fix(gate-manifest): reject shadowed bindings and value-changing provenance chains

Addresses both P2s from the re-review at 9f06c00.

Block/catch/loop shadowing. The proof modelled only function parameters, so a
`const entry` in a nested block — or a catch parameter, or a destructured
binding — shadowed the ownership callback parameter invisibly, and resolution
fell back to the ownership binding and exempted a dynamic rule.

Rather than model every scoping construct, shadowsParameter refuses the
exemption whenever the name is re-declared ANYWHERE inside the callback, by any
construct, including destructuring patterns. That over-refuses in principle — a
re-declaration in a sibling block cannot reach the call site — and fails closed,
which is the right direction for a proof whose job is to be conservative.

Provenance. iteratesOwnershipTable accepted any chain rooted at the table, so
`BUILD_OWNERSHIP.map(transform).map((entry) => entry.rule)` qualified even
though `transform` can return anything and the downstream elements are no longer
table entries. yieldsOwnershipEntries now walks the chain and requires every
intervening method to be value-preserving (filter/slice/reverse/sort/toSorted/
toReversed). `.map(transform)` mid-chain breaks the proof; the real
`BUILD_OWNERSHIP.filter(...).map(cb)` still holds.

Tests 46 → 50: nested-block re-declaration, catch parameter and destructured
re-declaration, a value-changing chain, and a value-preserving `.filter().slice()`
chain proving the legitimate case still resolves and loses no category.

rootIdentifier is gone — yieldsOwnershipEntries replaced it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SkS4S8XXrfkJ8TD1VBKkvJ

Author: claude

scripts/gate-manifest/selector-rules.test.ts

@@ -114,6 +114,69 @@ test('the real ownership loop stays exempt when no impostor shares its name', ()
   assert.deepEqual(selectorRuleIds('m.ts', source), ['gate:lint', 'own:swift']);
 });
 
+test('a block-scoped re-declaration inside the ownership callback fails closed', () => {
+  // `const entry = config` shadows the callback parameter without being a parameter itself,
+  // so function-level resolution alone would fall back to the ownership binding and exempt a
+  // rule that is not a collected literal.
+  const source = `
+    const BUILD_OWNERSHIP = [{ check: 'swift-runner', rule: 'own:swift', detail: 'd', owns: () => true }];
+    const bad = BUILD_OWNERSHIP.map((entry) => {
+      {
+        const entry = config;
+        return reason('lint', file, entry.rule, 'd');
+      }
+    });
+  `;
+  assert.throws(() => selectorRuleIds('m.ts', source), /rule argument is not a string literal/);
+});
+
+test('a catch or destructured re-declaration is caught the same way', () => {
+  const caught = `
+    const BUILD_OWNERSHIP = [{ check: 'swift-runner', rule: 'own:swift', detail: 'd', owns: () => true }];
+    const bad = BUILD_OWNERSHIP.map((entry) => {
+      try { go(); } catch (entry) { return reason('lint', file, entry.rule, 'd'); }
+    });
+  `;
+  assert.throws(() => selectorRuleIds('m.ts', caught), /rule argument is not a string literal/);
+
+  const destructured = `
+    const BUILD_OWNERSHIP = [{ check: 'swift-runner', rule: 'own:swift', detail: 'd', owns: () => true }];
+    const bad = BUILD_OWNERSHIP.map((entry) => {
+      {
+        const { entry } = config;
+        return reason('lint', file, entry.rule, 'd');
+      }
+    });
+  `;
+  assert.throws(
+    () => selectorRuleIds('m.ts', destructured),
+    /rule argument is not a string literal/,
+  );
+});
+
+test('a value-changing chain is not proven provenance, even rooted at the table', () => {
+  // `.map(transform)` can return anything, so the downstream elements are no longer ownership
+  // entries and their `.rule` is not a literal this reader collected.
+  const source = `
+    const BUILD_OWNERSHIP = [{ check: 'swift-runner', rule: 'own:swift', detail: 'd', owns: () => true }];
+    const bad = BUILD_OWNERSHIP.map(transform).map((entry) => reason('lint', file, entry.rule, 'd'));
+  `;
+  assert.throws(() => selectorRuleIds('m.ts', source), /rule argument is not a string literal/);
+});
+
+test('a value-preserving chain still proves provenance', () => {
+  const source = `
+    const BUILD_OWNERSHIP = [
+      { check: 'swift-runner', rule: 'own:swift', detail: 'd', owns: () => true },
+    ];
+    const good = BUILD_OWNERSHIP.filter((e) => e.owns(file)).slice(0).map((entry) =>
+      reason(entry.check, file, entry.rule, entry.detail),
+    );
+    const a = reason('lint', file, 'gate:lint', 'd');
+  `;
+  assert.deepEqual(selectorRuleIds('m.ts', source), ['gate:lint', 'own:swift']);
+});
+
 test('a computed rule argument fails closed rather than being skipped', () => {
   // A category this reader cannot see would bypass the representative-sample and reachability
   // checks entirely — the exact hole the derived universe exists to close.

scripts/gate-manifest/selector-rules.ts

@@ -59,19 +59,6 @@ function isMemberAccess(node: Node): boolean {
   return node.type === 'MemberExpression' || node.type === 'StaticMemberExpression';
 }
 
-/** Walks `a.b().c` down to its root identifier, or null when the root is not one. */
-function rootIdentifier(node: unknown): string | null {
-  let current: unknown = node;
-  for (let depth = 0; isNode(current) && depth < 32; depth++) {
-    const name = identifierName(current);
-    if (name !== null) return name;
-    if (isMemberAccess(current)) current = current['object'];
-    else if (current.type === 'CallExpression') current = current['callee'];
-    else return null;
-  }
-  return null;
-}
-
 /**
  * The body of the `reason(check, file, rule, detail)` factory itself.
  *
@@ -115,21 +102,50 @@ function ownershipTableNames(program: Node, factory: Span | null): Set<string> {
 }
 
 /**
- * Whether a call iterates a collected ownership table — `BUILD_OWNERSHIP.filter(...)`, and the
- * `.map(...)` chained onto it.
+ * Array methods that yield the SAME elements. An ownership entry stays an ownership entry
+ * through `.filter(...)`; it does not through `.map(transform)`, whose callback can return
+ * anything, so the elements downstream are no longer table entries and their `.rule` is no
+ * longer a literal this reader has collected.
+ */
+const VALUE_PRESERVING_METHODS = new Set([
+  'filter',
+  'slice',
+  'reverse',
+  'sort',
+  'toSorted',
+  'toReversed',
+]);
+
+/** Whether an expression evaluates to elements of a collected ownership table, unchanged. */
+function yieldsOwnershipEntries(node: unknown, tables: ReadonlySet<string>): boolean {
+  let current: unknown = node;
+  for (let depth = 0; isNode(current) && depth < 32; depth++) {
+    const name = identifierName(current);
+    if (name !== null) return tables.has(name);
+    if (current.type !== 'CallExpression') return false;
+    const callee = current['callee'];
+    if (!isNode(callee) || !isMemberAccess(callee)) return false;
+    const method = identifierName(callee['property']);
+    if (method === null || !VALUE_PRESERVING_METHODS.has(method)) return false;
+    current = callee['object'];
+  }
+  return false;
+}
+
+/**
+ * Whether a call iterates a collected ownership table — `BUILD_OWNERSHIP.filter(...).map(cb)`.
  *
  * This is what makes the forwarding exemption a proof rather than a pattern. Accepting any
  * member access named `.rule` would silently skip `reason(check, file, config.rule, …)`, whose
  * literal this reader never sees — a live category slipping past the derived universe while
- * the gate stays green. Only a binding whose origin is an ownership-table iteration qualifies,
- * because only then is the literal guaranteed to have been collected from the table already.
+ * the gate stays green. Only a binding whose values are provably unchanged table entries
+ * qualifies, because only then is the literal guaranteed to have been collected already.
  */
 function iteratesOwnershipTable(node: Node, tables: ReadonlySet<string>): boolean {
   if (node.type !== 'CallExpression') return false;
   const callee = node['callee'];
   if (!isNode(callee) || !isMemberAccess(callee)) return false;
-  const root = rootIdentifier(callee['object']);
-  return root !== null && tables.has(root);
+  return yieldsOwnershipEntries(callee['object'], tables);
 }
 
 function isFunctionLike(node: Node): boolean {
@@ -147,6 +163,54 @@ function callbackFunctions(node: Node): Node[] {
   return args.filter((argument): argument is Node => isNode(argument) && isFunctionLike(argument));
 }
 
+/** Every identifier a binding pattern introduces, including destructured ones. */
+function patternNames(node: unknown, into: Set<string>): void {
+  if (!isNode(node)) return;
+  const name = identifierName(node);
+  if (name !== null) {
+    into.add(name);
+    return;
+  }
+  for (const child of children(node)) patternNames(child, into);
+}
+
+/** Whether a node introduces `name` as a new binding of any kind. */
+function declaresName(node: Node, name: string): boolean {
+  const names = new Set<string>();
+  if (node.type === 'VariableDeclarator') patternNames(node['id'], names);
+  else if (node.type === 'CatchClause') patternNames(node['param'], names);
+  else if (isFunctionLike(node)) {
+    patternNames(node['id'], names);
+    const params = node['params'];
+    if (Array.isArray(params)) for (const parameter of params) patternNames(parameter, names);
+  }
+  return names.has(name);
+}
+
+/**
+ * Any re-declaration of `name` inside `callback` other than the callback's own parameter.
+ *
+ * Resolving to the innermost FUNCTION binder is not enough on its own: a block, catch or loop
+ * binding shadows the ownership parameter without being a function parameter at all, and the
+ * resolver would otherwise fall back to the ownership binding and exempt a dynamic rule —
+ *
+ *   BUILD_OWNERSHIP.map((entry) => { const entry = config; reason(…, entry.rule, …); })
+ *
+ * Rather than model every scoping construct, this refuses the exemption whenever the name is
+ * re-declared anywhere inside the callback. That over-refuses in principle (a re-declaration in
+ * a sibling block cannot reach the call site) and fails closed, which is the right direction.
+ */
+function shadowsParameter(program: Node, callback: Node, name: string): boolean {
+  const span = spanOf(callback);
+  if (span === null) return true;
+  let shadowed = false;
+  collect(program, (node) => {
+    if (shadowed || node === callback) return;
+    if (within(span, node) && declaresName(node, name)) shadowed = true;
+  });
+  return shadowed;
+}
+
 /**
  * A name bound by a function's parameter list, with the source span it is visible in.
  *
@@ -170,10 +234,12 @@ function parameterBindings(program: Node, tables: ReadonlySet<string>): Paramete
     const span = isFunctionLike(node) ? spanOf(node) : null;
     const params = node['params'];
     if (span === null || !Array.isArray(params)) return;
-    const iteratesOwnership = ownershipCallbacks.has(node);
+    const owns = ownershipCallbacks.has(node);
     for (const parameter of params) {
       const name = identifierName(parameter);
-      if (name !== null) bindings.push({ name, span, iteratesOwnership });
+      if (name === null) continue;
+      const iteratesOwnership = owns && !shadowsParameter(program, node, name);
+      bindings.push({ name, span, iteratesOwnership });
     }
   });
   return bindings;