stack/docs/scratchpads/1099-pipefail-sweep.md

#1099 — pipefail + early-exit sweep

Scope and decisions

• Baseline df4c591ab42aa1ae62c12935fdc0e772684864a0, after #1100 removed its 35 sites.
• Split into review-sized non-closing tranches: runtime/general; tmux/git/quality tests; wake validation/tests.
• Do not equate class membership with demonstrated risk. Do not use payload size or pipeline stage count as a safety proxy.
• Preserve the issue's withdrawn findings for qa-hook-stdin.sh and the two fresh-directory pnpm pack lookups. Fix install.sh:312 because malformed multi-root input must reach its named handler.

Tranche 1 TDD

RED-first control: node --test scripts/pipefail-early-exit.test.mjs reported exactly 26 non-accepted runtime/general sites, including install.sh:312, and exited 1. A checked-in fixture generated from immutable baseline df4c591a records all 26 normalized sites; the control passes every fixture entry through the same scanner, asserts exact identity/count/uniqueness, and separately requires zero findings in the current tree. It also inventories accepted sites rather than silently excluding whole files.

Construction choices:

• here-string/file redirection for scalar grep assertions;
• full capture then parameter expansion for first-line selection;
• arrays/mapfile for complete populations;
• direct jq/awk/grep selection where one tool can express the property;
• no || true added to a load-bearing assertion.

Site-by-site verdicts: docs/reports/quality/1099-pipefail-sweep.md.

Verification so far

• bash -n on every changed shell script: pass.
• structural Node control: pass.
• test-mutate-push-guard.sh: 8/8 pass.
• test-send-message-verdict.sh: 3/3 pass.
• test-send-message-socket.sh: pass.
• Independent review 143 found two semantic regressions: a help-probe || true changed the failure truth table, and an unguarded Git capture changed non-Git data-dir behavior from rc 0 + JSON to silent rc 128. Both received RED-first regressions before correction; help status is now separate and required, and Git status remains condition-guarded.
• Wake detector/reconcile/digest/preimage suites terminate at their existing fail-closed #973 BASH_LINENO environment probe (exit 97, observed [3 5], expected [3 4]) before subject tests. No bypass or skip was used; canonical CI remains required.
• ShellCheck reports only pre-existing source-following, unused-variable, and untouched ls | head findings; no new diagnostic was introduced.