fix(lint): stop the progn fixes deleting a reader prefix

[takeokunn]

paredit fix --write was corrupting source. Over 5,556 unique Common Lisp files (12,477 raw, deduplicated by SHA-256, 88.1 MB), of the 2,606 files a fix run changed, 206 that SBCL could read before no longer read at all — 116 from redundant-body-progn, 98 from redundant-progn.

The cause is a span, not a missing guard

RuleFix::single(view.span, …)   // span starts at the form's own reader prefix

The replacement text is built from the inner form, so the prefix is deleted. Actual before/after, loop-parser-for.lisp:78:

 (defmacro %define-loop-for-parser (keyword fn-name (var remaining) &body body)
-  `(progn
-     (defun ,fn-name (,var ,remaining) ,@body)
+  (defun ,fn-name (,var ,remaining) ,@body)
      (setf *loop-for-parsers* ...)))

→ SBCL: READ-ERROR: Comma not inside a backquote.

The silent variant is worse. combin.lisp:283: `(list* ,@required (sb-c::%rest-list .rest.)) → (cons ,@required (sb-c::%rest-list .rest.)) — reads fine, means something else.

This is systemic: 2,086 of 17,400 fixes (12.0%) across 40 rules drop a ', `, ,, ,@ or #'.

redundant-body-progn's premise was false

`(progn …) is the standard shape of a multi-form macro expansion, not a redundant progn in an implicit-progn body. 197 of 204 classifiable firings (96.6%) were quasiquoted templates; combined data+template false-positive rate 98.0%.

Four changes, all in lint-control-flow

1. Fix region is view.content_span, so a prefix survives — `(progn ,x) → `,x, not ,x. The two spans coincide on unprefixed code.
2. Hard-quote guard, reading only the hard half of the two-counter QuoteState. Quasiquote is deliberately not suppressed — a template really does become code. Reuses with_lexical_chain (binary search + one top-level descent, never root_view()) and runs only once a finding exists.
3. (progn ,@forms) as sole body form is exempt — it wraps an expansion-dependent number of forms, and `,@forms is not a well-formed backquote expression at all. Mirrors the existing reader-conditional exemption.
4. is_progn now requires no reader prefix — a prefixed child is a datum in that slot, not a body form.

Measured effect, same corpus and method

	before	after
files SBCL read before but not after	206	16
prefix-dropping fixes (rules)	2,086 (40)	808 (38)
fixes inside a hard quote	99	92
fixes on genuinely evaluated code	2,826	2,826

That last row is the anti-over-suppression evidence: not one fix on real, unquoted code was lost. redundant-progn 259 → 41 firings with its code bucket unchanged at 28; redundant-body-progn 204 → 5 with its bucket unchanged at 4.

The oracle

Quote context was adjudicated by an oracle built from SBCL's own reader — a custom readtable recording byte ranges of '/`/, — validated against this repo's parser over 1,194 regions on a 120-file sample: 0 prefix-char mismatches, 0 rejected by inspect check.

Controls and mutation

12 new engine-level tests assert the rewritten source, not just the finding.

Positive: still fires on unquoted code; inside a quasiquote template (`(when c (progn ,a ,b)) → `(when c ,a ,b)); in a defmacro body; on every implicit-progn head; on (progn) → nil.

Negative: hard quote, long-hand (quote …), deep nesting, comma-inside-hard-quote, plus the symmetric ,(…)-inside-quasiquote case proving the guard is on hard rather than "has a data ancestor".

8 mutations, all killed, each verified by git diff --no-ext-diff --stat to have actually changed the file — including M1/M2, the is_data() mutation (the obvious wrong fix), killed by the quasiquote-template controls, and M8, the over-suppression mutation widening the splice test to any prefix.

Reported, not fixed

Kept out to stay reviewable:

• 38 rules still drop reader prefixes (808 fixes). Worst by rate: redundant-prog1 89.5%, redundant-the 80%, if-not 60%, empty-let 46.7%, constant-if-test 38.8%, subseq-zero 38.5%, nth-constant-index 31.8%. The remedy is the same content_span change applied here.
• 91 of 98 CL Fixable rules have no hard-quote guard — only lint-repl-debug's 7 carry one. A 25-line adversarial file of a quoted HyperSpec-style table took 21 applied fixes, rewriting every row.
• The 16 residual read-breaks: single-operand-boolean (5), list-star-to-cons (4), negated-if (3), cons-to-list, append-nil, if-to-unless, empty-let.

Caveat on the hard-quote figures: only 3,570 of 17,400 fixes could be quote-classified, because the sandboxed reader (*read-eval* nil, fresh package) rejects files using #., custom readtables, or undefined packages. Those numbers are a ~20% sample and likely an under-count. The prefix-drop and read-break figures cover the whole corpus.

Gates

cargo build -p / cargo test -p paredit-feature-lint-control-flow (364 passed) / clippy --all-targets -- -D warnings / fmt --check / cargo test --test cli (3,085 passed) — all exit 0, each read unpiped.

No golden and no pinned count moved; fix list still reports rule_count: 106. So no repo fixture contained one of these false positives.