fix(shell): remove wake validation pipe hazards

packages/mosaic/framework/tools/wake/test-wake-digest-quarantine.sh

@@ -564,7 +564,7 @@ echo "== Q16 (guard): Q2's ENUM-B fixture must STAY address-free — the reconci
   # Token concatenated so THIS guard's own source lines never contain the
   # literal fixture id and cannot self-match.
   enum_id='ENUM''-B'
-  fixture_line="$(has_match -F "\"id\":\"$enum_id\"" "$self" | has_match -F '"observed_seq":5' | head -n1)"
+  fixture_lines="$(has_match -F "\"id\":\"$enum_id\"" "$self")"; fixture_matches="$(has_match -F '"observed_seq":5' <<<"$fixture_lines")"; fixture_line="${fixture_matches%%$'\n'*}"
   [ -n "$fixture_line" ] || fail_msg "Q16: could not locate Q2's $enum_id fixture line (renamed/renumbered? update this guard)"
   fixture_json="$(printf '%s' "$fixture_line" | sed "s/.*'\({.*}\)'.*/\1/")"
   # Positive controls FIRST (blind-instrument rule): the extraction must yield

packages/mosaic/framework/tools/wake/test-wake-preimage.sh

@@ -179,8 +179,8 @@ echo "== P3: detector orders the cause line BEFORE the delta it explains =="
   printf 'r1 state v2\n' >"$fx/repo_r1"
   "$DET" poll-once >/dev/null 2>&1 || fail_msg "P3: second poll failed"
   sd="$(state_dir)"
-  pre_seq="$(jq -r 'select(.locators.kind == "preimage") | .observed_seq' "$sd/pending.jsonl" | head -n1)"
-  src_seq="$(jq -r 'select(.locators.kind == "repo") | .observed_seq' "$sd/pending.jsonl" | head -n1)"
+  pre_seq="$(jq -nr 'first(inputs | select(.locators.kind == "preimage") | .observed_seq) // empty' "$sd/pending.jsonl")"
+  src_seq="$(jq -nr 'first(inputs | select(.locators.kind == "repo") | .observed_seq) // empty' "$sd/pending.jsonl")"
   [ -n "$pre_seq" ] || fail_msg "P3: no preimage cause entry enqueued"
   [ -n "$src_seq" ] || fail_msg "P3: no source delta entry enqueued"
   if [ -n "$pre_seq" ] && [ -n "$src_seq" ]; then
@@ -343,8 +343,8 @@ echo "== P11: reconcile surfaces the cause line before its enumerations =="
   printf '# adapter changed while detector down\n' >>"$fx/adapter.sh"
   "$RECON" reconcile >/dev/null 2>&1 # rc 1 expected (unaccounted enumerated)
   sd="$(state_dir)"
-  pre_seq="$(jq -r 'select(.locators.kind == "preimage") | .observed_seq' "$sd/pending.jsonl" | head -n1)"
-  enum_seq="$(jq -r 'select(.locators.reconciled == true) | .observed_seq' "$sd/pending.jsonl" | head -n1)"
+  pre_seq="$(jq -nr 'first(inputs | select(.locators.kind == "preimage") | .observed_seq) // empty' "$sd/pending.jsonl")"
+  enum_seq="$(jq -nr 'first(inputs | select(.locators.reconciled == true) | .observed_seq) // empty' "$sd/pending.jsonl")"
   [ -n "$pre_seq" ] || fail_msg "P11: reconcile must enqueue the preimage cause line"
   [ -n "$enum_seq" ] || fail_msg "P11: reconcile must still enumerate the unaccounted source"
   if [ -n "$pre_seq" ] && [ -n "$enum_seq" ]; then

packages/mosaic/framework/tools/wake/validate-973/microtest-wake-assert.sh

@@ -150,7 +150,7 @@ site_line() { # site_line FILE MARKER -> first physical line of that call
   local f="$1" marker="$2" ln
   ln="$(grep -n "# SITE:${marker}\$" "$f" | cut -d: -f1)"
   # continuation marker sits on the tail line; the call starts one line up
-  if ! sed -n "${ln}p" "$f" | grep -Eq 'has_match|count_lines'; then
+  source_line="$(sed -n "${ln}p" "$f")"; if ! grep -Eq 'has_match|count_lines' <<<"$source_line"; then
     ln=$((ln - 1))
   fi
   printf '%s' "$ln"
@@ -167,13 +167,13 @@ rcB=$?
 sort "$LEDGER" >"$TMP/got-c1"
 n_expected="$(grep -c . "$TMP/expected-c1")"
 if [ "$rcA" -eq 0 ] && [ "$rcB" -eq 0 ] &&
-  printf '%s' "$outA" | grep -q 'mini-a: OK' &&
-  printf '%s' "$outB" | grep -q 'mini-b: OK' &&
+  grep -q 'mini-a: OK'  <<<"$outA"&&
+  grep -q 'mini-b: OK'  <<<"$outB"&&
   [ "$n_expected" -gt 1 ] &&
   cmp -s "$TMP/expected-c1" "$TMP/got-c1"; then
   check C1 0 ""
 else
-  check C1 1 "rcA=$rcA rcB=$rcB expected($n_expected)/got diff: $(diff "$TMP/expected-c1" "$TMP/got-c1" 2>&1 | head -n 10 | tr '\n' ' ')"
+  check C1 1 "rcA=$rcA rcB=$rcB expected($n_expected)/got diff: $(diff "$TMP/expected-c1" "$TMP/got-c1" 2>&1 | sed -n '1,10p' | tr '\n' ' ')"
 fi
 
 # --- C2: early exit -> short ledger, comparison catches it -----------------
@@ -201,12 +201,12 @@ abort_case() { # abort_case NAME MARKER HELPER
     bash "$TMP/mini-a.sh" "$TMP" 2>&1)"
   rc=$?
   if [ "$rc" -ne 0 ] &&
-    ! printf '%s' "$out" | grep -q 'mini-a: OK' &&
-    ! printf '%s' "$out" | grep -q 'mini-a: FAILED' &&
-    printf '%s' "$out" | grep -q "WAKE-ASSERT ARMED: forcing real grep error at $site" &&
-    printf '%s' "$out" | grep -q "WAKE-ASSERT ABORT" &&
-    printf '%s' "$out" | grep -q "$site" &&
-    printf '%s' "$out" | grep -q "grep exit 2" &&
+    ! grep -q 'mini-a: OK'  <<<"$out"&&
+    ! grep -q 'mini-a: FAILED'  <<<"$out"&&
+    grep -q "WAKE-ASSERT ARMED: forcing real grep error at $site"  <<<"$out"&&
+    grep -q "WAKE-ASSERT ABORT"  <<<"$out"&&
+    grep -q "$site"  <<<"$out"&&
+    grep -q "grep exit 2"  <<<"$out"&&
     grep -q "^${helper} ${site}\$" "$ledger"; then
     check "$name" 0 ""
   else
@@ -230,8 +230,8 @@ if [ "$got" = "1" ]; then check C8 0 ""; else check C8 1 "env-prefix did not rea
 out="$(WAKE_ASSERT_FORCE_GREP_ERROR_AT="mini-a.sh:9999" bash "$TMP/mini-a.sh" "$TMP" 2>&1)"
 rc=$?
 if [ "$rc" -eq 0 ] &&
-  printf '%s' "$out" | grep -q 'mini-a: OK' &&
-  ! printf '%s' "$out" | grep -q 'WAKE-ASSERT ARMED'; then
+  grep -q 'mini-a: OK'  <<<"$out"&&
+  ! grep -q 'WAKE-ASSERT ARMED' <<<"$out"; then
   check C9 0 ""
 else
   check C9 1 "rc=$rc out=$(printf '%s' "$out" | tail -n 3 | tr '\n' ' ')"
@@ -248,8 +248,8 @@ chmod +x "$TMP/fake-bash"
 out="$(WAKE_ASSERT_PIN_BASH="$TMP/fake-bash" bash -c '. "$WAKE_COMMON" && wake_assert_init && echo REACHED-PAST-INIT' 2>&1)"
 rc=$?
 if [ "$rc" -ne 0 ] &&
-  ! printf '%s' "$out" | grep -q 'REACHED-PAST-INIT' &&
-  printf '%s' "$out" | grep -q 'WAKE-ASSERT INIT ABORT: BASH_LINENO convention violated'; then
+  ! grep -q 'REACHED-PAST-INIT'  <<<"$out"&&
+  grep -q 'WAKE-ASSERT INIT ABORT: BASH_LINENO convention violated' <<<"$out"; then
   check C10 0 ""
 else
   check C10 1 "rc=$rc out=$(printf '%s' "$out" | tail -n 2 | tr '\n' ' ')"
@@ -283,8 +283,8 @@ out="$(WAKE_ASSERT_LEDGER="$LEDGER" bash "$TMP/mini-c.sh" "$TMP" 2>&1)"
 rc=$?
 summary_ln="$(site_line "$TMP/mini-c.sh" c-summary)"
 if [ "$rc" -eq 1 ] &&
-  printf '%s' "$out" | grep -q 'wake mini-c harness: FAILED (1 assertion(s))' &&
-  ! printf '%s' "$out" | grep -q 'all invariants passed' &&
+  grep -q 'wake mini-c harness: FAILED (1 assertion(s))'  <<<"$out"&&
+  ! grep -q 'all invariants passed'  <<<"$out"&&
   grep -q "^count_lines mini-c.sh:${summary_ln}\$" "$LEDGER"; then
   check C11 0 ""
 else

packages/mosaic/framework/tools/wake/validate-973/validate-973.sh

@@ -107,7 +107,7 @@ if cmp -s "$TMP/expected.txt" "$TMP/static.txt"; then
   echo "STATIC-INVENTORY equals expected set ($(grep -c . "$TMP/static.txt") rows from source text)"
 else
   flag "static inventory (source text) differs from expected set (artifact):"
-  diff "$TMP/expected.txt" "$TMP/static.txt" | head -n 20 | sed 's/^/  /'
+  diff "$TMP/expected.txt" "$TMP/static.txt" | sed -n '1,20p' | sed 's/^/  /'
 fi
 
 # --- 3: green instrumented run ----------------------------------------------
@@ -116,7 +116,7 @@ LEDGER="$TMP/ledger"
 for s in "${SUITES[@]}"; do
   out="$(WAKE_ASSERT_LEDGER="$LEDGER" bash "$WAKE/$s" 2>&1)"
   rc=$?
-  if printf '%s\n' "$out" | grep -Eq "$(sentinel_for "$s")"; then
+  if grep -Eq "$(sentinel_for "$s")" <<<"$out"; then
     sent="present"
   else
     sent="ABSENT"
@@ -177,14 +177,14 @@ while read -r helper site form; do
   rc=$?
   bad=""
   [ "$rc" -ne 0 ] || bad="$bad exit=0"
-  printf '%s\n' "$out" | grep -q "WAKE-ASSERT ARMED: forcing real grep error at $site" ||
+  grep -q "WAKE-ASSERT ARMED: forcing real grep error at $site"  <<<"$out"||
     bad="$bad no-ARMED-line"
-  printf '%s\n' "$out" | grep -q "WAKE-ASSERT ABORT: ${helper} at ${site}: grep exit" ||
+  grep -q "WAKE-ASSERT ABORT: ${helper} at ${site}: grep exit"  <<<"$out"||
     bad="$bad no-ABORT-line"
   # AND-polarity check (a match is the defect): a grep error (rc>=2) must be
   # its own loud arm — it cannot fall through as "no sentinel = pass".
   rc_sent=0
-  printf '%s\n' "$out" | grep -Eq "$(sentinel_for "$f")" || rc_sent=$?
+  grep -Eq "$(sentinel_for "$f")"  <<<"$out"|| rc_sent=$?
   case "$rc_sent" in
   0) bad="$bad sentinel-emitted" ;;
   1) : ;;