The scan matched a backtick code span in a comment, and a prose string
inside an object literal before a ternary colon, as reads of
REVIEW_CAPABILITY_TOKEN. Comments and one-line strings are now blanked
before the code patterns run, and a string literal counts as a key only
when it is exactly the name, so template-literal keys still count.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

@@ -16,0 +12,5 @@
+// Comments and messages elsewhere mention the variable in prose, so only the name
+// spelled as a key counts as a read: a string literal that is exactly the name, or the
+// name in code once comments and one-line strings are blanked. A literal that spans lines
+// or interpolates stays as code, because a quote inside a regex literal can open a
+// literal that runs past its real end. A key built at run time is invisible to this scan.

@@ -18,2 +23,6 @@
 ];
 
+function blankProse(token: string): string {
+  if (token.startsWith("/")) {
+    return " ";
+  }

@@ -22,0 +34,5 @@
+  if (literals.some((literal) => CAPABILITY_TOKEN_KEY.test(literal))) {
+    return true;
+  }
+  const code = source.replace(COMMENT_OR_STRING, blankProse);
+  return CAPABILITY_TOKEN_CODE_READS.some((pattern) => pattern.test(code));