12 more gates a comment can switch OFF (#415 class, false-negative half)

[rubenvdlinde]

Found by the all-65 survey of the #415/#420 comment class. Full table with per-gate fixtures and verdicts: fleet-board/findings/gates-comment-class.md.

47 of 65 gates are affected. #422 fixes the four most serious (7, 25, 48, 49); #421 tracks gate-45 separately because its blast radius is repo-wide. This issue is the remaining false-negative set — the direction where a comment satisfies the gate, which is the serious half.

🔑 In every one of these, the sentence that switches the gate off is the sentence a diligent author writes while acknowledging the debt.

gate	site	the comment that switches it off
38 skip-link	runner inline L6167–6180, raw grep -qE '<NcContent\b…'	<!-- TODO: we should wrap this in <NcContent> so we inherit core's skip-link. Not done yet. --> → PASS. _sl_is_settings_surface greps the same way, so a comment can also remove a page root from scope entirely.
14 route-reachability	runner inline, grep -qF "'thing#orphanReport'" over raw routes.php	A route written ONLY in a // TODO: wire up 'thing#orphanReport' … satisfies "the route exists". The endpoint 404s at runtime and the gate says PASS. The in-code comment claims comment hits are "vanishingly rare" — it anticipated the false POSITIVE and missed the false negative.
30 public-monitoring	runner inline _pm_ok, extended with |^\s*\*.*[Aa]dmin-only	* Return metrics. This endpoint is NOT admin-only and never was. → PASS. A sentence that DENIES the posture closes the gate.
60 icon-vocabulary	check_icon_vocabulary.py _registered_icons() L150 / L166–175	// import ViewDashboard from 'vue-material-design-icons/ViewDashboard.vue' → PASS. A commented-out import vouches for an icon that renders blank.
65 coding-standard-adoption	check_coding_standard_adoption.py L175/182, .php-cs-fixer.dist.php read raw	// TODO: we still need to require __DIR__ . '/vendor/autoload.php' here … Not done yet. drops FAIL — 5 deviation(s) to FAIL — 3. One of the two rules it silences exists precisely because a php-cs-fixer fatal reads exactly like a clean tree.
56 register-handler-resolution	check_register_handler_resolution.py L118/L176	* TODO: implement function evaluate() here → PASS. Worse: class deleted entirely, class and method both named in one unindented /* */ block → PASS, because _class_def_re's line anchor assumes a docblock line starts with *.
57 orphaned-write-capability	check_orphaned_write_capability.py _build_caller_index() L793	A docblock TODO: we should call $this->fooService->postInvoice($id) here … Not done yet. → PASS. The file's own L444 docstring fixed this defect for the SEAMS and never for the caller index. Separately _declaration_has_body() L336 strips // and quotes but not /* */, so a ; in a signature comment makes the method read as abstract and be skipped entirely.
6 orphan-auth	check_orphan_auth.py caller corpus raw at L292	// TODO: we should call $this->authz->requiresChairAuthorization(...) here → PASS.
16 spec-coverage	check_spec_coverage.py, SPEC_RE unanchored substring	* TODO: nobody has written @spec openspec/specs/thing/spec.md for this yet satisfies it. Borderline — @spec is a deliberate docblock marker — but the tag being a substring means a sentence stating the gap satisfies the gate that exists to collect it.
1 spdx-headers	runner inline ~L1797, grep -LE '^\s*\*\s*@license\s' over the whole file	Tags appearing in mid-method prose, or inside a <<<'TXT' heredoc, → PASS.
3 stub-scan	runner inline, grep -cF "$param" on the body	// TODO: verify $uid actually owns this object before returning true. flips the caller-identity arm FAIL→PASS. (The run() arm is clean — it uses php_mask.)
17 redundant-controller	detect-redundant-controllers.py WRAPPER_NOISE_PATTERNS L111–116	Covers ^\s*//, ^\s*\*, ^\s*/\* — but not an unprefixed interior line of a /* */ block, which survives as "significant code" and makes a pass-through look non-redundant.

Notes for whoever takes this

• The shared helper exists: lib/source_scope.py (php_mask, js_comment_mask, script_mask), offset-preserving, knows #[ is a PHP 8 attribute and that // inside 'https://x' opens nothing, and exposes the blank_strings axis. Use it; do not write a fifth stripper.
• Four of these checkers already have a mask in the same file and did not apply it to every read path (56, 57, and see 12 gates where a comment MANUFACTURES a finding (#415 class, false-positive half) #423 for 59 and 64). Two of them cite this defect class in their own headers. Knowing about the class is not having applied the fix — and a partially-masked checker looks exactly like a fully-masked one from outside.
• ⚠️ Do not batch these into one sweep. For several, the mask that closes the false negative would delete the evidence (gate-7's string case is the worked example — see 12 more gates a comment can switch OFF (#415 class, false-negative half) #422). Each needs its own paired anti-widening arm, and each needs a positive control run first: two of the survey's own fixtures initially printed the same verdict on both arms because the control had never failed.

[rubenvdlinde]

Fixes for the four most serious instances of this class (gates 7, 25, 48, 49) are in #425, which also carries the full 65-gate survey table and the method notes.