fix(#498,#455): close two confirmed false negatives in PR #554's gates

[BorisTyshkevich]

What & why

Follow-up to a review of #554. Three claims were raised against it; all three are correct, and I verified each by experiment rather than by reading. Two are real false negatives — each gate passed while the thing it guards was removed.

1. The CSS contract accepted comment prose as a stylesheet rule (confirmed)

Both class scanners ran their selector regex over raw src/styles.css, so a class merely named in a comment counted as styled. The file already computes a comment-stripped declarations for precisely this reason — prose mentioning a px value must not read as a declaration — but selector extraction never used it.

The masking is real in the shipped stylesheet: each confirm menu's comment cross-references its siblings, so .dash-tree-confirm's prose names .qtab-close-confirm* and .dash-tile-confirm* (src/styles.css:1840), and .qtab-close-confirm's names .dash-tree-confirm* (:2010).

Experiment: deleted both real .qtab-close-confirm rules, left the comment.

before fix → Test Files 8 passed | Tests 338 passed (338)   ← rule GONE, gate green
after  fix → AssertionError: expected [ 'qtab-close-confirm' ] to deeply equal []

#498's own sabotage test missed this because its target, dash-tile-menu-danger, happens to be named in no comment — the reviewer's counterargument on that point is also exactly right.

Both scanners now share one styledClassNames() built from declarations. A second sabotage test pins the specific regression: it asserts the old raw-CSS scan would be fooled by the comment and the current one is not, so the fix cannot silently revert.

One genuine pre-existing gap fell out of this: dash-row (src/ui/dashboard.ts:2654) has no CSS rule and never has — it was only ever "covered" by the two comments naming it, so the pre-existing scanner had been leaking too. That one is correct by design: .dash-grid's own comment spells out that each row owns its column count "set inline by the flow renderer" and that the container must not impose grid-template-columns or the rows lay out side by side. A .dash-row rule would duplicate the inline style or reintroduce that bug, so it joins ALLOWED with that rationale instead.

2. The src/core boundary rule was not actually enforced (confirmed)

tests/unit/dashboard-boundaries.test.js re-implements the import walk instead of exercising build/check-boundaries.mjs.

Experiment: deleted the production src/core entry from RULES.

unit suite   → 61 passed (61)                                        ← nothing red
check:arch   → OK (105 files across 8 active rules, no violations)   ← note: 8, not 9

#455's entire deliverable was removable without a single failure. A text-read assertion now binds the mirror to the production rule, with a named failure message. Read as text rather than imported on purpose: the checker runs its whole gate at module top level and exits non-zero, so importing it would run the production gate inside the test process. With the fix, deleting that entry fails as build/check-boundaries.mjs has no 'dir: src/core' rule — #455 regressed, and check:arch is back to 9 active rules.

3. The unit test mutated src/core on disk (confirmed, minor)

The probe wrote a real .ts file into src/core and removed it in finally — which a crash or kill between the two would have left behind, and which file watchers see. The walk now accepts virtual [path, source] entries, so the probe exercises the same logic with the working tree untouched.

Verification

npm test → 201 files / 6661 tests passed. npm run build → OK. npm run check:arch → OK, 9 active rules. Every sabotage above was restored byte-identically (git diff --quiet checked, never git checkout --).

Refs #498, #455, #554. No behaviour change — src/styles.css and all production code are untouched; this PR only changes two test files.

Checklist

• npm test passes (the per-file coverage gate is non-negotiable)
• Tests added/updated in the same change as the code
• npm run build succeeds (single-file dist/sql.html)
• Layers kept honest: pure logic in src/core/, network in src/net/ (injected fetch), DOM in src/ui/
• No new runtime dependency
• README / CHANGELOG.md ([Unreleased]) updated if behavior or the deployed surface changed — n/a, test-only
• Reconciled affected tracked work (roadmap Roadmap to 1.0.0 #68, the issue body, ADR/CHANGELOG) if this change reshaped it

🤖 Generated with Claude Code

https://claude.ai/code/session_01GiubaoqEuBzAyo5C4P8Vqr