fix(shell): remove runtime early-exit pipe hazards

scripts/analysis/reflect-board-history.sh

@@ -72,8 +72,8 @@ elif [[ -n "$DATA_DIR" ]]; then
   while IFS= read -r file; do
     [[ -z "$file" ]] && continue
     done_total=$((done_total + 1))
-    if git -C "$DATA_DIR" log --since="${WINDOW_DAYS} days ago" --pretty='%s' -- "$file" 2>/dev/null \
-         | grep -qiE 'reopen|revert|fix|regression|wrong|incorrect|redo'; then
+    history="$(git -C "$DATA_DIR" log --since="${WINDOW_DAYS} days ago" --pretty='%s' -- "$file" 2>/dev/null)"
+    if grep -qiE 'reopen|revert|fix|regression|wrong|incorrect|redo' <<<"$history"; then
       detectable=$((detectable + 1))
     fi
   done < <(find "$DATA_DIR" -type f -name '*.json' 2>/dev/null)

scripts/analysis/reflect-git-history.sh

@@ -64,9 +64,9 @@ for line in "${LINES[@]}"; do
   #   - build/test/lint/type/ci signals → CI would have caught it
   #   - security/auth/permission/data/migration → human review would flag it
   #   - everything else (logic/UX/assumption/edge) → only-self-reflection bucket
-  if printf '%s' "$subj" | grep -qiE 'test|lint|type|build|ci|compile|typo'; then
+  if grep -qiE 'test|lint|type|build|ci|compile|typo' <<<"$subj"; then
     ci=$((ci + 1))
-  elif printf '%s' "$subj" | grep -qiE 'security|auth|permission|rbac|secret|migration|data|sql|injection'; then
+  elif grep -qiE 'security|auth|permission|rbac|secret|migration|data|sql|injection' <<<"$subj"; then
     human=$((human + 1))
   else
     selfonly=$((selfonly + 1))

scripts/pipefail-early-exit.test.mjs

@@ -0,0 +1,60 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import test from 'node:test';
+
+const TARGETS = [
+  'tools/matrix-presence-harness/run.sh',
+  'tools/e2e-install-test.sh',
+  'tools/install.sh',
+  'scripts/agent/session-start.sh',
+  'scripts/analysis/reflect-board-history.sh',
+  'scripts/analysis/reflect-git-history.sh',
+  'packages/mosaic/framework/templates/repo/scripts/agent/session-start.sh',
+  'packages/mosaic/framework/tools/authentik/user-create.sh',
+  'packages/mosaic/framework/tools/git/mutate-push-guard.sh',
+  'packages/mosaic/framework/tools/orchestrator/session-resume.sh',
+  'packages/mosaic/framework/tools/prdy/prdy-status.sh',
+  'packages/mosaic/framework/tools/qa/reflect-stop-hook.sh',
+  'packages/mosaic/framework/tools/qa/typecheck-hook.sh',
+  'packages/mosaic/framework/tools/tmux/send-message.sh',
+  'packages/mosaic/framework/tools/wake/detector.sh',
+  'packages/mosaic/framework/tools/wake/digest.sh',
+  'packages/mosaic/framework/tools/wake/reconcile.sh',
+];
+
+// These statuses are explicitly non-load-bearing or unreachable at designed input.
+// They remain inventoried until the final #1099 tranche records every verdict.
+const ACCEPTED = [
+  ['tools/install.sh', 'mosaic-bak-', '|| true'],
+  ['tools/install.sh', 'mosaicstack-mosaic-*.tgz', 'head -1'],
+  ['tools/install.sh', 'mosaicstack-gateway-*.tgz', 'head -1'],
+  ['scripts/agent/session-start.sh', 'docs/scratchpads/*.md', '|| true'],
+  [
+    'packages/mosaic/framework/templates/repo/scripts/agent/session-start.sh',
+    'docs/scratchpads/*.md',
+    '|| true',
+  ],
+];
+
+const earlyExit =
+  /(?<!\|)\|(?!\|)[^;\n]*(?:grep\b[^;\n]*(?:-[A-Za-z]*q|--quiet|-m\s*1)|head\b(?:\s|$))/;
+
+test('load-bearing pipefail paths do not pipe into early-exiting consumers', async () => {
+  const found = [];
+  for (const file of TARGETS) {
+    const source = (await readFile(new URL(`../${file}`, import.meta.url), 'utf8')).replace(
+      /\\\n\s*/g,
+      ' ',
+    );
+    for (const rawLine of source.split('\n')) {
+      const line = rawLine.trim();
+      if (!earlyExit.test(line)) continue;
+      const accepted = ACCEPTED.some(
+        ([acceptedFile, ...fragments]) =>
+          acceptedFile === file && fragments.every((item) => line.includes(item)),
+      );
+      if (!accepted) found.push(`${file}:${line}`);
+    }
+  }
+  assert.deepEqual(found, []);
+});