Skip to content

[finding] check-test-source-alias's codeOnly projection is pinned by nothing — the gate reads identical under a mask that blanks nothing at all #16299

Description

@baozhoutao

scripts/check-test-source-alias.mjs reads two projections of each source
(maskedProjections -> { commentsOnly, codeOnly }). commentsOnly feeds the import
regex; codeOnly feeds functionBodyRanges(codeOnly) in moduleLoadSites, which is
what decides whether a dynamic import sits inside a function body — a CLOCKED load — or
at module scope, which is the finding this gate reports. A brace counted inside a string
or a template flips that classification.

Measured while converting this file onto the shared export (#15776): nothing pins the
codeOnly half.
Neither the gate's plain run nor its --self-test moves by a single
byte when the shared mask is ablated, in two independent directions.

The measurement

Ablate maskCommentsAndLiterals in scripts/js-comment-mask.mjs, rebuild nothing (plain
.mjs, no dist), re-run node scripts/check-test-source-alias.mjs and the same with
--self-test, diff against the unablated run:

ablation what it does check-test-source-alias plain its --self-test
flags[k] = comment[k] drops the literal half; the projection degrades to maskComments byte-identical, exit 0 byte-identical, exit 0
return source blanks nothing at all — the mask becomes the identity byte-identical, exit 0 byte-identical, exit 0

The control — the instrument CAN fail

The same two ablations were run against the eight gates converted in #15776, sixteen runs
each. Ablation 1 moved 9 of 16 runs; ablation 2 moved 11 of 16. Every one of the other
seven gates has at least one leg that moves and goes red. check-test-source-alias is the
only file where BOTH legs are unmoved under BOTH ablations, so the silence is a fact about
this gate, not about the probe.

For scale: the gate's whole plain output is 189 bytes and its --self-test output is 39
bytes.

Why this is worth a card

The repo's standing acceptance for a comment-mask conversion is "byte-identical plain and
--self-test output before and after" (#15594, carried into #15776). That acceptance is
vacuous for this file — it would hold just as well if the conversion had swapped in a
projection that blanks nothing. The conversion in #15776 is nevertheless sound: it was
proven separately, by diffing the deleted composition against the export over 6,204 files
and 107,177,732 chars, byte for byte, with a control showing 6,174 of those files
distinguish the two. But that proof lives in a PR body, and this gate still has no pin of
its own.

What a fix looks like: a --self-test fixture whose module-scope-versus-clocked verdict
depends on a brace inside a string or a template — the shape the projection exists to
survive — so an under-masking mask reds here rather than reading green.

Not in scope of #15776

That card's fence is callers that RE-DERIVE the shared projection; this is a missing pin,
not a copy. Filed rather than ridden.

Found by the os-dev on #15776 (branch claude/issue-15776-comment-mask-projection-callers),
measured on 67581c042. Bare for triage — no assignee.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions