fix(signals): boundary-test-generation's array-bounds pattern misses the .at(-1) idiom

[JSONbored]

Context

src/signals/boundary-test-generation.ts powers the #1972 boundary-safe test-generation signal: it flags a changed diff that touches a well-known boundary-condition pattern (off-by-one array/index bounds, null/undefined branches, empty-collection edge cases) with no test evidence in the same PR, and hands the contributor's own coding agent a local-execution action spec to scaffold tests with.

ARRAY_INDEX_BOUNDS_PATTERN (line 35) is the array/index-bounds detector:

const ARRAY_INDEX_BOUNDS_PATTERN = /\[\s*(?:[\w.]+\.length|[\w.]+\.length\s*-\s*1|-1)\s*\]|\.length\s*(?:-\s*1)?\s*[<>]=?/;

This matches bracket-index forms (arr[arr.length - 1], arr[-1]) and .length comparisons, but does not match the Array.prototype.at() idiom (arr.at(-1), arr.at(0)) — the standard modern JS/TS way to express exactly the last-element/off-by-one access this detector exists to catch. Confirmed via direct regex test: ARRAY_INDEX_BOUNDS_PATTERN.test("items.at(-1)") returns false.

Since this module's own doc comment states the pattern set is "deliberately SMALL and PRECISE" (false positives are worse than a narrow true-positive set, per #1972's scope note), this is a natural, well-scoped extension of an existing pattern rather than a new design — the same shape as the file's three existing patterns (ARRAY_INDEX_BOUNDS_PATTERN, NULL_OR_UNDEFINED_BRANCH_PATTERN, EMPTY_COLLECTION_CHECK_PATTERN, lines 35-37).

Requirements

• Add a .at(...) alternative to ARRAY_INDEX_BOUNDS_PATTERN matching .at( followed by a numeric literal (optionally negative) and ) — e.g. \.at\(\s*-?\d+\s*\) — so arr.at(-1), arr.at(0), items.at(-2) etc. are recognized as an array-index-bounds touch, consistent with the file's "small, precise, added-line-only" design constraint.
• Keep the pattern narrow per the module's own stated design principle: match only a literal numeric argument (not an arbitrary expression like .at(idx)), since a bare identifier argument carries none of the specific off-by-one/boundary signal a literal -1/0 does, and a broader match would risk the false-positive-noise this module explicitly avoids.
• No change to BOUNDARY_PATTERNS (line 39), BoundaryPatternKind, or any other pattern (NULL_OR_UNDEFINED_BRANCH_PATTERN, EMPTY_COLLECTION_CHECK_PATTERN) — this is a single-pattern, additive regex change.
• No change to the module's MAX_TOUCHES cap, added-line-only scanning (addedLines), or the local-execution action-spec builder downstream.

Deliverables

• ARRAY_INDEX_BOUNDS_PATTERN updated to also match the .at(<numeric literal>) idiom.
• Regression tests asserting array_index_bounds fires for items.at(-1), items.at(0), and a negative-index variant, in whichever test file exercises boundary-test-generation.ts today (locate via the existing test suite for this module).
• A negative test confirming .at(someVariable) (a non-literal argument) does NOT trigger the pattern, per the narrow-scope requirement above.
• Existing tests for the bracket-index forms (arr[arr.length - 1], arr[-1], .length comparisons) continue to pass unmodified.

Test Coverage Requirements

Aim for 99%+ Codecov patch coverage (100% including the negative-argument branch) on the touched lines in src/signals/boundary-test-generation.ts. Both the new positive match and the deliberate non-match (variable argument) need explicit test cases, matching this module's own "narrow and precise, false positives are worse than missed positives" design philosophy.

Expected Outcome

A PR that introduces or touches arr.at(-1)/arr.at(0)-style last-element/off-by-one access is now correctly flagged by the boundary-safe test-generation signal when it lacks accompanying test evidence — closing a gap where the modern .at() idiom silently evaded a detector explicitly designed to catch exactly this class of access pattern.

Links & Resources

• src/signals/boundary-test-generation.ts (ARRAY_INDEX_BOUNDS_PATTERN, line 35; BOUNDARY_PATTERNS, lines 39-42)
• Related: #1972 (original boundary-safe test generation), #2189 (config toggle), #2188 (MCP action-spec builder)

[linear-code]

JSO-4026