fix: three defects the v0.31.0 release audit found in v0.30.0's own delta (#1372)

[fdaviddpt]

Closes #1376.

Gate 3 round one for v0.31.0 -- range v0.30.0..HEAD, dispatch token gate3-r1-4f2a9c7e1b83, 4 findings, none in a blocking row, DISPOSITION: stop-tag. Three of the four are defects that shipped in that same delta; the fourth is the missing control for one of them. The release is blocked on this landing.

Two of the three are compositions of two commits each, and neither commit's own diff contains the defect. A per-PR review cannot see either; only an audit over the whole delta can. That is the argument for gate 3 existing, restated by it catching three things in one pass.

1. Two trap counters disagree by one, permanently

#1348 excluded trap.d/README.md from trap_curate.waiting(). statusline._trap_count was not touched, and its docstring asserts the parity that became false. Reproduced on this repository: 16 against 17.

The harm is not the number. A fully drained trap.d/ -- the healthy end state -- renders trap 1 forever, with no fragment left to delete that would clear it, while doctor.py's own trap-queue check says none waiting in the same run.

statusline.py is vendored standalone into managed repos and cannot import trap_curate, so the literal is duplicated knowingly and the docstring now says so. What changed is that the two counters are compared by a test rather than by a docstring claiming they match.

2. A new relay read with no sentinel

forged relay, claude NOT on PATH -> ('connected', 'oss-channel')

OSS_WORKSPACE_MCP_LIST_OUTPUT was read on its own, so a stale, inherited or forged variable reported the consumer live on a machine with no claude binary. #1344 hardened the sibling relay against exactly this in the same delta and said why; this one shipped with none of the three guards its two siblings carry. Adds OSS_WORKSPACE_MCP_LIST_CHECKED=1 on both sides, matching #629 and #810, and unsets it before exec alongside them.

3. The repair reproduced the bug it repairs

bin/oss-workspace's declared-but-not-live arm registers oss-channel because the plugin-declared consumer is dead. The census then counted both -- its plugin half reads .mcp.json declarations with no liveness check anywhere in it -- answered collision, and set channel_ready=0. The session opens with no channel flag: #1361's own zero-consumer state, one layer inside the fix for it, plus an oss-channel registration colliding on every launch afterwards.

_drop_dead_plugin_consumers drops only a transport positively read as failed. could-not-ask, not-listed and connected all keep the server counted, because an unread answer is not evidence a consumer is dead, and dropping one on that basis would hide a real collision -- the opposite failure, and the worse of the two, since this census is what stops two servers racing one socket.

Its default arm_target_liveness is imported inside the function, not at module scope, because doctor_check_mcp_channel_connection imports names back out of this module.

4. The new shell arm had no control

grep -rn "declared-but-not-live" . returned two hits, both in bin/oss-workspace, none under tests/. Adds a coupling check over the emitter's line order and the reader's sed offsets -- stated as a coupling check, not an execution of the launcher, which it cannot be and does not claim to be -- plus a positive control that the arm actually blanks the target it just found dead.

Red, then green

Each fix's test written first. 4 failed / 1 passed before, then 7 passed; 140 passed across every guard these four files touch (test_workspace_channel_census_810, test_plugin_channel_consumer_census_1241, test_workspace_plugin_channel_arm_1307, test_workspace_channel_arm_1343, test_doctor_channel_connection_1361, test_statusline_479, test_trap_curate_905, test_trap_curate_owned_readme_1348).

#1361's own relay fixture asserted the value alone was enough -- which is precisely the hole finding 2 names. Updated to carry the sentinel rather than weakening the new guard to keep an old fixture green.

Not fixed here

The ranking table has no row for finding 3's shape: two individually-correct decisions composing to a disabled feature. The auditor ranked it unranked and reasoned through why none of misreports, misdirects or fails-to-preserve fits. That is a gap in the table, and it stays open on #1376.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GAMumWmudgzrPR4HmeeG7w

[AI-generated]