fix(build): repair the selective-component gate, which was red and built into /tmp (#2415)

Three defects, not one.

(1) The gate had been RED since 2026-08-19, behind a green test count. #1889
legitimately gave Text.Json a public Collections.Core dependency -- fail-fast
enumeration needs detail::MutationCounter and the boundary validator rejected
the private declaration outright -- while forbidden_text_json_collections still
asserted List.hpp was unreachable. It went unnoticed because that script is not
part of CLAUDE.md rule 2's gate.

The fixture is RETARGETED rather than deleted, because CLAUDE.md names it as an
invariant. List.hpp was only ever a proxy for "Collections"; the proxy moves to
BlockingCollection, the type that sentence is actually about. That is strictly
stronger: Collections.Blocking publicly needs Threading, so the include can only
compile if Text.Json acquired a Threading requirement -- pinning by COMPILATION
what assert_target_absent pinned by target name alone.

(2) A second, independent defect in the same script: MATRIX_ROOT was a bare
mktemp -d with nothing setting TMPDIR, so every run built eight selective
component trees into /tmp -- the one place the build-resource policy exists to
keep builds out of, and build-tmp/ is in the closed directory list described as
exactly this redirect. The mechanism was designed and never wired up.

(3) Nothing ran the script, which is why (1) survived a day. It now runs last in
local_ci_check.sh, costs a measured ~10 minutes at two jobs stated in the script
rather than left as a surprise, and is deliberately not behind an opt-out: a
check that can be skipped is the check that rotted.

Script exits 0, with the renamed fixture genuinely exercised. Gate unchanged at
17,700/38 -- no production code touched.

Author: robertvokac

CLAUDE.md

@@ -139,6 +139,37 @@
 > and each is itemised in §2 below. **§4b says where to look next, and the method that found all
 > three of today's tickets.**
 
+## 2026-08-20 — #2415: the selective-component gate was red, and building into `/tmp`
+
+**Gate unchanged at 17,700 / 38** — no production code was touched. This repairs a *gate*, and the
+build-policy violation that gate was committing on every run.
+
+**Three defects, not one.**
+
+1. **Red since 2026-08-19, behind a green test count.** #1889 legitimately gave `Text.Json` a
+   **public** `Collections.Core` dependency — fail-fast enumeration needs `detail::MutationCounter`,
+   and the boundary validator *rejected the private declaration outright* — while
+   `forbidden_text_json_collections` still asserted `List.hpp` was unreachable. **Retargeted rather
+   than deleted**, because CLAUDE.md names the fixture as an invariant: `List.hpp` was only a
+   **proxy** for "Collections", and the proxy moves to `BlockingCollection`, the type that sentence
+   is actually about. **Strictly stronger** — `Collections.Blocking` publicly needs `Threading`, so
+   the include can only compile if `Text.Json` acquired a `Threading` requirement, pinning **by
+   compilation** what `assert_target_absent sharp_runtime_threading` pinned by target name.
+
+2. **A second, independent defect in the same script.** `MATRIX_ROOT="$(mktemp -d)"` with nothing in
+   the repository setting `TMPDIR`, so every run built **eight selective component trees into
+   `/tmp`** — the one place the build-resource policy exists to keep builds out of, and `build-tmp/`
+   is in the closed directory list described as exactly this redirect. **The mechanism was designed
+   and never wired up.**
+
+3. **Nothing ran the script**, which is why (1) survived a day. `local_ci_check.sh` ran the boundary
+   validator, the seam checker and the negative-fixture checker but not this. It now runs **last**,
+   costs a **measured ~10 minutes at two jobs** stated in the script rather than left as a surprise,
+   and is deliberately **not** behind an opt-out — a check that can be skipped is the check that
+   rotted.
+
+`docs/Migration-SelectiveComponentCheckRepair.md`.
+
 ## 2026-08-20 — #1945: four `XmlConvert` arguments accepted and discarded
 
 **Gate: 17,700 / 38, 0 failed, 0 skipped** (+6, `Xml` 518 → 524). Graph **41/94 → 41/95**,

NEXT.md

@@ -0,0 +1,84 @@
+<!-- SPDX-License-Identifier: MIT -->
+<!-- Copyright (c) Robert Vokac and contributors -->
+
+# `check_selective_components.sh` was red, and built into `/tmp` — #2415
+
+**No production code changed.** This is a repair of a gate, and of the build-policy violation that
+gate was committing on every run. The test count is unmoved at **17,700 / 38**.
+
+## Defect 1 — red since 2026-08-19, behind a green test count
+
+`scripts/check_selective_components.sh` failed:
+
+```
+FAIL: forbidden consumer fixture forbidden_text_json_collections compiled
+```
+
+and it failed **identically on a clean tree** — verified by stashing the in-flight change and
+re-running, so it was not caused by the work that surfaced it.
+
+**Cause.** `test/consumer/forbidden_text_json_collections.cpp` included
+`System/Collections/Generic/List.hpp` beside `JsonDocument.hpp` and asserted the pair must not
+compile in a selective `Text.Json` build. **#1889 made that boundary legitimate**: `JsonArray` and
+`JsonObject` gained fail-fast enumeration, which needs
+`System::Collections::detail::MutationCounter`, and the module-boundary validator **rejected the
+private declaration outright** — so `modules/text-json` took `Collections.Core` as a **public**
+dependency. The fixture then asserted a boundary that had deliberately been moved.
+
+**Why it went unnoticed for a day.** This script is **not part of CLAUDE.md rule 2's gate**, so a
+green 17,68x reading said nothing about it. Every checkpoint since #1889 was recorded as green while
+this was red.
+
+**The repair retargets rather than deletes**, because CLAUDE.md names the fixture as an invariant:
+*"BlockingCollection<T> belongs to Collections.Blocking; do not add its Threading requirements back
+to Collections.Core or weaken the Text.Json isolation fixture."* `List.hpp` was only ever a **proxy**
+for "Collections"; the proxy moves to the type that sentence is actually about, and the file is
+renamed so its name still says what it asserts.
+
+**The new proxy is strictly stronger.** `Collections.Blocking` declares `PUBLIC_DEPENDENCIES
+Collections.Core Core.Base Threading`, so the include can only compile if `Text.Json` has acquired a
+`Threading` requirement — which is exactly what the surrounding `assert_target_absent
+sharp_runtime_threading` exists to prevent, now pinned **by compilation** rather than by a target
+name alone.
+
+## Defect 2 — the script built into `/tmp`
+
+`MATRIX_ROOT="$(mktemp -d)"`, with **nothing in the repository setting `TMPDIR`**. CLAUDE.md's
+build-resource policy says in terms: *"Never create a build tree under `/tmp`, `/var/tmp`, or
+`/dev/shm` … Redirect `mktemp`-based scripts through a repository-local `TMPDIR` (this repository
+uses `build-tmp/`)"* — and `build-tmp/` is in the closed list of build directories, described as
+exactly this. **The mechanism was designed and never wired up.**
+
+This script configures and builds **one selective component tree per matrix entry**, so every run
+was putting eight build trees in the one place the policy exists to keep builds out of. Now:
+
+```bash
+mkdir -p "$REPO_ROOT/build-tmp"
+MATRIX_ROOT="$(TMPDIR="$REPO_ROOT/build-tmp" mktemp -d)"
+```
+
+The script's existing `EXIT` trap still removes its own tree, so nothing accumulates.
+
+## Defect 3 — nothing ran it
+
+The proximate cause of defect 1 surviving a day is that **no routine invoked this script**.
+`scripts/local_ci_check.sh` — which its own header calls a pre-push gate — ran the boundary
+validator, the seam checker and the negative-fixture checker, but not this.
+
+It now runs, **last**, so the cheap checks and the full suite still report first. **It costs about
+ten minutes** (measured 2026-08-20 at two jobs), and that is stated in the script rather than left
+as a surprise. It is deliberately **not** behind an opt-out: a check that can be skipped is the
+check that rotted.
+
+## Evidence
+
+`scripts/check_selective_components.sh` exits **0**, with the log showing the renamed fixture
+genuinely exercised:
+
+```
+negative fixture forbidden_text_json_collections_blocking rejected
+negative fixture forbidden_text_json_object_model rejected
+```
+
+Gate unchanged at **17,700 / 38, 0 failed, 0 skipped** — no production code was touched. Module
+graph **41 / 95**. Negative fixture set **53 / 269**, unchanged.

docs/Migration-SelectiveComponentCheckRepair.md

@@ -155,6 +155,37 @@ exactly, this batch's own tests, no regression**. Graph **41 / 92**, seams **3 /
 sole member is now remediated**; CCF-019 open; CCF-021/#2131 and CCF-022/#2109 unminted. Doxygen,
 `ccache` and `/rv` absent. Maximum compiler parallelism **2 jobs**.*
 
+## 2026-08-20 — #2415: the selective-component gate was red, and building into `/tmp`
+
+**Gate unchanged at 17,700 / 38** — no production code was touched. This repairs a *gate*, and the
+build-policy violation that gate was committing on every run.
+
+**Three defects, not one.**
+
+1. **Red since 2026-08-19, behind a green test count.** #1889 legitimately gave `Text.Json` a
+   **public** `Collections.Core` dependency — fail-fast enumeration needs `detail::MutationCounter`,
+   and the boundary validator *rejected the private declaration outright* — while
+   `forbidden_text_json_collections` still asserted `List.hpp` was unreachable. **Retargeted rather
+   than deleted**, because CLAUDE.md names the fixture as an invariant: `List.hpp` was only a
+   **proxy** for "Collections", and the proxy moves to `BlockingCollection`, the type that sentence
+   is actually about. **Strictly stronger** — `Collections.Blocking` publicly needs `Threading`, so
+   the include can only compile if `Text.Json` acquired a `Threading` requirement, pinning **by
+   compilation** what `assert_target_absent sharp_runtime_threading` pinned by target name.
+
+2. **A second, independent defect in the same script.** `MATRIX_ROOT="$(mktemp -d)"` with nothing in
+   the repository setting `TMPDIR`, so every run built **eight selective component trees into
+   `/tmp`** — the one place the build-resource policy exists to keep builds out of, and `build-tmp/`
+   is in the closed directory list described as exactly this redirect. **The mechanism was designed
+   and never wired up.**
+
+3. **Nothing ran the script**, which is why (1) survived a day. `local_ci_check.sh` ran the boundary
+   validator, the seam checker and the negative-fixture checker but not this. It now runs **last**,
+   costs a **measured ~10 minutes at two jobs** stated in the script rather than left as a surprise,
+   and is deliberately **not** behind an opt-out — a check that can be skipped is the check that
+   rotted.
+
+`docs/Migration-SelectiveComponentCheckRepair.md`.
+
 ## 2026-08-20 — #1945: four `XmlConvert` arguments accepted and discarded
 
 **Gate: 17,700 / 38, 0 failed, 0 skipped** (+6, `Xml` 518 → 524). Graph **41/94 → 41/95**,

plan.md

@@ -6,7 +6,13 @@ set -euo pipefail
 export PYTHONDONTWRITEBYTECODE=1
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-MATRIX_ROOT="$(mktemp -d)"
+# CLAUDE.md's build-resource policy forbids a build tree under /tmp and names `build-tmp/` as
+# this repository's local TMPDIR for exactly this kind of mktemp-based script. THE MECHANISM WAS
+# DESIGNED AND NEVER WIRED UP: this line was a bare `mktemp -d`, so every run of this script --
+# which configures and builds one selective component tree per matrix entry -- built into /tmp,
+# the one place the policy exists to keep builds out of. Found and repaired by #2415.
+mkdir -p "$REPO_ROOT/build-tmp"
+MATRIX_ROOT="$(TMPDIR="$REPO_ROOT/build-tmp" mktemp -d)"
 trap 'rm -rf "$MATRIX_ROOT"' EXIT
 
 # Resolve the same repository job budget as local CI and export it to every
@@ -111,7 +117,7 @@ check_component() {
             echo "FAIL: Text.Json unexpectedly configured ZLIB" >&2
             exit 1
         fi
-        expect_consumer_failure Text.Json forbidden_text_json_collections.cpp
+        expect_consumer_failure Text.Json forbidden_text_json_collections_blocking.cpp
         expect_consumer_failure Text.Json forbidden_text_json_object_model.cpp
     elif [ "$component" = "Xml.Linq" ]; then
         expect_consumer_failure Xml.Linq forbidden_xml_diagnostics.cpp

plan.sqlite3

@@ -60,4 +60,17 @@ echo "    build clean: 0 warnings, 0 errors"
 echo "==> Running tests"
 scripts/run_component_tests.sh "$BUILD_DIR"
 
+# ADDED BY #2415, AND THE REASON IS THAT ITS ABSENCE WAS THE DEFECT. The selective-component
+# check verifies an invariant nothing else does -- that a component built on its own drags in no
+# more than it declares -- and because NOTHING RAN IT, it sat red for a day behind a green test
+# count: #1889 legitimately gave Text.Json a public Collections.Core dependency while a fixture
+# still asserted the opposite, and CLAUDE.md rule 2's gate says nothing about either.
+#
+# IT COSTS ABOUT TEN MINUTES (measured 2026-08-20, two jobs), because it configures and builds one
+# selective tree per matrix entry. That is stated here rather than left as a surprise. It runs
+# LAST, so the cheap checks and the full suite still report first, and it is deliberately NOT
+# behind an opt-out: a check that can be skipped is the check that rotted.
+echo "==> Checking selective component isolation (~10 min)"
+scripts/check_selective_components.sh
+
 echo "==> Local CI check passed"

scripts/check_selective_components.sh

@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: MIT
+// Copyright (c) Robert Vokac and contributors
+//
+// RETARGETED BY #2415, AND RENAMED SO THE NAME STILL SAYS WHAT IT ASSERTS.
+//
+// This fixture used to include `System/Collections/Generic/List.hpp` and assert that a selective
+// `Text.Json` build could not reach it. **#1889 made that boundary legitimate**: `JsonArray` and
+// `JsonObject` gained fail-fast enumeration, which needs
+// `System::Collections::detail::MutationCounter`, and the module-boundary validator REJECTED the
+// private declaration outright -- so `modules/text-json` took `Collections.Core` as a PUBLIC
+// dependency. The fixture then asserted a boundary that had deliberately been moved, and it has
+// been failing since 2026-08-19 behind a green test count.
+//
+// IT IS RETARGETED RATHER THAN DELETED, because CLAUDE.md names it as an invariant:
+// "BlockingCollection<T> belongs to Collections.Blocking; do not add its Threading requirements
+// back to Collections.Core or weaken the Text.Json isolation fixture." `List.hpp` was only ever a
+// PROXY for "Collections"; the proxy moves to the type that sentence is actually about.
+//
+// AND THE NEW PROXY IS STRICTLY STRONGER than the old one. `Collections.Blocking` declares
+// `PUBLIC_DEPENDENCIES Collections.Core Core.Base Threading`, so this include can only compile if
+// `Text.Json` has acquired a `Threading` requirement -- which is precisely what the surrounding
+// `assert_target_absent sharp_runtime_threading` exists to prevent, now pinned by compilation
+// rather than by a target name alone.
+#include "System/Text/Json/JsonDocument.hpp"
+#include "System/Collections/Concurrent/BlockingCollection.hpp"
+
+int main() {
+    return 0;
+}