fix(gate-manifest): prove the forwarded rule is only ever read, not enumerate binders

Addresses both P2s from the re-review at e5331aa, and replaces the approach
that produced them.

The binder list was the wrong shape of proof. It failed open one construct at a
time — a `const` in a nested block, then a catch parameter, then a destructured
binding, and now `class entry {}` — because there is always another declaration
form to miss. Proving provenance only at callback ingress had the same defect
from the other side: `entry = config` keeps the binding and replaces the value.

onlyReadsAsProperty replaces both. Every occurrence of the parameter name inside
the callback must be the object of a member access that is not an assignment
target; the parameter itself is the only other permitted occurrence. That is
total rather than enumerated: a re-declaration of ANY kind, a reassignment, a
mutation of the entry, and passing the binding elsewhere all appear as an
occurrence that is not a read, and each refuses the exemption. It over-refuses
in principle and fails closed, which is the direction a conservative proof
should err in.

shadowsParameter, declaresName and patternNames are deleted — the enumeration
they encoded is what kept springing leaks.

Tests 50 → 54: class-declaration shadow, parameter reassignment, entry mutation
(`entry.rule = computed`), and aliasing (`mutate(entry)`). The live
`BUILD_OWNERSHIP.filter((entry) => entry.owns(file)).map((entry) => …)` still
resolves — `entry.owns` is a read like the rest. Planted red against the live
selector: wrapping its map body in `entry = { ...entry }` now fails with its
line number.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SkS4S8XXrfkJ8TD1VBKkvJ

Author: claude

scripts/gate-manifest/selector-rules.test.ts

@@ -177,6 +177,56 @@ test('a value-preserving chain still proves provenance', () => {
   assert.deepEqual(selectorRuleIds('m.ts', source), ['gate:lint', 'own:swift']);
 });
 
+test('a class declaration shadowing the parameter fails closed', () => {
+  // Not in any binder enumeration — which is why the proof asks "is every use a property
+  // read?" instead of listing the ways a name can be bound.
+  const source = `
+    const BUILD_OWNERSHIP = [{ check: 'swift-runner', rule: 'own:swift', detail: 'd', owns: () => true }];
+    const bad = BUILD_OWNERSHIP.map((entry) => {
+      {
+        class entry {}
+        return reason('lint', file, entry.rule, 'd');
+      }
+    });
+  `;
+  assert.throws(() => selectorRuleIds('m.ts', source), /rule argument is not a string literal/);
+});
+
+test('reassigning the parameter before use fails closed', () => {
+  // Same binding, different value. Proving provenance only at callback ingress would exempt a
+  // rule that is no longer an ownership entry by the time it is read.
+  const source = `
+    const BUILD_OWNERSHIP = [{ check: 'swift-runner', rule: 'own:swift', detail: 'd', owns: () => true }];
+    const bad = BUILD_OWNERSHIP.map((entry) => {
+      entry = config;
+      return reason('lint', file, entry.rule, 'd');
+    });
+  `;
+  assert.throws(() => selectorRuleIds('m.ts', source), /rule argument is not a string literal/);
+});
+
+test('mutating the entry before reading it fails closed', () => {
+  const source = `
+    const BUILD_OWNERSHIP = [{ check: 'swift-runner', rule: 'own:swift', detail: 'd', owns: () => true }];
+    const bad = BUILD_OWNERSHIP.map((entry) => {
+      entry.rule = computed;
+      return reason('lint', file, entry.rule, 'd');
+    });
+  `;
+  assert.throws(() => selectorRuleIds('m.ts', source), /rule argument is not a string literal/);
+});
+
+test('passing the binding elsewhere before use fails closed', () => {
+  const source = `
+    const BUILD_OWNERSHIP = [{ check: 'swift-runner', rule: 'own:swift', detail: 'd', owns: () => true }];
+    const bad = BUILD_OWNERSHIP.map((entry) => {
+      mutate(entry);
+      return reason('lint', file, entry.rule, 'd');
+    });
+  `;
+  assert.throws(() => selectorRuleIds('m.ts', source), /rule argument is not a string literal/);
+});
+
 test('a computed rule argument fails closed rather than being skipped', () => {
   // A category this reader cannot see would bypass the representative-sample and reachability
   // checks entirely — the exact hole the derived universe exists to close.

scripts/gate-manifest/selector-rules.ts

@@ -163,52 +163,47 @@ function callbackFunctions(node: Node): Node[] {
   return args.filter((argument): argument is Node => isNode(argument) && isFunctionLike(argument));
 }
 
-/** Every identifier a binding pattern introduces, including destructured ones. */
-function patternNames(node: unknown, into: Set<string>): void {
-  if (!isNode(node)) return;
-  const name = identifierName(node);
-  if (name !== null) {
-    into.add(name);
-    return;
-  }
-  for (const child of children(node)) patternNames(child, into);
-}
-
-/** Whether a node introduces `name` as a new binding of any kind. */
-function declaresName(node: Node, name: string): boolean {
-  const names = new Set<string>();
-  if (node.type === 'VariableDeclarator') patternNames(node['id'], names);
-  else if (node.type === 'CatchClause') patternNames(node['param'], names);
-  else if (isFunctionLike(node)) {
-    patternNames(node['id'], names);
-    const params = node['params'];
-    if (Array.isArray(params)) for (const parameter of params) patternNames(parameter, names);
-  }
-  return names.has(name);
-}
-
 /**
- * Any re-declaration of `name` inside `callback` other than the callback's own parameter.
+ * Every use of `name` inside `callback`, other than the parameter itself, must be a plain
+ * property READ — the object of a member access that is not being assigned to.
  *
- * Resolving to the innermost FUNCTION binder is not enough on its own: a block, catch or loop
- * binding shadows the ownership parameter without being a function parameter at all, and the
- * resolver would otherwise fall back to the ownership binding and exempt a dynamic rule —
- *
- *   BUILD_OWNERSHIP.map((entry) => { const entry = config; reason(…, entry.rule, …); })
- *
- * Rather than model every scoping construct, this refuses the exemption whenever the name is
- * re-declared anywhere inside the callback. That over-refuses in principle (a re-declaration in
- * a sibling block cannot reach the call site) and fails closed, which is the right direction.
+ * This replaces an enumeration of binder kinds, which kept failing open one construct at a
+ * time: a `const` in a nested block, then a catch parameter, then a destructured binding, then
+ * `class entry {}`. Enumerating is the wrong shape of proof — there is always another
+ * declaration form. Asking instead "is every occurrence of this name a property read?" is
+ * total: any re-declaration (of any kind), any reassignment, any mutation of the entry, and any
+ * passing of the binding elsewhere all show up as an occurrence that is not a read, and refuse
+ * the exemption. It over-refuses in principle and fails closed, which is the point.
  */
-function shadowsParameter(program: Node, callback: Node, name: string): boolean {
+function onlyReadsAsProperty(
+  program: Node,
+  callback: Node,
+  parameter: Node,
+  name: string,
+): boolean {
   const span = spanOf(callback);
-  if (span === null) return true;
-  let shadowed = false;
+  if (span === null) return false;
+
+  const assigned = new Set<unknown>();
+  const reads = new Set<Node>();
+  collect(program, (node) => {
+    if (!within(span, node)) return;
+    if (node.type === 'AssignmentExpression') assigned.add(node['left']);
+    else if (node.type === 'UpdateExpression') assigned.add(node['argument']);
+  });
+  collect(program, (node) => {
+    if (!within(span, node) || !isMemberAccess(node) || assigned.has(node)) return;
+    const object = node['object'];
+    if (isNode(object) && identifierName(object) === name) reads.add(object);
+  });
+
+  let onlyReads = true;
   collect(program, (node) => {
-    if (shadowed || node === callback) return;
-    if (within(span, node) && declaresName(node, name)) shadowed = true;
+    if (!onlyReads || !within(span, node)) return;
+    if (identifierName(node) !== name || node === parameter || reads.has(node)) return;
+    onlyReads = false;
   });
-  return shadowed;
+  return onlyReads;
 }
 
 /**
@@ -237,8 +232,8 @@ function parameterBindings(program: Node, tables: ReadonlySet<string>): Paramete
     const owns = ownershipCallbacks.has(node);
     for (const parameter of params) {
       const name = identifierName(parameter);
-      if (name === null) continue;
-      const iteratesOwnership = owns && !shadowsParameter(program, node, name);
+      if (name === null || !isNode(parameter)) continue;
+      const iteratesOwnership = owns && onlyReadsAsProperty(program, node, parameter, name);
       bindings.push({ name, span, iteratesOwnership });
     }
   });