diff --git a/docs/scratchpads/1099-pipefail-sweep.md b/docs/scratchpads/1099-pipefail-sweep.md
index efd0b9df..5dd36dad 100644
--- a/docs/scratchpads/1099-pipefail-sweep.md
+++ b/docs/scratchpads/1099-pipefail-sweep.md
@@ -9,7 +9,7 @@
 
 ## Tranche 1 TDD
 
-RED-first control: `node --test scripts/pipefail-early-exit.test.mjs` reported 28 non-accepted runtime/general sites, including `install.sh:312`, and exited 1. The same control is green after construction changes. It also inventories accepted sites rather than silently excluding whole files.
+RED-first control: `node --test scripts/pipefail-early-exit.test.mjs` reported exactly 26 non-accepted runtime/general sites, including `install.sh:312`, and exited 1. A checked-in fixture generated from immutable baseline `df4c591a` records all 26 normalized sites; the control passes every fixture entry through the same scanner, asserts exact identity/count/uniqueness, and separately requires zero findings in the current tree. It also inventories accepted sites rather than silently excluding whole files.
 
 Construction choices:
 
@@ -28,5 +28,6 @@ Site-by-site verdicts: `docs/reports/quality/1099-pipefail-sweep.md`.
 - `test-mutate-push-guard.sh`: 8/8 pass.
 - `test-send-message-verdict.sh`: 3/3 pass.
 - `test-send-message-socket.sh`: pass.
+- Independent review 143 found two semantic regressions: a help-probe `|| true` changed the failure truth table, and an unguarded Git capture changed non-Git data-dir behavior from rc 0 + JSON to silent rc 128. Both received RED-first regressions before correction; help status is now separate and required, and Git status remains condition-guarded.
 - Wake detector/reconcile/digest/preimage suites terminate at their existing fail-closed #973 `BASH_LINENO` environment probe (exit 97, observed `[3 5]`, expected `[3 4]`) before subject tests. No bypass or skip was used; canonical CI remains required.
 - ShellCheck reports only pre-existing source-following, unused-variable, and untouched `ls | head` findings; no new diagnostic was introduced.
diff --git a/scripts/analysis/reflect-board-history.sh b/scripts/analysis/reflect-board-history.sh
index b2b1b0be..f36bf295 100755
--- a/scripts/analysis/reflect-board-history.sh
+++ b/scripts/analysis/reflect-board-history.sh
@@ -72,8 +72,9 @@ elif [[ -n "$DATA_DIR" ]]; then
   while IFS= read -r file; do
     [[ -z "$file" ]] && continue
     done_total=$((done_total + 1))
-    history="$(git -C "$DATA_DIR" log --since="${WINDOW_DAYS} days ago" --pretty='%s' -- "$file" 2>/dev/null)"
-    if grep -qiE 'reopen|revert|fix|regression|wrong|incorrect|redo' <<<"$history"; then
+    history_rc=0
+    history="$(git -C "$DATA_DIR" log --since="${WINDOW_DAYS} days ago" --pretty='%s' -- "$file" 2>/dev/null)" || history_rc=$?
+    if [[ "$history_rc" -eq 0 ]] && grep -qiE 'reopen|revert|fix|regression|wrong|incorrect|redo' <<<"$history"; then
       detectable=$((detectable + 1))
     fi
   done < <(find "$DATA_DIR" -type f -name '*.json' 2>/dev/null)
diff --git a/scripts/fixtures/pipefail-early-exit-baseline.json b/scripts/fixtures/pipefail-early-exit-baseline.json
new file mode 100644
index 00000000..4f79e4ff
--- /dev/null
+++ b/scripts/fixtures/pipefail-early-exit-baseline.json
@@ -0,0 +1,28 @@
+[
+  "tools/matrix-presence-harness/run.sh:TSX_CLI=\"$(ls -d \"${REPO}\"/node_modules/.pnpm/tsx@*/node_modules/tsx/dist/cli.mjs 2>/dev/null | head -1)\"",
+  "tools/e2e-install-test.sh:if ! mosaic gateway --help 2>&1 | grep -q 'verify'; then",
+  "tools/install.sh:EXTRACTED_DIR=\"$(find \"$WORK_DIR\" -maxdepth 1 -mindepth 1 -type d | head -1)\"",
+  "scripts/analysis/reflect-board-history.sh:if git -C \"$DATA_DIR\" log --since=\"${WINDOW_DAYS} days ago\" --pretty='%s' -- \"$file\" 2>/dev/null  | grep -qiE 'reopen|revert|fix|regression|wrong|incorrect|redo'; then",
+  "scripts/analysis/reflect-git-history.sh:if printf '%s' \"$subj\" | grep -qiE 'test|lint|type|build|ci|compile|typo'; then",
+  "scripts/analysis/reflect-git-history.sh:elif printf '%s' \"$subj\" | grep -qiE 'security|auth|permission|rbac|secret|migration|data|sql|injection'; then",
+  "packages/mosaic/framework/tools/authentik/user-create.sh:group_pk=$(echo \"$group_response\" | jq -r \".results[] | select(.name == \\\"$GROUP\\\") | .pk\" | head -1)",
+  "packages/mosaic/framework/tools/git/mutate-push-guard.sh:PROSE_LO=\"$(grep -n '^usage() {' \"$BAK\" | head -1 | cut -d: -f1)\"",
+  "packages/mosaic/framework/tools/orchestrator/session-resume.sh:echo \"$dirty_files\" | head -20 | while IFS= read -r line; do",
+  "packages/mosaic/framework/tools/prdy/prdy-status.sh:if echo \"$PRD_CONTENT\" | grep -qiE \"$pattern\"; then",
+  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qiE 'auth|login|session|token|permission|rbac|credential|secret'; then echo auth; return; fi",
+  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qiE 'migration|prisma|schema|\\.sql|entity|repository|seed'; then echo data; return; fi",
+  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qiE 'docker|\\.woodpecker|compose|traefik|deploy|helm|k8s|terraform'; then echo infra; return; fi",
+  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qiE 'package\\.json|tsconfig|turbo\\.json|pnpm-|\\.config\\.|eslint|vite'; then echo build; return; fi",
+  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qE '\\.tsx|\\.css|components/|apps/web/'; then echo ui; return; fi",
+  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qE '\\.spec\\.|\\.test\\.|__tests__/'; then echo test; return; fi",
+  "packages/mosaic/framework/tools/qa/reflect-stop-hook.sh:if printf '%s' \"$p\" | grep -qE '\\.md$|docs/'; then echo docs; return; fi",
+  "packages/mosaic/framework/tools/qa/typecheck-hook.sh:FILE_PATH=$(echo \"$JSON_INPUT\" | grep -o '\"file_path\"[[:space:]]*:[[:space:]]*\"[^\"]*\"' | sed 's/.*\"\\([^\"]*\\)\"$/\\1/' | head -1)",
+  "packages/mosaic/framework/tools/qa/typecheck-hook.sh:RELEVANT=$(echo \"$OUTPUT\" | grep -A2 \"$BASENAME\" 2>/dev/null || echo \"$OUTPUT\" | head -20)",
+  "packages/mosaic/framework/tools/tmux/send-message.sh:if printf '%s' \"$pane\" | grep -qF \"$QUEUED_RE\"; then",
+  "packages/mosaic/framework/tools/tmux/send-message.sh:if [ -n \"$snippet\" ] && printf '%s' \"$promptline\" | grep -qF \"$snippet\"; then",
+  "packages/mosaic/framework/tools/wake/detector.sh:sed -n \"s/^${key}=//p\" \"$MANIFEST\" | head -n1 | tr -d '[:space:]'",
+  "packages/mosaic/framework/tools/wake/detector.sh:if [ -n \"$snap_sha\" ] && ! printf '%s' \"$snap_sha\" | grep -Eq '^[0-9a-f]{7,64}$'; then",
+  "packages/mosaic/framework/tools/wake/detector.sh:if [ -n \"$snap_ts\" ] && ! printf '%s' \"$snap_ts\" | grep -Eq '^[0-9]{1,12}$'; then",
+  "packages/mosaic/framework/tools/wake/digest.sh:olabel=\"$(_locator_line \"$oloc\" | head -n1)\"",
+  "packages/mosaic/framework/tools/wake/reconcile.sh:sed -n \"s/^${key}=//p\" \"$MANIFEST\" | head -n1 | tr -d '[:space:]'"
+]
diff --git a/scripts/pipefail-early-exit.test.mjs b/scripts/pipefail-early-exit.test.mjs
index b42fccb0..6d99875f 100644
--- a/scripts/pipefail-early-exit.test.mjs
+++ b/scripts/pipefail-early-exit.test.mjs
@@ -1,7 +1,12 @@
 import assert from 'node:assert/strict';
-import { readFile } from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
+import { chmod, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 import test from 'node:test';
 
+const ROOT = new URL('../', import.meta.url);
+const EXPECTED_BASELINE_SITES = 26;
 const TARGETS = [
   'tools/matrix-presence-harness/run.sh',
   'tools/e2e-install-test.sh',
@@ -39,13 +44,10 @@ const ACCEPTED = [
 const earlyExit =
   /(?<!\|)\|(?!\|)[^;\n]*(?:grep\b[^;\n]*(?:-[A-Za-z]*q|--quiet|-m\s*1)|head\b(?:\s|$))/;
 
-test('load-bearing pipefail paths do not pipe into early-exiting consumers', async () => {
+function scan(sources) {
   const found = [];
-  for (const file of TARGETS) {
-    const source = (await readFile(new URL(`../${file}`, import.meta.url), 'utf8')).replace(
-      /\\\n\s*/g,
-      ' ',
-    );
+  for (const [file, rawSource] of sources) {
+    const source = rawSource.replace(/\\\n\s*/g, ' ');
     for (const rawLine of source.split('\n')) {
       const line = rawLine.trim();
       if (!earlyExit.test(line)) continue;
@@ -56,5 +58,78 @@ test('load-bearing pipefail paths do not pipe into early-exiting consumers', asy
       if (!accepted) found.push(`${file}:${line}`);
     }
   }
-  assert.deepEqual(found, []);
+  return found;
+}
+
+async function currentSources() {
+  return Promise.all(
+    TARGETS.map(async (file) => [file, await readFile(new URL(file, ROOT), 'utf8')]),
+  );
+}
+
+test('the registered baseline denominator is exactly 26 unsafe sites', async () => {
+  const baseline = JSON.parse(
+    await readFile(new URL('scripts/fixtures/pipefail-early-exit-baseline.json', ROOT), 'utf8'),
+  );
+  assert.equal(baseline.length, EXPECTED_BASELINE_SITES);
+  assert.equal(new Set(baseline).size, EXPECTED_BASELINE_SITES);
+  const fixtureSources = baseline.map((site) => {
+    const separator = site.indexOf(':');
+    assert.ok(separator > 0, `invalid baseline site: ${site}`);
+    return [site.slice(0, separator), site.slice(separator + 1)];
+  });
+  assert.deepEqual(scan(fixtureSources), baseline);
+});
+
+test('load-bearing pipefail paths do not pipe into early-exiting consumers', async () => {
+  assert.deepEqual(scan(await currentSources()), []);
+});
+
+test('gateway verify capability preserves the complete help-probe truth table', async () => {
+  const directory = await mkdtemp(path.join(tmpdir(), 'gateway-help-probe-'));
+  const mosaic = path.join(directory, 'mosaic');
+  const probe = new URL('tools/e2e-gateway-verify-supported.sh', ROOT).pathname;
+  try {
+    await writeFile(
+      mosaic,
+      '#!/usr/bin/env bash\nprintf \'%s\\n\' "${MOCK_HELP_OUTPUT:-}"\nexit "${MOCK_HELP_RC:-0}"\n',
+    );
+    await chmod(mosaic, 0o755);
+    const run = (rc, output) =>
+      spawnSync('bash', [probe], {
+        env: {
+          ...process.env,
+          PATH: `${directory}:${process.env.PATH}`,
+          MOCK_HELP_RC: String(rc),
+          MOCK_HELP_OUTPUT: output,
+        },
+      }).status;
+
+    assert.equal(run(0, 'commands: verify'), 0);
+    assert.equal(run(0, 'commands: install'), 1);
+    assert.equal(run(1, 'commands: verify'), 1);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+});
+
+test('board-history preserves non-git data-dir as a non-detectable result', async () => {
+  const directory = await mkdtemp(path.join(tmpdir(), 'reflect-board-non-git-'));
+  try {
+    await writeFile(path.join(directory, 'task.json'), '{}\n');
+    const result = spawnSync(
+      'bash',
+      [
+        new URL('scripts/analysis/reflect-board-history.sh', ROOT).pathname,
+        '--data-dir',
+        directory,
+      ],
+      { encoding: 'utf8' },
+    );
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /"done_tasks": 1/);
+    assert.match(result.stdout, /"detectable_outcomes": 0/);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
 });
diff --git a/tools/e2e-gateway-verify-supported.sh b/tools/e2e-gateway-verify-supported.sh
new file mode 100644
index 00000000..de32af27
--- /dev/null
+++ b/tools/e2e-gateway-verify-supported.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Exit 0 only when the capability probe itself succeeds and advertises verify.
+# A failed help command and a successful response without verify are both
+# unsupported, matching the historical e2e-install-test.sh conditional.
+set -uo pipefail
+
+gateway_help_rc=0
+gateway_help="$(mosaic gateway --help 2>&1)" || gateway_help_rc=$?
+[[ "$gateway_help_rc" -eq 0 ]] || exit 1
+grep -q 'verify' <<<"$gateway_help"
diff --git a/tools/e2e-install-test.sh b/tools/e2e-install-test.sh
index 8274c0c1..5e6d561f 100755
--- a/tools/e2e-install-test.sh
+++ b/tools/e2e-install-test.sh
@@ -136,8 +136,7 @@ fi
 echo "=== [inner] Running mosaic gateway verify ==="
 # `gateway verify` was added in feat/mosaic-first-run-ux.
 # If the installed version pre-dates this, skip gracefully.
-gateway_help="$(mosaic gateway --help 2>&1 || true)"
-if ! grep -q 'verify' <<<"$gateway_help"; then
+if ! bash /repo/tools/e2e-gateway-verify-supported.sh; then
   echo "[SKIP] 'mosaic gateway verify' not available in installed version ${INSTALLED_VERSION}."
   echo "[SKIP] This command was added in the feat/mosaic-first-run-ux release."
   echo "[SKIP] Re-run after the new version is published to validate this step."