fix(core): one compiled handshake registry, so every partitioner sees a mid-file trigger — closes #2848

[squid-protocol]

Closes #2848.

What was wrong (and one thing the issue did not know)

Every handshake trigger is ^-anchored, so compiling it without re.M means the partitioner only fires on a file whose very first byte opens the block. The issue found two copies of the registry; there are three, and two were missing the flag:

module	flags	consequence
detector.py	re.I | re.M	correct (fixed by #1183)
prism.py	re.I	embedded segment never formed → host comment rules ran over the embedded body
language_lens.py	re.I	_detect_hybrids reported a polyglot lang_mix only for the degenerate offset-0 file

The issue's micro-repro, before → after: mid-file <script> read coding/doc LOC 7/0 with // eval("nope"); surviving into code_stream as executable risk; it now reads 6/1 with the comment in comment_stream, matching the offset-0 case in kind.

The fix

The flags have now drifted twice on the same three patterns (#1183 the anchor, this the multiline flag) because three modules each compiled them. So rather than adding re.M in two more places, the compilation moves next to the patterns as _lens_config.COMPILED_HANDSHAKE_REGISTRY, and all three consumers share it. Compiled patterns are immutable and thread-safe, so this is one list rather than three copies, and test_every_partitioner_shares_one_compiled_registry_2848 pins the identity (not a copy of the flags) so a fourth copy cannot quietly appear.

The test that documented this asymmetry as a deliberate workaround (test_both_partitioners_move_the_same_boundary, from #2549) is now parameterised over both trigger positions instead.

Measured

• Corpus: rosetta_audit 46/46, 0 regressions. No planted signal count moves, so no manifest rebless is owed — contrary to the issue's expectation of a corpus-wide re-bless. (The manifests gate signal counts; the derived LOC columns live in the bias report, which regenerates on its own schedule.) Reachability scan: rosetta has mid-file triggers in html only.
• Golden masters, both legs blessed, verify green. bless_scope: 194 substantive diffs, html (101) and groovy (36) only — the Coding LOC/Documentation LOC redistribution the issue predicted. 11 html files move 64 JavaScript // lines out of code and into doc, conserved per file (math.html 192/2 → 171/23, webWorkerExtensionHostIframe.html 139/0 → 124/15).
• The groovy entry is the boundary case, read in full: gradle's EnrichedReportRenderer.groovy emits injected JavaScript from a triple-quoted string (marked // language=javascript). Its ~61 lines of genuine JS logic were recorded as documentation (103 doc LOC for a file with ~10 real comments); they are code now, and the JS signals that were invisible — 8 branches, 13 state mutations, 5 closures — are counted. Worth a reviewer's eye: this is embedded code inside a host string literal, which is exactly the case Residual function-extraction gap post-#1193: contiguous dead zone + near-total loss in embedded-foreign-code-heavy files #1198's line-anchoring was designed to keep honest, and here the content is real injected JavaScript rather than fixture data describing it.
• Full suite: 8670 passed (the 10 test_security_auditor failures are this venv missing pandas/xgboost — identical on untouched main; CI installs them). audit_check all clear; ruff baseline clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BLztFhLH42oxWBKEvwfdBb

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab