fix(tooling): two checkers stopped manufacturing false audit signals

Both defects are parser bugs in tooling, and both were producing a signal the operator sees on every
run. Plan 2026-11-13_062052, implemented as written.

1. `help coverage` WARN was a quote-pairing artefact (every run, always 367/368).
   `newos4-maintain.py:238-239` captured `this._baseWhitelist = [...]` with a regex and then pulled
   `'([^']+)'` out of it. A JS comment inside that array literal contains the apostrophe in "don't"
   (terminal.js:16), which desynchronised pairing: it matched forward to the opening quote of 'ui' and
   the pseudo-command `t work"\n // …` joined the audited set — so a genuine undocumented command was
   indistinguishable from parser debris. Fix: strip `/* */` and `//` before extracting, and keep only
   tokens matching `^[a-z][a-z0-9_-]{0,40}$`. The same shape bug existed for `const internals = [...]`
   and is fixed by the same helper. The WARN list is now single-line (newlines collapsed) so one bad
   token cannot reflow the digest.

   Proven both ways: injected `'zzz-probe-cmd'` into the whitelist -> `WARN: help coverage 367/368 —
   undocumented: zzz-probe-cmd`; reverted (md5 verified) -> `PASS: help coverage 367/367`.

2. Auto-review "still present in shipped code" fired on generic tokens.
   `STEER-20261112-195037-1eed [high] cmds.indexOf is not a function` was approved because
   `identifiers()` kept `indexOf` and `function` (hits: 36 and 74 files) and R4 approved on `any()`
   present token. `isCommand` — the only name that identifies the fault — was never considered, because
   stack frames were not parsed at all. It does not exist anywhere in the tree.

   Fix: JS keywords/builtins/DOM handler names join the skip set; `stack_functions()` extracts frame
   names (dropping `onclick`, `anonymous`, `eval`); R4 now requires a **distinctive** token (>=6 chars,
   present in modules/, not generic); and a stack whose TOP frame is `<anonymous>` is classified as
   generated code (`js-run` / `new Function`), which can never justify "still present in shipped
   source". The bottom `HTMLButtonElement.onclick (…/main.html)` frame proves only that a click
   started it — deciding on "does any frame name a real file" got this wrong once already.

   Proven: `identifiers('cmds.indexOf is not a function')` -> `[]`; `distinctive(['indexOf','function'],
   {...})` -> `[]`; the real report replayed into a fixture reports `nothing provable (1 left for the
   operator)` with **no** decision row written; production dry-run `nothing provable (0 left)`.
   `decisions.jsonl` still carries exactly 1 row for that report (append-only history untouched).

Regression cover: `python3 scripts/newos4-feedback-autoreview.py --self-test` -> 6/6.
maintain: node tests 42/42, help coverage 367/367, result OK.

1 files changed, 22 insertions, 5 deletions

diff --git a/scripts/newos4-maintain.py b/scripts/newos4-maintain.py
index acb81c3..fa20dfa 100644
--- a/scripts/newos4-maintain.py
+++ b/scripts/newos4-maintain.py
@@ -235,10 +235,24 @@ def check_help_coverage():
     check makes the gap visible on every maintenance run.
     """
     cmds, term = set(), open(os.path.join(ROOT, 'modules/core/terminal.js'), encoding='utf-8').read()
-    for m in re.finditer(r'this\._baseWhitelist = \[(.*?)\];', term, re.S):
-        cmds.update(re.findall(r"'([^']+)'", m.group(1)))
-    for m in re.finditer(r'const internals = \[(.*?)\];', term, re.S):
-        cmds.update(re.findall(r"'([^']+)'", m.group(1)))
+
+    # A JS comment inside one of these array literals used to desynchronise quote pairing: the
+    # apostrophe in "don't" (terminal.js:16) matched forward to the opening quote of 'ui', and the
+    # pseudo-command `t work"\n // …` joined the audited set — 367/368 forever, so a genuine gap was
+    # indistinguishable from the artefact (plan 2026-11-13_062052, fixed 2026-11-14).
+    def _tokens(pattern):
+        out = set()
+        for m in re.finditer(pattern, term, re.S):
+            body = re.sub(r'/\*.*?\*/', '', m.group(1), flags=re.S)   # block comments
+            body = re.sub(r'//[^\n]*', '', body)                      # line comments
+            for tok in re.findall(r"'([^']+)'", body):
+                # Shape guard: a real command is a lowercase word. Anything else is parser debris.
+                if re.fullmatch(r'[a-z][a-z0-9_-]{0,40}', tok):
+                    out.add(tok)
+        return out
+
+    cmds.update(_tokens(r'this\._baseWhitelist = \[(.*?)\];'))
+    cmds.update(_tokens(r'const internals = \[(.*?)\];'))
     cmds.update(re.findall(r"cmd === ['\"]([a-z0-9_-]+)['\"]", term))
     for p in glob.glob(os.path.join(ROOT, 'modules/**/*.js'), recursive=True):
         if 'bundle' in p or '/test/' in p or '.bkp' in p:
@@ -252,9 +266,12 @@ def check_help_coverage():
         if first and re.fullmatch(r'[a-z][a-z0-9_-]{0,40}', first[0].lstrip('./')):
             documented.add(first[0].lstrip('./'))
     missing = sorted(cmds - documented)
+    # Tokens are shape-guarded above, but collapse whitespace anyway: one bad token must never be able
+    # to reflow the whole digest (plan task 3).
+    shown = ' | '.join(m.replace('\n', ' ') for m in missing[:8])
     add('PASS' if not missing else 'WARN',
         f'help coverage {len(cmds) - len(missing)}/{len(cmds)} commands'
-        + ('' if not missing else f' — undocumented: {", ".join(missing[:8])}'))
+        + ('' if not missing else f' — undocumented: {shown}'))
 
 def check_regression_tests():
     """Every node-runnable test under modules/test/ must pass (2026-10-27).