[finding] Nothing gates the working tree staying clean, so a task that writes an untracked non-ignored file leaks silently

[claude]

What

Context: #10249 — a next dev boot writes untracked, non-gitignored apps/docs/AGENTS.md
and apps/docs/CLAUDE.md. That instance was found by eyeballing git status, not by any
check in this repo.

Measured on origin/main @ 01c50322a1:

• Root package.json declares 86 check:* scripts, and scripts/pm/dispatch-gates.mjs
  discovers 127 gate families across 26 workflow files. None asserts that the working tree
  is clean.
• grep -rn "git status --porcelain|git diff --exit-code|git diff --quiet" .github/workflows/ scripts/
  hits only scripts/pm/os-regen-merge.sh (an agent helper) and
  scripts/docs-audit/affected-docs.mjs (a probe). No workflow step, no gate.
• ls scripts/ | grep -iE 'clean|dirty|untracked|worktree' matches nothing.

Why it may be worth a card

A repo task that writes an untracked, non-ignored file into the working tree produces no
failure anywhere — not in pnpm build, not in pnpm test, not in CI. The file simply
waits for someone's git add -A.

The machinery already exists: scripts/check-nul-bytes.mjs computes exactly this
population and prints it. On a clean tree it reported
scanned 6237 text file(s) -- 6237 tracked, 0 untracked-not-ignored. A gate asserting that
the untracked-not-ignored set does not grow across a build / test run would close the
class for CI-reachable tasks.

Scope limit, stated up front

This would not have caught the next dev instance: CI never boots a dev server, so
those files never appear there. It would cover build/test-time generators only. Whether
that residual class earns a gate is the triage call — the observation recorded here is that
the class currently has zero coverage, not that a gate is obviously warranted.

What was measured clean

A full pnpm install in a fresh worktree ran every prepare / postinstall hook across
all 78 workspace projects (including scripts/setup-git-hooks.mjs and the apps/docs
fumadocs-mdx postinstall) and left git status --porcelain empty. Install-time is clean.
pnpm build and pnpm test were not run repo-wide, so build/test-time is unmeasured
rather than known-clean.

---

Generated by Claude Code

[huangyiirene]

Triage (finding round): closing not planned — the card's own scope-limit paragraph decides it. The proposed gate would not have caught the one measured instance (#10249's next dev writes; CI never boots a dev server), install-time was measured clean across all 78 projects, and build/test-time has zero observed instances — so this is a gate with a measured-empty population guarding against a hypothetical, at gate-farm carrying cost. Startup-stage default applies: an ability with no pull is deferred, not declared. Reopening is free and warranted the day a build/test-time generator leak is actually measured — file that evidence here and this converts straight to a queue card (the check-nul-bytes.mjs population machinery the card identified remains the right instrument). Maintainer may veto by reopening.

---

Generated by Claude Code