fix(gates 2, 21, 35, 36): three false positives and one blind spot, both arms fixtured

[rubenvdlinde]

Fixes three false positives and one blind spot found by the gate audit. Do not merge without Ruben — a gate change moves the verdict for all eighteen apps at once.

Why this is security work

A gate that cries wolf gets its silences believed. That is not a slogan: gate-7 reported zero IDORs in all eighteen apps for months because its known failure mode was false positives, so every agent who met it learned to distrust its findings and therefore to trust its quiet. One hundred and sixty-seven real ones sat in the tree. Three of the four repairs here remove a false positive, and that is the route by which they matter.

The four

gate-2 forbidden-patterns flagged private function exit(). die and exit are semi-reserved in PHP — illegal as free function names, legal as method names — so the construct pattern saw the parameter list's opening bracket and reported the one position where the identifier is definitionally not a call. The call sites $this->exit() and self::exit() and the property $exitCode were already silent, so the gate was quiet everywhere it might have been right and loud in the one place it could not be. Fixed by computing the name offsets of every function header and skipping a construct match that starts exactly there. A construct in that method's body still fires, and so does one in a method merely named exitEarly().

gate-21 conflict-markers flagged a seven-character Markdown setext H1 underline, which is byte-identical to git's separator under the anchored pattern. In Markdown only, a bare separator with no angle-bracket marker anywhere in the same file is now read as a heading. Every other file type is untouched, which is where all three incidents this gate was written for actually happened. A second, independent defect in the same block: the enumeration named appinfo twice, so find walked it twice and a conflicted appinfo/routes.php — one of those three incidents — was reported as two files.

The brief asked whether this gate's use of find rather than git ls-files, unique in gates one to twenty-one, is intended. Decision: keep it, and say so in the code. An unstaged conflicted file is a real state on shared checkouts, and switching to the tracked-file enumeration would narrow the true-positive class to buy consistency. The reason is now written into the block rather than left as an unexplained asymmetry.

gate-35 img-alt-empty-only was blind. The noun list was word-boundary anchored, and U is a word character, so avatarUrl, thumbnailUrl, photoUrl and pictureUrl could not match; underscore is a word character too, so avatar_url was invisible for the same reason. On a seven-image probe in which every image was a violation, the gate found three. The source expression is now tokenised on camelCase and punctuation boundaries and compared for token equality. Equality rather than substring is the load-bearing choice — a relaxed substring match lights up photographerBio, gallery.pictures and thumbnails, all of which are correct code, and that is exactly how the next gate earns the reputation this PR exists to undo.

gate-36 tabindex-positive, the last raw grep in its family, reported a comment warning against positive tabindex as a positive tabindex — the gate-32 shape, where the better a team documents a rule the redder its repository goes. Comments are now masked. Deliberately comments only, not the markup scope: focus order is a property of the rendered DOM whoever emitted it, so script blocks, PHP code and .js files all stay in scope. Removing the noise by removing detection would not be a repair.

gates 35 and 36 move into check_markup_a11y.py, joining 31 and 32 for the reason those moved.

Measurement

On one fixture tree with only the gate package changed, gate-2 goes from three findings to two, gate-21 from five to three, gate-35 from three to seven, gate-36 from three to one.

On openregister and pipelinq, both at their development tips, all four gates are clean before and after the change — so the before/after on real repositories is zero to zero, and a repair that had silently narrowed detection would be invisible in that number alone. The load-bearing measurement is therefore the planted one: with true positives committed into both repositories, the pre-repair package misses the planted image entirely and reports the planted comment, while the repaired package names the real subject in each of the four gates, identically in both apps.

Live exposure is zero for all four defects, positive-controlled across all eighteen fleet apps. No method is named after a language construct; there is no seven-character setext underline; there is no positive tabindex value anywhere; and there are seventeen image-tag occurrences fleet-wide, of which three are documentation prose and exactly one carries an empty alt, correctly silent both before and after. These repairs buy trustworthiness, not a closed defect. Please do not read urgency into them.

Acceptance coverage

Two new repo-shaped bundles under gate-acceptance/. The ratchet moves from thirteen fixtured gates to seventeen and the four rows leave UNCOVERED.md.

There are two expect.conf rows per gate, because the driver grades a verdict plus a named subject and never a count. With all of a gate's true positives in a single file, switching a whole rule off still produces a failure naming that file and the suite stays green — measured while authoring these bundles, not assumed. Each row now names a file holding exactly one mechanism.

Eight deliberate breakages were run, each verified to have landed before its result was believed, and each turns the suite red. They include both over-corrections a reviewer should worry about: exempting every Markdown separator, and widening the noun match to a substring. One prediction was wrong — substituting the markup scope for the comments-only mask reddens the clean arm rather than the planted one, because the extension dispatch sends .js somewhere that does not understand // — and that correction is recorded in the fixture rather than tidied away.

The full helper-suite runner reports seventy-four passing, two quarantined, and one failing. The one failure is test_gate_45_to_55_acceptance.sh, which fails identically on the unmodified base with ajv is not resolvable; the two logs differ only in the absolute path. It is the known needs-external dependency, not this change.