@ccoalm/ccl-skills 0.13.0 → 0.15.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_impact_chain_refscripts.sh

@@ -108,6 +108,15 @@ run_gate() {
   rc=$?
   set -e
 }
+# Same gate, explicit base: for fixtures whose claim is about WHICH base the
+# verdict was taken against, pinning it beats inferring it from the upstream.
+run_gate_with_base() { # <base ref>
+  gate_runs=$((gate_runs + 1))
+  set +e
+  out="$(env -u ALIAS_AUDIT_CMD CCL_SKILL_BASE_REF="$1" ruby "$GATE_SCRIPT" "$REPO" 2>&1)"
+  rc=$?
+  set -e
+}
 
 # Case 1: an upstream owner's REFERENCE changed with NO impact-chain row -> block.
 new_case case-ref-no-row
@@ -1194,12 +1203,13 @@ run_gate
 assert_rc "$rc" 1 "a duplicated-then-dropped row must not vouch for new owner bytes"
 assert_contains "impact_chain_gate_missing" "$out" "the net-zero ledger leaves the owner undeclared"
 
-# Round scoping 6: the partition's central claim is that ONE MERGED worktree round
-# is ONE boundary — and this repo's integration branch is nothing but merge commits,
-# so a linear-only fixture set proves nothing about the shape the gate actually runs
-# on. `git rev-list --first-parent -- <path>` applies history simplification, so the
-# merge is a boundary only when it is not TREESAME to its first parent. These two
-# cases pin that behaviour instead of asserting it in a comment.
+# Round scoping 6: the partition's central claim is that a MERGED worktree round is
+# judged exactly as its branch was — and this repo's integration branch is nothing
+# but merge commits, so a linear-only fixture set proves nothing about the shape
+# the gate actually runs on. A merge git rebuilds from its parents is expanded
+# into the branch's own rounds; work committed on the integration line after it
+# is a round of its own. These two cases pin that behaviour instead of asserting
+# it in a comment.
 new_case case-round-scope-merged-worktree-round
 git -C "$REPO" switch -q -c feature-round-merged
 printf '\n- Never skip the fixture merged-round rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
@@ -1270,24 +1280,188 @@ run_gate
 assert_rc "$rc" 0 "a pre-rename round declared against its own round head must pass"
 assert_not_contains "impact_chain_evidence_missing_file" "$out" "a row citing the name that existed at its round head is valid evidence"
 
-# Round scoping 8: the --first-parent discriminator. On the branch the ledger
-# append lands BEFORE the owner work; first-parent collapses the merged branch
-# to one boundary (the merge), so row and work share a round. A full walk would
-# instead cut the round at the branch's ledger commit, stranding the work in a
-# rowless later round — so this fixture goes red if --first-parent is dropped,
-# which is what proves the flag load-bearing.
+# Round scoping 8: the merged view IS the branch view. On the branch the ledger
+# append lands BEFORE the owner work, so as a pull request the branch is refused:
+# the work sits in a rowless later round. Collapsing the merged branch to one
+# boundary used to accept the same bytes — what a pull request could not land,
+# its merge could, and the verdict moved after it landed. A merge git rebuilds
+# from its parents is now expanded into the branch's own rounds, so the two views
+# agree; both are run on the same fixture so the equality is a checked fact.
 new_case case-round-scope-merged-row-before-work
 git -C "$REPO" switch -q -c feature-round-row-first
+git -C "$REPO" branch --set-upstream-to=fixture-base feature-round-row-first >/dev/null 2>&1
 printf '| Fixture row-first merged round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture row-first rule | `updated` | `platform-observability/SKILL.md` merged round |\n' >> "$REGISTER"
 routing_surface_downscope
 commit_case "worktree round: ledger append first"
 printf '\n- Never skip the fixture row-first rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
 routing_surface_downscope
 commit_case "worktree round: owner work after the append"
+run_gate
+branch_rc="$rc"
+assert_rc "$rc" 1 "as a pull request, owner work after the ledger append sits in a rowless round"
+assert_contains "impact_chain_gate_missing" "$out" "the branch view names the undeclared work"
 git -C "$REPO" switch -q case-round-scope-merged-row-before-work
 git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-round-row-first': one worktree round" feature-round-row-first
 run_gate
-assert_rc "$rc" 0 "a merged worktree round collapses to one boundary even when the row precedes the work"
+assert_rc "$rc" "$branch_rc" "the merge of that branch is judged exactly as the branch was"
+assert_contains "impact_chain_gate_missing" "$out" "the merged view names the same undeclared work"
+
+# Round scoping 13: the observed failure. On the branch, round 1 adds a body rule
+# with its row and round 2 changes ONLY the description with a `#description`
+# row — as a pull request that is round scoping 2 and passes. Collapsed to one
+# boundary the owner's merged diff is body plus description, the routing-surface
+# class refuses the anchor, and a row that was valid when it landed reads
+# `impact_chain_firing_path_missing` on every post-merge evaluation (observed on
+# the integration branch's push build and on the promotion pull request, with
+# nothing about the row changed). Expanded, round 2 is judged on its own bytes.
+new_case case-round-scope-merged-description-round
+git -C "$REPO" switch -q -c feature-round-description
+git -C "$REPO" branch --set-upstream-to=fixture-base feature-round-description >/dev/null 2>&1
+printf '\n- Never skip the fixture merged-description body rule for this gate.\n' >> "$REPO/skills/product-rd-workflow/SKILL.md"
+printf '| Fixture merged body round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/SKILL.md#Never skip the fixture merged-description body rule | `updated` | `product-rd-workflow/SKILL.md` body round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round 1: body rule added to the entrypoint"
+perl -0pi -e 's/^(description: .+)$/$1 Fixture merged round-scope routing clause./m' "$REPO/skills/product-rd-workflow/SKILL.md"
+printf '| Fixture merged description round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/product-rd-workflow/SKILL.md#description | `updated` | `product-rd-workflow/SKILL.md` description-only round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round 2: description-only edit to the same owner"
+run_gate
+branch_rc="$rc"
+assert_rc "$rc" 0 "as a pull request, the description-only round keeps its locator after the body round"
+git -C "$REPO" switch -q case-round-scope-merged-description-round
+git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-round-description': two worktree rounds" feature-round-description
+run_gate
+assert_rc "$rc" "$branch_rc" "the merge of that branch is judged exactly as the branch was"
+assert_not_contains "impact_chain_firing_path_missing" "$out" "the description anchor binds in its own round after the merge too"
+
+# Round scoping 14: expansion is bounded by what git can rebuild. A merge whose
+# tree is not the automatic merge of its parents carries content that came from
+# neither branch; expanding it would leave that content in no round, so such a
+# merge keeps the single boundary at the merge. The row-before-work branch from
+# round scoping 8, merged with an extra owner edit inside the merge commit, is
+# therefore judged as one span — which accepts it, as it always did, because that
+# span holds both the row and the work. The review-ledger binder refuses a
+# non-automatic merge on a promotion chain, so the hand-carried content is still
+# caught where promotion is decided; this fixture pins only that the expansion
+# does not silently widen past git's own reconstruction.
+new_case case-round-scope-hand-resolved-merge
+git -C "$REPO" switch -q -c feature-round-hand-resolved
+printf '| Fixture hand-resolved merged round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture hand-resolved rule | `updated` | `platform-observability/SKILL.md` merged round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round: ledger append first"
+printf '\n- Never skip the fixture hand-resolved rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
+routing_surface_downscope
+commit_case "worktree round: owner work after the append"
+git -C "$REPO" switch -q case-round-scope-hand-resolved-merge
+git -C "$REPO" merge -q --no-ff --no-commit feature-round-hand-resolved >/dev/null 2>&1
+printf '\nFixture line carried by the merge commit itself.\n' >> "$REPO/skills/platform-observability/references/platform-observability-playbook.md"
+commit_case "Merge branch 'feature-round-hand-resolved' with a hand-carried edit"
+run_gate
+assert_rc "$rc" 0 "a merge git cannot rebuild from its parents keeps one boundary and is not expanded"
+
+# Round scoping 15: the depth bound fails closed. Nine nested worktree rounds —
+# each branch cut from the previous one and merged back in turn, every merge the
+# automatic one — nest expansions past ROUND_WALK_MAX_DEPTH. The walk must stop
+# with its own diagnostic rather than fall back to a collapsed span, because a
+# fallback here would be the lenient verdict on exactly the history an author
+# could construct to reach it.
+new_case case-round-scope-nesting-depth
+prev=case-round-scope-nesting-depth
+for level in 1 2 3 4 5 6 7 8 9; do
+  git -C "$REPO" switch -q -c "feature-nest-$level" "$prev"
+  prev="feature-nest-$level"
+done
+printf '\n- Never skip the fixture nested rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
+printf '| Fixture nested round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture nested rule | `updated` | `platform-observability/SKILL.md` nested round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "deepest worktree round: owner work with its row"
+for level in 9 8 7 6 5 4 3 2 1; do
+  if [ "$level" -gt 1 ]; then outer="feature-nest-$((level - 1))"; else outer=case-round-scope-nesting-depth; fi
+  git -C "$REPO" switch -q "$outer"
+  git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-nest-$level'" "feature-nest-$level"
+done
+run_gate
+assert_rc "$rc" 1 "merges nested past the depth bound must fail closed, not fall back to a collapsed span"
+assert_contains "impact_chain_round_walk_too_deep" "$out" "the depth refusal names itself"
+
+# Round scoping 16 and 17: git failures inside the expansion decision fail closed.
+# A `git` shim on PATH delegates everything to the real git except the one
+# subcommand under test, which it makes fail with an operational status. If the
+# gate swallowed that status it would silently take the collapsed-span path — the
+# lenient verdict — so both lookups must abort with impact_chain_git_failed.
+GIT_REAL="$(command -v git)"
+SHIM_DIR="$(mktemp -d "${TMPDIR:-/tmp}/icshim.XXXXXX")"
+make_git_shim() { # <subcommand-to-break> <exit-status>
+  cat > "$SHIM_DIR/git" <<SHIM
+#!/usr/bin/env bash
+real="$GIT_REAL"
+args=("\$@")
+sub=""
+i=0
+while [ \$i -lt \${#args[@]} ]; do
+  case "\${args[\$i]}" in
+    -C) i=\$((i + 2)); continue ;;
+    -*) i=\$((i + 1)); continue ;;
+    *) sub="\${args[\$i]}"; break ;;
+  esac
+done
+if [ "\$sub" = "$1" ]; then
+  case "$1" in
+    merge-base) case " \${args[*]} " in *" --is-ancestor "*|*" HEAD "*) exec "\$real" "\$@" ;; esac ;;
+  esac
+  echo "shim: $1 unavailable" >&2
+  exit $2
+fi
+exec "\$real" "\$@"
+SHIM
+  chmod +x "$SHIM_DIR/git"
+}
+git -C "$REPO" switch -q case-round-scope-merged-description-round
+make_git_shim merge-tree 129
+PATH="$SHIM_DIR:$PATH" run_gate
+assert_rc "$rc" 1 "an unavailable merge-tree must abort the walk, not skip the expansion"
+assert_contains "impact_chain_git_failed: git merge-tree --write-tree" "$out" "the refusal names the merge-tree lookup"
+assert_contains "exited 129" "$out" "the refusal carries the shim status, so it is this lookup and not another git read"
+make_git_shim merge-base 128
+PATH="$SHIM_DIR:$PATH" run_gate
+assert_rc "$rc" 1 "a failing fork-point lookup must abort the walk, not skip the expansion"
+assert_contains "impact_chain_git_failed: git merge-base" "$out" "the refusal names the fork-point lookup"
+assert_contains "exited 128" "$out" "the refusal carries the shim status, so it is this lookup (the only two-commit merge-base in the gate) and not the base resolution, which passes HEAD"
+rm -rf "$SHIM_DIR"
+
+# Round scoping 18: a sync of the TARGET inside a branch is a sync on that
+# branch's own line. The target advances under a feature that already carries
+# owner work; the feature merges the target (automatically) and only then
+# appends its row. As a pull request the branch passes: the sync brings nothing
+# new and work plus row share a round. Promoted and judged against the older
+# base, that sync's second parent is not below the outer base — expanding it
+# would cut the branch at the sync and strand the work in a rowless span, so the
+# sync test is made against the line being walked, not the outer base alone.
+new_case case-round-scope-branch-synced-target
+git -C "$REPO" switch -q -c feature-synced-target
+git -C "$REPO" branch --set-upstream-to=case-round-scope-branch-synced-target feature-synced-target >/dev/null 2>&1
+git -C "$REPO" switch -q case-round-scope-branch-synced-target
+mkdir -p "$REPO/specs/fixture-refscripts"
+printf 'Fixture target note unrelated to any owner.\n' >> "$REPO/specs/fixture-refscripts/target-note.md"
+commit_case "target advances with an unrelated change"
+SYNC_TARGET_T="$(git -C "$REPO" rev-parse HEAD)"
+SYNC_TARGET_O="$(git -C "$REPO" rev-parse fixture-base)"
+git -C "$REPO" switch -q feature-synced-target
+printf '\n- Never skip the fixture synced-target rule for this gate.\n' >> "$REPO/skills/platform-observability/SKILL.md"
+routing_surface_downscope
+commit_case "worktree round: owner work before the sync"
+git -C "$REPO" merge -q --no-ff -m "Merge branch 'case-round-scope-branch-synced-target' into feature-synced-target" case-round-scope-branch-synced-target
+printf '| Fixture synced-target round | `downstream-executor` | behavioral-evidence: RED-baseline; observed-failure: yes; result-class: failure; bank-evidence: downscoped:REFSCRIPTS-FIXTURE-NO-BANK; firing-path: file:skills/platform-observability/SKILL.md#Never skip the fixture synced-target rule | `updated` | `platform-observability/SKILL.md` synced round |\n' >> "$REGISTER"
+routing_surface_downscope
+commit_case "worktree round: its ledger append after the sync"
+run_gate_with_base "$SYNC_TARGET_T"
+branch_rc="$rc"
+assert_rc "$rc" 0 "as a pull request (base: the advanced target), a branch that synced the target keeps its work and row in one round"
+git -C "$REPO" switch -q case-round-scope-branch-synced-target
+git -C "$REPO" merge -q --no-ff -m "Merge branch 'feature-synced-target': one worktree round" feature-synced-target
+run_gate_with_base "$SYNC_TARGET_O"
+assert_rc "$rc" "$branch_rc" "promoted against the older base (pinned: the commit the target advanced from), the target sync inside the branch is still a sync and the verdict is the branch's"
+assert_not_contains "impact_chain_gate_missing" "$out" "the branch's pre-sync work is not stranded by expanding the target sync"
 
 # Round scoping 9: a TRANSIENT intermediate rename hop must not launder work.
 # X renames to Y (declared), a later round substantively changes Y with no row,
@@ -1409,6 +1583,6 @@ assert_rc "$rc" 1 "a directory masquerading as SKILL.md must not read as a prese
 assert_contains "platform-observability/SKILL.md" "$out" "the masqueraded owner must be named"
 
 assert_rc "$full_check_runs" 1 "fixture suite must retain exactly one full checker wiring case"
-assert_rc "$gate_runs" 88 "all remaining impact-chain fixtures must run the standalone gate"
+assert_rc "$gate_runs" 97 "all remaining impact-chain fixtures must run the standalone gate"
 
 echo "test_check_ccl_impact_chain_refscripts: ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_check_ccl_regressions.sh

@@ -24,6 +24,7 @@
 #   - test_check_ccl_register_pending_exclusion.sh
 #   - test_eval_routing_bank_grader_diagnostics.sh
 #   - test_eval_routing_bank_surface_binding.sh
+#   - test_eval_routing_bank_resolution.sh
 #   - test_eval_routing_prose_target.sh
 #   - test_validate_skill_credential_cwd.sh
 #   - test_validate_skill_root_depth.sh
@@ -31,6 +32,7 @@
 #   - test_uiux_delivery_contract.sh
 #   - test_uiux_loading_budget.sh
 #   - test_obligation_ledger.sh
+#   - test_reference_access_census.sh
 # --full runs --fast plus the heavy full-checker regressions:
 #   - test_check_ccl_r0_status.sh
 #   - test_check_ccl_source_register_lifecycle.sh
@@ -107,6 +109,13 @@ fast_tests=(
   # applied deletion mutation in a throwaway copy (spec 031 review disposition).
   test_controlled_escalation_pins.sh
   test_check_ccl_size_budget.sh
+  # Entrypoint guidance-form census (what counts as one rule, a prohibition, a
+  # named baseline failure): synthetic fixtures plus the shipped entrypoint,
+  # seconds. Pins the definitions, never any round's figures.
+  test_entrypoint_form_census.sh
+  # Usage census over synthetic transcripts (counts, privacy contract,
+  # unevaluated sentinel, ARG_MAX batching): no host logs, seconds.
+  test_reference_access_census.sh
   test_check_ccl_skill_catalog.sh
   test_check_ccl_parallel_stack_parity.sh
   test_check_mr_target_freshness.sh
@@ -137,6 +146,7 @@ fast_tests=(
   test_impact_chain_round_attribution.sh
   test_eval_routing_bank_grader_diagnostics.sh
   test_eval_routing_bank_surface_binding.sh
+  test_eval_routing_bank_resolution.sh
   test_eval_routing_prose_target.sh
   test_validate_skill_credential_cwd.sh
   test_validate_skill_root_depth.sh

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_entrypoint_form_census.sh

@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# Regression for the entrypoint form census. The census is an instrument whose
+# only value is that a later round recomputes the same quantity, so the cases
+# below pin the definitions the script documents -- what counts as one rule,
+# what counts as a prohibition, and what counts as a named baseline failure --
+# rather than the figures of any particular entrypoint, which move every round.
+set -uo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+CENSUS="$DIR/entrypoint_form_census.py"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/entrypoint-form-census.XXXXXX")"
+trap 'rm -rf "$WORK"' EXIT
+
+fails=0
+check() { if eval "$2"; then echo "ok   - $1"; else echo "FAIL - $1"; fails=$((fails+1)); fi; }
+
+[ -f "$CENSUS" ] || { echo "FAIL: census missing: $CENSUS" >&2; exit 1; }
+
+field() { printf '%s\n' "$1" | sed -n "s/^$2=//p"; }
+
+# One rule per top-level bullet: the sub-bullet and the continuation line belong
+# to the rule above them, and the blank line between them does not close it.
+# Getting this wrong inflates every per-rule figure the census reports.
+# The prohibitions are placed in the continuation and the sub-bullet, never in
+# the bullet's own first line: a rule COUNT cannot detect a parser that drops
+# continuations, because a dropped continuation is still not a new top-level
+# bullet. The token total is the quantity that moves when the defect is present,
+# so that is what the case asserts.
+cat >"$WORK/one-rule.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- A rule head with no imperative of its own.
+
+  A continuation line that must hold.
+
+  - A sub-bullet that must also hold.
+
+## After
+
+- A bullet outside Core Rules that must not be counted.
+MD
+out="$(python3 "$CENSUS" "$WORK/one-rule.md")"; rc=$?
+check "sub-bullets and continuations separated by blank lines stay inside one rule" \
+  '[ "$rc" = 0 ] && [ "$(field "$out" rules)" = 1 ] && [ "$(field "$out" prohibitive_tokens)" = 2 ]'
+# This case owns the section boundary alone: a parser that ran past `## After`
+# would report two rules, so the rule count is the quantity that moves here.
+check "the census stops at the next same-level heading" \
+  '[ "$(field "$out" rules)" = 1 ]'
+
+# A prohibition with no named baseline failure is the diagnostic set; the same
+# rule with its failure named must leave that set. The pair is the control: if
+# the failure-shape vocabulary stopped matching, the first case would still pass
+# and only the second would fail, which is what makes the pair informative.
+cat >"$WORK/unanchored.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- A rule that must never be skipped.
+MD
+out="$(python3 "$CENSUS" "$WORK/unanchored.md")"
+check "a prohibition with no named baseline failure is reported unanchored" \
+  '[ "$(field "$out" unanchored_prohibition_rules)" = 1 ] && [ "$(field "$out" rules_naming_baseline_failure)" = 0 ]'
+
+cat >"$WORK/anchored.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- A rule that must never be skipped. Failure shape: the step is skipped under time pressure.
+MD
+out="$(python3 "$CENSUS" "$WORK/anchored.md")"
+check "the same prohibition with its baseline failure named leaves the unanchored set" \
+  '[ "$(field "$out" unanchored_prohibition_rules)" = 0 ] && [ "$(field "$out" rules_naming_baseline_failure)" = 1 ]'
+
+# A rule with no prohibitive token is not in the diagnostic set whether or not it
+# names a failure: the set is prohibitions the form table has something to say
+# about, not every rule that omits a rationale.
+cat >"$WORK/no-prohibition.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- State the artifact's parts, in order.
+MD
+out="$(python3 "$CENSUS" "$WORK/no-prohibition.md")"
+check "a rule carrying no prohibitive token is outside the diagnostic set" \
+  '[ "$(field "$out" prohibitive_tokens)" = 0 ] && [ "$(field "$out" unanchored_prohibition_rules)" = 0 ]'
+
+# The capitalised spellings are emphasis in this package and are counted; a word
+# that merely contains one of them is not a token.
+cat >"$WORK/tokens.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- This MUST hold and NEVER lapses, and the mustard and nevertheless here are not tokens.
+MD
+out="$(python3 "$CENSUS" "$WORK/tokens.md")"
+check "capitalised emphasis counts as prohibitive and a word merely containing one does not" \
+  '[ "$(field "$out" prohibitive_tokens)" = 2 ]'
+
+# The alternation is leftmost and non-overlapping, so a phrase absorbs the words
+# inside it. Two independent review lenses read the previous comment as promising
+# the opposite, which is exactly the failure this case now pins: the documented
+# counting rule and the reported figure have to be the same ruler.
+cat >"$WORK/overlap.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+- This must not be counted twice, and this cannot be either.
+MD
+out="$(python3 "$CENSUS" "$WORK/overlap.md")"
+check "a phrase absorbs the word inside it: 'must not' is one token, not two" \
+  '[ "$(field "$out" prohibitive_tokens)" = 2 ]'
+
+# An existing but empty Core Rules section is an error, not a zero-rule census:
+# a section that lost its rules must not report as a clean sheet either.
+cat >"$WORK/empty-core.md" <<'MD'
+# Entry
+
+## Core Rules
+
+### A group
+
+Prose with no top-level bullet.
+
+## After
+
+- A bullet outside Core Rules.
+MD
+out="$(python3 "$CENSUS" "$WORK/empty-core.md" 2>&1)"; rc=$?
+check "an existing but empty Core Rules section is an error, never a zero-rule census" \
+  '[ "$rc" != 0 ] && case "$out" in *entrypoint_form_census_error*) true;; *) false;; esac'
+
+# An entrypoint with no Core Rules section is an error, not a zero: reporting
+# zero rules would let a renamed or moved section read as a clean sheet.
+cat >"$WORK/no-core.md" <<'MD'
+# Entry
+
+## Something Else
+
+- A bullet.
+MD
+out="$(python3 "$CENSUS" "$WORK/no-core.md" 2>&1)"; rc=$?
+check "a file with no Core Rules heading is an error, never an empty census" \
+  '[ "$rc" != 0 ] && case "$out" in *entrypoint_form_census_error*) true;; *) false;; esac'
+
+# The shipped entrypoint must parse, or the instrument silently stops measuring
+# the only file it exists for.
+out="$(python3 "$CENSUS" "$DIR/../SKILL.md")"; rc=$?
+check "the shipped entrypoint parses and reports a non-zero rule count" \
+  '[ "$rc" = 0 ] && [ "$(field "$out" rules)" -gt 0 ] && case "$out" in *entrypoint_form_census_ok*) true;; *) false;; esac'
+
+if [ "$fails" -ne 0 ]; then
+  echo "test_entrypoint_form_census: $fails failing case(s)"
+  exit 1
+fi
+echo "test_entrypoint_form_census: ok"