fix(gates 12-22): four gates could not detect the defect they exist for, and gate-20 had never fired at all

[rubenvdlinde]

What was measured

Every gate in the 12–22 band was given one textbook true positive of exactly what it exists to catch, in a real fleet repo whose shape suits it; then the plant was removed and the gate had to return to its exact prior verdict, and a clean repo had to stay clean. Three further arms were added after the earlier bands showed a plant cannot see them: break the interpreter, run against a repo whose subject the gate cannot see, and read the exit byte on a many-finding run.

Final measurement at [hydra-gates] gate package: ff8869d17ed38fbc52b746f99c6ca89abaf841d0 (this branch, merged with 48c88ba). Earlier arms measured at cdfbd7a, fef032b and 34370f6; each defect below is quoted with the sha it was measured at.

Repo shapes — two per gate where behaviour can differ by shape:

Repo	Shape	Why it matters here
openregister	hand-declared appinfo/routes.php, 207 .vue, 794 spec scenarios, register JSONs	the conventional shape
shillinq	ADR-040 AppHost adopter — Routes::standard(), keeps its own SettingsController	decisive for gate-14/#265
pipelinq	hand-declared routes, six type:"dashboard" pages	gate-15's subject
nldesign-shaped fixture	src/ holding one manifest.json	gates 12/13 zero-.vue
gates-23-33/planted (this package)	DI-bound AppHost\Controller\GenericHealth	gate-14 path derivation

Gate	Planted true positive	Fired?	Repaired
12 nc-input-labels	<NcSelect :reduce="(o) => o.value" />, no input-label	✅	➕ na not PASS on zero-.vue src/
13 modal-isolation	inline <NcModal> in src/views/	✅	➕ same
14 route-reachability	(a) unrouted method (b) route→missing method (c) settings#update deleted from an AppHost adopter (d) DI-bound AppHost\Controller\GenericHealth	✅ ✅ ❌ ❌	✅ #265 closed + PSR-4 path
15 dashboard-antipattern	<CnDashboardPage> in a #widget-<id> slot	✅	✅ crashed checker; attribute-order
16 spec-coverage	changed method with no @spec; deleting an existing @spec	✅ ❌	✅ crashed checker; tag-deletion
17 redundant-controller	fetchAll() { return new JSONResponse($this->objectService->findAll([])); }	❌ PASS	✅ two causes
18 notification-dialect	legacy dialect in a register JSON	✅ (7 tokens)	✅ crashed checker
19 e2e-coverage	new #### Scenario: with no @e2e	✅	✅ crashed checker
20 or-objectservice-api	$this->objectService->findObjects(...)	❌ — had never fired anywhere, ever	✅
21 conflict-markers	real markers in lib/*.php	✅ — and not on a .md documenting them	—
22 manifest-validation	invalid page type + additional property	✅	✅ verdict depended on checkout layout

Seven defects

1. gate-20 had never fired. Not rarely — never. Its pattern expands to ->findObjects\(, which begins with -, so grep parses it as options (grep: invalid option -- '>', exit 2). 2>/dev/null || true discarded the message and the status, so every file returned zero hits and the gate printed PASS fleet-wide.

Repairing the grep alone is not the fix: the receiver test was "the file mentions ObjectService somewhere", which with a working grep yields 14 false findings on openregister and 5 on shillinq — createFromArray() is a real method on OpenRegister's Mappers. The receiver is now part of the pattern. Measurement across all three repos afterwards: one finding, and it is real — shillinq's BookingNotificationController resolves OCA\OpenRegister\Service\ObjectService from the container inside its non-admin authorisation guard and calls findObject(), which does not exist on it. A BadMethodCallException in an auth guard, shipped.

2. gate-17 was wrong about the same API, in the other direction. Four of six names in OBJECT_SERVICE_CRUD do not exist on ObjectService — they are what gate-20 flags as fabricated — and findAll/createObject/updateObject/deleteObject were absent. Separately, ^\s*return\s+new\s+JSONResponse sits in WRAPPER_NOISE_PATTERNS and was tested before the ObjectService check, so the commonest pass-through spelling was discarded as "response wrapping" with the call still inside it — then matched by RESCUE_PATTERNS and returned False. The gate rescued its own subject. Blast radius of both fixes across the three repos: 0 new findings.

3. gate-14 never judged the ten routes AppHost supplies (#265). #223 taught invariant 1 about Routes::standard(); invariant 2 asks the opposite question and still read route names as literals out of the leaf's own routes.php, where those ten never appear. Deleting SettingsController::update() from shillinq leaves PUT /api/settings resolving to nothing — not a 404: the router matches, ControllerMethodReflector reflects, the request dies 500. shillinq's own docblock spells the hazard out. Gate-14's findings log came back empty.

4. gate-14 derived a path the app does not use. AppHost\Controller\GenericHealth#index resolved to lib/Controller/AppHost/Controller/… while PSR-4 puts it at lib/AppHost/Controller/…, so the gate reported controller-class-not-found inside the repository that ships the file. And where a DI binding rescued the absence the loop continued — so the method-existence check never ran: two fixtures differing by one renamed method both reported PASS. #275 found the same root independently from gate-5's side and landed the two-root probe; this branch's resolver is now byte-identical to main's, and adds the gate-14 invariant-2 fixtures that assert it from the other direction.

5. Three gates reported PASS over a crashed checker. With python3 exiting 1 — nothing inspected by any python-backed gate:

gate-12 SKIPPED (wiring)     gate-15 PASS
gate-17 SKIPPED (wiring)     gate-16 PASS
                             gate-18 PASS
                             gate-19 FAIL — "an unreported number of scenario(s)"

15/16/18 wrote 2>/dev/null || true and counted lines in an empty log; 19 read exit 1 as EXIT_FAIL from a helper that never printed its summary — a blocking verdict carrying a count nobody measured.

6. gates 12 and 13 passed over a src/ with zero .vue (#274). [ -d src ] is not "src/ contains a Vue component". At fef032b both printed PASS on the nldesign shape. Now na, with the judgement #274 asked for written down: NcSelect/NcModal/NcDialog are Vue SFC components, a PHP template cannot instantiate one, so these two stay .vue-only and gate-40 keeps the language-agnostic rule for templates/. (#280 closed the gate-45 half; this is the gate-12 half.)

7. gate-16 could not see the deletion of its own tag. _overlaps walks forward from the declaration; the docblock is above it, and the docblock is the only place @spec lives. Delete the tag, leave the body byte-identical → # count=0, exit 0. Every @spec tag in a repository could be stripped and gate-16 stayed green. run_gate also skipped any file with an empty added set, which a pure deletion produces, so the file was never opened. Same family as filter_preexisting_methods.py filing an auth-attribute removal as pre-existing — gate-16 does not route through that helper (its four call sites are gates 6/7/8/30, and check_spec_coverage.py references it zero times); it reached the same blind spot by its own path.

Plus gate-22's verdict depended on where the gates were checked out (ajv resolved relative to check_manifest.js, never to the repo under test — run from openregister's root with node_modules/ajv present there it printed "not resolvable … no node_modules", which was false), and gate-15's slot matcher had gate-44's attribute-order blind spot (<template #widget-x class="wide"> did not match).

Exit is a status, count on stdout — swept, empirically

Helper	Findings	Exit
check_e2e_coverage.py	794	1
check_spec_coverage.py	239	1
detect-redundant-controllers.py	1 + # count= marker	1
check_dashboard_antipattern.py	0 + marker	0
check_manifest.js	failed already clamped to 0/1	0/1/2/3

check_spec_coverage.py and check_dashboard_antipattern.py used to return the count; both are now a status plus a terminal # count= marker, which is also what lets the runner tell "clean" from "did not execute".

Anti-widening

• gate-20: a mapper's real createFromArray() in a file mentioning ObjectService → not flagged.
• gate-17: a domain-named method with a byte-identical body → not flagged.
• gate-14: the other nine canonical AppHost names still resolve; the conventional ping#index sibling is unaffected; routes-standard/ still yields exactly one finding.
• gate-16: a typo fix in a legacy untagged method's docblock → clean, no inherited debt surfaced.
• gates 12/13: add one .vue carrying the defect and both go straight back to FAIL.
• gate-18: a working python3 on the same fixture still FAILs the planted dialect.
• gate-21: a .md documenting conflict markers is not flagged.
• pipelinq and openregister, clean, whole repo: verdicts unchanged before and after across all eleven gates.

Tests — all mutation-checked against the pre-fix tree

Suite	Red before
test_gate_or_objectservice_surface.sh (new)	gate-20 + gate-17, each with its silent sibling, plus a direct assertion that a --leading grep pattern is parsed as options
test_gate_crashed_checker_is_not_a_finding.sh	7 failures — all six python-backed gates under a broken interpreter, asserted generically so a future gate inherits it
test_gate_empty_scope_never_passes.sh	3 failures — gates 12/13 on the nldesign shape, with the one-.vue control
test_gate_route_registration.sh	5 failures — routes-standard-missing-update/ (#265) and psr4-namespaced-controller{,-missing-method}/. ⚠️ This suite hardcoded its runner, so HYDRA_GATES_RUNNER_UNDER_TEST silently kept running the fixed one and reported all-green — a mutation check that could not fail. Fixed here too.
test_check_spec_coverage.py	tag-deletion caught; unrelated docblock edit clean
test_check_manifest.sh	ajv anchor red before
test_check_dashboard_antipattern.py	4 subtests — slot-tag spellings that were silent misses

59 helper suites pass (2 quarantined, unchanged), 61 bin-level assertions pass.

Verdicts will move

gate-20 and gate-17 can now produce findings in repos that were green — starting with the shillinq auth-guard call above. Gates 12/13/15/16/18/19 can now report SKIPPED (wiring) or NOT APPLICABLE; neither is a pass.

Closes #265. Closes the gate-12 half of #274.