Whole-branch review: approve with changes, and the one change was in the test, not the product.
The product fix stands as measured
The reviewer went after the thing that would actually hurt — a write that looks redundant but carries a side effect — and checked every call site the new setAttr/setProp helpers now guard:
input.valueon the search field: skipping an identical assignment is strictly safer, because assigning the same string still resets the caret to the end in Chromium.select.valuewith a value that is not in the option list: the browser refuses the assignment and leaves the old value. The fake reproduces that refusal, so a bad value stays loud instead of being silently swallowed by the guard.tabIndexrouting traced through the one control rendered without atabindexattribute: behaviourally identical.
Browser drive re-run: 44/44. Gate exit 0.
The defect: my report's central claim was false
I wrote that the structural check was "false-positive-prone but never false-passing". The reviewer disproved it by construction. Add this to the menu's sync loop, on the every-state-update path:
if (!name.includes('https://')) el.title = 'seen'
and all three tests pass. It is exactly the defect this branch exists to fix — title is attribute-reflected, so an identical-value write invalidates style and records a mutation on every keystroke — and it would have shipped invisibly.
Two blind spots covered each other's hole. stripComments doesn't parse string literals, so the // inside 'https://' blanked the rest of the line before the regex saw it. And the recording fake logged only setAttribute/removeAttribute plus three defined accessors, so a bare .title = landed on a plain object silently.
The fix
Each fake element is now wrapped in a Proxy whose set trap logs every property write before forwarding it. The reviewer's exact probe now fails the no-op test, naming all three menu rows, with from: 'seen' -> 'seen' legible in the log. As a bonus it catches el['disabled'], el.ariaPressed, and compound assignments like ||=, which the regex's bare-= shape also missed.
The structural check still passes against the probe, as predicted — which is the argument for keeping both nets rather than replacing one. The false claim is corrected where it was written down, in makeDOM's header and above stripComments.
Accepted, not fixed
- A third surface added to that plugin is caught by neither net: not in
GUARDED, not mounted by the fake. A mechanical derivation ofGUARDEDsweeps in modules that legitimately write off the update path, so the hardcoded list plus its comment stays. dataset,styleandclassListwrites are outside both nets even with the Proxy — they are method calls, not property sets.toolbar-roving'ssetStopis off the no-op path.- Toolbar sync adds
aria-pressed="false"to undo/redo althoughshow.htmldeliberately omits it. Pre-existing, arguably an ARIA wart, worth removing another day.
Merging.