Review follow-up. provenLocalCallee inferred file-local calls from module
scoping but borrowed non-exportedness from its one caller and never checked
module-ness: a helper in a global script file (no import/export) is
program-visible and callable cross-file with no same-file reference, so the
proof passed and those call sites were dropped as silently missing matrix
cells. Guard both premises at the proof entry, failing toward the global
fallback.
- State the EVENT_API_METHODS obligation: a visitSource branch for an
unlisted method name is dead because the prefilter drops the call first.
- Add gen-doc-graphs.spec.ts pinning fast path vs global fallback equivalence
on fixture programs: a proven-local helper, an alias-escaping helper, and a
global-script helper (negative control that keeps the fallback exercised).
- Record the demand-driven indexing decision in the Program-backed semantic
gates Agent Note (both languages, pairing re-recorded).
Generated docs stay byte-identical (verify-doc-graphs green).
The event-relation collector resolved every CallExpression in all package
sources up front (getResolvedSignature is the most expensive checker query)
and type-classified every property-access receiver before looking at the
method name. Both costs served a tiny fraction of call sites.
- Filter by event API method name first; receiver classification now runs
on those calls only.
- Replace the eager global call-site index with demand-driven indexing:
when a non-exported local helper's same-file references are all provably
direct callees, only that file is indexed; any other reference shape
(alias escape) falls back to the original full package-source index.
Generated docs are byte-identical; verify-doc-graphs stays green. Halves
the script's CPU time (23.4s -> ~13s user on a warm run).
363db89ba removed the client-side modality gate and the tests that fed
host.describe a scripted activeModel, but left the fakeApi override
field, its ResponseValue import, and the ?? fallback behind. Nothing
passes hostDescription, so the left arm was unreachable.
The workspace header row is now wrapped by its HoverCard anchor span
(0b4a6196f), so the row's immediate parent no longer holds the session
subtree; the delete scenario anchors on the groupSection ancestor
instead. The flat-view and dwell failures were downstream of this one
(shared page state).
dsh-bash-local injects `subprocess`, which this tree never mounted, so the bash
chain sat PENDING and the bundle's tool-bash waited with it. The shared boot()
all-ACTIVE assertion now surfaces that as a load failure.
The scenario probes filesystem confinement only, so the rows are removed and the
bundle opts out with `toolBash: false`. The recorded transcript is unchanged
because bash never reached the model.