fix(observability-map): enter the walk exactly where execution is guaranteed

The catch-evidence walk entered only a bare block and a do body, so
relocating a clause's own statements inside if (true), a single-default
switch, an if/else or a try/finally hid the branch evidence while the
returns veto still saw the return: a deciding clause read as a swallow on
83 real routes per corpus entry, the generalisation of the switch-break
bug fixed in 87e0822.

The walk now enters the positions guaranteed to execute whenever the
clause runs: a catchless try's tryBlock, the sole clause of a
single-default switch, the then-arm of a keyword-exact if (true), and
both arms of an if/else with isolated per-arm states merged by
intersection (evidence in one arm only earns nothing). definitelyExits
folds the literal true keyword so a trailing dead statement after
if (true) { exit } is cut. The entry folds are keyword-exact while the
liveness folds stay wide, deliberately: entry grants credit, liveness
only withholds blindness.

Refactors the walk's flags into a threaded state record (verified
byte-identical on the real tree before the entries landed); the finished
step is also byte-identical including per-clause evidence over all 427
entry points. The six mechanism-B corpus entries measure falls 0 rises 0.
New corpus entry dead-classifier-one-arm pins the intersection: widening
it to a union raises 80 routes and turns the entry red.

Author: 1stvamp

internal-packages/observability-map/src/checks/index.test.ts

@@ -796,6 +796,51 @@ describe("error-classification", () => {
     );
     expect(r.status).toBe("pass");
   });
+
+  // The verdict end of the walk's guaranteed-execution entries, one pair per entered construct.
+  // The evidence end is `the walk enters exactly the positions guaranteed to execute` in
+  // scan.test.ts; these hold the wrapped and unwrapped spellings to the same verdict, modeled on
+  // the switch pair above. Before the entries existed, every wrapper here turned a passing
+  // deciding clause into a fail with a detail line accusing it of ignoring the error.
+  const CLAUSE_WRAPPED = (clauseBody: string) => `import { prisma } from "~/db.server";
+     export async function loader() {
+       try {
+         return json(await prisma.thing.findMany());
+       } catch (e) {
+         ${clauseBody}
+       }
+     }`;
+
+  const DECIDING_CLAUSE =
+    "if (e instanceof Error) { return new Response(null, { status: 400 }); }\n" +
+    "return new Response(null, { status: 500 });";
+
+  const GUARANTEED_WRAPPERS: Array<[string, (body: string) => string]> = [
+    ["a catchless try/finally", (body) => `try {\n${body}\n} finally { }`],
+    ["a single-default switch", (body) => `switch (pick()) { default: {\n${body}\n} }`],
+    ["an if (true)", (body) => `if (true) {\n${body}\n}`],
+    [
+      "an if/else with the body in both arms",
+      (body) => `if (pick()) {\n${body}\n} else {\n${body}\n}`,
+    ],
+  ];
+
+  for (const [label, wrap] of GUARANTEED_WRAPPERS) {
+    it(`reads a deciding clause relocated into ${label} with the same verdict`, () => {
+      const wrapped = run(
+        "error-classification",
+        "api.v1.wrapped.ts",
+        CLAUSE_WRAPPED(wrap(DECIDING_CLAUSE))
+      );
+      const bare = run(
+        "error-classification",
+        "api.v1.wrapped.ts",
+        CLAUSE_WRAPPED(DECIDING_CLAUSE)
+      );
+      expect(bare.status).toBe("pass");
+      expect(wrapped).toEqual(bare);
+    });
+  }
 });
 
 describe("auth-boundary", () => {

internal-packages/observability-map/src/mutations.ts

@@ -688,6 +688,17 @@ export const MUTATIONS: Mutation[] = [
     "splice if (e instanceof Error) { } into every catch",
     (e) => `if (${e} instanceof Error) { }`
   ),
+  // The if/else arm walk merges per-arm evidence by INTERSECTION, so a real classifier sitting in
+  // one arm only earns nothing: one arm running is a condition, not a guarantee. This is the entry
+  // that goes red the day someone "simplifies" the intersection to a union, at which point every
+  // clause in the tree earns a branch from a dead arm. Additive: it plants fake signal.
+  prependToEveryCatch(
+    "dead-classifier-one-arm",
+    "preserving",
+    "splice a dead one-arm classifier if/else into every catch",
+    (e) =>
+      `if (false) { if (${e} instanceof Error) { return new Response(null, { status: 400 }); } } else { 0; }`
+  ),
 
   // The additive class. Everything above either takes signal away or moves it about; these put in
   // signal that is not real, which is the direction the corpus was blind to.
@@ -905,6 +916,7 @@ export const ADDITIVE_IDS = [
   "wrap-body-in-rethrow",
   "wrap-body-in-same-arms-throw-ternary",
   "empty-instanceof-if",
+  "dead-classifier-one-arm",
   "registered-throw",
   "fake-require-guard",
   "fake-authenticated-lookup",

internal-packages/observability-map/src/scan.test.ts

@@ -865,6 +865,109 @@ describe("scanFile: catch clause evidence", () => {
     });
   });
 
+  // The walk may enter a construct exactly where the entered statements are guaranteed to execute
+  // whenever the clause body runs. Before these entries existed, relocating a clause's own
+  // statements inside `if (true)`, a switch default, an if/else or a try/finally put the branch
+  // evidence out of reach while the returns veto still saw the return, so a deciding clause read
+  // as a swallow: 83 real routes regressed per corpus entry. Each identity pair here holds the
+  // wrapped and unwrapped spellings to the same evidence; `checks/index.test.ts` holds them to the
+  // same verdict.
+  describe("the walk enters exactly the positions guaranteed to execute", () => {
+    const clauseEvidence = (body: string) => {
+      const ep = scanFile(
+        "x.ts",
+        `export async function loader() {
+           try { return await prisma.thing.findMany(); }
+           catch (e) {
+             ${body}
+           }
+         }`
+      );
+      return ep!.catches[0]!;
+    };
+
+    const DECIDING =
+      "if (e instanceof KnownError) { return new Response(e.code, { status: 400 }); }\n" +
+      "return new Response(null, { status: 500 });";
+    const RETHROW = "logger.error(e);\nthrow e;";
+
+    const WRAPPERS: Array<[string, (body: string) => string]> = [
+      ["a catchless try/finally", (body) => `try {\n${body}\n} finally { }`],
+      ["a single-default switch", (body) => `switch (pick()) { default: {\n${body}\n} }`],
+      ["an if (true)", (body) => `if (true) {\n${body}\n}`],
+      [
+        "an if/else with the body in both arms",
+        (body) => `if (pick()) {\n${body}\n} else {\n${body}\n}`,
+      ],
+    ];
+
+    for (const [label, wrap] of WRAPPERS) {
+      it(`reads a deciding clause wrapped in ${label} identically`, () => {
+        expect(clauseEvidence(wrap(DECIDING))).toEqual(clauseEvidence(DECIDING));
+      });
+
+      it(`reads a rethrowing clause wrapped in ${label} identically`, () => {
+        expect(clauseEvidence(wrap(RETHROW))).toEqual(clauseEvidence(RETHROW));
+      });
+    }
+
+    // The switch entry is exact: one clause and it is a default. Anything else is not entered and
+    // keeps its top-level treatment, which is what the identity pair below and the `break and
+    // continue inside the construct they target` family already pin for the multi-clause shapes.
+    it("reads a clause wrapped in a single-default switch as the bare clause", () => {
+      expect(clauseEvidence(`switch (1) { default: {\n${DECIDING}\n} }`)).toEqual(
+        clauseEvidence(DECIDING)
+      );
+    });
+
+    // Intersection, not union. One arm running is a condition, not a guarantee, so evidence in a
+    // single arm earns nothing; `dead-classifier-one-arm` in the mutation corpus is the tree-scale
+    // twin with the arm provably dead.
+    it("does not credit a classifier that sits in one arm only", () => {
+      const evidence = clauseEvidence(
+        "if (pick()) { if (e instanceof Error) { return new Response(null, { status: 400 }); } } else { 0; }\n" +
+          "return null;"
+      );
+      expect(evidence.branches).toBe(false);
+    });
+
+    it("does not credit a classifier in a dead arm beside an inert arm", () => {
+      const evidence = clauseEvidence(
+        "if (false) { if (e instanceof Error) { return new Response(null, { status: 400 }); } } else { 0; }\n" +
+          "return null;"
+      );
+      expect(evidence).toMatchObject({ branches: false, rethrows: false, throws: false });
+    });
+
+    // The else-arm under a literal-true guard can never run, so nothing in it is evidence: no
+    // rethrow minted, and the deciding statements after the wrapper keep their credit.
+    it("reads a dead else arm under if true as contributing nothing", () => {
+      const evidence = clauseEvidence(`if (true) { 0; } else { throw e; }\n${DECIDING}`);
+      expect(evidence).toMatchObject({ throws: false, branches: true });
+    });
+
+    // A throw in the tryBlock of a CAUGHT try never escapes the clause: the nested catch takes
+    // it. Crediting it as a rethrow would launder a returnless swallow into not-applicable.
+    it("does not read the tryBlock of a caught try as this clause's rethrow", () => {
+      const evidence = clauseEvidence("try { throw e; } catch {}\nlogger.error(e);");
+      expect(evidence).toMatchObject({ rethrows: false, throws: false });
+    });
+
+    // The walk does not enter a finally block, so the returns veto must still read it off the
+    // whole statement: this clause's finally return eats the throw, and the error never leaves.
+    it("reads a try whose finally returns as swallowing, not rethrowing", () => {
+      const evidence = clauseEvidence("try { throw e; } finally { return null; }");
+      expect(evidence.rethrows).toBe(false);
+    });
+
+    // The `definitelyExits` fold: `if (true) { X }` definitely exits iff X does, so the trailing
+    // throw is cut rather than read. Without the fold the throw still walks and mints `throws`.
+    it("cuts a dead trailing statement after an if true that exits", () => {
+      const evidence = clauseEvidence("if (true) { return null; }\nthrow e;");
+      expect(evidence.throws).toBe(false);
+    });
+  });
+
   // S1. The other end of the same problem. `reachableStatements` used to cut the statement list
   // only on a BARE `return`/`throw`, while the walk descended into blocks and `do` bodies, so a
   // `throw e;` written after a nested construct that had already returned was still read as the