measure: the candidate generator must be the IR, not the ruleset

A candidate-driven detector can only judge sites something else enumerates,
so the enumerator caps recall. Measured over the 58 scorable web pairs before
building anything:

  pattern ruleset:  12.1% ceiling -- and the misses are not near-misses, the
                    ruleset finds nothing at all in most of these files
  semantic IR:      96.6% ceiling, a median of ten call sites and bindings
                    inside the labeled function

The ruleset would have capped us at 12.1% against the 64.9% the unconstrained
loop already reaches. That design was one commit from being built.

Two corpus defects found on the way, both mine from task 4.1. The overleaf
excerpt started mid-import, because `_declarator_start` walks back to the
nearest `}` and Overleaf writes JavaScript without semicolons, so the nearest
one was inside `import { expressify }`. It then ended mid-object-literal,
because registration mentions were appended as bare lines. Neither parsed,
and a pair that cannot be parsed cannot be scored. Registration mentions now
expand to the statement that contains them; the ceiling moved 94.8% -> 96.6%.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/pairs/agent-vfc/lensops-kubernetesmanagement-fe4910/fixed.tsx

@@ -64,8 +64,27 @@
     }
   }
 
-await loadNamespaces(true)
-await loadNamespaces(true)
-loadNamespaces(true)
-loadNamespaces(true) // Skip connection check since we're auto-connecting
-loadNamespaces(true);
+        try {
+          await loadNamespaces(true)
+          await loadData()
+        } catch (err) {
+          console.error('Error loading namespaces:', err)
+        }
+        try {
+          await loadNamespaces(true)
+          // Always load data after namespaces are loaded (defaults to 'all' to show all resources)
+          await loadData()
+        } catch (err) {
+          console.error('Error loading namespaces after connection:', err)
+          setErrorMessage('✅ Connected, but failed to load namespaces. Click "Load Namespaces" to retry.')
+        }
+      if (apiUrl && !deployedNamespace) {
+        loadNamespaces(true)
+      }
+    if (apiUrl && !isConnected && !isConnecting) {
+      console.log('🚀 Auto-connecting to Kubernetes cluster via ServiceAccount...')
+      loadNamespaces(true) // Skip connection check since we're auto-connecting
+    }
+    if (apiUrl && !isConnected) {
+      loadNamespaces(true);
+    }

benchmarks/pairs/agent-vfc/lensops-kubernetesmanagement-fe4910/vuln.tsx

@@ -62,8 +62,27 @@
     }
   }
 
-await loadNamespaces(true)
-await loadNamespaces(true)
-loadNamespaces(true)
-loadNamespaces(true) // Skip connection check since we're auto-connecting
-loadNamespaces(true);
+        try {
+          await loadNamespaces(true)
+          await loadData()
+        } catch (err) {
+          console.error('Error loading namespaces:', err)
+        }
+        try {
+          await loadNamespaces(true)
+          // Always load data after namespaces are loaded (defaults to 'all' to show all resources)
+          await loadData()
+        } catch (err) {
+          console.error('Error loading namespaces after connection:', err)
+          setErrorMessage('✅ Connected, but failed to load namespaces. Click "Load Namespaces" to retry.')
+        }
+      if (apiUrl && !deployedNamespace) {
+        loadNamespaces(true)
+      }
+    if (apiUrl && !isConnected && !isConnecting) {
+      console.log('🚀 Auto-connecting to Kubernetes cluster via ServiceAccount...')
+      loadNamespaces(true) // Skip connection check since we're auto-connecting
+    }
+    if (apiUrl && !isConnected) {
+      loadNamespaces(true);
+    }

benchmarks/pairs/agent-vfc/overleaf-with-claude-exportscontroller-3980b9/fixed.mjs

@@ -9,13 +9,7 @@
 // relpath: services/web/app/src/Features/Exports/ExportsController.mjs
 // provenance: agent
 // mechanism: identity_from_request_body
-// upstream_start: 1
-
-from '@overleaf/promise-utils'
-import SessionManager from '../Authentication/SessionManager.mjs'
-import logger from '@overleaf/logger'
-import OError from '@overleaf/o-error'
-import settings from '@overleaf/settings'
+// upstream_start: 8
 
 async function exportProject(req, res, next) {
   const { project_id: projectId, brand_variation_id: brandVariationId } =
@@ -82,4 +76,8 @@ async function exportProject(req, res, next) {
   }
 }
 
-exportProject: expressify(exportProject),
+export default {
+  exportDownload: expressify(exportDownload),
+  exportProject: expressify(exportProject),
+  exportStatus: expressify(exportStatus),
+}

benchmarks/pairs/agent-vfc/overleaf-with-claude-exportscontroller-3980b9/vuln.mjs

@@ -9,12 +9,7 @@
 // relpath: services/web/app/src/Features/Exports/ExportsController.mjs
 // provenance: agent
 // mechanism: identity_from_request_body
-// upstream_start: 1
-
-from '@overleaf/promise-utils'
-import SessionManager from '../Authentication/SessionManager.mjs'
-import logger from '@overleaf/logger'
-import OError from '@overleaf/o-error'
+// upstream_start: 7
 
 async function exportProject(req, res, next) {
   const { project_id: projectId, brand_variation_id: brandVariationId } =
@@ -80,4 +75,8 @@ async function exportProject(req, res, next) {
   }
 }
 
-exportProject: expressify(exportProject),
+export default {
+  exportDownload: expressify(exportDownload),
+  exportProject: expressify(exportProject),
+  exportStatus: expressify(exportStatus),
+}