fix(observability-map): block the refused-swallow accusation on any own deciding catch that may raise

Arm c was ordered off reachable, own catches filtered by guardCanRaise,
so a route owning a real classifying catch that canRaise cannot see (a
destructuring guard) beside a per-item .map swallow was told nothing it
owns decides. canRaise is a whitelist and cannot carry that decision;
the new guardMayRaise is its containment twin, false only for the
provably inert try { 0; }, so the dead classifier dead-classifying-try
prepends still blocks nothing while the real catch does. The pin that
was meant to hold this asserted the absence of a detail string no arm
ever emits; it now asserts the verdict.

Author: 1stvamp

internal-packages/observability-map/src/checks/errorClassification.ts

@@ -172,11 +172,16 @@ export function usesBuilder(ep: EntryPoint): boolean {
  * throwing one needs types the scanner does not have. `dead-classifying-try-with-call` in the
  * mutation corpus is the open shape, running as an expected failure.
  *
- * The filter also has to run BEFORE nothing. Ordering the callback branch off `reachable` rather
- * than `ep.catches` accused a route that owns a real classifying catch of owning none, whenever
- * `canRaise` missed what that catch guarded: a destructuring declaration is not on its list, so
- * `try { const { a } = undefined; } catch (e) { ... }` beside a per-item `.map` catch failed with
- * "its only error handling sits in a callback the route does not own", which was simply untrue.
+ * The refused-swallow arm reads the route's own deciding catches through `guardMayRaise`, never
+ * through `guardCanRaise`. `canRaise` is a whitelist and misses real raising code (a destructuring
+ * declaration is not on its list, and `const { a } = undefined` throws), so ordering the arm off
+ * `reachable` accused a route that owns a real classifying catch of owning none, which was simply
+ * untrue; `does not accuse a route that owns a catch of owning none` pins the verdict. The
+ * containment read `guardMayRaise` is false only for the provably-inert `try { 0; }`, so the one
+ * clause that must not block the accusation, the prepended dead classifier `dead-classifying-try`
+ * refuses, still does not block it (`still fails a per-item swallow beside a deciding catch over a
+ * dead guard`). The already-open residual is unchanged: `try { String(0); }` reads as may-raise
+ * AND can-raise, which is `dead-classifying-try-with-call`, the corpus's expected failure.
  */
 export const errorClassification = {
   id: ID,
@@ -209,8 +214,12 @@ export const errorClassification = {
     // `wrap-body-in-rethrow` adds to every route, must not lift a refused swallow out of the
     // verdict, or wrapping a per-item-swallow route in try/rethrow reads "every catch rethrows".
     // `fails a per-item swallow even when the route owns an inert rethrow catch` pins that.
+    // "Nothing the route owns decides" is read off `ep.catches` under `guardMayRaise`, not off
+    // `reachable`: a deciding catch `canRaise` cannot see still decides, and only the
+    // provably-inert `try { 0; }` guard is excluded. See the `guardMayRaise` paragraph above.
     const reachableCb = ep.callbackCatches.filter((c) => c.guardCanRaise);
-    if (!reachable.some(decides) && reachableCb.some(swallows)) {
+    const ownDecides = ep.catches.some((c) => decides(c) && c.guardMayRaise);
+    if (!ownDecides && reachableCb.some(swallows)) {
       return {
         id: ID,
         status: "fail",

internal-packages/observability-map/src/checks/index.test.ts

@@ -743,8 +743,11 @@ describe("error-classification", () => {
 
   // I4. A route that owns a real classifying catch must never be told it owns none. `canRaise` does
   // not list destructuring, and `const { a } = undefined` throws, so the owned catch dropped out of
-  // `reachable`; with the callback branch ordered off `reachable` the route was then accused of
-  // having all its error handling in a callback, which was simply false.
+  // `reachable`; with the refused-swallow arm ordered off `reachable` the route was then accused of
+  // owning nothing that decides, which was simply false. The arm now reads own deciding catches
+  // through `guardMayRaise`, so the accusation is withheld and the route sits out exactly as it did
+  // before the arm existed. Asserted on `status`: an earlier version of this test asserted the
+  // absence of a detail string no arm ever emits, which could not fail.
   it("does not accuse a route that owns a catch of owning none", () => {
     const r = run(
       "error-classification",
@@ -764,7 +767,79 @@ describe("error-classification", () => {
          return json({ ok: true });
        }`
     );
-    expect(r.detail).not.toContain("callback the route does not own");
+    expect(r.status).toBe("not-applicable");
+    expect(r.detail).toContain("guards nothing that can throw");
+  });
+
+  // I4 sibling: the same shape through `.filter` and a different `canRaise` miss (a plain
+  // declaration is not on the whitelist either), so the fix is the rule and not the fixture.
+  it("does not accuse a route whose deciding catch guards a declaration beside a filter swallow", () => {
+    const r = run(
+      "error-classification",
+      "owned-filter.ts",
+      `import { prisma } from "~/db.server";
+       export async function action({ request }) {
+         const items = await prisma.item.findMany();
+         const kept = items.filter((item) => {
+           try { return check(item); } catch { return false; }
+         });
+         try { const parsed = { ...raw }; } catch (e) {
+           if (e instanceof TypeError) { return new Response(null, { status: 400 }); }
+           throw e;
+         }
+         return json({ kept });
+       }`
+    );
+    expect(r.status).toBe("not-applicable");
+  });
+
+  // The blocking catch has to DECIDE: an own inert rethrow catch over the same invisible guard
+  // still leaves the refused swallow in the verdict, or `wrap-body-in-rethrow` spelled with a
+  // destructuring guard would lift every per-item swallow out of it.
+  it("still fails a per-item swallow beside an inert catch over an invisible guard", () => {
+    const r = run(
+      "error-classification",
+      "owned-inert.ts",
+      `import { prisma } from "~/db.server";
+       export async function action({ request }) {
+         const items = await prisma.item.findMany();
+         await Promise.all(
+           items.map(async (item) => {
+             try { await processItem(item); } catch { return null; }
+           })
+         );
+         try { const { a } = undefined; } catch (e) { throw e; }
+         return json({ ok: true });
+       }`
+    );
+    expect(r.status).toBe("fail");
+    expect(r.detail).toContain("nothing the route owns decides");
+  });
+
+  // And the blocking catch has to guard something that MAY raise: the provably-inert `try { 0; }`
+  // clause `dead-classifying-try` prepends decides and must still block nothing, or the prepend
+  // would lift a refused-swallow fail to not-applicable at tree scale.
+  it("still fails a per-item swallow beside a deciding catch over a dead guard", () => {
+    const r = run(
+      "error-classification",
+      "owned-dead.ts",
+      `import { prisma } from "~/db.server";
+       export async function action({ request }) {
+         const items = await prisma.item.findMany();
+         await Promise.all(
+           items.map(async (item) => {
+             try { await processItem(item); } catch { return null; }
+           })
+         );
+         try { 0; } catch (e) {
+           if (e instanceof Error) { return new Response(null, { status: 400 }); }
+           throw e;
+         }
+         return json({ ok: true });
+       }`
+    );
+    expect(r.status).toBe("fail");
+    expect(r.detail).toContain("nothing the route owns decides");
   });
 
   // C2. A single-element array cannot iterate, so `[0].map(async () => { whole body })` is not a

internal-packages/observability-map/src/scan.test.ts

@@ -1752,6 +1752,7 @@ describe("scanFile: per-catch evidence", () => {
       guardsParse: true,
       awaitsOnlyParse: true,
       guardCanRaise: true,
+      guardMayRaise: true,
       tryStatementCount: 1,
     });
     expect(ep!.catches[1]).toMatchObject({
@@ -1856,6 +1857,7 @@ describe("scanFile: per-catch evidence", () => {
       guardsParse: false,
       awaitsOnlyParse: false,
       guardCanRaise: true,
+      guardMayRaise: true,
       tryStatementCount: 4,
     });
   });

internal-packages/observability-map/src/scan.ts

@@ -1641,6 +1641,7 @@ export function scanFile(fileName: string, source: string): EntryPoint | null {
             throws: clause.throws,
             branches: clause.branches,
             ...guardedWork(node.tryBlock),
+            guardMayRaise: tryBlockMayThrow(node.tryBlock),
             tryStatementCount,
           });
         }

internal-packages/observability-map/src/types.ts

@@ -53,6 +53,18 @@ export type CatchEvidence = {
    * declaration it misses.
    */
   guardCanRaise: boolean;
+  /**
+   * The containment twin of `guardCanRaise`: false only when the guarded region provably cannot
+   * raise, i.e. every statement is an expression over a bare literal, which is `try { 0; }` and
+   * nothing else. Everything `canRaise`'s whitelist misses (a destructuring declaration, a
+   * temporal-dead-zone read) stays true here, so `guardCanRaise` implies `guardMayRaise`. What the
+   * refused-callback arm of `error-classification` reads: a route whose own classifying catch
+   * `canRaise` cannot see must never be told nothing it owns decides
+   * (`does not accuse a route that owns a catch of owning none`), while the provably dead
+   * `try { 0; }` clause still blocks nothing (`still fails a per-item swallow beside a deciding
+   * catch over a dead guard`).
+   */
+  guardMayRaise: boolean;
   /**
    * Everything the guarded region waits for is one of those parses. What separates
    * `try { const body = await request.json(); } catch { 400 }` from