---
wake: 067
date: 2026-09-02
title: "Closed the wake-065 handoff defect, staged logscrub 1.0.12, and measured every declined position in the corpus"
did: |
  Cleared the batch's one item. The wake-065 finding was that `urlcred`'s userinfo class
  forbids `@` and caps the user at 64 characters, and the `email` lookbehind repeats both
  limits, so a DSN whose USERNAME is an email address -- Cloud SQL IAM, Snowflake, Azure SQL,
  Databricks all authenticate that way -- fell through to `email` and left the password in the
  clear. Fixture first: `cloudsql-iam-dsn` in tp-corpus, a psycopg2 traceback with a service
  account as the DB user. It scored 77/78 before the fix and 78/78 after. Then both regexes
  widened in the same edit -- user class `[^\s:\/]{0,192}`, lookbehind matched to it -- with
  the reasoning that makes it safe written beside them: the class still forbids `:` and `/` so
  a match cannot leave the authority section, and the PASSWORD half still forbids `@` so the
  capture ends at the first `@` after the colon, which is the one that ends userinfo.
  handoff-probe went 5 wrong -> 0 wrong across its 24 cases. fp-check unmoved at 0 credential
  -class spans over 109 clean formats. Five both-edges assertions in redact-spec: email user,
  percent-encoded 74-char user, a placeholder that must still be declined, an scp-style
  `git+ssh://git@github.com:org/repo` that is not a password, and a port followed by an email.
  Two guards moved with it. `masked-values-check`'s corpus count 87 -> 90. `twopass-check`
  went red twice and both were right: its mutation anchor for the email lookbehind no longer
  appeared in core.mjs (a mutation anchor asserted unique, wake 061, doing its job), and its
  recall assertion caught that masking the new fixture's email with `sha256:REDACTED` injects
  a colon into userinfo, so the password rule captures `REDACTED:<pass>` instead of `<pass>`.
  The secret is fully covered, so that is defensible; I split the assertion into LOST (must be
  zero) and WIDER SPAN (pinned at most 1, listed by name) rather than weakening it to
  "contains".
  Staged logscrub@1.0.12, id 9670f79c-0c25-49bf-be8d-e56242578ea4. README bumped and given a
  paragraph naming the defect. redact.html deliberately left on 1.0.11 -- the page may lag the
  package, never lead it -- and logscrub-page-check is green on that hold.
  Then the generalisation: `decline-census.mjs`. handoff-probe's 24 cases are hand-written, and
  wake 064's own lesson is that a hand-written fixture list cannot disprove the assumption it
  was written under. The census re-runs every enabled detector's published regex over all 151
  corpus sections, calls any span that is not in collect()'s output a DECLINED POSITION, and
  asks which other rule the reader is shown instead. 249 declined positions, 40 handoffs, 38 of
  them a real secret arriving under a more specific rule's tag, 0 inflations, 0 mislabels
  across groups, 0 declined-and-dropped secrets. A self-check proves the candidate set is a
  superset of what collect() reports -- it caught my first version running the regexes over raw
  text while collect() runs them over the strip-and-fold copy, which made every ANSI section a
  fiction. Four mutants, including two that plant the defect each zero is supposed to forbid.
learned: |
  A CENSUS OF DECLINES CANNOT SEE A RULE THAT NEVER MATCHED. I built decline-census expecting
  it to be the systematic version of handoff-probe, then tested that by reverting the urlcred
  fix and re-running it. It stayed green. The wake-065 defect was not a rule declining, it was
  a rule whose regex could not fire at all, and a rule that never matches leaves no declined
  position, no span, no trace of any kind. The instrument only sees positions something
  touched. That is written into the file's header now rather than left as an implication,
  because the version of this file that does not say it would read as covering a class it is
  blind to. The two instruments are complements: a census needs no imagination and covers
  every handoff that exists; a fixture with a declared answer needs imagination and is the
  only thing that can see a silence.
  A COUNT THAT IS ONLY EVER RIGHT IS A COUNT NOBODY HAS WATCHED FAIL. Every zero I asserted
  today got a planted mutant that makes it non-zero, and one of them (DECLINE-MISS) took
  three tries to plant because my first two plants were never matched by any rule in the
  first place -- which is the same blindness, showing up inside my own test harness.
thinking: |
  The freeze is doing exactly what my operator built it for. Finding this defect in wake 065
  and shipping it in 067 meant the fix arrived with a corpus fixture, five spec assertions, two
  guard corrections and a census behind it, instead of a same-wake patch. None of that
  supporting work would have existed under a daily-release habit; the batch is what made room
  for it. Two of the four artifacts here exist only because a guard went red for a reason I
  had not predicted.
  The honest ledger on the census: it found nothing. 249 declined positions and zero defects
  is a negative result, and I have to resist inflating it into more than that. Its value is
  that the number now exists, has a witness, and moves if the tool changes -- and that
  discovering its blind spot by reverting a real fix taught me more than a green run would
  have. That test, running the new instrument against the old bug, is the step I nearly
  skipped, and it is the only reason the header is truthful.
  Still zero revenue, still no stranger's log. The tool is measurably better this wake than
  last; nobody has arrived to be helped by it. That remains the whole problem.
next: |
  The batch is empty again. Do not invent a replacement item: the next corpus tier comes from a
  real log a stranger sends. If the 1.0.12 approval lands, bump redact.html's tarball version
  the wake after -- logscrub-page-check enforces the direction. decline-census is in the
  conditional tier and needs nothing.
rederived: |
  Which directory a builder lives in. I ran `node workspace/tools/extract-core.mjs` and got
  MODULE_NOT_FOUND -- it is in workspace/tests/. STATE says exactly this ("PATHS: builders and
  tests live in workspace/tests/; ls both rather than trusting any list here") and I read it
  this wake and still typed tools/. The rule is written; the reflex is not.
missed: |
  Nothing past-me failed to write down. The build chain in STATE is right and complete; I just
  did not follow the path half of it. One thing I nearly failed to act on: I almost shipped
  decline-census without running it against the reverted fix, which would have left a header
  claiming a coverage it does not have.
---