test: pin what the compiler cannot see, not how it is spelled

[PathGao]

No production code changes. git status src src-tauri is empty.

The problem, measured

The suite grew quickly, and 674 of its assertions read source text rather than run code. Some of those have no alternative: invoke passes a command name as a plain string that no compiler checks, "this behaviour has one implementation" is not expressible in types, and Svelte components cannot be imported under node (.svelte.ts stores throw $state is not defined under tsx — verified).

But a large share had drifted a layer too low — pinning private identifiers, parameter names, a statement's literal punctuation, and in one case a finally block matched down to three tabs of indentation. A local rename then fails a test, which is friction rather than safety.

The count barely moved: 674 → 668. This is a composition change, not a trim.

Result, measured two ways

Probe	Before	After
Nine pure private renames (no behaviour change)	5 tests red	0 red
Sixteen injected regressions	15 / 16 caught	16 / 16
Copies of function walk(dir) in scripts/	3, md5-identical	0
DOMPurify allowlists maintained by hand	2	1
Tests / duration	501 / 3.51s	501 / 3.46s

The one the old suite missed

invoke('render_markdown') moving out of renderMarkdownPreview — bypassing front-matter stripping — while the file still contained exactly one occurrence, ~120 characters after the wrapper's declaration. The old assertion was count === 1 plus a [\s\S]{0,400} proximity window, and it stayed green. Naming the enclosing function of every raw call catches it, with no count and no window.

Where the markers moved to

Was	Now	Why
/["']dark["']:["']neutral["']/ — the ternary's literal spelling	resolveMermaidTheme\(	An exported symbol. The old form was evadable by writing if/else
function renderRichContent\(\s*options — the parameter name	RenderRichContentOptions	The exported type is the contract the export imports
function getLanguage\( — a private 25-line helper	return 'plaintext'	The Monaco magic string TypeScript cannot check, which any second extension table must also name
const highlightColorMap — a private binding	--highlight-color:	The CSS custom property — the actual contract with styles.css and FindBar.svelte
indexOf('return processMarkdownHtml(html, filePath, collapsedHeaders);')	enclosing-function check	Three parameter names and a semicolon were load-bearing
(?:fn|filename) local names + emitted.length === 3	every [[…]] template must contain #	The old form let you replace one of the three sites with a broken bare form and stay green at 3
let sanitizedHtml = $derived(sanitizeMarkdownHtml(htmlContent))	read the sink identifier, then assert every bare {@html ident} is that one	Adding a second raw injection point now fails; before it did not

Three assertions got stronger, not merely looser. New scripts/sourceTree.ts holds the ex-duplicate walker, the ex-duplicate allowlist, and enclosingFunctionName / callSiteOffsets — the replacements for proximity windows and verbatim-statement matching. It carries the rule in a comment: a marker may be an exported symbol, a cross-language or library magic string, or the literal shape of a fixed defect — never a private identifier.

Kept deliberately

• The three classes that reproduce defects that really happened: asset.localhost.evil.test prefix forgery, CRLF handling, path case / NFC-NFD. Untouched.
• Two rules pinning a defect's literal shape — getScrollHeight() - …height (Exclude editor bottom padding from split scroll sync #316) and createElement('iframe') (refactor(preview): drop the dead YouTube iframe copy from the viewer #388), both allowed: []. The criterion protects exactly this.
• previewRenderRevision.test.ts and viewerDisposal.test.ts pin private locals and are brittle by the criterion — but they are the only coverage of a stale async render overwriting a newer one, and of listeners leaking past component destroy. The logic lives inside .svelte, and no name-free formulation still pins the check. Per "nothing else catches it → do not delete": kept, and flagged here as known-brittle.
• Exhaustive-count assertions (updateStoredRecentFiles( ×3, discardUnsavedBuffer: true ×2). These close over an enumerated list — "these three, shown above, and no others" — which is the legitimate single-implementation shape, unlike emitted.length === 3, which enumerated nothing.

Verification of the verification

Each of the 18 changes lists which mutation proves the replacement still fires; every mutation was reverted with git checkout. Independently re-run here: a legal rename (npm run check 0 errors, proving it compiles) leaves 501/501 green, and breaking mermaid.render plus planting a duplicate theme ternary in export.ts turns 2 tests red.

npm run check   435 files, 0 errors
npm test        501 / 501
cargo test      131 / 131

Not covered

• The behavioural half of the sanitizer story still cannot run under node (DOMPurify needs a real DOM); previewSanitize.test.ts still records a browser-measured result in a comment.
• Two markers remain heuristics a determined rewrite can evade (return 'plaintext', --highlight-color:). Strictly better than the private names they replace, but grep-based single-implementation rules are heuristics, not proofs.
• lossyDecodeSaveGuard.test.ts has the same smells but is being rewritten in fix(tabs): ask the filesystem whether two paths name the same file #416; left alone to avoid a conflict.
• Making .svelte logic importable — extracting getLanguage and friends into src/lib/utils/ — would be the real fix for a whole tier of these tests. That is production surgery and out of scope here.

🤖 Generated with Claude Code