forgedock 1.8.4 → 1.9.1

package/scripts/close-dossier-no-main-commit.test.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# close-dossier-no-main-commit.test.sh — close.md Phase C1.7 must never write or commit in the main checkout.
+#
+# Static asserts on the spec plus execution of the real extracted C1.7 block
+# against a temp repo with a bare origin and a stubbed gh.
+#
+# Usage: bash scripts/close-dossier-no-main-commit.test.sh
+# Exit code: 0 if all assertions pass, 1 if any fail.
+#
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CLOSE_MD="$SCRIPT_DIR/../commands/work-on/close.md"
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+ok()   { PASS=$((PASS+1)); echo "PASS: $1"; }
+bad()  { FAIL=$((FAIL+1)); echo "FAIL: $1"; }
+
+# --- Static asserts on the spec ---
+if grep -nE 'git -C "\$\{REPO_PATH\}" (commit|add)' "$CLOSE_MD" >/dev/null; then
+  bad "close.md still runs git add/commit against REPO_PATH"
+else ok "close.md has no git add/commit against REPO_PATH"; fi
+
+C17=$(sed -n '/^## Phase C1.7/,/^## Phase C1.5/p' "$CLOSE_MD")
+if printf '%s\n' "$C17" | grep -nE '^\s*cd "\$\{REPO_PATH\}"' >/dev/null; then
+  bad "C1.7 changes directory into REPO_PATH"
+else ok "C1.7 does not cd into REPO_PATH"; fi
+printf '%s\n' "$C17" | grep -q 'Phase C1.7: skipped' && ok "C1.7 logs skip reasons" || bad "C1.7 missing 'Phase C1.7: skipped'"
+printf '%s\n' "$C17" | grep -q 'worktree add --detach' && ok "C1.7 uses a temporary detached worktree" || bad "C1.7 missing temp worktree"
+printf '%s\n' "$C17" | grep -q 'gh pr create' && ok "C1.7 opens a PR" || bad "C1.7 missing gh pr create"
+[ "$(printf '%s\n' "$C17" | grep -c '^```bash')" -eq 1 ] && ok "C1.7 is a single bash block (no cross-block shell state)" || bad "C1.7 must be exactly one bash block"
+printf '%s\n' "$C17" | grep -qE "^\s*trap .*EXIT" && ok "C1.7 registers an EXIT trap" || bad "C1.7 missing EXIT trap"
+printf '%s\n' "$C17" | grep -q 'worktree remove --force' && ok "C1.7 cleanup removes the worktree" || bad "C1.7 cleanup missing worktree remove"
+ADD_LN=$(printf '%s\n' "$C17" | grep -n 'worktree add --detach' | head -1 | cut -d: -f1)
+TRAP_LN=$(printf '%s\n' "$C17" | grep -nE "^\s*trap .*EXIT" | head -1 | cut -d: -f1)
+[ -n "$ADD_LN" ] && [ -n "$TRAP_LN" ] && [ "$TRAP_LN" -gt "$ADD_LN" ] && ok "EXIT trap registered after worktree add" || bad "EXIT trap must follow worktree add"
+printf '%s\n' "$C17" | grep -q 'force-with-lease' && ok "C1.7 pushes with --force-with-lease" || bad "C1.7 missing force-with-lease"
+printf '%s\n' "$C17" | grep -qE 'push .*--force( |$)' && bad "C1.7 uses bare --force" || ok "C1.7 has no bare --force"
+printf '%s\n' "$C17" | grep -q 'gh pr list' && ok "C1.7 checks for an existing open PR" || bad "C1.7 missing gh pr list"
+grep -q 'FORGE:DOSSIER_UPDATED' "$CLOSE_MD" && ok "FORGE:DOSSIER_UPDATED marker kept" || bad "FORGE:DOSSIER_UPDATED marker missing"
+
+# --- Dynamic: execute the REAL C1.7 block extracted from close.md (gh stubbed) ---
+BLOCK=$(printf '%s\n' "$C17" | awk '/^```bash/{f=1;next} /^```/{f=0} f')
+if [ -z "$BLOCK" ]; then
+  bad "could not extract the C1.7 bash block"
+elif ! command -v perl >/dev/null 2>&1 || ! yq --version 2>&1 | grep -q 'mikefarah'; then
+  bad "dynamic section needs perl and mikefarah yq v4 (not silently skipped)"
+else
+printf '%s\n' "$BLOCK" | grep -q '^_dossier_run()' && printf '%s\n' "$BLOCK" | grep -q '^_dossier_cleanup()' \
+  && ok "extracted block defines _dossier_run and _dossier_cleanup" || bad "extracted block missing _dossier_run/_dossier_cleanup"
+
+# Substitute only the exact {NAME} placeholders; leave ${NAME} shell expansions intact.
+printf '%s\n' "$BLOCK" | perl -pe 's/(?<!\$)\{GH_REPO\}/o\/r/g; s/(?<!\$)\{NUMBER\}/1/g; s/(?<!\$)\{PR_NUMBER\}/2/g; s/(?<!\$)\{GH_FLAG\}/-R o\/r/g' > "$TMP/block.sh"
+bash -n "$TMP/block.sh" && ok "substituted C1.7 block parses (bash -n)" || bad "substituted C1.7 block has a syntax error"
+
+export GIT_AUTHOR_NAME=t GIT_AUTHOR_EMAIL=t@example.com GIT_COMMITTER_NAME=t GIT_COMMITTER_EMAIL=t@example.com
+git init -q --bare "$TMP/origin.git"
+git init -q -b staging "$TMP/main"
+mkdir -p "$TMP/main/devdocs/modules"
+echo seed > "$TMP/main/devdocs/modules/m.md"
+printf 'modules:\n  - name: m\n    glob: "*.sh"\n    path: modules/m.md\n' > "$TMP/main/devdocs/index.yaml"
+git -C "$TMP/main" add -A && git -C "$TMP/main" commit -q -m seed
+git -C "$TMP/main" remote add origin "$TMP/origin.git"
+git -C "$TMP/main" push -q origin staging 2>/dev/null
+
+# gh stub: never touches the network; every call is logged.
+mkdir -p "$TMP/bin" "$TMP/tmpd" "$TMP/cwd"
+cat > "$TMP/bin/gh" <<'GHEOF'
+#!/usr/bin/env bash
+echo "gh $*" >> "$GH_LOG"
+case "$1 $2" in
+  "api repos/o/r/issues/1/comments")
+    printf '<!-- FORGE:BUILDER -->\n### Changes\n- `scripts/foo.sh` changed\n### Next\n' ;;
+  "pr view") echo "Test PR title" ;;
+  "pr list")
+    echo "pr-list worktrees: $(git -C "$REPO_PATH" worktree list | wc -l)" >> "$GH_LOG"
+    [ "${GH_KILL_ON_PR_LIST:-}" = 1 ] && kill -TERM "$(cat "$PIDF")" && sleep 1
+    echo "${GH_PR_LIST_URL:-}" ;;
+  "pr create") [ "${GH_FAIL_PR_CREATE:-}" = 1 ] && exit 1; echo "https://example.invalid/o/r/pull/9" ;;
+esac
+exit 0
+GHEOF
+chmod +x "$TMP/bin/gh"
+export GH_LOG="$TMP/gh.log" PIDF="$TMP/pid" REPO_PATH="$TMP/main" PR_BASE=staging NUMBER=1
+[ "$(PATH="$TMP/bin:$PATH" command -v gh)" = "$TMP/bin/gh" ] && ok "gh resolves to the stub" || bad "gh stub not first on PATH"
+
+HEAD_BEFORE=$(git -C "$TMP/main" rev-parse HEAD)
+BRANCH_BEFORE=$(git -C "$TMP/main" branch --show-current)
+
+# run_block: executes the real block in a fresh bash, cwd without forge.yaml.
+run_block() { : > "$GH_LOG"; ( cd "$TMP/cwd" && env PATH="$TMP/bin:$PATH" TMPDIR="$TMP/tmpd" "$@" bash -c 'echo $$ > "$PIDF"; source "$1"' _ "$TMP/block.sh" ) > "$TMP/out.log" 2>&1; }
+main_untouched() {
+  [ "$(git -C "$TMP/main" rev-parse HEAD)" = "$HEAD_BEFORE" ] && [ "$(git -C "$TMP/main" branch --show-current)" = "$BRANCH_BEFORE" ] \
+    && [ -z "$(git -C "$TMP/main" status --porcelain)" ]
+}
+no_leak() {
+  [ -z "$(ls -A "$TMP/tmpd" 2>/dev/null)" ] && [ "$(git -C "$TMP/main" worktree list | wc -l)" -eq 1 ]
+}
+
+# Scenario A: happy path
+run_block; RC=$?
+[ "$RC" -eq 0 ] && ok "A: real block exits 0" || bad "A: real block exit $RC"
+main_untouched && ok "A: main checkout untouched (HEAD, branch, clean tree)" || bad "A: main checkout modified"
+git -C "$TMP/origin.git" rev-parse -q --verify refs/heads/docs/dossier-1 >/dev/null && ok "A: dossier branch pushed to origin" || bad "A: dossier branch not pushed"
+git -C "$TMP/origin.git" show refs/heads/docs/dossier-1:devdocs/modules/m.md 2>/dev/null | grep -q '^## Entry' && ok "A: dossier entry appended on pushed branch" || bad "A: no entry on pushed branch"
+grep -q '^gh pr create' "$GH_LOG" && ok "A: gh pr create called" || bad "A: gh pr create not called"
+grep -q 'FORGE:DOSSIER_UPDATED' "$GH_LOG" && ok "A: FORGE:DOSSIER_UPDATED comment posted" || bad "A: no FORGE:DOSSIER_UPDATED comment"
+no_leak && ok "A: temporary worktree removed" || bad "A: temporary worktree leaked"
+
+# Scenario B: retry over the existing remote branch (real fetch + --force-with-lease)
+OLD=$(git -C "$TMP/origin.git" rev-parse refs/heads/docs/dossier-1)
+sleep 1  # commit SHAs embed second-resolution timestamps; ensure the retry differs
+run_block; RC=$?
+NEW=$(git -C "$TMP/origin.git" rev-parse refs/heads/docs/dossier-1)
+[ "$RC" -eq 0 ] && [ "$OLD" != "$NEW" ] && ok "B: retry push over existing remote branch succeeds" || bad "B: retry push failed (rc=$RC)"
+main_untouched && no_leak && ok "B: main untouched and worktree removed" || bad "B: main modified or worktree leaked"
+
+# Scenario C: fault injection - SIGTERM after worktree add, before the explicit cleanup.
+# Only the block's real EXIT trap can remove the worktree.
+run_block GH_KILL_ON_PR_LIST=1 2>/dev/null
+grep -q '^pr-list worktrees: 2' "$GH_LOG" && ok "C: worktree existed when the fault fired" || bad "C: fault did not fire after worktree add (vacuous)"
+grep -q '^gh pr create' "$GH_LOG" && bad "C: block continued past the injected fault" || ok "C: block aborted before pr create"
+no_leak && ok "C: real EXIT trap cleaned the worktree" || bad "C: worktree leaked after abort (EXIT trap regression)"
+main_untouched && ok "C: main checkout untouched" || bad "C: main checkout modified"
+
+# Scenario D: gh pr create fails - block still exits 0, logs a skip, cleans up
+run_block GH_FAIL_PR_CREATE=1; RC=$?
+[ "$RC" -eq 0 ] && grep -q 'skipped - gh pr create failed' "$TMP/out.log" && ok "D: pr create failure logged as skip, exit 0" || bad "D: pr create failure not handled"
+grep -q 'issue comment' "$GH_LOG" && bad "D: annotation posted despite no PR" || ok "D: no annotation without a PR"
+no_leak && ok "D: worktree removed" || bad "D: worktree leaked"
+fi
+
+echo "Passed: $PASS  Failed: $FAIL"
+[ "$FAIL" -eq 0 ]

package/scripts/forge-root.test.sh

@@ -8,7 +8,7 @@
 set -uo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; ROOT="$HERE/.."
 T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
-PASS=0; FAILN=0
+PASS=0; FAILN=0; SKIPPED=0
 ok()  { PASS=$((PASS+1)); }
 bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
 expect() { [ "$2" = "$3" ] && ok || bad "$1 (got '$3' want '$2')"; }
@@ -40,6 +40,8 @@ grep -v '^[[:space:]]*#' "$T/canon" > "$T/canon.code"   # code only: the comment
 grep -qE 'mapfile|readarray|declare -A|sort[^|]* -[a-zA-Z]*V' "$T/canon.code" && bad "canonical bootstrap uses a bash-4+/non-portable construct" || ok
 grep -q 'sort -k1,1nr -k2,2nr -k3,3nr' "$T/canon.code" && ok || bad "canonical bootstrap lacks numeric component version sort"
 grep -qF 'marketplaces/*; do' "$T/canon" && bad "canonical bootstrap globs all marketplaces" || ok
+grep -qF -- "-iname '*forgedock*'" "$T/canon.code" && bad "canonical bootstrap wildcard-matches marketplaces" || ok
+grep -qF '[A-Za-z]:' "$T/canon.code" && ok || bad "canonical bootstrap lacks drive-letter path handling"
 # review.md must hard-exit on an unreadable trail
 grep -qE 'TRAIL_RC.* -ge 2 .*exit 1' "$ROOT/commands/work-on/review.md" && ok || bad "work-on/review.md lacks hard exit guard for TRAIL_RC>=2"
 # behavioral: execute the guard line itself. rc>=2 => BLOCKED on STDOUT + exit 1; rc 0/1 => falls through.
@@ -88,9 +90,9 @@ mkscripts() {
   : > "$1/bin/engine/resolve.mjs"; : > "$1/bin/engine/orchestrate-canary.mjs"; : > "$1/bin/engine/admission.mjs"
 }
 # plugin install: no env vars at all
-mkscripts "$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0"
-expect "plugin cache resolves with no env" "$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0" "$(run "$T/h1")"
-expect "CLAUDE_PLUGIN_ROOT resolves" "$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0" "$(run "$T/empty" CLAUDE_PLUGIN_ROOT="$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0")"
+mkscripts "$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0"
+expect "plugin cache resolves with no env" "$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0" "$(run "$T/h1")"
+expect "CLAUDE_PLUGIN_ROOT resolves" "$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0" "$(run "$T/empty" CLAUDE_PLUGIN_ROOT="$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0")"
 # nothing installed: empty (never the consumer repo, never a relative path)
 expect "unresolvable stays empty" "" "$(run "$T/empty")"
 expect "relative FORGE_HOME ignored" "" "$(run "$T/empty" FORGE_HOME=.)"
@@ -98,31 +100,38 @@ expect "relative FORGE_HOME ignored" "" "$(run "$T/empty" FORGE_HOME=.)"
 expect "FORGEDOCK_HOME authoritative" "$T/nowhere" "$(run "$T/h1" FORGEDOCK_HOME="$T/nowhere")"
 # symlink install (install.sh): ~/.claude/commands/work-on.md -> <clone>/commands/work-on.md
 mkdir -p "$T/clone/commands" "$T/h2/.claude/commands"; mkscripts "$T/clone"; : > "$T/clone/commands/work-on.md"
-ln -sf "$T/clone/commands/work-on.md" "$T/h2/.claude/commands/work-on.md"
-expect "install.sh symlink resolves" "$(cd "$T/clone" && pwd -P)" "$(cd "$(run "$T/h2")" && pwd -P)"
-expect "FORGE_HOME without scripts falls through" "$(cd "$T/clone" && pwd -P)" "$(cd "$(run "$T/h2" FORGE_HOME="$T/h2/.claude")" && pwd -P)"
+# Git Bash (MSYS) makes a COPY for `ln -s` unless native symlinks are requested, which leaves readlink
+# nothing to resolve; request them, and run the two symlink cases only when a real symlink exists (a runner
+# without symlink privilege cannot exercise install.sh's layout, which is itself a symlink install).
+MSYS=winsymlinks:nativestrict ln -sf "$T/clone/commands/work-on.md" "$T/h2/.claude/commands/work-on.md" 2>/dev/null
+if [ -L "$T/h2/.claude/commands/work-on.md" ]; then
+  expect "install.sh symlink resolves" "$(cd "$T/clone" && pwd -P)" "$(cd "$(run "$T/h2")" && pwd -P)"
+  expect "FORGE_HOME without scripts falls through" "$(cd "$T/clone" && pwd -P)" "$(cd "$(run "$T/h2" FORGE_HOME="$T/h2/.claude")" && pwd -P)"
+else
+  echo "SKIP: symlink cases (this platform cannot create symlinks)"; SKIPPED=$((SKIPPED+1))
+fi
 
 # newest cached version wins (1.10.0 must beat 1.9.0)
-for v in 1.9.0 1.10.0 1.2.0; do mkscripts "$T/h3/.claude/plugins/cache/mk/forgedock/$v"; done
-expect "newest cached version wins" "$T/h3/.claude/plugins/cache/mk/forgedock/1.10.0" "$(run "$T/h3")"
+for v in 1.9.0 1.10.0 1.2.0; do mkscripts "$T/h3/.claude/plugins/cache/forgedock/forgedock/$v"; done
+expect "newest cached version wins" "$T/h3/.claude/plugins/cache/forgedock/forgedock/1.10.0" "$(run "$T/h3")"
 # HOME containing a space still resolves
-mkscripts "$T/sp ace/.claude/plugins/cache/mk/forgedock/2.0.0"
-expect "space in HOME resolves" "$T/sp ace/.claude/plugins/cache/mk/forgedock/2.0.0" "$(run "$T/sp ace")"
+mkscripts "$T/sp ace/.claude/plugins/cache/forgedock/forgedock/2.0.0"
+expect "space in HOME resolves" "$T/sp ace/.claude/plugins/cache/forgedock/forgedock/2.0.0" "$(run "$T/sp ace")"
 # relative FORGEDOCK_HOME / CLAUDE_PLUGIN_ROOT rejected (fail closed => empty)
 expect "relative FORGEDOCK_HOME rejected" "" "$(run "$T/h1" FORGEDOCK_HOME=scripts/..)"
 expect "relative CLAUDE_PLUGIN_ROOT ignored" "" "$(run "$T/empty" CLAUDE_PLUGIN_ROOT=../consumer)"
 # a candidate with only one of the two needed scripts is rejected
-mkdir -p "$T/h4/.claude/plugins/cache/mk/forgedock/1.0.0/scripts"; : > "$T/h4/.claude/plugins/cache/mk/forgedock/1.0.0/scripts/verify-phase-trail.sh"
+mkdir -p "$T/h4/.claude/plugins/cache/forgedock/forgedock/1.0.0/scripts"; : > "$T/h4/.claude/plugins/cache/forgedock/forgedock/1.0.0/scripts/verify-phase-trail.sh"
 expect "partial install (missing lint script) rejected" "" "$(run "$T/h4")"
 # stale install: has the two original gate scripts but lacks is-docs-only.sh / engine modules => rejected
 for missing in scripts/is-docs-only.sh bin/engine/resolve.mjs bin/engine/orchestrate-canary.mjs bin/engine/admission.mjs; do
-  rm -rf "$T/h12"; mkscripts "$T/h12/.claude/plugins/cache/mk/forgedock/1.0.0"; rm -f "$T/h12/.claude/plugins/cache/mk/forgedock/1.0.0/$missing"
+  rm -rf "$T/h12"; mkscripts "$T/h12/.claude/plugins/cache/forgedock/forgedock/1.0.0"; rm -f "$T/h12/.claude/plugins/cache/forgedock/forgedock/1.0.0/$missing"
   expect "stale install missing $missing rejected" "" "$(run "$T/h12")"
 done
 # a stale newest version is skipped in favor of a complete older one
-rm -rf "$T/h13"; mkscripts "$T/h13/.claude/plugins/cache/mk/forgedock/1.0.0"; mkscripts "$T/h13/.claude/plugins/cache/mk/forgedock/2.0.0"
-rm -f "$T/h13/.claude/plugins/cache/mk/forgedock/2.0.0/scripts/is-docs-only.sh"
-expect "stale newest skipped for complete older" "$T/h13/.claude/plugins/cache/mk/forgedock/1.0.0" "$(run "$T/h13")"
+rm -rf "$T/h13"; mkscripts "$T/h13/.claude/plugins/cache/forgedock/forgedock/1.0.0"; mkscripts "$T/h13/.claude/plugins/cache/forgedock/forgedock/2.0.0"
+rm -f "$T/h13/.claude/plugins/cache/forgedock/forgedock/2.0.0/scripts/is-docs-only.sh"
+expect "stale newest skipped for complete older" "$T/h13/.claude/plugins/cache/forgedock/forgedock/1.0.0" "$(run "$T/h13")"
 # non-ForgeDock marketplace dirs are ignored; ForgeDock-named ones resolve
 mkscripts "$T/h5/.claude/plugins/marketplaces/other-tool"
 expect "non-ForgeDock marketplace ignored" "" "$(run "$T/h5")"
@@ -131,21 +140,67 @@ expect "forgedock marketplace resolves" "$T/h6/.claude/plugins/marketplaces/forg
 
 # release outranks its own pre-release; a newer pre-release core still beats an older release
 rm -rf "$T/h7"   # fixture is mutated below; reset per shell
-mkscripts "$T/h7/.claude/plugins/cache/mk/forgedock/1.9.0-rc1"; mkscripts "$T/h7/.claude/plugins/cache/mk/forgedock/1.9.0"
-expect "release beats its pre-release" "$T/h7/.claude/plugins/cache/mk/forgedock/1.9.0" "$(run "$T/h7")"
-mkscripts "$T/h7/.claude/plugins/cache/mk/forgedock/2.0.0-rc1"
-expect "newer-core pre-release beats older release" "$T/h7/.claude/plugins/cache/mk/forgedock/2.0.0-rc1" "$(run "$T/h7")"
-# version component decides, not the marketplace name (zz sorts after aa lexically but holds the older version)
-mkscripts "$T/h8/.claude/plugins/cache/zz-market/forgedock/1.0.0"; mkscripts "$T/h8/.claude/plugins/cache/aa-market/forgedock/1.1.0"
-expect "version beats marketplace name" "$T/h8/.claude/plugins/cache/aa-market/forgedock/1.1.0" "$(run "$T/h8")"
+mkscripts "$T/h7/.claude/plugins/cache/forgedock/forgedock/1.9.0-rc1"; mkscripts "$T/h7/.claude/plugins/cache/forgedock/forgedock/1.9.0"
+expect "release beats its pre-release" "$T/h7/.claude/plugins/cache/forgedock/forgedock/1.9.0" "$(run "$T/h7")"
+mkscripts "$T/h7/.claude/plugins/cache/forgedock/forgedock/2.0.0-rc1"
+expect "newer-core pre-release beats older release" "$T/h7/.claude/plugins/cache/forgedock/forgedock/2.0.0-rc1" "$(run "$T/h7")"
+# marketplace pinning: a higher-versioned forgedock plugin from a non-official marketplace is never used
+mkscripts "$T/h8/.claude/plugins/cache/evil-market/forgedock/99.0.0"; mkscripts "$T/h8/.claude/plugins/cache/forgedock/forgedock/1.1.0"
+expect "hostile marketplace at 99.0.0 ignored" "$T/h8/.claude/plugins/cache/forgedock/forgedock/1.1.0" "$(run "$T/h8")"
+rm -rf "$T/h8b"; mkscripts "$T/h8b/.claude/plugins/cache/evil-market/forgedock/99.0.0"
+expect "only a hostile marketplace => empty" "" "$(run "$T/h8b")"
+expect "FORGEDOCK_MARKETPLACE pins another marketplace" "$T/h8b/.claude/plugins/cache/evil-market/forgedock/99.0.0" "$(run "$T/h8b" FORGEDOCK_MARKETPLACE=evil-market)"
+expect "invalid FORGEDOCK_MARKETPLACE falls back to forgedock" "" "$(run "$T/h8b" FORGEDOCK_MARKETPLACE=..)"
+rm -rf "$T/h8c"; mkscripts "$T/h8c/.claude/plugins/marketplaces/evil-forgedock-tools"
+expect "wildcard-named marketplace dir ignored" "" "$(run "$T/h8c")"
+# non-semver cache dir names (commit SHAs, 1e5x) are skipped, never ranked by numeric coercion
+rm -rf "$T/h14"; P14="$T/h14/.claude/plugins/cache/forgedock/forgedock"
+mkscripts "$P14/1.10.0"; mkscripts "$P14/1e5abcdef"; mkscripts "$P14/abc1234def"; mkscripts "$P14/6f3a9c0"
+expect "SHA-named cache dirs ignored" "$P14/1.10.0" "$(run "$T/h14")"
+rm -rf "$T/h14b"; mkscripts "$T/h14b/.claude/plugins/cache/forgedock/forgedock/abc1234def"
+expect "only SHA-named dir => empty" "" "$(run "$T/h14b")"
+mkscripts "$P14/1.10.0-rc1"; expect "pre-release dir name still accepted (release wins)" "$P14/1.10.0" "$(run "$T/h14")"
+# Windows drive-letter FORGEDOCK_HOME is normalized (/c/...), relative stays rejected
+rm -rf "$T/win"; mkscripts "$T/win/c/forge"
+expect "C:/ FORGEDOCK_HOME authoritative (no cygpath, bogus path)" "/c/nowhere/forge" "$(run "$T/h1" FORGEDOCK_HOME='C:/nowhere/forge')"
+expect "C:\\ FORGEDOCK_HOME normalized" "/d/x/y" "$(run "$T/h1" FORGEDOCK_HOME='D:\x\y')"
+# Codex: forge-home pointer file written by install-codex.sh
+mkscripts "$T/hx/clone"; mkdir -p "$T/hx/.codex"; printf '%s\n' "$T/hx/clone" > "$T/hx/.codex/forge-home"
+expect "codex forge-home pointer resolves" "$T/hx/clone" "$(run "$T/hx")"
+expect "CODEX_HOME override resolves" "$T/hx/clone" "$(run "$T/empty" CODEX_HOME="$T/hx/.codex")"
+# A relative CODEX_HOME must not resolve the pointer against the consumer cwd
+mkdir -p "$T/consumer/.codex"; printf '%s\n' "$T/hx/clone" > "$T/consumer/.codex/forge-home"
+expect "relative CODEX_HOME ignored (cwd-local pointer not read)" "" "$(run "$T/empty" CODEX_HOME=.codex)"
+rm -rf "$T/consumer/.codex"
+printf 'relative/path\n' > "$T/hx/.codex/forge-home"
+expect "relative forge-home pointer rejected" "" "$(run "$T/hx")"
+# install-codex.sh: FORGE_HOME is shell-escaped in env files, and absent env files are not created (forge#3241)
+IC="$T/ic/we ird\$x's"; mkdir -p "$IC/commands" "$T/ic-home"
+cp "$ROOT/install-codex.sh" "$IC/install-codex.sh"
+: > "$T/ic-home/.zshenv"
+( cd "$IC" && env -i PATH="$PATH" HOME="$T/ic-home" CODEX_HOME="$T/ic-home/.codex" bash ./install-codex.sh >/dev/null 2>&1 )
+[ ! -e "$T/ic-home/.profile" ] && ok || bad "install-codex.sh created a missing ~/.profile"
+# The installer records its own resolved dir (macOS /var -> /private/var, Git Bash /tmp -> /c/Users/...), so compare against that, not $IC.
+IC_REAL=$( cd "$IC" && env -i PATH="$PATH" bash -c 'cd "$(dirname ./install-codex.sh)" && pwd' )
+got=$(env -i PATH="$PATH" HOME="$T/ic-home" bash -c '. "$HOME/.zshenv"; printf %s "$FORGE_HOME"' 2>&1)
+expect "env-file FORGE_HOME round-trips space, \$ and single quote" "$IC_REAL" "$got"
+got=$(env -i PATH="$PATH" HOME="$T/ic-home" sh -c '. "$HOME/.zshenv"; printf %s "$FORGE_HOME"' 2>&1)
+expect "env-file FORGE_HOME round-trips under POSIX sh" "$IC_REAL" "$got"
+grep -qF "\$'" "$T/ic-home/.zshenv" && bad "env file contains bash-only \$'...' quoting" || ok
+expect "pointer file still written" "$IC_REAL" "$(cat "$T/ic-home/.codex/forge-home" 2>/dev/null)"
+# errexit/pipefail safety: absent readlink target, absent cache dir, no ~/.claude at all
+for opts in "-e" "-eo pipefail" "-euo pipefail"; do
+  expect "survives set $opts with nothing installed" "ok:" "$( cd "$T/consumer" && env -i PATH="$PATH" HOME="$T/empty" "$SH" -c "set $opts; $(cat "$T/canon"); printf 'ok:%s' \"\$FORGE_ROOT\"" 2>&1 )"
+  expect "resolves under set $opts" "ok:$T/h3/.claude/plugins/cache/forgedock/forgedock/1.10.0" "$( cd "$T/consumer" && env -i PATH="$PATH" HOME="$T/h3" "$SH" -c "set $opts; $(cat "$T/canon"); printf 'ok:%s' \"\$FORGE_ROOT\"" 2>&1 )"
+done
 # a non-forgedock plugin in the cache is ignored even with a higher version
-mkscripts "$T/h9/.claude/plugins/cache/mk/otherplugin/9.9.9"; mkscripts "$T/h9/.claude/plugins/cache/mk/forgedock/1.0.0"
-expect "non-forgedock cache plugin ignored" "$T/h9/.claude/plugins/cache/mk/forgedock/1.0.0" "$(run "$T/h9")"
+mkscripts "$T/h9/.claude/plugins/cache/forgedock/otherplugin/9.9.9"; mkscripts "$T/h9/.claude/plugins/cache/forgedock/forgedock/1.0.0"
+expect "non-forgedock cache plugin ignored" "$T/h9/.claude/plugins/cache/forgedock/forgedock/1.0.0" "$(run "$T/h9")"
 # unmatched globs: empty cache dir, absent marketplaces dir, absent ~/.claude entirely (must not abort under zsh)
 mkdir -p "$T/h10/.claude/plugins/cache"
 expect "empty cache, no match, no abort" "" "$(run "$T/h10")"
 expect "no ~/.claude at all, no abort" "" "$(run "$T/empty")"
-expect "unmatched glob does not break later candidates" "$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0" "$(run "$T/h10" CLAUDE_PLUGIN_ROOT="$T/h1/.claude/plugins/cache/mk/forgedock/1.0.0")"
+expect "unmatched glob does not break later candidates" "$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0" "$(run "$T/h10" CLAUDE_PLUGIN_ROOT="$T/h1/.claude/plugins/cache/forgedock/forgedock/1.0.0")"
 # plugin root (textually substituted) outranks an exported FORGE_HOME that also has the scripts:
 # the running plugin's own files win over a stale clone named by a global env var (forge#3147 field test)
 mkscripts "$T/h11/stale-clone"; mkscripts "$T/h11/running-plugin"
@@ -166,11 +221,13 @@ for f in $SITES commands/work-on/close.md; do
 done
 if command -v node >/dev/null 2>&1; then
   for d in "we#ird" "sp ace" "q?x"; do
+    # '?' is not a legal Windows filename character: MSYS remaps it, so node sees a different path.
+    case "$d:$(uname -s)" in *'?'*:MINGW*|*'?'*:MSYS*|*'?'*:CYGWIN*) echo "SKIP: path '$d' (illegal on Windows)"; SKIPPED=$((SKIPPED+1)); continue ;; esac
     mkdir -p "$T/url/$d/bin/engine"; echo 'export const v = 42;' > "$T/url/$d/bin/engine/resolve.mjs"
     out=$(node -e 'import(require("node:url").pathToFileURL(process.argv[1]).href).then(m => process.stdout.write(String(m.v)))' "$T/url/$d/bin/engine/resolve.mjs" 2>&1)
     expect "pathToFileURL import survives path '$d'" 42 "$out"
   done
 fi
 
-echo "forge-root tests: pass=$PASS fail=$FAILN"
+echo "forge-root tests: pass=$PASS fail=$FAILN skipped=$SKIPPED"
 [ "$FAILN" -eq 0 ]

package/scripts/lint-build-validate-files.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Lint: every work-on:build:validate Skill( invocation in build.md must carry --files,
+# and the B6.5 repair section must contain an explicit one (forge#3254).
+# Usage: bash scripts/lint-build-validate-files.sh [path/to/build.md]
+set -uo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+SPEC="${1:-$HERE/../commands/work-on/build.md}"
+[ -f "$SPEC" ] || { echo "lint-build-validate-files: spec not found: $SPEC" >&2; exit 2; }
+rc=0
+calls=$(grep -n 'Skill(skill=.*work-on:build:validate' "$SPEC" || true)
+if [ -z "$calls" ]; then
+  echo "FAIL: no work-on:build:validate Skill( invocation found in $SPEC" >&2
+  exit 1
+fi
+bad=$(printf '%s\n' "$calls" | grep -vF -- '--files' || true)
+if [ -n "$bad" ]; then
+  printf '%s\n' "$bad" | while IFS= read -r l; do
+    echo "FAIL: $SPEC:${l%%:*}: validate invocation lacks --files" >&2
+  done
+  rc=1
+fi
+if ! awk '/Phase B6\.5/{f=1} f' "$SPEC" | grep 'Skill(skill=.*work-on:build:validate' | grep -qF -- '--files'; then
+  echo "FAIL: $SPEC: B6.5 repair section has no explicit validate invocation carrying --files" >&2
+  rc=1
+fi
+[ "$rc" -eq 0 ] && echo "OK: all validate invocations carry --files"
+exit "$rc"

package/scripts/lint-build-validate-files.test.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Fixtures for lint-build-validate-files.sh (forge#3254). Run: bash scripts/lint-build-validate-files.test.sh
+set -uo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+LINT="$HERE/lint-build-validate-files.sh"
+T="$(mktemp -d)"; trap 'rm -rf "$T"' EXIT
+PASS=0; FAILN=0
+check() { # name want_rc file
+  bash "$LINT" "$3" >"$T/out" 2>&1; rc=$?
+  if [ "$rc" -eq "$2" ]; then PASS=$((PASS+1)); else FAILN=$((FAILN+1)); echo "FAIL: $1 (rc=$rc want $2)"; cat "$T/out"; fi
+}
+V='Skill(skill="{FORGE_SKILL_PREFIX}work-on:build:validate", args="{NUMBER} --worktree {W}'
+printf '## Phase B6\n%s --files \\"{CHANGED_FILES}\\"")\n## Phase B6.5\n%s --files \\"{CHANGED_FILES}\\"")\n' "$V" "$V" > "$T/ok.md"
+check "all carry --files" 0 "$T/ok.md"
+printf '## Phase B6\n%s --files \\"x\\"")\n## Phase B6.5\n%s")\n' "$V" "$V" > "$T/bad1.md"
+check "one invocation lacks --files" 1 "$T/bad1.md"
+printf '## Phase B6\n%s --files \\"x\\"")\n## Phase B6.5\nfollowed by work-on:build:validate with the same args\n' "$V" > "$T/bad2.md"
+check "B6.5 has no explicit invocation" 1 "$T/bad2.md"
+printf 'nothing here\n' > "$T/bad3.md"
+check "no invocations at all" 1 "$T/bad3.md"
+check "real build.md" 0 "$HERE/../commands/work-on/build.md"
+echo "passed=$PASS failed=$FAILN"
+[ "$FAILN" -eq 0 ]

package/scripts/lint-dispatch-prompt.test.sh

@@ -229,7 +229,8 @@ check "mid-line CR not stripped" 1 "$T/p25"
 # 10. Spec snippet enforcement (forge#3070): extract the lint gate from the spec and run it in a loop.
 # Gate = from the bootstrap marker to the end of its fenced code block (not a hard-coded count of
 # top-level fi lines, which breaks whenever the bootstrap gains or loses a conditional).
-awk '/^# FORGE_ROOT bootstrap/{f=1} f&&/^```/{exit} f{print}' "$SPEC" > "$T/gate"
+# Several spec blocks carry the bootstrap marker (e.g. the recovery-claim gate, forge#3172); pick the one holding the lint gate.
+awk '/^# FORGE_ROOT bootstrap/{f=1;buf=""} f&&/^```/{if(buf ~ /LINT_REFUSED_ISSUES/){printf "%s",buf;exit} f=0} f{buf=buf $0 "\n"}' "$SPEC" > "$T/gate"
 [ -s "$T/gate" ] || { FAILN=$((FAILN+1)); echo "FAIL: could not extract spec lint gate"; }
 gate_refused() { # prompt-file home -> prints refusal entries or LAUNCHED
   ( LINT_REFUSED_ISSUES=(); RENDERED_PROMPT="$(cat "$1")"; FORGEDOCK_HOME="$2"; unset FORGE_HOME; reset_vals

package/scripts/recovery-claim-live.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# recovery-claim-live.sh — is an issue currently claimed by a /recover-orphans sweep?
+#
+# Single source of truth for the dispatcher-side check of FORGE:RECOVERY_CLAIM, used by
+# /work-on Phase 0B and /orchestrate Phase 4 so a dispatcher never re-enters an issue a sweep is
+# resuming. Same semantics as `claim_orphan` in commands/recover-orphans.md: a claim is LIVE when it
+# is an unreleased `<!-- FORGE:RECOVERY_CLAIM -->` comment, its `updated_at` is within
+# RECOVERY_CLAIM_TTL_MIN (default 30) minutes, and no `FORGE:RECOVERY_CLAIM_RELEASED` comment names
+# its sweep id. FORGE:HEARTBEAT is deliberately NOT counted: a dispatcher must not defer to another
+# dispatcher's heartbeat (that is the lease/claims-board job).
+#
+# Usage:
+#   recovery-claim-live.sh <issue> -R <owner/repo> [--exempt-sweep <sweep-id>]
+#
+#   --exempt-sweep  Ignore the claim held by this sweep id (the calling sweep's own claim), so the
+#                   holder's inline /work-on is not blocked by its own claim. A claim with no
+#                   parsable sweep id is never exempt (and `unknown` is rejected as an exemption id).
+#
+# Output (stdout): CLAIM: LIVE <sweep-id> | CLAIM: FREE | CLAIM: ERROR
+# Exit codes: 0 free, 1 live, 2 error (unreadable comments or usage; fails closed — callers must
+# treat 2 like "live" and defer, never like "free").
+#
+# Trust note: any commenter's claim marker counts (same as claim_orphan). A spoofed claim can only
+# defer an issue for RECOVERY_CLAIM_TTL_MIN unless it is refreshed.
+# END-HELP (`-h` prints the header up to this line; keep it last)
+
+set -uo pipefail
+
+ISSUE=""; REPO=""; EXEMPT=""
+err() { echo "CLAIM: ERROR"; echo "$1" >&2; exit 2; }
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -R|--repo)
+      [ $# -ge 2 ] && [ -n "${2:-}" ] || err "usage error: $1 needs a value"
+      REPO="$2"; shift 2 ;;
+    --exempt-sweep)
+      [ $# -ge 2 ] && [ -n "${2:-}" ] || err "usage error: $1 needs a value"
+      [ "$2" != "unknown" ] || err "usage error: --exempt-sweep 'unknown' is the no-sweep-id sentinel and cannot exempt a claim"
+      EXEMPT="$2"; shift 2 ;;
+    -h|--help) awk 'NR >= 5 { if (/^# END-HELP/) exit; print }' "$0"; exit 0 ;;
+    *)
+      if [ -z "$ISSUE" ] && [[ "$1" =~ ^[0-9]+$ ]]; then ISSUE="$1"; shift
+      else err "usage error: unexpected argument '$1'"; fi ;;
+  esac
+done
+[ -n "$ISSUE" ] && [ -n "$REPO" ] || err "usage: recovery-claim-live.sh <issue> -R <owner/repo> [--exempt-sweep <id>]"
+
+TTL="${RECOVERY_CLAIM_TTL_MIN:-30}"
+[[ "$TTL" =~ ^[0-9]+$ ]] || TTL=30
+CUTOFF=$(( $(date -u +%s) - TTL * 60 ))
+
+# pipefail: a gh failure (rate limit, 403) must not look like "no comments".
+COMMENTS=$(gh api --paginate "repos/${REPO}/issues/${ISSUE}/comments" 2>/dev/null | jq -s 'add // []') \
+  || err "could not read comments for #${ISSUE}"
+
+LIVE=$(echo "$COMMENTS" | jq -r --argjson cutoff "$CUTOFF" --arg exempt "$EXEMPT" '
+  def sweepid: ((.body | capture("Sweep: (?<id>[^ \n*]+)")?) // {id: "unknown"}).id;
+  # "unknown" is the no-id sentinel, never a matchable id: an unparsable release frees nothing (fail closed).
+  ([.[] | select(.body | contains("FORGE:RECOVERY_CLAIM_RELEASED")) | sweepid] | map(select(. != "unknown"))) as $rel
+  | [ .[] | select(.body | contains("<!-- FORGE:RECOVERY_CLAIM -->"))
+          | select((.body | contains("FORGE:RECOVERY_CLAIM_RELEASED")) | not)
+          | select(((.updated_at // "") | fromdateiso8601? // 9999999999) >= $cutoff)
+          | select(sweepid as $sid | ($rel | index($sid)) == null)
+          | select($exempt == "" or sweepid == "unknown" or sweepid != $exempt)
+          | sweepid ] | first // empty') \
+  || err "could not evaluate recovery claims for #${ISSUE}"
+
+if [ -n "$LIVE" ]; then echo "CLAIM: LIVE ${LIVE}"; exit 1; fi
+echo "CLAIM: FREE"; exit 0

package/scripts/recovery-claim-live.test.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# recovery-claim-live.test.sh — tests for scripts/recovery-claim-live.sh
+# No network: `gh` is mocked on PATH; MOCK_GH_JSON names a fixture holding the JSON array
+# `gh api .../comments` would return. MOCK_GH_FAIL=1 simulates an outage.
+#
+# Usage: bash scripts/recovery-claim-live.test.sh
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CHECK="$SCRIPT_DIR/recovery-claim-live.sh"
+TMP_BIN=$(mktemp -d); TMP_FX=$(mktemp -d)
+trap 'rm -rf "$TMP_BIN" "$TMP_FX"' EXIT
+
+cat > "$TMP_BIN/gh" <<'MOCK'
+#!/usr/bin/env bash
+if [ "${MOCK_GH_FAIL:-}" = "1" ]; then echo "mock gh: outage" >&2; exit 1; fi
+cat "$MOCK_GH_JSON"
+MOCK
+chmod +x "$TMP_BIN/gh"
+export PATH="$TMP_BIN:$PATH"
+
+PASS=0; FAILN=0
+ok()  { PASS=$((PASS+1)); echo "ok   - $1"; }
+bad() { FAILN=$((FAILN+1)); echo "FAIL - $1"; }
+
+now_iso()  { date -u +%Y-%m-%dT%H:%M:%SZ; }
+old_iso()  { date -u -d '2 hours ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-2H +%Y-%m-%dT%H:%M:%SZ; }
+
+# fx <name> <json-array>
+fx() { echo "$2" > "$TMP_FX/$1.json"; echo "$TMP_FX/$1.json"; }
+claim()   { jq -cn --arg id "$1" --arg t "$2" '{body:("<!-- FORGE:RECOVERY_CLAIM -->\n**Sweep: "+$id+"**\nHolder: /recover-orphans"), updated_at:$t}'; }
+release() { jq -cn --arg id "$1" --arg t "$2" '{body:("<!-- FORGE:RECOVERY_CLAIM_RELEASED -->\n**Sweep: "+$id+"**\nReleased"), updated_at:$t}'; }
+
+run() { local f="$1"; shift; OUT=$(MOCK_GH_JSON="$f" bash "$CHECK" 7 -R o/r "$@" 2>/dev/null); RC=$?; }
+expect() { # name rc needle
+  [ "$RC" -eq "$2" ] && echo "$OUT" | grep -q "$3" && ok "$1" || bad "$1 (rc=$RC out=$OUT)"
+}
+
+N=$(now_iso); O=$(old_iso)
+
+run "$(fx live "[$(claim sweep-A "$N")]")";                      expect "fresh claim is LIVE" 1 "CLAIM: LIVE sweep-A"
+run "$(fx exp "[$(claim sweep-A "$O")]")";                       expect "expired claim is FREE" 0 "CLAIM: FREE"
+run "$(fx rel "[$(claim sweep-A "$N"), $(release sweep-A "$N")]")"; expect "released claim is FREE" 0 "CLAIM: FREE"
+run "$(fx relother "[$(claim sweep-A "$N"), $(release sweep-B "$N")]")"; expect "release of another sweep does not free the claim" 1 "CLAIM: LIVE sweep-A"
+run "$(fx unkrel "[{\"body\":\"<!-- FORGE:RECOVERY_CLAIM -->\\nno sweep line\",\"updated_at\":\"$N\"}, {\"body\":\"<!-- FORGE:RECOVERY_CLAIM_RELEASED -->\\nno sweep line\",\"updated_at\":\"$N\"}]")"; expect "release with no sweep id does not free an id-less claim" 1 "CLAIM: LIVE unknown"
+run "$(fx own "[$(claim sweep-A "$N")]")" --exempt-sweep sweep-A; expect "own sweep id is exempt" 0 "CLAIM: FREE"
+run "$(fx other "[$(claim sweep-A "$N")]")" --exempt-sweep sweep-B; expect "other sweep id is not exempt" 1 "CLAIM: LIVE sweep-A"
+run "$(fx two "[$(claim sweep-A "$N"), $(claim sweep-B "$N")]")" --exempt-sweep sweep-A; expect "exempting A still sees live B" 1 "CLAIM: LIVE sweep-B"
+run "$(fx unk "[{\"body\":\"<!-- FORGE:RECOVERY_CLAIM -->\\nno sweep line\",\"updated_at\":\"$N\"}]")" --exempt-sweep sweep-A; expect "claim with no sweep id is never exempt" 1 "CLAIM: LIVE"
+run "$(fx unk2 "[{\"body\":\"<!-- FORGE:RECOVERY_CLAIM -->\\nno sweep line\",\"updated_at\":\"$N\"}]")" --exempt-sweep unknown; expect "--exempt-sweep unknown is rejected" 2 "CLAIM: ERROR"
+run "$(fx none '[]')";                                            expect "no comments is FREE" 0 "CLAIM: FREE"
+run "$(fx hb "[{\"body\":\"<!-- FORGE:HEARTBEAT -->\\nPhase 3\",\"updated_at\":\"$N\"}]")"; expect "heartbeat alone is not a recovery claim" 0 "CLAIM: FREE"
+run "$(fx bad "[{\"body\":\"<!-- FORGE:RECOVERY_CLAIM -->\\nno sweep line\",\"updated_at\":\"$N\"}]")"; expect "malformed claim fails closed (LIVE)" 1 "CLAIM: LIVE"
+run "$(fx nodate "[{\"body\":\"<!-- FORGE:RECOVERY_CLAIM -->\\n**Sweep: sweep-A**\",\"updated_at\":\"garbage\"}]")"; expect "unparsable updated_at fails closed (LIVE)" 1 "CLAIM: LIVE"
+
+OUT=$(MOCK_GH_FAIL=1 MOCK_GH_JSON=/dev/null bash "$CHECK" 7 -R o/r 2>/dev/null); RC=$?
+expect "gh outage is ERROR (exit 2)" 2 "CLAIM: ERROR"
+OUT=$(MOCK_GH_JSON="$(fx junk 'not json')" bash "$CHECK" 7 -R o/r 2>/dev/null); RC=$?
+expect "unparsable response is ERROR (exit 2)" 2 "CLAIM: ERROR"
+OUT=$(bash "$CHECK" 2>/dev/null); RC=$?;                          expect "no args is a usage error" 2 "CLAIM: ERROR"
+OUT=$(bash "$CHECK" 7 -R 2>/dev/null); RC=$?;                     expect "-R without value is a usage error" 2 "CLAIM: ERROR"
+
+echo "passed=$PASS failed=$FAILN"
+[ "$FAILN" -eq 0 ]