Parity ledger masks executable Kotlin string-template calls as literal text

[bhelm]

Finding

Confirmed independently on local drift/meta commit 032983d2bed9bf50dfcfc4d06ef707f3818cdc26.

The parity ledger reports ConnectionTrace.sessionHeldSuffix/1 as test-only even though Android calls it on the real BLE disconnect path.

Concrete false finding

Productive call:

android/app/src/main/java/com/noop/ble/WhoopBleClient.kt:7903

log("connect down (uptime ends${com.noop.analytics.ConnectionTrace.sessionHeldSuffix(heldMs)})", ...)

Current baseline identity:

test-only-callsite|android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt::sessionHeldSuffix/1#1

Direct scanner reproduction on the unchanged tree:

• raw production source occurrences: 1
• occurrences after _mask_non_code: 0
• _call_sites(PRODUCTION_GLOBS): 0 Kotlin sessionHeldSuffix calls
• _call_sites(TEST_GLOBS): 4 calls
• resulting ledger text: ConnectionTrace.sessionHeldSuffix/1 has 4 test callsite(s) and no production callsite

Root cause

_call_sites scans the output of _mask_non_code (Tools/parity_ledger.py lines 1087-1097). _mask_non_code replaces an entire quoted string with spaces and has no Kotlin ${...} code-state handling (same file, lines 213-282). The call is executable Kotlin inside a string template, but it is erased as though it were literal text before the call regex runs.

Upstream PR ryanbr#1023 is provenance for the productive disconnect call; it is not a duplicate of this tooling defect.

Severity and routing

P1 governance defect: the ledger and checked-in baseline make a false claim about production reachability, so call-site findings cannot be trusted for this Kotlin syntax. There is no runtime product failure.

This belongs in the fork tooling/harness workflow.

Required red test

Add a focused fixture to Tools/tests/test_parity_ledger.py with a declaration, a real production call inside a Kotlin string template, and test calls, for example:

object Trace { fun suffix(value: Int) = value.toString() }
fun production(value: Int) = log("x${Trace.suffix(value)}")

Assert that Trace.suffix/1 is not reported as test-only-callsite. The unchanged scanner must fail this test for the reproduced reason.

Also add a negative control proving that literal text such as "Trace.suffix(1)" does not count as a call.

Acceptance

• Executable expressions inside Kotlin ${...} templates are scanned as code, including balanced nested braces and strings inside the expression.
• Non-executable string contents and comments remain masked and cannot create call sites.
• A malformed or unterminated template fails the ledger scan explicitly rather than silently discarding possible executable code.
• WhoopBleClient contributes the productive ConnectionTrace.sessionHeldSuffix/1 call and the false baseline entry is removed.
• Existing owner, arity, default-argument, and declaration-suppression tests remain green.