refactor: close the Medium tech-debt findings from 20260803

[mrojas54]

Closes the remaining Medium findings from the 20260803 tech-debt assessment. Four commits, each independently green.

What changed

Commit	Finding	Result
dee95e4	12 duplicated fake-lmnr suppressions	# type: ignore 21 → 10
c4f1a79	shell_safety.py had no co-located test file	24 tests moved, importing the module directly
82f7824	JSONL parse duplication	one shared reader — plus a latent crash fixed
150c387	the package's two longest functions	main() 176 → 104, _resolve_corpus() 141 → 57

The one behavior change: a real crash in find_located

The report called this "5 duplicated JSONL sites." Reading them, only two actually are (parsers.py ×2). Of the rest, adapters.py must not count malformed lines (S5 — counting there charges a session twice) and needs raw lines to replay via chain(buffered, lines); complex.py:326 decodes a payload embedded in a text block and is not a line reader at all. Both are left alone, with comments recording why.

The fifth, find_located, had no isinstance guard. A line of valid-but-non-object JSON reached entry.get(...):

AttributeError: 'int' object has no attribute 'get'

That took down the whole scoring run over one garbled transcript line. Routing it through the shared reader closes it, and mypy --strict then surfaced three more of the same class on the same path — message, content, and text were each dereferenced before their type was checked. All four now follow ClaudeParser.parse's existing discipline: a field arriving from outside is not a value until its type is checked.

test_a_bare_scalar_line_is_skipped_not_a_crash pins all four. Verified load-bearing — it fails with exactly that AttributeError against the previous find_located body, and passes after.

Notes for review

• tests.fakes.make_module removes a suppression rather than relocating it. types.ModuleType declares no attributes, so module.Laminar = ... is an attr-defined error and each of the 12 sites carried its own ignore. setattr is typed (object, str, Any), so the factory is checked as written and needs no suppression at all.
• The passive.py split is pure restructuring. Every comment moved with the code it explains; no control flow, disclosure string, or exit code changed. One ordering note: freeze_note is now computed at the render call instead of before the early return — same inputs, same value, and the early-return path never used it.
• TRIAL_ROOT is deliberately defined in both test files. Scoring still needs it, and its "never stat it, so it need not exist" property is what the read-escape audit leans on.
• The logfire High finding from the same report was already closed by 312d258 before this branch started.

Verification

Run on the merge of this branch with origin/main:

Check	Result
uv run ruff check .	clean — All checks passed!
uv run python -m toolbench.complexity_gate --base origin/main	0 errors, 0 warnings
uv run mypy --strict src/toolbench tests	clean — 49 source files
uv run pytest -q	748 passed, 2 skipped, 10 subtests

Test count moved 747 → 748: the one addition is the regression test above. No test was lost or rewritten in the test_complex.py → test_shell_safety.py split.

Package functions over 100 lines: 12 → 10.

🤖 Generated with Claude Code