fix(review): bridge label-separator punctuation in test-evidence negation checks

[JSONbored]

Summary

• hasValidationNote's negation-proximity checks required a literal whitespace gap next to the test/validation stem or negation word. A label-style status line that glues its separator directly onto that word with no surrounding space ("Tests: not run.", "Validation; skipped.", "Tests - not run.") broke that adjacency entirely, so the negation went undetected and the bare stem fell through to the affirmative check instead — letting a PR body that explicitly says validation was not done still satisfy a configured manifest test expectation.
• Fixes a follow-up defect surfaced by review on fix(review): explain validation and guardrail holds #3304 after it merged: src/signals/test-evidence.ts:35 treated Validation: not run / Tests: not run as passing evidence because : was neither a split boundary nor allowed between the test stem and negation.
• Adds LABEL_SEPARATOR_GAP — a single colon/semicolon/dash (ASCII, en dash, or em dash) with optional trailing whitespace — which stands in for the mandatory whitespace only at the junction touching the stem/negation word itself. Every other gap between filler words stays pure whitespace, so a separator elsewhere in a longer sentence still cannot bridge a negation across unrelated content.
• Also drops semicolon from the clause-splitting boundary: splitting there severed a stem from its own negation before the proximity checks ever ran (the same failure mode one level up, e.g. "Tests; not run." previously split into "Tests" and " not run" as independent clauses, letting the bare "Tests" half pass as affirmative on its own).

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed. (Follow-up to merged PR fix(review): explain validation and guardrail holds #3304; no separate issue.)

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥97% coverage of the lines AND branches you changed (aim for 98%+ on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• This change is confined to a single pure-logic backend file (src/signals/test-evidence.ts) and its unit test. Ran npm run typecheck and the full targeted test suite locally (test/unit/test-evidence.test.ts — 19/19 passing, including 2 new regression tests for this fix — plus test/unit/predicted-gate.test.ts and test/unit/rules.test.ts, the two consumers of hasValidationNote, both fully green at 140/140 total). Causality for the new tests was proven by reverting the source fix and confirming the new assertions fail against the prior (merged) logic. The remaining checks (actionlint, workers, MCP, UI, audit) are unaffected by this diff and are left to CI.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session/CORS surface touched.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — internal pure-logic helper, no public API/schema change.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI change.)
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository. (N/A — no UI change.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (N/A.)

UI Evidence

N/A — no UI/frontend/docs/extension change.

Notes

• Round 4 in a series of fixes to hasValidationNote (rounds 1-3 landed in fix(review): explain validation and guardrail holds #3304). Verified this fix against every prior round's regression case plus new adversarial cases (a genuine semicolon-joined independent clause must not be falsely bridged, e.g. "No documentation issues; tests pass regardless." still correctly resolves to true) to avoid reintroducing an earlier bug class one level up.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.91%. Comparing base (1560dee) to head (0f05454).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3372   +/-   ##
=======================================
  Coverage   93.90%   93.91%           
=======================================
  Files         284      284           
  Lines       30607    30608    +1     
  Branches    11148    11148           
=======================================
+ Hits        28743    28744    +1     
  Misses       1208     1208           
  Partials      656      656           

Files with missing lines	Coverage Δ
src/signals/test-evidence.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.