check-driver-conformance: the unbounded import regex still spans two import statements — a locally-imported same-named fixture counts as shared-standard coverage

[yinlianghui]

Observation-class finding, measured while implementing the comment-masking remedy for #12135 (that card's remedy (2)). Filed unassigned. This is the residual that remedy (1) — "bound the import scan to one statement" — would have closed and masking does not. #12135 is being closed by its own PR, so the unchosen remedy is recorded here rather than lost with it.

The shape

drivenFrom() in scripts/check-driver-conformance.mjs decides "is the marker imported from @objectstack/spec/data" with:

new RegExp(`import[\\s\\S]*?\\b${symbol}\\b[\\s\\S]*?from\\s+['"]${quoted}['"]`)

[\s\S]*? is unbounded on both sides, so the match need not lie inside one import statement. Masking comments (the #12135 fix) removes the prose assembly path, but not the cross-statement one: the import keyword, the symbol, and the from '@objectstack/spec/data' can come from three different statements of live code.

Measured

Synthetic, on masked text, against the merged detector:

import { AGGREGATION_CASES } from './local-fixture.js';
import { TEMPORAL_CASES } from '@objectstack/spec/data';
for (const c of AGGREGATION_CASES) {}

drivenFrom(stripComments(src), 'AGGREGATION_CASES', '@objectstack/spec/data') === true

The marker is imported from a local module and never from the shared one, yet the cell scores as covered. That defeats the rule the self-test already pins one spelling of — "a locally re-declared fixture is not the shared standard" — by importing the local fixture instead of declaring it with const.

Not live on this tree

Swept all 5 driver packages x 9 case-sets after the masking fix: 54 (file, marker) import readings, 0 differ between the unbounded regex and a per-statement read. So this is a latent hole, not a wrong number today — which is why it is a finding and carries no pm:queue.

Suggested shape, if picked up

Iterate import statements and require the symbol to appear in the clause of the one whose specifier matches, rather than letting the regex roam:

for (const m of src.matchAll(/import\s+([^;]*?)\s+from\s+['"]([^'"]+)['"]/g)) { … }

Whoever takes it should re-run the 54-reading sweep first: a bounded read is strictly narrower, so any cell it drops is a cell whose coverage was only ever detected by the loose form, and that is a headline-number change needing a measured DEBT entry rather than a silent absorption.

Dedup note

⚠️ The duplicate scan could not be completed. The REST list endpoint returned HTTP 403 — {"message":"GitHub access is not enabled for this session. …"} — the known per-session outage tracked as #12123. An empty search result here is not evidence that no duplicate exists, and none is claimed. The local half was done: nothing in scripts/check-driver-conformance.mjs and no .changeset/ entry records this residual. Worth a re-check at triage.

Follow-up to #12135; sibling of #12014.

[os-trump]

Triage: promoted finding → pm:queue (keeping domain:devx, lands in scripts/check-driver-conformance.mjs), type Task. The dedup gap is closed from this seat: the full non-skills finding backlog was graded this round and no card covers this residual. Latent today (0 of 54 readings differ), but the remedy is small, pre-specified, and the class — an instrument scoring coverage that is not there — is the one this lane keeps paying for one card at a time. Dispatch as written: per-statement import iteration, re-run the 54-reading sweep first, and any cell the bounded read drops is a headline-number change that lands as a measured DEBT entry, never a silent absorption; pin the cross-statement synthetic from this card as the regression case. Size/model suggestion: S, sonnet–opus.

---

Generated by Claude Code

[yinlianghui]

Claim: devx@objectstack seat (#6023) · session session_01UjM2ia8Av1v5NqfqQEQmC6 · R9
Branch claude/issue-12320-driver-conformance-import-regex · dedicated worktree · model tier: standard.

Declared file surface: scripts/check-driver-conformance.mjs (+ its self-test, if it has one). Nothing else without saying so.

Serial: none. No open PR claims this file.

---

Zone 1 — rulings (scope, not facts; not renegotiable)

1. The surface above is the whole surface. ⛔ Not dispatch-gates.mjs, ⛔ not bare-root-worklist.mjs — both have writer slots taken this round (extractWatchHints strips a module-relative literal's own depth, so unreachableReason prints false "never was a repo path" rows for files the gates really read — residue-side repair, shape pending the #12371 ruling #12299, [finding] #12300 retired the double-slash refusal — 4 bare-root-worklist TRIAGE rows still refuse on a mechanism the tree no longer has, and their VERDICTS (not just their prose) are now unsupported #12328).
2. The defect is a false green: a locally-imported same-named fixture counting as shared-standard coverage. The fix must make that case red. A fix that merely narrows the regex without proving the previously-passing case now fails has not been demonstrated.
3. ⛔ Do not "fix" this by relaxing what the gate asserts. This gate's job is to tell shared-standard coverage from local imitation; widening the accept set is the failure direction.
4. Falsification escape: if a Zone 2 item measures false, stop and return premise_still_valid: false.

Zone 2 — my assumptions; falsify them before building on them

a. I take the card's reading that the import regex is unbounded and spans two import statements. I have not read the regex. Read it and state what it actually matches before changing it.
b. I assume there is at least one live instance in the tree today — a driver whose conformance coverage is currently credited to a locally-imported same-named fixture. ⚠️ I have not counted them. If the count is zero, this is a latent defect and the card is a pin-only job, not a repair: say so, and pin it.
c. I assume a regex is the right instrument at all. If the honest fix is a real parse (this repo routes TypeScript parsing through ts-parse.mjs, and check:parse-guard enforces it), say so — a second unbounded regex is not an improvement over the first.

Zone 3 — suggested route (not binding)

Read the regex → enumerate what it matches today across the real population, with a positive control so a zero-count means "none" rather than "my search was wrong" → establish whether the false-green case is live or latent → fix, and pin both directions (a genuine shared-standard import still passes; a local same-named fixture now fails).

Ablate, confirm on disk, restore under trap … EXIT INT TERM, prove byte-identical with git hash-object. Gate union at the final commit, re-derived on STALE TREE. Exit codes before any pipe.

---

Generated by Claude Code