fix: bug-hunt round 9 — ssh-safe secret scan, terminal capture convergence, npm stream split, truthful apply preview, deps overlay ignore, recoverable release publish

[REPPL]

Bug-hunt round 9. Fresh hunt across four dimensions (code, docs-vs-code, infrastructure, internal-doc consistency): 36 candidates, each adversarially reviewed by an independent refuter before any fix — 28 confirmed (13 substantive, 15 nitpick), 8 refuted/rejected.

Confirmed substantive, fixed

1. Secret scan reads through symlinks — into ~/.ssh (cmd/sync.go:1172): the changed-file scan used a symlink-following read, so an untracked repo symlink at ~/.ssh/id_ed25519 was read in full on the default sync path — a direct breach of the untouchable-~/.ssh boundary. Changed paths are now Lstat-gated; non-regular entries skip (link text is covered by the push-range blob scan).
2. Directory-shaped entries wedge every sync (cmd/sync.go:1128): a dirty submodule ( M sub) or symlink-to-directory (?? link) arrives without the trailing slash the scan keyed on, EISDIR-failing fail-closed with unsatisfiable advice. Same Lstat gate; gitlink content never enters the push range.
3. Untracked-directory scan over-blocks (cmd/sync.go:1128-1171): the walk read gitignored files and nested .git trees that git add -A would never stage (a nested repo's https://user:token@ remote was a dead end). Enumeration now uses git ls-files --others --exclude-standard.
4. Shared terminal capture never converges behind a local overlay (cmd/capture.go:1063/1079/1114): the compare used the local-wins source while the shared route wrote the shared path — permanent re-offers, stale overlay kept applying. A shared accept removes the superseded overlay (reported; symlinked overlays untouched).
5. Secret-routed terminal capture reports drift forever (cmd/status.go:201-218, cmd/capture.go:1079-1091): status/capture byte-compared the raw {{ferry.secret …}} placeholder against the live export while apply rendered it. Both now render via the secret store before comparing; the placeholder write round-trips byte-exactly.
6. npm-globals domain dies on any peer-dep warning (internal/deps/npm.go:53-64, runner.go): CombinedOutput fused npm's stderr into the JSON parse, making the documented non-zero-exit tolerance dead code. Stdout-only parse; stderr spliced into real errors.
7. ferry diff cannot predict the empty-over-substantial refusal (cmd/apply.go, internal/dotfile/apply.go): the preview showed "would update" for an item apply refuses; abort left scrollback claiming writes that were rolled back. Preview renders "would refuse"; the abort states its rollback. The abort policy itself was adjudicated deliberate and is unchanged.
8. Per-machine deps overlay is committed and synced (cmd/init.go:918, cmd/init_github.go:355): deps/Brewfile.*.local — documented "one machine only" and code-commented "gitignored" — matched no generated ignore pattern, so it was pushed, cloned, installed fleet-wide, and bundled. Pattern ships from the single chokepoint on every init route; the --github gate model is rendered from the writer's pattern set. End-to-end eval reproduced the publish pre-fix.
9. Post-publish release failure is unrecoverable and the heal is blind (.github/workflows/release.yml:418-489, auto-release.yml:97-99): a red post-publish check could not be re-run (create 422s on the existing release) while a full re-run went green with the bypassed gates unrun. Publish is idempotent (view → upload --clobber + edit, else create); the heal predicate requires a published, asset-complete release; recovery documented.
10. Hand-publish recipe hashes unstamped binaries (docs/how-to/cutting-a-release.md:161-166, Makefile:61-62): make checksums re-runs the phony build without VERSION, silently discarding stamped binaries under a self-consistent manifest. Recipe is the single make checksums VERSION=vX.Y.Z; Makefile comment corrected.
11. Compatibility contract's versioning claim is false for snapshots (docs/reference/compatibility.md:45-62 vs internal/backup/snapshot.go:21-23,93-97): the page granted one exception (baseline) while the snapshot manifest (snapshots/ID/manifest.json) is unversioned and restore --undo replays it ungated. Snapshots are now the named second exception.
12. Docs direct users to "extend" a compile-time allowlist (docs/reference/configuration.md:187,193-194): no manifest surface exists. The page now states the allowlist is compiled in and documents the route that works (committed plist / local/ overlay, imported verbatim by apply; capture rewrites to the filtered set).
13. Main-only ferry sync is stated nowhere user-facing (cmd/sync.go:23,290-293): every sibling precondition was documented; the single-branch constraint was not. Now in the commands reference, tutorial (with the remote-side rename steps), and sync help.

Confirmed nitpicks, fixed

Conflict items in the guided walkthrough say confirming will not overwrite them (and the commands reference lists the fourth risky class); clean skip-always targets are silent and counted in-sync; receive's unlock accumulates releases (latent double-lock leak); consistency-lint invariant 3 exempts only *_test.go; zizmor's SARIF upload skips fork PRs (audit still gates); install.sh names a failed download; ci.yml's cross-compile comment stops claiming a pre-tag gate (auto-release tags the same push in ~20s, measured); the release how-to documents step 7's local handover reset; allowlist categories completed; route jargon replaced; ssh.md's enumeration made universal (incl. the cargo-store guard); scaffold help names what it creates; AGENTS.md's CI list names gitleaks/zizmor; the tutorial distinguishes drift from conflict; the wizard row states the tty fallback; evals/harness.go's ApplyConfirmed comment corrected.

Considered and rejected (refuted)

• restore --packages over-count: unreachable via ferry-written state (both rails record bare names); tampered-input direction is under-removal, the safe side.
• auto-merge retitle never disarms: same end state as the earlier edited-arming refutation — no privilege delta, one-admin actor set, and a disarm step is racy and clobbers hand-armed PRs.
• Green terminal-state annotation after the release retry bound: the three counted runs were each red and notified; a transition-fail fires unreliably on a non-monotonic two-counter sum.
• +build-metadata tag becomes latest + escapes retention: round-8 adjudication stands — the workflow comment weighs exactly this consequence, and retention-escape applies to every suffixed tag by documented design.
• Stale-binary checksums in local rehearsal: gitignored throwaway file; CI builds on fresh runners.
• Doubled push/pull_request CI runs: different trees (branch tip vs merge ref); a shared concurrency group would cancel required checks.
• --wizard=interactive silent fallback as substantive: disclosed twice on the same reference page; the fallback is conservative and secret-safe by deliberate design (redirected runs must not paint a TUI into a file); wording tightened as a nitpick instead.
• fileDomainIsRepoAuthoritative registry rebuild: hunter-self-refuted (allocation-only, no I/O, once per plan item).

Carried forward

terminalRepoStatusSource's extensionless/poisoned-overlay divergences from terminalExportBlob (hand-authored state only; one shared resolver would close it); Apple Terminal's unfiltered export routinely trips the entropy gate on NSKeyedArchiver base64 — the domain may be uncapturable on customised machines (new lead from the refutation pass, unadjudicated); the deps-overlay glob duplicated in cmd/init.go rather than shared from internal/deps; release.sh's render_next_md "also sourced by tests" claim matches nothing, and a NEXT.md missing its carry markers exits the driver non-zero after a successful tag push; the heal predicate hardcodes the 5-asset count; sync's branch-rename hint omits the remote-side default-branch step; managed carry remains path-keyed.

Gates

make build, gofmt -l (empty), go vet ./..., go test ./..., go test -race ./internal/..., full eval suite with FERRY_BIN set, scripts/consistency-lint.sh, and make gen-docs (no drift) — all green locally. Every behaviour change carries a test watched failing before the fix; the overlay fix additionally carries an end-to-end eval reproduced against a pre-fix binary.