test(gates): close the regression gap — 58 of 65 gates now fixtured, and the two registries reconciled against the code

[rubenvdlinde]

What this closes

The acceptance corpus protected 22 of 65 gates by the ratchet's own arithmetic.
The other 43 sat in UNCOVERED.md, and thirty-six of those rows were wrong —
nine because nothing blocked authoring a bundle, twenty-seven because a planted
defect was already being driven through the real wrapper by a suite under
scripts/lib/, which neither registry knew about.

After this PR the ratchet reports 58 of 65, and the seven that remain each
name a specific thing a fixture directory cannot supply.

1. Five new bundles — nine gates, security and data first

bundle	gates	what the planted arm is
semantic-authz/	9 semantic-auth, 6 orphan-auth	#[NoAdminRequired] over a requireAdmin() body; an uncalled isTransitionAllowed(string $userId, …)
apphost-prelude/	64 apphost-autoload-prelude	an OCA\OpenRegister\AppHost\Bootstrap reference in register() with no ADR-040 prelude
register-dialect/	18 notification-dialect, 51 schema-property-titles	a lifecycleEnter trigger and a rule-level singular channel; a property with no title, and one with a title and no description
dashboard-and-detail/	15 dashboard-antipattern, 55 detail-page-discipline	<CnDashboardPage> inside a #widget-kpis slot, and a type:"custom" page used as a widget; page-level widgets[] shadowing config.widgets, and a deprecated summaryAggregates
manifest-planes/	62 store-plane, 63 settings-surface	a Store entry rendering ViewGridOutline and a Catalog over catalog_item; adminSettings[], a reserved-name settings page, and a Settings > Settings foldout

Thirteen expect.conf rows across nine gates. Every gate that could carry two
mechanisms carries two rows, each naming a subject in a different file, rule or
page — because the driver grades a verdict plus ONE named subject, so a
one-row bundle stays green over any regression that leaves one finding standing.
That is the method=preamble / method=preambleForbiddenCode lesson applied
before it could bite.

Both arms of every bundle were run through scripts/run-hydra-gates.sh by
test_gate_acceptance_matrix.sh: 102 assertions, 0 failures on the fixture
arms.

2. Every bundle is revert-proven, one mechanism at a time

Each row was proven by BREAKING THE GATE and watching the named subject leave
the log. A prediction was written before each run; all nine matched.

gate	mutation	predicted	measured
15	disable the slot rule	widget=kpis gone, page=metrics survives	exactly that, # count=1
55	disable rule (a)	thingDetail gone, caseDetail survives	exactly that
18	disable the singular-channel test	token=channel gone, token=lifecycleEnter survives	exactly that
51	accept a property that carries a title	closedAt gone, governanceBody survives	exactly that
62	disable the Tier A icon rule	row 1 gone, one glyph, two meanings + Catalog survive	exactly that, 3 → 2
63	disable the adminSettings[] rule	row 1 gone, other two survive	exactly that, 3 → 2
64	disable BOOTSTRAP_REF	no finding at all	apphost-autoload-prelude: OK
9	disable the admin-body test	method=adminPanelState gone	no output
6	widen: drop the auth-signal requirement	1 → 2 findings, so FAIL — 1 orphan method(s) no longer matches	isValidCode joined it

The gate-6 arm is the anti-widening direction on purpose: its near-miss lives in
the same file as its true positive, so the row is two-directional even though it
grades a count (see below).

3. The reconciliation — the deliverable, not a side effect

UNCOVERED.md loses thirty-six rows. Nine to the new bundles; twenty-seven to
COVERED-ELSEWHERE.md, each row naming the suite and quoting the assertion
that proves the claim, every quote observed in a run of that suite today —
test_gate_1_11_honest_verdicts.sh (1, 3, 5, 8, 10, 11),
test_gate_a11y_markup_scope.sh (34, 37, 39, 40, 42, 43, 44, 45),
test_gate_5661_empty_scope_is_not_a_pass.sh (56–60),
test_gate_13_multiline_dialog.sh (13), test_gate_route_auth.sh +
test_gate_fq_route_names.sh (5, 14), test_gate_or_objectservice_surface.sh +
test_gate_20_comment_masking.sh (17, 20), test_gate_46_tests_scope.sh (46),
test_gate_monitoring_and_skiplink.sh (38), test_gate_45_to_55_acceptance.sh
(50, 53).

Three gates were deliberately NOT moved. 12, 41 and 52 have a planted arm
but no anti-widening arm anywhere, so COVERED-ELSEWHERE's "planted and
clean" claim would be an overclaim. They get a new partial-elsewhere category
that names the suite, the assertion that exists, and the missing half.

gate-22's reason had rotted and is corrected. It said "no node_modules
ships anywhere in this package, so the clean arm cannot go green".
.github/workflows/hydra-gates-package.yml installs ajv before the helper-suite
step, and a schema-valid manifest was measured clean today. What actually blocks
a bundle is that the acceptance driver has no ajv preflight, so a wiring fault
would be reported as a gate defect — the exact false pass
test_gate_45_to_55_acceptance.sh grew its own preflight to prevent. A reason
naming a state of the world rots; a reason naming a test artefact does not.

4. Two things found while doing this

gate-6 is the only gate in the runner whose findings log is a mktemp path.
hydra-gate-orphan-auth.XXXXXX.log, chosen for hydra#110 so parallel app runs
cannot clobber counts. The acceptance driver resolves <log-basename> as a
literal filename, so gate-6 cannot be graded by subject at all — its row
uses the - (stdout) form and grades the count. That is weaker and it is
written into the bundle rather than hidden: it would not notice a gate that
swapped which of the two methods it reported. Fixing it needs a stable log name
or a glob in the driver, both outside this PR.

All four new manifests were invalid against the v2 schema on first write, and
would have put gate-22 into a permanent FAIL on eight new arms. Fixed in
d3b662f — every new manifest now validates clean. Harmless while every bundle
grades per-gate expectations; the moment a suite adds a run-level-green
assertion it detonates. The hazard is now note 3 in UNCOVERED.md.

Verification

• bash hydra-gates/tests/run-helper-suites.sh — 80 discovered, 78 passed, 2
  quarantined, 0 failed, with NODE_PATH pointing at an ajv install (the same
  thing CI's npm install --no-save ajv ajv-formats step provides).
• test_gate_acceptance_matrix.sh — coverage ratchet intact, 58 of 65 gates
  fixtured, no gate in both registries, no declared gate in neither.
• Thirteen sibling suites re-run individually to source every COVERED-ELSEWHERE
  quote.

No checker, no runner, no existing bundle, and no expect.conf outside the five
new directories was modified.

🤖 Generated with Claude Code