Close the Walk-Arounds in the Block Scanner's Whitespace-Predicate Guard #1618

scripts/tests/test_release_guards.py carries test_no_bare_whitespace_predicate_in_the_block_scanner, added because six silent defects in the AUDIT.md fence scanner were one habit: a Python whitespace or line predicate taking a wider class than a renderer does, each written while fixing the previous one. The guard reads the scanner's own source and fails on such a predicate. A review of it found three ways it does not hold, the first of them verified by a mutation that changes behaviour and passes the whole suite.

The guard does not reach the module-level pattern

inspect.getsource(function) returns a function body, so the module-level FENCE_LINE regex, which holds the scanner's only whitespace-class decision, is never read. Verified: "FENCE_LINE = " in scanned_source is False.

Changing that pattern's indent group from (?P<indent> {0,3}) to (?P<indent>\s{0,3}) passes the entire suite, and the mutant is not equivalent. On "\t```bash\nA=1\n\t```\n" it returns a block where a reference CommonMark implementation returns none, since a tab-indented line is an indented code block rather than a fence. That is exactly the defect class the guard exists to stop, three lines above the function it guards.

The set of functions it reads is hard-coded and unverified

The tuple of functions is a literal, and mutating it to read only fenced_blocks passes the suite. A predicate moved into shell_blocks, or into a new module-level helper, is then caught only by whichever behaviour case happens to cover it. Three such walk-arounds were tried and all three were caught, but by the refusal cases over tab, no-break space and form feed body lines rather than by the guard. The docstring's claim that every function the scanner is built from is read is false in both directions, since module-level code is read in neither.

The wide-class half is decorative

The guard also looks for \s written into a pattern, and deleting that half passes the suite: no case in the file contains one for it to find.

Smaller, in the same file

• "Every comparison here names the characters it means" is false by design, since the label split carries an inline exemption and the test asserts exactly one such exemption exists.
• The docstring's refusal rule reads as though four leading spaces would be read, where the indent is capped at three, and it omits the refusal of a backtick or tilde after the run. The module comment states the rule correctly, so the docstring is the surface that drifted.
• "dedented out of the list item holding it" describes one case, where a top-level fence indented one to three spaces is dedented by the same rule.
• The refusal loop's line shadows the scan loop's line. Harmless as written, and the kind of footing several fix rounds in this file have slipped on, since a statement added after it would read the clobbered name and look correct.

Why this is filed rather than fixed

The branch that added the guard answered its own decisive question, that the scanner cannot silently drop a labelled block or hand back a body that changes what bash -n decides, and these are gaps in the guard rather than defects in the scanner. Reading module-level source and verifying the function set are a change to the guard's own design and deserve their own review rather than a fourteenth commit on that branch.