@micha.bigler/ui-core-micha 3.14.4 → 4.0.0

package/docs/messaging-deviations.md

@@ -1,118 +0,0 @@
-# Messaging parity outcomes (MSG-3b, extended by MSG-3c and MSG-3d)
-
-This is the authoritative parity record for the ucm messaging surfaces. It
-replaces the former file-level “final parity confirmation,” which was not
-sufficient evidence of feature parity. Each entry maps directly to the
-numbered checklist in Part A of `work-orders/MSG-3b.md`. `OK` means the
-capability is present; `DEV` means an intentional, documented redesign or
-non-parity; `BLOCKED` means the dependency (dcm) does not expose the data or
-realtime contract needed to implement it truthfully.
-
-**Binding rule, added by MSG-3c:** every `BLOCKED` entry below must name the
-dcm version it was verified blocked against. MSG-3b was itself blocked
-against dcm 2.36.1 and recorded seven rows as `BLOCKED` on "a future dcm work
-order" — dcm 2.37.0 shipped that work mid-flight, and MSG-3b's own WO-end
-review closed without noticing, because it cross-checked the checklist
-against ucm's landed code and took the dependency's state from the WO text
-instead of the live dependency. A version pin turns that re-check into a
-two-minute job instead of an archaeology exercise; `tests/messagingContractConformance.test.js`
-now fails the build if a `BLOCKED` line omits one.
-
-## Unread lifecycle
-
-1. **OK** — Selecting a conversation calls the existing mark-read endpoint and clears its local unread count.
-2. **OK** — Opening a `Thread` also marks its conversation read; the duplicate call is idempotent.
-3. **OK** — Marking a conversation read decrements the global count by that conversation’s prior unread value, clamped at zero.
-4. **OK** — Expanding a reply thread calls the existing thread-read endpoint for its root message.
-5. **OK** — Realtime incoming messages increment unread only outside the active conversation and never double-count optimistic-send reconciliation.
-
-## Message actions
-
-6. **DEV** — Desktop hover and right-click open the MUI action menu. jg’s dedicated mobile long-press gesture is not reproduced; the same actions remain available through the regular MUI affordance.
-7. **OK** — Authors can edit their own messages inline. Moderator edit affordance is host-supplied because dcm exposes no per-viewer capability field; server authorization remains authoritative.
-8. **OK** — An active editor closes when the message is deleted by another update.
-9. **OK** — Authors and host-designated moderators can delete; the host boolean is UX gating only and dcm enforces the actual permission.
-10. **OK** — Deletion is confirmed in a MUI dialog before the request is sent.
-11. **OK** — A deleted reply/edit target clears dependent composer or editor state.
-12. **OK** — Message text can be copied through the action menu.
-13. **OK** — Reply targeting is present.
-14. **DEV** — Reactions use five compact presets rather than jg’s six-preset presentation.
-15. **DEV** — No full third-party emoji picker is added; the compact preset menu keeps the package dependency-free.
-16. **OK** — Deleted and poll messages do not render the generic action menu.
-
-## Direct conversations
-
-17. **OK** — `DirectMessageLauncher` starts a direct conversation.
-18. **OK** — The launcher displays the host-supplied candidate list (searchable via an Autocomplete since MSG-19) and selection state.
-19. **OK** — It has distinct empty and in-flight creation states; candidate discovery remains host-owned because dcm has no directory endpoint.
-20. **OK** — Start is disabled until a candidate is selected and during creation.
-21. **OK** — Policy rejections render an API-derived readable error in the dialog.
-22. **OK** — The picker uses a fullscreen MUI dialog at the small breakpoint.
-
-## Threading and quoting
-
-23. **OK** — Both dcm’s `reply_to_id` and optimistic rows’ `reply_to` are read, so REST and realtime replies group under their root.
-24. **OK** — Replies show a sender and short quoted snippet.
-25. **OK** — Clicking a quote scrolls its source message into view.
-26. **OK** — Quotes of deleted messages render the deleted placeholder rather than stale content.
-27. **OK** (delivered in MSG-3d, was BLOCKED as of dcm 2.37.0) — dcm 2.38.0's `serialize_message` gains viewer-independent `reply_count`/`last_reply_at`, and `thread_last_read_at` is attached REST-only from `MessageThreadReceipt`. `Thread` shows an unread-reply marker on the thread toggle when `last_reply_at > thread_last_read_at`, treats a `null` receipt with replies as unread, and shows no marker (and no toggle) when there are no replies. Opening a thread updates the receipt from the REST response, not a frame (the field is never present on one, by design). An incoming reply's `message` frame also live-advances the cached root's `reply_count`/`last_reply_at`, merged field-wise so a previously-fetched `thread_last_read_at` is never wiped — the same merge-trap discipline MSG-3c's three fixes established, now with its own mandatory regression test.
-28. **OK** — Reply threads load lazily on expand and collapse locally.
-29. **DEV** — Reply composition is supplied through the independently mountable `Composer` target prop rather than jg’s per-thread embedded composer.
-
-## Composer
-
-30. **OK** — Enter sends and Shift+Enter preserves a newline.
-31. **OK** — Staged files show image thumbnails or file labels, with independent removal.
-32. **OK** — Attachment uploads show real byte-percentage progress when the browser reports an upload total; otherwise an indeterminate indicator is shown while the upload is in flight.
-33. **OK** — Images over 2 MB are compressed client-side to a maximum 2560 px JPEG at quality 0.85, with silent original-file fallback.
-34. **DEV** — Composer emoji insertion uses the existing compact preset set instead of jg’s full picker, while preserving insertion at the cursor.
-35. **OK** — Sending is optimistic and exposes retry plus inline error state.
-36. **OK** — The poll button is disabled while an image is staged as a UI convenience matching jg’s composer behavior; no dcm-side constraint requires it. Poll creation and attachment sending are separate API calls and separate message rows.
-37. **DEV** — Drafts are deliberately reset on conversation changes. jg’s cross-conversation draft leak is not reproduced.
-
-## Conversation list
-
-38. **OK** (delivered in MSG-3c, was BLOCKED as of dcm 2.36.1) — dcm 2.37.0 serializes `last_message` (`excerpt`/`created_at`) on the conversation payload and emits it live via `conversation_upsert` on new-message send. `ConversationList` was found reading the wrong field name (`last_message.body` instead of the real `excerpt`) — fixed, so the preview now actually renders against the real contract instead of always falling back to the empty state. Reorder and live preview refresh work for new messages; dcm does not publish `conversation_upsert` on message edit/delete, so those cases update on the next REST refresh rather than live (see row 58).
-39. **OK** — `last_message_at` renders through browser-native, locale-aware `Intl.RelativeTimeFormat` labels.
-40. **OK** — The existing MUI `selected={conversation.id === activeConversationId}` wiring produces the `Mui-selected` active-row highlight; it was verified and needs no redundant styling.
-41. **OK** — Unread badges and bold unread titles are present.
-42. **OK** (delivered in MSG-3d, was BLOCKED as of dcm 2.37.0) — dcm 2.38.0's `serialize_conversation_core` includes `external_key`. ucm does not interpret it — jg's `event_all`/`event_team` vocabulary (or any other app's) stays entirely host-side. `ConversationList` accepts an optional `resolveManagedLabel(conversation)` host resolver, called only for `kind: 'managed'` conversations, falling back to the existing title behavior when unset; no app-specific string appears anywhere in `src/` (asserted directly by test).
-43. **DEV** — Generic MUI kind icons replace jg’s richer per-kind/person avatar treatment while retaining type identification.
-44. **OK** — Mute and archive actions are present.
-
-## Timeline
-
-45. **OK** — New active-conversation messages auto-scroll when the reader was already near the bottom. Scrolled-up readers are not pulled away from history; this near-bottom gate is an intentional usability refinement.
-46. **OK** — Announcement messages render their deep-link action only when a host supplies `onAnnouncementLink`; routing remains a host-app responsibility.
-47. **OK** — Sender names remain visible for group and managed conversations and are suppressed in direct conversations. No sender-side bubble alignment scheme was added because it is not required for this capability.
-48. **OK** — Deleted tombstones, edited marker, and timestamps are rendered.
-
-## Read receipts
-
-49. **OK** — Read ticks mount only for the current user’s own persisted messages.
-50. **OK** — Non-direct recipient detail supplied by dcm is shown through a click/keyboard-openable popover list rather than hover-only tooltip. Direct conversations always suppress the detail control; dcm’s recipient-detail payload remains the moderator authorization boundary because no generic client moderator field exists.
-
-## Polls
-
-51. **OK** (delivered in MSG-3c, was BLOCKED as of dcm 2.36.1) — dcm 2.37.0's `serialize_poll` renders question, options and per-option `vote_count` through `PollCard`. Fixed against the real shape: the initial-selection effect previously read non-existent per-option `selected`/`voted` flags — it now derives from `voted_option_ids`, which dcm adds only to the create/vote/close REST responses (never to `serialize_poll` itself or the `poll_updated` frame), and correctly shows no known selection when that field is absent rather than guessing.
-52. **DEV** (delivered in MSG-3c, was BLOCKED as of dcm 2.36.1) — dcm 2.37.0's poll options carry `voters` as user ids only, never names, and there is no user-directory endpoint (the same structural limit already established for the DM candidate list, row 19). `PollCard` renders the vote count and marks the viewer's own vote (derived from `voted_option_ids`) rather than a per-voter name list, which the dependency cannot supply.
-53. **OK** (delivered in MSG-3c, was BLOCKED as of dcm 2.36.1) — `closed_at` is in the real poll projection; voting is disabled once set. The poll creator's close permission was found broken against the real contract (`created_by_id` is the real field; the prior code read a non-existent `created_by.id`) — fixed.
-54. **OK** — Composer starts at two options and disables adding options once it reaches ten; the server’s two-option minimum remains enforced.
-55. **OK** — Vote and close write paths are wired; full read rendering is now delivered per rows 51-53.
-
-## Live synchronization
-
-56. **OK** (delivered in MSG-3c, was BLOCKED as of dcm 2.36.1) — dcm 2.37.0 emits `reaction` frames. The handler had never run against a real frame; verification found it wholesale-replacing the message's reaction list with the server's aggregate-only projection (`{emoji, count}`, never a per-viewer `reacted` flag, by design) on every arrival — silently wiping every previously-known `reacted` flag on that message, not just whichever emoji changed. The same defect existed in the REST-confirm path for the viewer's own toggle. Both fixed to merge by emoji, preserving previously-known `reacted` state instead of discarding it.
-57. **OK** (delivered in MSG-3c, was BLOCKED as of dcm 2.36.1) — dcm 2.37.0 emits `poll_updated` frames. Same defect class as row 56, found while implementing row 51-53: the frame handler wholesale-replaced a message's `poll` object, silently dropping a REST-known `voted_option_ids` the moment any `poll_updated` frame arrived (e.g. a vote-count bump from another viewer). Fixed to carry the previous value forward when the incoming frame is silent about it, per the WO's explicit "must not clear or invert the viewer's own vote state" requirement.
-58. **OK** (delivered in MSG-3c, was BLOCKED as of dcm 2.36.1) — new messages live-reorder the conversation list and refresh its preview via `conversation_upsert` (row 38). dcm does not publish `conversation_upsert` on message edit or delete (only on new-message send — verified against every `_publish(..., "conversation_upsert", ...)` call site in `services.py`), so an edit/delete of a conversation's last message updates the preview on the next REST refresh rather than live; this is a dcm-side gap outside this WO's scope, not a ucm limitation.
-59. **OK** — dcm’s emitted message, message-edited, and message-deleted frames are handled live.
-
-## Required backend follow-up
-
-None outstanding. This checklist has **zero `BLOCKED` entries** as of MSG-3d. MSG-2c (dcm 2.37.0)
-delivered what MSG-3b's own audit had recorded as blocking rows 38, 51–53 and 56–58 — MSG-3c
-re-verified each against the live dependency and delivered them. MSG-2d (dcm 2.38.0) delivered what
-remained blocking rows 27 and 42 — MSG-3d re-verified and delivered them the same way. Every row of
-the original MSG-3b checklist is now either implemented or a recorded deliberate deviation; see the
-rows above for what was actually built, including the client-side bugs found and fixed only once real
-server data was checked against, not assumed from the WO text or the doc's own prior claims.

package/index.html

@@ -1,12 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>ui-core-micha development harness</title>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script type="module" src="/dev/main.jsx"></script>
-  </body>
-</html>

package/renovate.json

@@ -1,10 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "github>bigler-webapps/renovate-config",
-    "github>bigler-webapps/renovate-config:auto-merge"
-  ],
-  "baseBranchPatterns": [
-    "main"
-  ]
-}

package/scripts/chart-api-census.mjs

@@ -1,415 +0,0 @@
-// NO SHEBANG. Run this with an explicit interpreter: `node scripts/chart-api-census.mjs
-// <workspace-root>`, which is how it is documented and how it is run.
-//
-// A `#!` line here is invisible to direct execution -- Node strips it -- but breaks anything
-// that loads this file through an ESM graph rather than running it: Vite's module runner
-// (hence vitest) rejects `#` as an illegal token, and other bundlers/parsers may too.
-// UCM-CHART-14 shipped with one. The script kept working and its output stayed correct, so
-// nothing user-facing complained; what broke was its own test suite, silently reduced to
-// 0 collected tests (`SyntaxError: Invalid or unexpected token`). Do not re-add it.
-// UCM-CHART-14: a parser, not a grep. This is the whole point of this file -- five wrong consumer
-// counts in this series (see work-orders/UCM-CHART-14.md) all came from a grep pattern that could
-// not see JSX structure: a prop several lines below the component name, an arrow function's `=>`
-// inside a prop value, an apostrophe inside a comment, a `>` inside a nested `{}` expression. A
-// regex line-match cannot tell any of those apart from the thing it's looking for. This script
-// tracks string/template/comment/regex-literal state and brace depth in ONE continuous pass over
-// each file, so its answer is reproducible output, not a claim someone has to trust.
-//
-// Second review round (both `reviewer` and `ui_reviewer`, independently) found the first version's
-// three-pass design (a raw `RegExp.exec` tag-open search, oblivious to string/comment context, then
-// a per-tag bounds scan, then a per-tag attribute scan) could itself produce a WRONG, non-UNPARSED
-// answer -- worse than an honest UNPARSED, because nothing flags it: JSX-looking text inside a
-// string or comment counted as a real element, and a regex literal's `}`/`>` characters (e.g.
-// `data={/[}>]/}`) corrupted brace-depth tracking and closed a tag early. Both are fixed here by
-// giving every stage the SAME shared state, tracked once, forward, per file.
-//
-// Dev script only -- never imported by the published package (kept out of package.json's `files`/
-// `exports`), never writes anything, and degrades to "not present" for a missing/frontend-less
-// sibling repo rather than throwing.
-
-import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
-import { join, relative, dirname } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-
-// The five props this WO's series has spent five work orders removing/relocating -- what a census
-// exists to count is exactly "who still passes one of these".
-export const TARGET_PROPS = ['aspect', 'height', 'minHeight', 'margin', 'xAxisAngle'];
-export const TARGET_COMPONENTS = ['BarChart', 'LineChart', 'ScatterChart', 'TimeSeriesChart', 'ChartFrame'];
-const SOURCE_EXTENSIONS = new Set(['.js', '.jsx', '.ts', '.tsx']);
-const SKIP_DIR_NAMES = new Set(['node_modules', 'dist', 'build', '.git']);
-const PACKAGE_SPECIFIER = '@micha.bigler/ui-core-micha';
-
-/**
- * Finds every `import { ... } from '@micha.bigler/ui-core-micha'` in `source` and returns a map
- * of LOCAL name -> CANONICAL export name, restricted to `TARGET_COMPONENTS`. Import declarations
- * are a much simpler grammar than JSX (no nested arbitrary expressions in the specifier list), so
- * a regex is appropriate here -- unlike the JSX scan below, which is not.
- */
-function findImportedLocalNames(source) {
-  const localToCanonical = new Map();
-  const importRe = /import\s*\{([^}]*)\}\s*from\s*['"]@micha\.bigler\/ui-core-micha['"]/g;
-  let match;
-  while ((match = importRe.exec(source)) !== null) {
-    const specifiers = match[1].split(',').map((s) => s.trim()).filter(Boolean);
-    for (const spec of specifiers) {
-      const asMatch = spec.match(/^(\w+)\s+as\s+(\w+)$/);
-      const canonical = asMatch ? asMatch[1] : spec;
-      const local = asMatch ? asMatch[2] : spec;
-      if (TARGET_COMPONENTS.includes(canonical)) localToCanonical.set(local, canonical);
-    }
-  }
-  return localToCanonical;
-}
-
-function lineNumberAt(source, index) {
-  let line = 1;
-  for (let i = 0; i < index; i += 1) if (source[i] === '\n') line += 1;
-  return line;
-}
-
-const IDENT_START = /[A-Za-z_$]/;
-const IDENT_CHAR = /[A-Za-z0-9_$]/;
-// Regex-literal-start heuristic: a `/` is treated as opening a regex literal (not division) only
-// when the last significant character before it is one of these -- the common "a regex can only
-// start where a VALUE is expected, not follow one" rule real JS tokenizers use. Not a full parser;
-// documented, and sufficient for `data={/[}>]/}`-shaped prop values, the concrete case found in
-// review. A `/` following an identifier/number/`)`/`]` is treated as division and left alone.
-//
-// Regression found DURING this same fix's own verification run (before it ever reached review):
-// `<` and `>` were originally in this set on the theory that `/` can start a regex right after a
-// comparison operator -- but `<`/`>` are also exactly what precede the `/` in EVERY JSX closing
-// tag (`</Something>`) and self-closing tag (`Something />`). With them included, `</ChartFrame>`
-// itself was misread as a regex-literal start, consuming everything up to the next stray `/` in
-// the file and corrupting brace depth for the rest of the scan -- turning every multi-line
-// ChartFrame usage in the estate into a false UNPARSED. A `/` genuinely starting a regex right
-// after `<`/`>` (e.g. `a < /regex/.test(b)`) does not occur in practice in this codebase; dropped.
-const REGEX_PRECEDING_CHARS = new Set(['(', '{', '[', ',', ';', ':', '=', '&', '|', '!', '?', '+', '-', '*', '%', '^', '~']);
-
-/**
- * Extracts top-level (tag-depth-0, RELATIVE TO `tagSource`) attribute names from `tagSource` (a
- * full, already-correctly-bounded `<Name ...>` span). Shares the same string/template/comment/
- * regex tracking as the outer scanner, so a prop value containing a regex literal, a nested
- * object, or a comment can never be mistaken for a top-level attribute name -- `sx={{ aspect: 1
- * }}` never reports a false `aspect` (an object key inside an expression, not a JSX attribute),
- * and `data={/[}>]/}` never corrupts this function's own depth count either.
- */
-function extractTopLevelAttributeNames(tagSource) {
-  const found = new Set();
-  let depth = 0;
-  let inString = null;
-  let inLineComment = false;
-  let inBlockComment = false;
-  let inRegex = false;
-  let inRegexClass = false;
-  let lastSignificant = null;
-
-  for (let i = 0; i < tagSource.length; i += 1) {
-    const c = tagSource[i];
-    const next = tagSource[i + 1];
-
-    if (inLineComment) { if (c === '\n') inLineComment = false; continue; }
-    if (inBlockComment) { if (c === '*' && next === '/') { inBlockComment = false; i += 1; } continue; }
-    if (inRegex) {
-      if (c === '\\') { i += 1; continue; }
-      if (c === '[') { inRegexClass = true; continue; }
-      if (c === ']') { inRegexClass = false; continue; }
-      if (c === '/' && !inRegexClass) {
-        inRegex = false;
-        let j = i + 1;
-        while (j < tagSource.length && /[a-z]/i.test(tagSource[j])) j += 1;
-        i = j - 1;
-      }
-      continue;
-    }
-    if (inString) {
-      if (c === '\\') { i += 1; continue; }
-      if (c === inString) inString = null;
-      continue;
-    }
-    if (c === '/' && next === '/') { inLineComment = true; i += 1; continue; }
-    if (c === '/' && next === '*') { inBlockComment = true; i += 1; continue; }
-    if (c === '/' && (lastSignificant === null || REGEX_PRECEDING_CHARS.has(lastSignificant))) {
-      inRegex = true; inRegexClass = false; lastSignificant = '/'; continue;
-    }
-    if (c === '"' || c === "'" || c === '`') { inString = c; lastSignificant = c; continue; }
-    if (c === '{') { depth += 1; lastSignificant = c; continue; }
-    if (c === '}') { depth = Math.max(0, depth - 1); lastSignificant = c; continue; }
-
-    if (depth === 0 && IDENT_START.test(c) && (i === 0 || !IDENT_CHAR.test(tagSource[i - 1]))) {
-      let j = i + 1;
-      while (j < tagSource.length && IDENT_CHAR.test(tagSource[j])) j += 1;
-      found.add(tagSource.slice(i, j));
-      lastSignificant = tagSource[j - 1];
-      i = j - 1;
-      continue;
-    }
-    if (!/\s/.test(c)) lastSignificant = c;
-  }
-  return found;
-}
-
-/**
- * The single-pass scanner. Walks `source` exactly ONCE, maintaining ONE shared state for strings,
- * template literals (+ `${}` expression nesting), line/block comments, regex literals, and brace
- * depth -- so tag-open detection and tag-close detection agree on where the real code is, instead
- * of a separate context-blind pass for each. A `<Name` is only recognised as a real JSX tag open
- * when the scanner is not currently inside a string/comment/regex, which is what stops `// <BarChart
- * aspect />` or `"<BarChart aspect />"` from being counted. Multiple target tags can be pending at
- * once (a component nested inside another's own prop expression, e.g. `<ChartFrame content={<>
- * <BarChart aspect /></>} />`) -- each is closed independently, at the exact brace depth it opened
- * at, so a nested tag closing does not consume or corrupt the outer tag's own remaining scan.
- *
- * A tag still open when the file ends is reported UNPARSED, never dropped (Definition of Done).
- */
-function scanForComponents(source, localToCanonical) {
-  const results = [];
-  const openTags = []; // { canonical, tagStart, closeAtDepth, line }
-  const localNames = [...localToCanonical.keys()];
-
-  let inString = null;
-  let inLineComment = false;
-  let inBlockComment = false;
-  let inRegex = false;
-  let inRegexClass = false;
-  let depth = 0;
-  const templateDepthStack = [];
-  let lastSignificant = null;
-
-  const closePendingAtCurrentDepth = (closeIndex) => {
-    for (let k = openTags.length - 1; k >= 0; k -= 1) {
-      if (openTags[k].closeAtDepth === depth) {
-        const tag = openTags.splice(k, 1)[0];
-        const tagSource = source.slice(tag.tagStart, closeIndex + 1);
-        const attrNames = extractTopLevelAttributeNames(tagSource);
-        const props = {};
-        for (const prop of TARGET_PROPS) props[prop] = attrNames.has(prop);
-        results.push({ component: tag.canonical, line: tag.line, unparsed: false, props });
-      }
-    }
-  };
-
-  for (let i = 0; i < source.length; i += 1) {
-    const c = source[i];
-    const next = source[i + 1];
-
-    if (inLineComment) { if (c === '\n') inLineComment = false; continue; }
-    if (inBlockComment) { if (c === '*' && next === '/') { inBlockComment = false; i += 1; } continue; }
-    if (inRegex) {
-      if (c === '\\') { i += 1; continue; }
-      if (c === '[') { inRegexClass = true; continue; }
-      if (c === ']') { inRegexClass = false; continue; }
-      if (c === '/' && !inRegexClass) {
-        inRegex = false;
-        let j = i + 1;
-        while (j < source.length && /[a-z]/i.test(source[j])) j += 1;
-        i = j - 1;
-      }
-      continue;
-    }
-    if (inString) {
-      if (c === '\\') { i += 1; continue; }
-      if (inString === '`' && c === '$' && next === '{') {
-        templateDepthStack.push(depth);
-        depth += 1;
-        i += 1;
-        inString = null;
-        lastSignificant = '{';
-        continue;
-      }
-      if (c === inString) inString = null;
-      continue;
-    }
-
-    if (c === '/' && next === '/') { inLineComment = true; i += 1; continue; }
-    if (c === '/' && next === '*') { inBlockComment = true; i += 1; continue; }
-    if (c === '/' && (lastSignificant === null || REGEX_PRECEDING_CHARS.has(lastSignificant))) {
-      inRegex = true; inRegexClass = false; lastSignificant = '/'; continue;
-    }
-    if (c === '"' || c === "'" || c === '`') { inString = c; lastSignificant = c; continue; }
-
-    if (c === '{') { depth += 1; lastSignificant = c; continue; }
-    if (c === '}') {
-      if (templateDepthStack.length && depth - 1 === templateDepthStack[templateDepthStack.length - 1]) {
-        templateDepthStack.pop();
-        depth -= 1;
-        inString = '`';
-        lastSignificant = '}';
-        continue;
-      }
-      depth = Math.max(0, depth - 1);
-      lastSignificant = c;
-      continue;
-    }
-
-    if (c === '<') {
-      let matchedName = null;
-      for (const name of localNames) {
-        if (source.startsWith(name, i + 1)) {
-          const after = source[i + 1 + name.length];
-          if (after === undefined || /[\s/>]/.test(after)) { matchedName = name; break; }
-        }
-      }
-      if (matchedName) {
-        openTags.push({
-          canonical: localToCanonical.get(matchedName),
-          tagStart: i,
-          closeAtDepth: depth,
-          line: lineNumberAt(source, i),
-        });
-        i += matchedName.length;
-        lastSignificant = matchedName[matchedName.length - 1];
-        continue;
-      }
-      lastSignificant = c;
-      continue;
-    }
-
-    if (c === '>') {
-      closePendingAtCurrentDepth(i);
-      lastSignificant = c;
-      continue;
-    }
-
-    if (!/\s/.test(c)) lastSignificant = c;
-  }
-
-  for (const tag of openTags) {
-    results.push({ component: tag.canonical, line: tag.line, unparsed: true, props: {} });
-  }
-  return results;
-}
-
-/**
- * The pure analysis function -- no filesystem access, so this is what the fixture tests below
- * exercise directly. Returns one entry per JSX element found whose tag name resolves (via the
- * file's own imports) to one of `TARGET_COMPONENTS`.
- *
- * Documented, accepted heuristic limitation (unchanged from the first version, not solved by the
- * single-pass rewrite): `<` is only ever treated as a JSX tag open, never as a less-than
- * comparison against an uppercase-starting identifier (`foo < BarChart`). Real component
- * references are never used in a numeric/relational comparison in practice, so this is judged a
- * theoretical gap, not a practical one -- unlike the string/comment/regex-literal blindness fixed
- * above, which were concrete, plausible false positives.
- */
-export function findChartApiUsage(source) {
-  const localToCanonical = findImportedLocalNames(source);
-  if (localToCanonical.size === 0) return [];
-  return scanForComponents(source, localToCanonical);
-}
-
-function walkSourceFiles(rootDir) {
-  const files = [];
-  function walk(dir) {
-    let entries;
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry.name.startsWith('.')) continue;
-      if (SKIP_DIR_NAMES.has(entry.name)) continue;
-      const full = join(dir, entry.name);
-      if (entry.isDirectory()) {
-        walk(full);
-      } else if (entry.isFile()) {
-        const dot = entry.name.lastIndexOf('.');
-        if (dot === -1) continue;
-        if (SOURCE_EXTENSIONS.has(entry.name.slice(dot))) files.push(full);
-      }
-    }
-  }
-  walk(rootDir);
-  return files;
-}
-
-/**
- * Locates an app's frontend source root: `frontend/src` first (this estate's usual layout), then
- * a bare `src/` fallback. Returns `null` (never throws) if neither exists -- a repo with no
- * frontend, or absent entirely, is reported as "not present", not an error.
- */
-function findAppSourceRoot(appDir) {
-  const candidates = [join(appDir, 'frontend', 'src'), join(appDir, 'src')];
-  for (const candidate of candidates) {
-    if (existsSync(candidate) && statSync(candidate).isDirectory()) return candidate;
-  }
-  return null;
-}
-
-export function runCensus(workspaceRoot, { excludeDirs = ['ui-core-micha'] } = {}) {
-  let appNames;
-  try {
-    appNames = readdirSync(workspaceRoot, { withFileTypes: true })
-      .filter((e) => e.isDirectory() && !e.name.startsWith('.') && !excludeDirs.includes(e.name))
-      .map((e) => e.name);
-  } catch (err) {
-    return { workspaceRoot, apps: [], error: `workspace root unreadable: ${err.message}` };
-  }
-
-  const apps = appNames.map((appName) => {
-    const appDir = join(workspaceRoot, appName);
-    const sourceRoot = findAppSourceRoot(appDir);
-    if (!sourceRoot) return { app: appName, present: false, entries: [] };
-
-    const entries = [];
-    for (const file of walkSourceFiles(sourceRoot)) {
-      let source;
-      try {
-        source = readFileSync(file, 'utf8');
-      } catch {
-        continue; // unreadable file (permissions, symlink race) -- not a parse failure, skip quietly
-      }
-      if (!source.includes(PACKAGE_SPECIFIER)) continue; // fast path: no ucm import at all
-      const usages = findChartApiUsage(source);
-      for (const usage of usages) {
-        entries.push({ ...usage, file: relative(workspaceRoot, file).replace(/\\/g, '/') });
-      }
-    }
-    return { app: appName, present: true, entries };
-  });
-
-  return { workspaceRoot, apps };
-}
-
-/**
- * Reports EVERY element found (Definition of Done: "every `<ChartFrame>` and every ucm chart
- * preset element"), not just the ones carrying a target prop -- a clean element is printed as
- * `(clean)`, not omitted, so "this app has zero matching elements at all" and "this app has
- * elements, all clean" stay visibly distinct instead of looking identical.
- */
-function formatReport(result) {
-  const lines = [];
-  let totalUnparsed = 0;
-  for (const { app, present, entries } of result.apps) {
-    if (!present) { lines.push(`${app}: not present (no frontend/src or src)`); continue; }
-    if (entries.length === 0) continue;
-    lines.push(`${app}:`);
-    for (const entry of entries) {
-      if (entry.unparsed) {
-        totalUnparsed += 1;
-        lines.push(`  UNPARSED  ${entry.file}:${entry.line}  <${entry.component}>  -- could not close this tag, not counted as clean`);
-        continue;
-      }
-      const activeProps = TARGET_PROPS.filter((p) => entry.props[p]);
-      const propsText = activeProps.length > 0 ? activeProps.join(' ') : '(clean)';
-      lines.push(`  ${entry.file}:${entry.line}  <${entry.component} ${propsText}>`);
-    }
-  }
-  if (totalUnparsed > 0) {
-    lines.push('');
-    lines.push(`${totalUnparsed} tag(s) could not be parsed -- see UNPARSED lines above. Not counted as clean.`);
-  }
-  return lines.join('\n');
-}
-
-// `pathToFileURL` (not manual string-building) is what makes this comparison correct on Windows,
-// where a bare `file://${path}` is missing the extra slash before the drive letter that
-// `import.meta.url` actually has (`file:///C:/...`) -- a naive comparison silently never matches,
-// so `node scripts/chart-api-census.mjs` would run to completion with zero output and no error.
-const isMain = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
-if (isMain) {
-  const workspaceRoot = process.argv[2] || join(dirname(fileURLToPath(import.meta.url)), '..', '..');
-  const result = runCensus(workspaceRoot);
-  // eslint-disable-next-line no-console
-  console.log(formatReport(result));
-}