[tabladrum]

Fixes all 53 findings of the 2026-10-10 parsing audit: places where grove read comments, docstrings or string literals as code. Many reached stored edges at 0.94–0.98 confidence. It also fixes further bugs that a new metamorphic check found on real repos. This supersedes #13, whose commit is included. It depends on provasign/astkit#4, pinned here as a pseudo-version.

Root causes and fixes

• Seven hand-written blankers → astkit textmask.
  • The old graph blanker took 'single quoted' text for a Rust lifetime in every language, which gave wrong Python/JS/PHP call targets. It also took every # for a comment and treated \ in a Go raw string as an escape.
  • The native blanker masked strings but kept comments, which gave uses-type and extends edges from comments at native confidence.
  • The parser, graph and native layers now all mask through textmask.
• Field and attribute maps came from a regex over the whole class text. That read other methods' locals, comments and docstrings, including numpy Attributes sections. Maps now come from indexed field symbols and class-body depth-1 masked text.
  • Java lambdas now take their enclosing method's locals by span. They used to get them only through this leak.
• Signatures and declaration headers are parsed on masked text. This fixes Kotlin and Python bases, C# attribute strings, and Java // extends Base on the header line. Python base lists are read across lines.
• strings.Contains on source → AST or masked facts:
  • Python abstract methods (NotImplementedError in a docstring).
  • export default.
  • declaresLocalFunction.
  • Rust inline crate paths.
• Parser recovery path:
  • It matches and counts braces on masked text, including Go, text blocks, raw strings, heredocs and JSX text.
  • #if 0 is masked.
  • Docstrings never cross code lines.
  • C/C++ phantoms from raw strings and #define bodies are gone.
  • C#/Java call statements (new JArray(...)) are no longer methods.
  • Broken C-family files are parsed from code alone, so comments cannot move error recovery.
• Rename plan masks the whole body (fixes PHP #[Attr], JS #field, interpolation) and COBOL rename. COBOL field reads and writes are classified per statement.
• Fixes the decoy invariant found on real repos:
  • Import paths with comments (Rust use {} groups).
  • Rust test roots that all registered under the crate name tests; the winner changed with map order.
  • Anonymous classes resolved by name across files.
  • Java annotation skipping.

Tests

• internal/invariance: a twin test, a clean repo vs a decoy twin, for every audit ID, run with native analyzers off and on. Plus pkg/grove tool tests (missing-implementations, rename-plan, change-impact) and parser recovery tests.
• go test ./... passes.
• The decoy invariant (research harness/scoring/decoy_invariant.py with astkit cmd/decoy) holds on 23 real repos across all languages.
  • The current release fails it on 7 of 8 sampled repos. On newtonsoft, comments alone move the edge count from 85k to 105k.
• I reviewed the full-corpus graph diff against the release by sampling removed and added edges in each edge class. Details are in the session notes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KXa6Cv1ZUXcdMqXcJfQFhX