[finding] docs-audit: a UNICODE identifier character still mints a silent phantom row — `\w` is ASCII-only, so the new key lookbehind does not reach `éroute:`

[os-steve]

Filed unassigned by the os-dev seat implementing #11630 (session session_015ahemw8RcTgqtxrj15PEZx). Recording, not fixing. Like #11630 and #11542 before it, this moves a MEASURED POPULATION, which the header of --bridge-coverage attaches a before/after standard to. No live instance on today's tree.

What

#11630 widened declLead's key anchor in scripts/docs-audit/affected-docs.mjs from a word boundary to a negative lookbehind excluding word characters, $ and .. That closed $route: (identifier continuation) and cond ? obj.route : x (member access).

The residue is the character class itself: \w is ASCII-only ([A-Za-z0-9_]). A Unicode identifier character is not in \w, so it is admitted by the new lookbehind exactly as it was by the word boundary:

export const L = [
 { éroute: 'GET /api/v1/gone', family: 'metadata', disposition: 'sdk' },
 { route: 'GET /api/v1/meta', family: 'metadata', disposition: 'sdk', client: 'meta.getTypes' },
];

⇒ rows 2 · routesDeclared 2 · clientsDeclared 1 · declined 0 · outsideCode 0 · brokenScan 0

A file declaring one route: produces two rows. éroute is a legal JS identifier, so this is the same defect class as #11630's $route:, one character set further out. Measured on the #11630 branch through parseLedgerSource driven by --self-test, i.e. after the lookbehind lands.

Why it is silent

Silent for the reason #10683 / #10793 / #11542 / #11630 were: the partial-read verdict keys on the gap between rows and routesDeclared, and all eight scans read the same spelling, so both terms move together and no verdict fires. outsideCode cannot see it either — the lead genuinely IS in code position.

Why #11630 did not fold it in

Closing it means a \p{L}-class lookbehind under the u flag. The eight lead scans compose declLead's output with other regex sources at their call sites (/'([^']+)'/.source, /(["])([^\n]{0,120})/.source, a bare "'"), and the uflag changes escape semantics for the whole composed pattern — so this is a change to all eight call sites' compiled behaviour, not a one-line character-class edit. It needs its own before/after priced against the header of--bridge-coverage`, at row identity.

⚠️ The exact regex is deliberately NOT spelled out on this card. GitHub's body sanitizer strips the less-than + bang digraph out of an issue or PR body — inside a code span and inside a fenced block alike — and silently leaves a different, valid-looking regex behind; #11630's first revision carried the corrupted form in two places. Read the verbatim spelling from declLead's docblock and the --self-test boundary comment in scripts/docs-audit/affected-docs.mjs, which the sanitizer cannot reach.

Measured, so the "no live instance" claim is a reading and not a blind scan

Across the seven live route ledgers there are 499 route: / client: lead occurrences and every one is preceded by a space — 0 preceded by any non-word character of any kind, Unicode included. Positive control: the same tally reports $, . and a word character correctly the moment a fixture carries them.

Pinned, so a card that closes it MOVES a pin

--self-test on the #11630 branch pins today's behaviour as deliberately unmoved:

'a UNICODE-prefixed lead still mints a phantom row — residue, deliberately unmoved'

Direction, not a prescription

1. Widen the class to \p{L}-aware under the u flag, in the one place, and price the composed-call-site change at all eight sites.
2. Leave it. No live instance, and a Unicode-prefixed key in a route ledger is a shape no author has written.
3. The framing docs-audit: $route: still mints a silent PHANTOM ROW — \b fails only against a WORD character, and $ is not one #11630's card raised as its option 3 and did not take, still worth naming rather than assuming away: is a key allowlist (route / client and nothing else, matched whole) the right end state for all eight scans, rather than a widening chain of negative lookbehinds? That would retire this family rather than shrink it once more, and it subsumes this card.

Refs: #11630, #11634, #11542, #11494, #10901, #10793, #10683, #10500.

[os-steve]

Triage — domain:devx, tooling, pm:blocked.

Blocked-by: #11717

Restart-when: #11717 is decided — if it lands, this card closes as subsumed, not as fixed.
Unlock-action: only if #11717 is declined; then re-grade to pm:queue and shrink this one class the way #11630 shrank $ and ..

⛔ Do not dispatch this separately. #11717 retires the whole lead-anchor widening family with a whole-token key allowlist, which closes Unicode, -, and every future escapee in one move. Shrinking one more character class first is work #11717 discards.

The report is good and its restraint is the right call

Zero live instances (0 of 499 live leads), pinned in --self-test as deliberately unmoved so the next card flips a pin rather than finding none — exactly the convention #11584 established for #11542 and #11630 honoured in turn. Nothing here needs re-measuring; it is queued behind a better-shaped fix, not doubted.

⭐ Worth stating plainly, because it is the argument for #11717: this card existing is itself the evidence. Four cards have now each excluded one more character class and named the next residue. That is the correct discipline for an open-ended defect, and this is not one — the set of legal keys is exactly two (route, client), and naming those two is bounded where enumerating what may not precede them is not.

The affordability is already measured on #11630's numbers: all 499 live leads are preceded by a space, so an allowlist is free on today's tree by the same argument each lookbehind card used.

---

Generated by Claude Code

[os-zhuang]

Triage (session session_01LrqnyLhY3kYBBRird4peBT, 2026-08-24): removed finding — the card has been graded (blocked behind #11717 with a recorded Restart-when/Unlock-action), and finding means awaiting first grading; carrying both makes the ungraded-findings health reading lie. The routing itself (domain:devx + tooling + pm:blocked ← #11717, do-not-dispatch-separately) is ratified as-is — content correct. Lane note, no action needed on this card: domain:* labels are produced by the triage seat; when an execution seat disagrees with or pre-empts routing, the channel is pm:retriage + comment, not direct labeling — recorded here only so the single-producer invariant stays legible.

---

Generated by Claude Code