hasStructuralKeyword: STRUCTURAL_STEMS_RE has no right-side boundary, false-fires on ordinary words (callus, Connecticut, affectionate, Tracey)

[inth3shadows]

Summary

Four of the English stems in the multilingual structural-question gate (#1134) — call, trace,
affect, connect — match as unbounded prefixes, so ordinary non-technical English words that merely
start with one of these stems false-fire the gate's HIGH-tier (full-explore) branch.

Root cause

// src/directory.ts:405-406
const STRUCTURAL_STEMS_RE = new RegExp(`${NOT_WORD_BEFORE}(?:${STRUCTURAL_STEMS.join('|')})`, 'iu');

STRUCTURAL_STEMS_RE enforces a LEFT boundary only (by design — see the docstring at
src/directory.ts:312-320 — so "architect" matches "architecture"). Most stems in the list only ever
complete into structural words, so the open right side is safe for them. But call, trace,
affect, connect have common English completions that aren't structural at all: callus,
calligraphy, callous, Connecticut, connective (tissue), affectionate, Tracey. The file's own review
rule for this list ("Add a stem only when every plausible completion is still a structural word",
src/directory.ts:318) doesn't hold for these four.

Repro (verified by direct execution against the built regex, node 22, node:sqlite backend)

import { hasStructuralKeyword } from './src/directory';

hasStructuralKeyword('he has a callus');            // true — should be false
hasStructuralKeyword('Connecticut is a state');      // true — should be false
hasStructuralKeyword('she is very affectionate');    // true — should be false
hasStructuralKeyword('Tracey went home early');       // true — should be false

I have NOT run the full codegraph prompt-hook CLI end-to-end on these strings — the above is a
direct unit-level call. keyworded = hasStructuralKeyword(prompt) at src/bin/codegraph.ts:1094 does
feed straight into the HIGH-tier branch (confirmed by reading that call site), which runs
codegraph_explore and writes a <codegraph_context> block — PR #1134's own reported payload sizes
put HIGH-tier injections around 16KB on this repo for other prompts, so I'd expect a comparable cost
here, though I haven't measured it for these exact strings.

No existing test catches this — __tests__/frontload-hook.test.ts's mid-word guards
("restructure this paragraph", "an independent module", lines 230-231) only exercise the LEFT
boundary.

Impact

Any structural-question prompt containing one of these four stems as a false-positive substring
gets the same unnecessary explore-and-inject cost the STRUCTURAL_WORDS exact-match class exists to
avoid (per its own docstring: "short or ambiguous tokens where prefix matching would
false-positive"). "call" in particular is a common enough substring that this seems likely to fire
in normal use, though I don't have production telemetry to say how often.

Suggested fix

Bound the four risky stems to their known derivational suffixes, matching the suffix-enumeration
pattern STRUCTURAL_WORDS already uses elsewhere in this same file (e.g. reach(?:es|ed)?):

`call(?:s|ing|ed|ers?)?${NOT_WORD_AFTER}`
`trace(?:s|d|rs?)?${NOT_WORD_AFTER}`
`affect(?:s|ed|ing)?${NOT_WORD_AFTER}`
`connect(?:s|ed|ing|ions?|ors?)?${NOT_WORD_AFTER}`

Verified by direct execution: calls/calling/called/caller(s), traces/traced/tracer(s),
affects/affected/affecting, connects/connected/connecting/connection(s)/connector(s) all still
match; callus/calligraphy/callous/Connecticut/connective/affectionate/Tracey no longer do. All 31
existing tests in frontload-hook.test.ts still pass with this change. The other 6 English stems
(architect, structur, depend, implement, impact, explain) didn't turn up demonstrable non-technical
collisions in my check, so I'd leave those as open prefixes rather than touch what isn't
demonstrated broken.

Verification / scope

• Checked all 29 currently-open PRs' changed-file lists for src/directory.ts — 3 touch it (fix(mcp): dedupe one repo's two path spellings onto one DB connection (#1057) #1082,
  feat(directory): allow local-only codegraph gitignore #1013), none touch this line range (STRUCTURAL_STEMS / STRUCTURAL_STEMS_RE, lines 312-406).
• Checked open + closed issues for "structural keyword stem", "prompt hook false positive" and
  related terms — only prompt-hook gate regex skips non-English (Chinese) prompts — UserPromptSubmit never injects context #994/prompt-hook gate still skips non-English Latin-script prompts (French) â�� follow-up to #994/#1004 #1126 (the issues fix(prompt-hook): make the structural-question gate multilingual (#1126) #1134 itself fixed) came up; nothing about this
  specific boundary gap.
• Full test suite green on this change locally; not yet posted as a PR.

Environment

Found on main (tip e699ee9, v1.2.0). Not yet in a tagged release (still origin/main as of
2026-07-02).

---

Happy to send a PR for the fix (I already have it written and tested locally), or just leave this
filed if you'd rather pick it up yourself. Let me know which you'd prefer.

[colbymchenry]

Confirmed and fixed in #1147 — thanks for another precise report, and for the offer to send the PR. I ended up folding it into a batch fixing your whole set of reports (#1138–#1146) in one pass, so I took this one myself rather than leave you waiting on a review — the fix is essentially yours, with one deliberate delta worth flagging:

The suffix sets are a superset of the ones proposed here. The open call prefix was previously (accidentally) covering callback/callbacks/callable/callsites, which are genuinely structural ("what callbacks fire on save") and aren't in STRUCTURAL_WORDS — so the proposed call(?:s|ing|ed|ers?)? would have silently regressed them. Shipped as call(?:s|ing|ed|ers?|backs?|able|sites?)?, plus connectivity on the connect stem. Your instinct on trace was right for a subtler reason: "tracing" drops the e, so it never matched the trace prefix at all — it's already covered as an exact word.

Also verified your repro independently before changing anything (all four false-fired against the built dist), and left the other six stems open as you suggested — no demonstrated collisions, no speculative bounding.

All four false-positive words now reject, eleven derived structural forms pin as still firing. This is in the unreleased #1134 gate, so it ships with the next release — no released version ever had the bug.