Two detectors scanned a narrower population than they claimed: the shim gate saw only test_*.py, and the netblock's three open egress routes were six (#1598, #1584)

[fdaviddpt]

Two detectors whose population was narrower than their claim, so each zero read as "clean" when it meant "I did not look there". Both re-derived, and both counts in the issues were wrong in the direction that matters.

#1598 — the shim gate scanned only tests/test_*.py

Widening the scan over the 21 previously unscanned modules found exactly one hit, _gitshim.py:38, as filed. But the issue omitted tests/fixtures/ — three real modules — so the fix is rglob, not glob.

_modules_scanned() is now every *.py under tests/ recursively minus __pycache__, with hits reported as relative_to(root).as_posix().

The exemption is a grammar answer, not a filename allowlist: _shifts_through_argv requires every $1-test position to sit inside a while|until|for … done span containing shift, consistent with #1412.

The judgment call: the one pre-existing site is the correct implementation, so no register was needed — shape over marker, because a marker is a self-declaration anybody can write above a broken shim.

FAILED ...::test_a_shim_planted_in_a_helper_module_is_reported
FAILED ...::test_the_canonical_dispatcher_is_exempt_by_its_shape_not_by_its_filename
FAILED ...::test_a_fixture_module_below_tests_is_reached_too
FAILED ...::test_the_scan_reads_every_python_module_in_the_suite_not_only_test_files
E   AssertionError: ('_gitshim.py', 709)
4 failed, 43 passed in 9.19s

GREEN: 47 passed in 5.49s

#1584 — the issue said three open egress routes. It is six.

gethostbyname_ex, getnameinfo and gethostbyaddr were open and unnamed:

connect_ex         NOT BLOCKED -> 0
gethostbyname      NOT BLOCKED -> '104.20.23.154'
udp sendto         NOT BLOCKED -> 1
gethostbyname_ex   NOT BLOCKED -> ('example.com', [], ['104.20.23.154', ...])
getnameinfo        NOT BLOCKED -> ('one.one.one.one', 'http')
gethostbyaddr      NOT BLOCKED -> ('one.one.one.one', [...], ['1.1.1.1'])

All six refused now, plus sendmsg. Loopback and AF_UNIX stay open by design.

The judgment call: not a longer list. _netblock.ROUTES / SOCKET_ROUTES classify every callable socket and socket.socket expose as PATCHED / VIA / LOCAL / INERT / OPEN, with the population derived from dir(socket) at test time — so a name CPython grows arrives red rather than silently unblocked. OPEN carries a reason, and BEYOND_THE_PROCESS names the four uncoverable routes instead of counting them blocked.

Prose corrected at all three live sites (conftest.py, docs/contributing.md, test_transport_seam_enforced_1341.py). CHANGELOG.md:180 deliberately left — it is a historical release record.

RED 16 failed, 3 passed → GREEN 19 passed, then 179 passed across the netblock/hashnode/seam/shim suites.

The reviewer caught a Windows-wide outage before CI could

_netblock.py:322 — the patch loop hardcoded ("connect","connect_ex","sendto","sendmsg") while _METHOD_PATCHES was hasattr-filtered directly above. Windows has no socket.socket.sendmsg, and monkeypatch.setattr(raising=True) on an absent attribute raises AttributeError out of an autouse fixture — every test, every Windows leg. Fixed; the loop iterates the derived tuples.

The pin proved red against the old loop (hardcoded loop -> sendmsg is original: False). Note delattr cannot simulate the platform — socket.socket.sendmsg is inherited from _socket.socket — so the pin shortens the derived tuple instead.

Two more accepted: a stale sentence one paragraph above the rewritten disclosure, and a docstring claiming patches == register while the loop had drifted.

Adjacent, fixed

tests/test_git_shim_subcommand_1206.py carried a module-level pytestmark = skipif(os.name == "nt"), which was skipping the class gate and every pure-AST rule test on Windows. Scoped to the five tests that actually run /bin/sh; the AST tests now run there.

Suite

Full suite twice in disposable clones: 12898 passed, 97 skipped. Two failures, neither from this diff — test_no_cli_at_all_is_not_an_absence_either (fails identically on parent d2a48e7f in a clean clone in isolation; filed separately) and test_a_minified_file_does_not_hang_the_diagnostic (passes in isolation on both sides; timing). Windows unverified locally — CI is the authority.

Closes #1598
Closes #1584