Merge pull request #72 from StepenkoAnatoli/fix/stale-unknown-line

The correction landed and the sentence it corrected stayed

Author: StepenkoAnatoli

.github/workflows/collect.yml

@@ -90,8 +90,10 @@ name: collect
 # Re-run the measurement instead of trusting this comment, which can go stale:
 #   node research-kit/bin/disclosure.mjs --repository OWNER/REPO --run <id> --topic "..."
 #
-# What is NOT measured here: what a signed-in user with read access sees in the web UI,
-# which is a different surface from the REST API. Treat that as unknown rather than safe.
+# What the disclosure probe does NOT measure: the signed-in surface, because it is
+# unauthenticated by design. That was measured separately, and the answer is above - a
+# signed-in reader sees every dispatch input in the job log. Do not read a clean probe as
+# "nobody learns the subject".
 #
 # And the reason going private is not the reflex fix: per E-06, converting a GitHub Free
 # repository from public to private makes its protection rules and environment secrets

research-kit/test/collector-workflow.test.mjs

@@ -228,6 +228,30 @@ test('the anonymous disclosure table never appears without the signed-in caveat'
       `${name} prints the anonymous refusal table without saying what a signed-in reader sees`);
     assert.ok(/env:/.test(text) && /\blog\b/i.test(text),
       `${name} does not name the mechanism - the job log echoing a step's env: block`);
+
+    // And it must not still call the same thing unknown somewhere else in the file.
+    //
+    // The first version of this guard asked only whether the caveat appeared ANYWHERE, and
+    // it passed a file that carried both: the correction near the top, and thirty lines
+    // below it the original "treat that as unknown rather than safe", untouched and reading
+    // as current. A reader reaching the second sentence would have believed it.
+    //
+    // A stale sentence surviving beside its own correction is the defect ADR-0035 names,
+    // committed in the act of recording it.
+    //
+    // The second version was worse: it was VACUOUS. It tried to match "signed-in user" and
+    // "unknown rather than safe" in one line-anchored expression, and those sit on separate
+    // lines, so `[^\n]*` could never bridge them and nothing could ever fail it. Found by
+    // running the red check, which is the only reason this comment is not describing a
+    // guard that silently guards nothing.
+    //
+    // Quoting the superseded claim is allowed and is the house style; asserting it is not.
+    // So the phrase may appear only on a line that also marks it as past.
+    const stale = text.split('\n').filter((line) => /unknown rather than safe/i.test(line)
+      && !/used to|no longer|superseded|this used to say/i.test(line));
+    assert.deepEqual(stale, [],
+      `${name} still asserts the signed-in surface is unknown, in the same file that measures it:\n  `
+      + stale.map((l) => l.trim()).join('\n  '));
   }
 });