[bug] jsx-tags.ts does not treat a backtick as a delimiter, so one apostrophe in a template literal drops a whole tag from two source guards

[serge-ivo]

One apostrophe in a template literal deletes a whole tag from two source guards

store/console/src/lib/jsx-tags.ts:67:

if (c === '"' || c === "'") quote = c;

A backtick is not tracked as a string delimiter. So inside a template literal, an ordinary apostrophe — title={`the agent's runner`} — opens a quote state that the closing backtick never clears, and the scanner swallows the rest of the tag.

The consequence is not a parse error. It is a silently smaller input: the <button> simply is not seen, so the control-shapes ratchet and the design-token guard both pass while measuring less than they claim.

Found by the #530/#531 lane, which hit it on a real title string. Not folded into #531 — that issue is closed and this is a different file with a different blast radius.

Why this matters more than its size

This is the third guard found lying in one day, and all three failed the same way — green while measuring nothing:

• the [bug][mobile] Copy and Delete sit on top of the message timestamp — 42px of 110px covered in WebKit, and removing the year only recovers 30px #426 mobile-overflow guard — with both layouts in the DOM, an aria-label query found a display:none element with a zero rect and opacity 1. Fixed under In-session feedback capture: an owner's complaint should land as a durable, turn-anchored record — today it lands in memory or nowhere, and the turn it is about is not addressable #514 by adding data-msg-action and measuring what is painted.
• runnerPanel.ts's tile invariant — its own header promised the tile was derived from both readings, but machinesToShow merged them only for the synthesised tile, and the test iterated only the pinned node. Fixed under [bug] A "Runs on" tile claims "Attached · online" for a node the pin excludes — one line below "Status: Offline", and the invariant test only covers the pinned tile #531.
• this one — a lexer that loses a tag on a legal character.

A guard that under-reports is worse than no guard, because the number it prints is trusted. check-file-size.mjs, check-design-tokens.mjs and check-bare-catch.mjs all exist because someone was surprised; a guard that quietly measures a subset re-opens exactly the ground those were written to hold.

Acceptance criteria

1. A backtick is tracked as a string delimiter, and ${…} interpolation inside one is handled (an apostrophe inside an interpolated expression is a third nesting case — decide it deliberately).
2. A fixture with title={`the agent's runner`} is counted by both consumers of this module.
3. The fix is proven non-vacuous the way the other two were: assert the tag count rises on that fixture against the current lexer, so the test fails before the fix.
4. Check whether the tag count changes across the repo once fixed. If it does, the pinned numbers in the guards that consume this were set against an undercount and need re-pinning with that stated — not silently adjusted.

Verified

jsx-tags.ts:67 reads exactly as quoted. That both consumers under-report as a result is the lane's report and follows from the lexer, but I have not measured the repo-wide delta — criterion 4 exists to establish it.

[serge-ivo]

Criterion 4, measured: the console pin is an undercount by exactly one, and 33 tags are invisible today

Measured at cfe8ff7 by running the real scanTags against a copy patched only at line 67 (backtick added to the delimiter set, plus backslash escapes), over every .tsx in the three trees the two consumers sweep (store/console/src, store/admin/src, agents/coder/web/src, 107 files):

tree	tags now	tags with backtick tracked	invisible
store/console	5472	5473	1
store/admin	1947	1979	32
agents/coder/web	967	967	0

2 of 107 files are mis-lexed; 33 tags never reach either guard.

The pinned number that is wrong

store/console/src/lib/control-shapes.test.ts pins hand-authored control shapes at 42. The tree holds 43. The missing one:

store/console/src/tabs/TmuxTab.tsx:390   px-2 py-2 rounded-lg

The apostrophe that hides it is 23 lines further down, inside that button's own onClick:

store/console/src/tabs/TmuxTab.tsx:413

setError(`Couldn't remember ${key} as your ${noun} — it will reset when you reload. …`);

So the ratchet's own headline — "the console is DONE, which is a different statement from '42 left'" — is a count taken over a subset. The re-pin is 42 → 43, and the note beside it should say the extra one was always there rather than newly added, or the next reader will read it as a regression that landed.

findHandAuthoredCards (33 / 3 / 9) and all three control-labels sweeps (unlabeled 0, placeholder-only 0, mouse-only 0) are unchanged under the fixed lexer. So the emptiness assertions are still true — they were just being asserted over less than they claimed.

The admin case is the one that shows the blast radius

store/admin/src/pages/UserDetail.tsx:139

description={`Deletes this user's stored ${k.provider} key. …`}

That <DangerAction> tag body is scanned as 3491 characters spanning lines 137–216 — one tag swallowing 79 lines, i.e. 32 tags including a <label>/<input> pair at 186–188 that no a11y sweep has ever looked at. It happens to be correctly wrapped in its label, which is luck, not coverage.

A second-order hazard worth an acceptance criterion: control-labels.ts tracks labelDepth by counting <label> opens and closes. A swallow that eats a </label> but not its <label> leaves the depth stuck above zero, and every subsequent control in that file is then scored via: "wrapping-label" — named, silently. I measured the label balance per file under both lexers and it is 0 either side today, so this has not fired; but it converts a lost tag into false negatives across the rest of the file, which is worse than losing the tag.

One correction to the issue body

The consumers are control-labels.ts and control-shapes.ts (both call scanTags) and toolLiterals.ts — which imports maskComments only (toolLiterals.ts:24), and maskComments is regex-based and does not use the quote variable, so it is unaffected. scripts/check-design-tokens.mjs has its own scanner in scripts/lib/design-tokens.mjs and does not go through this file, so the design-token guard is not among the under-reporters here.

Reproduce

Copy jsx-tags.ts, control-shapes.ts, control-labels.ts to a scratch dir, change line 67 to

if (c === "\\") { j++; continue; }
if (c === '"' || c === "'" || c === "`") quote = c;

(the same escape skip inside the if (quote) arm), then run both copies over the three trees and diff by tag index. Node 26 runs the .ts files directly.

Note for criterion 1: treating a backtick as a plain delimiter is what I measured, not necessarily what should ship — it makes ${x > 1 ? a : b} string content, which is harmless here because a > inside an interpolation was already not a tag end (the depth counter covers it), but a nested template inside ${…} would still mis-pair. Deciding that case deliberately is criterion 1's point.

[serge-ivo]

Landed as 1342c4f, on top of ADR 0002 (e021910). CI green.

Criterion 1 — the third nesting case, decided. findTagEnd is now a stack, not a flag plus a counter: " and ' are strings with escapes, ` is a template with escapes, and ${…} re-enters CODE. Your note was right that a blanket backtick delimiter is not necessarily what should ship — it fixes the reported apostrophe and still mis-pairs a template nested inside an interpolation, and it hides a stray brace inside ${…} from the depth count. Re-entering code is what workers/api/src/lib/source-guard.ts does and the only rule that composes to arbitrary depth. Both cases have a test.

Criterion 2 — both consumers see it; there is a fixture in each suite, not only in the lexer's own test.

Criterion 3 — proven non-vacuous by watching it fail (ADR 0002 G4). With findTagEnd reverted to the pre-fix quote flag, 17 tests go red: the four delimiter tests, the console pin, the admin denominator, the consumer-level apostrophe fixture in both suites, and the label-balance arm. Restored, all 74 pass.

Criterion 4 — re-pinned, with it stated. store/console 42 → 43, and the comment above the pin says the forty-third (tabs/TmuxTab.tsx:390 px-2 py-2 rounded-lg) was always there rather than newly added. Your measurements reproduced exactly: admin 1979 tags, coder/web 967, and console 5473 once the other lane's uncommitted Usage.tsx (+21 tags) is taken out. Cards 33/3/9 and all three control-labels sweeps unchanged.

One finding beyond the issue: the continue at :72 was LIVE, not just latent

The issue reads it as the thing that converted a lexer bug into an under-count. It was doing more than that — it was firing on the real tree today. Restoring the old lexer with the new throw in place reports:

tabs/TmuxTab.tsx: jsx-tags: <button> at line 390 is never closed — the scan ran to the end of the file.
  near: <button key={targetKey(s)} type="button"

So the two files failed by two different mechanisms: the console's button ran to EOF and was dropped by continue (1 tag lost), while the admin's <DangerAction> terminated at a later > and swallowed the region (32 tags lost). Had that continue been loud, this would have failed on the day the apostrophe landed.

Your second-order hazard is now an assertion

The labelDepth observation was the sharpest thing in the comment, so it got a guard rather than a note. assertMeasurable (new store/console/src/lib/tsx-trees.ts, which now owns the tree walk both suites used to duplicate) asserts four things per tree:

1. a floor on files and tags — catches a lost tree, and explicitly does not claim to catch a 33-in-1979 swallow;
2. a bound on how many lines one opening tag may span — this is the swallow detector, and it needs almost no tuning: the longest real tag in the three trees is 28 lines, the mis-lexed one was 79;
3. <label> balance per file — your hazard. Measured at 0 in all three trees before and after, so it is a guard against the next lexer change rather than a finding;
4. that scanTags did not throw.

Both suites print the denominator in the passing output (ADR 0002 G2):

↳ store/console: 69 .tsx files, 5494 tags, longest tag 28 lines, 183 named-or-not form controls

Also in this commit

• scripts/lib/bare-catch.mjs:118 (if (close === -1) continue;) throws, with a note distinguishing it from the catch method skip four lines above, which is the guard working. check-bare-catch.mjs prints its file count and fails when a tree's walk finds none.
• jsx-tags.ts gets the unit test it never had, including two tests naming what it does not handle (a tag inside a string literal, and a TypeScript type argument — it counts both).
• ADR 0002 linked from both scanners' headers.

Correction to your correction, adopted: toolLiterals.ts imports only maskComments, which is unchanged, and the design-token guard has its own scanner — neither is affected. Confirmed.

Not run: Playwright. Nothing here reaches the console bundle — maskComments untouched, scanTags/tsx-trees.ts imported only by tests, and assertMeasurable/node:fs verified absent from the built bundle.js. Console 200 and API 200 in production after the host deploy.