test(mcp-server): the premium census counts code, not comments, so a comment cannot hide a new ungated read - #470

Board: task_1790076280813_v7c1 (P2, security). It asked for four things, and this does them:

• each drifted census entry classified as a real read or a comment;
• real reads gated;
• comments no longer counted, proven by a comment that does not fire;
• green on the current head, with an added ungated read still red.

What was wrong

premium-exit-guard.test.ts guards against the next premium-leak exit. It counts every place in three servers that reads knowledge rows and compares the counts with a reviewed list. It counted text, so comments counted as reads. #390 (6f2504d94) made it green on main by listing those comment mentions as rows, for example "the path appears in a comment". The census itself still counted comments, and that cut three ways:

1. False alarm. A new comment quoting a call shape turned the census red.
2. A hole. Swap such a comment for a real, ungated read in the same file, and the count stays the same, so the census stays green. That is exactly the new exit it exists to catch.
3. A second hole. A gate named only in a comment passed "every listed gate is really there".

What changes

• Comments are blanked before counting. withoutComments does this with the TypeScript parser:
  • a // inside a string, a template, a regex, or JSX text (what a page shows) stays code;
  • line numbers are kept, so a failure still points at the right line.
• A gate must be named in code as a whole identifier (namesSymbol). A comment, or a longer name such as premiumTeaserCache, no longer counts.
• The Studio proxy checks read the proxy's code, not its comments.
• The file stays fast. Only files that one of the read patterns could match at all are parsed.

The list. 25 mentions stop counting, and every one was checked by hand to sit in a comment. Each is a // or * line, such as route doc headers and "Mirrors HoloMesh ... POST /api/holomesh/quickstart". No real read was lost: for example, knowledge/query/route.ts:6 (a URL string) still counts.

• 14 counts go down.
• 6 comment-only rows are removed: marketplace rate and ratings, the knowledge/query route's HoloMesh row, the knowledge/sync route, studio/quickstart, and the db/schema HoloMesh row.

Verified

The census on real source. 10/10: the 5 existing checks plus 5 new tests that pin the blanking.

Before and after, on a scratch copy of the scanned trees (PREMIUM_EXIT_GUARD_ROOT), one planted change at a time:

The new tests, watched failing, one break at a time:

• tsc is clean (pre-commit gate).
• Prettier: the file had 5 formatting differences on main (the one-row-per-line SITES layout), and it still has exactly those 5. This change adds none.

Round 2: the pre-review (head 0fbb60a)

The same seat's pre-review (not the distinct-seat review) found no P0 or P1. Its independent recount agrees with the blanking on all 107 file/read keys across 2,031 files, and found no over-blanking in real source. Its four smaller points are fixed:

• P2: the JSDoc skip was untested. Without it, /** Uses {@link Y} // note */ const g = () => queryKnowledge(x); counted 0. A test now expects 1.
• P3: a read with a block comment inside it (queryKnowledge/* why */(q)) was never parsed, because the filter read the raw text. The filter now also tries the text with block comments removed. A test reads such a file through codeOf and expects 1.
• P3: the whole-name rule for gates was untested. old_premiumTeaser(x) must not name premiumTeaser, and the gate test now asserts it.
• P3: the count was wrong. The census drops 25 comment mentions, not 30 (18 from the 14 lowered counts, 7 from the 6 removed rows). Corrected above.

Watched failing, one break at a time:

The real code passes 12/12. Prettier leaves this file with the same 5 differences it has on main.

Review

A distinct seat is needed. The author is claude1 / claudecode-claude-x402. The census was last changed by #390, from this same seat, so a reviewer from another seat is wanted: claude3 or claude2 (mcp-server).

🤖 Generated with Claude Code