feat(learning-harness): absence rows travel with their registration

Eight of the ten vendored access-control rows had no named handler at all,
so every one of them would have scored `missing_context` forever rather
than as a detector miss. After the re-harvest nine are named and the tenth
states its reason.

The handler-context mode now carries the class its framework registers,
multi-line decorators, and commented-out guards -- `#@token_required`
above a ThreatByte handler is the entire bug. Where the registration lives
in another document (connexion's `operationId`, an express router), a
recipe names `context = [...]`, the harvester writes that stanza per side,
and the pair materializes both files at their repository-relative paths so
the entry-point mapper sees the layout the project has. `harvest_recipe`
fetches every blob before the first write and the driver takes `--report`,
so a failed fetch leaves a reviewed excerpt exactly as it was.

Two defects the re-harvest exposed: `.mjs` was not a known suffix, so the
one pair vendored as an ES module had no file target at all; and
`_python_route_access` matched auth words inside decorator prose, reading
`@ns.doc(description='... without proper authorization checks')` as a
guard. Recorded in the hygiene artifact: nine of the ten duplicate groups
sit on both sides of the split, which the repository-level split cannot
see.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG

benchmarks/pairs/agent-vfc/recipes.toml

@@ -904,7 +904,7 @@ repo = "amitknigam84/lensops"
 parent = "9b87ecc3a44a7fe2a5185cca1fe52441647d5748"
 commit = "fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84"
 path = "components/KubernetesManagement.tsx"
-mode = "hunk"
+mode = "handler_context"
 language = "typescript"
 relpath = "components/KubernetesManagement.tsx"
 license = "MIT"
@@ -920,6 +920,11 @@ trailer = "Co-Authored-By: Claude Sonnet 4.6 <[email protected]>"
 reviewer = "pending"
 evidence = "Fix missing auth header on namespaces API call"
 commit_url = "https://github.com/amitknigam84/lensops/commit/fe49109aedfe21dea4d24d4d9f2fa3f1ecfb6c84"
+family = "access_control"
+function = "loadNamespaces"
+line = 805
+fix_line = 805
+known_limit = "client_side_caller"
 split = "holdout"
 
 [[recipe]]
@@ -1211,7 +1216,7 @@ repo = "HHHHHejia/openniw"
 parent = "4d91ed82fa9a5ec6bf5ef96da1d221fc187700dc"
 commit = "0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10"
 path = "backend/app/routers/jobs.py"
-mode = "hunk"
+mode = "handler_context"
 language = "python"
 relpath = "backend/app/routers/jobs.py"
 license = "MIT"
@@ -1227,6 +1232,8 @@ trailer = "Co-Authored-By: Claude Fable 5 <[email protected]>"
 reviewer = "pending"
 evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership"
 commit_url = "https://github.com/HHHHHejia/openniw/commit/0fc94733f6ca3c6b129a0a8e6d7b3acce19d5a10"
+family = "access_control"
+function = "get_job"
 split = "train"
 
 [[recipe]]
@@ -1236,7 +1243,7 @@ repo = "ziyuzuo/openniw"
 parent = "98a0c392ba96cd2c4aa746dd6fc2b183f385225e"
 commit = "b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68"
 path = "backend/app/routers/jobs.py"
-mode = "hunk"
+mode = "handler_context"
 language = "python"
 relpath = "backend/app/routers/jobs.py"
 license = "MIT"
@@ -1252,6 +1259,8 @@ trailer = "Co-Authored-By: Claude Fable 5 <[email protected]>"
 reviewer = "pending"
 evidence = "Fix IDOR on job endpoint: case-bound jobs require case ownership"
 commit_url = "https://github.com/ziyuzuo/openniw/commit/b74de31b0a5f37e4e929ba6aa74dbe0f5e6d9a68"
+family = "access_control"
+function = "get_job"
 split = "holdout"
 
 [[recipe]]
@@ -1261,7 +1270,7 @@ repo = "ZUENS2020/overleaf-with-claude"
 parent = "5a886aa9fb9fe4e2203f3cb1d62c91f4be0525ed"
 commit = "3980b9e5806defb63e45ae2696e6c1899f3a8431"
 path = "services/web/app/src/Features/Exports/ExportsController.mjs"
-mode = "hunk"
+mode = "handler_context"
 language = "javascript"
 relpath = "services/web/app/src/Features/Exports/ExportsController.mjs"
 license = "AGPL-3.0"
@@ -1277,6 +1286,9 @@ trailer = "Co-authored-by: briangough <[email protected]
 reviewer = "pending"
 evidence = "Fix IDOR in exports by adding token verification (Issue #31637) (#32883)"
 commit_url = "https://github.com/ZUENS2020/overleaf-with-claude/commit/3980b9e5806defb63e45ae2696e6c1899f3a8431"
+family = "access_control"
+function = "exportProject"
+context = ["services/web/app/src/router.mjs"]
 split = "train"
 
 [[recipe]]
@@ -1468,7 +1480,7 @@ repo = "bigfivefoods/supplieradvisor-mvp"
 parent = "a7a9bc260d649ea2e582c07435bfd7d93100647b"
 commit = "387bcf40e984a2ee1832ab7beabf0284c5b627d8"
 path = "app/api/customers/claims/route.ts"
-mode = "hunk"
+mode = "handler_context"
 language = "typescript"
 relpath = "app/api/customers/claims/route.ts"
 license = "MIT"
@@ -1484,6 +1496,8 @@ trailer = "Co-authored-by: bigfivefoods <[email protected]
 reviewer = "pending"
 evidence = "Brief 62: Fix IDOR on customer_claims PATCH/DELETE (#156)"
 commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/387bcf40e984a2ee1832ab7beabf0284c5b627d8"
+family = "access_control"
+function = "PATCH"
 split = "holdout"
 
 [[recipe]]
@@ -1493,7 +1507,7 @@ repo = "bigfivefoods/supplieradvisor-mvp"
 parent = "8558538471e4fb10856f8d9a17d2be5ab5c4fb9c"
 commit = "a69e8f27c0f4d402573d16f0612b51155bbc46e1"
 path = "app/api/customers/opportunities/route.ts"
-mode = "hunk"
+mode = "handler_context"
 language = "typescript"
 relpath = "app/api/customers/opportunities/route.ts"
 license = "MIT"
@@ -1509,6 +1523,8 @@ trailer = "Co-authored-by: bigfivefoods <[email protected]
 reviewer = "pending"
 evidence = "Brief 60: Fix IDOR on opportunities GET/PATCH/DELETE (missing company membership checks) (#148)"
 commit_url = "https://github.com/bigfivefoods/supplieradvisor-mvp/commit/a69e8f27c0f4d402573d16f0612b51155bbc46e1"
+family = "access_control"
+function = "GET"
 split = "train"
 
 [[recipe]]