fix: bughunt round 2 — eleven records fixed, iss-201 closed, iss-358 wontfixed on review evidence

[REPPL]

Autonomous all-dimensions bug-hunt, round 2 (branch bughunt-b/round-2). Baseline (make preflight + gofmt -l .) green before any change and green again on the final merged tree (68 packages tested). Every finding survived an independent adversarial refutation before capture; every behaviour change has a test watched failing first. All findings live in the committed ledger as iss-N records (never as forge issues), captured before the fixes per the record-first rule. Two ids minted this round collided with a parallel hunt's mints that landed on main mid-round; they are re-minted as iss-358/iss-359 per the collision protocol (fresh capture, ids never hand-edited).

Confirmed substantive, fixed

• iss-359 — internal/core/cite/fetch.go: a redirect-controlled FinalURL carried C1/bidi/zero-width runes raw into docs cite refresh --json and the committed citations baseline (encoding/json escapes only C0 + U+2028/9 — measured and pinned). The fetch boundary now percent-encodes them byte-wise (lossless on invalid UTF-8 too), Baseline.validate refuses them from any producer, and the false JSON-needs-no-sanitising claims in termsafe.go and lifeboat/coverage.go are corrected. Tests: TestRedirectTargetControlRunesNotRecordedRaw, TestEncodeHiddenRunesKeepsInvalidBytes, TestBaselineRefusesControlRunesInFinalURL, TestJSONLeavesC1AndBidiRaw.
• iss-346 — internal/surface/cli/guard.go: the "also matched" line rendered Matches[1:], but Matches is blockers-warns-synthetics ordered, so a synthetic block over registry warns dropped the matched warn and echoed the winner twice. Display now selects by id; core Matches untouched (the corpus warn-rate gate reads it). Test: TestGuardCheckAlsoMatchedListsTheNonWinners.
• iss-347 — readTranscript was the one guarded read left off fsutil.ReadGuarded — no O_NOFOLLOW (a symlinked transcript_path was followed and persisted; reproduced) and no cap+1 probe (a growing file stored silently truncated against spc-4's refuse-whole invariant). Test: TestHookSessionEndRefusesSymlinkedTranscript.
• iss-201 (pre-existing record, closed) — readHookInput and the guard hook read exactly the cap, misreporting an over-cap payload as malformed host JSON; both now read cap+1 and name the cap, mirroring guardCandidate. Tests: TestHookPromptRouterReportsAnOverCapPayload (+ at-cap boundary case), TestGuardHookReportsAnOverCapPayload.
• iss-348 — the root command hid the shipped record-id dispatch (Usage: abcd, no Long); the sole command in the tree with an undeclared positional. Use/Long now state it; reference regenerated; spc-26 golden tests green.
• iss-349 — docs/reference/terminology.md listed the pre-tool-use shell guard among "deterministic, fail-closed gates" — the opposite of adr-42's fail-open-loud mistake filter, on the page written for an evaluator, in the sentence citing enforcement claims are facts.
• iss-350 — the README promised bare abcd ahoy reports the off-PATH gap after the copy one-liner install; reproduced both branches (no plugin root → no PATH gap at all; resolvable root → symlink.foreign, resolve-manually). The sentence now names the installer's reachability note, the thing that actually prints the fix.
• iss-351 — six sites hand-rostered "the three disciplines (itd-1, itd-5, itd-37)" while intents/disciplines/ holds six; the sites now point at the directory, and the genuinely phase-scoped mentions say so.
• iss-352 — three records cited ADRs at development/research/adr/ (never existed; adr-30 rejected the layout), invisible to links_resolve as code spans; repointed as markdown links the blocker rule gates. adr-30's own rejected-alternative mention untouched.
• iss-353 — research/notes/README.md prescribed undated <topic>-<kind> naming against adr-30, development/README.md, the record-lint successor path, and the ideate writer (29 of 41 notes are dated); the outlier section rewritten, nothing renamed.
• iss-354 — no test coupled ci.yml's three go-version pins to AbcdSubstitutions().GoVersion (the d594511→8b70d70 drift shipped CI-green binaries on an unpatched toolchain). TestWorkflowGoVersionsMatchSubstitutions added, verified by mutation.
• iss-356 — grouped nitpick batch, all thirteen items fixed: guard-help backtick disclosure (iss-148 remains the parser record), urlguard RFC 6890 ranges incl. CGNAT 100.64/10, repolint not-scanned warn for oversize textual files, 64-hex --commit, launch --dry-run required Short, release.yml --verify-tag/rehearsal wording (+ scaffold templates, byte parity held), dependabot pip ecosystem for /docs, five-of-nine chapter rosters, phase-6/06-lint change-narration blocks, phantom ledger citation, retired activity-record noun.

Built, reviewed, reverted — wontfix (iss-358)

The scanner hostname trailing-\b fix (lanHostRe/deviceHostRe, the residual of hunt A's iss-307 sweep) was implemented with a watched-fail test and then reverted on this PR's own pre-merge adversarial review, which proved the loosened pattern flags ordinary snake_case selectors — stream.local_addr (Rust), args.local_rank (Python), storage.local_key (JS) — and Stage-1 redaction rewrites every finding into the history store, the one irreversible artefact abcd writes. The warn-tier miss on an underscore-suffixed hostname is the accepted cost; TestSnakeCaseSelectorsStayQuiet pins the decision, and the record annotates why the original whole-tree no-regression sweep was insufficient evidence.

Confirmed substantive, recorded not fixed (stays open)

• iss-355 — a batched merge-queue push makes github.sha the batch tip, so auto-release tags the wrong commit and release.yml's HEAD^2^ receipt derivation resolves an unrelated PR's commit whenever the release roll is not the last entry in its batch; the ancestry guard passes and the run wedges after the immutable tag — iss-326's outcome by a route the itd-93 pre-merge check cannot close (batch composition is the queue's decision). Proven from this repo's own merge history and auto-release run numbering. Required-check workflow logic, unverifiable without a live Actions run (the iss-301/302 precedent), so the record carries two proposed fixes: a receipts-presence-searching derivation (fail-closed before any tag, mirrored into a batch-simulating rehearsal), or max_entries_to_merge: 1.
• iss-357 — memory ingest records a redirect-controlled FinalURL verbatim into stored material origins: the iss-359 class one door over, recorded for a future round.

Considered and rejected (refuted candidates)

• The external-review required check wedging under pull_request_target — refuted empirically: check runs attach to the PR head sha. Incidental observation for iss-302: role_of returned admin under read-only perms, so its severity clause about 403s did not reproduce.
• The docs site being "outside every gate" — docs-lint gates docs/ on every PR; the inert classifier and dashboard build are recorded decisions (iss-234, wrangler.jsonc).
• Empty how-to/tutorials/reference promises — genre statements of a committed Diátaxis IA; the gaps are owned (iss-216, the facilitator plan).
• Email case-folding at the identity pin — byte-exact parity with the sh pre-commit gate is a documented cross-implementation contract; folding would be a fail-open loosening.
• The guard's top-level backtick silent allow as a fix target — open prior art (iss-148) with a reverted fix behind it; only its missing help-text disclosure was new (fixed under iss-356).
• resolvedSHA 64-hex widening — prior art iss-206, and GitHub has no SHA-256 object format on this value's path.
• A .PHONY completeness fix — inert for the targets named.

Dedup boundary

iss-307, iss-311, iss-317, iss-319, iss-321, iss-325 (hunt A's reconciliation) and the v0.6.0 wedge (iss-326/327, dispositioned into itd-93) were already held by the sibling loop or the maintainer and were not re-reported; iss-358 is the declared residual of iss-307's sweep, and iss-355 is the batch-composition route iss-326/327 do not cover.

Round 2 of the bug-hunt loop (state: #368). Gates: make preflight + gofmt -l . + scripts/check-attribution.sh green locally on the merged tree; CHANGELOG entries cite their iss-N handles; round summary appended to .abcd/work/DECISIONS.md.

Assisted-by: Claude:claude-fable-5

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	abcd	7aaef13	Aug 20 2026, 08:54 AM

[REPPL]

Merge gate — dual independent review + CI

CI on head 7aaef13b: all 13 checks green — check (macos + ubuntu), record-lint, smoke, gitleaks, zizmor, attribution, external-review, govulncheck, changes, dependency-review, Workers Builds. (make preflight, gofmt -l ., abcd lint at its main baseline, and check-attribution.sh also green locally on the merged tree.)

Reviewer A (Claude Fable 5): SHIP. Mutation-tested every new test by reverting each fix (none vacuous), verified the 51-entry committed baseline against the new validate rung, confirmed the ledger's capture-before-fix ordering and iss-355's evidence against the live workflows. Two concerns, both acted on: encodeHiddenRunes was lossy on invalid UTF-8 (now byte-wise, tested), and the memory-ingest FinalURL sibling site was unrecorded (now iss-357).

Reviewer B (Claude Opus 5): NO-SHIP — two blockers, both accepted as correct:

1. The scanner hostname-boundary fix flagged ordinary snake_case selectors (stream.local_addr, args.local_rank, storage.local_key) and Stage-1 redaction would have rewritten them into the irreversible history store. Response: reverted; iss-358 wontfixed with the measured false-positive cost; TestSnakeCaseSelectorsStayQuiet pins the decision; the record annotates why the original whole-tree sweep was insufficient evidence.
2. The new urlguard test added six unwaivered IP literals, doubling the repo's own abcd lint errors. Response: waivers added; the dogfood lint is back at its main baseline (verified against a clean checkout of main), with a negative control proving the waivers are load-bearing rather than a rule loosening.
   All of B's concerns and nits were also addressed (byte-wise encoding, repolint probe error path, over-cap message wording, rehearsal comment reflow, iss-355 citation precision).

Delta verification (independent third reviewer): BLOCKERS-CLOSED — the revert is byte-exact against the pattern's prior state, the selectors round-trip unmodified through ScanText+Redact, the regression pin fails when the reverted change is restored, and the full gate is clean including the race leg.

Also handled mid-gate: the merge conflict after main absorbed hunt A's reconciliation (resolved by keeping both new guard-help disclosure lines and regenerating the CLI reference with the repo's tooling), the concurrent-mint id collision (iss-344/345 re-minted as iss-358/359, references moved, ids never hand-edited), and the commit-identity correction the attribution gate's own remedy prescribes.

Auto-merge has been enabled by the maintainer; per the loop protocol this round performs no merge action itself.

Assisted-by: Claude:claude-fable-5

---

Generated by Claude Code