scheme globals: indentation doesn't track scope — the rule is 42.7% precise, and the #2651 col-0 anchor trades 67 false positives for 32 real globals

[squid-protocol]

Split out of the #2660 audit (Batch B.2 of #2669). #2660 listed scheme as a candidate for the #2651 ^[ \t]* → ^(?![ \t]) anchor change. There is a real defect — a bad one — but the anchor is the wrong instrument, and the measurement below is the reason. Filing separately so #2660 can close on go alone.

Current rule

"globals": re.compile(r"^[ \t]*\([ \t]*define\s+[a-zA-Z0-9_!?*+/<>=.~$%^&:-]+\s+[^(\s]")

In Scheme, indentation does not track scope — the enclosing form does. Two constructs are indented identically and mean opposite things:

(define (f x)
  (define y 5)        ; internal define -> a LOCAL binding. False positive.
  y)

(let ()               ; whole-file module wrapper (a standard Chez/R6RS idiom)
  (define track-counts #f)   ; module-level binding -> a REAL global, and it is indented.
  ...)

Measurement

I wrote a paren-depth classifier (skipping strings, ; comments, #| |# blocks, #\( char literals) that resolves each (define …) to its nearest enclosing form and labels it module-level or internal, then joined that against what each regex actually matches, over the real language-crucible scheme sources (Chez + Racket, 1510 defines total: 619 module-level, 891 internal).

Restricted to the lines this rule's form actually targets:

rule	true globals	internal (false positives)	precision
current (^[ \t]*)	53	71	42.7%
#2651 anchored (^(?![ \t]))	21	4	84.0%

The current rule is wrong more often than it is right. But the anchor is not the fix: it deletes 67 false positives and 32 real globals, cutting true positives from 53 to 21. Precision doubles, recall drops ~60%, and on a risk metric that is undercounting global state, not fixing it.

Why the recall collapse — per-file (define at column 0 vs indented:

file	col-0	indented
cpnanopass.ss (Chez; entire body inside (let () …) from line 16)	0	682
io.ss	0	285
syntax.ss	318	341
schemify.rkt	9	119
thread.rkt	83	61

Two of five real files have no column-0 defines at all. The anchor takes them to zero globals — the rule goes blind on the commonest Scheme file layout rather than getting more precise on it.

Fix shape

The discriminator is body position, not column. A (define …) is internal iff its nearest enclosing form is a body position (lambda, case-lambda, the let family, a procedure-form (define (name …) …), when/unless/cond/parameterize, …) and module-level otherwise (top level, or nested only in library / module / define-library / a depth-0 (let () …) file wrapper).

Applied to the same corpus that predicate yields 53 true globals and 0 false positives — it keeps every true positive the current rule finds and drops all 71 false ones.

This is deliberately not a regex change, and therefore not B.3 material. A flat pattern cannot see the enclosing form; this needs a paren-depth pass in the detector, i.e. the slicer layer, which #2669's stacking rule keeps out of a registry-regex PR. The classifier that produced the numbers above is ~60 lines and can seed it. Machinery precedent exists: scheme already has a func_start rule for the procedure form —

"func_start": r"^[ \t\n]*\([ \t\n]*define[ \t\n]+\([ \t\n]*([a-zA-Z0-9_!?*+/<>=.~$%^&:-]+)…"

— so the engine already models "this define opens a procedure"; what is missing is using that to decide whether a later define sits inside its body.

Recommendation

1. Do not apply the zig + dart: globals rule anchors ^[ \t]* so function-local var/const count as globals (+150% on the rosetta corpus) #2651 anchor to scheme. Recorded on globals rule audit: 11 more languages share zig/dart's ^[ \t]* any-indentation anchor (#2651 follow-up) #2660 as audited-and-rejected.
2. Treat the body-position predicate as a scoped design item — small, self-contained, one language, with a ready-made oracle (the classifier) and a clear pass mark (53/0 on the crucible corpus).
3. Until then, ledger scheme globals as a known 42.7%-precision over-count. The rosetta corpus reads the planted globals 2 and cannot see any of this, so nothing here blocks a rebless — and nothing here will be caught by one either.

[squid-protocol]

Implemented on #2701 (branch fix/2674-scheme-define-body-position), as the scoped design item recommendation 2 asked for: a registry-declared _scope_filters hook in coding_analysis plus one filter, lisp_body_position, that walks the paren structure and keeps a (define …) only when its nearest classifying enclosing form is module scope.

Two things worth recording here that the issue text didn't anticipate:

1. The 53/0 pass mark was measured on raw files; the engine sees Prism code streams, and they differ in two ways. Comments are gone, so (define foo ; comment no longer satisfies the regex's value slot (that inflated the raw counts, e.g. syntax.ss 44 → 20 matches). And Prism's lisp stripper treated the #\; char literal ((write-char #\; p), cpnanopass.ss:7690/7805, io.ss:6393) as a line comment and swallowed the rest of the line including its closing parens, desyncing every paren-balanced scan for the rest of the file — the first cut of this filter read cpnanopass.ss as 0 globals because of it. Fixed in the same PR (first commit), one golden-master cell moves from that alone (io.ss closures 454 → 455).

2. The oracle's "depth == 1, or any module" proxy and the shipped walk disagree in three shapes, all resolved toward the enclosing form's real semantics:

• kept: defines under a (begin …) or a let-syntax body inside the file wrapper — both splice into the enclosing context (R7RS 5.6.1 / R6RS 11.18), so they share the wrapper's status (syntax.ss's three *-eval-hooks, io.ss's buffer-size constants under its file-level let-syntax);
• dropped: defines inside a (module …) that sits inside a nanopass define-pass (a procedure) — pass-local state (cpnanopass.ss gl*, gle*, goto*, block* …);
• dropped: defines inside a (module …) nested under a block-scope (let () …) (cpnanopass.ss:212's block holding the empty-tree module) — block-local, the same rule the oracle itself applied to syntax.ss's (define who …) runs.

Golden master on the code streams, both modes: cpnanopass.ss 26 → 1, io.ss 10 → 6, schemify.rkt 6 → 0, thread.rkt 3 → 1. Every dropped define is in a procedure body, a define-pass, a cond/match clause, or a local module under a block let; the PR lists them per file with their enclosing forms. The rosetta scheme gate is unchanged (plants are top-level), so recommendation 3's ledger entry is not needed.