finding(tooling): `js-comment-mask` still opens a phantom regex on a self-closing JSX tag and on a slash in JSX text

[claude]

Measured while implementing #6891, on cf7f2af6e. Filed unassigned, not fixed there: #6891 closes the LT SLASH half with a one-token rule; this half provably cannot be closed the same way, so it is its own decision.

The defect

scanSource opens a REGEX when the character before a / is not a value (IDENT_CHAR, ), ]). } and GT are not values, so both of these open a phantom regex that runs to end of line:

• a self-closing JSX tag whose / follows a brace — Foo bar={x} SLASH GT, Foo {...p} SLASH GT
• a / in JSX text — {a}/{b}, or code OS_PAGE_REACT=off /code SLASH code x /code

A self-closing tag whose / follows a value (br SLASH GT, Foo SLASH GT, Foo x="1" SLASH GT) was never affected — the discriminator is the preceding byte, not the tag shape.

Measured

Over all 4,322 tracked source files, with #6891's fix applied and both flag arrays diffed byte for byte against the pre-fix scanner: 145 bytes across 28 files are still flagged literal by this shape. They were invisible before only because the closing tag's larger phantom started earlier on the same line and covered them.

It reaches the FABRICATES direction too — the phantom swallows a comment opener that follows it on the same line, so genuinely commented-out text comes back to a caller as live code:

const c = Foo bar={x} SLASH GT ; // dead = 1;

maskComments leaves dead = 1; standing. That is the direction this module's header calls worse than no verifier at all.

Why #6891 did not take it

There is no one-token rule for it, and the two obvious ones are both wrong:

1. / followed by GT is a tag closer. That is exactly how a regex matching a GT is spelled — str.replace(/GT/g, '>') — and this tree writes that shape.
2. } and GT are values. Both are genuinely ambiguous in JavaScript: function f(){} /re/ is a regex, and a GT /re/.test(b) parses.

Separating them needs to know whether the scanner is inside a JSX element, which is a parser. js-comment-mask.mjs is deliberately a cheap language-level masker, and turning it into a parser is a different card.

Already pinned, so this cannot be closed silently

scripts/__tests__/js-comment-mask-jsx-6891.test.ts carries a KNOWN LIMITS block asserting today's behaviour for all four shapes. Whoever closes this will see those pins fail and must retire them deliberately — the same two-way discipline that surfaced #6891 itself.

Shape of a fix, for triage rather than as a decision

1. Leave it. The residue is 145 bytes, it is pinned, and no gate's verdict moves today. Cheapest, and honest as long as the pins stay.
2. Port objectstack's corpus sweep (scripts/check-comment-mask-corpus.mjs, named in this module's header as NOT ported here) and decide against a measurement over an independent parser rather than against cases. This is the route finding(tooling): js-comment-mask reads a JSX closing tag as a regex literal — 7 measured call sites become undelimitable #6891's own triage comment named as the only one that answers "which direction does it fail in".
3. A JSX-aware mode, opt-in per caller. Largest, and it changes what this module is.

---

Generated by Claude Code

[os-zhuang]

分诊：domain:devx / tooling + finding / needs-user-decision / priority:p3

⛔ needs-user-decision 不与 pm:* 并存。

落点核实（origin/main）

scripts/js-comment-mask.mjs:302
    if (c === '/' && source[i - 1] !== '<' && !(IDENT_CHAR.test(prev) || prev === ')' || prev === ']')) {

⇒ #6891 的 LT SLASH 规则已落地（source[i - 1] !== '<'），而判别式仍是「前一字节是不是一个值」：IDENT_CHAR / ) / ] 是值，⇒ } 与 > 都不是 ⇒ 卡片描述的两种幻影（自闭合标签的 / 跟在 } 后、JSX 文本里的 /）在这条判别式下确实仍然开启。

scripts/__tests__/js-comment-mask-jsx-6891.test.ts:178
  describe('KNOWN LIMITS — the half this change does not close', () => {

⇒ 那一块 pin 确实在，⇒ 卡片那句「已被钉住，因此不能被静默关闭」成立。

⚠️ 本席未复现 4,322 个文件 / 145 字节 / 28 个文件的实测。⛔ 不当作已复现继承。

---

⭐ 卡片最重要的一段：它到达了 FABRICATES 方向

the phantom swallows a comment opener that follows it on the same line, so genuinely commented-out text comes back to a caller as live code：

const c = Foo bar={x} SLASH GT ; // dead = 1;

maskComments leaves dead = 1; standing. That is the direction this module's header calls worse than no verifier at all.

⇒ ⭐ 这不是「漏报」，是「捏造」——一段被注释掉的代码被交还给调用方当作活代码。⛔ 这条把本卡与一个普通的覆盖面缺口区分开了，而它正是该模块自己的档头判定为「比没有验证器更糟」的那个方向。

⚠️ 而卡片诚实地记下了为什么这 145 字节此前不可见：「它们此前不可见，只是因为闭合标签那个更大的幻影在同一行上更早开始并覆盖了它们。」 ⇒ 修好一半反而让另一半显形 —— 这是一个诚实的、非直觉的读数。

为什么定 p3（尽管方向危险）

• 今天没有任何门的判决因此移动（卡片自陈）；
• 残留是 145 字节 / 28 个文件，且已被 pin 钉住 ⇒ 它是一条被声明的边界，不是一个静默盲区；
• ⛔ 不升 p2：FABRICATES 方向虽然危险，但尚未有任何一次实际误判被记录（卡片未主张有）。
• ⛔ 不降更低：它是被这个模块自己的档头判定为最坏方向的那一类，且 pin 的存在意味着关闭它必须是刻意的。

为什么是决定箱

卡片列了三支，并且证明了没有便宜的一票解：

There is no one-token rule for it, and the two obvious ones are both wrong:

1. 「/ 后跟 GT 是标签闭合」 —— 那正是一个匹配 GT 的正则的写法（str.replace(/GT/g, '>')），而这棵树里就有这种写法。
2. 「把 } 与 GT 当作值」 —— 两者在 JavaScript 里确实歧义：function f(){} /re/ 是正则，而 a GT /re/.test(b) 也能解析。
   Separating them needs to know whether the scanner is inside a JSX element, which is a parser.

⇒ ⭐ 两条显而易见的规则各自被一个树内反例否掉 —— 这不是「还没想到办法」，是已经证明了廉价规则不存在。⇒ 决定箱成立。⛔ 本席不裁决（本会话 claude-opus-5，CONTRACT_REVIEW_TIER 硬门要求 fable）。

四facet

① 事实（已核） js-comment-mask.mjs:302 的判别式以「前一字节是否为值」决定是否开启正则；} 与 > 不在值集里 ⇒ 自闭合 JSX 标签（/ 跟在 } 后）与 JSX 文本里的 / 仍开启一个跑到行尾的幻影。实测残留 145 字节 / 28 文件，且到达 FABRICATES 方向。四种形状已被 js-comment-mask-jsx-6891.test.ts:178 的 KNOWN LIMITS 钉住。

② 分叉

1. 不动。残留 145 字节，已钉住，今天无门的判决移动。
2. 移植 objectstack 的语料 sweep（scripts/check-comment-mask-corpus.mjs，本模块档头明说尚未移植到这里），对着一个独立的 parser 做测量再决定，而不是对着用例决定。
3. 一个 JSX-aware 模式，按调用方 opt-in。

③ 各支的代价

1. 最便宜，且只要 pin 留着就是诚实的。⚠️ 但 FABRICATES 方向留在树上。
2. ⭐ finding(tooling): js-comment-mask reads a JSX closing tag as a regex literal — 7 measured call sites become undelimitable #6891 自己的分诊已经点名这是唯一能回答「它往哪个方向失败」的路线 ⇒ 它不是三支之一，它是回答另外两支所需的前置测量。
3. 最大，且它改变了这个模块是什么（卡片：js-comment-mask.mjs 刻意是一个廉价的语言级 masker，把它变成 parser 是另一张卡）。

④ 需要裁决者提供的东西
一句话：js-comment-mask 是否应当保持为一个廉价的语言级 masker？ 答「是」⇒ 1 或 2（且 2 只是把边界测清楚，不改性质）；答「否」⇒ 3，但那是重新定义这个模块。

⚠️ 本席补一条：路线 2 与另外两支不互斥，且它是唯一能把「145 字节」这个数字变成「往哪个方向、影响哪些门」的东西。⇒ 建议裁决者无论最终选 1 还是 3，都先批准 2。

⭐ 一条不可省的约束

Already pinned, so this cannot be closed silently. … Whoever closes this will see those pins fail and must retire them deliberately — the same two-way discipline that surfaced #6891 itself.

⇒ ⛔ 任何一支（包括「不动」）都不得在不处理那四条 pin 的情况下关闭本卡。 ⭐ 而「双向纪律」正是本轮同批 #7883 里那条反着写的钉子所示范的东西——同一个模块族，同一条纪律，第二次生效。

Related：#6891（已落地的 LT SLASH 那一半）· #7883（因 #6891 而冗余的那个下游变通，本轮已判 pm:queue / p3）· objectstack 的 scripts/check-comment-mask-corpus.mjs（路线 2 的来源）。

---

⛔ 本席为 triage 席位：不认领、不派单、不写码、不合并、不裁决 decision-box。

---

Generated by Claude Code

[os-zhuang]

Ruling recorded — option 2, with a standing principle (director seat, decision batch #72, 2026-09-07)

Maintainer reply, verbatim: 「7749 已加入队列，其他同意」 — this card was presented with option 2 recommended and is covered by 「其他同意」.

Ruling:

1. js-comment-mask stays a cheap, language-level masker. ⛔ Option 3 (a JSX-aware mode) is ruled out: it changes what the module is, and a parser is a different card if one is ever wanted.
2. Port objectstack's corpus sweep (scripts/check-comment-mask-corpus.mjs, named in this module's own header as not yet ported) and measure the residue against an independent parser — which direction it fails in, and which gates' verdicts it can move. That measurement is the deliverable; it turns "145 bytes / 28 files" into a reading a decision can be made on.
3. The four KNOWN LIMITS pins in scripts/__tests__/js-comment-mask-jsx-6891.test.ts stay until a fix retires them deliberately. ⛔ Nothing closes this card silently.

After the sweep: if it shows the FABRICATES direction actually moves a gate's verdict, the card comes back to the decision box with that reading; if it shows no gate is affected, option 1 (leave it, pinned) is the standing answer and the card can close on the measurement.

needs-user-decision → pm:queue.

---

Generated by Claude Code