fix(shell): preserve pipeline verdict semantics

scripts/pipefail-early-exit.test.mjs

@@ -1,7 +1,12 @@
 import assert from 'node:assert/strict';
-import { readFile } from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
+import { chmod, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 import test from 'node:test';
 
+const ROOT = new URL('../', import.meta.url);
+const EXPECTED_BASELINE_SITES = 26;
 const TARGETS = [
   'tools/matrix-presence-harness/run.sh',
   'tools/e2e-install-test.sh',
@@ -39,13 +44,10 @@ const ACCEPTED = [
 const earlyExit =
   /(?<!\|)\|(?!\|)[^;\n]*(?:grep\b[^;\n]*(?:-[A-Za-z]*q|--quiet|-m\s*1)|head\b(?:\s|$))/;
 
-test('load-bearing pipefail paths do not pipe into early-exiting consumers', async () => {
+function scan(sources) {
   const found = [];
-  for (const file of TARGETS) {
-    const source = (await readFile(new URL(`../${file}`, import.meta.url), 'utf8')).replace(
-      /\\\n\s*/g,
-      ' ',
-    );
+  for (const [file, rawSource] of sources) {
+    const source = rawSource.replace(/\\\n\s*/g, ' ');
     for (const rawLine of source.split('\n')) {
       const line = rawLine.trim();
       if (!earlyExit.test(line)) continue;
@@ -56,5 +58,78 @@ test('load-bearing pipefail paths do not pipe into early-exiting consumers', asy
       if (!accepted) found.push(`${file}:${line}`);
     }
   }
-  assert.deepEqual(found, []);
+  return found;
+}
+
+async function currentSources() {
+  return Promise.all(
+    TARGETS.map(async (file) => [file, await readFile(new URL(file, ROOT), 'utf8')]),
+  );
+}
+
+test('the registered baseline denominator is exactly 26 unsafe sites', async () => {
+  const baseline = JSON.parse(
+    await readFile(new URL('scripts/fixtures/pipefail-early-exit-baseline.json', ROOT), 'utf8'),
+  );
+  assert.equal(baseline.length, EXPECTED_BASELINE_SITES);
+  assert.equal(new Set(baseline).size, EXPECTED_BASELINE_SITES);
+  const fixtureSources = baseline.map((site) => {
+    const separator = site.indexOf(':');
+    assert.ok(separator > 0, `invalid baseline site: ${site}`);
+    return [site.slice(0, separator), site.slice(separator + 1)];
+  });
+  assert.deepEqual(scan(fixtureSources), baseline);
+});
+
+test('load-bearing pipefail paths do not pipe into early-exiting consumers', async () => {
+  assert.deepEqual(scan(await currentSources()), []);
+});
+
+test('gateway verify capability preserves the complete help-probe truth table', async () => {
+  const directory = await mkdtemp(path.join(tmpdir(), 'gateway-help-probe-'));
+  const mosaic = path.join(directory, 'mosaic');
+  const probe = new URL('tools/e2e-gateway-verify-supported.sh', ROOT).pathname;
+  try {
+    await writeFile(
+      mosaic,
+      '#!/usr/bin/env bash\nprintf \'%s\\n\' "${MOCK_HELP_OUTPUT:-}"\nexit "${MOCK_HELP_RC:-0}"\n',
+    );
+    await chmod(mosaic, 0o755);
+    const run = (rc, output) =>
+      spawnSync('bash', [probe], {
+        env: {
+          ...process.env,
+          PATH: `${directory}:${process.env.PATH}`,
+          MOCK_HELP_RC: String(rc),
+          MOCK_HELP_OUTPUT: output,
+        },
+      }).status;
+
+    assert.equal(run(0, 'commands: verify'), 0);
+    assert.equal(run(0, 'commands: install'), 1);
+    assert.equal(run(1, 'commands: verify'), 1);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+});
+
+test('board-history preserves non-git data-dir as a non-detectable result', async () => {
+  const directory = await mkdtemp(path.join(tmpdir(), 'reflect-board-non-git-'));
+  try {
+    await writeFile(path.join(directory, 'task.json'), '{}\n');
+    const result = spawnSync(
+      'bash',
+      [
+        new URL('scripts/analysis/reflect-board-history.sh', ROOT).pathname,
+        '--data-dir',
+        directory,
+      ],
+      { encoding: 'utf8' },
+    );
+    assert.equal(result.status, 0, result.stderr);
+    assert.match(result.stdout, /"done_tasks": 1/);
+    assert.match(result.stdout, /"detectable_outcomes": 0/);
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
 });