Audit: nine greens that measured nothing, and the 141 that hid them

[itsvedantkumar]

Nine defects, every one of them a green that measured nothing or a command doing something its name does not suggest. Each leaves behind a check and a mutation row rather than just a fix.

What was broken

Check 24 said ok over a comparison it never ran. A version declared by the manifests but not yet tagged has no payload to diff against, and that branch printed ok. The tagless branch one elif below already knew better. Now it skips with a reason, so the skip census can see it.

The pinned quickstart 404s. The README's pin-a-release lane pinned v1.8.0, the manifests said v1.8.0, and no such tag existed. Check 24 compared the two strings, found them equal, and was satisfied. Measured: HTTP 404 for v1.8.0, 200 for v1.7.0. Every stranger who copy-pasted that block got nothing. A pin now has to name a tag that is actually there.

shellcheck was linting a hand-maintained list. git ls-files '*.sh' bin/doctor bin/vstack never included bin/cloudflare-mcp, a #!/bin/sh script with no .sh suffix. An unquoted expansion appended to it made shellcheck exit 1 while the gate printed ok shellcheck clean (29 scripts). Selection is by shebang now, the way check 1 already did it. Row 29 mutates that file specifically.

The count check dropped nouns on the floor. want_for() resolved eight nouns; the extractor carried its own grep alternation. A claim could be extractable-but-unresolvable or the reverse, silently either way. One list drives both now, with a positive control.

A suppression-reason rule that only lived in a comment. Check 29's header had claimed it for versions while bootstrap.sh carried a naked disable=SC2086. Check 30 enforces it.

Two files nothing pointed at. A launchd wrapper around the doctor that install.sh never installed and uninstall.sh never removed, and the eval-loop driver. Check 31 makes an unreferenced file a failure.

An uninstall that left Conductor pinning policy. install.sh writes ~/.conductor/settings.toml and settings.managed.toml; uninstall.sh had no reference to conductor at all, so a removed vstack went on pinning models and plan mode.

A fresh bootstrap ended red. setup-machine.sh installs claude-mem, bin/doctor has checked its hooks are async for versions, and nothing ever set the flag. The doctor-stranger matrix case could not see it: that case runs install.sh, and the plugin only arrives via setup-machine.sh, which only the bootstrap lane runs. Found by running the README quickstart verbatim, which is the point of running it verbatim.

doctor --drift deleted an unpushed release tag. It ran a bare git fetch to compute a behind-count. A bare fetch is not read-only: with fetch.prune and fetch.pruneTags true it deletes every local tag the remote lacks. It destroyed the v1.9.1 tag seconds after creation, and the release check then reported ok for a version whose tag was already gone. Every flag is explicit now.

The 141 that hid several of these

tests/gate-falsifiability.sh probed for a check's skip with verify.sh | grep -q. Under set -o pipefail, grep -q exits on the first match, verify dies of SIGPIPE, and the pipeline returns 141, which reads as "did not skip". Measured: rc=141 with pipefail, rc=0 without. Row 24 had been reporting falsifiable off the wrong branch. Four sites now capture first and grep a here-string.

Numbers

gate	before	after
.claude/verify.sh	31 declared, 31 ran, 0 skipped	33 declared, 33 ran, 0 skipped
tests/gate-falsifiability.sh	33 passed, row 24 falsifiable off the wrong branch	35 passed, 0 failed, tree unchanged
tests/install-matrix.sh	22 passed	23 passed, 0 skipped
tests/auto-trigger.sh	—	12 of 12
tests/compare-baseline.sh	—	6 scenarios, 0 regressions
shellcheck coverage	29 files	30, selected by shebang
stranger install	1 red line + DRIFT ✖ on the bootstrap lane	23 ok, 0 red, 6 notes
pinned quickstart	HTTP 404	HTTP 200, 26/8/14/6/6 land, 0 red

Two checks that defeated themselves first

Naming the orphans in the header of the check that hunts unnamed files gave them a referrer. Naming the probe in the mutation row gave the probe one, and the row reported "did NOT fail when broken" while the mutation was working perfectly. Both comments now say so. The first version of doctor-no-mutate used a scratch repo --drift refuses to run against, so it never reached the fetch and passed against the unfixed doctor; it carries three controls now.

What a reader should be sceptical of

bin/doctor --drift was attacked with an empty source directory on the theory that it would print no drift ✔ over nothing. It went red instead, correctly. It still does not say how many items it compared, which is a transparency gap rather than a defect.

The grep -q 141 trap did not reproduce in isolation on this bash, only in the real slow-producer case inside the falsifiability suite. The other pipe-fed grep -q sites are documented but unproven.

No dead functions or unread variables were found. The five candidates the sweep surfaced were all false positives: two secret-scan test fixtures, an IFS= read-loop idiom, and two env-prefix assignments.

v1.9.0 is tagged and describes a payload carrying the claude-mem defect. It is left in place rather than moved, because a tag somebody may have fetched is not a thing to rewrite. Use v1.9.1.

Merge with a merge commit, not a squash: v1.9.0 and v1.9.1 point at commits on this branch.

🤖 Generated with Claude Code