fix: repair AWS service onboarding and measure its cost

[skyoo2003]

Summary

The write-only-mutator sweep decided by name arithmetic (occurrences == declaration lines), so a live namesake covered a dead declaration's zero call sites. Measured on this tree: send has 9 declarations and 120 occurrences, record 6, delete/tick/clamped 3 — if every call site of one send disappeared, the other eight kept the gate green on exactly the defect class it exists to catch.

The verdict now counts per declaration site. SwiftPM already writes an index store on every build ($(swift build --show-bin-path)/index/store), where each declaration carries a USR and each reference carries that USR, so the data was there for free. Tools/MutatorGate reads it; scripts/mutator-sweep.sh keeps the policy (allowlist, debug prefix rule).

Note on the issue's proposed fix: swift-syntax alone cannot close this. It makes declaration sites precise but cannot resolve which send a store.send(...) call binds to — that needs type inference, so name pooling would survive. Periphery was rejected too: its upstream repository is archived and the brew formula is deprecated (disabled 2027-08-12), so CI cannot depend on it. The index store is the semantic superset of both.

Closes #233

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• Other:

UI changes

N/A — no files under Sources/PokeTokenBar/UI/ changed.

What the gate now catches

scripts/verify-mutator-gate.sh plants six defects and compares exit codes, so the verdict lives in an exit code rather than a memory of having checked once:

#	Injected	Expected	Name arithmetic	Declaration sites
1	dead mutator named send, beside 9 live namesakes	red	green	red
2	dead mutator with a unique name	red	red	red
3	mutator with a caller	green	green	green
4a	debug prefix with a Tests caller	green	green	green
4b	debug prefix without a Tests caller	red	red	red
5	reachable only through a protocol requirement	green	green	green

Exactly one case flipped, which is both the RED evidence for this fix and proof the harness discriminates instead of painting everything red. Case 5 stays green because the tool follows .overrideOf relations — without that, a protocol-dispatched mutator would stop CI for a defect that does not exist.

What deleting the awk extractor exposed

A fourth counting asymmetry of the class #235 fixed: save() inside a non-func member was attributed to the preceding func. Three candidates changed, all measured:

• clamped gone — a ghost. init(fileURL:) at PokemonChat.swift:675 calls save() at :687, and no func appears between :394 and :687, so a different type's clamped(x:y:) was carrying that call.
• merge gone — a ghost. It is a local function nested inside backfillMissingOwnedNames().
• backfillMissingOwnedNames() added — a real non-private mutator the old extractor structurally could not see, because its own nested func merge stole the name before the save() line. It has callers, so nothing was dead; the gate simply had never looked at it.

Findings on the current tree are exactly the existing allowlist (five debug* hooks with Tests callers, plus setHidden and setTheme), so no real code regressed.

New failure modes, each guarded and injection-tested

Moving to an index means the index itself can lie. All three guards were verified by injecting the failure:

• Stale index → the sweep builds before it reads, so it cannot judge from an old store.
• Missing or empty store → exit 2 with a message. Measured on both a nonexistent path and an empty directory. A silent "0 findings" here would mean a gate that sees nothing while reporting green.
• Stale unit for a deleted file → skipped when the declaration line cannot be read (1 finding with the file present → 0 when only the file moves), so probe files leave no ghosts.

Remaining ceilings (recorded in defect-log.md)

• Calls through a protocol or superclass are recorded against the requirement's USR, so with two or more conformers one live call keeps the others looking alive (dynamic dispatch; periphery has the same limit).
• A dead cluster that only calls itself (A→B→A) passes.
• Accessors (didSet, setters) calling save() are not candidates — the class stayed "functions", as before.

Cost

	Measured
indexstore-db cold build	21s (no CI cache needed)
Sweep, warm	~5s
Full test-gate.sh	1m43s, coverage 90.84%

The sweep builds with --enable-code-coverage to match the gate's later swift test; mismatched flags made SwiftPM recompile the whole module (19s measured, 0.18s once aligned). Tools/MutatorGate is a separate package on purpose — putting indexstore-db in the root manifest would drag the dependency through the release build and signing path.

The dependency is pinned by revision to swift-6.1.2-RELEASE (54212fc), matching CI's toolchain (Swift 6.1.2 on macos-15); indexstore-db has no semver tags for SwiftPM to read.

Files Changed

File	Change	Why
Tools/MutatorGate/{Package.swift,Package.resolved,Sources/main.swift}	Added	Reads the index store, reports dead declarations per site
scripts/mutator-sweep.sh	Added	The sweep, extracted so the gate and the harness run the same code
scripts/verify-mutator-gate.sh	Added	Six-case defect-injection harness (stand-alone, not in CI)
scripts/test-gate.sh	Modified	−110 lines: the awk extractor and its approximation comments are gone
docs/reference/defect-log.md	Modified	Ceiling marked resolved; new asymmetry, new ceilings, injection evidence
docs/reference/memory-home-plan.md	Modified	No longer claims test-gate.sh owns the sweep

Testing

• ./scripts/test-gate.sh — passes (coverage 90.84% ≥ 69%)
• ./scripts/verify-mutator-gate.sh — 6/6 as expected; the same harness fails 1/6 on the pre-fix implementation
• Guard injections for the empty store, the missing store, and the stale unit, as described above

The harness is deliberately outside CI: it rebuilds per case and would make the gate verify itself inside itself. It is the thing to run when the sweep's verdict is touched.

Checklist

• swift build and swift test pass locally
• PR title and description are written in English
• UI changes are described above (before/after — images optional)
• No copyrighted assets, secrets, or private tooling references are committed
• Tests were added or updated for this change