refactor(gates): own the client-only replay rule as daemon-process reachability (R82)

[thymikee]

Follow-up to the #3517 review (comment). Based on main.

The design question

You asked whether the src/daemon.ts hub closure should own the client-only rule instead of a hand-listed path set. The answer is yes: what the daemon process can load owns it. But the eager closure can't carry it. Measured on main:

• src/daemon.ts eagerly evaluates 393 modules. Neither src/daemon-composition.ts nor any src/platform-runtime-* module is among them, because they load behind a function-scoped await import. A planted import '@agent-device/replay-port/source-discovery' in src/platform-runtime-daemon-services.ts passes an eager-closure deny set.
• Over static plus dynamic edges, src/daemon.ts reaches 1,366 modules, including the composition root, the platform-runtime family and every package they reach. Neither collector module is among them.

So the rule is a layering check over the resolved import graph, like R76, instead of a deny set in eager-closure-budgets.

What

• New R82 daemon-process-reach (scripts/layering/daemon-process-reach.ts): a breadth-first walk from src/daemon.ts over value and dynamic edges. It fails if packages/replay-port/src/script-source-bundle.ts or source-discovery.ts is reachable, naming the importing edge and the shortest chain.
  • The planted import above now fails: src/daemon.ts -> … -> src/platform-runtime-daemon-services.ts -> packages/replay-port/src/source-discovery.ts.
  • Type-only edges load nothing, and client code may import the collector.
• Deleted: the R11 path gate (CLIENT_ONLY_SUBPATHS, DAEMON_PROCESS_ROOT_FILES, the daemon-path predicate) and client-only-subpaths.test.ts.
• Non-blocking note taken: the root wiring test imports testRequestScope, now exported next to testInventoryHost, instead of redeclaring it.
• The seven inline threads you listed were resolved on refactor(daemon): cut daemon test edges into root data fixtures and fakes [11a-3] #3517.

Validation

• check:layering: 326 tests, guard OK, R82 in the success line.
• check:quick, check:fallow (no issues in 10 changed files), check:gate-manifest, test-file-size ratchet, check:affected --run: all runnable checks passed.

🤖 Generated with Claude Code

[cubic-dev-ai]

No issues found across 7 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	5.21 MB	5.21 MB	-2.5 kB
Package (unpacked)	5.21 MB	5.20 MB	-2.5 kB
Package (download)	1.57 MB	1.56 MB	-841 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	22.8 ms	22.1 ms	-0.7 ms
CLI --help	61.4 ms	61.4 ms	-0.0 ms

[thymikee]

This PR is ready at 7ed93ce. The rule reads as a correct move from import-specifier matching to reachability from the daemon entry.

Not blocking, and you can take or leave these: the rule passes silently if src/daemon.ts or a denied module such as packages/replay-port/src/source-discovery.ts is renamed or moved, and the pin test only compares the constant to itself, so a stale entry would stay green (a stale-entry check against the source file set, like the one in R78, would close it); the test file has no case for a static-only chain to a denied module or for the second denied module, script-source-bundle, so iterating DAEMON_PROCESS_DENIED_MODULES in the planted-import test would cover both; and the testRequestScope export in inventory-gateways.fixtures.ts is unrelated to R82 and would sit better in its own commit.

CI is still pending: the 7 jobs that have not passed are all queued, and none has failed. Lint & Format, Typecheck & Package and the check:layering step cover this change directly, because the new rule runs against the real graph there. I did not run check:layering at this commit myself, so I have not confirmed that neither collector module is reachable from src/daemon.ts. The test counts and the check:fallow result come from the PR description. Like every graph rule, R82 cannot see dynamic imports with non-literal specifiers.

Before merge, please confirm those three checks go green once the queued jobs run, and land #3603 first, since this PR is stacked on it.

[thymikee]

Addressed in 9d95852.

• Stale targets: R82 now fails as stale when src/daemon.ts or a denied module is not a tracked source, so a rename or move can no longer turn the walk into a silent pass. A test covers this.
• Coverage: the planted-import tests now iterate DAEMON_PROCESS_DENIED_MODULES, so each module, script-source-bundle included, is covered over a dynamic chain and over a static-only chain.
• testRequestScope: it is already in its own commit (7fdefc319), separate from the R82 commit.
• fix(gates): stop the closure walker following JSON data imports #3603: closed as superseded by test(closure): read committed JSON modules on the merge-base side #3602, which fixes the same JSON closure breakage on main. This PR is now based on main directly. The earlier red Bundle Size, Compatibility and Coverage runs diffed against fix(gates): stop the closure walker following JSON data imports #3603's old head (a32cee793). The re-pushed runs passed on 3389177.

check:layering (330 tests, OK against the real graph, so neither collector module is reachable from src/daemon.ts), check:quick, check:fallow and check:affected --run pass locally at 9d95852.

[cubic-dev-ai]

No issues found across 7 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[thymikee]

This is ready for review at 9d95852. The earlier review at 7ed93ce was clean, and the delta adds no new problems: the stale-target check reuses the same entry and denied-module constants, so R82 stays the single owner of the rule. The new tests fail if the reachability walk or the stale check is reverted. There are no conflicts. CI is still running (15 of 18 checks queued or in progress, none failed).

Not blocking: checkDaemonProcessReach builds its own adjacency map and BFS and repeats the executable-edge filter. Could it use importGraphFromResolvedEdges(edges, EXECUTABLE_EDGES) and getShortestPath, like the R76 rule next to it? Then a change to the edge classification in import-graph.ts reaches R82 too.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-10-14 10:50 UTC