fix(gate-acceptance): a subject that another finding contains is not a subject

[rubenvdlinde]

A bundle that stays green over a reverted fix is not evidence of anything

Three of the ten acceptance bundles could not detect the regression they exist to
prevent. All ten go red on a full revert — which is the test anybody actually runs,
and which is why nobody noticed. Three were blind to a partial one, and one of those
was blind to precisely the defect it was built for.

This PR touches only hydra-gates/scripts/test-fixtures/gate-acceptance/. No checker,
no runner, no driver. The driver (test_gate_acceptance_matrix.sh) needed no change at
all — see "the anchor" below.

The general fix: close the subject on the RIGHT

#380's remedy was one mechanism per named file. That is a special case, and it would
not have caught authn-vs-authz, whose three plants legitimately belong in one
controller — the fixture's whole argument is that they differ from each other only by
the preamble.

The real invariant is that a subject must be unsatisfiable by every OTHER finding the
bundle can produce. _names is grep -qF, and gate-7's log line is
path:LINE method=NAME rule=RULE. So method=preamble is contained in
method=preambleForbiddenCode, and a method name is a prefix of every longer method name.
Every subject here is now closed on the right by its rule=… / calls a service method
field, with one row per arm.

Three controls, run before any edit:

grep -qF 'method=preamble rule=no-auth-guard-in-body'  <preambleForbiddenCode line>  -> rc=1  ✅
grep -qF 'method=preamble rule=no-auth-guard-in-body'  <preamble line>               -> rc=0  ✅
grep -qF 'method=preamble'                             <preambleForbiddenCode line>  -> rc=0  🔴 the bug

⚠️ A trailing space would not have worked — read strips trailing IFS whitespace from
the last field, so method=preamble collapses back to method=preamble and the bundle
stays vacuous while looking fixed. The anchor has to be a token.

What changed

bundle	rows	mechanisms	named files
authn-vs-authz	1 → 3	3 (bare · 401 preamble · 403 preamble)	1
auth-guards	1 → 2 (was the file path)	1 × 2 instances	1
exception-translation	1 → 2	2 (destroy header-binding · purge docblock span)	1
🆕 comment-silenced-guard	2	3	2

🆕 comment-silenced-guard — the third gate-7 blindness had no fixture at all

Of the three ways gate-7 was proven blind, the comment-silenced guard helper was
covered only by unit tests. That is exactly the layer this suite's own header argues is
insufficient:

gate-7 has 86 unit tests. All 86 passed. The gate was still wrong.

Three mechanisms, two named files, three separate reverts:

• A — the body test reads comment-free text. hermiq's loadOwnedAgent() contains
  no throw statement at all; the word appears only in a comment explaining why it
  catches one, and that sentence cleared all four routed methods.
• B — a throw must name an authorisation exception. opencatalogi's
  getObjectService() — 36 controller files across 7 apps — throws when OpenRegister
  is absent, and so cleared every caller.
• C — an ownership comparison answered with null is recognised, so the narrowing
  costs no true clear. This one only shows in the clean/ arm.

Both arms keep the comment and keep the locator verbatim. #373 did not make prose
illegal, it made prose uncountable — an arm that had also deleted the sentence would
have passed against the broken checker too.

Structurally modelled on gate-65's probe suite: greps a rule name, never a file name,
so a no-op plant leaves the fixture clean and the probe goes red.

Every repair is proven by reverting the fix it defends

Twelve probes. Twelve predictions written before the run. Twelve matched exactly —
count and the identity of every failing assertion. Baseline 52 → 70 assertions, 0
failed.

probe	revert	predicted	got
1	#365, 401 half only — the "just delete 401 from it" repair	69/1, method=preamble	✅
2	#365, 403 half only (the mirror)	69/1, method=preambleForbiddenCode	✅
3	#365 full	68/2, bare survives as liveness control	✅
4	drop multi-parameter methods → lose update()	69/1	✅
5	off-by-one, lose first finding per file	62/5, all five named in advance	✅
6	gate-49 METHOD_RE unbounded docblock	66/2	✅
7	_method_bodies(src)[1:] → lose destroy()	69/1	✅
8	[:1] → lose purge()	69/1	✅
9	mechanism A (body = src[...])	69/1, method=rotate	✅
9b	pure-prose control — A reverted and the comment deleted	back to 70/0	✅
10	mechanism B (bare \bthrow\b)	69/1, method=show	✅
11	mechanism C	68/2, clean/ arm, FAIL — 2 method(s)	✅
12	A+B+C	66/4, clean shows 1 method(s)	✅

Probes 4 and 7 are the two the vacuity audit measured at 28 passed / 0 failed —
green over the exact defect. They are now 1 failure each, naming the lost plant.

Probe 9b matters on its own: gate-7's routed-method scan still reads comment-bearing
text, so an explanatory docblock in a fixture can clear the very method the fixture
plants. With mechanism A reverted, deleting only the two comment lines restored the
finding — proving the silencer is the comment and nothing else in the file. Every
per-method docblock in the new fixture is austere for that reason; the explanation lives
in the file header, outside every method body span.

⚠️ A trap for the next person adding a bundle

The new fixture's first run reported NOT APPLICABLE — scope was empty — 0 lib/Controller PHP file(s) because the files were untracked — gate-7 enumerates via git ls-files.
An untracked bundle is not a failing bundle, it is an absent one, and its clean/ arm
goes green because nothing was inspected. Stage a new bundle before measuring it.

Scope, honestly

• publicpage-scope, contract-coverage, license-triangle, prose-not-proof,
  relation-dialect were audited sound and are untouched.
• a11y-noise and debug-and-conflict (#380) have not been revert-audited by
  anyone. They were authored with the one-mechanism-per-file remedy, which this PR shows
  is necessary but not sufficient. Next job.
• The wider comment leak is still open by design — scan_file matches _GUARD_BODY_RE
  against comment-bearing text, so a comment in a routed method containing
  Http::STATUS_FORBIDDEN / , 403) still clears it. This bundle pins the helper path
  only, and says so in its header.
• Coverage is unchanged at 22 of 65 gates fixtured. "The acceptance matrix is green"
  is still a statement about 22 gates, not 65.

🤖 Generated with Claude Code