forgedock 1.13.1 → 1.14.0

package/scripts/check-spec-bash.sh

@@ -14,6 +14,7 @@
 #   check-spec-bash.sh [--base <git-ref>] [--shellcheck] <file.md>...
 #   check-spec-bash.sh --positional [<file.md>...]
 #   check-spec-bash.sh --fence-state <VAR>... -- <file.md>...
+#   check-spec-bash.sh --fence-funcs -- <file.md>...
 #   check-spec-bash.sh            (no args: same as --positional over all Skill-loaded commands/**/*.md,
 #                                  excluding orchestrate/**, pipeline-health/**, review-pr-agents/**)
 #
@@ -33,6 +34,13 @@
 #                 does not match `$REPO_FLAG`. Suppress a deliberate read by putting
 #                 `allowlist:fence-state` on the same line. Pseudo-tool-call fences are scanned too.
 #                 Output: `FAIL <file>:<line> fence-state ...` then `SPEC-FENCE-STATE: ...`.
+#   --fence-funcs Different check, opt-in: shell functions are per-shell too, so a function defined
+#                 (`name() {`, `function name`) in one ```bash/sh fence is undefined in every other
+#                 fence. Fail any fence that calls (command position) a function that the same file
+#                 defines only in a DIFFERENT fence. A fence that carries its own definition (also
+#                 `declare -f name >/dev/null || name() {...}`) is fine. Comment lines are ignored.
+#                 Suppress a deliberate call with `allowlist:fence-funcs` on the same line.
+#                 Output: `FAIL <file>:<line> fence-funcs ...` then `SPEC-FENCE-FUNCS: ...`.
 #   --base <ref>   Only check blocks that contain a line changed relative to <ref>
 #                  (`git diff -U0 <ref> -- <file>`), so pre-existing blocks never fail
 #                  a new change. Without --base every block is checked.
@@ -53,8 +61,8 @@
 
 set -u
 
-BASE=""; SHELLCHECK=0; POSITIONAL=0; FILES=""; FENCESTATE=0; FSVARS=""
-usage() { echo "ERROR: Usage: check-spec-bash.sh [--base <git-ref>] [--shellcheck] <file.md>... | --positional [<file.md>...] | --fence-state <VAR>... -- <file.md>..." >&2; exit 2; }
+BASE=""; SHELLCHECK=0; POSITIONAL=0; FILES=""; FENCESTATE=0; FSVARS=""; FENCEFUNCS=0
+usage() { echo "ERROR: Usage: check-spec-bash.sh [--base <git-ref>] [--shellcheck] <file.md>... | --positional [<file.md>...] | --fence-state <VAR>... -- <file.md>... | --fence-funcs -- <file.md>..." >&2; exit 2; }
 
 while [ "$#" -gt 0 ]; do
   case "$1" in
@@ -69,6 +77,10 @@ while [ "$#" -gt 0 ]; do
       done
       [ "$#" -gt 0 ] && [ -n "$FSVARS" ] || usage
       shift ;;
+    --fence-funcs)
+      FENCEFUNCS=1; shift
+      [ "$#" -gt 0 ] && [ "$1" = "--" ] || usage
+      shift ;;
     --*) usage ;;
     *) FILES="$FILES
 $1"; shift ;;
@@ -78,7 +90,7 @@ done
 # No file arguments: default to the --positional check over every Skill-loaded spec under commands/
 # (orchestrate/**, pipeline-health/** and the review-pr-agents catalog are Read-loaded, not substituted).
 # Resolved relative to this script, so it works from any cwd and from linked worktrees.
-if [ -z "$FILES" ] && [ "$FENCESTATE" = 0 ] && { [ "$#" -eq 0 ] && [ "$POSITIONAL" = 0 ] && [ -z "$BASE" ] && [ "$SHELLCHECK" = 0 ] || [ "$POSITIONAL" = 1 ]; }; then
+if [ -z "$FILES" ] && [ "$FENCESTATE" = 0 ] && [ "$FENCEFUNCS" = 0 ] && { [ "$#" -eq 0 ] && [ "$POSITIONAL" = 0 ] && [ -z "$BASE" ] && [ "$SHELLCHECK" = 0 ] || [ "$POSITIONAL" = 1 ]; }; then
   POSITIONAL=1
   cd "$(dirname "$0")/.." || exit 2
   FILES=$(find commands -name '*.md' -not -path 'commands/orchestrate/*' \
@@ -127,6 +139,64 @@ EOS
   exit $?
 fi
 
+if [ "$FENCEFUNCS" = 1 ]; then
+  ffail=0; ffiles=0
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    case "$f" in *.md) ;; *) continue ;; esac
+    [ -f "$f" ] || { echo "SKIP $f missing"; continue; }
+    ffiles=$((ffiles + 1))
+    hits=$(awk -v f="$f" '
+      function isdef(line, name) {
+        return line ~ ("(^|[;&|{ \t])(function[ \t]+)?" name "[ \t]*[(][)]") || line ~ ("(^|[;&|{ \t])function[ \t]+" name "([ \t;{]|$)")
+      }
+      # A non-bash fence (prompt templates) can nest ```lang fences: track depth so they stay ignored.
+      other && /^[ \t]*```[A-Za-z]/ { depth++; next }
+      other && /^[ \t]*```[ \t]*$/ { if (depth > 0) depth--; else other = 0; next }
+      other { next }
+      !inb && /^[ \t]*```(bash|sh)[ \t]*$/ { inb = 1; nf++; next }
+      !inb && /^[ \t]*```/ { other = 1; depth = 0; next }
+      inb && /^[ \t]*```[ \t]*$/ { inb = 0; next }
+      inb {
+        n++; fen[n] = nf; ln[n] = NR; txt[n] = $0
+        if ($0 ~ /^[ \t]*#/) next
+        # Function definitions: `name()` or `function name`, wherever they sit on the line.
+        s = $0
+        while (match(s, /(^|[;&|{ \t])(function[ \t]+)?[A-Za-z_][A-Za-z0-9_]*[ \t]*[(][)]/)) {
+          d = substr(s, RSTART, RLENGTH); s = substr(s, RSTART + RLENGTH)
+          sub(/^[;&|{ \t]+/, "", d); sub(/^function[ \t]+/, "", d); sub(/[ \t]*[(][)]$/, "", d)
+          defn[d, nf] = 1; if (!(d in seen)) { seen[d] = 1; names[++nn] = d }
+        }
+        s = $0
+        while (match(s, /(^|[;&|{ \t])function[ \t]+[A-Za-z_][A-Za-z0-9_]*/)) {
+          d = substr(s, RSTART, RLENGTH); s = substr(s, RSTART + RLENGTH)
+          sub(/^[;&|{ \t]+/, "", d); sub(/^function[ \t]+/, "", d)
+          defn[d, nf] = 1; if (!(d in seen)) { seen[d] = 1; names[++nn] = d }
+        }
+      }
+      END {
+        for (k = 1; k <= nn; k++) {
+          name = names[k]
+          for (i = 1; i <= n; i++) {
+            if (defn[name, fen[i]] || reported[name, fen[i]]) continue
+            if (txt[i] ~ /^[ \t]*#/ || txt[i] ~ /allowlist:fence-funcs/) continue
+            if (txt[i] ~ ("(^[ \t]*|[;&|({][ \t]*|[$][(][ \t]*|(then|do|else|elif|if|while|until|!)[ \t]+)" name "([ \t;&|)]|$)")) {
+              reported[name, fen[i]] = 1
+              print "FAIL " f ":" ln[i] " fence-funcs: " name "() is called in a fence that does not define it (fresh shell per Bash call; defined only in another fence): " txt[i]
+            }
+          }
+        }
+      }
+    ' "$f" | LC_ALL=C sort -t: -k2,2n)
+    if [ -n "$hits" ]; then printf '%s\n' "$hits"; ffail=$((ffail + $(printf '%s\n' "$hits" | wc -l))); fi
+  done <<EOS
+$FILES
+EOS
+  echo "SPEC-FENCE-FUNCS: files=$ffiles violations=$ffail"
+  [ "$ffail" -eq 0 ]
+  exit $?
+fi
+
 if [ "$POSITIONAL" = 1 ]; then
   pfail=0; pfiles=0
   while IFS= read -r f; do

package/scripts/check-spec-bash.test.sh

@@ -165,5 +165,55 @@ check 0 "violations=0"                   "--fence-state passes declared, loop, e
 check 2 "Usage"                          "--fence-state without -- is a usage error"  -- --fence-state PR_NUMBER fs-good.md
 check 2 "Usage"                          "--fence-state without vars is a usage error" -- --fence-state -- fs-good.md
 
+# --fence-funcs: a function defined only in another fence, then called, is flagged.
+cat > "$T/ff-bad.md" <<EOF
+${FENCE}bash
+helper() {
+  echo hi
+}
+helper
+${FENCE}
+${FENCE}bash
+X=\$(helper arg)
+${FENCE}
+${FENCE}bash
+if helper; then :; fi
+${FENCE}
+EOF
+cat > "$T/ff-good.md" <<EOF
+Prose calls helper and mentions helper() freely.
+${FENCE}bash
+helper() { echo hi; }
+function other_fn { :; }
+helper
+${FENCE}
+${FENCE}bash
+declare -f helper >/dev/null 2>&1 || helper() { echo hi; }
+helper
+${FENCE}
+${FENCE}bash
+# helper is only named in a comment
+declare -f helper >/dev/null 2>&1
+echo "call helper later"
+git log --grep helper
+helper # allowlist:fence-funcs
+${FENCE}
+${FENCE}text
+helper
+${FENCE}
+${FENCE}
+Template with a nested fence:
+${FENCE}bash
+helper
+${FENCE}
+${FENCE}
+EOF
+check 1 "FAIL ff-bad.md:8 fence-funcs: helper()"  "--fence-funcs flags a call in a fence without the definition" -- --fence-funcs -- ff-bad.md
+check 1 "FAIL ff-bad.md:11 fence-funcs: helper()" "--fence-funcs flags a call after if" -- --fence-funcs -- ff-bad.md
+check 1 "violations=2"                           "--fence-funcs counts violations"  -- --fence-funcs -- ff-bad.md
+check 0 "violations=0"                           "--fence-funcs passes same-fence defs, guarded redefinition, comments, quoted/arg uses, allowlist, prose, non-bash fences" -- --fence-funcs -- ff-good.md
+check 2 "Usage"                                  "--fence-funcs without -- is a usage error" -- --fence-funcs ff-good.md
+check 2 "Usage"                                  "--fence-funcs without files is a usage error" -- --fence-funcs --
+
 echo "check-spec-bash.test.sh: passed=$pass failed=$fail"
 [ "$fail" -eq 0 ]

package/scripts/checkbox-sections.test.sh

@@ -49,4 +49,23 @@ SINGLE_BODY=$'## Acceptance Criteria\n- [ ] complete this work'
   exit 1
 }
 
+# forge#3545: the investigate placeholder box is scaffolding and must not form a section.
+PLACEHOLDER_SECOND=$'## Success Criteria\n- [ ] real work\n\n## Acceptance Criteria\n- [ ] Fix confirmed during investigation.'
+[[ "$(printf '%s\n' "$PLACEHOLDER_SECOND" | awk "$CLOSE_CLASSIFIER")" == "1" ]] || {
+  printf 'FAIL: placeholder box must not count as a second checkbox section\n' >&2
+  exit 1
+}
+PLACEHOLDER_ONLY=$'## Acceptance Criteria\n- [ ] Fix confirmed during investigation.'
+[[ "$(printf '%s\n' "$PLACEHOLDER_ONLY" | awk "$CLOSE_CLASSIFIER")" == "0" ]] || {
+  printf 'FAIL: placeholder-only body must count zero checkbox sections\n' >&2
+  exit 1
+}
+grep -Fq 'Fix confirmed during investigation' "$ROOT/commands/work-on/close.md" || {
+  printf 'FAIL: close.md must exclude the investigate placeholder\n' >&2
+  exit 1
+}
+# REMAINING_BEFORE must also ignore the placeholder (placeholder-only body => 0).
+REM=$(printf '%s\n' "$PLACEHOLDER_ONLY" | grep -vE '^[-*+] \[ \] Fix confirmed during investigation\.?[[:space:]]*$' | grep -cE '^[-*+] \[ \]' || true)
+[[ "$REM" == "0" ]] || { printf 'FAIL: placeholder counted in REMAINING_BEFORE\n' >&2; exit 1; }
+
 printf 'PASS: close-path classifier supports setext section boundaries\n'

package/scripts/classify-finding.sh

@@ -11,6 +11,7 @@
 #   classify-finding.sh --severity <S> [--confidence <C>] [--agent <A>]
 #                       [--lineage none|review-finding] [--text <T> | --text-file <F>]
 #                       [--inpr-diff <F> --file <P>] [--contract-scope <F> --contract-open <F> [--pr-files <F>] [--merge-issue <N>]]
+#                       [--prior-findings <F> [--title <T>] [--line-start <N> [--line-end <M>]] [--diff-map <F>]]
 #
 #   --severity    CRITICAL | HIGH | MEDIUM | LOW (case-insensitive). Missing or
 #                 unparseable → ISSUE (fail toward filing, never drop).
@@ -45,6 +46,23 @@
 #                 `--pr-files <F>` is the PR's changed paths, one per line, supplied for this guard
 #                 alone (it never triggers INPR_FIX). The gate runs after the severity and in-PR gates. Without the flags output is unchanged.
 #
+#   --prior-findings <F> --file <P> [--title <T>] [--line-start <N> [--line-end <M>]] [--diff-map <F>]
+#                 Cross-head / cross-PR re-flag gate: F is a TSV of findings already raised for an
+#                 earlier head of this PR or by a bundle's member PRs, one per line, columns
+#                 file<TAB>line-start<TAB>line-end<TAB>title<TAB>prior-disposition<TAB>issue#.
+#                 prior-disposition is `filed` (its issue is still open), `filed-closed` (issue closed:
+#                 the row is IGNORED so a regressed defect is classified normally) or `note`.
+#                 Line columns may be empty (NOTE-sourced rows carry no range). A finding re-flags a row
+#                 when it is the same file AND ((line IoU >= 0.6 and >= 1 shared title token), or >= 3 shared title tokens). Output is
+#                 `NOTE reflag-filed #N` (row has an issue number) or `NOTE reflag-note`; this gate never
+#                 emits ISSUE. `--file` may carry `path:line`; explicit --line-start wins.
+#                 `--diff-map <F>` (optional, best-effort) lists `git diff <old>..<new>` hunks as
+#                 file<TAB>old-start<TAB>old-count<TAB>new-start<TAB>new-count; a prior range lying
+#                 wholly after hunks is shifted by their net line delta before the IoU. A missing or
+#                 unparseable map means the unshifted range is used. The gate runs after the severity
+#                 parse (HIGH/CRITICAL and unparseable severity stay ISSUE) and before the in-PR gate.
+#                 Without the flags output is unchanged.
+#
 # Output (stdout, one line): `ISSUE <reason>`, `NOTE <reason>` or `INPR_FIX <reason>`.
 # Exit codes: 0 classified, 2 usage error.
 #
@@ -80,9 +98,14 @@ CONTRACT_SCOPE=""
 CONTRACT_OPEN=""
 PR_FILES=""
 MERGE_ISSUE=""
+PRIOR_FINDINGS=""
+TITLE=""
+LINE_START=""
+LINE_END=""
+DIFF_MAP=""
 
 usage() {
-  echo "ERROR: Usage: classify-finding.sh --severity <S> [--confidence <C>] [--agent <A>] [--lineage none|review-finding] [--text <T> | --text-file <F>] [--inpr-diff <F> --file <P>] [--contract-scope <F> --contract-open <F> [--pr-files <F>] [--merge-issue <N>]]" >&2
+  echo "ERROR: Usage: classify-finding.sh --severity <S> [--confidence <C>] [--agent <A>] [--lineage none|review-finding] [--text <T> | --text-file <F>] [--inpr-diff <F> --file <P>] [--contract-scope <F> --contract-open <F> [--pr-files <F>] [--merge-issue <N>]] [--prior-findings <F> [--title <T>] [--line-start <N> [--line-end <M>]] [--diff-map <F>]]" >&2
   exit 2
 }
 
@@ -99,6 +122,11 @@ while [ "$#" -gt 0 ]; do
     --contract-open)  [ "$#" -ge 2 ] || usage; CONTRACT_OPEN="$2"; shift 2 ;;
     --pr-files)       [ "$#" -ge 2 ] || usage; PR_FILES="$2"; shift 2 ;;
     --merge-issue)    [ "$#" -ge 2 ] || usage; MERGE_ISSUE="${2#\#}"; shift 2 ;;
+    --prior-findings) [ "$#" -ge 2 ] || usage; PRIOR_FINDINGS="$2"; shift 2 ;;
+    --title)          [ "$#" -ge 2 ] || usage; TITLE="$2"; shift 2 ;;
+    --line-start)     [ "$#" -ge 2 ] || usage; LINE_START="$2"; shift 2 ;;
+    --line-end)       [ "$#" -ge 2 ] || usage; LINE_END="$2"; shift 2 ;;
+    --diff-map)       [ "$#" -ge 2 ] || usage; DIFF_MAP="$2"; shift 2 ;;
     --text-file)
       [ "$#" -ge 2 ] || usage
       [ -r "$2" ] || { echo "ERROR: --text-file not readable: $2" >&2; exit 2; }
@@ -127,6 +155,10 @@ if [ -n "$PR_FILES" ] && [ ! -r "$PR_FILES" ]; then
   echo "ERROR: --pr-files not readable: $PR_FILES" >&2; exit 2
 fi
 
+if [ -n "$PRIOR_FINDINGS" ] && [ ! -r "$PRIOR_FINDINGS" ]; then
+  echo "ERROR: --prior-findings not readable: $PRIOR_FINDINGS" >&2; exit 2
+fi
+
 upper() { printf '%s' "$1" | tr '[:lower:]' '[:upper:]' | tr -d '[:space:]'; }
 SEV=$(upper "$SEVERITY")
 CONF=$(upper "$CONFIDENCE")
@@ -137,6 +169,69 @@ case "$SEV" in
   *) echo "ISSUE unparseable-severity"; exit 0 ;;
 esac
 
+# Cross-head / cross-PR re-flag gate (#3641). Runs after the severity parse so HIGH/CRITICAL and
+# unparseable severity have already exited as ISSUE. Emits only NOTE; fails toward the normal
+# classification below on a missing file, no match, or an unusable diff map.
+if [ -n "$PRIOR_FINDINGS" ] && [ -n "$FINDING_FILE" ]; then
+  _rpath="${FINDING_FILE#./}"; _rline=""
+  case "$_rpath" in *:[0-9]*) _rline="${_rpath#*:}"; _rline="${_rline%%[!0-9]*}" ;; esac
+  _rpath="${_rpath%%:*}"
+  _rls="${LINE_START:-$_rline}"; _rle="${LINE_END:-$_rls}"
+  case "$_rls" in ''|*[!0-9]*) _rls=""; _rle="" ;; esac
+  case "$_rle" in ''|*[!0-9]*) _rle="$_rls" ;; esac
+  _dmap="$DIFF_MAP"; { [ -n "$_dmap" ] && [ -r "$_dmap" ]; } || _dmap=""
+  _reflag=$(awk -F '\t' -v file="$_rpath" -v ls="$_rls" -v le="$_rle" -v title="$TITLE" -v dmap="$_dmap" '
+    function toks(str, arr,    n, i, parts, t, c) {
+      c = 0; str = tolower(str); gsub(/[^a-z0-9]+/, " ", str)
+      n = split(str, parts, " ")
+      for (i = 1; i <= n; i++) { t = parts[i]; if (length(t) >= 3 && !(t in arr)) { arr[t] = 1; c++ } }
+      return c
+    }
+    function shift(f, s, e,    k, delta) {
+      delta = 0
+      for (k = 1; k <= nh; k++)
+        if (hf[k] == f && (hc[k] == 0 ? ho[k] < s : ho[k] + hc[k] <= s)) delta += hc2[k] - hc[k]
+      return delta
+    }
+    BEGIN {
+      if (dmap != "") {
+        while ((getline line < dmap) > 0) {
+          if (split(line, p, "\t") >= 5 && p[2] ~ /^[0-9]+$/ && p[3] ~ /^[0-9]+$/ && p[4] ~ /^[0-9]+$/ && p[5] ~ /^[0-9]+$/) {
+            nh++; hf[nh] = p[1]; ho[nh] = p[2] + 0; hc[nh] = p[3] + 0; hn[nh] = p[4] + 0; hc2[nh] = p[5] + 0
+          }
+        }
+        close(dmap)
+      }
+      ntitle = toks(title, ft)
+    }
+    {
+      pf = $1; sub(/^\.\//, "", pf)
+      if (pf != file) next
+      if ($5 == "filed-closed") next
+      hit = 0
+      delete pt; toks($4, pt); shared = 0
+      for (t in pt) if (t in ft) shared++
+      # Line overlap alone is not a match (an unrelated finding can land on the same line): it also
+      # needs at least one shared title token. Title-only matching still needs >= 3.
+      if (shared >= 1 && ls != "" && $2 ~ /^[0-9]+$/) {
+        ps = $2 + 0; pe = ($3 ~ /^[0-9]+$/) ? $3 + 0 : ps
+        if (pe < ps) pe = ps
+        d = shift(pf, ps, pe); ps += d; pe += d
+        lo = (ps > ls) ? ps : ls; hi = (pe < le) ? pe : le
+        inter = hi - lo + 1; if (inter < 0) inter = 0
+        uni = (pe - ps + 1) + (le - ls + 1) - inter
+        if (uni > 0 && inter / uni >= 0.6) hit = 1
+      }
+      if (!hit && ntitle >= 3 && shared >= 3) hit = 1
+      if (!hit) next
+      if ($5 == "filed" && $6 ~ /^#?[0-9]+$/) { n = $6; sub(/^#/, "", n); print "NOTE reflag-filed #" n; found = 1; exit }
+      if (!note) note = "NOTE reflag-note"
+    }
+    END { if (!found && note) print note }
+  ' "$PRIOR_FINDINGS" 2>/dev/null) || _reflag=""
+  if [ -n "$_reflag" ]; then echo "$_reflag"; exit 0; fi
+fi
+
 # In-PR fix gate (#3387, narrowed). MEDIUM CONFIRMED is an ISSUE under every rule below
 # (lineage included), so checking here changes only where it is handled, never whether.
 if [ -n "$INPR_DIFF" ] && [ -n "$FINDING_FILE" ] && [ "$SEV" = "MEDIUM" ] && [ "$CONF" = "CONFIRMED" ]; then

package/scripts/classify-finding.test.sh

@@ -152,6 +152,53 @@ rm -f "$CSCOPE" "$COPEN"
 expect_exit 2 "unreadable --contract-scope"   -- --severity MEDIUM --contract-scope /nonexistent/s --file x
 expect_exit 2 "unreadable --contract-open"    -- --severity MEDIUM --contract-open /nonexistent/o --file x
 
+# --- Cross-head / cross-PR re-flag gate (#3641) ---
+expect_out() { # expect_out <full output> <description> -- args...
+  want="$1"; desc="$2"; shift 3
+  got=$(bash "$S" "$@" 2>/dev/null)
+  if [ "$got" = "$want" ]; then pass=$((pass+1)); else fail=$((fail+1)); echo "FAIL: $desc (want '$want', got '${got}')"; fi
+}
+TAB=$(printf '\t')
+PRIOR=$(mktemp "${TMPDIR:-/tmp}/classify-finding-prior.XXXXXX")
+DMAP=$(mktemp "${TMPDIR:-/tmp}/classify-finding-dmap.XXXXXX")
+{
+  printf 'src/sync.sh\t40\t50\tlock released before write completes\tnote\t\n'
+  printf 'src/api.py\t10\t20\tmissing retry on timeout handler\tfiled\t123\n'
+  printf 'src/closed.py\t5\t15\tstale cache entry never evicted\tfiled-closed\t77\n'
+  printf 'src/notes.py\t\t\tduplicated predicate counted twice\tnote\t\n'
+} > "$PRIOR"
+PF=(--prior-findings "$PRIOR")
+M=(--severity MEDIUM --confidence CONFIRMED)
+
+expect_out "NOTE reflag-note" "re-flag by line IoU (same range)" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 42 --line-end 50 --title "lock handling wording here"
+expect_out "NOTE reflag-note" "re-flag via path:line tolerated" -- "${M[@]}" "${PF[@]}" --file src/sync.sh:41 --line-end 50 --title "lock x"
+printf 'src/sync.sh\t1\t2\t1\t12\n' > "$DMAP"   # 2 lines became 12: prior 40-50 is now 50-60
+expect_out "NOTE reflag-note" "re-flag after the line moved, shifted by diff map" -- "${M[@]}" "${PF[@]}" --diff-map "$DMAP" --file src/sync.sh --line-start 50 --line-end 60 --title "lock something else"
+expect ISSUE "line moved with no diff map does not match" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 50 --line-end 60 --title "lock something else"
+printf 'garbage\n' > "$DMAP"
+expect_out "NOTE reflag-note" "unparseable diff map falls back to unshifted range" -- "${M[@]}" "${PF[@]}" --diff-map "$DMAP" --file src/sync.sh --line-start 41 --line-end 50 --title "lock x"
+expect_out "NOTE reflag-note" "re-flag by title tokens (far line)" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 300 --title "Lock released before the write"
+expect_out "NOTE reflag-note" "NOTE row with empty line columns matches by title" -- "${M[@]}" "${PF[@]}" --file src/notes.py --line-start 9 --title "Duplicated predicate is counted twice"
+expect ISSUE "same line, different topic MEDIUM CONFIRMED is not swallowed (SEC-1)" -- "${M[@]}" --agent security "${PF[@]}" --file src/sync.sh --line-start 42 --line-end 50 --title "SQL injection via unsanitized token"
+expect ISSUE "same line with no title at all is not swallowed" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 42 --line-end 50
+expect_out "NOTE reflag-note" "same line, same topic (one shared token) still NOTE" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 42 --line-end 50 --title "Lock handling is racy"
+expect ISSUE "non-overlapping same-file finding is classified normally" -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 200 --line-end 210 --title "missing bounds check"
+expect ISSUE "two shared tokens are not enough"       -- "${M[@]}" "${PF[@]}" --file src/sync.sh --line-start 200 --title "lock released late"
+expect ISSUE "same title on a different file is classified normally" -- "${M[@]}" "${PF[@]}" --file src/other.sh --line-start 45 --title "lock released before write completes"
+expect_out "NOTE reflag-filed #123" "re-flag of an already-filed issue links it" -- "${M[@]}" "${PF[@]}" --file src/api.py --line-start 12 --line-end 18 --title "retry x"
+expect_out "NOTE reflag-filed #123" "filed re-flag by title tokens" -- "${M[@]}" "${PF[@]}" --file src/api.py --line-start 99 --title "Missing retry on timeout"
+expect ISSUE "filed-closed row is ignored (regression not swallowed)" -- "${M[@]}" "${PF[@]}" --file src/closed.py --line-start 5 --line-end 15 --title "stale cache entry never evicted"
+expect ISSUE "HIGH is never demoted by a re-flag"     -- --severity HIGH --confidence CONFIRMED "${PF[@]}" --file src/api.py --line-start 12 --line-end 18 --title "missing retry on timeout handler"
+expect ISSUE "CRITICAL is never demoted by a re-flag" -- --severity CRITICAL "${PF[@]}" --file src/api.py --line-start 12 --line-end 18
+expect ISSUE "unparseable severity is never demoted"  -- --severity INFO "${PF[@]}" --file src/api.py --line-start 12 --line-end 18
+expect ISSUE "no --file: gate skipped"                -- "${M[@]}" "${PF[@]}" --title "lock released before write completes"
+expect ISSUE "no --prior-findings: unchanged"         -- "${M[@]}" --file src/api.py --line-start 12 --line-end 18
+expect NOTE  "re-flag wins over in-PR fix gate"       -- "${M[@]}" "${PF[@]}" --file src/api.py --line-start 12 --line-end 18 --title "retry gap" --inpr-diff "$PRIOR"
+: > "$PRIOR"
+expect ISSUE "empty prior-findings: unchanged"        -- "${M[@]}" "${PF[@]}" --file src/api.py --line-start 12 --line-end 18 --title "missing retry"
+rm -f "$PRIOR" "$DMAP"
+expect_exit 2 "unreadable --prior-findings"   -- --severity MEDIUM --prior-findings /nonexistent/p --file x
+
 # --- usage errors ---
 expect_exit 2 "unknown flag"                  -- --bogus x
 expect_exit 2 "bad lineage"                   -- --severity LOW --lineage P3

package/scripts/forge-root.test.sh

@@ -246,7 +246,7 @@ while IFS= read -r f; do
   arms=$(grep -c 'trusted-comments.sh" \]' "$f" || true)
   [ "$arms" = "$(cat "$T/tc_n")" ] || { TC_STRAY=$((TC_STRAY + 1)); echo "  stray resolver in $f: $arms arms vs $(cat "$T/tc_n") blocks"; }
 done < <(grep -rl 'trusted-comments.sh" \]' "$ROOT/commands")
-expect "trusted-comments.sh resolver blocks discovered (review-pr 8 + review + remediate + phase-4 + review-pr-staging)" 12 "$TC_BLOCKS"
+expect "trusted-comments.sh resolver blocks discovered (review-pr 11 + review + remediate x2 + phase-4 + review-pr-staging 7)" 22 "$TC_BLOCKS"
 expect "trusted-comments.sh resolvers without a canonical block" 0 "$TC_STRAY"
 expect "trusted-comments.sh resolvers byte-identical" 1 "$(sort -u "$T/tc_all" | wc -l | tr -d ' ')"
 grep -qF 'plugins/cache/forgedock/forgedock' "$T/tc_all" && ok || bad 'trusted-comments.sh resolver lacks the plugin-cache scan'
@@ -311,6 +311,53 @@ expect "AMP_SCRIPT: no install resolves empty (cwd copy ignored)" "" "$(hr_run "
 expect "extract-affected-files: cache-only install resolves (cwd and REPO_PATH copies ignored)" "$CACHE_SCRIPTS/extract-affected-files.sh" "$(hr_run "$T/hrhome" "$T/hr_ex4.sh" 'resolve_extract_affected_files')"
 expect "extract-affected-files: no install resolves nothing (cwd and REPO_PATH copies ignored)" "" "$(hr_run "$T/nohome" "$T/hr_ex4.sh" 'resolve_extract_affected_files')"
 
+# Guard (#3596): review-time helpers (derive-finding-milestone.sh, severity-to-priority.sh, code-index.sh) run while the
+# cwd / REPO_PATH is the PR checkout, so each call site must carry a canonical trusted-install resolver block.
+HR_STG="$ROOT/commands/review-pr-staging.md"
+hr_check_block() { # label file var script
+  extract_helper_block "$2" "$3" > "$T/hr_blk.sh"
+  expect "$1: $3 resolver block found" 1 "$(grep -c "^$3=\"\"" "$T/hr_blk.sh")"
+  grep -qF 'plugins/cache/forgedock/forgedock' "$T/hr_blk.sh" && ok || bad "$1: $3 resolver lacks the plugin-cache scan"
+  grep -qF 'CLAUDE_CONFIG_DIR' "$T/hr_blk.sh" && ok || bad "$1: $3 resolver lacks CLAUDE_CONFIG_DIR"
+  grep -qE '\$PWD|\$REPO_PATH|\$\{PWD|\$\{REPO_PATH' "$T/hr_blk.sh" && bad "$1: $3 resolver lists the working directory or repo path" || ok
+  grep -qF "scripts/$4" "$T/hr_blk.sh" && ok || bad "$1: $3 resolver does not resolve scripts/$4"
+}
+hr_check_block review-pr "$HR_CLASSIFY" DERIVE_MILESTONE_SCRIPT derive-finding-milestone.sh
+hr_check_block review-pr "$HR_CLASSIFY" PRIORITY_SCRIPT severity-to-priority.sh
+hr_check_block review-pr "$HR_CLASSIFY" CODE_INDEX_SCRIPT code-index.sh
+hr_check_block review-pr-staging "$HR_STG" DERIVE_MILESTONE_SCRIPT derive-finding-milestone.sh
+hr_check_block review-pr-staging "$HR_STG" PRIORITY_SCRIPT severity-to-priority.sh
+extract_helper_block "$HR_CLASSIFY" DERIVE_MILESTONE_SCRIPT > "$T/hr_dm.sh"
+extract_helper_block "$HR_CLASSIFY" PRIORITY_SCRIPT > "$T/hr_pr.sh"
+extract_helper_block "$HR_STG" DERIVE_MILESTONE_SCRIPT > "$T/hr_dm_stg.sh"
+extract_helper_block "$HR_STG" PRIORITY_SCRIPT > "$T/hr_pr_stg.sh"
+# only the variable-name-specific text may differ, and review-pr/review-pr-staging must agree
+cmp -s "$T/hr_dm.sh" "$T/hr_dm_stg.sh" && ok || bad 'DERIVE_MILESTONE_SCRIPT resolver differs between review-pr and review-pr-staging'
+cmp -s "$T/hr_pr.sh" "$T/hr_pr_stg.sh" && ok || bad 'PRIORITY_SCRIPT resolver differs between review-pr and review-pr-staging'
+# no bare cwd-relative helper call in either review spec
+if grep -nE 'bash scripts/(derive-finding-milestone|severity-to-priority)\.sh' "$HR_CLASSIFY" "$HR_STG" >/dev/null 2>&1; then bad 'review spec still calls a helper by a bare scripts/ path'; else ok; fi
+
+# Repo-wide guard (#3596): no executed bare `bash scripts/<name>` / `./scripts/` and no REPO_PATH/scripts tier under commands/.
+# Allowlist entries are "file-suffix" prefixes; each is a reviewed row with a reason.
+#   design-bench.md, design-render-critique-loop.md, pipeline-health/phase-2-metrics.md, phase-3-dependency.md:
+#     node scripts/*.mjs run inside the ForgeDock repo itself or printed as user hints (not run under a PR checkout cwd).
+#   work-on/investigate.md, work-on/build/architect.md: {REPO_PATH}/scripts/code-index.sh, deferred to #3670.
+#   deploy-info.md: read-only grep of decrypt-secrets.sh, never executed.
+SCRIPTS_ALLOW='commands/(design-bench|design-render-critique-loop|deploy-info|pipeline-health/phase-2-metrics|pipeline-health/phase-3-dependency|work-on/investigate|work-on/build/architect)\.md'
+guard_hits=$(grep -rnE '(^|[^A-Za-z0-9_-])(bash|sh|source) +(\./)?scripts/[A-Za-z0-9_.-]+|REPO_PATH\}?/scripts/' "$ROOT/commands" 2>/dev/null \
+  | sed "s#^$ROOT/##" | grep -vE "^($SCRIPTS_ALLOW):" | grep -vE '^[^:]+:[0-9]+:[[:space:]]*#' || true)  # comment lines are prose
+if [ -n "$guard_hits" ]; then bad "commands/ has a cwd-relative or REPO_PATH helper call outside the allowlist: $(printf '%s' "$guard_hits" | head -5 | tr '\n' '|')"; else ok; fi
+
+# Behavior (#3596): planted cwd copies of the two review helpers must never be selected.
+for h in derive-finding-milestone severity-to-priority code-index; do
+  : > "$T/hrwork/scripts/$h.sh"; : > "$CACHE_SCRIPTS/$h.sh"
+done
+for pair in "dm:DERIVE_MILESTONE_SCRIPT:derive-finding-milestone" "pr:PRIORITY_SCRIPT:severity-to-priority"; do
+  IFS=: read -r k var h <<< "$pair"
+  expect "$var: cache-only install resolves (cwd copy ignored)" "$CACHE_SCRIPTS/$h.sh" "$(hr_run "$T/hrhome" "$T/hr_$k.sh" "printf %s \"\$$var\"")"
+  expect "$var: no install resolves empty (cwd copy ignored)" "" "$(hr_run "$T/nohome" "$T/hr_$k.sh" "printf %s \"\$$var\"")"
+done
+
 # Guard (#3636): review-delta.sh takes its trust script ONLY from an explicit absolute --trusted-script. Any
 # commands/ block that resolves review-delta.sh (added by the specs that consume it) must use the trusted-install
 # tiers: plugin-cache scan and CLAUDE_CONFIG_DIR present, no "$PWD"/"$REPO_PATH" tier. Passes with 0 blocks today.

package/scripts/orchestrate-soft-edge.test.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# orchestrate-soft-edge.test.sh — cases for verify_soft_edge_early (forge#3697).
+# Extracts the helper's fenced bash block from commands/orchestrate/phase-4-execution.md and runs it
+# against a stubbed `gh`, so the spec and the test cannot drift.
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+P4="$ROOT/commands/orchestrate/phase-4-execution.md"
+P3="$ROOT/commands/orchestrate/phase-3-dependency.md"
+PASS=0; FAILN=0
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+ok() { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+
+if [ "${BASH_VERSINFO[0]}" -lt 4 ]; then echo "orchestrate-soft-edge.test.sh: bash 4+ required (associative arrays), skipped"; exit 0; fi
+
+awk '/^```bash$/{b="";in_b=1;next} /^```$/{if(in_b&&b~/^verify_soft_edge_early\(\)/)printf "%s",b; in_b=0;next} in_b{b=b $0 "\n"}' "$P4" \
+  | sed 's/{GH_REPO}/o\/r/g' > "$TMP/helper.sh"
+if [ -s "$TMP/helper.sh" ]; then ok; else bad "verify_soft_edge_early block not found"; echo "failed=$FAILN"; exit 1; fi
+
+mkdir "$TMP/bin"
+cat > "$TMP/bin/gh" <<'STUB'
+#!/bin/sh
+case "$1 $2" in
+  "pr list") [ "${STUB_LIST_FAIL:-0}" = 1 ] && exit 1; [ "${STUB_NO_PR:-0}" = 1 ] || echo 42; exit 0 ;;
+  "pr diff") [ "${STUB_DIFF_FAIL:-0}" = 1 ] && exit 1; printf '%s\n' $STUB_DIFF; exit 0 ;;
+esac
+exit 1
+STUB
+chmod +x "$TMP/bin/gh"
+
+# run NAME WANT SOFT(1|0) EDGE_FILES DIFF [ENV=VAL...]
+run() {
+  local name="$1" want="$2" soft="$3" files="$4" diff="$5"; shift 5
+  local got
+  got="$(env PATH="$TMP/bin:$PATH" STUB_DIFF="$diff" "$@" bash -c '
+    declare -A EDGE_SOFT EDGE_KIND EDGE_FILES
+    EDGE_KIND["1:2"]=same-file; EDGE_FILES["1:2"]="'"$files"'"
+    [ "'"$soft"'" = 1 ] && EDGE_SOFT["1:2"]=true
+    . "'"$TMP"'/helper.sh"
+    verify_soft_edge_early 1 2' 2>&1 | tail -n1)"
+  if [ "$got" = "$want" ]; then ok; else bad "$name (got '$got' want '$want')"; fi
+}
+run "soft edge, diff excludes shared file -> RELEASE" RELEASE 1 "commands/review-pr.md" "commands/review-pr-staging.md"
+run "soft edge, diff has shared file -> HOLD"          HOLD    1 "commands/review-pr.md" "commands/review-pr.md other.md"
+run "soft edge, no PR -> HOLD"                         HOLD    1 "commands/review-pr.md" "" STUB_NO_PR=1
+run "hard edge, no overlap -> HOLD"                    HOLD    0 "commands/review-pr.md" "commands/review-pr-staging.md"
+run "soft edge, gh pr diff fails -> HOLD"              HOLD    1 "commands/review-pr.md" "" STUB_DIFF_FAIL=1
+run "soft edge, PR lookup fails -> HOLD"               HOLD    1 "commands/review-pr.md" "x" STUB_LIST_FAIL=1
+run "path boundary: utils vs some_utils_helper.py"     RELEASE 1 "utils" "src/some_utils_helper.py"
+run "directory edge overlap -> HOLD"                   HOLD    1 "src/utils/" "src/utils/a.py"
+
+grep -q 'EDGE_SOFT' "$P3" && grep -qi 'soft' "$P3" && ok || bad "phase-3 does not declare/tag EDGE_SOFT"
+grep -q 'verify_soft_edge_early "\$PRED"' "$P4" && ok || bad "phase-4 IN_PROGRESS arm does not call verify_soft_edge_early"
+
+echo "orchestrate-soft-edge.test.sh: passed=$PASS failed=$FAILN"
+[ "$FAILN" -eq 0 ]

package/scripts/remediate-basesync.test.sh

@@ -36,14 +36,35 @@ has "M3 records merged base head" 'BASESYNC_BASE_SHA=\$\(git rev-parse origin/'
 has "re-sync rounds hard-capped" 'BASESYNC_MAX_ROUNDS'
 has "M6 distinguishes advanced base" 'Base advanced'
 has "M8 trail persists base sha" 'Base sync\*\*: ran \(base='
-has "rounds derived from pushed sync merges" 'BASESYNC_ROUNDS=\$\(git rev-list --first-parent --merges --count origin/\{PR_BASE\}\.\.origin/\{HEAD_BRANCH\}'
-has "unreadable round count treated as the cap" '\|\| BASESYNC_ROUNDS=\$BASESYNC_MAX_ROUNDS'
+has "rounds derived from pushed sync merges" 'git rev-list --first-parent --merges origin/\{PR_BASE\}\.\.origin/\{HEAD_BRANCH\}'
+has "only merges whose 2nd parent is a base ancestor count" 'git merge-base --is-ancestor "\$_q" origin/\{PR_BASE\}'
+has "unreadable round count treated as the cap" 'else BASESYNC_ROUNDS=\$BASESYNC_MAX_ROUNDS; fi'
+if grep -qF -- '--first-parent --merges --count' "$SPEC"; then bad "no raw all-merges round count"; else ok "no raw all-merges round count"; fi
+if grep -qF 'BASESYNC_RAN' "$SPEC"; then bad "no BASESYNC_RAN shell-state carrier"; else ok "no BASESYNC_RAN shell-state carrier"; fi
+if grep -qF "HEAD^2" "$SPEC"; then bad "M8 does not read HEAD^2"; else ok "M8 does not read HEAD^2"; fi
+has "M0 DONE count accepts ran|attempted" 'Base sync\\\*\\\*: \(ran\|attempted\)'
+has "M0 scopes override by newest bound kind" 'CURRENT_KIND" = "BASESYNC_REMEDIATION"'
+has "M8 records a no-merge round as attempted" 'Base sync\*\*: attempted \(no merge\)'
+# The cap derivation block must be byte-identical across every copy (M3, M6 freshness, M6 base-conflict, M8).
+CAPDIR="$(mktemp -d)"
+awk -v d="$CAPDIR" '/^BASESYNC_ROUNDS=0; _p2=""$/{c++; f=1} f{print > (d "/cap" c)} f&&/^BASESYNC_BASE_SHA=/{f=0}' "$SPEC"
+NCAP=$(ls "$CAPDIR" | wc -l); [ "$NCAP" -ge 4 ] && ok "cap derivation present in M3, M6 x2 and M8 ($NCAP copies)" || bad "cap derivation copies ($NCAP)"
+[ "$(cat "$CAPDIR"/cap* | sort | uniq -c | awk '{print $1}' | sort -u | wc -l)" -le 1 ] && [ "$(cksum < "$CAPDIR"/cap1)" = "$(for _f in "$CAPDIR"/cap*; do cksum < "$_f"; done | sort -u)" ] && ok "cap derivation copies are byte-identical" || bad "cap derivation copies are byte-identical"
 if grep -qF 'BASESYNC_ROUNDS=$(( ${BASESYNC_ROUNDS:-0}' "$SPEC"; then bad "no shell-state round counter"; else ok "no shell-state round counter"; fi
 if grep -qF '[ -n "${BASESYNC_BASE_SHA:-}" ]' "$SPEC"; then bad "freshness pass not gated on a shell var"; else ok "freshness pass not gated on a shell var"; fi
 has "freshness push rc checked" 'if git push origin HEAD:\{HEAD_BRANCH\}; then'
 has "freshness merge re-gated before push" 'Run the Phase M4 pre-push ancestry guard'
 if grep -qF 'do NOT sync a second time' "$SPEC"; then bad "unconditional second-sync refusal removed"; else ok "unconditional second-sync refusal removed"; fi
 
+# Cross-fence shell state (forge#3653): every fence is a fresh shell, so no flag/var may cross fences.
+if grep -qF 'BASESYNC_RAN:-false' "$SPEC"; then bad "M8 not gated on BASESYNC_RAN shell var"; else ok "M8 not gated on BASESYNC_RAN shell var"; fi
+if grep -qE 'BASESYNC_(RAN|CONFLICTED|MERGE_REFUSED)=' "$SPEC"; then bad "no cross-fence BASESYNC_* flags"; else ok "no cross-fence BASESYNC_* flags"; fi
+# MERGE_RC / MERGE_OUT may be read only in the fence that sets them (the M3 sync fence).
+FENCE_SET="$(awk '/^```/{f=!f; n++; next} f&&/MERGE_RC=\$\?/{print n}' "$SPEC" | head -n1)"
+FENCE_USE="$(awk '/^```/{f=!f; n++; next} f&&/\$\{?MERGE_(RC|OUT)/{print n}' "$SPEC" | sort -u | tr '\n' ' ')"
+eq "MERGE_RC/MERGE_OUT read only in the fence that sets them" "$FENCE_USE" "$FENCE_SET "
+has "refused park posts needs-human from the sync fence" 'echo "BLOCKED: base-sync: merge refused'
+
 # Behavioural: dirty tree + base change -> refused (rc!=0, no MERGE_HEAD, empty U-list); real conflict -> MERGE_HEAD present.
 T="$(mktemp -d)"; trap 'rm -rf "$T"' EXIT
 (
@@ -77,7 +98,7 @@ eq "advanced base: SHA differs, unchanged base same, second merge clean" "$(cat
 
 # Durable derivation (forge#3517): the M3/M6 lines, run in a fresh shell against a scratch repo, recover rounds and the
 # recorded base head from the pushed branch; an unpushed merge does not count.
-DERIVE="$(grep -m1 -E '^BASESYNC_ROUNDS=\$\(git rev-list' "$SPEC")"$'\n'"$(grep -m1 -E '^_lm=\$\(git rev-list' "$SPEC")"$'\n'"$(grep -m1 -E '^\[ -n "\$_lm" \]' "$SPEC")"
+DERIVE="$(cat "$CAPDIR/cap1")"
 DERIVE="${DERIVE//\{PR_BASE\}/main}"; DERIVE="${DERIVE//\{HEAD_BRANCH\}/feat}"
 (
   R="$T/derive"; mkdir "$R" && cd "$R" && git init -q -b main . && git config user.email t@t && git config user.name t
@@ -99,5 +120,43 @@ eq "derive: no sync merge -> 0 rounds, no recorded head" "$D0" "0 none"
 eq "derive: unpushed merge does not count" "$DU" "0 none"
 eq "derive: pushed sync merge -> 1 round, recorded head = merged base" "$D1" "1 $B1"
 
+# Cap counts only SYNC merges: a non-sync (manual / feature-branch) merge must not burn the budget, and must not be the recorded head.
+(
+  R="$T/nonsync"; mkdir "$R" && cd "$R" && git init -q -b main . && git config user.email t@t && git config user.name t
+  derive() { BASESYNC_MAX_ROUNDS=2; eval "$DERIVE"; echo "$BASESYNC_ROUNDS ${_p2:-none}"; }
+  echo a > f && git add f && git commit -qm base
+  git checkout -qb feat && echo x > g && git add g && git commit -qm feat
+  git checkout -q main && echo b > f && git commit -qam m1 && git checkout -q feat
+  git update-ref refs/remotes/origin/main main; b1=$(git rev-parse main)
+  git merge origin/main --no-edit >/dev/null 2>&1                      # sync merge
+  git checkout -qb side && echo s > s && git add s && git commit -qm side && git checkout -q feat
+  git merge side --no-ff --no-edit >/dev/null 2>&1                      # manual non-sync merge on top (newest)
+  git checkout -q main && echo c > h && git add h && git commit -qm m2 && git checkout -q feat
+  git update-ref refs/remotes/origin/main main; git update-ref refs/remotes/origin/feat feat
+  echo "$(derive)|$b1|$(git rev-list --first-parent --merges --count origin/main..origin/feat)" > "$T/nonsync.out"
+)
+IFS='|' read -r N1 NB NRAW < "$T/nonsync.out"
+eq "non-sync merge not counted: 1 sync round, recorded head = sync base (raw merge count was 2)" "$N1" "1 $NB"
+eq "manual merge case really had 2 raw merges" "$NRAW" "2"
+
+# M8 derivation in a fresh shell: the spec lines recover the base-sync line from git + trusted markers with no shell state.
+M8="$(awk '/^BASESYNC_KIND=""$/{f=1} /^REMEDIATION_BODY=/{exit} f{print}' "$SPEC")"
+M8="${M8//\{PR_NUMBER\}/7}"
+mkdir -p "$T/bin"; cat > "$T/bin/trusted.sh" <<'TS'
+#!/usr/bin/env bash
+# stand-in for trusted-comments.sh bodies: grep the stdin comment bodies (one per line) with an ERE
+[ "$1" = bodies ] && grep -E -- "$2" || true
+TS
+m8() { # $1 = newest-kind marker body line, $2 = prior trail body line
+  ( BASESYNC_BASE_SHA="$3"; TRUSTED_SCRIPT="$T/bin/trusted.sh"; ISSUE_COMMENTS="$(printf '%s\n%s\n' "$2" "$1")"; eval "$M8"; echo "${BASESYNC_LINE:-empty}" )
+}
+SHA=0123456789abcdef0123456789abcdef01234567
+bs='<!-- FORGE:BASESYNC_REMEDIATION: pr=7 -->'; ci='<!-- FORGE:CI_REMEDIATION: pr=7 -->'
+eq "M8: newest base-sync kind + new sync merge -> ran line" "$(m8 "$bs" "" "$SHA")" "**Base sync**: ran (base=$SHA)"
+eq "M8: newest base-sync kind, no sync merge -> attempted" "$(m8 "$bs" "" "")" "**Base sync**: attempted (no merge)"
+eq "M8: sync merge already recorded by an earlier trail -> attempted" "$(m8 "$bs" "**Base sync**: ran (base=$SHA)" "$SHA")" "**Base sync**: attempted (no merge)"
+eq "M8: other kind -> no base-sync line" "$(m8 "$ci" "" "$SHA")" "empty"
+
+rm -rf "$CAPDIR"
 echo "passed=$PASS failed=$FAILN"
 [ "$FAILN" -eq 0 ]