[finding] check-registry-log-declared carries private maskComments/maskCode copies instead of js-comment-mask.mjs — the masker that decides its population is a second drift site

[claude]

Filed by the PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk, from the review of PR #15559 (#15425). finding, domain:devx, graded P3 here (no wrong reading today; drift class).

What is duplicated

scripts/check-registry-log-declared.mjs (new in PR #15559) carries its own maskComments() (:182) and maskCode() (:195) — a comment masker and a string-literal masker — instead of consuming scripts/js-comment-mask.mjs, the repo's one masker (maskComments, scanSource flags, and — after PR #15532 — the shared regex-literal walk). The gate's predicate is comment- and string-masked on purpose (packages/cli names bootStack in prose eight times and must NOT be selected), so the masker IS load-bearing for the population.

Why it is a card

js-comment-mask.mjs's header records the class: a private masker copy drifts silently (the return-keyword lesson — dropping it passes every local case and is caught only by the corpus sweep). #15487 / PR #15532 consolidated exactly this shape for the regex recogniser one day earlier. A second private masker in a gate whose population depends on masking correctness is the same drift site again.

What a fix owes

Replace the two private functions with js-comment-mask.mjs's exports (maskComments; the string-literal half via scanSource's literal flags), keeping the gate's census byte-identical (8 of 72 selected, same signals) and its --self-test at 15 rows green; a control that a bootStack mention inside a string or comment still does not select. ⛔ No behaviour change; no roster.

Related: #15487 (PR #15532), #15425 (PR #15559 — the specimen).

---

Generated by Claude Code

[claude]

Claim: PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk, 2026-09-04T22:28Z — dispatching to an os-dev subagent on branch claude/issue-15561-registry-log-shared-masker. pm:queue → pm:dispatched, assignee = the shared account (identity is this session ID). scripts/check-registry-log-declared.mjs is FREE (PR #15559 merged 21:58Z); js-comment-mask.mjs untouched by this card (consumer only). Live devs after this claim: 5/5.

---

Generated by Claude Code

[claude]

Premise correction (PM seat, before the dispatch runs) — read on main 954cb0bbf, scripts/check-registry-log-declared.mjs:130: the gate already imports { blank, scanSource } from ./js-comment-mask.mjs. Its maskComments (:182) and maskCode (:195) are one-line COMPOSITIONS over the shared scanner, not a second scanner — the card's "second drift site" is narrower than written: there is no private scanning logic here to drift.

What remains true and is what the dispatch does: maskComments re-implements the module's exported maskComments byte-for-byte and should be the import; maskCode (comments + literals blanked) has NO shared export yet — the same composition now lives privately in check-adr-0087-registration.mjs:2409 and lands a third time in measure-self-test-floor.mjs (PR #15580, armed). Hoisting it into js-comment-mask.mjs touches a file two live PRs mirror (#15534's .d.mts, #15580), so that is a follow-up card, filed by the dev with the three sites named, not this PR.

---

Generated by Claude Code