@pyreon/compiler 0.22.0 → 0.24.0

package/src/lpih.ts

@@ -0,0 +1,270 @@
+/**
+ * Live Program Inlay Hints (LPIH) — merge runtime fire data onto static
+ * Reactivity-Lens findings.
+ *
+ * This is a PURE function. The runtime side (`@pyreon/reactivity`)
+ * captures source locations at signal/computed/effect creation and emits
+ * fire counts via `getFireSummaries()`. The editor/LSP side calls
+ * `analyzeReactivity()` to get static findings. This module bridges them:
+ * given findings + fires, produces enriched findings whose `detail` field
+ * carries the live fire count.
+ *
+ * No I/O, no devtools dependency. The LSP transport is the consumer's
+ * responsibility (read fires from a cache file, an IPC bridge, or
+ * the editor's devtools panel — whatever the editor extension wants).
+ *
+ * ## The category
+ *
+ * Editors today show STATIC errors, types, and lint warnings at the
+ * cursor. They do NOT show LIVE program data — "this signal fires 240×
+ * per second", "this effect re-runs 3× per render", "this computed has
+ * 12 downstream subscribers". That data lives in a separate devtools
+ * panel that the developer has to context-switch to.
+ *
+ * LPIH closes that gap: live runtime data appears AT THE SOURCE LINE
+ * via LSP inlay hints, like a type annotation or a TypeScript error.
+ * No category like this exists for any reactive framework today.
+ *
+ * @example
+ * import { analyzeReactivity, mergeFireDataIntoFindings } from '@pyreon/compiler'
+ * import { getFireSummaries } from '@pyreon/reactivity'
+ *
+ * const code = `const count = signal(0)\nreturn <div>{count()}</div>`
+ * const { findings } = analyzeReactivity(code, 'app.tsx')
+ * const fires = getFireSummaries().map(s => ({
+ *   file: s.loc.file, line: s.loc.line, count: s.count, kind: s.kind,
+ * }))
+ * const enriched = mergeFireDataIntoFindings(findings, fires, 'app.tsx')
+ * // enriched[0].detail might now be "live — signal fired 240×"
+ */
+
+import type { ReactivityFinding, ReactivityFindingKind } from './reactivity-lens'
+
+/**
+ * Runtime fire data carried into the merge function. Shape mirrors
+ * `@pyreon/reactivity`'s `FireSummary` but is duplicated here to keep
+ * `@pyreon/compiler` free of a runtime-package import. The consumer
+ * adapts the shape at the call site.
+ */
+export interface LPIHFireDatum {
+  /** Source file path captured from `new Error().stack`. */
+  file: string
+  /** 1-based line number (V8 stack format). */
+  line: number
+  /** Total fires recorded at this location. */
+  count: number
+  /** `performance.now()` of most recent fire, or null. */
+  lastFire?: number | null | undefined
+  /** Node kind that fired (signal / derived / effect). */
+  kind?: 'signal' | 'derived' | 'effect' | undefined
+  /**
+   * Exponentially-decayed fire rate, fires/sec (1s time constant). 0
+   * when the node has been idle longer than several time constants.
+   * Used by the default formatter to add a "12/s" suffix when active.
+   * See `@pyreon/reactivity`'s `FireSummary.rate1s` for the math.
+   */
+  rate1s?: number | undefined
+}
+
+/** Options for `mergeFireDataIntoFindings`. */
+export interface LPIHMergeOptions {
+  /**
+   * Optional file-path normalizer. Used for both the analyzed source
+   * file and each fire's `file` field. Useful when fires come from
+   * runtime stacks (absolute paths) but the source file is identified
+   * relative (e.g. workspace-rooted). Defaults to identity.
+   */
+  normalizeFile?: (path: string) => string
+  /**
+   * Optional formatter for the enriched detail. Receives the original
+   * detail + the matched fire datum. Defaults to:
+   *   `${detail} — ${kind ? kind + ' ' : ''}fired ${count}×`
+   */
+  formatDetail?: (detail: string, fire: LPIHFireDatum) => string
+}
+
+/**
+ * Threshold below which the rate suffix is omitted. A long-dormant node
+ * decays toward 0; showing "0/s" or "0.001/s" is noise. The 0.5 cutoff
+ * means "less than once every 2 seconds at steady state" — at that
+ * rate, the cumulative count is the more useful signal.
+ *
+ * @internal — exported for tests + tunability.
+ */
+export const _LPIH_RATE_VISIBLE_THRESHOLD = 0.5
+
+function _formatRate(rate1s: number): string {
+  if (rate1s < _LPIH_RATE_VISIBLE_THRESHOLD) return ''
+  // < 10/s: 1 decimal place. ≥ 10/s: rounded integer.
+  return rate1s < 10
+    ? ` (${rate1s.toFixed(1)}/s)`
+    : ` (${Math.round(rate1s)}/s)`
+}
+
+const DEFAULT_FORMAT = (detail: string, fire: LPIHFireDatum): string => {
+  const kindLabel = fire.kind ? `${fire.kind} ` : ''
+  const rate = typeof fire.rate1s === 'number' ? _formatRate(fire.rate1s) : ''
+  return `${detail} — ${kindLabel}fired ${fire.count}×${rate}`
+}
+
+/**
+ * Merge runtime fire data onto static reactivity findings. Pure function,
+ * deterministic, input not mutated.
+ *
+ * Matching rules:
+ *   - Only fires whose normalized `file` matches the analyzed source file
+ *     are considered (cross-file fires are silently skipped).
+ *   - Line-level matching only (column is ignored). V8 stack columns
+ *     differ from compiler-emitted span columns by 1+ chars in practice,
+ *     and the user-visible affordance is "this signal at this line is
+ *     firing" — line precision is sufficient.
+ *   - Multiple fires at the same `line` are summed; latest `lastFire`
+ *     and corresponding `kind` win.
+ *   - Findings of kind `footgun`, `hoisted-static`, or `static-text` are
+ *     passed through unchanged — they're not runtime-active reactive
+ *     reads, so a fire count at their location is unrelated to them.
+ */
+export function mergeFireDataIntoFindings(
+  findings: ReactivityFinding[],
+  fires: readonly LPIHFireDatum[],
+  sourceFile: string,
+  options: LPIHMergeOptions = {},
+): ReactivityFinding[] {
+  if (fires.length === 0) return findings
+  const norm = options.normalizeFile ?? ((p) => p)
+  const format = options.formatDetail ?? DEFAULT_FORMAT
+  const targetFile = norm(sourceFile)
+
+  // Build line-keyed index. Sum counts at the same line; latest wins for
+  // lastFire + kind.
+  const byLine = new Map<number, LPIHFireDatum>()
+  for (const f of fires) {
+    if (norm(f.file) !== targetFile) continue
+    const existing = byLine.get(f.line)
+    if (existing) {
+      existing.count += f.count
+      if (typeof f.rate1s === 'number') {
+        existing.rate1s = (existing.rate1s ?? 0) + f.rate1s
+      }
+      const incomingLast = f.lastFire ?? -Infinity
+      const existingLast = existing.lastFire ?? -Infinity
+      if (incomingLast > existingLast) {
+        existing.lastFire = f.lastFire
+        existing.kind = f.kind ?? existing.kind
+      }
+    } else {
+      byLine.set(f.line, { ...f })
+    }
+  }
+
+  if (byLine.size === 0) return findings
+
+  return findings.map((finding) => {
+    // Footguns + static spans are NOT enriched — fire data at those lines
+    // belongs to a SEPARATE reactive expression on the same line, and
+    // attributing it to the footgun would be misleading.
+    if (
+      finding.kind === 'footgun' ||
+      finding.kind === 'hoisted-static' ||
+      finding.kind === 'static-text'
+    ) {
+      return finding
+    }
+    const fire = byLine.get(finding.line)
+    if (!fire) return finding
+    return {
+      ...finding,
+      detail: format(finding.detail, fire),
+    }
+  })
+}
+
+/**
+ * Synthesize "creation-site" inlay-hint findings directly from fire data.
+ *
+ * `analyzeReactivity()` produces findings at REACTIVE READ sites (JSX
+ * expressions). But the runtime captures fires at CREATION sites
+ * (`signal(0)`, `computed(...)`, `effect(...)`). These are usually
+ * different source lines — so the merge function above only helps when
+ * they happen to coincide.
+ *
+ * The simpler, more useful editor surface is: show fire counts AT THE
+ * CREATION LINE. The user writes `const count = signal(0)` and sees
+ * `(signal fired 129×)` as ghost text on that line, the same way
+ * TypeScript shows the inferred type.
+ *
+ * This function turns each fire datum into a synthetic finding the LSP
+ * can serve as an inlay hint. No static analysis required — pure runtime
+ * data → editor hint.
+ *
+ * Returns findings sorted by (line, column). Files that don't match
+ * `sourceFile` (after normalization) are skipped.
+ *
+ * @example
+ * import { firesToCreationSiteFindings } from '@pyreon/compiler'
+ * import { getFireSummaries } from '@pyreon/reactivity'
+ *
+ * const fires = getFireSummaries().map(s => ({
+ *   file: s.loc.file, line: s.loc.line, count: s.count, kind: s.kind,
+ * }))
+ * const findings = firesToCreationSiteFindings(fires, 'app.tsx')
+ * // [{ kind: 'live-fire', line: 5, detail: 'signal fired 129×', ... }]
+ */
+export function firesToCreationSiteFindings(
+  fires: readonly LPIHFireDatum[],
+  sourceFile: string,
+  options: LPIHMergeOptions = {},
+): ReactivityFinding[] {
+  if (fires.length === 0) return []
+  const norm = options.normalizeFile ?? ((p) => p)
+  const targetFile = norm(sourceFile)
+
+  // Per-line aggregation (multiple nodes on the same line — rare but
+  // possible: `const [a, b] = [signal(0), signal(0)]`).
+  const byLine = new Map<number, LPIHFireDatum>()
+  for (const f of fires) {
+    if (norm(f.file) !== targetFile) continue
+    const existing = byLine.get(f.line)
+    if (existing) {
+      existing.count += f.count
+      // Sum rates at the same line (e.g. destructured signal pair).
+      if (typeof f.rate1s === 'number') {
+        existing.rate1s = (existing.rate1s ?? 0) + f.rate1s
+      }
+      const incomingLast = f.lastFire ?? -Infinity
+      const existingLast = existing.lastFire ?? -Infinity
+      if (incomingLast > existingLast) {
+        existing.lastFire = f.lastFire
+        existing.kind = f.kind ?? existing.kind
+      }
+    } else {
+      byLine.set(f.line, { ...f })
+    }
+  }
+
+  const format = options.formatDetail ?? ((_: string, fire: LPIHFireDatum) => {
+    const kindLabel = fire.kind ?? 'node'
+    const rate = typeof fire.rate1s === 'number' ? _formatRate(fire.rate1s) : ''
+    return `${kindLabel} fired ${fire.count}×${rate}`
+  })
+
+  // 'live-fire' is a new finding kind — synthetic, not produced by
+  // `analyzeReactivity()`. The LSP renders it as an inlay hint the same
+  // way as the structural kinds (reactive/static-text/etc).
+  const LIVE_KIND = 'live-fire' as ReactivityFindingKind
+
+  const out: ReactivityFinding[] = []
+  for (const [line, fire] of byLine) {
+    out.push({
+      kind: LIVE_KIND,
+      line,
+      column: 0,
+      endLine: line,
+      // 9999 = "end of line" sentinel; the LSP can clamp to actual line length.
+      endColumn: 9999,
+      detail: format('', fire),
+    })
+  }
+  out.sort((a, b) => a.line - b.line || a.column - b.column)
+  return out
+}

package/src/pyreon-intercept.ts

@@ -993,16 +993,27 @@ export function hasPyreonPatterns(code: string): boolean {
     /\.theme\s*\(\s*\{\s*\}\s*\)/.test(code) ||
     /\b(?:add|remove)EventListener\s*\(/.test(code) ||
     (/\bDate\.now\s*\(/.test(code) && /\bMath\.random\s*\(/.test(code)) ||
-    /on[A-Z]\w*\s*=\s*\{\s*undefined\s*\}/.test(code) ||
-    /=\s*\(\s*\{[^}]+\}\s*[:)]/.test(code) ||
-    // props-destructured-body: `const { … } = <ident>` anywhere. Loose
-    // on purpose — the AST walker is the precise gate; this only has to
-    // avoid skipping the full walk.
-    /\b(?:const|let|var)\s+\{[^}]*\}\s*=\s*[A-Za-z_$]/.test(code) ||
+    // Bounded `\w{0,60}` cap on the handler identifier — real `on*`
+    // names are at most ~25 chars (`onPointerLeaveCapture`); 60 leaves
+    // headroom. The unbounded `\w*` form was flagged by CodeQL
+    // `js/polynomial-redos` (alert #65) as polynomial-time on inputs
+    // like `onAAAA…` (long runs of `[A-Z]`): per starting position
+    // the greedy `\w*` consumes O(N) chars before the trailing `=`
+    // fails to match, giving O(N²) overall on N starting positions.
+    // The cap keeps the regex linear regardless of input shape.
+    /on[A-Z]\w{0,60}\s*=\s*\{\s*undefined\s*\}/.test(code) ||
+    // Bounded `{0,500}` / `{1,500}` quantifiers — this is a pre-filter
+    // scan before the precise AST walker, so losing detector recall on
+    // a pathologically long single-line input is acceptable.
+    /=\s*\(\s*\{[^}]{1,500}\}\s*[:)]/.test(code) ||
+    // props-destructured-body: `const { … } = <ident>` anywhere.
+    /\b(?:const|let|var)\s+\{[^}]{0,500}\}\s*=\s*[A-Za-z_$]/.test(code) ||
     // signal-write-as-call: `const X = signal(` declaration anywhere
     /\b(?:signal|computed)\s*[<(]/.test(code) ||
-    // static-return-null-conditional: `if (...) return null` anywhere
-    /\bif\s*\([^)]+\)\s*\{?\s*return\s+null\b/.test(code) ||
+    // static-return-null-conditional: `if (...) return null` anywhere.
+    // `[\s{]*` (single class) instead of `\s*\{?\s*` (overlapping
+    // quantifiers) — the latter is polynomial on long whitespace runs.
+    /\bif\s*\([^)]{1,500}\)[\s{]{0,20}return\s+null\b/.test(code) ||
     // as-unknown-as-vnodechild
     /\bas\s+unknown\s+as\s+VNodeChild\b/.test(code) ||
     // query-options-as-function: a query hook called with an object literal

package/src/ssg-audit.ts

@@ -278,8 +278,8 @@ function detectDynamicRouteMissingGetStaticPaths(
   const findings: SsgFinding[] = []
   for (const file of routeFiles) {
     const base = file.split('/').pop() ?? ''
-    // Dynamic route iff filename contains `[...]` or `[name]` brackets.
-    if (!/\[.+\]/.test(base)) continue
+    // `[^\]]+` instead of `.+` — bounded, no backtrack potential.
+    if (!/\[[^\]]{1,200}\]/.test(base)) continue
     // Skip layouts / errors / 404s — only PAGE files take getStaticPaths.
     if (/^_(layout|error|loading|404|not-found)\./.test(base)) continue
     // Skip API routes under `routes/api/` (path-based convention).
@@ -425,7 +425,7 @@ export function auditSsg(rootDir: string): SsgAuditResult {
   let revalidateExports = 0
   for (const file of routeFiles) {
     const base = file.split('/').pop() ?? ''
-    if (/\[.+\]/.test(base) && !/^_(layout|error|loading|404|not-found)\./.test(base)) {
+    if (/\[[^\]]{1,200}\]/.test(base) && !/^_(layout|error|loading|404|not-found)\./.test(base)) {
       dynamicRoutes++
     }
     const source = parseSourceFile(file)

package/src/tests/collapse-bail-census.test.ts

@@ -84,6 +84,13 @@ interface SiteClass {
    * attrs are string literals AND children are static text (partial-collapse
    * addressable). */
   partialAddressable: boolean
+  /** dynamic-prop only: true iff EXACTLY ONE dynamic attr is a ternary of
+   * two string literals AND every OTHER non-literal attr is an `on*`
+   * handler (which compose orthogonally via the handler-combined
+   * emit), AND children are static text. Counts the subset addressable
+   * by the dynamic-prop collapse PR sequence (PRs #765-#767 plus the
+   * handler-combined follow-up). */
+  dynamicTernaryAddressable: boolean
 }
 
 const isPascal = (t: string): boolean =>
@@ -113,17 +120,47 @@ function classifySite(node: any): SiteClass {
   const attrs: any[] = opening.attributes ?? []
   let sawDynamic = false
   let everyDynamicIsHandler = true
+  // Dynamic-prop addressable tracking: count ternaries + check shape.
+  // Exactly one ternary-of-two-literals + every other non-literal attr
+  // is either a ternary or an `on*` handler (handlers compose via the
+  // combined `_rsCollapseDynH` emit) → addressable. Note no
+  // `sawHandler` tracking: the original PR 3 no-handler restriction
+  // was lifted by the handler-combined follow-up; handlers no longer
+  // disqualify a site from `dynamicTernaryAddressable`.
+  let ternaryCount = 0
+  let everyDynamicIsTernary = true
   for (const a of attrs) {
-    if (a.type === 'JSXSpreadAttribute') return { bucket: 'spread', partialAddressable: false }
+    if (a.type === 'JSXSpreadAttribute')
+      return { bucket: 'spread', partialAddressable: false, dynamicTernaryAddressable: false }
     const nm = a.name?.type === 'JSXIdentifier' ? a.name.name : null
-    if (!nm) return { bucket: 'spread', partialAddressable: false }
+    if (!nm)
+      return { bucket: 'spread', partialAddressable: false, dynamicTernaryAddressable: false }
     const v = a.value
-    if (!v) return { bucket: 'boolean-attr', partialAddressable: false }
+    if (!v)
+      return {
+        bucket: 'boolean-attr',
+        partialAddressable: false,
+        dynamicTernaryAddressable: false,
+      }
     const isStr =
       v.type === 'StringLiteral' || (v.type === 'Literal' && typeof v.value === 'string')
     if (!isStr) {
       sawDynamic = true
-      if (!/^on[A-Z]/.test(nm)) everyDynamicIsHandler = false
+      const isHandler = /^on[A-Z]/.test(nm)
+      if (!isHandler) everyDynamicIsHandler = false
+      // Probe for the ternary-of-two-literals shape (PR 2 detector's
+      // structural shape).
+      const expr = v.type === 'JSXExpressionContainer' ? v.expression : null
+      const isLitStr = (n: any): boolean =>
+        n &&
+        (n.type === 'StringLiteral' || (n.type === 'Literal' && typeof n.value === 'string'))
+      const isTernaryOfLits =
+        expr &&
+        expr.type === 'ConditionalExpression' &&
+        isLitStr(expr.consequent) &&
+        isLitStr(expr.alternate)
+      if (isTernaryOfLits) ternaryCount++
+      else if (!isHandler) everyDynamicIsTernary = false
     }
   }
   // children
@@ -135,22 +172,41 @@ function classifySite(node: any): SiteClass {
     else staticChildrenOnly = false // JSXExpressionContainer etc.
   }
   if (sawDynamic) {
-    // Every NON-dynamic attr is a string literal by construction: the loop
-    // above early-returns on spread / missing-name / boolean attrs, so any
-    // attr that didn't set `sawDynamic` is necessarily `isStr`. Hence the
-    // partial-addressable condition is just "every dynamic attr is on*" AND
-    // "children are static text" — no separate literal check needed.
     const partialAddressable = everyDynamicIsHandler && staticChildrenOnly
-    return { bucket: 'dynamic-prop', partialAddressable }
+    // Dynamic-collapse claims: EXACTLY 1 ternary, every OTHER dynamic
+    // attr is either a ternary or an `on*` handler (no plain dynamic
+    // shapes like `state={getValue()}`), static children. The
+    // handler-combined follow-up (this PR) lifted the no-handler
+    // restriction by routing handler-bearing dynamic sites to the
+    // `_rsCollapseDynH` runtime helper instead of bailing — closes
+    // the bulk of the 15.4% dynamic-prop bucket (previously the
+    // strict no-handler scope only addressed 0.2% of sites).
+    //
+    // The `everyDynamicIsTernary` flag here is computed in the loop
+    // above as "every non-handler dynamic attr is a ternary"; combined
+    // with `ternaryCount === 1` + `staticChildrenOnly` it precisely
+    // matches what `detectDynamicCollapsibleShape` + `tryDynamicCollapse`
+    // claim. Handlers are NO LONGER excluded — they compose orthogonally.
+    const dynamicTernaryAddressable =
+      ternaryCount === 1 && everyDynamicIsTernary && staticChildrenOnly
+    return { bucket: 'dynamic-prop', partialAddressable, dynamicTernaryAddressable }
   }
   // No spread / boolean / dynamic attr. Bail can now only come from children.
   for (const c of kids) {
     if (c.type === 'JSXText') continue
     if (c.type === 'JSXElement' || c.type === 'JSXFragment')
-      return { bucket: 'element-child', partialAddressable: false }
-    return { bucket: 'expression-child', partialAddressable: false }
+      return {
+        bucket: 'element-child',
+        partialAddressable: false,
+        dynamicTernaryAddressable: false,
+      }
+    return {
+      bucket: 'expression-child',
+      partialAddressable: false,
+      dynamicTernaryAddressable: false,
+    }
   }
-  return { bucket: 'collapsible', partialAddressable: false }
+  return { bucket: 'collapsible', partialAddressable: false, dynamicTernaryAddressable: false }
 }
 
 describe('proposal #1 — collapse-tail bail-reason census (measurement, not a build)', () => {
@@ -168,6 +224,7 @@ describe('proposal #1 — collapse-tail bail-reason census (measurement, not a b
     }
     let candidates = 0
     let partialAddressable = 0
+    let dynamicTernaryAddressable = 0
     let myCollapsible = 0
     let scannerCollapsible = 0
 
@@ -191,6 +248,7 @@ describe('proposal #1 — collapse-tail bail-reason census (measurement, not a b
             tally[c.bucket]++
             if (c.bucket === 'collapsible') myCollapsible++
             if (c.partialAddressable) partialAddressable++
+            if (c.dynamicTernaryAddressable) dynamicTernaryAddressable++
           }
         }
         for (const k in node) {
@@ -220,14 +278,27 @@ describe('proposal #1 — collapse-tail bail-reason census (measurement, not a b
         `  bail:expression-child              : ${tally['expression-child']} (${pct(tally['expression-child'])})`,
         `  ── partial-collapse ADDRESSABLE    : ${partialAddressable} (${pct(partialAddressable)} of all sites)`,
         `     (dynamic-prop bails where every dynamic attr is on*, all else literal, static children)`,
+        `  ── dynamic-collapse ADDRESSABLE    : ${dynamicTernaryAddressable} (${pct(dynamicTernaryAddressable)} of all sites)`,
+        `     (dynamic-prop bails where EXACTLY ONE attr is a ternary-of-two-string-literals,`,
+        `      every other non-literal attr is on* (handlers compose via _rsCollapseDynH),`,
+        `      static children — dynamic-prop sequence #765-#767 + handler-combined follow-up)`,
         '',
       ].join('\n'),
     )
 
     // ── Trustworthiness gate (bisect-equivalent) ────────────────────────────
-    // This independent walk's "collapsible" count MUST equal the production
-    // scanner's truth-set. If they diverge the census is measuring fiction.
-    expect(myCollapsible).toBe(scannerCollapsible)
+    // This independent walk's "collapsible-equivalent" count MUST equal the
+    // production scanner's truth-set. If they diverge the census is
+    // measuring fiction.
+    //
+    // Per PR 3 (#767) the scanner emits TWO `CollapsibleSite` entries per
+    // dynamic-prop site (one per literal value — the resolver pre-renders
+    // both); the compiler emit still produces ONE collapsed call site. So
+    // the per-site classifier count + 2× the dynamic-addressable count
+    // equals the scanner's per-resolution count. If they diverge, either
+    // the classifier and scanner disagree on which dynamic sites are
+    // addressable, OR the scanner's expansion drifted from this formula.
+    expect(myCollapsible + 2 * dynamicTernaryAddressable).toBe(scannerCollapsible)
 
     // ── Lock the headline finding (ratchet record) ──────────────────────────
     // The corpus is real and large; these are the measured facts as of this
@@ -241,5 +312,19 @@ describe('proposal #1 — collapse-tail bail-reason census (measurement, not a b
     // the classifier ran over a non-trivial dynamic-prop population so the
     // ratio is meaningful, not noise.
     expect(tally['dynamic-prop'] + tally.collapsible).toBeGreaterThan(0)
+    // PR 4 of the dynamic-prop partial-collapse build: lock that the
+    // dynamic-collapse classifier ran over a meaningful population
+    // (dynamic-prop bucket non-zero). The addressable count is in the
+    // log; we DON'T assert it >0 here because the strict no-handler
+    // PR 3 scope is honestly small in real-world corpora (real Buttons
+    // with `state={cond ? ... : ...}` almost always also carry
+    // `onClick` → BAIL until the handler-combined follow-up). The
+    // dynamic-prop bucket itself is the size of the future surface;
+    // PR 3's no-handler subset is the first measurable step.
+    expect(tally['dynamic-prop']).toBeGreaterThan(0)
+    // The dynamic-addressable count can be 0 in a clean run (no
+    // matching sites in the corpus); just lock that the counter is
+    // wired and consistent with the bucket.
+    expect(dynamicTernaryAddressable).toBeLessThanOrEqual(tally['dynamic-prop'])
   })
 })