fix(tests): judge cold-spawn warm-up registration structurally - #5080

Summary

Closes #5060.

The cold-spawn warm-up coverage guard decided whether a file was warmed by asking whether its text contained the substring "helpers/cold-spawn-warmup". A comment, a string literal, or an import left behind after the beforeAll call was deleted all satisfied that, so the measured child could go back to paying its cold module-graph load inside a timed assertion while the guard in front of it stayed green.

tests/helpers/warmup-registration.ts replaces the substring with a structural judge over the file's tokens, and the guard now asks it instead. Five stages, each of which refuses on its own:

• import binding - a runtime import of the exact helper module (resolved per file, not matched by name) binds warmColdSpawn or warmModuleGraph, aliases followed. A type-only import, a same-named local function, a same-named export of another module, a comment and a string bind nothing.
• hook registration - a bun:test beforeAll binding is called with an inline callback, at the top level or in a describe callback, unconditionally. A callback that is only declared, one handed to the hook by name, one registered inside a helper function nobody calls, and one behind a false condition all register nothing the file can be read for.
• call ownership - the bound name is called on that callback's own direct path: not inside a nested function, not behind a condition, and not through a name the file redeclares or the callback takes as a parameter.
• completion - the promise reaches the hook by await, by return, or by a concise arrow body, and it has to be the whole returned expression. Fire-and-forget, void, and a warm-up that is one operand of a larger expression all let the hook settle first.
• unwarmed exception - a file recorded as warmed: false still needs its documented reason, and must now import the helper module not at all. Bindings alone were not enough: a namespace import binds no name this judge follows, so a real warm-up would have read as an absence.

Parsing is a driven token walk rather than an AST visit, and that is a finding rather than a preference. This repository's TypeScript is 7.0.2, the native port: its published entry points are "typescript" (a version constant), "typescript/unstable/sync" and ".../async" (clients that spawn the Go tsgo executable and hold a whole project), and "typescript/unstable/ast" - AST types, type guards, a visitor and the scanner, with parsing itself left in Go. There is no in-process createSourceFile to call, and reading one file through the RPC client would start a compiler process on every shard of every platform. The judge therefore drives the scanner, which is the entry point tests/responses/responses-fetch-helpers-boundary.test.ts already uses, and reconstructs only the grammar the five stages need. Two rescans are what make that honest: a template substitution continues at its closing brace, and a slash is a regular expression or a division depending on the token before it. A file that still does not balance is reported unreadable and fails; it is never read as an absence.

A static structural check does not prove execution. It reads the shape of a file, not the run: it cannot prove the process reached the describe holding the registration, or that the warm-up child loaded anything. That oracle already exists and is unchanged - the helper prints one "[cold-spawn-warmup] graph=... elapsedMs=..." completion line per warmed graph on every hosted run, and a warm-up that throws fails its file as a setup failure.

Where the judge cannot decide, it refuses with a named reason rather than passing: a namespace import, a callback reached by name, a registration in a scope it cannot see running, and a file it cannot tokenize all fail loudly and say why and where.

Deliberately out of scope: the re-export recognition question the issue excludes, the cold-start budget, the measured deadline, the graph failure policy, and the preload safety net are all untouched.

Verification

• No local suite was run - no bun test, no focused test file, no typecheck, no build, no install, no ocx invocation. The change was verified by static reasoning against the seven files the guard classifies and by hosted CI at the exact head.
• Hosted CI at head 60a04f0: test 1/4, 2/4, 3/4, 4/4 and macos 1/2, 2/2 all green, along with gates, hygiene, changes, docker smoke, keyring on all three platforms, storage policy, api usage and enforce-target. No non-success check run at that head.
• One flake is recorded rather than hidden. At the previous head, macos 1/2 failed in tests/server/server-live.test.ts:662 (an rtc_sideband WebSocket with a 15s handshake bound) and tests/server/server-auth.test.ts:4264 (a streaming pool-retry poll). Neither file is touched here, and nothing in this change runs a server, a socket or a child process. Per devlog/_plan/260817_windows_stability_program/070_flakiness_policy.md a rerun may be used to investigate with both results recorded: the second attempt passed, and the following head passed macos 1/2 first time. Nothing was retried, widened or skipped to get there.
• All six CodeRabbit findings were correct and are fixed, each with its own regression: the namespace-import hole in the unwarmed disposition, registrations in conditional or uncalled scopes, callback-parameter shadowing, a helper call that is only part of the returned expression, a conditional flag left set across a missing semicolon, and a line break treated as a statement boundary when the next line continues the expression.
• The new test file is registered in both scripts/test-layout/layout.json (explicit) and tests/fixtures/test-layout-expected.json under the same basename-to-domain mapping.
• File-size ratchet: no file here is in tests/fixtures/file-size-baseline.json, and each stays far below the 2000-line threshold that applies to an unlisted file.
• tests/ci-workflows/warmup-registration.test.ts pins both directions. Refused: comment-only, string-only, unused import, the same name from another module, type-only, a local function of the same name, a namespace import, a declared-but-unregistered callback, a hook handed a name, beforeAll not from bun:test, a registration in an uncalled function at the top level and inside a describe, a registration behind if (false) braced and bare, a call in a nested function, a redeclared name, a callback parameter of the same name, fire-and-forget, void, a call that is one operand of the returned expression, and a guarded statement the next line continues. Accepted: await, return, an implicit-return concise arrow, a function expression, an alias import, a registration inside describe and one at the top level, an unconditional hook after a semicolonless guarded one, and a hook body containing a template substitution and a regular expression.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.