Bug-hunt round 9: verbs agree with the gates they mint for, and two dead detector legs come alive

[REPPL]

What

Bug-hunt round 9 (bughunt-b). Baseline green before any change (make preflight exit 0 with the full suite executed — 77 package results including the race lane — and gofmt -l . empty) after unshallowing this environment's clone. Five parallel hunters swept the four dimensions; every candidate went through an independent adversarial refuter. 21 candidates in; 12 substantive and 5 nitpicks confirmed and fixed, 4 refuted or prior art, 2 recorded open.

Confirmed and fixed — substantive

1. capture --blocked-by minted records its own blocker refuses (internal/core/capture/workflow.go, iss-2608261437046287). Shape-only validation wrote a dangling cross-reference with exit 0; record_schema (blocker) then wedged preflight on the tool's own output — the invariant workflow.go states verbatim ("the tool's own resolve path can never mint a record its own blocker rejects"), swept for --intent/--spec and missed here. Capture now probes each target through the shared existence probe before reserving a path; a resolved/wontfix target stays legal (watched-fail test both directions).
2. Intent verbs refused lint-green spec_id spellings (internal/core/intent/lifecycle.go:306, ready.go:166, audit.go:182, internal/core/spec/spec.go:82; iss-2608261437047643). Lint matches spec references by number and the store's reservation check tolerates spc-N-slug/spc-0N by recorded design (iss-68 P5), but Reconcile compared raw strings and Lookup compared exactly — a record every gate passes bricked intent ready, spec close, intent link and the audit emit. The verbs now resolve by number via shared SameNum/HasNum helpers; the strict grammar still guards CLI arguments; unparseable values match nothing.
3. RD002's rename leg was dead and its failures read as clean (scripts/check-reviews.sh:53, iss-2608261437044382). git log --diff-filter=MR under a pathspec limited to the new path can never form a rename pair, so renaming a review file in the same commit as a full rewrite passed the append-only gate — reproduced; and the stderr swallow turned any git failure into a clean pass. One --name-status --diff-filter=DMRT history pass over the reviews root now refuses every modify/rename/delete of a dated review file (closing the previously deferred deletion case with the same line), git failures exit 2, unborn HEAD reports loudly, and a new scripts/check-reviews-cases.sh pins eight polarities in the Makefile gate and CI — 5 of 8 fail against the old script.
4. A ledger record missing schema_version vanished while every gate stayed green (internal/core/lint/schema.go, internal/surface/cli/cli.go, iss-2608261437041050). The reader skips such a record (list omits it, the bare status board silently undercounted, dispatch says not found) and record_schema never asserted required properties — a live record hand-edited three days ago sat invisible through two bug-hunt rounds. The issue store now declares its required frontmatter from a new shared internal/core/issueschema leaf both the reader and the lint consume (an import cycle bars exporting from capture — proved empirically), the status board renders the skipped roster, and the live record is repaired in place with id, filename and provenance intact.
5. cleanLessonProse kept the body the CleanProse consolidation claims it routed (internal/core/lifeboat/graveyard_lessons.go:313, iss-2608261437040578). Byte-identical to the pre-migration cleanSynthProseN: only <!-- neutralised, and before Sanitize — the ordering termsafe/prose.go documents as forging <? from a masked control byte (reproduced). Now delegates to termsafe.CleanProse with the unchanged cap; two watched-fail tests pin the opener class and the ordering.
6. ScanSpecLinks failed open on the intent tree (internal/core/lint/speclinks.go:106-112, iss-2608261437049307). The intent half swallowed every walk/read error while the spec half ten lines later fails closed — and the fail-open half feeds release.staleIntents, the guard whose own doc says it exists to stop a silent under-bump. Errors now propagate; a missing intents root stays soft (the documented unpopulated-repository state).
7. RS001's superseded rule survived at three doc sites (README.md:44, AGENTS.md:171, principles/the-record-lands-with-the-act.md:50; iss-2608261437041111). All three taught the leaves-open/ predicate — under which a bare git rm satisfies a Resolves: trailer, the exact hole round 8 closed — and the README's flagship refusal example quoted a message the gate no longer emits.
8. README miscounted the plugin surface (README.md:110, iss-2608261437042550). "Adds one command" — the brief's surface chapters and the 2026-07-11 sign-off record three host-delegated markdown commands with no Go verb (prepare-this-repo, consult, ingest); the CLI refuses the latter two by name.
9. The CHANGELOG promised a Breaking section the derived ingest cannot emit (CHANGELOG.md:8, iss-2608261437046261). The section set is closed at six and the refusal is structural, so the promise became unfulfillable at v0.6.0's final manual roll. Header now states the derived truth (the minor bump is the signal); adr-37 carries a dated amendment in the repo's established form; the version-arithmetic comment quotes the amendment.
10. The site build README asserted a theme control that does not exist (site-src/README.md:11, iss-2608261437047965). The explorer shipped without it and the stylesheet's header was corrected in that same commit; the README clause was left behind, contradicting the file one directory over. Nothing in the tree sets data-theme.
11. The live disciplines bucket missed the spc-28 rename (five files under .abcd/development/intents/disciplines/, iss-2608261437043634 + iss-2608261437043962). itd-1 instructed running /abcd:intent review — a verb the binary refuses — and five active cross-cutting rules named the removed intent-fidelity-reviewer; the bucket appears in neither spc-28's swept inventory nor its not-swept list, and intent audit refuses non-shipped intents, so no reconciliation event could ever fire. 21 substitutions plus itd-5's task_classes line repointed at the naming registry (iss-265) with intent_audit; stored artefact spellings stay frozen; spc-28's not-swept paragraph records the late sweep; drafts//planned/ stay deliberately unswept under iss-94.
12. itd-43 specified work against the retired terminology/ tree (.abcd/development/intents/planned/itd-43-...md, iss-2608261437044340). Its problem statement asserted a term file that does not exist, its canonical-term scope bullet and AC2 pointed at a path that cannot come into existence, two open questions were answered by its own spec, and two schema files never existed in the Go rebuild. Reconciled in place (the iss-392 precedent on this same file); the live remainder — the reviews-subsystem rename, correctly blocked on itd-28 — stands untouched.

Confirmed and fixed — nitpicks

13. CI-account rosters (CONTRIBUTING.md:22, AGENTS.md:77, ci.yml:5-10; iss-2608261437047992): the Linux leg's blocking site-render gate and the record-lint job's RS001–RS003 steps were absent from all three closed enumerations (iss-318 established these sentences as intended-exhaustive).
14. firstRootSHA unbounded (internal/core/lifeboat/probe.go:557, iss-2608261437048689): the one uncapped git read in the file that documents every-read-is-bounded; now RunLimited + rev-list -n 1, with a source-guard test.
15. .gitattributes eol gap (iss-2608261437040448): site-src/install.sh.tmpl — the one distributed shell artefact — lacked the text eol=lf pin its five siblings carry; a CRLF render would publish an installer curl | sh cannot run.
16. itd-24's glossary_terms_used (iss-2608261437046944): listed the nonexistent core/epic (the armed forbidden synonym) beside its successor core/spec; dropped losslessly.
17. (folded into 11) itd-5's phantom task_classes enum claim.

Considered and rejected (refuted or prior art)

• renderReviewMD writes provenance fields via Sanitize only — real, but verbatim the subject of open issue disembark review writes untrusted _provenance.json fields (source_name, manifest_sha256) into the durable review .md via termsafe.Sanitize, which does not neutralize CommonMark HTML-block openers — so a hostile lifeboat can make the review record hide its own findings #325; an elaboration (the evidence-path vector), not a new discovery. Not fixed here to keep the round honest about provenance.
• Receipt sha-width split (RD001 {40} vs --release-gate {7,64}) — two different jobs, not one contract: the arming input is a path-safety filter on a release-time external value, the directory sha is machine-derived 40-hex on every real path, and the width is documented where RD001 is defined; widening would fail open.
• Principles README's "not-yet-enforced layer" claim — the principle in question already records its unmet promotion condition and its tracking issue; the class-level residue is exactly open iss-390's scope, and the README claim has more counter-examples than the candidate counted.
• DECISIONS.md ordering inversions — order-independence is declared design (.gitattributes merge=union with its rationale); one claimed instance was not even a merge, and iss-2608220150157511 already rules append logs tolerate union merges.

Recorded open (not fixed here)

• iss-2608261447039180 — an unknown frontmatter property hides a ledger record the same way a missing one did (the second half of the visibility gap; the repaired live record demonstrated it).
• iss-2608261437042674 — itd-5's scope step still carries the tiebreak its own 2026-07-12 amendment struck.

Verification

make preflight exit 0 on the final merged tree (lint-reviews with the new cases harness, lint-issues, record-lint, docs-lint, site-render, build, vet, test, race — 77 package results, suite executed) and gofmt -l . empty; scripts/check-attribution.sh commits clean over the range. origin/main was merged after #516/#517 landed mid-round; the merge was clean and the full gate re-ran green on the merged tree. Every behaviour change carries a test watched fail before the change and pass after: the dangling --blocked-by refusal, the spec_id spelling tolerance at all four verb sites, the RD002 rename/rewrite/deletion refusals (5 of 8 harness cases fail against the old gate), the required-frontmatter blocker, the status-board skip roster, the CleanProse opener and ordering cases, the gitutil.Run source guard, and the ScanSpecLinks dangling-symlink propagation. Each confirmed finding is captured in the ledger and resolved with fixing-commit provenance in this PR (RS001 checks all 17 trailers).

Assisted-by: Claude:claude-fable-5

[REPPL]

Merge gate — round 9

CI: all 13 checks green on head f5cbae31 — check (ubuntu-latest), check (macos-latest), record-lint, attribution, external-review, gitleaks, zizmor, govulncheck, dependency-review, smoke, screenshots, changes (the one cancelled attribution run belongs to the superseded pre-merge head).

Two independent adversarial reviews of the full diff — both SHIP:

• Reviewer A (Claude Opus 5): SHIP. Re-ran every watched-fail test against the base source and confirmed all twelve fail pre-fix and pass post-fix; verified captureBlockers precedes every side effect, the RD002 tab parsing and heredoc feed, no misfire of the required-fields invariant on the adr/itd/spc stores, gates fully green, ledger discipline (19 captured, 17 resolved in range with reachable stamps), and tight scope. Eleven non-blocking observations, chiefly: the tolerant spec-number regex is looser than its comment's enumerated spellings (tail unanchored — traversal risk traced to ground and closed); Link stamps the caller's spelling rather than the resolved record's id; the cases harness's fail polarity accepts any nonzero exit; a single rename is double-reported; ~8 design-record-only resolutions are stamped impact: fix where internal would keep them out of the public changelog (re-stampable before the next cut).
• Reviewer B (Claude Fable 5): SHIP. Independently verified exact-match precedence in the number-resolving Lookup, both polarities of the RD002 rewrite on the live history (no over-refusal: reviews/README.md and the receipt directories stay outside the population), reader↔lint agreement in both directions for the required-fields invariant, that CleanProse is a strict superset of the old lesson cleaner, commit/attribution/privacy compliance, and RS001 over all 17 trailers. Twelve non-blocking observations, chiefly: two narrow residual RD002 gaps worth a follow-up capture (an edit hidden inside a merge commit's own diff; a core.quotepath-quoted filename escaping the population regex), and the octopus regression test pins agreement with itself rather than with the old read.

Both reviewers flag one thing for the merger: land this with a merge commit, not squash or rebase — the 17 resolved_by.commit stamps name branch shas, and a history rewrite would turn RS003 red on main for everyone.

Auto-merge is not authorised for this loop; the PR stays open for a human to merge.

Assisted-by: Claude:claude-fable-5

---

Generated by Claude Code