Finding (surfaced during #388)
While fixing #388 (the boundary checker flagging generated bundle leftovers), a source-gap audit of scripts/check-boundary.mjs surfaced a latent fragility in the Rule 2 / Rule 2b bare-path scan — orthogonal to #388, not triggered by any file in the tree today.
The gap
quotedLiterals treats a backtick as a quote character and matches any whitespace-free span between two quote chars. Its whitespace-exclusion heuristic (scripts/check-boundary.mjs:177-180) is meant to let a sentence that merely mentions a spec path pass (spaces between the quotes exclude it) while catching a real bare-path filesystem argument. But the repo's own house style backtick-quotes file paths in prose, and a backtick-quoted path is whitespace-free — so a backtick-quoted spec path inside a runtime string literal (not a comment — comments are stripped) would fire Rule 2b even though it is documentation prose, not a filesystem read.
Why nothing fires today
Every current occurrence is in one of the safe categories:
- backtick citations in comments → stripped before the scan;
- spec-path mentions in runtime strings are space-delimited sentences → excluded by the whitespace rule (e.g.
normalize-to-canonical.js:593/:750 See DESIGN.md "...").
The near-miss: packages/enscribe/src/master-document/book-scaffold.js:216 puts notes/specs/book-navigation.md in a diagnostic template literal, saved only by not backtick-quoting it. If any such diagnostic were restyled to the repo's backtick convention (`notes/specs/book-navigation.md`), Rule 2b would fire on a mention that is not a filesystem read.
Severity / disposition
Low. The failure direction is loud red, not silent green — it self-announces, consistent with the guard's declared over-fire-rather-than-silent-skip posture. It is fixable when/if it bites, either by rewording the diagnostic or via a RULE2B_ALLOW entry. Filing for the paper trail rather than fixing now: the fix would touch the Rule 2b scan logic (outside #388's fences of the filename skip), and no code triggers it. A future hardening could make quotedLiterals backtick-aware (treat a backtick-delimited span as prose, or require the matched quote chars to pair), but that is a scan-semantics change to weigh on its own.
Finding (surfaced during #388)
While fixing #388 (the boundary checker flagging generated bundle leftovers), a source-gap audit of
scripts/check-boundary.mjssurfaced a latent fragility in the Rule 2 / Rule 2b bare-path scan — orthogonal to #388, not triggered by any file in the tree today.The gap
quotedLiteralstreats a backtick as a quote character and matches any whitespace-free span between two quote chars. Its whitespace-exclusion heuristic (scripts/check-boundary.mjs:177-180) is meant to let a sentence that merely mentions a spec path pass (spaces between the quotes exclude it) while catching a real bare-path filesystem argument. But the repo's own house style backtick-quotes file paths in prose, and a backtick-quoted path is whitespace-free — so a backtick-quoted spec path inside a runtime string literal (not a comment — comments are stripped) would fire Rule 2b even though it is documentation prose, not a filesystem read.Why nothing fires today
Every current occurrence is in one of the safe categories:
normalize-to-canonical.js:593/:750See DESIGN.md "...").The near-miss:
packages/enscribe/src/master-document/book-scaffold.js:216putsnotes/specs/book-navigation.mdin a diagnostic template literal, saved only by not backtick-quoting it. If any such diagnostic were restyled to the repo's backtick convention (`notes/specs/book-navigation.md`), Rule 2b would fire on a mention that is not a filesystem read.Severity / disposition
Low. The failure direction is loud red, not silent green — it self-announces, consistent with the guard's declared over-fire-rather-than-silent-skip posture. It is fixable when/if it bites, either by rewording the diagnostic or via a
RULE2B_ALLOWentry. Filing for the paper trail rather than fixing now: the fix would touch the Rule 2b scan logic (outside #388's fences of the filename skip), and no code triggers it. A future hardening could makequotedLiteralsbacktick-aware (treat a backtick-delimited span as prose, or require the matched quote chars to pair), but that is a scan-semantics change to weigh on its own.