chore(gates): scope stale approvals to introduced entries and keep readers in sync

Address review findings on the eager-closure merge-base ratchet.

- docs/agents/testing.md: drop the new bullet. The file was 386 bytes over the
  10,000-byte focused-doc budget, and the gate module's header already owns the
  invariant, so the prose was duplication the ownership rule forbids.
- The closure walker's relative resolver no longer tries a .tsx suffix. The repo
  defines a production source as .ts (tracked-sources.ts pathspecs and
  isProductionSourceFile), so the committed-tree reader never loads .tsx content;
  resolving one produced an edge that reader could not read, crashing the ratchet
  instead of failing it.
- The APPROVED_OVER_CEILING staleness check now looks only at entries still
  first-introduced. Once the merge-base carries an entry, the no-growth rule
  governs it and nothing reads its row again, so the row is stale for the same
  reason a shrunk entry's row is.

Author: thymikee

docs/agents/testing.md

@@ -181,10 +181,6 @@ or remove flakes.
 - Test files over 1,000 lines may be no longer than at the merge-base with `origin/main`, and no
   new test file may cross that line. Split the family before adding tests; shrinking needs no
   gate edit.
-- Package entry surfaces and the designated hub modules may not evaluate more repo modules on
-  import than at the merge-base with `origin/main` (`scripts/__tests__/eager-closure-budgets.ts`);
-  a first-introduced entry fits a per-category ceiling, and a platform façade stays at exactly
-  one module. Shrinking needs no gate edit; growth means moving an import behind `await import`.
 - Keep isolation enabled and the pool on forks — both alternatives were measured and did not help.
   The useful optimization is importing the module under test, not a platform barrel.
 - Local Vitest runs use a four-worker cap. Override it when a run needs a different host share:

scripts/__tests__/eager-closure-budgets.test.ts

@@ -406,13 +406,18 @@ test.for(introduced)(
 );
 
 test('no APPROVED_OVER_CEILING row is stale', () => {
+  // Only a first-introduced entry consults a ceiling. Once the merge-base carries the entry, the
+  // no-growth rule governs it and nothing reads the row again, so a carried entry's row is stale
+  // for the same reason a shrunk one is: it can no longer change any verdict.
+  const introducedById = new Map(introduced.map((entry) => [entry.entryFile, entry]));
   const stale = Object.keys(APPROVED_OVER_CEILING).filter((id) => {
-    const entry = entries.find((candidate) => candidate.entryFile === id);
+    const entry = introducedById.get(id);
     return !entry || eagerClosureGraphOf(absolute(id)).size <= NEW_ENTRY_CEILINGS[entry.category];
   });
   expect(
     stale,
-    'These approvals name an entry that no longer exists or now fits its ceiling: remove the rows.',
+    'These approvals name an entry that no longer exists, that the merge-base now carries, or ' +
+      'that now fits its ceiling: remove the rows.',
   ).toEqual([]);
 });
 

scripts/__tests__/eager-closure-budgets.ts

@@ -20,8 +20,8 @@
 // - An entry absent at the merge-base: a per-category CEILING (`NEW_ENTRY_CEILINGS`). At or
 //   under it, nothing to write. Over it, one `APPROVED_OVER_CEILING` row naming the issue, the
 //   reason, and an owner; the row records no number, and the merge-base carries the entry from
-//   the next PR on. A row for an entry at or under its ceiling, or one that no longer exists,
-//   is stale and fails.
+//   the next PR on. A row is stale once nothing can read it -- the entry is gone, the merge-base
+//   now carries it, or its closure fits the ceiling -- and a stale row fails.
 //
 // Independent of size, a façade entry's closure must never reach a concrete platform
 // implementation (`PLATFORM_IMPLEMENTATION_PATTERNS`) before discovery or binding selects an

src/__tests__/eager-import-closure.fixtures.ts

@@ -125,10 +125,16 @@ const workingTreeReader: SourceTreeReader = {
   readFile: (file) => fs.readFileSync(file, 'utf8'),
 };
 
+/**
+ * `.ts` only, matching what the repo counts as a production source: `tracked-sources.ts` scans
+ * `.ts` pathspecs and `isProductionSourceFile` accepts `.ts`, so a `.tsx` file under a walked root
+ * is invisible to every layering scan. Resolving one here would only produce an edge the committed
+ * tree reader cannot read, which crashes the ratchet instead of failing it.
+ */
 function resolveRelative(from: string, specifier: string, tree: SourceTreeReader): string | null {
   const candidate = path.resolve(path.dirname(from), specifier);
   if (tree.isFile(candidate)) return candidate;
-  for (const suffix of ['.ts', '.tsx', '/index.ts']) {
+  for (const suffix of ['.ts', '/index.ts']) {
     if (tree.exists(`${candidate}${suffix}`)) return `${candidate}${suffix}`;
   }
   return null;