test(scripts): read the vi.mock anti-exemption pin over the comment-blanked gate, and name the offending line - #8461

Fixes #8117

Head 2a10ce4e1, base 1706d8be4. Session session_01FhBNJcLRZLe8M87VcUgpKr.

The defect, re-derived on today's tree

scripts/__tests__/check-vi-mock-inherit.test.ts carries the assertion that keeps the
exemption swamp out of scripts/check-vi-mock-inherit.mjs. It read the gate's raw source
and asserted it does not match the pattern below — one entry of a hand-written array of exempt
file paths (the character class holds a single quote, a double quote and a backtick):

/\.test\.tsx?['"`]\s*[,\]]/

That gate's leading docblock is 1128 lines and is, by construction, the per-slice logbook
objectui#6892 writes every sweep record into. Recording a sweep means naming test files, and a
backticked filename followed by a comma is byte-identical to one entry of the array the pin
exists to catch.

Measured on this branch's base (1706d8be4), before any edit:

The card's diagnosis reproduces exactly. Note row 3: the header already carries 13 backticked
test filenames and none is followed by a comma — that green reading is not evidence the pin
is sound, it is the tax the two previous repairs paid by rewording prose (objectui#8116 at 69
of 69, objectui#8207 at caf312b93). Without the injected control, the zero would have meant
nothing.

What changed

One file, scripts/__tests__/check-vi-mock-inherit.test.ts, +99 / -4.

1. The ENTRY pattern is read over maskComments(src) — the gate's own rule ("only text the
   language would EXECUTE is judged") turned on the gate's own file. The shared masker leaves
   string literals, templates and regex literals intact, so a real exemption array survives it
   whole; only prose goes. The pin keeps every tooth and the docblock becomes unreachable.
2. The DECLARATION pattern still reads the raw source. Its ^\s* anchor reaches a docblock
   line's * prefix and stops, so that half has no false red to fix, and blanking it would
   narrow an assertion for nothing. Leg 6 below measures that claim rather than asserting it.
3. The failure names the offending LINE. not.toMatch printed the whole ~1850-line gate as
   the "received" value and never said where the match was; locating it needed a separate
   grep -nP with the pattern copied out of the test by hand. Both patterns are now named
   constants and both assertions go through one offendingLines() helper reporting
   LINE NUMBER: source line. Measured below: 101417 bytes of failure report became 1336.
4. Three sibling cases pin the repair itself, each with the raw match as its control — a
   zero-hit reading on a tree whose prose already dodges the comma would otherwise mean nothing.

⛔ No exemption was added, and none of isCovered / coveredPrefixes / operandDenotes /
COVERED_SPECIFIERS was touched. scripts/check-vi-mock-inherit.mjs is not in this diff.

A premise of the card is falsified

Both the card body and the triage comment prescribe "the masking helper the gate already
exports (deJsxClosingTags plus the shared js-comment-mask)". deJsxClosingTags was
retired by objectui#7883 and survives only as three lines of historical prose (gate line
1115, test lines 544 and 568). It is not a function, not an export, not callable. The other
half is live and is what the gate itself uses at check-vi-mock-inherit.mjs:1603-1604, so the
repair stands — but on js-comment-mask alone.

Two smaller corrections: the card describes the pin as one assertion, and it is two, only one
of which has the false red; and the dispatch brief quotes 660 judged / 660 inherit where the
tree reads 663 / 663 today.

Ablation — six legs, every mutation proved on disk before any result was read

Each leg prints the HEAD blob hash, the on-disk blob hash and a marker count before the run
is read; an empty hash exits 9 rather than reading as "nothing to compare". Restore is proved
by state — git diff HEAD empty and both blobs equal to HEAD — never by an exit code. Both
scripts carry trap RESTORE EXIT INT TERM with absolute paths from git rev-parse --show-toplevel.

Restore after each script: 0 paths differing from HEAD, gate blob and pin blob both equal to
their HEAD blobs.

Leg 5 found a defect in the repair, and it is fixed in 2a10ce4e1

The anchored positive control is the reason the dispatch note asked for two positive shapes
rather than one. The pin went red as it must, but the line it named was

[ "1853: " ]

an empty line, one above the declaration. EXEMPTION_DECLARATION_RE opens with ^\s* and
\s matches a newline, so against a declaration with a blank line above it the match starts
on that blank line, and counting to the match offset reported the blank line. A failure message
that names the wrong line is the defect this branch is about, one level down. offendingLines
now counts to the first non-whitespace byte of the match, and a dedicated case pins it. Leg 5
re-run on the fix reports 1854: with the declaration's own text, as the table shows.

Census unmoved

node scripts/check-vi-mock-inherit.mjs, exit 0, before and after — byte-identical lines:

✅  check-vi-mock-inherit: OK (4480 tracked source file(s), 2746 test-named; 625 carry a mock;
663 call site(s) on … and their subpaths judged (663 inherit, 0 auto-mocked); 0 other
workspace, 244 external, 886 local, 0 non-static, 3 embedded in a string literal)

Commands, with real output

All heavy runs through the shared os-verify-lock.sh (slot issue-8117-vi-mock), verdicts read
from its own VERDICT line rather than a bare exit status. Head 2a10ce4e1, tree clean.

Bare objectui#8202 was filed for the second instance and a maintainer already marked it a
duplicate of this card. It is mentioned for history only and needs nothing from this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FhBNJcLRZLe8M87VcUgpKr