fix(devx): bound check-driver-conformance's import scan to one statement

[yinlianghui]

Fixes #12320

drivenFrom in scripts/check-driver-conformance.mjs decided "is this marker imported from @objectstack/spec/data" with a regex whose two [\s\S]*? runs were unbounded on both sides of the symbol. The three parts it wants — the import keyword, the symbol, and the matching specifier — never had to come from the same import statement. #12135's comment masking closed the prose assembly path; this is the cross-statement one, and it survived it.

A marker imported from a local module scored as shared-standard coverage by borrowing a sibling statement's specifier:

import { AGGREGATION_CASES } from './local-fixture.js';
import { TEMPORAL_CASES } from '@objectstack/spec/data';
for (const c of AGGREGATION_CASES) {}

That defeats the rule the self-test already pinned one spelling of — a locally re-declared fixture is not the shared standard — by importing the local fixture instead of declaring it with const.

Live or latent: measured, with a positive control

Swept all 5 driver packages x 9 case-sets, comparing the roaming rule against a per-statement read on masked text:

reading	count
(file, marker) pairs swept	2664
...of which the marker appears in code at all (the card's 54)	54
readings where the two rules differ	0
covered cells, roaming -> bounded	45 -> 45
cells whose covering-file set differs	0

The zero is load-bearing, so it carries a control: the synthetic above was run through the same comparison and reads loose=true bounded=false. The sweep can see the shape — a zero means "none present", not "my search was wrong". A genuine shared import reads true in both.

So the defect is LATENT, not live. No cell is dropped, the gate's full output is byte-identical before and after, and no DEBT entry is owed.

Why a bounded regex and not a real parse

An AST read via scripts/ts-parse.mjs was prototyped and measured before choosing, not waved off: it is correct (refuses the synthetic, accepts a genuine import) and found 0 unparseable files among the 296 driver sources. It was rejected on cost — not the 911ms per pass against ~0.4s for this whole gate, but that ts-parse.mjs imports typescript, so adopting it trades a gate that runs in a fresh worktree with no node_modules for one that refuses until pnpm install has run.

The objection a bounded regex must answer is that it is a second roaming regex beside the first. It is not: the clause class [^;'"] cannot cross a statement terminator or a string literal, so a match starting at one import cannot reach a later statement's from — every intervening specifier is quoted. It is also the only import matcher left in the file; the reference half carried its own roaming import[\s\S]*?from… for stripping, and leaving that would have left the smell this change exists to remove.

Two deliberate narrowings, both measured to move no cell: a bare re-export (export { X } from … — re-exporting the cases is not running them), and a side-effect import (no clause, no symbol).

Proven red, not merely narrowed

Reverse-verified by ablation on the committed fix: the import half was reverted to the roaming form, the mutation confirmed on disk three ways (the anchor text gone, the mutated drivenFrom printed from disk, and the blob moving e51329eab4 -> 5c664f1e37), and the self-test then failed on exactly the two #12320 cases and nothing else. The restore leg returned the blob byte-identical to e51329eab4, under a trap … EXIT INT TERM.

A pin this would have quietly weakened, repaired

#12135's falsifiability probe was written as drivenFrom(proseOnly, …) — it asserted "the unmasked rule accepts this fixture" by calling the live detector. The statement bound makes that fixture red for a second, independent reason, so the probe stopped being a statement about masking and became one about the bound: a stronger tree, but a weaker pin.

Repaired rather than absorbed. The probe now asserts against the superseded rule spelled out as text (so it keeps measuring what it is about), and a new fixture keeps masking itself falsifiable on the shape where the two rules come apart — a marker genuinely imported from the shared module whose only mention is a docblock. Measured: unmasked it is coverage, masked it is not.

Verification

All 12 gates green at bfa9860e0a, the final commit — the 10 derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack from the real change set, plus check:nul-bytes and the gate's own --self-test. Exit codes captured before any pipe.

No changeset: this is an internal CI gate script and publishes nothing user-visible.

Generated by Claude Code

---

Generated by Claude Code