@@ -39,6 +39,8 @@ import { fileURLToPath } from 'node:url';
 
 import { describe, expect, it } from 'vitest';
 
+import { maskComments } from '../../../../scripts/js-comment-mask.mjs';
+
 const SPEC_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 const REPO_ROOT = path.resolve(SPEC_ROOT, '../..');
 const THIS_FILE = path.relative(REPO_ROOT, fileURLToPath(import.meta.url)).split(path.sep).join('/');
@@ -75,8 +77,13 @@ const PRODUCER_YAML = /^\s*(?:-\s+)?recipient_?[tT]ype\s*:\s*(['"]?)guest\1\s*(?
 
 const lineOf = (text: string, index: number): number => text.slice(0, index).split('\n').length;
 
-const producersIn = (ext: string, text: string, live = 'guest'): number[] => {
-  if (!text.includes(live)) return [];
+/** Extensions read as JS/TS source: their comments are blanked first, since a comment writes no row. */
+const CODE_EXT = new Set(['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs']);
+
+const producersIn = (ext: string, raw: string, live = 'guest'): number[] => {
+  if (!raw.includes(live)) return [];
+  // `maskComments` blanks comment content and keeps offsets and line numbers.
+  const text = CODE_EXT.has(ext) ? maskComments(raw) : raw;
   const out: number[] = [];
   const code = new RegExp(PRODUCER_CODE.source.replace('guest', live), 'g');
   for (let m = code.exec(text); m; m = code.exec(text)) out.push(lineOf(text, m.index));
@@ -87,7 +94,7 @@ const producersIn = (ext: string, text: string, live = 'guest'): number[] => {
   return [...new Set(out)].sort((a, b) => a - b);
 };
 
-/** The string literals inside the bracketed span that starts at `open`, comments stripped. */
+/** The string literals inside the bracketed span that starts at `open`, in comment-masked source. */
 const literalsInBrackets = (text: string, open: number): string[] => {
   let depth = 0;
   let end = -1;
@@ -96,12 +103,12 @@ const literalsInBrackets = (text: string, open: number): string[] => {
     else if (text[i] === ']') { depth -= 1; if (depth === 0) { end = i; break; } }
   }
   if (end < 0) return [];
-  const body = text.slice(open + 1, end).replace(/\/\/[^\n]*/g, '').replace(/\/\*[\s\S]*?\*\//g, '');
-  return [...body.matchAll(/(['"`])([^'"`]*)\1/g)].map((m) => m[2]!);
+  return [...text.slice(open + 1, end).matchAll(/(['"`])([^'"`]*)\1/g)].map((m) => m[2]!);
 };
 
 /** Leg 2: the options of the `recipient_type` select in a file that declares `sys_record_share`, or `null`. */
-const recordShareSelectOptions = (text: string): string[] | null => {
+const recordShareSelectOptions = (raw: string): string[] | null => {
+  const text = maskComments(raw);
   if (!/name:\s*['"]sys_record_share['"]/.test(text)) return null;
   const at = text.search(/recipient_type\s*:\s*Field\.select\(/);
   if (at < 0) return null;
@@ -110,10 +117,10 @@ const recordShareSelectOptions = (text: string): string[] | null => {
 };
 
 /** Leg 3: the literal members of `RecordShareRecipientType`, or `null` when the file does not declare it. */
-const unionMembers = (text: string): string[] | null => {
-  const m = /export\s+type\s+RecordShareRecipientType\s*=([^;]*);/.exec(text);
+const unionMembers = (raw: string): string[] | null => {
+  const m = /export\s+type\s+RecordShareRecipientType\s*=([^;]*);/.exec(maskComments(raw));
   if (!m) return null;
-  return [...m[1]!.replace(/\/\/[^\n]*/g, '').matchAll(/'([^']*)'/g)].map((x) => x[1]!);
+  return [...m[1]!.matchAll(/'([^']*)'/g)].map((x) => x[1]!);
 };
 
 describe('record-share guest recipient census — the matchers can see the value (planted positive controls)', () => {
@@ -130,6 +137,8 @@ describe('record-share guest recipient census — the matchers can see the value
     expect(producersIn('.ts', "({ anchor: 'guest', principalKind: 'guest', type: 'guest' })")).toEqual([]);
     expect(producersIn('.ts', "({ recipient_type: 'guest_portal' })")).toEqual([]);
     expect(producersIn('.md', 'The guest recipient type was removed.')).toEqual([]);
+    // A comment writes no row; the same words in a string literal do.
+    expect(producersIn('.ts', "// once: recipient_type: 'guest'\nconst x = 1;")).toEqual([]);
   });
 
   it('leg 2 reads the options of the record-share select, and finds a planted guest option', () => {
@@ -143,6 +152,8 @@ describe('record-share guest recipient census — the matchers can see the value
   it('leg 3 reads the union members, and finds a planted guest member', () => {
     expect(unionMembers("export type RecordShareRecipientType =\n  | 'user'\n  | 'guest';")).toEqual(['user', 'guest']);
     expect(unionMembers("export type SharingRuleRecipientType = 'user' | 'guest';")).toBeNull();
+    // A member named only in a comment is not a member.
+    expect(unionMembers("export type RecordShareRecipientType =\n  | 'user'\n  // | 'guest'\n  ;")).toEqual(['user']);
   });
 });