fix(gate-45): a commented-out universal reset silenced the gate for the WHOLE repo (#421)

[rubenvdlinde]

Closes #421.

The defect

The per-file checker masks comments before it looks for motion or for a guard (_mask_comments, #294). The global pre-pass that computes HYDRA_RM_GLOBAL_GUARD did not — it grepped the UNIVERSAL regex over raw file text. Two halves of one gate disagreeing about what a comment is, and the careless half runs first.

That flag makes the per-file checker sys.exit(0) on every file in the repository. So this is not one missed finding: one comment, in one stylesheet, anywhere in the tree, silenced gate-45 for the whole app — and the comment that does it is the one an author writes while acknowledging the a11y debt.

Reproduced on c26f9a3 — one fixture, one variable

css/motion.css with two real unguarded motion declarations, plus a css/reset.css whose only universal reset is inside a comment:

arm	verdict
the /* TODO(a11y): … @media (prefers-reduced-motion: reduce) { *, … } … */ comment present	PASS ← the defect
the same tree, comment deleted	FAIL — 1 stylesheet with motion
a real universal reset in css/reset.css	PASS ← positive control: the pre-pass does set the flag on real CSS

The third arm is what makes the first mean anything. It was run before the fix, per the issue's request.

The fix

Route the pre-pass through the same masking _mask_comments already applies, character for character, including the (?<!:) that keeps the // of a url(https://…) out of the SCSS arm.

The two copies are separate python3 invocations and cannot share a function; arm 9d pins them together so they cannot diverge again.

Acceptance — 5 new arms in test_gate_45_stylesheet_scope.sh

Run against this branch: all 13 arms green.
Run against origin/main's runner (HYDRA_GATES_RUNNER_UNDER_TEST=, i.e. a real revert, not git checkout --): 2 failures, and they are the two evidence arms.

arm	before	after	role
9a /* */-commented reset does not globally guard	PASS (wrong)	FAIL	evidence
9b same tree, no comment	FAIL	FAIL	control
9c a real universal reset (with a comment above it) still guards	PASS	PASS	anti-widening control
9d1 //-commented reset in SCSS does not guard	PASS (wrong)	FAIL	evidence
9d2 the // of a url(https://…) does not eat the reset beside it	PASS	PASS	control

9c is the arm that would catch a mask that ate CSS instead of comments and turned this gate from silenceable into always red.

Fleet numbers — 6 repos, whole-tree scope

gate-45 is not a delta gate, so a whole-tree run exercises it. Six fresh development clones: procest, opencatalogi, openregister, softwarecatalog, docudesk, larpingapp.

Unplanted: PASS, 0 findings, in both arms, all six. That agreement is explained, not assumed — measured at the pre-pass layer, no repo in the fleet has a universal reset at all today, by comment or by real CSS (RAW=0 and MASKED=0 in all six), so the flag was 0 in both arms and there was nothing for this change to alter.

Positive control on the real trees — plant the #421 shape (css/_g421_probe.css with unguarded motion + css/_g421_reset.css whose reset is only inside a comment) into each repo and re-run both arms:

repo	base	this branch
procest	PASS	FAIL — 1
opencatalogi	PASS	FAIL — 1
openregister	PASS	FAIL — 1
softwarecatalog	PASS	FAIL — 1
docudesk	PASS	FAIL — 1
larpingapp	PASS	FAIL — 1

Exactly one finding each — the planted probe, named by path — in trees that contain 9–29 files declaring transition:/animation:. Nothing widened.

Layer

Verdict layer, via the shipped runner, on real fleet trees. Not a helper-only claim.