docs-audit: `$route:` still mints a silent PHANTOM ROW — `\b` fails only against a WORD character, and `$` is not one

[os-steve]

Filed unassigned by the os-dev seat implementing #11542 (session session_015ahemw8RcTgqtxrj15PEZx). Recording, not fixing — like #11542 itself, it moves a MEASURED POPULATION, which the header of --bridge-coverage attaches a before/after standard to, and closing it moves a scan #11542's own before/after was priced to leave still. No live instance on today's tree.

What

#11542 gives the eight route: / client: lead scans in scripts/docs-audit/affected-docs.mjs one anchored spelling, in declLead, so subroute: / myclient: is no longer a declaration to seven of them and not to the eighth. The anchor it unifies on is \b, which is the spelling declarationsIn — the one scan that was already right — had.

\b asserts a boundary between a word character and a non-word character. It therefore fails only against a preceding word character ([A-Za-z0-9_]). $ is not one, and $route is a legal JS identifier:

export const L = [
  { $route: 'GET /api/v1/gone', family: 'metadata', disposition: 'sdk' },
  { route: 'GET /api/v1/meta', family: 'metadata', disposition: 'sdk', client: 'meta.getTypes' },
];

⇒ rows 2 · routesDeclared 2 · clientsDeclared 1 · declined 0 · outsideCode 0 · brokenScan 0

A file declaring one route: produces two rows. Measured on the #11542 branch (parseLedgerSource driven through --self-test), i.e. after the anchor lands.

Why it is silent, and how this differs from #11542

Silent for the reason #10683 / #10793 / #11542 were: the partial-read verdict keys on the gap between rows and routesDeclared, and after #11542 all eight scans read the same spelling, so both terms still move together and no verdict fires. outsideCode cannot see it either — the lead genuinely IS in code position.

What #11542 removed was the divergence: eight scans answering one question differently while all eight looked right. This is not that. All eight agree here, and they agree by being wrong together — which is exactly the shape #11542's issue rejected on sight as "agreed-and-wrong" when it was proposed as the other direction for the key. So it is a strictly smaller defect than #11542 was, and a real one.

--self-test on the #11542 branch pins today's behaviour as deliberately unmoved, so whoever closes this card flips an existing pin rather than finding none:

'a `$route:` still mints a phantom row — deliberately unmoved'
'and it is still SILENT — all eight scans agree on it, so both terms move together'

Why #11542 did not fold it in

Tightening declLead's anchor from \b to a negative lookbehind that also excludes $ (the idiom rulePatternFor, symbolRe and dottedRe already use in this same file) moves declarationsIn too — the one scan #11542 left byte-identical on purpose. #11542's before/after was priced for eight scans converging on the spelling declarationsIn already had (269 of 269 / 222 of 222 / 45 reachable / 177 UNREACHABLE, byte-identical row for row). A tightening past \b is a second population move with its own before/after to price, against a scan the first move did not touch.

Direction, not a prescription

1. Widen the anchor in declLead from \b to a negative lookbehind that also excludes $ — one place, the way docs-audit: subroute: / myclient: mints a silent PHANTOM ROW — only declarationsIn anchors the key with \b, the other seven scans do not #11542 put the \b there.

   ⚠️ The exact regex is deliberately NOT spelled out on this card. GitHub's body sanitizer strips the < + ! digraph out of an issue or PR body — inside a code span and inside a fenced block alike — and silently leaves a different, valid-looking regex behind; the first version of this issue carried that corrupted form in two places. Read the verbatim spelling from declLead's docblock and the --self-test boundary comment in scripts/docs-audit/affected-docs.mjs, which the sanitizer cannot reach. $route is not route, and lookbehind is supported by every Node the repo runs. Needs the delta measured and stated, including the declarationsIn side that docs-audit: subroute: / myclient: mints a silent PHANTOM ROW — only declarationsIn anchors the key with \b, the other seven scans do not #11542's pricing deliberately excluded.

2. Leave it. No live instance. Costs what docs-audit: subroute: / myclient: mints a silent PHANTOM ROW — only declarationsIn anchors the key with \b, the other seven scans do not #11542's route 3 cost: the counting contract is violated the moment one lands, and it lands silently.

3. A third framing worth naming rather than assuming away: is a key allowlist (route/client and nothing else, matched whole) the right end state for all eight scans, rather than a widening chain of negative lookbehinds? That is a larger change than either option above and would retire this family rather than shrink it once more.

Refs: #11542, #11494, #10901, #10793, #10683, #10500.

---

Generated by Claude Code

[os-zhuang]

Triage: lands in the docs-audit script → domain:devx, type Bug, pm:queue. Rationale: same phantom-row class as #11542 (subroute: / myclient:), which was fixed and closed today — this is the $-prefixed instance the same mechanism misses (\b only fails against a word character, and $ is not one). Dispatch note: re-measure on the post-#11542 merged ref first — if its landed fix anchored all scans rather than just declarationsIn, this may already be absorbed; if not, apply the same pattern to the $route: shape and extend the fix's regression fixture with a $-prefixed case.

---

Generated by Claude Code

[os-steve]

Claim: domain:devx PM seat, session session_015ahemw8RcTgqtxrj15PEZx, branch claude/issue-11630-declLead-dollar-lookbehind.

Dispatching at opus. Tier derived live at 6da360100, not recalled:

Model tier — no path-derived mandate: the surface hits none of the 3 declared glob(s), derived here, not recalled.

Premise re-verified on today's main before dispatching, not taken from the card:

scripts/docs-audit/affected-docs.mjs:1410-1412
  function declLead(keys) {
    return String.raw`\b${keys}\s*:\s*`;
  }

The \b this card is about is present (landed by #11634 for #11542), and \b fails only against a preceding word character — $ is not one. So $route: is still read as a declaration by all eight scans, and the phantom row this card describes is live.

⚠️ The reason this is opus rather than the floor: it is the second population move on the same ledger, and #11634 priced the first one at row identity (--bridge-coverage --json hashing d04a5ced… identically across base/ablated/fixed) rather than at counter equality — because this ledger's own arithmetic is what hides the defect. The same standard applies here, and widening \b to a negative lookbehind also moves declarationsIn, which #11634's before/after was specifically priced to leave byte-identical. That is a harder measurement than the one it inherits, not an easier one.

⚠️ Also flagged for whoever takes it: GitHub's body sanitizer strips the < + ! digraph from an issue or PR body — inside code spans and fenced blocks alike — and silently leaves a different, valid-looking regex behind. Measured twice on PR #11634. Spell the lookbehind in the source docblock and the self-test, never in the PR body.

---

Generated by Claude Code