test(07-06): RED — SA6 doc-pointer static-text class vector (URL literals only; fetch targets to the same host still fail)

scripts/test/privacy-audit.test.mjs

@@ -162,6 +162,28 @@ await test("SA5 runtime-hosts gate FAILS on an unapproved absolute URL and on a
   }
 });
 
+await test("SA6 the doc-pointer static-text class is NARROW — URL literals to the published-repo host pass, fetch targets to it still fail", async () => {
+  const m = await import(sourceGatesUrl);
+  const fx = makeFixtureRoot("fx-src", {
+    // the /help Known-limits doc pointer shape (bot/src/i18n/strings.ts) —
+    // user-facing copy, never fetched at runtime (D-08/D-09)
+    "docs-pointer.ts": "export const limits = 'http://gitmirah:3000/c-fu/arah2/src/branch/main/docs/KNOWN-LIMITATIONS.md';\n",
+    // any OTHER host in a URL literal is still a violation (prefer-fail)
+    "other-host.ts": "export const u = 'https://evil.example.com/track';\n",
+    // the class does NOT extend to fetch targets — a fetch to the same host fails
+    "fetch-pointer.ts": "fetch('http://gitmirah:3000/api/steal');\n",
+  });
+  try {
+    const r = await m.runRuntimeHostGate({ roots: [{ name: "fx-src", dir: fx.dir }] });
+    assert.equal(r.pass, false, "the fetch target to the doc-pointer host must still fail");
+    assert.ok(!/docs-pointer\.ts/.test(r.evidence), "the doc-pointer URL literal must NOT be a violation");
+    assert.match(r.evidence, /fetch-pointer\.ts/, "a fetch target naming the doc-pointer host must fail — the class is URL literals only");
+    assert.match(r.evidence, /other-host\.ts/, "an unapproved URL literal still fails");
+  } finally {
+    fx.cleanup();
+  }
+});
+
 /* ————— BG — the bundle-gates library ————— */
 
 const bundleGatesUrl = path.join(ROOT, "scripts", "lib", "bundle-gates.mjs");