measure: the candidate generator must be the IR, not the ruleset

A candidate-driven detector can only judge sites something else enumerates,
so the enumerator caps recall. Measured over the 58 scorable web pairs before
building anything:

  pattern ruleset:  12.1% ceiling -- and the misses are not near-misses, the
                    ruleset finds nothing at all in most of these files
  semantic IR:      96.6% ceiling, a median of ten call sites and bindings
                    inside the labeled function

The ruleset would have capped us at 12.1% against the 64.9% the unconstrained
loop already reaches. That design was one commit from being built.

Two corpus defects found on the way, both mine from task 4.1. The overleaf
excerpt started mid-import, because `_declarator_start` walks back to the
nearest `}` and Overleaf writes JavaScript without semicolons, so the nearest
one was inside `import { expressify }`. It then ended mid-object-literal,
because registration mentions were appended as bare lines. Neither parsed,
and a pair that cannot be parsed cannot be scored. Registration mentions now
expand to the statement that contains them; the ceiling moved 94.8% -> 96.6%.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/pairs/agent-vfc/lensops-kubernetesmanagement-fe4910/fixed.tsx

@@ -64,8 +64,27 @@
     }
   }
 
-await loadNamespaces(true)
-await loadNamespaces(true)
-loadNamespaces(true)
-loadNamespaces(true) // Skip connection check since we're auto-connecting
-loadNamespaces(true);
+        try {
+          await loadNamespaces(true)
+          await loadData()
+        } catch (err) {
+          console.error('Error loading namespaces:', err)
+        }
+        try {
+          await loadNamespaces(true)
+          // Always load data after namespaces are loaded (defaults to 'all' to show all resources)
+          await loadData()
+        } catch (err) {
+          console.error('Error loading namespaces after connection:', err)
+          setErrorMessage('✅ Connected, but failed to load namespaces. Click "Load Namespaces" to retry.')
+        }
+      if (apiUrl && !deployedNamespace) {
+        loadNamespaces(true)
+      }
+    if (apiUrl && !isConnected && !isConnecting) {
+      console.log('🚀 Auto-connecting to Kubernetes cluster via ServiceAccount...')
+      loadNamespaces(true) // Skip connection check since we're auto-connecting
+    }
+    if (apiUrl && !isConnected) {
+      loadNamespaces(true);
+    }

benchmarks/pairs/agent-vfc/lensops-kubernetesmanagement-fe4910/vuln.tsx

@@ -62,8 +62,27 @@
     }
   }
 
-await loadNamespaces(true)
-await loadNamespaces(true)
-loadNamespaces(true)
-loadNamespaces(true) // Skip connection check since we're auto-connecting
-loadNamespaces(true);
+        try {
+          await loadNamespaces(true)
+          await loadData()
+        } catch (err) {
+          console.error('Error loading namespaces:', err)
+        }
+        try {
+          await loadNamespaces(true)
+          // Always load data after namespaces are loaded (defaults to 'all' to show all resources)
+          await loadData()
+        } catch (err) {
+          console.error('Error loading namespaces after connection:', err)
+          setErrorMessage('✅ Connected, but failed to load namespaces. Click "Load Namespaces" to retry.')
+        }
+      if (apiUrl && !deployedNamespace) {
+        loadNamespaces(true)
+      }
+    if (apiUrl && !isConnected && !isConnecting) {
+      console.log('🚀 Auto-connecting to Kubernetes cluster via ServiceAccount...')
+      loadNamespaces(true) // Skip connection check since we're auto-connecting
+    }
+    if (apiUrl && !isConnected) {
+      loadNamespaces(true);
+    }