# Part B measured — workspace + barrel resolution coverage (#40 / #36b)

audience: AI coding agents first. Optimize for activation, not prose.

**BLUF: Part B delivered + measured on the real zync tree. `@zync/*` first-party resolution went 0/958 →
945/958 (98.6%).** The 13-import residual is a SINGLE specifier (`@zync/db/schema`) served by tsconfig
`paths`, the explicitly-deferred D4 case — not a silent gap. The barrel-wrapped S1 cell resolves the
builder body THROUGH the indirection (dry-run), and the #42 oracle-reach is wiring-PROVEN (Task 5 test).
**This is COVERAGE (an enabler), NOT a recall result** — see the value-chain statement below.

## Headline: `@zync/*` value-import resolution, BEFORE (no aliases) vs AFTER (workspace aliases)

Measured: load `gate.py` by path; `build_workspace_aliases(zync.is)`; for every tracked `.ts` under
`apps/`, count `@zync/*` import specifiers resolving to a real file via `resolve()`. BEFORE = `aliases=[]`
(today's behavior — no `@zync/*` alias existed → every first-party workspace import resolved to None).

```
                          AFTER    BEFORE
  @zync/admin-analytics   5/5      0/5
  @zync/ai                12/12    0/12
  @zync/api-usage         2/2      0/2
  @zync/auth              111/111  0/111
  @zync/calendar          19/19    0/19
  @zync/config            2/2      0/2
  @zync/db                435/448  0/448     <- 13 unresolved, ALL `@zync/db/schema` (see below)
  @zync/expenses          11/11    0/11
  @zync/integrations      1/1      0/1
  @zync/modules           8/8      0/8
  @zync/notifications     25/25    0/25
  @zync/payments          5/5      0/5
  @zync/public-api        9/9      0/9
  @zync/realtime          10/10    0/10
  @zync/storage           1/1      0/1
  @zync/time              3/3      0/3
  @zync/types             256/256  0/256
  @zync/ui                25/25    0/25
  @zync/utils             5/5      0/5
  TOTAL                   945/958  0/958
```

`build_workspace_aliases` discovered 18 `@zync/*` package roots + subpath exports (e.g. `@zync/db/queries`,
`@zync/types/enums`, `@zync/realtime/server`) from `pnpm-workspace.yaml` globs + each `package.json`
`exports`/`main`. dist-pointing exports remap to the `src/` twin; subpath (longer) specifiers sort first so
`resolve()`'s exact match picks the most specific.

### The 13-import residual is the D4 deferral, not a gap (no-silent-gap)

All 13 unresolved `@zync/db` imports are the SAME specifier `@zync/db/schema`. The `@zync/db` `exports` map
declares `.`, `./queries`, `./schema/contracts`, `./serialize`, … but NOT a bare `./schema`. The deep import
`@zync/db/schema` resolves in the real build via tsconfig `paths` (`"@zync/db/*": ["../db/src/*"]` →
`packages/db/src/schema/index.ts`, which exists). `build_workspace_aliases` reads `package.json` `exports`,
NOT tsconfig `paths` — so `@zync/db/schema` degrades to None. This is exactly **D4 (tsconfig paths
non-package aliases), REJECTED/deferred in the spec NOT-covered section**: measured-rare (1 specifier on the
one tree in evidence), degrades to None with no regression. Documented no-op until a measured repo needs it.

## Barrel cell — resolution proof (NOT a recall claim)

`domains/security/corpus/S1-barrel-2fa-on-refresh/` = the real S1 canonical (`buildSessionPayload` defaults
`enforce_2fa: args.enforce2fa ?? false`; the refresh caller omits `enforce2fa` → 2FA dropped on every
refresh) with ONE barrel layer added: `vuln.ts` imports from `./barrel`, which re-exports from
`./imported-builder`. Ground-truthed from `ead618d~1` (RAW git): the pre-fix builder
`packages/auth/src/session.ts:61` has the `?? false` default; the pre-fix caller
`apps/zync-api/src/routes/auth/refresh.ts:79` omits it. ead618d fixed the CALLER (added `session-two-factor`
helper + passed `enforce2fa` through), never the builder — matching the cell's shape exactly.

`gate.py vuln.ts --dry-run --no-workspace-alias` →

```
[target] .../S1-barrel-2fa-on-refresh/vuln.ts
[dep]     .../S1-barrel-2fa-on-refresh/imported-builder.ts — import `buildSessionPayload` from vuln.ts
```

The dep is `imported-builder.ts`, NOT `barrel.ts` — `resolve_through_barrel` followed the transparent
re-export to the def file. The builder body (carrying the insecure default) reaches the review bundle; the
barrel indirection is gone. Without barrel-following this dep would be `barrel.ts` (a re-export line, no
builder body) = a SILENT FALSE-CLEAN of the same canonical the flat `S1-xfile` cell catches 3/3.

## Real-file barrel-follow proof (closes the synthetic-only gap)

Every `resolve_through_barrel` unit test + the barrel cell run on SYNTHETIC trees (hand-built barrels
matching the function). That is confirmation-shaped: the function was never exercised on a real `@zync/*`
barrel (`export *` chains, sub-barrels, mixed named+star). And the 945/958 number calls `resolve()`
DIRECTLY — `resolve()` stops at the package `exports` entry (the barrel `index.ts`); it does NOT follow
barrels. So neither check proved barrel-following on real code.

Closed deterministically: `gate.py apps/zync-api/src/routes/auth/refresh.ts --dry-run` (workspace aliases
ON) on the REAL S1 source. `refresh.ts` imports `buildSessionPayload` from `@zync/auth`.

```
[target] apps/zync-api/src/routes/auth/refresh.ts
[dep]    packages/auth/src/session.ts — import `buildSessionPayload` from refresh.ts   <- DEF, barrel followed
[dep]    packages/auth/src/sessions.ts — import `blocklistToken`
[dep]    packages/auth/src/tokens.ts — import `generateOpaqueToken`
[dep]    packages/auth/src/jwt.ts — import `signSession`
[dep]    packages/db/src/queries/auth-reads.ts — import `countActiveRefreshTokens`
... (13 deps total, all resolved to def files through real @zync/auth + @zync/db/queries barrels)
```

Discriminator (advisor-set): `buildSessionPayload` resolves to `packages/auth/src/session.ts` (the def —
barrel `@zync/auth/src/index.ts` re-exports it from `./session`), NOT `packages/auth/src/index.ts` (barrel
not followed) and not absent. PASSED. `session.ts:61` is the def carrying `enforce_2fa: args.enforce2fa ??
false` (ground-truthed `ead618d~1`). No `[barrel] hop cap` warning fired on real topology; 13 deps inlined,
under the `--max-scope 60` cap (the real post-B1 bundle, observed — before B1 this route inlined ~0 deps).
The synthetic tests are now backed by the real-barrel end-to-end run on the exact canonical.

## #42 hard gate — oracle reaches the barrel-resolved def (wiring-PROVEN, not assumed)

`tests/test_gate.py::test_bundle_and_oracle_set_reach_barrel_resolved_def` (deterministic, no bun/no LLM):
through a real pnpm workspace + barrel, `collect_deps` reaches the def file (not the barrel); `build_bundle`
contains the DEF BODY (`DEF_BODY_MARKER`, `enforce_2fa: a.enforce2fa ?? false`), not the re-export line; and
the file list `[target] + dep_files` that `main()` hands to `run_oracle_set` CONTAINS the resolved def file.
The #42 lesson — relocating WHERE one leg reads can silently shrink ANOTHER leg's reach — is closed by PROOF:
resolution flows to BOTH the LLM bundle and the oracle file list. Full suite: 24 passed.

## Value chain (read this before citing any number above)

Resolution coverage is the ENABLER, NOT a catch. The chain is explicit:
`coverage ↑ → oracle/LLM reaches more first-party sinks → catches`. The catch evidence is the DOWNSTREAM
#24 recall sweep, never this coverage delta. Do NOT present 0→945 as a recall result. The barrel cell proves
the known S1 catch's INPUT survives barrel indirection (the def body reaches the bundle); it is a
resolution/plumbing proof, not a new recall win (Shape-B scarcity n=1/85 — building a synthetic for a recall
claim is forbidden).

## Honest scope

- The 945/958 counts `@zync/*` import SPECIFIERS resolvable by `resolve()` (value + type lines alike). The
  gate INLINES only the value-import subset (`first_party_value_imports` skips `import type`), so fewer
  bodies are bundled than 945 — the number is specifier-resolution reach, the precondition for inlining, not
  an inlined-body count. The 0→ delta (nothing resolved before) is the load-bearing fact.
- Deferred, logged-not-silent: tsconfig `paths` non-package aliases (D4 — the `@zync/db/schema` residual);
  2-hop+ barrels beyond the 3-hop cap (`resolve_through_barrel` logs to stderr on cap hit); npm/yarn
  `workspaces` (read best-effort, only pnpm MEASURED).

## The measurement this phase OPENS

Cross-file PRECISION at n≥3. More resolved imports = more inlined bodies = more surface for
paraphrased-duplicate findings. The precision guard is `#17a semantic_merge` (already wired); the broad
precision sweep is its own follow, not closed here.