test(quality): fail loudly when a source-scanning guard is negative-only

[MumuTW]

First step of the god-file decomposition campaign tracked in #8617. No production code.

The problem

A negative guard passes against an empty string:

const endpoint = readSource("src/.../EndpointPageClient.tsx");
assert.equal(endpoint.includes(">Active Endpoints<"), false);

Extract AvailableEndpointsSection out of that file and the parent no longer contains the
string — the assertion keeps passing while guarding nothing. No test turns red. Positive
assertions (assert.match) fail loudly and are safe; only the negative shape is silent.

#8617 plans ~90 extraction PRs. Each one is precisely the operation that voids these guards,
so the guards need to become loud before the extractions start.

What this adds

tests/unit/source-scanner-guards.test.ts — a hard gate, deliberately with no baseline
and no allowlist: the violation set is small and every instance is a real hole, so it is
fixed by adding an anchor, not by suppressing it. Every test variable bound to a project
source read must carry at least one positive anchor.

Classification runs on logical statements, with strings, regexes and comments blanked out
before bracket counting — /notify\.error\(/ must not read as an unclosed paren, and a unit
must end when brace depth rises or an entire test body would fold into one blob and the gate
would start inventing violations. That folding is what exposed 3 of the 7 violations; a
line-based scan classifies the bare source, argument line of a multi-line
assert.doesNotMatch(...) as a positive anchor.

tests/_helpers/readSrc.ts — repo-root-relative reader (derived from import.meta.url,
never cwd) that throws on a missing or empty file instead of returning "".
settings-ui-layout-static.test.ts had a byte-equivalent local copy and now imports it.

The 7 violations fixed

file	variable	anchor
proxy-bypass-scope-guard-3226	chatHelpers	export async function executeChatWithBreaker(
proxy-bypass-scope-guard-3226	chatCore	export async function handleChatCore(
providers-autosync-ssrf-323	syncInitializeRouteSrc	export async function POST(
claude-web-transport	executorSource	export class ClaudeWebExecutor extends BaseExecutor
dashboard-localization-contract	endpoint	export default function APIPageClient(
gamification-display-contract	tokensSource	export default function TokensPage(
settings-ui-layout-static	generalStorage	export default function SystemStorageTab(

Every anchor is a top-level exported declaration other modules import by name, so it survives
UI copy churn and internal splits.

Two were security scope guards. providers-autosync-ssrf-323 guards /api/sync/initialize
against a client-controlled Origin becoming the credential-bearing model-sync base URL.
proxy-bypass-scope-guard-3226 asserts the NVIDIA-only proxy bypass has not spread to the
chat hot path — and it reads open-sse/handlers/chatCore.ts, a 4,906-line file scheduled for
decomposition in 3.8.53. Both were held only by multi-line negative assertions, so both would
have died silently at exactly the moment they mattered.

Verification

source-scanner-guards            # pass 4  # fail 0
claude-web-transport             # pass 9  # fail 0
dashboard-localization-contract  # pass 14 # fail 0
gamification-display-contract    # pass 4  # fail 0
settings-ui-layout-static        # pass 8  # fail 0
providers-autosync-ssrf-323      # pass 4  # fail 0
proxy-bypass-scope-guard-3226    # pass 2  # fail 0

npm run typecheck:core           exit 0, 0 errors
npx eslint <all touched>         exit 0
npx prettier --check             all matched files clean
check:file-size                  OK (new files 423 / 57 lines, cap 800)
check:dead-code                  OK (222, baseline 227)
check:test-discovery             OK

The gate bites. Removing the chatCore anchor (the multi-line shape) and re-running:

1 source-bound test variable(s) carry ONLY negative guards:

  tests/unit/proxy-bypass-scope-guard-3226.test.ts
    variable "chatCore" is guarded only by negative assertions (line 51)
    fix: add one positive anchor, e.g. assert.match(chatCore, /export default function SomeComponent/);

Two synthetic cases in the gate's own suite lock the multi-line behaviour in both directions:
a multi-line negative guard must be reported, and a multi-line positive anchor must not be —
the second one catches an over-merging folding bug that would invent violations.

Known limitation (deliberate, documented in the file header)

Variables are keyed by name per file, not per scope, so a file declaring const source in two
separate test bodies pools both sets of usages and one anchor can mask the other's negative-only
guard (tests/unit/8395-plugin-hooks-fire.test.ts is the current example). This errs toward
under-reporting — it never invents a violation — and closing it needs scope-aware parsing that
is not worth the complexity here.

Refs #8617