async-supervision scan regex misses compound #[cfg(all(test, feature = ...))] gates

[bug-ops]

Finding

The mandatory tokio::spawn and blocking-pattern awk scans in .claude/rules/continuous-improvement.md (Async Supervision Audit section) only recognize the literal #[cfg(test)] attribute immediately followed by mod name { on the next line. Any test module gated by a compound expression — #[cfg(all(test, feature = "..."))] — is not detected as test-only, so every tokio::spawn inside it is counted as a production call site.

This was first identified in ci-1415 for one file (crates/zeph-durable/src/backend/local.rs, gated #[cfg(all(test, feature = "sqlite"))], 4 false positives). This cycle (ci-1418) found the same class recurring in two more files:

• src/gateway_spawn.rs — #[cfg(all(test, feature = "gateway"))] at line 360 — 5 false positives (lines with let forwarder = tokio::spawn(forward_webhooks(...))), present even at the ci-1415 baseline and never subtracted.
• src/channel.rs — #[cfg(all(test, feature = "tui"))] at line 289 — 1 false positive (elicit_task spawn inside app_channel_forwards_elicit_to_real_implementation), newly added in this cycle's window.

Impact

The raw scan count grew from 83 (ci-1415, HEAD 3aed7063) to 89 (ci-1418, HEAD c0fc51ed6), which on its face looks like a +6 regression against the documented baseline. Manual reconciliation (diffing old/new trees with git archive, checking each new hit's surrounding #[cfg(...)]) showed the true count of genuine non-test, non-EXEMPT production spawn sites is flat at 75 in both trees — the entire raw delta is test-code growth colliding with this blind spot. No actual regression occurred, but confirming that required a manual audit that the documented scan command was supposed to make unnecessary. The ci-1415 "79 true call sites" figure documented in continuous-improvement.md was itself already 4 too high (the gateway_spawn.rs false positives were present but unrecognized at that baseline too).

Location

.claude/rules/continuous-improvement.md, Async Supervision Audit section — the awk scan command's test-module detector:

/^[[:space:]]*#\[cfg\(test\)\]/ { pending_cfg=1; next }

Suggested fix

Broaden the detector regex to also match #[cfg(all(test, ...))] (and ideally any #[cfg(...)] whose condition list contains a bare test token), e.g.:

/^[[:space:]]*#\[cfg\(test\)\]/ { pending_cfg=1; next }
/^[[:space:]]*#\[cfg\(all\([^)]*\btest\b[^)]*\)\)\]/ { pending_cfg=1; next }

Re-run both scans after the fix, spot-check the newly-excluded lines (per the file's own "re-validate exclusions" convention), and record the corrected true baseline (currently 75, not 79/80) in continuous-improvement.md.

Why

Each CI cycle currently re-derives this by hand from a stale/wrong baseline, costing analyst time and risking a false-positive regression report or a masked real one in a future cycle with less careful reconciliation.

[bug-ops]

Fixed. Both awk scan scripts in .claude/rules/continuous-improvement.md (Async Supervision Audit's tokio::spawn scan and its Blocking-pattern scan) now detect compound #[cfg(all(test, ...))] gates in addition to the literal #[cfg(test)] attribute.

Implementation note: used a token-split approach (flatten all(...) args by replacing parens/commas with whitespace, split, check for an exact test token) rather than a \b word-boundary regex — the default macOS /usr/bin/awk (BWK "one true awk", not gawk) does not support \b at all, so a word-boundary-based fix would have silently been a no-op. The token-split rule correctly excludes feature = "test_utils"/feature = "testing" and correctly matches all(test, unix), all(feature = "x", test), all(test, any(...)), arbitrary whitespace, and 3+ closing parens.

Empirical re-run on current HEAD (e0af1f70c, via comm true-set-diff):

• tokio::spawn scan: old (2026-07-13 regex) = 89, fixed = 66 (23 false positives removed, 0 new matches). Spot-checked 6/23 removed sites, all confirmed genuine #[cfg(all(test, ...))] / mod tests { gates. Note: neither the old 80 baseline nor this issue's claimed "true baseline 75" match current HEAD — HEAD has moved since filing. 66 is the corrected baseline going forward, not 75.
• Blocking-pattern scan: old = new = 60, unchanged — the scoped directories contain a few #[cfg(all(test, ...))] modules, but none happen to contain the blocking patterns being scanned for, so this scan wasn't actually affected by the bug.

Documented a known limitation: nested negation #[cfg(all(not(test), ...))] would be misclassified as test-gated (the rule doesn't track nesting). Verified no such pattern currently exists in the repo (grep -rn 'not(test)' only hits unrelated cfg_attr(not(test), allow(dead_code)) lines).

Note on delivery: .claude/ is excluded from this repository via a personal global gitignore and has never been part of this repo's git history (confirmed: git log --all -- .claude/ is empty, git check-ignore -v traces to the global gitignore, not the repo's own .gitignore). This is expected, pre-existing environment behavior (previously confirmed during PR #5960), not specific to this issue. The fix was applied directly to the local file rather than via a PR, since there is no git-trackable diff to ship.