feat(pm): wide-population, a third dispatch-gates derivation channel

scripts/check-init-service-contract.mjs

@@ -78,6 +78,8 @@
  *     node scripts/check-init-service-contract.mjs --self-test # verify the checker
  */
 
+// dispatch-gates: wide-population -- walk(join(ROOT, 'packages')) admits every non-test .ts source under the packages root -- 2182 of 5837 tracked files (37.4%, base 2aa8456cf), recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE in scripts/pm/bare-root-worklist.mjs. The population is not a part of that root, it IS every source in it, so the only true subtree spelling is the bare root -- which would name this gate on every card touching a package. lint.yml carries no paths filter, so CI runs it on every PR regardless.
+
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-live-db-isolation.mjs

@@ -55,6 +55,8 @@
 // `--self-test`, and a live file whose DDL it cannot parse at all is reported,
 // never skipped.
 
+// dispatch-gates: wide-population -- ROOTS is packages, apps and examples, each walked recursively for every .ts/.mts source that is not a .d.ts -- 5269 of 5837 tracked packages/ files (90.3%, base 2aa8456cf), recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE in scripts/pm/bare-root-worklist.mjs. Whole-tree-adjacent across three top-level roots at once: the only spelling true of it is each bare root, which would name this gate on every card touching packages, apps or examples.
+
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-meta-type-normalized.mjs

@@ -78,6 +78,8 @@
  * A new entry needs a reason a reader can check, not a name.
  */
 
+// dispatch-gates: wide-population -- SCAN_DIRS is packages/rest/src, walked for non-test TypeScript sources only. The DIRECTORY is narrow enough to name and the glob would still be false six times in seven: that tree is 133 test files to 21 sources -- 21 of 154 (14%). What cannot be spelled here is the file-KIND filter, not the subtree, which is why the recorded verdict in scripts/pm/bare-root-worklist.mjs is REFUSE-UNSPELLABLE rather than REFUSE-WIDE.
+
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-optional-error-sink-contract.mjs

@@ -228,6 +228,8 @@
  * numbers in this header are stated with the tree they were measured on.
  */
 
+// dispatch-gates: wide-population -- SCAN_ROOTS is packages, walked for every non-test .ts source under it -- 1898 of 4903 (39%), recorded REFUSE-WIDE in scripts/pm/bare-root-worklist.mjs. The population is not a part of that root, it IS every non-test source in it, so a true declaration would name this gate on every card touching a package. This gate's own failure text already prints the subtree spelling, which is how close the shape sits to declaring itself by accident.
+
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-resume-authority-declared.mjs

@@ -102,6 +102,8 @@
 // JSON Schema, and it cannot tell which literal a match belongs to. Object
 // structure decides this, so the checker reads structure.
 
+// dispatch-gates: wide-population -- DEFAULT_SCAN_ROOTS is packages and examples, walked for every non-test TypeScript source -- 1898 of 4903 (39%) and 162 of 238 (68%), recorded REFUSE-WIDE in scripts/pm/bare-root-worklist.mjs on both halves. Refused together rather than split: declaring only the smaller root would read as a claim about where this gate bites, which is exactly what is not known.
+
 import { readFileSync, readdirSync } from 'node:fs';
 import { join, dirname, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-runner-env-posture.mjs

@@ -71,6 +71,8 @@
  * deleting the explanation is how the next author re-introduces the defect.
  */
 
+// dispatch-gates: wide-population -- SCANNED_ROOTS is packages, apps and examples, walked for non-test source beneath a src SEGMENT -- 1812 of 5241 (35%) under packages, 150 of 241 (62%) under examples, and MEASURED AT ZERO (0 of 35) under apps, which has no src tree today. Recorded REFUSE-UNSPELLABLE in scripts/pm/bare-root-worklist.mjs on all three: the narrowest live subtree spelling covers 4291 files to reach 1812 (42%), and 2466 of the files it over-names are the test files this gate deliberately skips -- the one filter no glob idiom can spell.
+
 import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import { join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-settings-bind-window.mjs

@@ -104,6 +104,8 @@
  *     node scripts/check-settings-bind-window.mjs --self-test # verify the checker
  */
 
+// dispatch-gates: wide-population -- walk(join(ROOT, 'packages')) admits every non-test .ts source under the packages root -- 2182 of 5837 tracked files (37.4%, base 2aa8456cf), recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE in scripts/pm/bare-root-worklist.mjs, the identical corpus its three census siblings walk. The population is every source in that root, so the only true subtree spelling is the bare root and it would name this gate on every card touching a package.
+
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-startup-registry-verdict.mjs

@@ -141,6 +141,8 @@
  * Deliberately no optional-root flag — see `assertRootsResolvable`.
  */
 
+// dispatch-gates: wide-population -- the scan root is join(ROOT, 'packages') and the walk admits every non-test .ts source under it -- 2182 of 5837 tracked files (37.4%, base 2aa8456cf), recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE in scripts/pm/bare-root-worklist.mjs. The population is every source in that root, so the only true subtree spelling is the bare root and it would name this gate on every card touching a package. (--packages-dir retargets that walk for the self-test fixture; the CI invocation walks the repo's own packages root.)
+
 import {
     existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync,
     writeFileSync,

scripts/check-verify-stand-in-erasure.mjs

@@ -69,6 +69,8 @@
 // through a typed helper is out of reach here exactly as it is for the ESLint
 // rule, and is stated in that rule's comment rather than implied.
 
+// dispatch-gates: wide-population -- SCAN_ROOTS is packages and examples, walked for every non-test TypeScript source -- 1898 of 4903 (39%) and 162 of 238 (68%), recorded REFUSE-WIDE in scripts/pm/bare-root-worklist.mjs on both halves. Refused together rather than split, for the reason recorded there: declaring only the smaller root would read as a claim about where the stand-ins land.
+
 import { readFileSync, readdirSync, existsSync, statSync } from 'node:fs';
 import { join, dirname, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/check-wildcard-fallthrough.mjs

@@ -74,6 +74,8 @@
  *     node scripts/check-wildcard-fallthrough.mjs --self-test # verify the checker
  */
 
+// dispatch-gates: wide-population -- walk(join(ROOT, 'packages')) admits every non-test .ts source under the packages root -- 2182 of 5837 tracked files (37.4%, base 2aa8456cf), recorded REFUSE-WIDE in CENSUS_REFUSE_WIDE in scripts/pm/bare-root-worklist.mjs. The population is not a part of that root, it IS every source in it, so the only true subtree spelling is the bare root and it would name this gate on every card touching a package.
+
 import { readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';

scripts/pm/bare-root-worklist.mjs

@@ -70,12 +70,14 @@ import { isEntrypoint } from '../invoked-as.mjs';
 import { auditSource } from '../check-watch-hint-literal.mjs';
 import {
   collapseHint,
+  declaredWidePopulation,
   discoverFamilies,
   extractWatchHints,
   hintCovers,
   maskComments,
   maskSelfTests,
   trackedFiles,
+  widePopulationRefusal,
 } from './dispatch-gates.mjs';
 
 const ROOT = new URL('../..', import.meta.url).pathname;
@@ -1345,7 +1347,14 @@ export function sweep(families, files, { restrict = true } = {}) {
     for (const file of entry.files ?? []) {
       const abs = join(ROOT, file);
       if (!existsSync(abs)) continue;
-      const body = maskSelfTests(maskComments(readFileSync(abs, 'utf8')));
+      // The RAW source, read once and used twice. The literal sweep below needs
+      // it masked; the `wide-population` marker (#15341) is a COMMENT, so it
+      // only exists in the unmasked text -- reading it off `body` would find
+      // nothing, every row would read as undeclared, and the acceptance below
+      // would be silently vacuous rather than measurably so.
+      const raw = readFileSync(abs, 'utf8');
+      const wideDeclared = declaredWidePopulation(raw) !== null;
+      const body = maskSelfTests(maskComments(raw));
       const spans = restrict ? populationSpans(body) : [];
       for (const { word, index } of bareRootLiterals(body, dirs)) {
         let constant = null;
@@ -1355,7 +1364,7 @@ export function sweep(families, files, { restrict = true } = {}) {
           constant = span.name;
         }
         const key = restrict ? rowKey({ file, constant, word }) : `${file} ${word}`;
-        if (!byKey.has(key)) byKey.set(key, { file, constant, word, checks: [], coveringChecks: 0, key });
+        if (!byKey.has(key)) byKey.set(key, { file, constant, word, checks: [], coveringChecks: 0, key, wideDeclared });
         const row = byKey.get(key);
         if (row.checks.includes(check)) continue;
         row.checks.push(check);
@@ -1368,6 +1377,47 @@ export function sweep(families, files, { restrict = true } = {}) {
     .sort((a, b) => a.key.localeCompare(b.key));
 }
 
+/**
+ * The rows a recorded verdict CONTRADICTS — pure, so the live sweep and the
+ * fixture cases beside it cannot disagree about what a contradiction IS.
+ *
+ * A row is contradicted when the sweep now finds it REACHABLE and a verdict is
+ * still recorded for it: the row then asserts both that the population is
+ * reachable by declaration and, in its own recorded reason, that it is not.
+ *
+ * ## The `wide-population` marker is the deliberate-declaration form (#15341)
+ *
+ * The message below has always offered two honest resolutions, and the second
+ * is "withdraw the VERDICT, if the declaration is deliberate". That resolution
+ * cost the row: withdrawing a verdict on a shrink-only map leaves the row
+ * printing REACHABLE with no reason under it, and a refusal that was measured
+ * per row stops being readable anywhere. Maintainer ruling, 2026-09-05
+ * (decision batch #43, verbatim reply 「同意」): `dispatch-gates.mjs` gains a
+ * third derivation channel, `wide-population`, the refused families move onto
+ * it, and ⛔ this file's rows are NOT deleted.
+ *
+ * So the marker IS that deliberate-declaration form, and it resolves the
+ * contradiction without withdrawing anything: a gate carrying it has declared,
+ * in its own source, the very fact the verdict records — that CI runs it over a
+ * population no subtree glob places. The two halves stop contradicting because
+ * they are now the same statement said twice, in the two places that need it,
+ * and the row keeps its measured reason where a reader can still find it.
+ *
+ * ⛔ What it is NOT is an escape from the refusal it accompanies. A gate that
+ * declares a real subtree hint reaching an arbitrary file at the top of the
+ * root is contradicted exactly as before, marker or no marker — that gate has
+ * taken the declaration the verdict refused, which is the FIRST resolution and
+ * a different decision. The marker resolves the pair only by agreeing with the
+ * verdict; a hint disagrees with it, and disagreement is what this assertion is
+ * for.
+ */
+export function contradictedRows(rows, triage = TRIAGE) {
+  return rows
+    .filter((r) => r.covered && triage.has(r.key) && !r.wideDeclared)
+    .map((r) => `${r.key} [recorded ${triage.get(r.key).verdict}]`)
+    .sort();
+}
+
 function report({ wide = false } = {}) {
   const files = trackedFiles();
   const families = [...discoverFamilies().byCheck];
@@ -1757,10 +1807,7 @@ function selfTest() {
   // can honestly wear any of the three, and choosing between the two honest
   // resolutions RE-DECIDES a verdict on a shrink-only map — not something this
   // assertion may do quietly, so it names both and picks neither.
-  const contradicted = rows
-    .filter((r) => r.covered && TRIAGE.has(r.key))
-    .map((r) => `${r.key} [recorded ${TRIAGE.get(r.key).verdict}]`)
-    .sort();
+  const contradicted = contradictedRows(rows);
   t(`no recorded verdict sits on a row the sweep now finds REACHABLE${contradicted.length
     ? ` — CONTRADICTED: ${contradicted.join(' · ')}. That gate now declares a hint reaching an `
       + 'arbitrary file at the top of the root, so the row claims BOTH that the population is '
@@ -1773,9 +1820,62 @@ function selfTest() {
       + 'REACHABLE with no reason beneath it: that is the shrink this map already permits, and the '
       + 'seven reachable rows carrying no verdict today are its live shape. ⛔ Do NOT re-point the '
       + 'row at DECLARED-NARROWER: that verdict is defined for a row that stays UNCOVERED, and a '
-      + 'covered row is the bare root wearing a glob, not a narrower subtree.'
+      + 'covered row is the bare root wearing a glob, not a narrower subtree. A THIRD resolution '
+      + 'exists since 2026-09-05 and costs the row nothing: the gate declares `dispatch-gates: '
+      + 'wide-population -- REASON` in its own source, which AGREES with the refusal instead of '
+      + 'overriding it, and `contradictedRows` excuses the pair without any verdict being withdrawn.'
     : ''}`, contradicted.length === 0);
 
+  // The `wide-population` acceptance (#15341), both directions, on fixtures —
+  // because the live direction is VACUOUS on this tree and saying so is the
+  // point: no covered row carries the marker today, so a live-only pin would be
+  // an assertion over an empty set that reads exactly like a pass. The fixtures
+  // are what make the rule falsifiable, and the control under them names the
+  // gate that owns the shape this one excuses.
+  t('a covered row whose gate DECLARES a wide population is accepted — the deliberate-declaration form, '
+    + 'agreeing with the recorded refusal rather than withdrawing it',
+    contradictedRows(
+      [{ key: 'k', covered: true, wideDeclared: true }],
+      new Map([['k', { verdict: 'REFUSE-WIDE' }]]),
+    ).length === 0);
+  t('…and a covered row with NO such declaration is still CONTRADICTED — the refusal this assertion '
+    + 'has always made, unmoved by the acceptance above',
+    (() => {
+      const out = contradictedRows(
+        [{ key: 'k', covered: true, wideDeclared: false }],
+        new Map([['k', { verdict: 'REFUSE-WIDE' }]]),
+      );
+      return out.length === 1 && out[0].includes('REFUSE-WIDE');
+    })());
+  t('an UNCOVERED row is contradicted by neither — the marker changes nothing about a row that was '
+    + 'never reachable, which is every row this map actually holds today',
+    contradictedRows(
+      [{ key: 'k', covered: false, wideDeclared: false }, { key: 'j', covered: false, wideDeclared: true }],
+      new Map([['k', { verdict: 'REFUSE-WIDE' }], ['j', { verdict: 'REFUSE-UNSPELLABLE' }]]),
+    ).length === 0);
+  // The handoff. The shape excused above — a marker sitting above a hint that
+  // reaches the top of the root — is not unowned: `dispatch-gates` REFUSES it,
+  // in the file that owns markers, as a gate claiming two population shapes at
+  // once. This assertion excuses it HERE only because naming it here would name
+  // it wrongly, as a verdict problem rather than a declaration problem.
+  t('the excused shape is refused by the gate that owns markers, so no configuration is excused by both',
+    (widePopulationRefusal({ widePopulationReason: 'walks packages entire', hints: ['packages/**'] }) ?? '')
+      .includes('NAMES paths'));
+  t('CONTROL: and that refusal really can come back null, so the pin above is discriminating',
+    widePopulationRefusal({ widePopulationReason: 'walks packages entire', hints: [] }) === null);
+  // The live direction, stated as the measurement it is rather than left to
+  // read as a silent pass: this tree has no covered row carrying the marker, so
+  // the acceptance above is currently doing nothing to the report — which is
+  // exactly what "the rows are not deleted" was ruled to mean.
+  const wideCovered = rows.filter((r) => r.wideDeclared && r.covered).map((r) => r.key).sort();
+  const wideRows = rows.filter((r) => r.wideDeclared).map((r) => r.key).sort();
+  t(`the ten declaring gates reach ${wideRows.length} row(s) here and ${wideCovered.length} of them is covered, so the `
+    + 'acceptance withdraws no verdict on this tree — every recorded refusal still prints against its row'
+    + (wideCovered.length ? ` — covered-and-declared: ${wideCovered.join(' · ')}` : ''),
+    wideCovered.length === 0);
+  t(`control: the marker IS being read off the live sweep (${wideRows.length} row(s) carry it), so the case above is `
+    + 'measuring something rather than reporting a field nothing ever sets', wideRows.length > 0);
+
   // The spelling rule the triage docblock states, held mechanically: a key
   // spelled as a bare path would enter this file's own declared population.
   const asHints = (s) => extractWatchHints(`const L = ${JSON.stringify(s)};`);
@@ -2073,7 +2173,10 @@ function selfTest() {
   }
   console.log(
     `OK  self-test: ${rows.length} live row(s), ${open.length} unreachable as spelled, `
-      + `${TRIAGE.size} recorded verdict(s) — none stale, none missing, none contradicted. `
+      + `${TRIAGE.size} recorded verdict(s) — none stale, none missing, none contradicted `
+      + `(${rows.filter((r) => r.wideDeclared).length} row(s) whose gate carries the dispatch-gates `
+      + 'wide-population declaration, the deliberate-declaration form this file accepts without '
+      + 'withdrawing a verdict; none of them is covered, so none is excused by it today). '
       + `Each row is one literal in one gate source file: ${perInvocation.size} invocation(s) of `
       + `those literals fold onto them, ${twins} of them as twins of a row that already existed, `
       + "and no folded row's invocations disagree about reachability. "