---
name: per-line-suppression-resumes-inside-a-multi-line-token
description: "In a line-walking scanner, a skip that advances ONE line resumes INSIDE a multi-line token and reads its body as source — and exercising the escape hatch is the only thing that reveals it."
metadata: 
  node_type: memory
  type: project
  originSessionId: c63f1093-4665-42cb-a581-0f78a683e349
  modified: 2026-08-22T08:16:14.555Z
---

A scanner that walks source LINE BY LINE but recognises MULTI-LINE tokens has two coupled
defects, and the second is only reachable by using the first. Measured 2026-08-22 while
building the `#74` interior-space-run gate (`crates/xtask/src/spacerun.rs`), all three faces
found PRE-BUILD, none of them by a red.

**Face 1 — the escape hatch was unusable on the population the gate exists for.**
`opted_out` read the marker only from the literal's OPENING line. A Rust continued literal's
opening line MUST end in the continuation backslash, so it can carry no trailing comment.
The gate existed *because of* continued literals, and 5 of its 11 real findings were that
shape — so the only way to silence a deliberate run was to rewrite the operator's message.
**Ask of any per-site escape hatch: can the population this check was BUILT FOR actually
carry it?** A hatch that only fits the easy cases is a hatch that gets replaced by deleting
the check.

**Face 2 — suppression was deciding what gets PARSED, not just what gets REPORTED.**
The skip did `line_no += 1; continue;`. For a multi-line literal that resumes the scan INSIDE
the literal's own body, where an escaped `\"` looks exactly like an opening quote. Marking
`firewall.rs` silenced its real run and a SECOND finding appeared two lines below, manufactured
out of the tail of the literal just exempted — at a line number where no literal opens.
The same hole had been sitting under the assert-family skip the entire time, unexercised.
Fix: always walk the token to its close; let suppression decide only whether it is *reported*.

**Face 3 — the act of exempting is the act that tests the skip path.** Face 2 is unreachable
until something is actually marked. A lane that measured a clean census, marked its deliberate
sites, saw green and shipped would have shipped a check that reports phantom line numbers —
and the phantom only appears at sites someone deliberately exempted, i.e. the sites nobody
looks at again. **After adding the first suppression marker, RE-RUN the scanner and diff the
finding set; do not assume a marker only subtracts.**

**Face 4 — A SCOPE LATCH SET BY A NESTED MARKER NEVER CLEARS, and this one was found
only by a witnessed red that DID NOT FIRE.** The scanner ended its scan of a file at the
first `#[cfg(test)]` at ANY indentation. In Rust a column-0 `#[cfg(test)]` opens the test
module that runs to end-of-file, but an INDENTED one annotates a single item with
production code continuing below it. `broker.rs` carries five; the first is indented at
2660 and the real module is at 8182. So the gate silently stopped scanning at 2660.
Measured blind zone across the two scanned crates: **4 files, 6,375 lines of production
code, 5,523 of them in broker.rs.** A real joined literal injected at 6622 — mutation
proven landed — produced `xtask check: OK`.

**The census had already reported A=0 through that blind instrument.** The partition was
re-derived after the fix and came back unchanged, but the earlier zero was never entitled
to the confidence it was reported with. **A zero from a scanner is a claim about the
scanner's REACH; measure the reach separately, and the cheapest way is a purposeful red
injected in the region you believe is covered.** Two more defects fell out of that same
red: the report printed UTF-8 through a `bytes[i] as char` Latin-1 cast (mojibake in a
check whose subject is text rendering correctly — the verdict was never wrong, only the
printed line), and the remedy line still named a placement that had become impossible.

**A red that does not fire is worth more than a red that does.** The firing one confirms
what you believed; this one found a latch, a coverage hole, an encoding bug and a stale
instruction.

Related shapes: [[census-enforcers-and-staters-of-an-invariant]] (a fix that lands at one of
two sites), [[declining-a-credit-specifies-the-requirement]] (say what a zero does NOT cover —
here A=0 means "no eaten continuation *within the gate's reach*", never "the class is absent"),
[[mutate-the-defect-not-the-trigger]].

Also settled the same day and worth keeping with it: the gate was validated against the
**historical** defect rather than an invented one — the pre-fix bytes were extracted from
`3416ffd3` with git rather than retyped (measured run = 18), and that commit's own body proves
the mechanism is a JOIN, not a bare backslash deletion. The variant where the backslash is
deleted WITHOUT joining the lines renders as LEADING indentation and is out of an
interior-run gate's reach by construction. A check's corpus should contain the bytes the
defect actually had.