finding(scripts): the recorder-wait census counts declarations as reads and lets its window run into the next test — 7 of its 18 strict flags are not reads

[os-justin]

Filed as an out-of-scope by-product of objectui#8703 (branch claude/issue-8703-matcher-dependent-strict-bucket). Not claimed, not assigned. The card objectui#8703 characterised the defect and recorded it in scripts/census-recorder-wait-shape.mjs's header; this card is the repair, which objectui#8703 declared out of scope.

What was measured

Two rules in scripts/census-recorder-wait-shape.mjs are the same in both --recorder-match modes and dominate the mode choice the census was carded about:

• D1 — the forward window is not scoped to the enclosing test. Step 3 scans from the end of the wait to the next textual await in the file. A waitFor that is the last await of its test therefore gets a window that runs on into the next test — and the next test's opening lines are exactly where recorder arrays get declared.
• D2 — any textual occurrence counts as a "read". Only X.push( is excluded. A declaration (const blobs: Blob[] = []), a destructuring (const { requested } = installMetaRouter(...)), a reset (gridSchemas.length = 0) and a function parameter named log all register as reads.

Measured on da5e4f69e, --recorder-match=path, 18 strict flags: SEVEN point at something that is not a read.

flagged line	what it actually is
form-onchange-wiring.test.tsx:207	const received: Record_[] = []; — declaration in the NEXT it
DatasetWidget.localSelectI18n.test.tsx:356	const blobs: any[] = []; — declaration in the next it
DatasetWidget.optionLabelI18n.test.tsx:313	const { requested } = installMetaRouter(...) — a different describe
DatasetWidget.tableTotalsRow.test.tsx:319	const blobs: Blob[] = []; — declaration in the next it
ObjectView.tableColumnsForwarding.test.tsx:136	const seen: any[] = []; — a different helper function
ObjectView.tableColumnsForwarding.test.tsx:149	gridSchemas.length = 0; — a reset, in yet another helper
providerCtxIdentity.discarded.test.tsx:515	function makeFetcher(tag: string, log: string[]) — a parameter name

In every one of the six audited by objectui#8703, the wait's enclosing it or helper closes before the flagged line, and the flagged recorder is never mentioned inside the wait's own block.

Forced, not read

A throwaway git repo with five fixtures, run through the real script (both modes). Fixture f4-window-crosses-test.test.ts:

it('a — its wait is the last await of this test', async () => {
  const first: number[] = [];
  first.push(1);
  await waitFor(() => expect(first.length).toBe(1));
  expect(first[0]).toBe(1);
});

it('b — a different test, with its own recorder', async () => {
  const second: number[] = [];
  second.push(2);
  await waitFor(() => expect(second.length).toBe(1));
});

Both modes flag f4-window-crosses-test.test.ts:9 — which is const second: number[] = [];, in a different test. D1 and D2, reproduced in isolation.

The same truncation loses real hazards

Fixture f5-window-truncated.test.ts — a genuine cross-recorder read, one await further on:

await waitFor(() => expect(arrivals.length).toBe(1));
await Promise.resolve();
expect(payloads[0]).toBe(2);   // the real hazard

Zero flags, in both modes. So the instrument is not merely imprecise, it is also blind in the direction that matters: the window ends at the second await and the read is never examined.

What a repair has to do

Not a bigger regex. The recorder's identity is currently its spelling at the push site, matched textually at the read site by a name regex whose lookbehind forbids a preceding . — which is also why the two matcher modes are incomparable (see objectui#8703). A quotable instrument needs to:

1. resolve recorder identity (binding / alias resolution over an AST — same array object, not same name);
2. scope the forward window to the enclosing test body, in statements rather than characters;
3. classify each occurrence as read / write / declaration.

That is an AST pass, not a census script. ⛔ Whatever it becomes, it must stay out of CI while its bucket is matcher-dependent — that fence is objectui#8703's own conclusion and it is recorded in the script header.

Dedup — declared

search_issues returns false zeros in this repo, so a zero would not be evidence. The query run here was not a zero: census recorder wait shape script window ends at next await, declaration counted as a read, false positives scoped to this repo returned six hits (objectui#8327, objectui#8492, objectui#8703, objectui#8690, objectui#6938, objectui#6724) — a self-validating non-empty result. objectui#8492 is the same defect class in the docs census, not this instrument; nothing matching this finding.

Generated by Claude Code in session session_01YBWFb5YgMU5dw8p2VKj16S (attribution written as prose, because a footer block is stripped on issue creation).

[os-justin]

Claim: session session_01YBWFb5YgMU5dw8p2VKj16S · branch claude/issue-8704-census-matcher-ast

PM dispatch (domain:ui seat). The assignee and this comment are set by the PM on the dev's behalf — the dev inherits both, posts no second claim, and ⛔ never writes the assignee field.

⭐ This is the repair objectui#8703 declared out of scope, and it is determinate

Three named defects in scripts/census-recorder-wait-shape.mjs, all measured, none needing a ruling:

1. The forward window ends at the next await in the FILE, not at the end of the enclosing test.
2. Every textual occurrence counts as a read — no distinction between a read, a write, and a declaration.
3. ⇒ together, 7 of 18 strict flags land on declarations, destructurings, a reset (gridSchemas.length = 0) and a function parameter, and — the other direction — a genuine hazard one await further on draws ZERO flags in both matcher modes (fixture f5).

The card names the fix: AST identity resolution, test-scoped windows, and read/write/declare classification.

⚠️ What the instrument currently is, so you do not over-claim the repair

objectui#8703 established that no count this script prints is a corpus fact — objectui#8690's 9, its own 15/18, and any future run. That verdict is in the script header and printed beside its own counts.

⇒ your repair changes what it can honestly claim, and you must say by how much. Specifically:

• ⭐ Does the repaired matcher earn back a quotable number? If AST resolution + test-scoped windows + read/write classification remove all three known error sources, say so and prove it against the known-wrong cases — the 7 misclassified flags must go, and f5's hidden hazard must appear.
• ⚠️ If it does not — if some residual keeps the count untrustworthy — the header's caveat stays and you say why. ⛔ Do not quietly delete the caveat because the matcher got better. Removing it is a claim, and it needs the same evidence as any other.

⭐ The fixtures already exist — use them as the test suite

objectui#8703 built five throwaway fixtures that pin the current behaviour exactly:

f1  member-push / member-read              → path mode only
f2  member-push / bare-read                → ident mode only     (incomparable, both directions forced)
f3  bare-push  / member-read               → ZERO in both        (the shared blind spot)
f4  wait-is-last-await                     → both flag `const second: number[] = []` in the NEXT test
f5  real hazard behind one more await      → ZERO flags          (the mirror loss)

⇒ commit them as the script's own test suite. They were throwaway; they should not be. f3, f4 and f5 are the three defects stated as executable cases, and a repair that does not move them has not moved anything.

⚠️ Add the sixth: a case that must stay flagged (the real MetadataObjectsPage.lookupKeying shape objectui#8690 repaired). A matcher that fixes over-reporting by reporting nothing is the caricature here — run it.

Evidence bar

• ⭐ Leg 1: on the pre-repair script, show each of f3/f4/f5 producing its wrong answer. That is the baseline your repair is measured against, and it is cheap because the fixtures exist.
• Leg 2: the repaired script gives the right answer on all six.
• Leg 3: re-run the repaired script over the real corpus (2776 test files) and report both numbers — before and after — with the delta explained by category. ⚠️ A number you cannot decompose is the thing this card exists to stop.
• ⭐ The control that matters: the 9 sites objectui#8690 audited are now classified by hand (1 real, 8 sound) and the 7 objectui#8703 read are classified too (1 real read, 6 not reads at all). That is 16 hand-verified labels — use them as ground truth. A repaired matcher that disagrees with a hand verdict is either wrong or has found something; either way, say which and why.

Scope and collisions

• ⚠️ scripts/census-recorder-wait-shape.mjs is in TWO PRs currently in the merge queue — PR test: audit the nine recorder-wait sites — one repaired, eight measured sound #8702 (which created it) and PR chore(scripts): record what the recorder-wait census's two matchers disagree about #8706 (which annotated its header). Check whether they have landed before you branch. If they have not, base on main and merge main in once they do (⛔ never rebase, ⛔ never force-push), then re-run everything. ⭐ The reliable read of the queue is git ls-remote --heads origin 'gh-readonly-queue/*' — a pr-<N>-<sha> branch means that PR is queued and building.
• ⛔ Do not wire the detector into CI. objectui#8703's whole point is that a matcher-dependent instrument must not become a gate. If your repair genuinely makes it gate-worthy, that is a proposal to report, not to implement.
• ⛔ Do not re-litigate the ~151 non-recorder-wait flags or re-audit sites. This card is the instrument, not its output.

Verification standard

• Verify by CONTENT, never by exit code.
• ⚠️ An assertion never observed to fail has not been tested — every fixture case must be observed failing on the pre-repair script.
• Ask of every check: "Would an implementation strictly worse than the bug pass this?" ⇒ here that is "flag nothing", and the sixth fixture is what catches it.
• Ablation: mutate a READ SITE (never the fixture), from a committed tree, trap on EXIT/INT/TERM with absolute paths, proving the mutation on disk in both directions (anchor counts AND git hash-object vs the HEAD blob) plus a line-total gate; restore by state (git diff HEAD empty; git checkout HEAD -- ABSOLUTE_PATH, never the bare form). A void leg is VOID, not green; a leg that lands but does not discriminate is NEGATIVE, not void.
• ⚠️ git checkout HEAD -- PATH destroys uncommitted work in that path without a word. Commit your own edits before any leg touches their file — that cost a redo on PR test(plugin-map,plugin-timeline): pin what these two contractEnvelope-6839 waits were standing on #8713 tonight.
• Run from the repo root with paths. ⛔ --no-inline-config is an objectstack convention and manufactures errors here CI does not have.
• skip-changeset is a phantom label; the real exemption is an empty-frontmatter changeset. scripts/ is not published source — get the gate's own verdict line.
• ⚠️ search_issues returns false zeros here (measured tonight: total_count: 0 for 'contractEnvelope-6839' against a card full of that token) and REST search has answered 403 including its control. Declare your channel; ⛔ if neither works, report rather than filing blind.

---

Generated by Claude Code

[os-justin]

os-dev-report

{
  "issue": 8704,
  "status": "done",
  "branch": "claude/issue-8704-census-matcher-ast",
  "pr": "https://github.com/objectstack-ai/objectui/pull/8719",
  "premise_still_valid": true,
  "summary": "scripts/census-recorder-wait-shape.mjs now defaults to an AST matcher: recorder identity resolved over bindings and aliases (six forms, plus one hop through a same-file helper PARAMETER and one through a same-file factory's returned object literal, with PREFIX-AWARE canonicalisation), forward windows scoped to the enclosing test body in statements and ending at the next awaited SETTLING anchor rather than at any await, and every occurrence classified read/write/declaration. The original regex census is kept verbatim behind --matcher=regex so objectui#8690's and objectui#8703's published numbers stay reproducible from the file rather than being claims about a deleted script — verified: at da5e4f69e it still prints 159/15/10 for ident and 167/18/12 for path, exactly as published. objectui#8703's five throwaway fixtures are committed as the script's test suite plus the sixth the card asked for (the absence read objectui#8690 repaired, which must STAY flagged); both matchers are pinned over the same six files so the repair is pinned as a direction. BRANCH IS STACKED on PR #8706 (itself stacked on #8702) because the script exists on no other branch — there was nothing on main to repair; #8706 entered the merge queue during this run and a main merge is owed once it lands (never a rebase). NOT wired into CI, and the pin test runs the matcher over the fixtures only, never the corpus.",
  "tests": "LEG 1 (pre-repair, from the committed blob 3732191f, six fixtures in a throwaway git repo, BOTH modes): f3 ZERO in both (a genuine read, blind); f5 ZERO in both (the mirror loss); f4 six wrong flags in both, itemised by the line each lands on — `const second: number[] = [];` / `const third` / `const scratch` (D1+D2), `scratch.length = 0;` (D2 ALONE, same test), `const shared` , `expect(shared[0]).toBe(4);` (D1 ALONE, a genuine read in the wrong test); f1 path-only, f2 ident-only (M1); f6 correct in both. Every fixture answer was observed WRONG before the repair. LEG 2 (repaired, same six): f1:19 f2:21 f3:22 f5:23 f6:29 flag, f4 ZERO — all six right. LEG 3 (corpus at da5e4f69e, 2776 files): regex ident 159/15/10, regex path 167/18/12, AST 138/20/12. The strict delta against path decomposes EXACTLY with no residue: -7 = precisely the seven objectui#8703 read and found were not reads at all (nothing else removed); +9 = seven recorders unreachable by name matching through a host object, a factory return or a destructured factory return (ObjectChart.optionColors x3, DatasetWidget.relabel, ObjectView.expandGate, providerCtxIdentity.discarded x2) and two reads truncated away behind an ordinary await (anonSeedScope-5746.enumeration behind `await settle()`, rowRecordCrudVerdict behind `await act(...)`). 18-7+9=20. At this branch's base: path 167/17/11, AST 138/19/11 (one fewer each, #8702's own repair). The new pin test moves the population 2776->2777 and contributes ZERO flags in every matcher. GROUND TRUTH 16/16: objectui#8690's nine — eight flagged; the ninth (MetadataObjectsPage.lookupKeying:380) absent, and a CONTROL proves that is #8702's repair and not blindness — run over the da5e4f69e copy of that one file the AST matcher flags :380 (the card's single real defect, at the hand-verified line), over this branch's copy it flags nothing. objectui#8703's seven — all six NOT-A-READ verdicts absent, the one genuine read (PermissionMatrixEditor.scope:177) flagged; objectui#8704's extra parameter observation (providerCtxIdentity.discarded:515) absent. WARNING, two agreements were bought not free: the first draft LOST five hand-verified GENUINE reads (three PermissionMatrixEditor server.savedOpts sites, ObjectChart.optionColors:285, DatasetWidget.relabel:206) because binding identity is narrower than name identity — the pushes go through a helper parameter and a factory return. Caught only by checking against the hand verdicts; the two one-hop rules exist to answer it. ABLATION, four legs, each mutating a READ SITE inside the matcher (never a fixture — that would be circular), from a committed tree, trap on EXIT/INT/TERM with absolute paths, mutation proved on disk in both directions (anchor count 1->0, injected marker 0->1, git hash-object vs the HEAD blob, plus a line-total gate), restored BY STATE (git diff HEAD empty AND on-disk blob == HEAD blob, both checked), per-test classification from vitest's JSON reporter. A1 classification disabled: RED, `expected [ 'scratch.length = 0;' ] to deeply equal []`. A2 window ends at any awaited call: RED, `expected [] to deeply equal [ 'expect(payloads[0]).toBe(2);' ]`. A3 identity resolution disabled: RED, f2 and f3 both collapse to []. A4 flag nothing (the caricature): RED ON f6 ONLY — `expected [] to deeply equal [ 'expect(deletes).toEqual([]);' ]` — while `the runaway window flags NOTHING in f4` and every other must-be-empty assertion stayed GREEN. That is exactly why the sixth fixture exists. GATES: `pnpm exec vitest run scripts/` from the repo root with paths — 128 passed | 2 skipped (130 files), 3708 tests passed (the two error banners in that log are the deliberate failure-path stdout of the population-collapse and governed-guard pin tests); the new pin test alone 11 passed; `pnpm type-check:scripts` green and NOT vacuous (tsc --listFiles confirms all nine new .ts files including every fixture are in the checked program); eslint clean on script, pin test and fixture dir (no --no-inline-config); check-control-bytes and check-changeset-presence green, the changeset declares EMPTY frontmatter and the gate's own verdict line says so; check-governed-queue-guard --test over all ten changed paths: 'NOT GOVERNED — 10 path(s) checked against 5 governed surface(s); none matched'. Kept in DRAFT anyway and neither auto-merge nor the queue was touched, because the branch is stacked on two unlanded PRs.",
  "mcp_calls": "1 — one targeted search_issues for the out-of-scope dedup below; it returned 3 hits (self-validating, not a false zero). Everything else (issue and PR reads, PR creation, this comment) went over repo-scoped REST, probed first and declared.",
  "open_questions": [
    {
      "question": "The card asks whether the repaired matcher earns back a quotable number. Answered, not open, and recorded here because the answer is the deliverable: NO. The header caveat STAYS, restated rather than deleted, with its residuals now measured — R1 no type checker, one file at a time, each interprocedural rule ONE HOP; R1' the parameter hop OVER-MERGES when a helper is called with different arrays, which can only LOSE a flag and never invent one; R2 the window rule is a JUDGEMENT, measured not asserted — adding `act` to the anchor set takes the strict bucket 19->18 and total flags 138->132, removing exactly rowRecordCrudVerdict:235; R3 a flag is still not a defect, and 8 of the 9 hand-verified genuine reads were and remain SOUND BY CONSTRUCTION, which no matcher can see. The number is now DECOMPOSABLE, not quotable.",
      "options": [
        "A — keep the caveat, quote the number only as 'sites this instrument points at' (implemented)",
        "B — delete the caveat because 16/16 hand labels agree (rejected: agreement says the list is a good list of PLACES TO READ, not that anything on it is wrong)"
      ],
      "recommendation": "A, implemented. Removing the caveat is a claim needing the same evidence as any other, and R2 alone refutes it: a bucket that moves by one when `act` changes category is a reading of the matcher, not of the corpus."
    },
    {
      "question": "Is the repaired detector now gate-worthy? The card says that would be a proposal to report, not to implement.",
      "options": [
        "A — leave it out of CI (implemented; the pin test touches fixtures only, never the corpus)",
        "B — wire the corpus census into CI as a ratchet"
      ],
      "recommendation": "A. R2 is decisive: one judgement call about whether `await act(...)` settles a recorder moves the bucket by one. A gate on a list that moves with the matcher's own taste would institutionalise exactly the batch repair objectui#8690 exists to prevent."
    }
  ],
  "out_of_scope_findings": [
    "NOT FILED, reported for the PM to card or drop — the repaired matcher points at NINE strict sites the regex census never showed, all itemised with their category in PR #8719's Leg 3 section. Seven are recorders reached through a host object / factory return / destructured factory return; two are reads behind an ordinary `await` (anonSeedScope-5746.enumeration:397, rowRecordCrudVerdict:235). FOUR of the nine sit in packages/permissions (providerCtxIdentity.discarded:546/:573/:619/:626) which is objectui#8688 / PR #8689 territory and was left entirely alone. NOT filed for two reasons: (1) this card fences the instrument's OUTPUT explicitly ('do not re-litigate ... do not re-audit sites'), and a successor card would be objectui#8690 / objectui#8703's genre, not this one's; (2) the dedup read was run and is honest — `recorder wait census AST matcher new strict sites nobody has read after the repair`, repo-scoped, returned 3 hits (objectui#8704, objectui#8703, objectui#8690), a non-empty self-validating result with nothing covering this list. Filing it is a triage decision, so it goes to the PM rather than being filed blind or silently dropped.",
    "NOT A DEFECT, recorded so it is not lost — the census's output spelled every recorder by its PUSH-SITE name, which on the real corpus rendered a correct flag as 'waits [calls] reads calls' (two distinct arrays sharing a push-site spelling). Fixed inside this PR: recorders are now spelled as the wait and the read site write them. Pinned by a test."
  ]
}

---

Generated by Claude Code

[os-justin]

Contract review — accepted. ⛔ PR #8719 stays in DRAFT, and that was the right call.

The branch is stacked on PR #8706, itself stacked on PR #8702, because the script exists on no other branch — there was nothing on main to repair. Neither auto-merge nor the queue was touched. ⭐ Correct: flipping it now would arm a PR carrying two other PRs' diffs.

⚠️ Queue state, read the free way (git ls-remote --heads origin 'gh-readonly-queue/*'): neither #8702 nor #8706 has landed. #8702 is armed and waiting (echo 23:27:32Z); #8706 was disarmed and I re-armed it. ⇒ I am tracking the chain; #8719 gets flipped and armed once #8706 lands and main is merged in (⛔ never a rebase). Nothing for you to do.

⭐⭐ The card's central question has a NEGATIVE answer, and that is the deliverable

NO. The header caveat STAYS, restated rather than deleted, with its residuals now measured.

And the residual that settles it:

R2 — the window rule is a JUDGEMENT, measured not asserted: adding act to the anchor set takes the strict bucket 19 → 18 and total flags 138 → 132, removing exactly rowRecordCrudVerdict:235.

⇒ ⭐ a bucket that moves by one when await act(...) changes category is a reading of the matcher, not of the corpus. That is the whole argument, produced as a measurement rather than a worry — and it is why option B (delete the caveat because 16/16 hand labels agree) is correctly rejected: "agreement says the list is a good list of PLACES TO READ, not that anything on it is wrong."

The number is now DECOMPOSABLE, not quotable. That distinction is worth more than a smaller number would have been, and the decomposition is exact:

−7 = precisely the seven objectui#8703 read and found were not reads at all (nothing else removed); +9 = seven recorders unreachable by name matching through a host object / factory return / destructured factory return, plus two reads truncated away behind an ordinary await. 18 − 7 + 9 = 20, no residue.

⭐⭐⭐ The repair nearly shipped a recall regression, and only ground truth caught it

This is the most important thing in the run:

binding identity is NARROWER than name identity: my first working draft silently lost five hand-verified GENUINE reads — three PermissionMatrixEditor server.savedOpts sites, ObjectChart.optionColors:285, DatasetWidget.relabel:206 — because their pushes go through a helper parameter (makeClient(server)) and a factory return (makeHost()). Caught only by checking against the hand verdicts.

⚠️ The fixtures were all green at that point. A six-case suite passing completely while recall silently dropped by five — that is this session's recurring shape, occurring inside the repair for it. ⇒ the two one-hop interprocedural rules exist because of that check, and the card's insistence on the 16 hand-verified labels is vindicated in the strongest available way: the fixture suite could not have caught it, and did not.

⭐ And R1' is stated with its direction: the parameter hop over-merges when a helper is called with different arrays, which can only LOSE a flag, never invent one. A residual whose direction of error is known is a different object from one that is merely acknowledged.

The archival discipline is the part I did not ask for

the original regex census is kept verbatim behind --matcher=regex, so objectui#8690's and objectui#8703's published numbers stay reproducible from the file rather than being claims about a deleted script — verified: at da5e4f69e it still prints 159/15/10 for ident and 167/18/12 for path, exactly as published.

⇒ every number this family has published remains checkable, instead of becoming folklore the moment the matcher improved. ⭐ Given that objectui#8703's whole finding was "these counts are not corpus facts," preserving the ability to re-derive them is what keeps that finding falsifiable too.

Ground truth 16/16, with a control for the one absence: over da5e4f69e's copy of MetadataObjectsPage.lookupKeying the AST matcher flags :380 — the single real defect, at the hand-verified line — and over this branch's copy it flags nothing. ⇒ the absence is PR #8702's repair, not blindness, proved rather than assumed.

A4 (flag nothing) reddens on f6 ONLY, while every must-be-empty assertion stays green. ⭐ That is exactly why the sixth fixture was added to the brief, and it is the only leg that catches the caricature.

Both open questions: A, and correctly answered rather than left open

• The caveat stays. ⇒ quote the output only as "sites this instrument points at."
• ⛔ Not gate-worthy, and R2 is decisive: "a gate on a list that moves with the matcher's own taste would institutionalise exactly the batch repair objectui#8690 exists to prevent." The pin test touching fixtures only, never the corpus, is the right shape.

The nine new strict sites — my ruling: recorded, ⛔ not carded

The repaired matcher points at nine sites the regex never showed. ⚠️ Four sit in packages/permissions (objectui#8688 / PR #8689 territory) and were left entirely alone — correct.

⛔ No new audit card. Same ruling as the 541 negated matchers on objectui#8708, on the same evidence: objectui#8690's audit came back 1 real / 8 sound, objectui#8703's 1 real / 6 not even reads, and this card has just established that the list is places to read, not defects. ⇒ a nine-row card would invite the batch sweep every one of those results argues against.

⭐ I am recording them on objectui#8690 — the family's audit card — where they stay findable with their caveat attached and cost nobody a run. Your dedup was honest and self-validating (3 hits, non-empty), and handing a triage decision to the PM rather than filing blind or dropping it silently is the right escape.

The recorder-spelling fix folded in (waits [calls] reads calls on two distinct arrays sharing a push-site spelling) is a bounded in-place correction of the same instrument, pinned. Correct to fix rather than file.

---

Generated by Claude Code

[os-justin]

os-dev-report
{
"issue": 8704,
"status": "done",
"branch": "claude/issue-8704-census-matcher-ast",
"pr": "#8719",
"pr_state": "open, DRAFT (draft:true), auto_merge:null — left exactly as dispatched",
"pushed_sha": "063a9753402478b6ca426df2d392f87f7a015426",
"premise_still_valid": true,

"summary": "Merged origin/main into the branch (no rebase, no amend, no force-push) and resolved the single add/add conflict on scripts/census-recorder-wait-shape.mjs, then rewrote the header claim by claim. The conflict was an artefact of the merge base rather than a real divergence: the file is absent at da5e4f6, and main's side of the conflict is blob 3732191fb, byte-identical to this branch's OWN parent commit 3778170 — i.e. #8706 landed exactly the version this branch built its AST matcher on top of, so this branch's side drops no byte main carries. Byte identity is not claim identity, though: four of main's five header claims survived the AST rewrite in some form, and ONE (the nested-buckets measurement) had been silently dropped. It is restored, re-measured on both trees. One residual neither card named was found and added: the AST window rule repairs only HALF of D1.",

"resolution_mechanics": {
"merge_base": "da5e4f69ebd55f0dd943cb93f9319b0e11e3f30c — the script is ABSENT here, which is why both sides read as an ADD",
"conflict_stage_2_ours_branch": "2ca53244c468738034f611189d7aef9e416e99ff (850 lines, the AST rewrite)",
"conflict_stage_3_theirs_main": "3732191fb7d4c6c7a6cc656f5e2caebbfb7f6500 (167 lines)",
"proof_nothing_lost": "git rev-parse 3778170:scripts/census-recorder-wait-shape.mjs == 3732191fb7d4c6c7a6cc656f5e2caebbfb7f6500 == MERGE_HEAD's blob. main's content IS this branch's own parent content.",
"other_conflicts": "none — 80 other paths auto-merged, only this one file was AA",
"commits": [
"316a3f7d3 Merge origin/main into claude/issue-8704-census-matcher-ast (resolution + the blob-identity proof in the message)",
"063a97534 chore(scripts): resolve the census header claim by claim, not file by file"
]
},

"per_claim_verdicts": [
{
"claim": "1. The two regex modes are INCOMPARABLE BY CONSTRUCTION (path-only and ident-only examples), plus the self-correction that a recorder pushed bare and read as host.inits[0] is a SHARED blind spot, not a path-only miss.",
"verdict": "KEPT, REWORDED — and demoted from a caveat on the file's output to a fault of --matcher=regex only. Retired as a caveat on the DEFAULT matcher.",
"measurement": "The pin test makes it executable rather than asserted (11/11 green, JSON reporter). regex path flags f1 and NOT f2; regex ident flags f2 and NOT f1; BOTH miss f3. The AST matcher flags f1, f2 and f3, so there is no mode left whose choice could move the answer. The erratum itself was NOT dropped: M2 now carries an explicit 'an earlier header called this a path-only miss. It is not: the lookbehind forbids a dotted read in BOTH modes' clause."
},
{
"claim": "2. On this corpus the buckets are NESTED — at da5e4f6 ident's 15 is a subset of path's 18, ident-only is empty — so 'their strict buckets do not contain each other' is true in principle and FALSE as a measurement of this tree.",
"verdict": "KEPT — and this is the ONE claim the branch's rewrite had silently dropped. RESTORED, re-measured on two trees rather than copied forward.",
"measurement": "Ran --matcher=regex in both modes at da5e4f6 (a throwaway detached worktree, invoking the merged script by absolute path so cwd fixes the corpus) and on the merged tree, then diffed the strict site lists with comm. da5e4f6: ident 15 sites, path 18 sites, ident-minus-path = 0, path-minus-ident = 3. Merged tree: ident 12, path 15, ident-minus-path = 0, path-minus-ident = the SAME 3. The three are PermissionMatrixEditor.packageDoorFacets.test.tsx:191, :241 and PermissionMatrixEditor.scope.test.tsx:177 — the server.saved / server.savedOpts sites main's header named. Why it still matters: the rewrite kept M1 ('incomparable by construction') and dropped the measurement, so a reader could take M1 as a reason to run both modes and union them. On this tree the union is just path's bucket and that buys nothing. The header now says so and says 'never cite M1 as a reason to union the modes'.",
"delta_vs_main_header": "same substance; numbers now given for BOTH trees, and the whole item is explicitly labelled a claim about SHAPES that is false as a measurement."
},
{
"claim": "3. The mode choice is NOT the largest source of movement: D1 (window ends at the next textual await in the FILE) and D2 (any textual occurrence counts as a read) dominate it; seven of the 18 strict flags point at something that is not a read.",
"verdict": "SPLIT. The seven-non-reads half: KEPT verbatim in substance. The 'mode choice is not the largest source' framing: KEPT and upgraded from assertion to arithmetic. D2: RETIRED by the AST matcher. D1: only HALF retired — see the new residual R2' below.",
"measurement": "At da5e4f6, diffing site lists: path-minus-AST = 7 EXACTLY (form-onchange-wiring:207, providerCtxIdentity.discarded:515, DatasetWidget.localSelectI18n:356, DatasetWidget.optionLabelI18n:313, DatasetWidget.tableTotalsRow:319, ObjectView.tableColumnsForwarding:136 and :149) and AST-minus-path = 9 EXACTLY, so path 18 to AST 20 is not +2 but -7/+9, which is the decomposition the header claimed and it reproduces. Against that, the mode choice separates THREE sites. 16 versus 3: the mode was the visible knob and the smallest one. That comparison is now in the header as numbers a reader can re-derive by re-running the file."
},
{
"claim": "4. 'No count this script prints is a corpus fact', and the console banner that says so.",
"verdict": "KEPT. The header section stays (it is the file's longest section). The banner was WRONG after the rewrite and is CORRECTED rather than deleted.",
"measurement": "The banner said objectui#8704 'removed the three known error sources (name-matching, runaway windows, declarations read as reads)'. Two were removed outright; the window rule only half. It now reads: 'objectui#8704 removed name-matching and declarations-read-as-reads outright, and only the RUNAWAY half of the window rule: a wait hosted in a helper still cannot see its caller.' The same correction is applied to the header sentence that preceded the numbers table. Independent evidence for the claim, produced by this merge itself: with the matcher BYTE-IDENTICAL, merging main at a9bc029 moved the population 2776 to 2786 and every strict bucket down — AST 20 to 18, path 18 to 15, ident 15 to 12 — because #8707, #8711 and #8713 had each anchored a wait. That is claim 4 demonstrating itself on a controlled variable, and it is now recorded in the header."
},
{
"claim": "5. 'Until it exists this file stays OUT of CI: a matcher-dependent instrument must not become a gate.'",
"verdict": "KEPT, unchanged in substance, re-verified mechanically. NOT promoted, NOT weakened. Its reason is now R2 AND R2'.",
"measurement": "grep over the whole worktree for the script's name outside itself: three changesets, and the pin test. Zero .github/workflows references, zero package.json script entries (there is no census:recorder-wait entry alongside census:body-dialect). The only executable caller is scripts/tests/census-recorder-wait-shape.test.ts, which runs the matcher over the six committed fixtures and never over git ls-files. The header's fence sentence is intact and now reads 'R2 and R2' alone make it matcher-dependent'."
}
],

"new_residual_added_R2_prime": {
"what": "The AST window is scoped to the ENCLOSING FUNCTION BODY. That kills D1's runaway half (a window can never reach the next it) and leaves D1's TRUNCATION half alive, pointed the other way: when the wait is hosted in a helper the test awaits, or in any inner callback, the window is that inner body and the CALLER's statements are outside it.",
"forced_on_probes": "Three constructed probes, identical read in all three. pC (wait inline in the test body): FLAGGED — 'waits [saves] reads deletes'. pA (same read, wait moved into an async helper the test awaits): ZERO flags. pB (same read, wait inside an await act(async ...) callback): ZERO flags. The control is what makes pA/pB readings rather than absences.",
"corpus_scale": "503 of this tree's 3945 await waitFor(...) sites have their window owned by an inner function — 413 named helper functions, 51 const-arrow helpers, 39 other call arguments. 12.8 percent, not a corner.",
"is_it_a_regression": "No, with one measured exception. On pA the regex matcher is blind too (differently: its textual window ran past the helper's closing brace, not into the caller). On pB the regex matcher DOES flag and the AST matcher does not — for that one shape the AST matcher lost a flag the regex matcher caught. Zero such sites exist in this tree, so it costs nothing here; the header says both halves anyway."
},

"script_output_after_the_merge": {
"command": "node scripts/census-recorder-wait-shape.mjs (run from the worktree root, at the final commit 063a975)",
"population_line": "population: 2786 test files",
"counts": [
"matcher: ast",
"total flags: 139",
" wait named a recorder (the strict shape): 18 in 11 files",
" wait named no recorder (a DOM node, a hook result, a test id): 121"
],
"banner_as_printed": "WARNING READINGS, not corpus facts. objectui#8704 removed name-matching and / declarations-read-as-reads outright, and only the RUNAWAY half of the / window rule: a wait hosted in a helper still cannot see its caller. / R1-R3 in this file's header are what is left, and a flag is still a / site to READ, never a defect. NOT a gate.",
"regex_modes_same_tree": [
"--matcher=regex --recorder-match=ident : 159 flags, 12 strict in 9 files",
"--matcher=regex --recorder-match=path : 167 flags, 15 strict in 11 files"
],
"semantic_sanity": "Not half-and-half: all 18 strict sites print with a resolved recorder identity (server.saved / server.savedOpts, host.calls / host.inits, adapter.order), which only the AST matcher can produce, and the regex modes still reproduce objectui#8703's published totals unchanged (159 / 167 flags)."
},

"fixture_suite": {
"command": "pnpm exec vitest run scripts/tests/census-recorder-wait-shape.test.ts --reporter=json --outputFile=... (from the repo ROOT, file path, no --filter, no --no-inline-config)",
"json_reporter_counts": "success:true, numTotalTestSuites:3, numTotalTests:11, numPassedTests:11, numFailedTests:0, numPendingTests:0",
"per_test": "all 11 PASSED — 5 in 'the pre-repair regex matcher: objectui#8704's three defects, executable' and 6 in 'the AST matcher: identity, test-scoped windows, read/write/declare'",
"note": "Taken from the JSON reporter, so a module-scope TypeError would have shown as a dead suite (numTotalTests 0) rather than as green text."
},

"fixtures_shown_red_against_the_pre_fix_matcher": [
{
"discriminates": "D1 (the window rule)",
"fixture": "f5-window-truncated.fixture.ts",
"mutation": "containsSettlingAwait made to accept ANY awaited call, i.e. the pre-8704 rule that the window ends at the next await",
"on_disk_proof": "anchor 'SETTLING_ANCHORS.has(name) || isFindByQuery(name)' count 1 -> 0; marker MUTATION_D1_ANY_AWAIT count 0 -> 1; blob 2ca53244 -> c5bafa6a0c6bc9f28c2cb6bf08088d91021c92a9",
"red": "success:false, 9 passed / 2 failed. 'D1 mirror repaired: the hazard behind an ordinary await is found' -> AssertionError: expected [] to deeply equal [ 'expect(payloads[0]).toBe(2);' ]. The total-strict pin also went red (5 -> 4).",
"restore_proven_by_state": "git diff HEAD --quiet -- scripts/census-recorder-wait-shape.mjs => clean; git hash-object back to 2ca53244c468738034f611189d7aef9e416e99ff. Trap on EXIT INT TERM with an absolute REPO_ROOT path, and git checkout HEAD -- PATH (never bare git checkout -- PATH, which restores from the polluted index)."
},
{
"discriminates": "D2 (the occurrence rule)",
"fixture": "f4-window-crosses-test.fixture.ts, case c",
"mutation": "classifyOccurrence made to return 'read' for everything except a push/unshift receiver, i.e. the pre-8704 rule with no declaration class and no write class",
"on_disk_proof": "anchor "declNames.has(node)) return 'declare'" count 1 -> 0; marker MUTATION_D2_ALL_READS count 0 -> 1; blob 2ca53244 -> cbed62f13c9e27cdd827bcac6d60b457123ec278; node --check passes on the mutant",
"red": "success:false, 9 passed / 2 failed. 'D1+D2 repaired: the runaway window flags NOTHING in f4' -> AssertionError: expected [ 'scratch.length = 0;' ] to deeply equal []. That is exactly the reset the fixture's own docblock says case c exists to isolate. The total-strict pin went red the other way (5 -> 6).",
"restore_proven_by_state": "git diff HEAD --quiet -- scripts/census-recorder-wait-shape.mjs => clean; git hash-object back to 2ca53244c468738034f611189d7aef9e416e99ff."
},
{
"discriminates": "R2 (bonus — the header claim I was carrying forward, not required by the dispatch)",
"fixture": "the corpus, not a fixture",
"mutation": "'act' added to SETTLING_ANCHORS",
"red": "strict bucket 18 -> 17, and the single lost site is packages/plugin-grid/src/tests/rowRecordCrudVerdict.test.tsx:235 — the exact file R2 names. Nothing gained. R2's claim reproduces.",
"restore_proven_by_state": "git diff HEAD --quiet => clean; blob back to 2ca53244"
}
],

"merge_tree_rerun": {
"against_the_main_that_was_merged": "git merge-tree --write-tree origin/main HEAD (a9bc029) -> exit 0, single tree OID ee166f7e3e7fac571f76f3cc6d872e68b9a5f7c7, zero CONFLICT lines",
"against_main_as_of_now": "main moved to c6ae7b2 during this run (5 PRs: #8733 #8732 #8723 #8700 #8724). Re-ran: exit 0, tree d5f4ab057ed6dd8808111161bf20bb90b895d140, zero CONFLICT lines. None of those five touches the census script or its fixtures. The PR API still says mergeable_state 'behind', which is staleness, not conflict.",
"before_the_merge_for_contrast": "CONFLICT (add/add): Merge conflict in scripts/census-recorder-wait-shape.mjs"
},

"changeset_set": {
"declared_by_this_PR": ".changeset/issue-8704-census-matcher-ast.md — empty frontmatter, correct: scripts/ is unpublished and the whole diff is one repo script plus its pin test and fixtures.",
"not_duplicated": "issue-8690-recorder-wait-audit.md and issue-8703-matcher-dependent-strict-bucket.md are on main AND on this branch as the IDENTICAL blobs (99df37002 and a5e962b47 on both sides), because #8706 carried this branch's own ancestor commits. They are one file each, not duplicates, and changeset version will consume each once.",
"not_lost": "git diff origin/main...HEAD --name-only is exactly 10 paths: the one 8704 changeset, the script, the pin test, six fixtures and the harness. Nothing else.",
"gate": "pnpm changeset:check -> exit 0 ('All workspace packages are in the changeset fixed group', 'No changeset declares a major bump'). No skip-changeset label applied — objectui declares with empty frontmatter and that label is inert here.",
"content_docs_releases": "untouched"
},

"other_checks": {
"eslint": "pnpm exec eslint scripts/census-recorder-wait-shape.mjs -> exit 0",
"node_syntax": "node --check scripts/census-recorder-wait-shape.mjs -> OK",
"control_bytes": "pnpm check:control-bytes -> exit 0 (scanned 6929 tracked text files); plus a direct grep -naP over the changed file for [\x00-\x08\x0b\x0c\x0e-\x1f\x7f] -> no matches",
"worktree_hygiene": "dedicated worktree /home/user/objectui-pr8719; the shared checkout /home/user/objectui was never edited; no git stash anywhere; the three mutation scripts and the probe script were deleted before the header commit and git status --porcelain -uall is clean"
},

"things_the_merge_turned_up_that_neither_card_said": [
"The conflict was never a divergence. main's side of the AA is byte-identical to this branch's own parent commit (blob 3732191fb == 3778170's blob). #8706 landed exactly the file this branch's AST rewrite was authored on top of; git could not see it only because the file is absent at the merge base. So 'take ours' happens to be right here — but it is right for a reason that has to be measured, and it says nothing about whether the CLAIMS survived, which is where the actual work was.",
"R2' — the AST window repairs only half of D1. 503 of 3945 await waitFor sites in this tree have their window owned by an inner function, so a wait hosted in a helper covers none of its caller's statements. Neither objectui#8703 (which only knew the runaway direction) nor objectui#8704's card names this. It is now a first-class residual in the header with the probe and the corpus count.",
"For a wait inside an await act(...) callback the OLD regex matcher reaches the read and the new AST matcher does not — the only shape measured where the repair loses ground. Zero such sites in this tree, so it is free today; recorded so it is not rediscovered as a surprise.",
"The census counts are a moving target on a timescale of hours. Between da5e4f6 and a9bc029 the AST strict bucket fell 20 -> 18 purely because #8707/#8711/#8713 anchored waits, and main moved again (to c6ae7b2) while this run was in progress. Any future PR that quotes a bare count from this script is quoting a reading of a tree that no longer exists — which is the header's thesis, now with a controlled measurement behind it."
],

"mcp_calls": "1 — one add_issue_comment to post this report. Every read went through anonymous REST (the repo is public) or plain git; the corpus measurements are all local.",

"open_questions": [],

"out_of_scope_findings": [
"Not filed as issues, and deliberately: R2' and the act-callback asymmetry are properties of the instrument this card builds, so they belong in this file's own residual list rather than in a new card. Both are recorded in the header with their measurements. If the PM wants R2' pursued (scoping a helper-hosted wait's window to the CALL SITE, one hop, the way the parameter alias hop already works) that is a follow-up card, not a rider on this one — and it would need its own fixture, since no corpus site currently exercises it."
]
}

---

Generated by Claude Code