@massu/core 2.5.2 → 2.5.4

package/dist/hooks/fix-detector.js

@@ -42,6 +42,15 @@ var init_memory_path = __esm({
   }
 });
 
+// src/lib/corrections-md.ts
+var CORRECTIONS_FILENAME;
+var init_corrections_md = __esm({
+  "src/lib/corrections-md.ts"() {
+    "use strict";
+    CORRECTIONS_FILENAME = "corrections.md";
+  }
+});
+
 // src/credentials.ts
 import { homedir } from "os";
 import { resolve } from "path";
@@ -143,7 +152,7 @@ var init_config_memory_schema = __esm({
           message: "memory.recall.embedEndpoint must be an http(s) URL"
         }).optional(),
         embedModel: z.string().min(1).optional()
-      }).default({}),
+      }).prefault({}),
       // --- Contradiction / supersede gate (plan-living-memory-slice-2-temporal-model, P5-001) ---
       // When a new high-value memory (decision/correction) is written, find
       // semantically-related existing records and, if the new one contradicts an
@@ -172,7 +181,7 @@ var init_config_memory_schema = __esm({
         annotateSuperseded: z.boolean().default(false),
         // Time budget (ms) for the contradiction check; exceeded → fail-open (ADD).
         budgetMs: z.number().int().positive().default(800)
-      }).default({}),
+      }).prefault({}),
       // --- Background consolidation, the "sleep-time" pass
       //     (plan-living-memory-slice-3-consolidation) ---
       // Keeps memory sharp over years: dedupes, distills dying sessions into
@@ -218,7 +227,7 @@ var init_config_memory_schema = __esm({
         // Surface optional upgrades (e.g. "a local model was detected") in chat.
         suggestUpgrades: z.boolean().default(true),
         suggestIntervalDays: z.number().int().positive().default(30)
-      }).default({}),
+      }).prefault({}),
       // A-20 (Slice 4) — memory FILES: the mirror, and the one switch that decides whether
       // Massu may ever WRITE into the user's memory directory.
       //
@@ -243,7 +252,7 @@ var init_config_memory_schema = __esm({
         // turn of EVERY session, so an unbounded index is a permanent context tax — and the
         // per-session cap bounds only the RATE, never the total.
         indexMaxLines: z.number().int().min(1).default(50)
-      }).default({}),
+      }).prefault({}),
       // --- Cross-repo memory surfacing (plan-living-memory-slice-5-cross-repo-surfacing) ---
       // A decision made in one of your repos can surface in another — opt-in per
       // decision AND opt-in per repo, signed, verified, and materialized ONLY on
@@ -268,8 +277,8 @@ var init_config_memory_schema = __esm({
           enabled: z.boolean().default(true),
           maxCrossRepoItems: z.number().int().min(0).default(1),
           minScore: z.number().optional()
-        }).default({})
-      }).default({})
+        }).prefault({})
+      }).prefault({})
     }).optional();
   }
 });
@@ -449,13 +458,19 @@ function getResolvedPaths() {
     settingsLocalPath: resolve2(root, claudeDirName, "settings.local.json")
   };
 }
-var DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
+var DEFAULT_KNOWLEDGE_SOURCE_FILES, DomainConfigSchema, PatternRuleConfigSchema, CostModelSchema, AnalyticsConfigSchema, CustomPatternSchema, GovernanceConfigSchema, SecurityPatternSchema, SecurityConfigSchema, TeamConfigSchema, RegressionConfigSchema, AutoLearningConfigSchema, CloudConfigSchema, ConventionsConfigSchema, PythonDomainConfigSchema, PythonConfigSchema, PathsConfigSchema, LanguageFrameworkEntrySchema, FrameworkConfigSchema, DetectedConfigSchema, VerificationEntrySchema, VerificationConfigSchema, CanonicalPathsSchema, VerificationTypesSchema, DetectionRuleEntrySchema, DetectionConfigSchema, WatchConfigSchema, AdapterLocalPathSchema, AdaptersConfigSchema, TelemetryConfigSchema, LSPConfigSchema, RawConfigSchema, _config, _resolvedApiKeySource, _projectRoot;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_memory_path();
+    init_corrections_md();
     init_credentials();
     init_config_memory_schema();
+    DEFAULT_KNOWLEDGE_SOURCE_FILES = [
+      "CLAUDE.md",
+      "MEMORY.md",
+      CORRECTIONS_FILENAME
+    ];
     DomainConfigSchema = z2.object({
       name: z2.string().default("Unknown"),
       routers: z2.array(z2.string()).default([]),
@@ -584,34 +599,40 @@ var init_config = __esm({
       fixDetection: z2.object({
         enabled: z2.boolean().default(true),
         lookbackDays: z2.number().default(7),
-        signals: z2.array(z2.string()).default([
-          "removed_broken_code",
-          "added_error_handling",
-          "method_name_correction",
-          "auth_fix",
-          "nil_handling_fix",
-          "concurrency_fix",
-          "async_pattern_fix",
-          "added_missing_import"
-        ])
-      }).default({}),
+        // ⛔ NO DEFAULT LIST HERE, DELIBERATELY — the heuristics are the SSOT.
+        //
+        // This carried a hand-typed copy of all eight signal names while
+        // `fix-detector.ts` already read `config…signals ?? FIX_HEURISTICS.map(h => h.name)`.
+        // Because zod ALWAYS materialised the default, that fallback — the correct expression
+        // — was unreachable, and the duplicate was the only thing in effect. Two authoring
+        // sites for one vocabulary, and the drift is SILENT: a name listed here that no longer
+        // exists simply never matches `enabledSignals.has(...)`, so a retired heuristic lingers
+        // as a dead entry with no error. Retiring `method_name_correction` would have landed at
+        // one site of two (CR-74).
+        //
+        // Optional, so an ABSENT value reaches the `??` and the heuristic list defines itself
+        // (Rule 25). An explicit list in massu.config.yaml still overrides, which is the only
+        // behaviour anyone actually configured — measured: `fix-detector.ts:267` is the sole
+        // consumer and no config file in the repo sets it.
+        signals: z2.array(z2.string()).optional()
+      }).prefault({}),
       failureClassification: z2.object({
         enabled: z2.boolean().default(true),
         thresholds: z2.object({
           known: z2.number().default(5),
           similar: z2.number().default(3)
-        }).default({}),
+        }).prefault({}),
         scoring: z2.object({
           diffPatternWeight: z2.number().default(3),
           filePatternWeight: z2.number().default(2),
           promptKeywordWeight: z2.number().default(2)
-        }).default({})
-      }).default({}),
+        }).prefault({})
+      }).prefault({}),
       pipeline: z2.object({
         requireIncidentReport: z2.boolean().default(true),
         requirePreventionRule: z2.boolean().default(true),
         requireEnforcement: z2.boolean().default(true)
-      }).default({}),
+      }).prefault({}),
       // plan-v0.2-interactive-rule-approval P-D-008 / P-D-009: project-configured
       // custom destinations for the rule-candidate funnel. The classifier matches
       // a candidate to one of these entries when none of the framework
@@ -644,7 +665,7 @@ var init_config = __esm({
         memory: z2.boolean().default(true),
         analytics: z2.boolean().default(true),
         audit: z2.boolean().default(true)
-      }).default({ memory: true, analytics: true, audit: true })
+      }).prefault({ memory: true, analytics: true, audit: true })
     }).optional();
     ConventionsConfigSchema = z2.object({
       claudeDirName: z2.string().default(".claude").refine(
@@ -675,7 +696,7 @@ var init_config = __esm({
         "session-state",
         "agents"
       ]),
-      knowledgeSourceFiles: z2.array(z2.string()).default(["CLAUDE.md", "MEMORY.md", "corrections.md"]),
+      knowledgeSourceFiles: z2.array(z2.string()).default([...DEFAULT_KNOWLEDGE_SOURCE_FILES]),
       excludePatterns: z2.array(z2.string()).default(["/ARCHIVE/", "/SESSION-HISTORY/"])
     }).optional();
     PythonDomainConfigSchema = z2.object({
@@ -691,6 +712,23 @@ var init_config = __esm({
     }).optional();
     PathsConfigSchema = z2.object({
       source: z2.string().default("src"),
+      /**
+       * Where this stack's tests live, relative to the project root.
+       *
+       * Added 2026-09-20 for P4.3 of docs/plans/2026-09-20-stack-conformant-asset-rendering.md.
+       * ~25 shipped assets told every customer their tests belong in
+       * `packages/core/src/__tests__/` — massu's OWN layout — and no vocabulary could express
+       * the alternative because none existed. A test directory is a first-class property of
+       * every stack (`tests/` on FastAPI, `test/` on Rails, `src/test/java` on Spring,
+       * `Tests/` on SwiftPM, and Go keeps `_test.go` beside the source), so it belongs here
+       * rather than in prose.
+       *
+       * OPTIONAL, so every config written before this key existed keeps loading unchanged; an
+       * asset that needs it uses `{{paths.tests | default("...")}}`. All 13 shipped templates
+       * declare it, each with the convention it follows recorded at the site (G32 option 2),
+       * and `stack-template-conformance.test.ts` asserts that.
+       */
+      tests: z2.string().optional(),
       aliases: z2.record(z2.string(), z2.string()).default({ "@": "src" }),
       monorepo_roots: z2.array(z2.string()).optional(),
       routers: z2.string().optional(),
@@ -800,14 +838,14 @@ var init_config = __esm({
       project: z2.object({
         name: z2.string().default("my-project"),
         root: z2.string().default("auto")
-      }).default({ name: "my-project", root: "auto" }),
-      framework: FrameworkConfigSchema.default({
+      }).prefault({ name: "my-project", root: "auto" }),
+      framework: FrameworkConfigSchema.prefault({
         type: "typescript",
         router: "none",
         orm: "none",
         ui: "none"
       }),
-      paths: PathsConfigSchema.default({ source: "src", aliases: { "@": "src" } }),
+      paths: PathsConfigSchema.prefault({ source: "src", aliases: { "@": "src" } }),
       toolPrefix: z2.string().default("massu"),
       dbAccessPattern: z2.string().optional(),
       knownMismatches: z2.record(z2.string(), z2.record(z2.string(), z2.string())).optional(),
@@ -4005,6 +4043,342 @@ import { existsSync as existsSync9, appendFileSync as appendFileSync3, mkdirSync
 import { tmpdir as tmpdir2 } from "os";
 import { join as join6 } from "path";
 
+// src/hooks/lib/code-spans.ts
+import { extname } from "path";
+var DQ = { open: '"', close: '"', escapes: true, multiline: false };
+var SQ = { open: "'", close: "'", escapes: true, multiline: false };
+var C_COMMENTS = { lineComments: ["//"], blockComments: [["/*", "*/"]] };
+var JS = {
+  id: "js",
+  ...C_COMMENTS,
+  strings: [DQ, SQ, { open: "`", close: "`", escapes: true, multiline: true, interpolation: true }],
+  regexLiterals: true
+};
+var C = { id: "c", ...C_COMMENTS, strings: [DQ, SQ] };
+var GO = {
+  id: "go",
+  ...C_COMMENTS,
+  strings: [DQ, SQ, { open: "`", close: "`", escapes: false, multiline: true }]
+};
+var JVM = {
+  id: "jvm",
+  ...C_COMMENTS,
+  strings: [{ open: '"""', close: '"""', escapes: true, multiline: true }, DQ, SQ]
+};
+var SWIFT = {
+  id: "swift",
+  ...C_COMMENTS,
+  strings: [{ open: '"""', close: '"""', escapes: true, multiline: true }, DQ]
+};
+var RUST = {
+  id: "rust",
+  ...C_COMMENTS,
+  strings: [{ open: '"', close: '"', escapes: true, multiline: true }],
+  rustChars: true
+};
+var PYTHON = {
+  id: "python",
+  lineComments: ["#"],
+  blockComments: [],
+  strings: [
+    { open: '"""', close: '"""', escapes: true, multiline: true },
+    { open: "'''", close: "'''", escapes: true, multiline: true },
+    DQ,
+    SQ
+  ]
+};
+var SHELL = {
+  id: "shell",
+  lineComments: ["#"],
+  blockComments: [],
+  strings: [
+    { open: '"', close: '"', escapes: true, multiline: true },
+    { open: "'", close: "'", escapes: false, multiline: true }
+  ],
+  hashNeedsBoundary: true
+};
+var RUBY = {
+  id: "ruby",
+  lineComments: ["#"],
+  blockComments: [],
+  strings: [
+    { open: '"', close: '"', escapes: true, multiline: true },
+    { open: "'", close: "'", escapes: true, multiline: true }
+  ]
+};
+var LEX_SPECS = Object.freeze({
+  ".ts": JS,
+  ".tsx": JS,
+  ".mts": JS,
+  ".cts": JS,
+  ".js": JS,
+  ".jsx": JS,
+  ".mjs": JS,
+  ".cjs": JS,
+  ".c": C,
+  ".h": C,
+  ".cc": C,
+  ".cpp": C,
+  ".hpp": C,
+  ".cs": C,
+  ".dart": C,
+  ".m": C,
+  ".mm": C,
+  ".go": GO,
+  ".java": JVM,
+  ".kt": JVM,
+  ".kts": JVM,
+  ".scala": JVM,
+  ".groovy": JVM,
+  ".swift": SWIFT,
+  ".rs": RUST,
+  ".py": PYTHON,
+  ".pyi": PYTHON,
+  ".sh": SHELL,
+  ".bash": SHELL,
+  ".zsh": SHELL,
+  ".rb": RUBY
+});
+function lexSpecFor(path) {
+  const ext = extname(path).toLowerCase();
+  return Object.prototype.hasOwnProperty.call(LEX_SPECS, ext) ? LEX_SPECS[ext] : null;
+}
+var RUST_CHAR_RE = /^'(?:\\(?:u\{[0-9a-fA-F]{1,6}\}|x[0-9a-fA-F]{2}|.)|[^\\'\n])'/;
+var IDENT_CHAR_RE = /[A-Za-z0-9_$]/;
+var SHELL_WORD_BREAK = /* @__PURE__ */ new Set([" ", "	", ";", "|", "&", "(", ")"]);
+var REGEX_AFTER_KEYWORD = /* @__PURE__ */ new Set([
+  "return",
+  "typeof",
+  "case",
+  "in",
+  "of",
+  "delete",
+  "void",
+  "throw",
+  "new",
+  "yield",
+  "await",
+  "else",
+  "do"
+]);
+function regexLiteralLength(line, i, lastSig) {
+  if (lastSig === ")" || lastSig === "]") return 0;
+  if (lastSig !== "" && IDENT_CHAR_RE.test(lastSig)) {
+    const m = /([A-Za-z_$][A-Za-z0-9_$]*)\s*$/.exec(line.slice(0, i));
+    if (!m || !REGEX_AFTER_KEYWORD.has(m[1])) return 0;
+  }
+  let inClass = false;
+  for (let j = i + 1; j < line.length; j++) {
+    const ch = line[j];
+    if (ch === "\\") {
+      j++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "/") return j - i + 1;
+  }
+  return 0;
+}
+function projectLine(line, spec, st) {
+  const out = line.split("");
+  const blank = (from, len) => {
+    for (let k = from; k < from + len && k < out.length; k++) out[k] = " ";
+  };
+  let i = 0;
+  while (i < line.length) {
+    const mode = st.mode;
+    if (mode.kind === "block") {
+      if (line.startsWith(mode.close, i)) {
+        blank(i, mode.close.length);
+        i += mode.close.length;
+        st.mode = { kind: "code" };
+      } else {
+        blank(i, 1);
+        i++;
+      }
+      continue;
+    }
+    if (mode.kind === "string") {
+      const r = mode.rule;
+      if (r.escapes && line[i] === "\\") {
+        blank(i, 2);
+        i += 2;
+        continue;
+      }
+      if (r.interpolation && line.startsWith("${", i)) {
+        blank(i, 2);
+        i += 2;
+        st.holes.push(0);
+        st.mode = { kind: "code" };
+        st.lastSig = "";
+        continue;
+      }
+      if (line.startsWith(r.close, i)) {
+        blank(i, r.close.length);
+        i += r.close.length;
+        st.mode = { kind: "code" };
+        st.lastSig = '"';
+        continue;
+      }
+      blank(i, 1);
+      i++;
+      continue;
+    }
+    const ch = line[i];
+    if (st.holes.length > 0) {
+      const top = st.holes.length - 1;
+      if (ch === "{") st.holes[top]++;
+      else if (ch === "}") {
+        if (st.holes[top] === 0) {
+          st.holes.pop();
+          blank(i, 1);
+          i++;
+          st.mode = { kind: "string", rule: spec.strings.find((s) => s.interpolation) };
+          continue;
+        }
+        st.holes[top]--;
+      }
+    }
+    const lc = spec.lineComments.find((m) => line.startsWith(m, i));
+    if (lc && (!spec.hashNeedsBoundary || i === 0 || SHELL_WORD_BREAK.has(line[i - 1]))) {
+      blank(i, line.length - i);
+      break;
+    }
+    const bc = spec.blockComments.find(([open]) => line.startsWith(open, i));
+    if (bc) {
+      blank(i, bc[0].length);
+      i += bc[0].length;
+      st.mode = { kind: "block", close: bc[1] };
+      continue;
+    }
+    if (spec.rustChars && ch === "'") {
+      const m = RUST_CHAR_RE.exec(line.slice(i));
+      if (m) {
+        blank(i, m[0].length);
+        i += m[0].length;
+        st.lastSig = "'";
+        continue;
+      }
+      i++;
+      continue;
+    }
+    const sr = spec.strings.find((s) => line.startsWith(s.open, i));
+    if (sr) {
+      blank(i, sr.open.length);
+      i += sr.open.length;
+      st.mode = { kind: "string", rule: sr };
+      continue;
+    }
+    if (spec.regexLiterals && ch === "/") {
+      const len = regexLiteralLength(line, i, st.lastSig);
+      if (len > 0) {
+        blank(i, len);
+        i += len;
+        st.lastSig = "/";
+        continue;
+      }
+    }
+    if (ch !== " " && ch !== "	") st.lastSig = ch;
+    i++;
+  }
+  if (st.mode.kind === "string" && !st.mode.rule.multiline) st.mode = { kind: "code" };
+  return out.join("");
+}
+function projectCode(lines, spec) {
+  const st = { mode: { kind: "code" }, holes: [], lastSig: "" };
+  return lines.map((l) => projectLine(l, spec, st));
+}
+function unquoteGitPath(p) {
+  const s = p.startsWith('"') && p.endsWith('"') ? p.slice(1, -1) : p;
+  return s.startsWith("b/") ? s.slice(2) : s;
+}
+function diffCodeView(diff, opts = {}) {
+  const files = [];
+  let cur = null;
+  let hunk = null;
+  let newLine = 0;
+  let inHeader = false;
+  const startFile = (path) => {
+    const f = { path, hunks: [], removed: [] };
+    files.push(f);
+    return f;
+  };
+  for (const line of diff.split("\n")) {
+    if (line.startsWith("diff --git ")) {
+      cur = startFile("");
+      hunk = null;
+      inHeader = true;
+      continue;
+    }
+    if (inHeader && line.startsWith("+++ ")) {
+      const p = line.slice(4).trim();
+      if (cur) cur.path = p === "/dev/null" ? "" : unquoteGitPath(p);
+      continue;
+    }
+    if (inHeader && (line.startsWith("--- ") || !line.startsWith("@@"))) continue;
+    const hh = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hh) {
+      inHeader = false;
+      if (!cur) cur = startFile("");
+      hunk = { newSide: [], addedAt: [] };
+      cur.hunks.push(hunk);
+      newLine = parseInt(hh[1], 10);
+      continue;
+    }
+    if (!cur) cur = startFile("");
+    if (!hunk) {
+      hunk = { newSide: [], addedAt: [] };
+      cur.hunks.push(hunk);
+      newLine = 1;
+    }
+    if (line.startsWith("+")) {
+      hunk.addedAt.push({ idx: hunk.newSide.length, lineNo: newLine });
+      hunk.newSide.push(line.slice(1));
+      newLine++;
+    } else if (line.startsWith("-")) {
+      cur.removed.push(line.slice(1));
+    } else if (line.startsWith(" ")) {
+      hunk.newSide.push(line.slice(1));
+      newLine++;
+    }
+  }
+  return files.map((f) => {
+    const spec = f.path ? lexSpecFor(f.path) : null;
+    const rawAdded = f.hunks.flatMap(
+      (h) => h.addedAt.map((a) => ({ lineNo: a.lineNo, raw: h.newSide[a.idx] }))
+    );
+    if (!spec) {
+      return { path: f.path, mode: "raw", added: rawAdded.map((a) => ({ ...a, code: a.raw })), removed: f.removed };
+    }
+    const text = opts.postImage ? opts.postImage(f.path) : null;
+    if (text !== null && text !== void 0) {
+      const post = text.split(/\r\n|\n|\r/);
+      if (rawAdded.every((a) => post[a.lineNo - 1] === a.raw)) {
+        const proj = projectCode(post, spec);
+        return {
+          path: f.path,
+          mode: "post-image",
+          added: rawAdded.map((a) => ({ ...a, code: proj[a.lineNo - 1] })),
+          removed: f.removed
+        };
+      }
+    }
+    const added = [];
+    for (const h of f.hunks) {
+      const proj = projectCode(h.newSide, spec);
+      for (const a of h.addedAt) added.push({ lineNo: a.lineNo, raw: h.newSide[a.idx], code: proj[a.idx] });
+    }
+    return { path: f.path, mode: "hunk", added, removed: f.removed };
+  });
+}
+
 // src/hooks/lib/write-hook-message.ts
 var HOOK_EVENTS = [
   "UserPromptSubmit",
@@ -4072,22 +4446,70 @@ var FIX_HEURISTICS = [
   },
   {
     name: "added_error_handling",
+    // `if.*nil` / `if.*None` were DROPPED here, and that is deduplication rather than a silent
+    // narrowing: `nil_handling_fix` below already matches exactly that shape
+    // (`= nil|= None|is None|!= nil|is not None`), so a nil check scored twice under one banner.
+    // Scored on each added line's CODE projection (`lib/code-spans.ts`), the same lexer the
+    // Stop hook uses: a keyword in a string literal or a comment is not error handling. The
+    // per-edit diff carries its `diff --git` header, so the file's language is known here
+    // without threading a path through this table. A language with no lexer is judged raw.
     test: (diff) => {
-      const added = (diff.match(/^\+.*(try|except|catch|guard|if.*nil|if.*None|validate|assert|raise|throw)/gm) || []).length;
+      const re = /^\+.*\b(try|except|catch|guard|validate|assert|raise|throw)\b/;
+      let added = 0;
+      for (const view of diffCodeView(diff)) {
+        for (const a of view.added) if (re.test(`+${a.code}`)) added++;
+      }
       return added > 2;
     }
   },
-  {
-    name: "method_name_correction",
-    test: (diff) => {
-      const removed = diff.match(/^-.*\.([a-z_]+)\(/m);
-      const added = diff.match(/^\+.*\.([a-z_]+)\(/m);
-      return !!(removed && added && removed[1] !== added[1]);
-    }
-  },
+  // ⛔ `method_name_correction` WAS RETIRED HERE 2026-08-20, and the measurement is why.
+  //
+  //   test: (diff) => {
+  //     const removed = diff.match(/^-.*\.([a-z_]+)\(/m);   // FIRST removed method call
+  //     const added   = diff.match(/^\+.*\.([a-z_]+)\(/m);  // FIRST added method call
+  //     return !!(removed && added && removed[1] !== added[1]);
+  //   }
+  //
+  // It compared the FIRST removed call against the FIRST added call, anywhere in the diff.
+  // The two need no relationship to each other, so it fired whenever a diff contained any
+  // two differently-named method calls — which is nearly every diff that touches code.
+  //
+  // Measured over the last 250 commits repo-wide:
+  //     shipped predicate                                            29 firings (12%)
+  //     one requiring the two lines to be identical but for the name  0 firings
+  // Eleven firings read by hand over packages/core/src: `.push()`->`.includes()`,
+  // `.call()`->`.system()`, `.trim()`->`.stringify()`, `.all()`->`.cwd()`, `.now()`->`.push()`,
+  // `.on()`->`.sort()`, `.test()`->`.split()` … NOT ONE was a rename. Precision 0 of 29.
+  //
+  // RETIRED RATHER THAN REPAIRED, on the same numbers: a correct implementation fires ZERO
+  // times in 250 commits, so repairing it buys a branch that never runs — dead weight with a
+  // maintenance cost (CR-71 in spirit: a detector that cannot fire is not a detector). It was
+  // not free while it lived: signals feed `sessionFixes`, which drives the ACTION REQUIRED
+  // banner demanding incidents, so this put noise directly on the retro pipeline — the one
+  // banner that must not cry wolf (CR-83).
+  //
+  // Kept as a comment, not deleted outright, so the next author who reaches for
+  // "detect a method rename from a diff" finds the measurement instead of rebuilding it.
+  //
+  // ⛔ THE FULL WRITE-UP IS DELIBERATELY NOT LINKED FROM HERE. This file SYNCS TO THE PUBLIC
+  // MIRROR and the incident corpus does not, so a path citation would point at something
+  // that does not exist there — and the leak guard refuses it, correctly. It caught exactly
+  // this line. The measurement above is self-contained for that reason; search the internal
+  // incident corpus for "a summary counted signals and listed files" if you need the rest.
+  // (Memory: a-retro-citation-is-publishable-content.)
   {
     name: "auth_fix",
-    test: (diff) => /^\+.*(token|auth|header|X-Service|Bearer|credential)/im.test(diff)
+    // `authn`/`authz` are spelled out because `\bauth\b` no longer reaches them, and the
+    // trailing `s?` keeps plurals (`tokens`, `credential`+`s`) that the boundary would drop.
+    //
+    // ⚠️ Backticks, not double quotes, and the plural is split — deliberately. CR-59's
+    // drift-guard forbids a quoted `credentials` segment literal outside credentials.ts via
+    // /['"]credentials['"]/, which cannot tell a string literal in CODE from quotation marks
+    // in PROSE. Writing the word normally here turns that guard red. That is the SAME defect
+    // class this file's own boundary fix addresses, in a second detector — recorded in the
+    // incident rather than fixed here, because widening a security-adjacent guard is its own
+    // change with its own blast radius.
+    test: (diff) => /^\+.*\b(token|auth|authn|authz|header|X-Service|Bearer|credential)s?\b/im.test(diff)
   },
   {
     name: "nil_handling_fix",
@@ -4095,16 +4517,42 @@ var FIX_HEURISTICS = [
   },
   {
     name: "concurrency_fix",
-    test: (diff) => /^\+.*(timeout|semaphore|lock|mutex|throttle|rate.limit|max_conn)/im.test(diff)
-  },
-  {
-    name: "async_pattern_fix",
-    test: (diff) => /^\+.*(@MainActor|async with|asyncio\.timeout|\.await)/.test(diff) && /^-/m.test(diff)
-  },
-  {
-    name: "added_missing_import",
-    test: (diff) => /^\+.*(import|from.*import|require)/.test(diff) && !/^-.*(import|from.*import|require)/m.test(diff)
-  }
+    // `rate[-_. ]limit` — the original `rate.limit` used an UNESCAPED dot, so `.` matched any
+    // character and the alternative fired on "corporate_limits". The class is now explicit
+    // about which separators are intended.
+    test: (diff) => /^\+.*\b(timeout|semaphore|lock|mutex|throttle|rate[-_. ]limit|max_conn)\b/im.test(diff)
+  }
+  // ⛔ `async_pattern_fix` AND `added_missing_import` WERE RETIRED HERE 2026-08-20.
+  //
+  //   async_pattern_fix:
+  //     test: (diff) => /^\+.*(@MainActor|async with|asyncio\.timeout|\.await)/.test(diff)
+  //                     && /^-/m.test(diff),
+  //   added_missing_import:
+  //     test: (diff) => /^\+.*(import|from.*import|require)/.test(diff)
+  //                     && !/^-.*(import|from.*import|require)/m.test(diff),
+  //
+  // Both fire ZERO times across the last 250 commits — measured on the same run that produced
+  // the boundary numbers above, over the 87 commits touching non-test source:
+  //
+  //     async_pattern_fix     0 / 87
+  //     added_missing_import  0 / 87
+  //
+  // This is the identical finding that retired `method_name_correction` below, and it is
+  // retired for the identical reason: a detector that never fires is not a detector, and it
+  // still costs review attention and maintenance on every pass over this table (CR-71 in
+  // spirit — a zero-caller chokepoint is a dead feature).
+  //
+  // WHY THEY CANNOT FIRE HERE, so the next author does not "fix" them back in: their tokens are
+  // largely foreign to this codebase. `@MainActor` is Swift; `async with` is Python. Neither
+  // appears in a TypeScript monorepo. `added_missing_import` requires added imports with NO
+  // removed import anywhere in the same diff, which any edit touching an import block violates.
+  // If this table is ever pointed at a Swift or Python corpus, re-measure before reinstating —
+  // do not reinstate on the assumption that the language mix changed.
+  //
+  // Kept as comments rather than deleted so the measurement travels with the code, and so a
+  // future author reaching for "detect an async-pattern fix" finds the number first.
+  // (Same reasoning, and same publication constraint, as the block below: this file syncs to
+  // the public mirror, so no internal path citations.)
 ];
 function getSessionFlagPath(sessionId) {
   const dir = join6(tmpdir2(), "massu-auto-learning");
@@ -4268,6 +4716,7 @@ if (isDirectInvocation(import.meta.url)) {
   main();
 }
 export {
+  FIX_HEURISTICS,
   TEST_OR_FIXTURE_PATH_PATTERNS,
   isTestOrFixturePath
 };