test(#3090): normalize the whole reason line, not just the category token

The allow-test-rule gate keys on identity, and the identity it records is
everything after the colon on the annotation line — not the category token.
Ten annotations carried the canonical category plus a trailing justification
on the same line, so the recorded identity was a prose blob, and where the
prose wrapped it was a sentence fragment: `source-text-is-the-product — the
workflow .md content IS`.

Seven of those ten are ones this branch already rewrote. That pass renamed the
token and left the prose, which is the same error this wave exists to correct,
one level down: the label was fixed without checking what the machine reads.

Justifications move to the following comment line, which the scanner ignores
because it lacks the token. No annotation gains or loses an issue reference, so
no exemption changes compliance status; the allowlist goes 161 to 159 as two
files' duplicate identities collapse.

git-base-branch.test.cjs carried the token twice — once as the real annotation,
once echoed in docblock prose that the line scanner parsed as a second
exemption with a truncated identity. The echo is reworded to drop the literal
token.

intel.test.cjs:1360 was cut off mid-clause with an issue ref appended after the
break; its sentence is restored and the ref kept on the annotation line so it
stays compliant.

Every remaining non-canonical identity is an ESLint RuleTester fixture inside a
`code:` template literal, which the line scanner cannot tell apart from an
annotation. Those two stay grandfathered.

Refs #3057

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/lint-allow-test-rule-refs.allowlist.json

@@ -1,5 +1,5 @@
 [
-  "tests/agent-classification-parity.test.cjs :: source-text-is-the-product — docs/AGENTS.md section layout + docs/INVENTORY.md table ARE the classification surface being validated",
+  "tests/agent-classification-parity.test.cjs :: source-text-is-the-product",
   "tests/agent-frontmatter.test.cjs :: source-text-is-the-product",
   "tests/agent-required-reading-consistency.test.cjs :: source-text-is-the-product",
   "tests/agent-size-budget.test.cjs :: source-text-is-the-product",
@@ -28,7 +28,7 @@
   "tests/code-review.test.cjs :: source-text-is-the-product",
   "tests/codebuddy-install.test.cjs :: source-text-is-the-product",
   "tests/codex-config.test.cjs :: source-text-is-the-product",
-  "tests/command-contract.test.cjs :: source-text-is-the-product — commands/gsd/*.md files ARE the",
+  "tests/command-contract.test.cjs :: source-text-is-the-product",
   "tests/commands.test.cjs :: source-text-is-the-product",
   "tests/concurrency-safety.test.cjs :: source-text-is-the-product",
   "tests/config-field-docs.test.cjs :: docs-parity",
@@ -44,9 +44,9 @@
   "tests/discuss-phase-power.test.cjs :: source-text-is-the-product",
   "tests/docs-parity-live-registry.test.cjs :: source-text-is-the-product",
   "tests/drift-detection.test.cjs :: source-text-is-the-product",
-  "tests/edge-probe-docs-fixtures.test.cjs :: source-text-is-the-product — the rendered reference/SPEC/ADR vocab surfaces are the runtime contract; this pins their bijection to the code (docs-parity)",
-  "tests/edge-probe-planner-contract.test.cjs :: source-text-is-the-product — plan-phase.md's planner prompt is the deployed runtime contract under assertion",
-  "tests/edge-probe-spec-phase-contract.test.cjs :: source-text-is-the-product — spec-phase.md Step 5.5 is the deployed workflow runtime contract under assertion",
+  "tests/edge-probe-docs-fixtures.test.cjs :: source-text-is-the-product",
+  "tests/edge-probe-planner-contract.test.cjs :: source-text-is-the-product",
+  "tests/edge-probe-spec-phase-contract.test.cjs :: source-text-is-the-product",
   "tests/edit-phase.test.cjs :: source-text-is-the-product",
   "tests/eslint-rules.test.cjs :: <source-grep reason> must still error",
   "tests/eslint-rules.test.cjs :: pending migration",
@@ -61,7 +61,6 @@
   "tests/frontmatter-cli.test.cjs :: source-text-is-the-product",
   "tests/gates-taxonomy.test.cjs :: source-text-is-the-product",
   "tests/git-base-branch.test.cjs :: source-text-is-the-product",
-  "tests/git-base-branch.test.cjs :: source-text-is-the-product — the workflow .md content IS",
   "tests/gsd-check-update-worker-platform-gate.test.cjs :: structural-regression-guard",
   "tests/gsd-researcher-app-aware.test.cjs :: source-text-is-the-product",
   "tests/gsd-researcher-flow-diagram.test.cjs :: source-text-is-the-product",
@@ -75,9 +74,8 @@
   "tests/install-nested-layout.test.cjs :: source-text-is-the-product",
   "tests/install-runtime-artifacts.test.cjs :: source-text-is-the-product",
   "tests/install.test.cjs :: source-text-is-the-product",
-  "tests/intel.test.cjs :: source-text-is-the-product — agents/gsd-intel-updater.md IS the",
-  "tests/intel.test.cjs :: source-text-is-the-product — readFileSync assertions target API-SURFACE.md, which is the generated product of intelApiSurface; asserting on its text content is the only way to verify correct generation.",
-  "tests/inventory-headings-countfree.test.cjs :: source-text-is-the-product — INVENTORY.md heading format is the shipped doc surface being locked",
+  "tests/intel.test.cjs :: source-text-is-the-product",
+  "tests/inventory-headings-countfree.test.cjs :: source-text-is-the-product",
   "tests/ios-scaffold-safety.test.cjs :: source-text-is-the-product",
   "tests/issue-2639-codex-toml-neutralization.test.cjs :: source-text-is-the-product",
   "tests/issue-429-comment-text-gate.test.cjs :: source-text-is-the-product",
@@ -127,11 +125,11 @@
   "tests/release-coverage-scope.test.cjs :: source-text-is-the-product",
   "tests/release-tarball-smoke-workflow.test.cjs :: source-text-is-the-product",
   "tests/release-tarball-smoke.install.test.cjs :: integration-test-input",
-  "tests/research-agent-profiles.test.cjs :: source-text-is-the-product research agent .md content is the governed surface",
+  "tests/research-agent-profiles.test.cjs :: source-text-is-the-product",
   "tests/review-default-reviewers-workflow.test.cjs :: source-text-is-the-product",
   "tests/roadmap.test.cjs :: source-text-is-the-product",
   "tests/runtime-launcher-parity.test.cjs :: structural-regression-guard",
-  "tests/runtime-name-policy.test.cjs :: source-text-is-the-product — FALLBACK_ALIASES source text IS the",
+  "tests/runtime-name-policy.test.cjs :: source-text-is-the-product",
   "tests/scan-command.test.cjs :: source-text-is-the-product",
   "tests/secret-scan-lint.security.test.cjs :: source-text-is-the-product",
   "tests/secure-phase.test.cjs :: source-text-is-the-product",

tests/agent-classification-parity.test.cjs

@@ -1,4 +1,5 @@
-// allow-test-rule: source-text-is-the-product — docs/AGENTS.md section layout + docs/INVENTORY.md table ARE the classification surface being validated
+// allow-test-rule: source-text-is-the-product
+// docs/AGENTS.md section layout + docs/INVENTORY.md table ARE the classification surface being validated
 'use strict';
 
 /**

tests/command-contract.test.cjs

@@ -1,5 +1,6 @@
-// allow-test-rule: source-text-is-the-product — commands/gsd/*.md files ARE the
-// deployed skill surface. Testing their contract tests the runtime behaviour.
+// allow-test-rule: source-text-is-the-product
+// commands/gsd/*.md files ARE the deployed skill surface. Testing their
+// contract tests the runtime behaviour.
 
 'use strict';
 

tests/edge-probe-docs-fixtures.test.cjs

@@ -1,4 +1,5 @@
-// allow-test-rule: source-text-is-the-product — the rendered reference/SPEC/ADR vocab surfaces are the runtime contract; this pins their bijection to the code (docs-parity)
+// allow-test-rule: source-text-is-the-product
+// the rendered reference/SPEC/ADR vocab surfaces are the runtime contract; this pins their bijection to the code (docs-parity)
 // Asserts the portable reference doc (gsd-core/references/edge-probe.md) keeps its
 // worked-example JSON blocks in sync with the source-of-truth fixture files under
 // gsd-core/references/edge-probe-fixtures/. The fixtures are the canonical data; the

tests/edge-probe-planner-contract.test.cjs

@@ -1,4 +1,5 @@
-// allow-test-rule: source-text-is-the-product — plan-phase.md's planner prompt is the deployed runtime contract under assertion
+// allow-test-rule: source-text-is-the-product
+// plan-phase.md's planner prompt is the deployed runtime contract under assertion
 // plan-phase.md is the deployed planning workflow contract; these checks lock
 // the SPEC path wiring and quality-gate that the edge-probe review (RR-01/02/03)
 // requires — assertions scope to extracted sub-blocks to avoid false positives.

tests/edge-probe-spec-phase-contract.test.cjs

@@ -1,4 +1,5 @@
-// allow-test-rule: source-text-is-the-product — spec-phase.md Step 5.5 is the deployed workflow runtime contract under assertion
+// allow-test-rule: source-text-is-the-product
+// spec-phase.md Step 5.5 is the deployed workflow runtime contract under assertion
 // spec-phase.md is the deployed spec workflow contract; these checks lock
 // the Step 5.5 wiring so the edge-probe.cjs runtime invocation cannot
 // silently rot the way the original plan-phase no-op did (reviewer finding RR-11).

tests/git-base-branch.test.cjs

@@ -13,8 +13,9 @@
  *   G. Anti-regression guard: five affected workflows must NOT contain the
  *      duplicated bare `:-main` / `:-master` fallback pattern that was the root cause.
  *      They must call `gsd_run query git.base-branch` instead.
- *      (allow-test-rule: source-text-is-the-product — the workflow .md content IS
- *       the runtime surface; the absence of the bad pattern is what ships to agents.)
+ *      (see the source-text-is-the-product exemption declared below this docblock —
+ *       the workflow .md content IS the runtime surface; the absence of the bad
+ *       pattern is what ships to agents.)
  */
 
 // allow-test-rule: source-text-is-the-product

tests/intel.test.cjs

@@ -4,7 +4,8 @@
  * Covers: query, status, diff, validate, snapshot, patch-meta,
  * extract-exports, enabled/disabled gating, and CLI routing via gsd-tools.
  */
-// allow-test-rule: source-text-is-the-product — readFileSync assertions target API-SURFACE.md, which is the generated product of intelApiSurface; asserting on its text content is the only way to verify correct generation.
+// allow-test-rule: source-text-is-the-product
+// readFileSync assertions target API-SURFACE.md, which is the generated product of intelApiSurface; asserting on its text content is the only way to verify correct generation.
 
 'use strict';
 
@@ -1107,8 +1108,8 @@ describe('intelApiSurface', () => {
 });
 
 describe('#1000 regression: gsd-intel-updater emits canonical intel filenames', () => {
-  // allow-test-rule: source-text-is-the-product — agents/gsd-intel-updater.md IS the
-  // system prompt the intel-updater agent runs under; asserting its filename references
+  // allow-test-rule: source-text-is-the-product
+  // agents/gsd-intel-updater.md IS the system prompt the intel-updater agent runs under; asserting its filename references
   // verifies the deployed agent surface contract matches the INTEL_FILES the CLI reads.
   const agentPromptPath = path.join(__dirname, '..', 'agents', 'gsd-intel-updater.md');
   const agentPrompt = fs.readFileSync(agentPromptPath, 'utf8');
@@ -1357,9 +1358,9 @@ describe('bug #2351: intel updater kilo layout support', () => {
 {
   const { describe: __foldDescribe } = require('node:test');
   __foldDescribe("folded:bug-3290-intel-updater-layout-block (consolidation epic #1969 B7 #1976)", () => {
-// allow-test-rule: source-text-is-the-product — agents/gsd-intel-updater.md IS (see #3290)
-// the deployed agent instruction set. Asserting its text content tests the
-// deployed behaviour contract, not internal implementation.
+// allow-test-rule: source-text-is-the-product (see #3290)
+// agents/gsd-intel-updater.md IS the deployed agent instruction set. Asserting
+// its text content tests the deployed behaviour contract, not internal implementation.
 
 'use strict';
 

tests/inventory-headings-countfree.test.cjs

@@ -1,4 +1,5 @@
-// allow-test-rule: source-text-is-the-product — INVENTORY.md heading format is the shipped doc surface being locked
+// allow-test-rule: source-text-is-the-product
+// INVENTORY.md heading format is the shipped doc surface being locked
 'use strict';
 
 /**

tests/research-agent-profiles.test.cjs

@@ -1,4 +1,5 @@
-// allow-test-rule: source-text-is-the-product research agent .md content is the governed surface
+// allow-test-rule: source-text-is-the-product
+// research agent .md content is the governed surface
 // The 7 researcher agent .md files are the deployed AI agent definitions — their
 // frontmatter and @-includes ARE what the runtime loads. Asserting on their content
 // is asserting on the deployed contract, not the test author's source code.

tests/runtime-name-policy.test.cjs

@@ -54,8 +54,8 @@ describe('runtime-name-policy windsurf alias parity — manifest vs FALLBACK_ALI
   test('manifest and FALLBACK_ALIASES windsurf alias sets are identical', () => {
     // Read FALLBACK_ALIASES from source to detect manual drift before a build.
     const srcPath = path.join(ROOT, 'src', 'runtime-name-policy.cts');
-    // allow-test-rule: source-text-is-the-product — FALLBACK_ALIASES source text IS the
-    // product contract for runtimes that can't load the manifest at runtime; verifying
+    // allow-test-rule: source-text-is-the-product
+    // FALLBACK_ALIASES source text IS the product contract for runtimes that can't load the manifest at runtime; verifying
     // both surfaces contain the same windsurf aliases catches manual-mirror drift.
     const src = fs.readFileSync(srcPath, 'utf8');
     const match = src.match(/windsurf:\s*\[([^\]]+)\]/);