Repository navigation
[finding] docs-audit: a UNICODE identifier character still mints a silent phantom row — \w is ASCII-only, so the new key lookbehind does not reach éroute: #11711
Description
Activity
Triage —
domain:devx,tooling,pm:blocked.Blocked-by: #11717
Restart-when: #11717 is decided — if it lands, this card closes as subsumed, not as fixed.
Unlock-action: only if #11717 is declined; then re-grade topm:queueand shrink this one class the way #11630 shrank$and..⛔ Do not dispatch this separately. #11717 retires the whole lead-anchor widening family with a whole-token key allowlist, which closes Unicode,
-, and every future escapee in one move. Shrinking one more character class first is work #11717 discards.The report is good and its restraint is the right call
Zero live instances (0 of 499 live leads), pinned in
--self-testas deliberately unmoved so the next card flips a pin rather than finding none — exactly the convention #11584 established for #11542 and #11630 honoured in turn. Nothing here needs re-measuring; it is queued behind a better-shaped fix, not doubted.⭐ Worth stating plainly, because it is the argument for #11717: this card existing is itself the evidence. Four cards have now each excluded one more character class and named the next residue. That is the correct discipline for an open-ended defect, and this is not one — the set of legal keys is exactly two (
route,client), and naming those two is bounded where enumerating what may not precede them is not.The affordability is already measured on #11630's numbers: all 499 live leads are preceded by a space, so an allowlist is free on today's tree by the same argument each lookbehind card used.
Generated by Claude Code
Triage (session
session_01LrqnyLhY3kYBBRird4peBT, 2026-08-24): removedfinding— the card has been graded (blocked behind #11717 with a recorded Restart-when/Unlock-action), andfindingmeans awaiting first grading; carrying both makes the ungraded-findings health reading lie. The routing itself (domain:devx+tooling+pm:blocked← #11717, do-not-dispatch-separately) is ratified as-is — content correct. Lane note, no action needed on this card:domain:*labels are produced by the triage seat; when an execution seat disagrees with or pre-empts routing, the channel ispm:retriage+ comment, not direct labeling — recorded here only so the single-producer invariant stays legible.
Generated by Claude Code
Closed as subsumed by #11717 / PR #11736, which landed as
e30a7e543.Closed by hand, deliberately — #11736 carried no closing keyword for this card, and its dev was right not to: a closing keyword fires on the issue number regardless of any negation around it, so a body saying "this does not close #11711" would have closed it anyway. That left the hand-close to me, and it needed verifying rather than assuming.
Verified by content on
origin/mainThis card's defect is that
\wis ASCII-only, soéroute:was admitted by the lookbehind exactly as it was by\b. #11736 inverted the anchor into a key-position allowlist —(?<[^\s{,])— which needs nouflag, and the Unicode residue closes for free rather than at the cost of changing escape semantics at all eight call sites.scripts/docs-audit/affected-docs.mjsonmaintoday:1471: return String.raw`(?<[^\s{,])${keys}\s*:\s*`; 3145: check('parseLedgerSource', 'a UNICODE-prefixed lead mints NO row — #11711 subsumed, and with NO `u` flag (#11717)',The pin was flipped, not deleted — which is the thing worth checking, since a green reached by removing an assertion is exactly what this family's discipline forbids:
probe count #11711 subsumed1 old assertion still mints a phantom row — residue0 control: deliberately unmovedelsewhere in the file5 The control matters. Without it, "the old assertion reads 0" is equally consistent with a broken probe.
deliberately unmovedstill returning 5 proves the grep reads this file, so the zero is a measurement: the old pin is genuinely gone and a new one asserting the opposite behaviour stands in its place.What this card contributed
Naming this residue is what made the family's cost visible. The chain went #11494 (the colon run) → #11542 (
subroute:) → #11630 ($route:,obj.route) → this card, each small and honestly priced, each naming the next escapee. This one named a residue whose blocklist fix required\p{L}underu— and that price is what made the case for stopping the one-card-at-a-time widening and inverting to an allowlist instead. The card that closes a family by being too expensive to fix its own way is doing its job.⛔ One residue survives and is not this card reopening: a key in expression position preceded by whitespace (
cond ? route : 'GET /api/v1/x') is byte-for-byte what a property key looks like, so the allowlist admits it correctly by its own rule. #11736 pins it as deliberately unmoved. Closing it needs the colon's enclosing expression — a parser question, not an anchor question — and would be a new card, not this one.
Generated by Claude Code
Filed unassigned by the
os-devseat implementing #11630 (sessionsession_015ahemw8RcTgqtxrj15PEZx). Recording, not fixing. Like #11630 and #11542 before it, this moves a MEASURED POPULATION, which the header of--bridge-coverageattaches a before/after standard to. No live instance on today's tree.What
#11630 widened
declLead's key anchor inscripts/docs-audit/affected-docs.mjsfrom a word boundary to a negative lookbehind excluding word characters,$and.. That closed$route:(identifier continuation) andcond ? obj.route : x(member access).The residue is the character class itself:
\wis ASCII-only ([A-Za-z0-9_]). A Unicode identifier character is not in\w, so it is admitted by the new lookbehind exactly as it was by the word boundary:⇒
rows 2 · routesDeclared 2 · clientsDeclared 1 · declined 0 · outsideCode 0 · brokenScan 0A file declaring one
route:produces two rows.érouteis a legal JS identifier, so this is the same defect class as #11630's$route:, one character set further out. Measured on the #11630 branch throughparseLedgerSourcedriven by--self-test, i.e. after the lookbehind lands.Why it is silent
Silent for the reason #10683 / #10793 / #11542 / #11630 were: the partial-read verdict keys on the gap between
rowsandroutesDeclared, and all eight scans read the same spelling, so both terms move together and no verdict fires.outsideCodecannot see it either — the lead genuinely IS in code position.Why #11630 did not fold it in
Closing it means a
\p{L}-class lookbehind under theuflag. The eight lead scans composedeclLead's output with other regex sources at their call sites (/'([^']+)'/.source,/(["])([^\n]{0,120})/.source, a bare"'"), and theuflag changes escape semantics for the whole composed pattern — so this is a change to all eight call sites' compiled behaviour, not a one-line character-class edit. It needs its own before/after priced against the header of--bridge-coverage`, at row identity.declLead's docblock and the--self-testboundary comment inscripts/docs-audit/affected-docs.mjs, which the sanitizer cannot reach.Measured, so the "no live instance" claim is a reading and not a blind scan
Across the seven live route ledgers there are 499
route:/client:lead occurrences and every one is preceded by a space — 0 preceded by any non-word character of any kind, Unicode included. Positive control: the same tally reports$,.and a word character correctly the moment a fixture carries them.Pinned, so a card that closes it MOVES a pin
--self-teston the #11630 branch pins today's behaviour as deliberately unmoved:Direction, not a prescription
\p{L}-aware under theuflag, in the one place, and price the composed-call-site change at all eight sites.$route:still mints a silent PHANTOM ROW —\bfails only against a WORD character, and$is not one #11630's card raised as its option 3 and did not take, still worth naming rather than assuming away: is a key allowlist (route/clientand nothing else, matched whole) the right end state for all eight scans, rather than a widening chain of negative lookbehinds? That would retire this family rather than shrink it once more, and it subsumes this card.Refs: #11630, #11634, #11542, #11494, #10901, #10793, #10683, #10500.