rulereceipt 0.1.53 → 0.1.54

package/dist/checks/claimEvidence.js

@@ -48,7 +48,10 @@ const SUCCESS_CLAIM = /\b(?:all\s+)?(?:the\s+)?tests?(?:\s+suite)?\s+(?:are|is|n
  * sits in, not the whole message — a paragraph that says "one is failing"
  * elsewhere should not excuse a false claim made in its own sentence.
  */
-const NOT_A_CLAIM = /(?:\b(?:if|unless|once|when|after|before|until|should|would|will|going to|i'?ll|let'?s|need to|make sure|ensure|hope|expect|check (?:if|whether)|verify (?:that|if)|not|cannot|fail(?:s|ing|ed)?|red|broken)\b|\w+n['\u2019]t\b)/i;
+// `getting`/`means`/`goal` added 2026-09-26: "Getting tests passing is the
+// last step" and "All tests passing means the refactor is complete" are goal
+// framings, not a report that the tests currently pass (finding #5).
+const NOT_A_CLAIM = /(?:\b(?:if|unless|once|when|after|before|until|should|would|will|going to|i'?ll|let'?s|need to|make sure|ensure|hope|expect|check (?:if|whether)|verify (?:that|if)|not|cannot|getting|means|goal|fail(?:s|ing|ed)?|red|broken)\b|\w+n['\u2019]t\b)/i;
 /**
  * Actions the session can claim to have performed, and the command that
  * would prove it.
@@ -77,7 +80,10 @@ const ACTION_CLAIMS = [
     {
         label: "git push",
         claim: /\b(?:i|we)(?:'ve|\u2019ve| have| had)?\s+(?:\w+ly\s+|just\s+|already\s+|then\s+|also\s+|now\s+)*pushed\b/i,
-        exclude: /\bpushed\s+(?:back|for|through|forward|ahead|past|the\s+boundar)/i,
+        // Idioms that borrow "pushed" but aren't a git push. "pushed the fix/code/
+        // changes/branch to <remote>" stays a claim; effort/figurative senses do
+        // not (finding #6, 2026-09-26).
+        exclude: /\bpushed\s+(?:back|for|through|forward|ahead|past|hard|on|myself|ourselves|yourself|themselves|the\s+(?:boundar|button|envelope|limit|deadline|pace)|to\s+(?:get|finish|complete|ship|meet|hit|make|wrap|move))/i,
         command: /\bgit\s+push\b/i,
     },
     {
@@ -111,7 +117,11 @@ const ACTION_CLAIMS = [
          * something else entirely is still beyond it.
          */
         label: "read of a source",
-        claim: /\b(?:i|we)(?:'ve|’ve| have| had)?\s+(?:\w+ly\s+|just\s+|already\s+|then\s+|also\s+|now\s+)*read\b|^\s*(?:pages?\s+read|status)\s*:\s*(?:[\d\s,-]+|read\s+in\s+full)|\bread\s+in\s+full\b|\bconfirmed\s+at\s+source\b/im,
+        // A bare "status" header no longer counts on digits alone — "Status: 3 of
+        // 5 tasks done" / "STATUS: 200" are ordinary status lines, not a claim of
+        // having read a source (finding #7, 2026-09-26). "PAGES READ: <n>" and
+        // "STATUS: READ IN FULL" are the real provenance forms and still count.
+        claim: /\b(?:i|we)(?:'ve|’ve| have| had)?\s+(?:\w+ly\s+|just\s+|already\s+|then\s+|also\s+|now\s+)*read\b|^\s*pages?\s+read\s*:\s*(?:[\d\s,-]+|read\s+in\s+full)|^\s*status\s*:\s*read\s+in\s+full|\bread\s+in\s+full\b|\bconfirmed\s+at\s+source\b/im,
         exclude: /\b(?:will|going\s+to|need\s+to|should|next|plan\s+to|about\s+to|let\s+me|i'?ll|we'?ll)\s+(?:\w+\s+){0,3}read\b/i,
         command: /\b(?:cat|head|tail|less|more|bat|nl|strings|pdftotext|xxd|od)\b/i,
     },
@@ -216,6 +226,22 @@ function unclear(rule, evidence) {
         evidence,
     };
 }
+/**
+ * A run of the WHOLE suite, not a subset. A scoped run names a file/path or a
+ * `-- <filter>` positional. Used so a subset pass (`npm test -- frontend`)
+ * does not clear an earlier failure of a different scope (`… -- backend`) — a
+ * broad "all passing" claim over a partial re-run is unbacked, not proven
+ * (finding #8, 2026-09-26).
+ */
+function isFullSuiteRun(command) {
+    if (/\s--\s+[^\s-]/.test(command))
+        return false;
+    if (/\b(?:pytest|jest|vitest|mocha|phpunit|rspec)\s+[^\s-]\S*\.\w+/.test(command))
+        return false;
+    if (/\s\S*\.(?:test|spec)\.\w+/.test(command))
+        return false;
+    return true;
+}
 /**
  * Walks the session in order, tracking the state of the last test run, and
  * tests every assistant claim against the state at the moment it was made.
@@ -240,6 +266,10 @@ export function runClaimEvidenceChecks(classifications, events) {
     let uncertain = null;
     let unreadable = null;
     let backed = null;
+    // A failing run whose failure has NOT been cleared by a full-suite (or
+    // same-scope) passing re-run. A subset pass afterward leaves this standing.
+    let unresolvedFailure = null;
+    let partialPass = null;
     for (const event of events) {
         // A read through Read/Grep/Glob never reaches the shell, so it has to be
         // recorded here rather than by matching command text.
@@ -293,6 +323,15 @@ export function runClaimEvidenceChecks(classifications, events) {
                 };
                 pendingRuns.delete(resultId);
                 unknownSinceRed = null; // a recognised run supersedes anything before it
+                // Track whether a failure is still standing. A full-suite (or
+                // same-command) pass clears it; a subset pass does not.
+                if (lastRun.outcomeReadable && lastRun.failed) {
+                    unresolvedFailure = pendingRun;
+                }
+                else if (lastRun.outcomeReadable && !lastRun.failed && unresolvedFailure !== null) {
+                    if (isFullSuiteRun(pendingRun) || pendingRun === unresolvedFailure)
+                        unresolvedFailure = null;
+                }
             }
             continue;
         }
@@ -340,6 +379,12 @@ export function runClaimEvidenceChecks(classifications, events) {
             else if (lastRun.failed && contradiction === null) {
                 contradiction = { claim: sentence.trim(), run: lastRun };
             }
+            else if (!lastRun.failed && unresolvedFailure !== null && partialPass === null) {
+                // The last run passed, but it was a subset — an earlier failure of a
+                // different scope was never re-verified. Can't back a broad claim from
+                // a partial pass, and can't accuse either. Report the gap.
+                partialPass = { claim: sentence.trim(), failing: unresolvedFailure };
+            }
             else if (!lastRun.failed && backed === null) {
                 backed = { claim: sentence.trim(), run: lastRun };
             }
@@ -367,6 +412,10 @@ export function runClaimEvidenceChecks(classifications, events) {
             return unclear(rule, `the session stated: "${uncertain.claim}" after a failing test run, but \`${uncertain.script}\` ` +
                 `ran in between and this tool cannot tell whether that re-ran the suite — a human has to look`);
         }
+        if (partialPass && !contradiction) {
+            return unclear(rule, `the session stated: "${partialPass.claim}", but the earlier failing run \`${short(partialPass.failing)}\` ` +
+                `was only re-run in part — no full-suite pass covered it, so this claim isn't backed (nor disproven) here`);
+        }
         if (contradiction) {
             return {
                 ruleId: rule.id,

package/dist/checks/codeContent.js

@@ -55,7 +55,11 @@ function containsCall(content, pattern) {
         if (at === -1)
             return false;
         const before = at === 0 ? "" : content[at - 1];
-        if (!/[A-Za-z0-9_$.]/.test(before))
+        // A `.` before the pattern is a member-access SEPARATOR, not identifier
+        // continuation — `analytics.track(` is a real call to `track(`. So `.` is
+        // NOT in the disqualifying class (fixed 2026-09-26); `_` still is, so
+        // `_metar_fetch(` does not match `fetch(`.
+        if (!/[A-Za-z0-9_$]/.test(before))
             return true;
         from = at + 1;
     }

package/dist/checks/deterministicChecks.js

@@ -1,3 +1,39 @@
+import { segments, leadingCommand, withoutCommitMessage } from "./shellCommand.js";
+/**
+ * Commands that only READ/print/search their arguments — a required pattern
+ * appearing as an argument to one of these is being mentioned, not run.
+ */
+const MENTION_ONLY_CMDS = new Set([
+    "grep", "rg", "ag", "ack", "egrep", "fgrep", "echo", "printf", "cat", "bat",
+    "head", "tail", "less", "more", "ls", "find", "fd", "jq", "yq", "cut", "tr",
+    "sort", "uniq", "diff", "comm", "wc", "which", "type", "file", "stat", "man",
+]);
+/**
+ * Does this event actually PERFORM the required pattern, rather than mention
+ * it? A required action reported satisfied on a mention (assistant text, a
+ * grep/echo, a commit-message reference) is the mirror of the forbid path's
+ * mention-vs-action confusion, and it PASSes a rule that was never followed
+ * (finding 2026-09-26). Text and tool_result never count; a Bash command
+ * counts only when the pattern sits in a segment that is actually executed.
+ */
+function requirePerformedBy(event, pattern) {
+    if (event.kind !== "tool_use")
+        return false;
+    if (event.toolName === "Bash") {
+        const input = event.input;
+        const command = input && typeof input.command === "string" ? input.command : "";
+        for (const seg of segments(command)) {
+            if (MENTION_ONLY_CMDS.has(leadingCommand(seg)))
+                continue;
+            if (matchesPattern(canonicalise(withoutCommitMessage(seg)), pattern))
+                return true;
+        }
+        return false;
+    }
+    // A non-Bash tool_use (Write/Edit/…) that carries the pattern in its input
+    // genuinely produced it (e.g. `Closes #N` written into a PR body).
+    return matchesPattern(searchHaystack(event), pattern);
+}
 /**
  * Real false-positive found 2026-08-30 on an actual complex session: a
  * "no debug print() statements" rule failed because the agent ran a grep
@@ -174,14 +210,30 @@ export function runDeterministicChecks(classifications, events) {
             // distinguish "should have run this and didn't" from "this session
             // never needed to" — so a required-but-absent pattern reports
             // UNCLEAR, never a fabricated FAIL or a fabricated PASS.
-            if (foundEvent && foundPattern) {
-                const haystack = eventSearchText(foundEvent);
+            // A match is only a PASS when the pattern was actually PERFORMED, not
+            // merely mentioned (in assistant text, a grep/echo, or a commit
+            // message) — otherwise a required action reads as done when it wasn't.
+            let performedEvent;
+            let performedPattern;
+            for (const event of events) {
+                for (const pattern of patterns) {
+                    if (requirePerformedBy(event, pattern)) {
+                        performedEvent = event;
+                        performedPattern = pattern;
+                        break;
+                    }
+                }
+                if (performedEvent)
+                    break;
+            }
+            if (performedEvent && performedPattern) {
+                const haystack = eventSearchText(performedEvent);
                 return {
                     ruleId: rule.id,
                     ruleTitle: rule.title,
                     ruleSource: rule.source,
                     status: "PASS",
-                    evidence: `found required pattern "${foundPattern}" in a ${foundEvent.kind === "tool_use" ? foundEvent.toolName + " call" : foundEvent.kind}: ${haystack.slice(0, 160)}`,
+                    evidence: `found required pattern "${performedPattern}" in a ${performedEvent.kind === "tool_use" ? performedEvent.toolName + " call" : performedEvent.kind}: ${haystack.slice(0, 160)}`,
                 };
             }
             return {
@@ -189,7 +241,7 @@ export function runDeterministicChecks(classifications, events) {
                 ruleTitle: rule.title,
                 ruleSource: rule.source,
                 status: "UNCLEAR",
-                evidence: `required pattern ${patterns.map((p) => `"${p}"`).join(" or ")} never appeared this session — can't tell if the rule didn't apply, or applied and was skipped`,
+                evidence: `required pattern ${patterns.map((p) => `"${p}"`).join(" or ")} was not actually run this session — can't tell if the rule didn't apply, or applied and was skipped`,
             };
         }
         catch (err) {

package/dist/checks/emojiOutput.js

@@ -30,27 +30,46 @@ import { violation } from "../types.js";
 const DEFAULT_EMOJI = /\p{Emoji_Presentation}/u;
 const PICTOGRAPHIC = /\p{Extended_Pictographic}/u;
 const REGIONAL_INDICATOR = /[\u{1F1E6}-\u{1F1FF}]/u;
-const KEYCAP = /[0-9#*]\u{FE0F}?\u{20E3}/u;
 const VARIATION_SELECTOR_16 = "\u{FE0F}";
-/** Every distinct emoji in a string, in order of first appearance. */
+const KEYCAP_BASE = /[0-9#*]/;
+const COMBINING_KEYCAP = "\u{20E3}";
+/**
+ * Every distinct emoji in a string, in TRUE order of first appearance.
+ *
+ * The keycap sequence ([0-9#*] + optional FE0F + 20E3) is detected in the
+ * scan loop at its real position. It used to be unshifted to the FRONT of the
+ * list regardless of where it sat, so the evidence named the wrong "first"
+ * emoji and anchored its excerpt on it (finding #9, 2026-09-26).
+ */
 function emojiIn(text) {
     const found = [];
     const chars = [...text];
-    if (KEYCAP.test(text)) {
-        const m = text.match(KEYCAP);
-        if (m)
-            found.push(m[0]);
-    }
+    const add = (glyph) => {
+        if (!found.includes(glyph))
+            found.push(glyph);
+    };
     for (let i = 0; i < chars.length; i++) {
         const ch = chars[i];
+        // Keycap first: it starts on an ordinary digit/#/* that the emoji tests
+        // below would not catch on its own.
+        if (KEYCAP_BASE.test(ch)) {
+            if (chars[i + 1] === COMBINING_KEYCAP) {
+                add(ch + chars[i + 1]);
+                i += 1;
+                continue;
+            }
+            if (chars[i + 1] === VARIATION_SELECTOR_16 && chars[i + 2] === COMBINING_KEYCAP) {
+                add(ch + chars[i + 1] + chars[i + 2]);
+                i += 2;
+                continue;
+            }
+        }
         const isEmoji = DEFAULT_EMOJI.test(ch) ||
             REGIONAL_INDICATOR.test(ch) ||
             (PICTOGRAPHIC.test(ch) && chars[i + 1] === VARIATION_SELECTOR_16);
         if (!isEmoji)
             continue;
-        const glyph = chars[i + 1] === VARIATION_SELECTOR_16 ? ch + chars[i + 1] : ch;
-        if (!found.includes(glyph))
-            found.push(glyph);
+        add(chars[i + 1] === VARIATION_SELECTOR_16 ? ch + chars[i + 1] : ch);
     }
     return found;
 }

package/dist/checks/fileLifecycle.js

@@ -1,6 +1,6 @@
 import { violation } from "../types.js";
 import { isProjectPath } from "./projectPaths.js";
-import { withoutHeredocs } from "./shellCommand.js";
+import { segments, leadingCommand, withoutCommitMessage } from "./shellCommand.js";
 /**
  * Third structured-check primitive: only counts real MUTATIONS of a
  * protected file, never reads of it. Real false-positive this fixes
@@ -54,21 +54,35 @@ const CD_INTO_TEMP = /\bcd\s+["']?(?:\/private)?\/(?:tmp|var\/folders)\b|\bcd\s+
  * path into a file is not mutating that path.
  */
 function mutatesPathInBash(rawCommand, filePath) {
-    const command = withoutHeredocs(rawCommand);
     const p = pathPattern(filePath);
-    const mutations = [
-        // rm / rmdir / unlink targeting the path
-        new RegExp(`\\b(?:rm|rmdir|unlink)\\b[^|;&]*${p}`),
-        // mv / cp writing ONTO the path (path appears as the final argument)
-        new RegExp(`\\b(?:mv|cp)\\b[^|;&]*${p}\\s*(?:$|[;&|])`),
-        // truncation or append redirect onto the path
-        new RegExp(`>>?\\s*['"]?${escapeRegex(filePath.replace(/^\.\//, ""))}`),
-        // in-place edits
-        new RegExp(`\\bsed\\b[^|;&]*-i[^|;&]*${p}`),
-        new RegExp(`\\btee\\b[^|;&]*${p}`),
-        new RegExp(`\\btruncate\\b[^|;&]*${p}`),
-    ];
-    return mutations.some((re) => re.test(command));
+    const bare = escapeRegex(filePath.replace(/^\.\//, ""));
+    // A truncation/append redirect onto the path, with a trailing path boundary
+    // so `> CHANGELOG.md.new` does NOT count as touching `CHANGELOG.md` (#9).
+    const redirect = new RegExp(`>>?\\s*['"]?${bare}(?=$|[\\s'";)])`);
+    // sed only mutates with an in-place flag; matched as a real flag, not a bare
+    // "-i" substring that can sit inside a replacement like `s/api-id/…/` (#10).
+    const sedInPlace = /(?:^|\s)sed\b[^|;&]*\s(?:--in-place\b|-[A-Za-z]*i\b)/;
+    // Reason per SEGMENT: the mutating verb must be the segment's own leading
+    // command, so a path named inside a commit message, an echoed string, or
+    // another command's argument is not read as a mutation (#2). Heredoc bodies
+    // are already stripped by `segments`.
+    for (const raw of segments(rawCommand)) {
+        const seg = withoutCommitMessage(raw);
+        if (redirect.test(seg))
+            return true;
+        const exe = leadingCommand(seg);
+        if ((exe === "rm" || exe === "rmdir" || exe === "unlink") && new RegExp(`\\b(?:rm|rmdir|unlink)\\b[^|;&]*${p}`).test(seg))
+            return true;
+        if ((exe === "mv" || exe === "cp") && new RegExp(`\\b(?:mv|cp)\\b[^|;&]*${p}\\s*$`).test(seg))
+            return true;
+        if (exe === "tee" && new RegExp(`\\btee\\b[^|;&]*${p}`).test(seg))
+            return true;
+        if (exe === "truncate" && new RegExp(`\\btruncate\\b[^|;&]*${p}`).test(seg))
+            return true;
+        if (exe === "sed" && sedInPlace.test(seg) && new RegExp(p).test(seg))
+            return true;
+    }
+    return false;
 }
 function findMutation(events, filePath) {
     const normalized = filePath.replace(/^\.\//, "");

package/dist/checks/gitBranchPolicy.js

@@ -1,4 +1,5 @@
 import { violation } from "../types.js";
+import { segments, leadingCommand } from "./shellCommand.js";
 /**
  * First real structured-check primitive: parses actual git command
  * arguments instead of searching prose for a branch name as a substring.
@@ -28,18 +29,88 @@ import { violation } from "../types.js";
 // becomes a real violation if a commit follows it — see
 // findCheckoutCommitViolation.
 const GIT_CHECKOUT_CREATE = /\bgit\s+(?:checkout\s+-[bB]|switch\s+-c)\s+([^\s-][^\s]*)/;
-const GIT_CHECKOUT_SWITCH_ONLY = /\bgit\s+(?:checkout|switch)\s+(?:--\s+)?([^\s-][^\s]*)/;
-const GIT_BRANCH_CREATE = /\bgit\s+branch\s+(?:-[a-zA-Z]+\s+)?([^\s-][^\s]*)/;
-const GIT_PUSH = /\bgit\s+push\s+(?:\S+\s+)?(?:\+)?(?:[^\s:]+:)?([^\s:]+)\s*$/;
+// A bare switch to an existing branch. NOTE: no `(?:--\s+)?` here — `git
+// checkout -- <path>` restores a FILE (the `--` means "pathspec, not ref"),
+// and reading that path as a branch caused a false FAIL when a file shared the
+// protected branch's name (finding 2026-09-26).
+const GIT_CHECKOUT_SWITCH_ONLY = /\bgit\s+(?:checkout|switch)\s+([^\s-][^\s]*)/;
 const GIT_COMMIT = /\bgit\s+commit\b/;
-function extractGitBranchTargets(command) {
-    const targets = [];
-    for (const regex of [GIT_CHECKOUT_CREATE, GIT_CHECKOUT_SWITCH_ONLY, GIT_BRANCH_CREATE, GIT_PUSH]) {
-        const match = command.match(regex);
-        if (match)
-            targets.push(match[1]);
+// Locates the args after a `git … push`, allowing config flags between `git`
+// and `push` (`git -c x=y push …`), the same shape as the other detectors.
+const GIT_PUSH_ARGS = /\bgit\s+(?:\S+\s+){0,4}?push(?![\w-])\s*(.*)$/;
+const GIT_BRANCH_ARGS = /\bgit\s+(?:\S+\s+){0,4}?branch(?![\w-])\s*(.*)$/;
+/**
+ * The branch(es) a `git push` actually writes to. Parses the args instead of
+ * a single end-anchored regex, so it catches every real form the old GIT_PUSH
+ * missed: force-push, `-u`, a flag AFTER the branch, `--force-with-lease`, a
+ * remote-branch delete (`origin :main`, `origin --delete main`), and a
+ * `local:remote` refspec (the TARGET is the remote side).
+ */
+function pushTargets(command) {
+    const out = [];
+    for (const seg of segments(command)) {
+        if (leadingCommand(seg) !== "git")
+            continue;
+        const m = seg.match(GIT_PUSH_ARGS);
+        if (!m || m[1].trim().length === 0)
+            continue; // bare `git push`: branch unknown
+        const tokens = m[1].trim().split(/\s+/).filter(Boolean);
+        const positionals = tokens.filter((t) => !t.startsWith("-"));
+        // First positional is the remote; every later one is a refspec.
+        for (const ref of positionals.slice(1)) {
+            const spec = ref.replace(/^\+/, ""); // `+local:remote` force refspec
+            const colon = spec.indexOf(":");
+            const target = colon >= 0 ? spec.slice(colon + 1) : spec; // remote side
+            if (target.length > 0)
+                out.push(target);
+        }
     }
-    return targets;
+    return out;
+}
+/**
+ * The branch(es) a `git branch` command creates, deletes, or renames INTO.
+ * `-m/-M/--move <old> <new>` targets the NEW name (last positional — a rename
+ * into `main` overwrites `main`); `-d/-D/--delete` targets every named branch;
+ * a plain `git branch <name> [<start>]` targets only the created <name>.
+ */
+function branchTargets(command) {
+    const out = [];
+    for (const seg of segments(command)) {
+        if (leadingCommand(seg) !== "git")
+            continue;
+        const m = seg.match(GIT_BRANCH_ARGS);
+        if (!m || m[1].trim().length === 0)
+            continue;
+        const tokens = m[1].trim().split(/\s+/).filter(Boolean);
+        const flags = tokens.filter((t) => t.startsWith("-"));
+        const positionals = tokens.filter((t) => !t.startsWith("-"));
+        if (positionals.length === 0)
+            continue;
+        if (flags.some((f) => /^(?:--move|-m|-M)$/.test(f))) {
+            out.push(positionals[positionals.length - 1]);
+        }
+        else if (flags.some((f) => /^(?:--delete|-d|-D)$/.test(f))) {
+            out.push(...positionals);
+        }
+        else {
+            out.push(positionals[0]);
+        }
+    }
+    return out;
+}
+function extractGitBranchTargets(command) {
+    const hits = [];
+    const create = command.match(GIT_CHECKOUT_CREATE);
+    if (create)
+        hits.push({ branch: create[1], kind: "create" });
+    const switchOnly = command.match(GIT_CHECKOUT_SWITCH_ONLY);
+    if (switchOnly)
+        hits.push({ branch: switchOnly[1], kind: "switch" });
+    for (const b of branchTargets(command))
+        hits.push({ branch: b, kind: "create" });
+    for (const b of pushTargets(command))
+        hits.push({ branch: b, kind: "push" });
+    return hits;
 }
 function commandFromEvent(event) {
     if (event.kind !== "tool_use" || event.toolName !== "Bash")
@@ -83,8 +154,8 @@ export function runGitBranchPolicyChecks(classifications, events) {
         if (!command)
             continue;
         commands.push(command);
-        for (const branch of extractGitBranchTargets(command)) {
-            allTargets.push({ branch, command });
+        for (const hit of extractGitBranchTargets(command)) {
+            allTargets.push({ branch: hit.branch, command, kind: hit.kind });
         }
     }
     const anyGitCommand = events.some((e) => e.kind === "tool_use" && /\bgit\s/.test(JSON.stringify(e.input ?? "")));
@@ -103,8 +174,9 @@ export function runGitBranchPolicyChecks(classifications, events) {
                 evidence: "no git command ran this session, so this rule never applied",
             };
         }
-        const pushOrCreateHit = allTargets.find((t) => t.branch === branchName &&
-            (GIT_PUSH.test(t.command) || GIT_BRANCH_CREATE.test(t.command) || GIT_CHECKOUT_CREATE.test(t.command)));
+        // Push, branch-create/delete/rename, and checkout -b are immediate hits.
+        // A bare `switch` is not — it only violates if a commit follows (below).
+        const pushOrCreateHit = allTargets.find((t) => t.branch === branchName && (t.kind === "push" || t.kind === "create"));
         const commitViolationCommand = findCheckoutCommitViolation(commands, branchName);
         const hit = pushOrCreateHit ?? (commitViolationCommand ? { branch: branchName, command: commitViolationCommand } : undefined);
         if (polarity === "forbid") {

package/dist/checks/ifEditThenTest.js

@@ -1,6 +1,12 @@
 import { findTestRun } from "./testCommands.js";
 import { isProjectPath } from "./projectPaths.js";
-const TEST_FILE_PATTERN = /(\.test\.|\.spec\.|__tests__\/|_test\.|\/tests?\/)/i;
+// Test-file conventions across ecosystems: JS `.test.`/`.spec.`, Go/Python
+// `_test.`, `__tests__/` and `/tests/` dirs, RSpec `_spec.`/`/spec/`, and
+// pytest's `test_*.py` (a `test_` prefix at a path boundary, so a prod file
+// with "test" mid-name like `latest_data.py` is not swept in). Added
+// pytest/RSpec 2026-09-26 — they were missing, so idiomatic Python/Ruby test
+// files read as "no test touched".
+const TEST_FILE_PATTERN = /(\.test\.|\.spec\.|_spec\.|__tests__\/|_test\.|(?:^|\/)test_|\/tests?\/|\/spec\/)/i;
 // Real false-positive found 2026-08-30 on an actual session: editing a
 // markdown documentation file flagged "no test file touched" four
 // separate times — but a doc/config file was never going to have a test

package/dist/checks/proposedAction.js

@@ -1,4 +1,4 @@
-import { withoutHeredocs } from "./shellCommand.js";
+import { segments, leadingCommand, withoutCommitMessage } from "./shellCommand.js";
 import { canonicalise, matchesPattern } from "./deterministicChecks.js";
 /**
  * Commands that read. A banned literal appearing as an argument to one of
@@ -22,40 +22,26 @@ const READ_ONLY = new Set([
     "awk", "jq", "yq", "cut", "tr", "column", "tee",
     "which", "type", "file", "stat", "man", "help",
 ]);
-/** Read-only git subcommands — `git log` cannot delete anything. */
-const READ_ONLY_GIT = new Set(["log", "show", "diff", "status", "blame", "describe", "config", "remote", "branch", "tag", "ls-files", "rev-parse", "shortlog"]);
 /**
- * Splits a shell command into the pieces that run separately.
+ * Genuinely read-only git subcommands — `git log` cannot delete anything.
  *
- * Crude by design: this is not a shell parser and must never pretend to be
- * one. It exists so that `grep "rm -rf" notes.txt && npm run build` is read
- * as two things, one of which searches for a string and one of which does
- * not, rather than as one blob containing a banned literal.
+ * `branch`, `config`, `remote`, `tag` were removed 2026-09-26: each has a
+ * common MUTATING form (`git branch -D`, `git config user.email x`, `git
+ * remote set-url`, `git tag -f`) that the guard must be able to check, and a
+ * bare-flag literal (`-D`, `--force`) slipped past the old escape hatch.
  */
-function segments(command) {
-    return withoutHeredocs(command)
-        .split(/\n|&&|\|\||[;|]/)
-        .map((s) => s.trim())
-        .filter((s) => s.length > 0);
-}
-/** The executable a segment invokes, with env assignments and `sudo` skipped. */
-function leadingCommand(segment) {
-    const words = segment.split(/\s+/).filter(Boolean);
-    let i = 0;
-    while (i < words.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]) || words[i] === "sudo" || words[i] === "command" || words[i] === "time"))
-        i++;
-    const exe = (words[i] ?? "").replace(/^.*\//, "");
-    return exe;
-}
+const READ_ONLY_GIT = new Set(["log", "show", "diff", "status", "blame", "describe", "ls-files", "rev-parse", "shortlog"]);
 /**
- * A commit message is text the user wrote, not a command being run.
- *
- * Real case in this project's own history: a commit message containing
- * backticked shell examples. A message that quotes a banned command in order
- * to describe it must not be treated as running it.
+ * A normally-read-only command that, in this segment, actually EXECUTES or
+ * DELETES: `find … -exec/-execdir/-delete`, `awk 'BEGIN{system("…")}'`.
+ * Without this, a destructive command wrapped in one was read as harmless.
  */
-function withoutCommitMessage(segment) {
-    return segment.replace(/(-m|--message)(=|\s+)(['"])(?:\\.|(?!\3)[\s\S])*\3/g, "$1 <message>");
+function readOnlyCommandActuallyRuns(exe, segment) {
+    if (exe === "find" && /\s-(?:exec(?:dir)?|delete)\b/.test(segment))
+        return true;
+    if (exe === "awk" && /\bsystem\s*\(/.test(segment))
+        return true;
+    return false;
 }
 /**
  * Does this segment actually DO the forbidden thing?
@@ -64,9 +50,11 @@ function withoutCommitMessage(segment) {
  */
 function segmentRunsLiteral(segment, literal) {
     const exe = leadingCommand(segment);
-    if (READ_ONLY.has(exe))
+    if (READ_ONLY.has(exe) && !readOnlyCommandActuallyRuns(exe, segment))
         return false;
-    if (exe === "sed" && !/\s-[A-Za-z]*i\b/.test(segment))
+    // Plain `sed` prints to stdout; only an in-place edit mutates. Both the
+    // short `-i`/`-i.bak` and the long `--in-place` spellings count.
+    if (exe === "sed" && !/\s--in-place\b|\s-[A-Za-z]*i\b/.test(segment))
         return false;
     if (exe === "git") {
         const sub = segment.split(/\s+/).filter(Boolean)[1] ?? "";

package/dist/checks/shellCommand.d.ts

@@ -22,3 +22,25 @@
  * heredoc that set the fixture up.
  */
 export declare function withoutHeredocs(command: string): string;
+/**
+ * Splits a shell command into the pieces that run separately.
+ *
+ * Crude by design — not a shell parser. Heredoc bodies are stripped first, so
+ * a command that only WRITES another command is not split into it. Shared by
+ * every checker that needs to reason about what a compound command actually
+ * runs (proposedAction, attribution).
+ */
+export declare function segments(command: string): string[];
+/** The executable a segment invokes, with env assignments and `sudo` skipped. */
+export declare function leadingCommand(segment: string): string;
+/**
+ * Blanks out a git/gh commit or PR MESSAGE, leaving the command around it.
+ *
+ * A `-m "…"` / `--message "…"` value is text the author wrote, not a command
+ * being run, and not a path being touched — a message that quotes `rm …` or
+ * names a protected file must not be read as doing either. Shared so every
+ * checker that scans a Bash command string strips it the same way (this was
+ * present only in proposedAction, so fileLifecycle and testCommands each
+ * false-matched on commit-message text — findings 2026-09-26).
+ */
+export declare function withoutCommitMessage(command: string): string;