test(scripts): read the vi.mock anti-exemption pin over the comment-blanked gate, and name the offending line

[baozhoutao]

Fixes #8117

Head 2a10ce4e1, base 1706d8be4. Session session_01FhBNJcLRZLe8M87VcUgpKr.

The defect, re-derived on today's tree

scripts/__tests__/check-vi-mock-inherit.test.ts carries the assertion that keeps the
exemption swamp out of scripts/check-vi-mock-inherit.mjs. It read the gate's raw source
and asserted it does not match the pattern below — one entry of a hand-written array of exempt
file paths (the character class holds a single quote, a double quote and a backtick):

/\.test\.tsx?['"`]\s*[,\]]/

That gate's leading docblock is 1128 lines and is, by construction, the per-slice logbook
objectui#6892 writes every sweep record into. Recording a sweep means naming test files, and a
backticked filename followed by a comma is byte-identical to one entry of the array the pin
exists to catch.

Measured on this branch's base (1706d8be4), before any edit:

reading	raw source	comment-blanked source
the pin's ENTRY pattern, today's gate	0 hits	0 hits
backticked test filenames in the header	13	—
of those, followed by a comma	0	—
+ one sweep record naming a swept file, with a comma	1 hit, line 1128	0 hits
+ a real exemption array, as CODE	2 hits	2 hits
+ the same array commented out	2 hits	0 hits

The card's diagnosis reproduces exactly. Note row 3: the header already carries 13 backticked
test filenames and none is followed by a comma — that green reading is not evidence the pin
is sound, it is the tax the two previous repairs paid by rewording prose (objectui#8116 at 69
of 69, objectui#8207 at caf312b93). Without the injected control, the zero would have meant
nothing.

What changed

One file, scripts/__tests__/check-vi-mock-inherit.test.ts, +99 / -4.

1. The ENTRY pattern is read over maskComments(src) — the gate's own rule ("only text the
   language would EXECUTE is judged") turned on the gate's own file. The shared masker leaves
   string literals, templates and regex literals intact, so a real exemption array survives it
   whole; only prose goes. The pin keeps every tooth and the docblock becomes unreachable.
2. The DECLARATION pattern still reads the raw source. Its ^\s* anchor reaches a docblock
   line's * prefix and stops, so that half has no false red to fix, and blanking it would
   narrow an assertion for nothing. Leg 6 below measures that claim rather than asserting it.
3. The failure names the offending LINE. not.toMatch printed the whole ~1850-line gate as
   the "received" value and never said where the match was; locating it needed a separate
   grep -nP with the pattern copied out of the test by hand. Both patterns are now named
   constants and both assertions go through one offendingLines() helper reporting
   LINE NUMBER: source line. Measured below: 101417 bytes of failure report became 1336.
4. Three sibling cases pin the repair itself, each with the raw match as its control — a
   zero-hit reading on a tree whose prose already dodges the comma would otherwise mean nothing.

⛔ No exemption was added, and none of isCovered / coveredPrefixes / operandDenotes /
COVERED_SPECIFIERS was touched. scripts/check-vi-mock-inherit.mjs is not in this diff.

A premise of the card is falsified

Both the card body and the triage comment prescribe "the masking helper the gate already
exports (deJsxClosingTags plus the shared js-comment-mask)". deJsxClosingTags was
retired by objectui#7883 and survives only as three lines of historical prose (gate line
1115, test lines 544 and 568). It is not a function, not an export, not callable. The other
half is live and is what the gate itself uses at check-vi-mock-inherit.mjs:1603-1604, so the
repair stands — but on js-comment-mask alone.

Two smaller corrections: the card describes the pin as one assertion, and it is two, only one
of which has the false red; and the dispatch brief quotes 660 judged / 660 inherit where the
tree reads 663 / 663 today.

Ablation — six legs, every mutation proved on disk before any result was read

Each leg prints the HEAD blob hash, the on-disk blob hash and a marker count before the run
is read; an empty hash exits 9 rather than reading as "nothing to compare". Restore is proved
by state — git diff HEAD empty and both blobs equal to HEAD — never by an exit code. Both
scripts carry trap RESTORE EXIT INT TERM with absolute paths from git rev-parse --show-toplevel.

leg	mutation (on-disk proof)	predicted	observed
1	header gains one sweep record with a comma; pin reverted to origin/main (gate 08a986a0af5f to bf2f4a5611c9, marker 1; pin 3bd7dd19b060 to 650fd8eba6cb, marker 2)	RED	RED — 1 failed / 83 skipped. Report 1880 lines, 101417 bytes, never names line 1128
2	same header mutation, pin restored to HEAD (gate still bf2f4a5611c9, pin identical to HEAD)	GREEN	GREEN — the false red is gone
3	positive: an unanchored inline carve-out list as CODE (673f3fab6ba4, marker 1)	RED, naming the line	RED — report 35 lines, 1336 bytes, naming 1854: const PER_FILE_CARVE_OUTS = [...]
4a	pre-fix pin, the sentence with a comma (bf2f4a5611c9, marker 1)	RED	RED
4b	pre-fix pin, the same sentence, comma to em dash, nothing else (f84a6483cf9f, commas after that filename now 0)	GREEN	GREEN — punctuation is the only input that flips the pre-fix pin
5	positive: the anchored declaration shape const KNOWN_BAD = [...] as CODE (adb4fbcdf8bb, marker 1)	RED	RED — 1854: const KNOWN_BAD = ['packages/x/src/A.test.tsx', 'packages/y/src/B.test.ts'];
6	the same declaration written as docblock PROSE (f29e3bf3762d, marker 1)	GREEN	GREEN — both halves decline prose

Restore after each script: 0 paths differing from HEAD, gate blob and pin blob both equal to
their HEAD blobs.

Leg 5 found a defect in the repair, and it is fixed in 2a10ce4e1

The anchored positive control is the reason the dispatch note asked for two positive shapes
rather than one. The pin went red as it must, but the line it named was

[ "1853: " ]

an empty line, one above the declaration. EXEMPTION_DECLARATION_RE opens with ^\s* and
\s matches a newline, so against a declaration with a blank line above it the match starts
on that blank line, and counting to the match offset reported the blank line. A failure message
that names the wrong line is the defect this branch is about, one level down. offendingLines
now counts to the first non-whitespace byte of the match, and a dedicated case pins it. Leg 5
re-run on the fix reports 1854: with the declaration's own text, as the table shows.

Census unmoved

node scripts/check-vi-mock-inherit.mjs, exit 0, before and after — byte-identical lines:

✅  check-vi-mock-inherit: OK (4480 tracked source file(s), 2746 test-named; 625 carry a mock;
663 call site(s) on … and their subpaths judged (663 inherit, 0 auto-mocked); 0 other
workspace, 244 external, 886 local, 0 non-static, 3 embedded in a string literal)

Commands, with real output

All heavy runs through the shared os-verify-lock.sh (slot issue-8117-vi-mock), verdicts read
from its own VERDICT line rather than a bare exit status. Head 2a10ce4e1, tree clean.

command	result
vitest run scripts/__tests__/check-vi-mock-inherit.test.ts	exit 0 — Test Files 1 passed (1), Tests 86 passed (86) (84 before this PR)
node scripts/check-vi-mock-inherit.mjs	exit 0 — census above, unmoved
node scripts/check-vi-mock-specifiers.mjs	exit 0
node scripts/check-control-bytes.mjs	exit 0 — 6699 tracked text files, 85 binary skipped
node scripts/check-comment-mask-corpus.mjs	exit 0 — 4480 files, 1 disagrees, within the residue objectui#7882 holds open; unchanged by this PR
tsc -p tsconfig.scripts.json	exit 0 — and --listFiles confirms the program contains the changed file (count 1), so this is a measurement, not a NOT MEASURED reading
pnpm run lint:root	exit 0 — whole lane, not a narrowed run: 275 files read from eslint's own config via --format json, 0 errors, 32 pre-existing warnings, 0 in the changed file (control: another file does appear in that output)
node scripts/check-changeset-presence.mjs	exit 0 — "No source or published contract of a released package changed in this range, so no changeset is owed". Measured, not guessed
grep -naP for control bytes on the changed file	0 hits, with a positive control file proving the grep fires
node scripts/check-governed-queue-guard.mjs --test …	NOT GOVERNED

Bare objectui#8202 was filed for the second instance and a maintainer already marked it a
duplicate of this card. It is mentioned for history only and needs nothing from this PR.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01FhBNJcLRZLe8M87VcUgpKr

[claude]

LANDED — domain:devx @ objectui execution seat, PM session session_01FhBNJcLRZLe8M87VcUgpKr, R46. PR #8461 merged 2026-09-08T01:26:49Z as c90395b20; probe run on a clean extract of re-fetched origin/main, ⛔ never on the shared working tree.

leg	reading on origin/main@c90395b20
probe — maskComments imported	:18 import { maskComments, scanSource } from '../js-comment-mask.mjs';
probe — ENTRY assertion reads the masked source	:429 expect(offendingLines(maskComments(src), EXEMPTION_ENTRY_RE, src)).toEqual([]);
probe — DECLARATION still reads raw	:428 expect(offendingLines(src, EXEMPTION_DECLARATION_RE)).toEqual([]);
control — the non-vacuity pair survives	:442 / :443, both .test(...) assertions present
control — a term known present	check-vi-mock-inherit × 16, so the grep fires

⇒ The pin now reads code and keeps its teeth, and the two raw fixture checks are what will stop a future maskComments change from making it assert nothing.

⚠️ One probe leg returned a hit where this seat predicted zero, and the instrument was wrong — again. expect(src).not.toMatch was expected to be gone; it returns 1. The survivor is at :359, inside the docblock headed "## Why not expect(src).not.toMatch(re) (objectui#8117)" — prose explaining the replacement, not an assertion. ⭐ A raw grep that cannot tell code from comment produced a false hit in the very PR that taught this pin to ignore comments. Sixth instrument slip today, third of this seat's own, and caught before it scored anything.

⚠️ A standing belief of this seat is FALSIFIED by this merge commit, and it matters beyond bookkeeping

This seat's §1 has recorded all shift that "squash normalises trailers to plain Co-authored-by: Claude <noreply@anthropic.com> with no model identifier — so the dispatch fence and the mandated trailer never collide at main." Read off c90395b20:

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FhBNJcLRZLe8M87VcUgpKr
---------
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

A model identifier is in main's history, twice. ⇒ The belief was wrong, and it was load-bearing: it is why this seat treated the conflict as theoretical. ⭐ It also makes objectui#8471 — filed an hour ago by the #8337 dev, which acted on the stricter reading and omitted the model name — a measured fact rather than a hypothesis, and demonstrates its exact prediction: two seats in one shift resolved the same conflict two different ways, and one machine-readable field at main now carries both shapes. Recorded on that card; ⛔ this seat does not resolve it, since the durable fix is dispatch-contract text and that is governed surface.

pm:dispatched stripped in the same pass; domain:devx, bug, tests, tooling and priority:p2 stay —归属不是状态. The card closed via Fixes.

---

Generated by Claude Code