fix: keep the renderer's own log out of the portability audit

Second false-positive class, found on loglens in the wave2 re-baseline: the only
file the audit flagged was codeplain.log, which records broker activity and
module names and so contains codeplain-tty by construction. The directory
exemption added in 3127595 does not cover it — it is a file, not a tree.

Against the real artifacts the audit now reports nothing for either loglens or
cli-password-manager, where it previously flagged one and four files.

Author: gorandodig

render_machine/platform_test_audit.py

@@ -31,6 +31,11 @@
 
 MAX_AUDITED_FILE_BYTES = 4 * 1024 * 1024  # a delivered source file larger than this is not source
 
+# Suffixes that are never delivered source. Logs matter most: the renderer's own
+# codeplain.log records broker activity and module names, so auditing it reports the
+# render's diagnostics as if the application had referenced the helper.
+SKIPPED_FILE_SUFFIXES = (".log",)
+
 
 class PlatformBoundaryViolation(Exception):
     """A delivered build references Codeplain's private test tooling."""
@@ -44,6 +49,8 @@ def find_platform_references(build_folder: str) -> List[str]:
             name for name in directories if name not in SKIPPED_DIRECTORIES and name not in INTERNAL_TEST_DIRECTORIES
         ]
         for file_name in file_names:
+            if file_name.endswith(SKIPPED_FILE_SUFFIXES):
+                continue
             path = os.path.join(root, file_name)
             relative = os.path.relpath(path, build_folder)
             if any(marker in file_name for marker in HELPER_REFERENCE_MARKERS):

tests/test_platform_test_audit.py

@@ -68,3 +68,13 @@ def test_delivered_code_is_still_audited_alongside_them(tmp_path):
     (tmp_path / "vault.py").write_text("os.environ['CODEPLAIN_TTY_ENDPOINT']\n")
 
     assert find_platform_references(str(tmp_path)) == ["vault.py"]
+
+
+def test_the_renderers_own_log_is_not_audited(tmp_path):
+    """codeplain.log records broker activity and module names, so auditing it reports the
+    render's own diagnostics as if the application had referenced the helper. Seen on
+    loglens, where the log was the single flagged file."""
+    (tmp_path / "codeplain.log").write_text("DEBUG codeplain: the codeplain-tty broker thread started\n")
+    (tmp_path / "cli.js").write_text("console.log('hi')\n")
+
+    assert find_platform_references(str(tmp_path)) == []