fix(gates 50/57/60/62): the exemption list was the defect in all four

[rubenvdlinde]

The pattern

Four gates, one shape: the detection logic was sound in every case and the vocabulary or exemption list was what made the gate quiet. Each defect below was reproduced on a repo-shaped fixture with the prediction written down first, and each fix was measured on real repos against origin/main at 57bcb2b.

Note on reading the numbers: they are written as prose and plain tables on purpose. This PR's description is echoed into the gates log via the workflow env: block, so pasting verdict-shaped lines here would plant them inside the artefact meant to prove the fix.

gate-60 icon-vocabulary — half the gate was unreachable code

All ten entries in CONCEPT_LABELS resolved to Tier A concepts, while the vocabulary ships 140 Tier B ones. The Tier B warning branch could not execute for any input at all. Across fourteen repos and 417 manifests it had produced zero warnings, ever, so a green verdict said nothing about 140 of 153 concepts. Three Tier A concepts were dead the same way, and those are MUSTs.

The label table is now derived from the vocabulary itself, so a concept is reachable by its own name and adding one to the schema makes it enforceable. The hand-written map survives as a synonym layer for Dutch spellings and abbreviations. Fleet effect: warnings nought to sixty-two, and one new failure which is a true positive (a schema labelled Audit-trail drawing the wrong glyph).

Also narrows the missing-toolchain skip. Only a non-vocabulary icon name actually needs the library, so an all-vocabulary app now gets a real verdict with no npm ci — which is the part of "this gate went unrun" that lives in the checker rather than the workflow.

gate-57 orphaned-write-capability — the verb list is the whole detector

Everything else in that module only removes findings, so a missing verb is not a weaker check but no check. Measured on a controlled probe: four zero-caller write methods on one service, one reported.

Every candidate verb was measured across twelve repos before inclusion and every finding it produced was read. Three were measured and rejected — apply, process and register — with their costs recorded in the code. One measured false positive, a pure schedule() accessor returning a depreciation table, drove a prefix-only rule for noun-shaped verbs. Fleet effect: forty-one to seventy-five, matching the prediction exactly.

gate-50 security-config-fail-mode — blind in the app it was built for

The accepted app-id shapes let it pass over sixteen unguarded reads of the opencatalogi#86 keys, in opencatalogi, because the app id is spelled $this->appName rather than a literal.

The earlier attempt at this widening was backed out for noise, and the code carried a comment blaming the app-id shape. That diagnosis was wrong. The noise comes from the read sitting in an array-literal value position, where none of the six remedies this gate recognises can be written — no local variable, no statement slot. The two populations separate perfectly on that one syntactic fact: every one of the forty-eight noisy new findings is in that position and none of the sixteen real ones is.

So the app id is widened and the position is exempted instead. Demoted reads are written to a notes sidecar with file, line and key, so "the gate saw it and demoted it" stays checkable rather than becoming a silence. This does stop twenty-one currently-failing findings from failing; all twenty-one were read and all sit inside single return [...] config-assembly literals.

gate-62 store-plane — an undeclared divergence, now decided

gate-60 and gate-62 disagreed about whether a type: "caption" node is a menu entry. On one fixture, gate-60 found nothing and gate-62 failed twice.

Decided against the renderer rather than by aligning whichever was easier to change. CnAppNav.vue passes a caption only its label and a test id — no icon slot, no route, no children loop — its docblock states that captions ignore icon, route and children, and the manifest schema says the same independently. Every rule in check_store is a claim about a rendered icon or a resolved route, so gate-60 was right. gate-62 is aligned to it, and gate-60 now warns about the dead keys so the information is not merely dropped.

Scoped deliberately: the decision covers icon and route rules only. A caption's label is rendered, so gate-63 keeps walking captions and there is an arm pinning that.

Live exposure is zero — a positive-controlled census of 145 manifests found one caption node and none carrying a dead key. This corrects a latent contradiction, not a live count.

Acceptance arms

test_check_icon_vocabulary.py is new — gate-60 had no test suite at all — and is auto-discovered by run-helper-suites.sh. New classes were also added to the gate-57 and gate-62 suites, and the gate-50 boundary arms in test_gate_45_to_55_acceptance.sh were rewritten with the measurement in the comment, which is what the old arm's own comment asked for.

Every new arm was verified able to fail by running it against the pristine 57bcb2b checkers: seven of nineteen red for gate-60, four for gate-57, two for gate-62, and exactly the arms that should be. The anti-widening and regression arms stay green on both sides. The full package suite and the 45–55 acceptance suite are green on the final state.

Reviewer notes

• Merge conflict expected in run-hydra-gates.sh. gate-50's checker is a heredoc inside that file, which another agent is editing this session. I touched only the gate-50 heredoc — no scope resolution, no verdict wiring, no other gate. Please resolve in favour of both changes rather than taking a side.
• Worth doing later: extract gate-50's checker into scripts/lib/ like every other gate, so it can be unit-tested directly.
• Full findings, including everything I could not verify: fleet-board/findings/gates-exemption-fix.md.

🤖 Generated with Claude Code