Filed unassigned from #12398's implementation round — an observation, not a claim on anyone's
time, and deliberately not fixed there (that card converted exactly the three guards its
scope named).
What was measured
#12398 converted three route-ledger conformance guards off their private comment strippers
onto scripts/js-comment-mask.mjs and deleted their rows from
scripts/check-comment-mask-adoption.mjs (23 rows → 20). The conversion was checked by
diffing private-vs-shared output byte for byte over each package's scanned population, and
two of the three were silently deleting real code:
| file | what the private scanner did |
|---|
packages/metadata/src/plugin.ts | read the // inside the regex literal /^https?:\/\//i as a line-comment opener, deleting 40 bytes of live code to end of line |
packages/cloud-connection/src/marketplace-proxy-plugin.ts | same, on /\/packages\/[^/]+\/versions\// — 38 bytes, and this file is a declared MOUNT SOURCE, i.e. source that guard's census reads |
That is the naive-// family js-comment-mask.mjs's header measures, found live rather than
argued from the shape.
Why it is worth a card rather than a shrug
The adoption ledger's why notes describe each row's implementation shape —
"hand-rolled scanner, preserves block-comment newlines", "the full naive two-regex pair" — not
what that implementation does to the source it actually reads. Those are different facts, and
the first does not imply the second: three rows carried near-identical why text and the
behaviour underneath split two ways.
So for the 19 rows still recorded, nobody has the measurement. Each of them feeds a gate, and
the direction that matters is the quiet one: a stripper that swallows live code makes its gate
report clean over text it never looked at — the failure js-comment-mask.mjs's header calls
worse than no verifier at all, because it reports success.
Cheap to settle, per row
For a recorded file, run its private stripper and stripComments from
scripts/js-comment-mask.mjs over the population that file actually scans, and diff the two
outputs. A non-empty diff is either a conversion to make or a why note to correct; an empty
diff is a row whose why can then say so on evidence.
⛔ Not a sweep, and not a licence to convert in bulk: the adoption gate's own header is explicit
that converting is per-row, is a MEASUREMENT rather than a sweep, and that a row whose verdict
changes under the shared mask is a finding to read.
Dedup status — NOT established, and why
⚠️ The REST list endpoints return 403 GitHub access is not enabled for this session from the
dev seat this was filed from, and the dispatch contract forbids the MCP list_issues /
search_issues fallback. Local grep over the tree cannot see issue bodies. So "no covering
card" is unverified here rather than checked and confirmed — recording that plainly so the
triage round can settle it rather than reading this as a completed dedup. The same outage is
recorded on #12398 from two other seats.
Refs: #12398 (where it was measured) · #12372 (the adoption gate and its ledger)
Filed unassigned from #12398's implementation round — an observation, not a claim on anyone's
time, and deliberately not fixed there (that card converted exactly the three guards its
scope named).
What was measured
#12398 converted three route-ledger conformance guards off their private comment strippers
onto
scripts/js-comment-mask.mjsand deleted their rows fromscripts/check-comment-mask-adoption.mjs(23 rows → 20). The conversion was checked bydiffing private-vs-shared output byte for byte over each package's scanned population, and
two of the three were silently deleting real code:
packages/metadata/src/plugin.ts//inside the regex literal/^https?:\/\//ias a line-comment opener, deleting 40 bytes of live code to end of linepackages/cloud-connection/src/marketplace-proxy-plugin.ts/\/packages\/[^/]+\/versions\//— 38 bytes, and this file is a declared MOUNT SOURCE, i.e. source that guard's census readsThat is the naive-
//familyjs-comment-mask.mjs's header measures, found live rather thanargued from the shape.
Why it is worth a card rather than a shrug
The adoption ledger's
whynotes describe each row's implementation shape —"hand-rolled scanner, preserves block-comment newlines", "the full naive two-regex pair" — not
what that implementation does to the source it actually reads. Those are different facts, and
the first does not imply the second: three rows carried near-identical
whytext and thebehaviour underneath split two ways.
So for the 19 rows still recorded, nobody has the measurement. Each of them feeds a gate, and
the direction that matters is the quiet one: a stripper that swallows live code makes its gate
report clean over text it never looked at — the failure
js-comment-mask.mjs's header callsworse than no verifier at all, because it reports success.
Cheap to settle, per row
For a recorded file, run its private stripper and
stripCommentsfromscripts/js-comment-mask.mjsover the population that file actually scans, and diff the twooutputs. A non-empty diff is either a conversion to make or a
whynote to correct; an emptydiff is a row whose
whycan then say so on evidence.⛔ Not a sweep, and not a licence to convert in bulk: the adoption gate's own header is explicit
that converting is per-row, is a MEASUREMENT rather than a sweep, and that a row whose verdict
changes under the shared mask is a finding to read.
Dedup status — NOT established, and why
403 GitHub access is not enabled for this sessionfrom thedev seat this was filed from, and the dispatch contract forbids the MCP
list_issues/search_issuesfallback. Local grep over the tree cannot see issue bodies. So "no coveringcard" is unverified here rather than checked and confirmed — recording that plainly so the
triage round can settle it rather than reading this as a completed dedup. The same outage is
recorded on #12398 from two other seats.
Refs: #12398 (where it was measured) · #12372 (the adoption gate and its ledger)