fix(gate-manifest): declare the forwarded selector rule instead of proving it

The forwarding exemption fails open in two more ways, and closing them
soundly leaves it exempting nothing.

An upstream callback was never part of the provenance chain, so
`BUILD_OWNERSHIP.filter((entry) => { entry.rule = computed; return true; })
.map(...)` was accepted: `yieldsOwnershipEntries` walked the chain by method
name only. And `onlyReadsAsProperty` counted `entry.mutate()` as a property
read, because `entry.mutate` is a member access whose object is `entry`.

Closing the second requires treating any member call on the binding as
unsafe. The live call site is
`BUILD_OWNERSHIP.filter((entry) => entry.owns(file)).map(...)`, and
`entry.owns(file)` is exactly that — a member call no reader can prove does
not mutate the entry. So the sound version of the exemption rejects the one
call it existed to admit. There is no proof left to keep, and six rounds of
narrowing it (pattern → name → lexical scope → binder kind → total read-only
proof) were rounds spent on a construct that could not reach soundness.

The reader now collects string literals and nothing else. The single forward
is declared in FORWARDED_SELECTOR_RULES, keyed on the exact source text of
the call, and policed like every other waiver: check.ts fails if it matches
no call (inert) or more than one (spread beyond what was reviewed), and the
message quotes the exact text to paste. The category universe is unchanged —
`entry.rule` can only be a `rule:` literal the table already contributes,
which is what makes the declaration true.

selector-rules.ts drops from 344 to 222 lines. The shape-by-shape tests
become one table so all seventeen negatives, including the two above, stay
as the regression record rather than as arguments to relitigate.

Author: claude

docs/agents/testing.md

@@ -226,10 +226,21 @@ action → package script → aggregate chain → terminal`, and asserts:
 Two properties are load-bearing. **Ownership is proven, never inferred from a name appearing in
 workflow text** — commands resolve to *terminals* (`vitest:<project>`, `node-test:<file>`,
 `exec:<argv>`), so renaming an intermediate script breaks the chain instead of leaving the claim
-standing. And it **fails closed**: an unreadable edge (a `${{ … }}` in command position, a
-missing local action, an opaque runner that spawns its own child) is a failure until classified
-in `scripts/gate-manifest/waivers.ts` with a reason and a tracking issue. Waivers are themselves
-checked, so one that stops applying fails rather than rotting.
+standing. And it **fails closed**: anything unreadable — a `${{ … }}` in command position, a
+missing local action, an opaque runner that spawns its own child, a selector rule that is not a
+string literal — is a failure until classified in `scripts/gate-manifest/waivers.ts` with a
+reason and a tracking issue. Waivers are themselves checked, so one that stops applying fails
+rather than rotting: each is re-resolved with itself removed and must change the outcome.
+
+Where the two meet is worth knowing before you edit the selector. The path-category universe is
+*derived* from `scripts/check-affected/model.ts` — the third argument of each `reason()` call and
+each `BUILD_OWNERSHIP` entry's `rule:` — so a new ownership rule widens the universe and fails
+the gate until a representative path exercises it. Only string literals count. A rule the reader
+cannot see would slip past the reachability check while the gate stayed green, so a computed one
+is an error naming its line. The single call that forwards `entry.rule` out of the ownership loop
+is declared in `FORWARDED_SELECTOR_RULES`, keyed on the exact text of the call, rather than
+recognized by shape; `selector-rules.ts` records why the shape-recognizing version could not be
+made sound.
 
 The gate is deterministic, offline, and needs no GitHub token — it runs from a clean checkout in
 the `Affected-check Selector` job. Branch-protection required-contexts drift is the one part

scripts/gate-manifest/check.ts

@@ -27,13 +27,14 @@ import {
   unrepresentedRules,
   type PathCategory,
 } from './path-categories.ts';
-import { selectorRuleIds } from './selector-rules.ts';
+import { readSelectorRules } from './selector-rules.ts';
 import { suiteUniverse, unownedTerminals } from './suite-ownership.ts';
 import { buildLanes, parseWorkflow, type WorkflowFile } from './workflow-lanes.ts';
 import {
   CATALOG_CLAIM_WAIVERS,
   DECLARED_EDGES,
   DOCS_LANE_OWNERS,
+  FORWARDED_SELECTOR_RULES,
   LOCAL_ONLY,
   TRANSPARENT_WRAPPERS,
   type DocsLaneOwner,
@@ -70,7 +71,12 @@ const actions = new Map(
 const packageJson = JSON.parse(read('package.json')) as { scripts?: Record<string, string> };
 const packageScripts = new Map(Object.entries(packageJson.scripts ?? {}));
 const vitestProjects = vitestProjectNames('vitest.config.ts', read('vitest.config.ts'));
-const selectorRules = selectorRuleIds(SELECTOR_SOURCE, read(SELECTOR_SOURCE));
+const selector = readSelectorRules(
+  SELECTOR_SOURCE,
+  read(SELECTOR_SOURCE),
+  FORWARDED_SELECTOR_RULES.map((entry) => entry.call),
+);
+const selectorRules = selector.rules;
 
 const trackedFiles = listFiles();
 const trackedSet = new Set(trackedFiles);
@@ -210,6 +216,22 @@ const staleWaivers = [
       `TRANSPARENT_WRAPPERS "${entry.file}" changes nothing — no resolved command forwards ` +
       `through it, so the waiver is inert`,
   ),
+  // A forwarded-rule waiver is applied-reachable when the call it names is really there — and
+  // only that call. Matching none means the forward is gone and the waiver now excuses nothing;
+  // matching several means one reviewed claim has silently spread to a call nobody looked at.
+  ...FORWARDED_SELECTOR_RULES.map((entry) => ({
+    entry,
+    matches: selector.waiverMatches.get(entry.call) ?? 0,
+  }))
+    .filter(({ matches }) => matches !== 1)
+    .map(({ entry, matches }) =>
+      matches === 0
+        ? `FORWARDED_SELECTOR_RULES "${entry.call}" matches no reason() call in ` +
+          `${SELECTOR_SOURCE} — the forward is gone, so the waiver is inert`
+        : `FORWARDED_SELECTOR_RULES "${entry.call}" matches ${matches} calls in ` +
+          `${SELECTOR_SOURCE} — one waiver cannot stand for several forwards; make each call ` +
+          `distinguishable, or write the rules as literals`,
+    ),
   ...DECLARED_EDGES.filter(
     (entry) =>
       reportedProblems(
@@ -414,5 +436,10 @@ console.log(
     `across ${lanes.length} jobs in ${workflows.length} workflows (${prLanes} PR-triggered); ` +
     `${CHECK_CATALOG.length} catalog entries wired to live jobs; ` +
     `${selectorRules.length} selector categories represented and reachable; ` +
-    `${LOCAL_ONLY.length + DECLARED_EDGES.length + TRANSPARENT_WRAPPERS.length} owned waivers.`,
+    `${
+      LOCAL_ONLY.length +
+      DECLARED_EDGES.length +
+      TRANSPARENT_WRAPPERS.length +
+      FORWARDED_SELECTOR_RULES.length
+    } owned waivers.`,
 );

scripts/gate-manifest/path-categories.test.ts

@@ -8,9 +8,10 @@ import { selectChecks } from '../check-affected/model.ts';
 import type { CatalogEntry } from './catalog-wiring.ts';
 import { pathFilterMatches, triggersOnPath } from './path-filters.ts';
 import { unreachablePathCategories, unrepresentedRules } from './path-categories.ts';
-import { selectorRuleIds } from './selector-rules.ts';
+import { readSelectorRules } from './selector-rules.ts';
 import { buildLanes, parseWorkflow } from './workflow-lanes.ts';
 import { context } from './test-context.ts';
+import { FORWARDED_SELECTOR_RULES } from './waivers.ts';
 
 const repoRoot = path.resolve(import.meta.dirname, '../..');
 const SELECTOR_SOURCE = 'scripts/check-affected/model.ts';
@@ -109,9 +110,10 @@ test('a selector rule no sample path exercises is reported as unrepresented', ()
 // --- The real tree ----------------------------------------------------------
 
 test("the selector's real rule universe is derived, and excludes its fail-open classes", () => {
-  const rules = selectorRuleIds(
+  const { rules } = readSelectorRules(
     SELECTOR_SOURCE,
     fs.readFileSync(path.join(repoRoot, SELECTOR_SOURCE), 'utf8'),
+    FORWARDED_SELECTOR_RULES.map((entry) => entry.call),
   );
   // Live selection rules, read from `reason(...)` calls and the BUILD_OWNERSHIP table.
   for (const expected of ['gate:lint', 'platform-src', 'own:swift', 'own:mcp', 'src-prod']) {