[squid-protocol]

Summary

Part of the extraction-hardening epic (#813). Closes #823.

Hardens all four extraction gauntlets (func_start, args, class_start, _dependency_capture) for kotlin per tests/extraction/how_to_harden_extraction.md. This was a fresh sweep (no pre-flagged known bug) and surfaced two real bugs:

• func_start/args shared a flat <[^>]{0,100}> Rule-11 generic-parameter step-over, breaking any nested generic bound (fun <T, U : Comparable<U>> foo(x: T, y: U): T {, a realistic bounded generic function) — the same bug class already fixed for java/python/csharp/rust.
• class_start had no support for companion object { ... } at all (almost always anonymous in real Kotlin — a name is rare). The tempting fix (making the general class|interface|object|enum class branch's name optional) would have opened a new false positive on object expressions (object : Base() {, an anonymous object literal used inline, a different construct from an object declaration). Fixed instead with a dedicated alternative narrowly scoped to the literal companion object shape with its own optional name, leaving the general branch untouched.

Checked test_language_standards_strict.py for intentional kotlin behavior before finalizing (per the lesson from c's #822 pass, where an overly-broad fix broke a test documenting deliberate cross-rule ambiguity) — no conflicts found; the existing test_kotlin_ambiguity_sweep_shared_literals_are_not_bugs test passes unmodified.

Also documents a known, unfixed architectural limitation: func_start's Mode-B string-shielding gap reproduces via triple-quoted raw strings — now confirmed on a seventh language.

Differential Scan

Ran python tests/tools/crucible_check.py: zero diff. Confirmed expected — the corpus has only 5 kotlin files (okhttp), with zero companion objects among them (confirmed by grep). Verification relied on regex-level empirical checks plus ReDoS scaling sweeps, consistent with recurring bug class 8 ("a zero diff can mean the corpus doesn't exercise the feature"). No golden master changes in this PR.

Test plan

• pytest tests/extraction/languages/test_kotlin.py (42 new tests) — run via bare pytest from an unrelated CWD to reproduce CI's invocation style
• pytest tests/core_engine/ tests/extraction/ -q — 3664 passed, 1 known pre-existing tiktoken-environment failure, 1 xfailed — including all existing kotlin ambiguity-sweep tests
• python tests/tools/audit_check.py — clean (only the pre-existing, already-tracked guidestar_lens.py mypy findings, unrelated to this change)
• python tests/tools/crucible_check.py — PASS on both venvs (zero diff, as expected — see above)
• Migrated kotlin's cases out of the four monolithic dict files into tests/extraction/languages/test_kotlin.py
• Epic Epic: Harden the four extraction gauntlets (function/args/class/dependency) per language #813 and the methodology doc updated with the new findings (recurring bug classes 29-30)

🤖 Generated with Claude Code

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab