[lucasbraum]

What and why

Item 3 of the engine issues behind the react pack (#45), after #49. In tldraw, useTransform(rSvg, …) is rejected once in apps/examples and once in packages/tldraw, both by the hook's parameter at packages/editor/src/lib/hooks/useTransform.ts:6. Upstream fixed it once, at the declaration. compile.ts anchored a repository parameter only when two or more sites in the same workspace compile tripped it, so these stayed two breaking findings at the call sites.

• Tracer (adapters/typescript/compile.ts): a diagnostic whose parameter cause only it trips in its workspace keeps its own site there, as before, and carries the cause as a candidate, sharedCause.
• Merge (check/shared-root.ts, called from mergeAcrossWorkspaces): with files made repository-relative, a lone site joins the anchor another workspace already reports for the same declaration (same file, line and symbol). Lone sites of two or more workspaces make one anchor. The result is one breaking finding at the declaration, anchorOnly, with the call sites in downstream as evidence. A parameter only one site in the whole repository trips stays that site's finding. The cluster builder in unattributed.ts is factored out (clusterFinding) and reused.
• Report model, additive only (nothing renamed or removed):
  • Finding.callSites: how many call sites trip a parameter anchor, across every workspace.
  • Finding.sharedCause: on a lone site; dropped from the merged report once joined or found alone.
  • check --details prints N call sites trip it at the target, for example under the anchor, with the sites.
  • The HTML report prints N call sites and lists them (first ten, then "and N more") under the anchor's location.
• Scorer (packs/tooling/pack-test.ts): an anchored finding is scored at its anchor, so a ground-truth finding at the declaration matches it. The call sites under an anchor (evidenceSites) are excluded from predictions even if another finding also plans them: they are neither true nor false positives.
• docs/architecture.md describes the cross-workspace join.

No pack's rules, expectations, ground truth or companions changed.

How it was verified

New tests:

• tracer (cause.test.ts): a lone site carries sharedCause; sites clustered in one workspace do not.
• merge:
  • shared-root.test.ts: joins an existing anchor; two lone sites make an anchor under the rule that claimed them; a lone site stays and loses the candidate; different declarations stay apart.
  • check.test.ts: mergeAcrossWorkspaces with the tldraw shape gives one anchor, callSites: 2, counted as one site.
• scorer (pack-test.test.ts): the declaration matches the anchor, and a call site that is evidence is not a false positive even when planned on its own.
• CLI: format-check-details.test.ts and html/render.test.ts, for the N call sites lines.

pnpm lint, pnpm typecheck, pnpm test pass (core 918, cli 349).

Pack tests, breaking sites. Before is main (2e5c510, i.e. #49) with the react pack from #45's branch, as #49 measured it. After is this branch with the same pack, in a scratch worktree, kept out of this PR.

pack	precision before → after	recall before → after	breaking FP before → after
react	98% → 100%	69% → 69%	2 → 0
zod	100% → 100%	71% → 71%	0 → 0
stripe	100% → 100%	89% → 89%	0 → 0
ai	100% → 100%	36% → 36%	0 → 0

• react: the two useTransform call sites are gone. useTransform.ts:6 is still the true positive it was, now with callSites counting both workspaces' sites. pack test react prints FAIL only because feat(packs): react 18 → 19 candidate pack (pack test fails, draft) #45's recorded verification.json (candidate, 96%) no longer matches the run; there is no breaking false positive left. Recording it is feat(packs): react 18 → 19 candidate pack (pack test fails, draft) #45's job.
• zod and ai: pass, unchanged.
• stripe: unchanged on the two repositories that install in this sandbox. nextjs/saas-starter does not install here (pnpm MODULE_NOT_FOUND), before and after, which is the only reason pack test stripe fails here.

Checklist

• Tests for the change (a bug fix starts with a failing test)
• pnpm lint && pnpm typecheck && pnpm test pass
• README and docs updated if behavior changed (docs/architecture.md)
• Changeset added if a user would notice (pnpm changeset): minor
• No new dependency, or it was agreed in an issue
• No private code, names or paths in fixtures, tests or docs (tldraw and excalidraw are public)
• The rules in CONTRIBUTING.md ("Rules that do not bend") still hold

🤖 Generated with Claude Code

https://claude.ai/code/session_01AKRx4kuV6oi25MP5WguxW9

---

Generated by Claude Code