Treat an unreadable __artifacts_v2__ as a sink, not as a non-sink

[abrignoni]

The hole

A module whose __artifacts_v2__ is built by a helper cannot be evaluated statically, so declares_html_columns() returns None. is_sink read that as falsy:

is_sink = bool(declares) or uses_media_helper(tree) or in_scope_functions

So the module was skipped by all three rules — not just by unguarded-html-columns, which is the only one that actually needs the declaration.

That is fail-open in the one case where the answer is unknown. A module in the NOT CHECKED list could gain an html_columns tomorrow and stay completely unguarded, with nothing in the output changing to say so.

The fix

An unreadable declaration is now treated as a sink. The uncertainty costs coverage of one rule instead of all three.

Proof it does something

A probe artifact whose __artifacts_v2__ is helper-built, carrying both an unescaped interpolation and a remote <img src>:

	findings
old behaviour	0
this change	3

Proof it costs nothing

Measured before committing: no module currently in any core's NOT CHECKED list produces a finding under the new default. No new baseline entries, no allowlist growth.

Checked the other way too — of the eleven such modules across the cores, ten declare no html_columns at runtime, and the eleventh (RLEAPP kikReturns) was already being scanned through a media helper. The hole was latent, not live.

The NOT CHECKED banner now states that the other two rules still run, so the list reads as one missing rule rather than as an unscanned module.

Validation

• pylint --disable=C,R = 10.00; lint_changed reports no new warnings
• unit tests OK; the check still exits 0 on this tree

🤖 Generated with Claude Code