" '!run test:watch:all'
 elapsed_lt js-test-watch-nested-never-started 15
 case_run js-slice-empty   0 "$TMP/js-slice-empty" -           "checks=typecheck$" "YELLOW" \
          "test:\* slices found (test:unit test:e2e)" '!UNIT_RAN'
@@ -530,6 +605,18 @@ case_run js-typecheck-only 0 "$TMP/js-typecheck-only" -       "checks=typecheck$
          "no 'test' script in package.json" "'test' not counted"
 case_run js-poly-uncounted 0 "$TMP/js-poly-uncounted" "$GO:$PATH" "checks=typecheck,test" \
          "'test' not counted" "no countable suite" '!GREEN'
+case_run js-test-ui       0 "$TMP/js-test-ui" -              "checks=typecheck$" "YELLOW" \
+         "test:\* slices found (test:unit test:ui)" '!UNIT_RAN' '!UI_RAN' '!GREEN'
+case_run js-test-ui-only  0 "$TMP/js-test-ui-only" -          "checks=typecheck$" "YELLOW" \
+         "no slice the gate will run (test:ui)" "'test' not counted" \
+         '!UI_RAN' '!only watch-mode' '!GREEN'
+# Bounded like the other fixtures that hang for real: the promotion rule here is
+# about counting, but the slice it declines to run still never exits, so a
+# regression must cost 20s and not the default quarter of an hour.
+GATE_ENV="GATE_TIMEOUT=20"
+case_run js-test-unit-watch 0 "$TMP/js-test-unit-watch" -     "run test:unit" \
+         "checks=typecheck,test" "GREEN" '!run test:watch'
+elapsed_lt js-test-unit-watch-bounded 15
 case_run js-alias-both    0 "$TMP/js-alias-both" -            "run typecheck$" \
          "checks=typecheck,test" "GREEN" '!run type-check' '!ALIAS_TYPECHECK_RAN'
 case_run js-alias-red     1 "$TMP/js-alias-red" -             "RED at 'npm run test:unit'"
@@ -546,6 +633,20 @@ case_run dotnet-sln       0 "$TMP/dotnet-sln"   "$OK:$BASE" \
 case_run dotnet-two-slns  0 "$TMP/dotnet-two-slns" "$OK:$BASE" \
          "dotnet build --nologo -v minimal$" "checks=typecheck"
 case_run jvm-hybrid       0 "$TMP/jvm-hybrid"   "$OK:$BASE"   "mvn -q test" "gradle test" "GREEN"
+case_run jvm-no-tests     0 "$TMP/jvm-no-tests" "$OK:$BASE"   "mvn -q test" \
+         "no src/test directory found" "not counted" "no countable suite" '!GREEN'
+case_run jvm-module-tests 0 "$TMP/jvm-module-tests" "$OK:$BASE" "mvn -q test" "GREEN" \
+         '!not counted'
+case_run dotnet-poly-uncounted 0 "$TMP/dotnet-poly-uncounted" "$OK:$PATH" \
+         "checks=typecheck,test" "not counted" "no countable suite" '!GREEN'
+case_run py-reqs-no-source 0 "$TMP/py-reqs-no-source" -       "checks=typecheck,test" "GREEN" \
+         '!not counted'
+case_run py-reqs-with-source 0 "$TMP/py-reqs-with-source" -   "checks=typecheck,test" \
+         "no pytest config" "no countable suite" '!GREEN'
+case_run rb-gemfile-only  0 "$TMP/rb-gemfile-only" "$OK:$PATH" "checks=typecheck,test" "GREEN" \
+         '!not counted'
+case_run rb-source-no-spec 0 "$TMP/rb-source-no-spec" "$OK:$PATH" "checks=typecheck,test" \
+         "no spec/ and no Rakefile" "no countable suite" '!GREEN'
 case_run py-setupcfg      0 "$TMP/py-setupcfg"  "$OK:$BASE"   "checks=typecheck,test" "GREEN"
 case_run py-venv          0 "$TMP/py-venv"      "$BASE"       ".venv/bin/mypy" ".venv/bin/pytest" "GREEN"
 case_run py-no-tools      3 "$TMP/py-no-tools"  "$BASE"       "toolchain 'mypy' missing" "looked in"