docs(scripts): the swallow-family census reads the #12981 handover as landed, and cross-checks its copy of the gate vocabulary (#15459, #15473)

[claude]

Fixes #15459
Fixes #15473

One file, scripts/measure-durability-swallow-family.mjs — the #12981
programme's instrument of record. PR #15458 landed the handover that instrument
had reserved for the programme's LAST step (tryInsert/tryUpdate into the
gate's DURABILITY_CRITICAL_CALLEES) and PR #15472 closed the programme. Four
statements in this file still described both as pending, and nothing checked any
of them.

What changed

1. The header's "The handover" section is past tense and names the PRs that
   performed and closed the step (fix(scripts): durability gate — batch 10: declare the seeder wrappers in DURABILITY_CRITICAL_CALLEES (#12981) #15458, docs(runtime): keys.ts's catch annotation states its measured determination instead of promising a gate entry (#12981 batch 10b) #15472). The three ⛔ prohibitions it
   held are kept — they did not expire with the step, and two were re-affirmed by
   the ruling that closed the programme (The durability log-level gate cannot see the catch { return null; } seeder family — 15 files outside #12923's five, and neither widening path is cheap #12981 comment 5543738972, Q1 = A) — but
   they no longer read as "until then".
2. "an 18-entry DURABILITY_CRITICAL_CALLEES vocabulary" is now 20, which is
   what the gate declares. The sentence beside it — a seeder reaching storage
   through ql.insert(...) is not in that vocabulary — is untouched and still
   true.
3. tryInsert / tryUpdate move from origin: 'seed-wrapper' to
   'gate-vocabulary' in WRITE_SHAPED_CALLEES. After fix(scripts): durability gate — batch 10: declare the seeder wrappers in DURABILITY_CRITICAL_CALLEES (#12981) #15458 they ARE declared
   in the gate, so the census's gate/census OVERLAP reading has to say what the
   tree says. tryDelete was not part of the handover and stays seed-wrapper.
   This is a reading change, not a comment, and it is quoted before/after
   below.
4. The DETERMINED register row for
   packages/runtime/src/domains/keys.ts::handleKeysRequest no longer says the
   site is "waiting for" a FAILURE_PROPAGATION_SITES declaration; the Q1 = A
   ruling settled that none is owed there, ever. Prose in one why string: the
   row's anchor, verdict, scope and key are byte-identical, and the ablation
   below proves the row is still live over the file.
5. The by-value copy of the gate's vocabulary stays a copy — the header says
   why (importing a merge-blocking gate into a non-gate instrument) — but a
   by-value copy's failure mode is SILENCE, which is exactly how this file went
   stale under a green farm. readGateVocabulary() now PARSES the gate's own
   declaration (never imports it; the map is not exported) through the same
   parseSourceFile every other fact here is read with, and the --self-test
   cross-checks the gate-vocabulary subset against it in BOTH modes. It
   announces, never absorbs: drift reddens, and a person decides which side
   moved.

Declared beyond the two cards' letter: one more stale sentence, same defect

SELF_TEST_MODES's gated-subset note still called the handover "the ruling's
reserved handover step ... still gated on outstanding == 0". That is the
same future-tense-over-a-landed-step defect as item 1, in the same file, and its
correct form is pinned by the same landed evidence (#15458), so it is repaired
here rather than left as a fourth lie carrier inside the instrument the cards are
about. The instruction's force is unchanged — that subset is still never a route
to the handover — only its tense is.

The OVERLAP reading, before and after

Measured against this branch's fork point, 6c9f34f20 (a second checkout of that
commit, pnpm installed, so packages/** is held byte-identical and the only
variable is this file).

the OVERLAP	before	after
names labelled gate-vocabulary in WRITE_SHAPED_CALLEES	18	20
names the gate declares in DURABILITY_CRITICAL_CALLEES	20	20
the two sets are equal	no (tryInsert, tryUpdate missing)	yes, cross-checked on every --self-test
MEMBER sites whose guarded write resolves to a gate-vocabulary name	5 of 56	5 of 56
QUIET sites likewise	4 of 98	4 of 98

The site-side overlap does not move, and the reason is a number, not a hope:
0 member sites and 0 quiet sites resolve their guarded write through tryInsert
or tryUpdate on this tree. In this repo those two names are the ENCLOSING
functions of the seeder helpers, and the write inside them is ql.insert(...) /
ql.update(...) — origin: 'objectql'. The cross-file case the vocabulary entry
exists for (a caller awaiting an imported tryInsert) has no instance here. So
the relabel corrects the VOCABULARY side of the overlap, and moves no printed
row: all three readings are byte-identical across the change.

diff FORK_POINT.census.txt   BRANCH.census.txt   -> exit 0   # normal mode
diff FORK_POINT.sites.txt    BRANCH.sites.txt    -> exit 0   # --sites
diff FORK_POINT.json         BRANCH.json         -> exit 0   # --json

The self-test verdict line does change, by design — it now carries the
cross-check's count:

before: ... 3 DETERMINED register row(s) cross-check clean, 56 member site(s) total
after : ... 3 DETERMINED register row(s) cross-check clean, 20 copied gate-vocabulary
        name(s) match the gate's own declaration, 56 member site(s) total

Verification

All on the final commit — quoted per gate from its own printed verdict line, with
every exit code captured by redirecting to a file first and reading $? before
any pipe.

• node scripts/measure-durability-swallow-family.mjs exit 0 on the branch
  and exit 0 on the fork-point checkout; diff of the two normal-mode outputs
  exit 0 (also --sites exit 0, --json exit 0). See the table above.

• --self-test exit 0:
  ✓ measure-durability-swallow-family self-test: 4 positive control(s) yield members at their declared tier, 3 negative control(s) yield none, 2 regression control(s) stay clear, 6 resolution control(s) resolve as declared, 3 DETERMINED register row(s) cross-check clean, 20 copied gate-vocabulary name(s) match the gate's own declaration, 56 member site(s) total

• --self-test=gated / pnpm check:swallow-census-controls exit 0, same
  counts under the gated banner.

• pnpm check:durability-log-level exit 0 on both trees, output diff
  differing only in pnpm's own banner line naming the checkout directory. Verdict
  unchanged:

  ✓ durability-degradation log levels: 29 durability-critical catch seam(s), all
    loud, rethrowing or propagating to the caller (4 propagating, declared);
    2 counter-guarded summary report(s) outside a catch, all of them able to
    print against a sink with no `error` (#9748).
  

• The keys.ts register row is proved LIVE over the edited file, by ablation
  on the committed tree, trap-guarded (a trap on EXIT INT TERM that restores
  from HEAD) with
  absolute paths resolved from git rev-parse --show-toplevel:

  • mutation confirmed ON DISK before the run, by counting both markers:
    silent BY DESIGN 1 → 0, silent ON PURPOSE 0 → 1, and the blob hash moved
    (1408cfb2… → 510a2954…);
  • the census answered
    ✗ 1 STALE row(s) in the DETERMINED register … packages/runtime/src/domains/keys.ts::handleKeysRequest [anchor-gone],
    and the site went back onto the printed worklist;
    --self-test exit 1, --self-test=gated exit 1;
  • restore proved BY STATE, not by an exit code: restored blob
    1408cfb21954547ac6a1c8bd5a0e889e258f5ca8 equals the HEAD blob, git diff HEAD
    for that path is empty, and the marker counts are back at 1 / 0.

• Derived gate family — node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, no paths passed (it read the change set itself):
  25 commands, every one run, all exit 0. Including
  pnpm check:pm-dispatch-gates — ✓ dispatch-gates self-test: 1402 cases pass.
  (no case edited), pnpm check:nul-bytes —
  check-nul-bytes: OK (scanned 7498 text file(s) … no raw ASCII control bytes),
  pnpm check:ratchet-remedy-authority — 202 scripts swept,
  node scripts/check-self-test-wired.mjs —
  every one of the 169 script(s) CI runs that ship a --self-test has that self-test run by CI.

• Whole-repo pnpm lint (eslint . --no-inline-config) exit 0, run in full
  under this container's shared verify lock —
  os-verify-lock: VERDICT command-exit 0 · held the lock 88s (1m28s) · waited 129s (2m09s).
  No narrowing, so no narrowing evidence is owed. (A first attempt returned the
  wrapper's exit 99, VERDICT queue-timeout … never acquired; that is NOT
  MEASURED and is not counted anywhere above — the run quoted here is the one
  that acquired.)

• Control-byte self-scan of the edited file
  (grep -naP '[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]'): no hits.

• No test file is owed by this diff and none exists to re-run: the edited
  script has no *.test.* suite anywhere in the tree; its assertions are its own
  --self-test, which is run above in both modes and gained a leg. The only test
  that names it, packages/runtime/src/http-dispatcher.keys.test.ts, pins
  keys.ts delivery — a file this PR does not touch (proved by the restore
  above).

Changeset

skip-changeset: the diff is scripts/** only and publishes nothing.

Not done here

Not flipped to ready, no auto-merge — the PM reviews first.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

---

Generated by Claude Code

[claude]

ACCEPT — PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk.

Reviewed against the three-dot diff origin/main...claude/issue-15459-census-post-handover (merge base 6c9f34f20, head a841a374b): one file, scripts/measure-durability-swallow-family.mjs, +169/−18, matching the PR file list; delivered under the claim's ruling (5544724535).

• Removed-not-in-added: the only removed code rows are tryInsert / tryUpdate → seed-wrapper, re-added as gate-vocabulary (tryDelete stays, correctly — not part of the handover); the DETERMINED row's why prose loses the refused promise and gains the ruling's record; anchor / verdict / scope / key untouched and re-proved live by ablation ([anchor-gone], restore by blob hash).
• The by-value copy stays a copy; readGateVocabulary() PARSES the gate's DURABILITY_CRITICAL_CALLEES (never imports it), --self-test cross-checks the copy in both modes, an unreadable declaration is a FAILURE not "no names", and a negative leg proves the comparison fires — announce, never absorb.
• Overlap reading: vocabulary side 18 → 20 (set-equal to the gate), printed rows unchanged (0 member / 0 quiet sites resolve through the wrappers); normal, --sites and --json diffs against the fork point exit 0. Header and SELF_TEST_MODES note in the past tense with PR numbers (the latter declared as an in-place extension beyond the cards' letter — same defect class, same file, accepted).
• Derived family 25/25 green incl. dispatch-gates 1402/1402, check:swallow-census-controls, whole-repo lint. Hot-file scan: docs(scripts): the swallow-family census reads the #12981 handover as landed, and cross-checks its copy of the gate vocabulary (#15459, #15473) #15502 is the only open PR on the census. skip-changeset is right.

Fixes #15459 / Fixes #15473 close both cards on merge. #15503 (the printed empty-worklist line still saying "unblocked") is graded on the card. Flip + arm follow as soon as the MCP channel recovers from its rate limit (REST cannot flip a draft on this seat).

---

Generated by Claude Code