---
name: a-widening-that-fixes-an-undercount-can-introduce-an-overcount
description: "The 4-line lookback that fixed the emission census's multi-line under-count also mis-attributed a format! inside a map_err as an emission — one phantom in 487, found only because a downstream tool REFUSED instead of guessing."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: 43af483b-6d22-46cb-9d99-8b7713a6ff46
  modified: 2026-08-29T08:49:25.107Z
---

**A predicate widened to stop missing things starts catching things that are not there, and the
second error is invisible in exactly the way the first one was.** Measured 2026-08-29 on the
v0.65.0 emission census.

The census matches a `TOKEN:`-shaped literal, then scans **up to 4 lines back** for the macro that
emits it — a widening added because a line-based scan missed every multi-line `eprintln!`
(286 → 412 → 487 sites). That same window reached across a call boundary once:
`sealverb.rs:456` is `format!("SEAL_SEND_NO_DAEMON: …")` inside a `map_err`, three lines below an
unrelated `eprintln!`. The census counted it as an emission of that macro. **The TOKEN-colon
population is 486, not 487**, and every figure I had reported carrying 487 was high by one.

**How it surfaced, which is the reusable part:** not by re-reading the census. The CONVERTER built
on top of it hit the row, could not place the macro token (the real one had already been converted
under the neighbouring row), and **refused mid-run rather than editing a line it could not place**.
A tool that guesses would have made a silent wrong edit and left the count wrong forever.

**Then the census-discipline move:** having tripped over one, do NOT patch that one — re-check the
whole population with a predicate that cannot make the same class of error. Balanced-paren
CONTAINMENT (is the literal inside the macro call's span?) over all 487 rows returned **exactly
one**. Reporting "I found a phantom and fixed it" would have left the population unmeasured.

**How to apply:**
- When you widen a matcher to fix a miss, ask immediately what the widening can now over-match, and
  measure that — the widening's cost is never announced.
- Give downstream tools the power to REFUSE. A converter, migrator, or fixer that cannot say "I
  cannot place this" is an instrument that converts census defects into source defects.
- A containment check (does the thing live inside the span it is attributed to?) outranks a
  proximity check (is it near the thing?) whenever the two disagree.

Related: [[instrument-soundness-guards]] guard 8 (validate a rebuilt instrument against its sealed
output) · [[a-predicate-without-its-tool-is-not-evidence]] · [[dont-take-a-diagnosis-as-measured]].