Fixed read-only sync checks and link comparisons

[dzykovic]

Summary

Made sync --check preserve concurrent edits by rendering in a private project copy and compare links without following them. Fixed the remaining correctness and portability findings in #60. Closes #60. Closes #63.

Type of change

• CLI lifecycle or package behavior
• Sync engine or adapter
• Rule, agent, or skill content
• Documentation
• Refactor with no behavior change

Public CLI check

• Uses only the established command groups
• Keeps preview/apply behavior explicit for planned writes
• Preserves automatic alignment and CI refusal; checks never align tracked files
• Keeps fresh-clone package restoration behind intelligence sync

Verification

Run from the PR checkout on Linux or macOS with Bash and native symlinks. The fixture has local sources, a Claude target, and a project adapter that emits dangling and relative generated links. All commands succeed except the explicitly captured check after switching a link into an identical-byte file, which must exit 2. Checks preserve the generated link and personal notes, plain sync ignores inherited check state, and a second sync remains current.

set -euo pipefail
CLI="$(pwd)/cli/intelligence"
VERSION="$(tr -d ' \r\n' < engine/VERSION)"
FIXTURE="$(mktemp -d)"
trap 'rm -rf "$FIXTURE"' EXIT
mkdir -p "$FIXTURE/intelligence/rules" "$FIXTURE/intelligence/skills/demo" "$FIXTURE/intelligence/adapters"
printf '%s\n' '---' 'description: Verification rule' '---' '# Rule' > "$FIXTURE/intelligence/rules/base.md"
printf '%s\n' '---' 'description: Verification skill' '---' '# Demo' > "$FIXTURE/intelligence/skills/demo/SKILL.md"
printf external > "$FIXTURE/outside.txt"
printf link > "$FIXTURE/mode"
cat > "$FIXTURE/intelligence.yaml" <<EOF
schema_version: "$VERSION"
sources:
  rules:
    - intelligence/rules/
  skills:
    - intelligence/skills
targets:
  agents: { enabled: true, output: "AGENTS.md" }
  claude: { enabled: true, output: ".claude" }
  codex: { enabled: true, output: ".codex" }
  probe: { enabled: true, output: ".probe" }
EOF
cat > "$FIXTURE/intelligence/adapters/probe.sh" <<'EOF'
adapter_contract_probe() { adapter_contract_version 1; adapter_contract_owned .probe; }
sync_to_probe() {
    rm -rf "$1/.probe"
    mkdir -p "$1/.probe/assets"
    if [ "$(cat "$1/mode")" = file ]; then
        printf external > "$1/.probe/assets/item"
    else
        ln -s ../../outside.txt "$1/.probe/assets/item"
        ln -s missing "$1/.probe/assets/dangling"
    fi
}
EOF
printf '%s\n' 'CLAUDE.md' '.claude/*' '!.claude/settings.json' '.agents/skills/' '.codex/agents/' > "$FIXTURE/.gitignore"
cd "$FIXTURE"
bash "$CLI" sync > /dev/null
bash "$CLI" sync --check --force
test -L .probe/assets/dangling
printf '# Personal notes\n' > .agents/skills/README.md
bash "$CLI" sync --check --force
grep -qx '# Personal notes' .agents/skills/README.md
printf file > mode
set +e
bash "$CLI" sync --check --force
RC=$?
set -e
test "$RC" -eq 2
test -L .probe/assets/item
IS_SYNC_CHECK="$FIXTURE/unexpected-verdict" bash "$CLI" sync --force > /dev/null
test ! -L .probe/assets/item
test ! -e "$FIXTURE/unexpected-verdict"
bash "${CLI%/*}//intelligence" version
bash "$CLI" status --check
bash "$CLI" sync > /dev/null
bash "$CLI" sync --check --force

• bash cli/tests/verify.sh all reports verify ok
• The fixture's status --check succeeds and a second sync remains current
• Adapter formats remain unchanged; managed hand-written siblings are preserved
• User-facing docs use the established public groups

Automated regressions in e2e-sync-check, e2e-sync-cache, and unit-manifest cover accepted directory-link output roots, refused external/file/dangling output roots, normalized source diagnostics, external relative adapter inputs, exact-root output ancestors, relative-to-absolute link spelling changes, complete warning forwarding, link entry kinds/targets, executable bits, concurrent writes, inherited environment state, doubled slash invocation, managed siblings, warning forwarding, unchanged manifests during store restoration, trailing source slashes, fresh output absence, and manifest cache invalidation. e2e-sync-cache also passes with mawk.

Versioned artifacts

• Every fix is recorded under pending CHANGELOG.md version 0.20.0
• v0.20.0 is unpublished; the published 0.19.0 changelog remains byte-identical
• Version and example pins remain at the existing pending version
• Publishing remains gated by the owner's release instruction and both blocking PRs

Notes for reviewers

Private checks relocate internal absolute links, preserve external relative read-input resolution, and keep generated relative link spelling unchanged. Targets are compared in the original project coordinates. Project adapters see a temporary absolute root; adapters that embed that root in output may report a difference, as documented in docs/cli.md and decision 0018. The copy excludes Git history. Output-only cache changes render to distinguish generated changes from preserved siblings.

Comparator process batching is tracked in #62. Larger suggestions remain for the owner: separate cache records per environment, removing test-only qmap_preload/lock_validate, and consolidating fingerprint pipelines and contract-reader implementations. These require separate design/coverage work and do not affect the corrected check result.

[Copilot]

🟡 Changes recommended

Exact-root symlinks can escape the private copy, warning forwarding loses supported diagnostics, and documentation inconsistencies remain.

6 open findings

• Retarget exact repository-root links to the staging project · New
• Preserve cached indented warning diagnostics · New
• Preserve indented renderer warning diagnostics · New
• Replace stray question mark with an em dash · New
• Replace stray question mark with an em dash · New
• Update CLI rule for the private-copy check contract · New

What changed in this PR

This PR makes sync --check render in an isolated project copy, preserving live concurrent edits while comparing symlinks without dereferencing them.

Changes:

• Adds private-copy rendering and entry-kind-aware comparisons.
• Fixes cache, manifest restoration, warning, and path-handling behavior.
• Expands regression coverage and documentation.

File	Description
intelligence/​rules/​engine.md	Documents isolated check rendering.
engine/​sync.sh	Compares files, directories, and links directly.
engine/​lib/​common.sh	Clarifies manifest cache behavior.
docs/​cli.md	Documents check semantics and adapter roots.
decisions/​0018-check-whether-sync-is-needed.md	Records the isolation amendment.
cli/​tests/​unit-manifest.sh	Tests manifest cache invalidation.
cli/​tests/​e2e-sync-check.sh	Adds check-mode regressions.
cli/​tests/​e2e-sync-cache.sh	Fixes the mawk failure fixture.
cli/​lib/​sync-cache.sh	Implements private rendering and cache behavior.
cli/​lib/​manifest.sh	Invalidates manifest views after writes.
cli/​lib/​cli-common.sh	Shares list caching and supports source-preserving restore.
cli/​internal/​restore.sh	Adds source-preserving restoration.
cli/​intelligence	Handles doubled-slash invocation paths.
cli/​commands/​sync.sh	Clears inherited check state and preserves sources.
CHANGELOG.md	Records the fixes under 0.20.0.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dzykovic]

Verification - PASS

head: d1b3916 - steps: 5077754756e3c7739bcb91b951ec41d0958236014c1fba163f9f50a9643346f5 - env: local (WSL Ubuntu, Bash 5.2.21, native Linux symlinks)

#	Step	Source	Verdict	Expected / observed
1	Run the declared Bash fixture setup and initial bash "$CLI" sync > /dev/null.	PR	pass	Expected success. Setup and sync exited 0; generated relative link target was ../../outside.txt, dangling target was missing.
2	bash "$CLI" sync --check --force; test -L .probe/assets/dangling.	PR	pass	Expected success and preserved dangling link. Observed IS_STATUS=ok IS_DETAIL=generated files are up to date (rendered to compare); link assertion exited 0.
3	Write personal notes, run sync --check --force, and grep -qx '# Personal notes' .agents/skills/README.md.	PR	pass	Expected unchanged notes and success. Observed the same IS_STATUS=ok line; exact notes assertion exited 0.
4	Set mode to file; capture sync --check --force; require exit 2 and test -L .probe/assets/item.	PR	pass	Expected 2 while retaining the generated link. Observed IS_STATUS=out-of-date IS_DETAIL=rendering would change generated files; run 'intelligence sync', RC=2, and link assertion exited 0.
5	IS_SYNC_CHECK="$FIXTURE/unexpected-verdict" bash "$CLI" sync --force; require item no longer a link and no verdict file.	PR	pass	Expected normal rendering despite inherited state. Sync and both assertions exited 0.
6	bash "${CLI%/*}//intelligence" version.	PR	pass	Expected success. Observed 0.20.0 (engine 0.20.0), exit 0.
7	bash "$CLI" status --check.	PR	pass	Expected success. Observed matching schema 0.20.0; agents, claude, codex and probe contract v1; all good., exit 0.
8	Second bash "$CLI" sync > /dev/null; bash "$CLI" sync --check --force.	PR	pass	Expected current output. Both exited 0; observed IS_STATUS=ok IS_DETAIL=generated files are up to date (rendered to compare).
9	bash cli/tests/verify.sh all reports verify ok.	PR	pass	Expected full gate success. Both lint gates and all 19 CLI suites passed, exit 0, final === verify ok ===. Linux-inapplicable Windows junction case and unavailable other-user PID case were explicitly reported; no gate was skipped.
10	The fixture's status --check succeeds and a second sync remains current.	PR	pass	Observed rows 7–8: all good. and IS_STATUS=ok, all exit 0.
11	Adapter formats remain unchanged; managed hand-written siblings are preserved.	PR	pass	Generated .claude/rules/base.md contained description: Verification rule and # Rule; .claude/skills/demo/SKILL.md contained description: "Verification skill" and # Demo. Exact personal-notes assertion passed. All-model adapter rendering and managed-sibling cases also passed in the declared suite.
12	User-facing docs use the established public groups.	PR	pass	Read docs/cli.md: its nine command headings are init, sync, update, upgrade, package, source, adapter, status, registry; added check examples use sync, init and upgrade.
13	Automated regressions in e2e-sync-check, e2e-sync-cache, and unit-manifest cover the declared boundaries.	PR	pass	Observed sync-check: 196 checks passed, sync-cache: 254 checks passed, CLI-UNIT-MANIFEST: ALL OK. Negative cases executed include damaged records, renderer failures, changed executable bits, link-to-file changes, missing output, and refused invalid metadata.
14	e2e-sync-cache also passes with mawk.	PR	pass	Ran the frozen commit's suite with awk pointing to mawk 1.3.4: sync-cache: 254 checks passed, exit 0.

The exact fixture ran from the assigned checkout. Full gates and the mawk probe used a temporary Linux-native export of that same Git commit, with no code edits. The checkout remained clean at the named head before and after execution. There is no docs/qa-checks.md, so no standing steps were added. The steps digest is SHA-256 of the UTF-8 Verification section content between its heading and ## Versioned artifacts, excluding the headings.

[dzykovic]

Code review - BLOCK

head: d1b3916 - base: main - files 15, +283/-90

Critical

• cli/lib/sync-cache.sh:542 - Preserve the resolution of relative links to external read inputs when making the private copy. Only absolute links under the live root are rewritten. A supported project adapter at intelligence/adapters/probe.sh -> ../../../probe.sh becomes dangling after copying the project to a different parent, so the engine no longer discovers the enabled adapter. Independently reproduced on WSL Ubuntu: the adapter defines contract v1, owns .probe, and writes output; plain sync exits 0 and creates .probe, while the immediately following sync --check --force exits 1 with WARNING: No targets enabled. The generated output is already current. This violates decision 0018's exact forced-check contract and the PR Summary (body line 3), which claims the remaining correctness findings are fixed; the Notes for reviewers caveat about adapters embedding the absolute root does not describe this failure. Resolve escaping relative input links against their original parent before rendering, while retaining original link identity for output comparison, and add a regression for a linked project adapter.

Warning

• engine/sync.sh:297 - The directory traversal at lines 323-325 calls compare_sync_entries for every entry, starting a separate cmp for every regular file and two readlink subshells for every link. This conflicts with intelligence/rules/engine.md's explicit per-file process budget and scales forced/cold checks with the count of generated files, especially on Git Bash. The PR Summary's comparison change introduces this cost. Consider a batched comparison that retains the required entry-kind and link-target semantics.

Suggestion

None.

Reviewed the complete diff, applicable CLI/engine/shell/documentation and global rules, accepted decisions, PR body, issue #60 and the existing verification report. Regression coverage addresses the reported #60 cases; the external relative adapter-input case above is absent. The reviewed diff contained no live-secret matches. Assigned checkout was clean and remained at the reported head; the independent reproduction used only a disposable Linux-native temporary fixture. No code was edited. ai:reviewed was not applied because a Critical finding remains.

[dzykovic]

Verification - PASS

head: a209d67 - steps: bb05b83113490a0cf2be15607e07ad947817b46feb2db4be680fff52187be743 - env: local (WSL Ubuntu, Bash 5.2.21, native Linux symlinks)

#	Step	Source	Verdict	Expected / observed
1	Run the declared Bash fixture setup and initial bash "$CLI" sync > /dev/null.	PR	pass	Expected success. Setup and sync exited 0; generated relative link target was ../../outside.txt, dangling target was missing.
2	bash "$CLI" sync --check --force; test -L .probe/assets/dangling.	PR	pass	Expected success and preserved dangling link. Observed IS_STATUS=ok IS_DETAIL=generated files are up to date (rendered to compare); link assertion exited 0.
3	Write personal notes, run sync --check --force, and grep -qx '# Personal notes' .agents/skills/README.md.	PR	pass	Expected unchanged notes and success. Observed the same IS_STATUS=ok line; exact notes assertion exited 0.
4	Set mode to file; capture sync --check --force; require exit 2 and test -L .probe/assets/item.	PR	pass	Expected 2 while retaining the generated link. Observed IS_STATUS=out-of-date IS_DETAIL=rendering would change generated files; run 'intelligence sync', RC=2, and link assertion exited 0.
5	IS_SYNC_CHECK="$FIXTURE/unexpected-verdict" bash "$CLI" sync --force; require item no longer a link and no verdict file.	PR	pass	Expected normal rendering despite inherited state. Sync and both assertions exited 0.
6	bash "${CLI%/*}//intelligence" version.	PR	pass	Expected success. Observed 0.20.0 (engine 0.20.0), exit 0.
7	bash "$CLI" status --check.	PR	pass	Expected success. Observed matching schema 0.20.0; agents, claude, codex and probe contract v1; all good., exit 0.
8	Second bash "$CLI" sync > /dev/null; bash "$CLI" sync --check --force.	PR	pass	Expected current output. Both exited 0; observed IS_STATUS=ok IS_DETAIL=generated files are up to date (rendered to compare).
9	bash cli/tests/verify.sh all reports verify ok.	PR	pass	Expected full gate success. Both lint gates and all 19 CLI suites passed, exit 0, final === verify ok ===. Linux-inapplicable Windows junction case and unavailable other-user PID case were explicitly reported; no gate was skipped.
10	The fixture's status --check succeeds and a second sync remains current.	PR	pass	Observed rows 7–8: all good. and IS_STATUS=ok, all exit 0.
11	Adapter formats remain unchanged; managed hand-written siblings are preserved.	PR	pass	Generated .claude/rules/base.md contained description: Verification rule and # Rule; .claude/skills/demo/SKILL.md contained description: "Verification skill" and # Demo. Exact personal-notes assertion passed. All-model adapter rendering and managed-sibling cases also passed in the declared suite.
12	User-facing docs use the established public groups.	PR	pass	Read docs/cli.md: its nine command headings are init, sync, update, upgrade, package, source, adapter, status, registry; added check examples use sync, init and upgrade.
13	Automated regressions in e2e-sync-check, e2e-sync-cache, and unit-manifest cover the declared boundaries.	PR	pass	Observed sync-check: 205 checks passed, sync-cache: 270 checks passed, CLI-UNIT-MANIFEST: ALL OK. Negative cases executed include damaged records, renderer failures, changed executable bits, link-to-file changes, missing output, and refused invalid metadata. External relative adapter inputs, root-link output ancestors, changed generated link spelling, and complete warning forwarding also executed.
14	e2e-sync-cache also passes with mawk.	PR	pass	Ran the frozen commit's suite with awk pointing to mawk 1.3.4: sync-cache: 270 checks passed, exit 0.

The exact fixture ran from the assigned checkout. Full gates and the mawk probe used a temporary Linux-native export of that same Git commit, with no code edits. The checkout remained clean at the named head before and after execution. There is no docs/qa-checks.md, so no standing steps were added. The steps digest is SHA-256 of the UTF-8 Verification section content between its heading and ## Versioned artifacts, excluding the headings.

Additional observed diagnostic: each forced fixture check emitted WARNING: NOT SYNCED: intelligence/rules followed by WARNING: Wire one in: intelligence source add <rules|agents|skills> <path>. The fixture lists intelligence/rules/, and inspection confirmed its rule was generated. Commands still met the declared exit-code and preservation expectations. This warning was returned to the caller for defect tracking.

[dzykovic]

Code review - BLOCK

head: a209d67 - base: main - files 16, +399/-92

Critical

• engine/sync.sh:315 - Compare the rendered contents behind an allowed directory-link output, in addition to its link identity. validate_output_path explicitly permits output directory links whose targets remain inside the project. For an owned .probe -> actual, compare_sync_entries compares only the link text, then this line skips traversing the output altogether. Independently reproduced in WSL Ubuntu with a contract-v1 adapter owning .probe and writing the project's mode bytes to .probe/value: after an initial sync with mode=old, replace .probe with a link to its renamed actual directory and change mode to new. sync --check --force exits 0 with generated files are up to date, leaves actual/value=old, and the next plain sync --force changes that file to new. This violates decision 0018's strict check contract and the PR Summary (body line 3) and Notes for reviewers claim that targets are compared in original project coordinates. Track the physical in-project write directory separately from the link entry and snapshot/compare both, or consistently refuse this output layout before normal sync and checks; add a regression proving a changed file behind a directory-link output returns 2. The existing exact-root ancestor regression does not cover a snapshotted output that is itself a link.

Warning

• engine/sync.sh:294 - The traversal at lines 320-322 still starts one cmp per regular file and two readlink subprocesses per link. This remains a deviation from the explicit process budget in intelligence/rules/engine.md and can make large forced/cold checks slow on Git Bash. The PR Notes for reviewers records the deferral in Batch no-follow sync check comparison processes #62; it is a nonblocking warning. Batch comparison while retaining entry-kind, target-spelling and executable-state checks.

Suggestion

None.

The previous Critical external-relative adapter-input reproduction now passes, and the new regression covers it. Read the entire current PR diff against main, the current body, applicable rules and accepted decisions, and issues #60, #62 and #63. Issue #63's trailing-slash diagnostic is present in base origin/main plain sync as well as the head's forced check, independently reproduced with the same source fixture; the check verdict and rendered rule remain correct. Its normalization defect is recorded in #63 and this PR exposes it by forwarding existing warnings, rather than introducing the mismatch in warn_unsynced.

The reviewed diff contained no live-secret matches. Assigned checkout remained clean at the reported head. All independent behavioral probes used disposable Linux-native temporary fixtures, with no checkout or ref changes. ai:reviewed was not applied because a Critical finding remains.

[dzykovic]

Code review - PASS-WITH-WARNINGS

head: 724d75d - base: main - files 16, +483/-94

Critical

None.

Warning

• engine/sync.sh:305 - Comparing each generated regular file starts a separate cmp; each link starts two readlink subprocesses. This remains a deviation from the explicit per-file process budget in intelligence/rules/engine.md, and large forced/cold checks can be slow on Git Bash. The PR Notes for reviewers names the deferral, recorded in Batch no-follow sync check comparison processes #62. Consider batched comparison retaining entry-kind, target-spelling and executable-state checks. This warning does not block the review factor.

Suggestion

None.

Reviewed the complete final diff against main, the current PR body, applicable project/pack rules, accepted decisions, and the relevant issue/review history. No undeclared scope, live-secret matches, gate weakening, or further evidenced correctness findings were found. Added behavior has regression coverage in e2e-sync-check, e2e-sync-cache, and unit-manifest.

Independently repeated both prior Critical reproductions on WSL Ubuntu with native symlinks: the relative external project-adapter input remains usable; changing bytes behind an accepted .probe -> actual directory-link output now makes the forced check exit 2 while preserving the live old bytes and link spelling. A subsequent plain sync writes the new bytes, after which the forced check exits 0. An external directory-link output is refused with exit 1 before changing its marker. Direct cache-path safety rejects the linked root, and configured intelligence/rules/ no longer emits the false not-synced diagnostic in either plain sync or a forced check. These probes used disposable temporary fixtures and left the assigned checkout clean at the reported head.

ai:reviewed is earned for this head; comparator batching remains a documented nonblocking follow-up in #62.

[dzykovic]

Verification - PASS

head: 724d75d - steps: 664d0da810197f8387c9b0264d3518c909edea2a283112a9aac912e91cbd0dc0 - env: local (WSL Ubuntu, Bash 5.2.21, native Linux symlinks)

#	Step	Source	Verdict	Expected / observed
1	Run the declared Bash fixture setup and initial bash "$CLI" sync > /dev/null.	PR	pass	Expected success. Setup and sync exited 0; generated relative link target was ../../outside.txt, dangling target was missing.
2	bash "$CLI" sync --check --force; test -L .probe/assets/dangling.	PR	pass	Expected success and preserved dangling link. Observed IS_STATUS=ok IS_DETAIL=generated files are up to date (rendered to compare); link assertion exited 0.
3	Write personal notes, run sync --check --force, and grep -qx '# Personal notes' .agents/skills/README.md.	PR	pass	Expected unchanged notes and success. Observed the same IS_STATUS=ok line; exact notes assertion exited 0.
4	Set mode to file; capture sync --check --force; require exit 2 and test -L .probe/assets/item.	PR	pass	Expected 2 while retaining the generated link. Observed IS_STATUS=out-of-date IS_DETAIL=rendering would change generated files; run 'intelligence sync', RC=2, and link assertion exited 0.
5	IS_SYNC_CHECK="$FIXTURE/unexpected-verdict" bash "$CLI" sync --force; require item no longer a link and no verdict file.	PR	pass	Expected normal rendering despite inherited state. Sync and both assertions exited 0.
6	bash "${CLI%/*}//intelligence" version.	PR	pass	Expected success. Observed 0.20.0 (engine 0.20.0), exit 0.
7	bash "$CLI" status --check.	PR	pass	Expected success. Observed matching schema 0.20.0; agents, claude, codex and probe contract v1; all good., exit 0.
8	Second bash "$CLI" sync > /dev/null; bash "$CLI" sync --check --force.	PR	pass	Expected current output. Both exited 0; observed IS_STATUS=ok IS_DETAIL=generated files are up to date (rendered to compare).
9	bash cli/tests/verify.sh all reports verify ok.	PR	pass	Expected full gate success. Both lint gates and all 19 CLI suites passed, exit 0, final === verify ok ===. Linux-inapplicable Windows junction case and unavailable other-user PID case were explicitly reported; no gate was skipped.
10	The fixture's status --check succeeds and a second sync remains current.	PR	pass	Observed rows 7–8: all good. and IS_STATUS=ok, all exit 0.
11	Adapter formats remain unchanged; managed hand-written siblings are preserved.	PR	pass	Generated .claude/rules/base.md contained description: Verification rule and # Rule; .claude/skills/demo/SKILL.md contained description: "Verification skill" and # Demo. Exact personal-notes assertion passed. All-model adapter rendering and managed-sibling cases also passed in the declared suite.
12	User-facing docs use the established public groups.	PR	pass	Read docs/cli.md: its nine command headings are init, sync, update, upgrade, package, source, adapter, status, registry; added check examples use sync, init and upgrade.
13	Automated regressions in e2e-sync-check, e2e-sync-cache, and unit-manifest cover the declared boundaries.	PR	pass	Observed sync-check: 224 checks passed, sync-cache: 270 checks passed, CLI-UNIT-MANIFEST: ALL OK. Negative cases executed include damaged records, renderer failures, changed executable bits, link-to-file changes, missing output, and refused invalid metadata. Accepted directory-link output roots detected changed physical bytes without writing live targets; external, file and dangling roots were refused. Normalized source diagnostics, external relative adapter inputs, root-link output ancestors, changed generated link spelling and complete warning forwarding also executed.
14	e2e-sync-cache also passes with mawk.	PR	pass	Ran the frozen commit's suite with awk pointing to mawk 1.3.4: sync-cache: 270 checks passed, exit 0.

The exact fixture ran from the assigned checkout. Full gates and the mawk probe used a temporary Linux-native export of that same Git commit, with no code edits. The checkout remained clean at the named head before and after execution. There is no docs/qa-checks.md, so no standing steps were added. The steps digest is SHA-256 of the UTF-8 Verification section content between its heading and ## Versioned artifacts, excluding the headings.

The exact final fixture emitted no false NOT SYNCED: intelligence/rules warning for its configured intelligence/rules/ source.