The local NOW preview says OK where the required check context says FAIL -- two conditions previewed by nothing #5402

Re-filed from #2994. An attempt claimed that issue on 2026-09-24 and left an empty branch, and a dispatch row that has spent its retry ceiling keeps its issue for good - so no bee could take it again, however much the brief improved. The work below is carried over unchanged.

The local NOW preview says OK where the required check context says FAIL

docs/now/README.md documents three conditions — presence, freshness, and
"at least one Markdown heading and at least one bullet" — and then says:

The same three conditions are previewed locally by scripts/verify.sh and
enforced before commit by .githooks/pre-commit, scripts/pre-commit,
t27c check-now, and tri hooks now-gate.

tools/check_now_entry_shape.py enforces two more, and it is run by the
required check context (check-now-freshness.yml):

• the first line must be # NOW -- <title> (YYYY-MM-DD)
• there must be a ## section heading

Both are documented in the script's own docstring (lines 29–33) and in no file a
contributor reads.

Measured

A docs/now/ entry committed in the wrong shape — a plain # Title first line
and one long bullet, which satisfies every condition the README lists:

Note the second column of the first two rows: they name a different entry than
the one the change adds. They answer is the newest entry by filename date
fresh, which is a question about the tree; the blocking gate asks is the entry
this diff ADDS well formed, which is a question about the change. Two
populations, one label.

Cost, paid

This made check red on #2991 — a required context, on a pull request whose
NOW entry satisfied every condition its own README states. The repair was to
copy the shape out of a neighbouring entry, which is not what a documented gate
should require.

Two repairs, and they are not the same

1. Cheapest and honest: docs/now/README.md states all five conditions and
   says which instrument enforces which. The sentence claiming the local tools
   preview "the same three conditions" comes out, because they do not preview
   the two that block.
2. Better: the local preview asks the blocking gate's question — the entry
   the diff ADDS, in the shape the required context requires — so a green
   scripts/verify.sh means the same thing as a green check. That is the
   difference between a preview and a different check with a similar name.

Neither is mine to choose: (2) changes what four local tools do, and this
repository's own log records that a preview which disagrees with its gate is
worse than no preview.

Refs #2961

Boundary

• scripts/verify.sh
• tools/check_now_entry_shape.py

The instruments

Every one of these reads and prints; none of them writes. Run them from the repository root, with <spec> replaced by the file in ## Boundary:

.t27 is not Rust and not Zig, and a bee fluent in either writes one by
accident. Measured 2026-09-20: a bee filled eight bodies in
specs/file/watcher.t27 with return Ok(());, Err(FileError::WatcherNotFound)
and for i in 0..watchers.length. The parse ratchet refused the whole file --
Unexpected token in expression: RParen, line 123 -- and a spec that does not
parse generates nothing, so every test it already carried stopped running.

At the top level the parser accepts exactly these eight forms, with an optional
pub, and no others:

const   var   fn   enum   struct   test   invariant   bench

There is no trait, no impl, no type X = ..., no generics, no macro. What
a bee reaches for from another language, and what happens:

• Rust's result sugar (Ok(()), Err(E::V), ?) is not a construct here.
• Rust macros (println!, format!, vec!) are not constructs here.
• A range loop (for i in 0..n) is Rust and Zig, not this language.
• Zig builtins (catch unreachable, @intCast, @constCast) are not constructs here.
• Cross-module reuse (use other::fn;) parses and then generates a comment and an unqualified call, so the Zig fails with use of undeclared identifier (use a::b; generates no import, so no spec can reuse a function from another spec #4298). It does not work yet.

t27c parse <spec> answers in one line whether what you wrote is the language.
Run it before you report, every time.

• t27c spec-status <spec> - the compiler's one-word verdict: IMPLEMENTED, PARTIAL, UNWRITTEN, NOPARSE, NOFN. Exit code is 0 whatever it says, so read the word.
• t27c symbols <spec> - every name the file declares, with its kind. Answers "does this already exist here?" before you add it.
• t27c outline <spec> - per function: its locals, what it calls, what it returns. The contract you are implementing against.
• t27c coverage <spec> - which functions have a test and which do not. The issue asks for tests; this is how you check you wrote them.
• t27c lint <spec> - style and shape warnings. It OVER-REPORTS has no test or invariant: measured 2026-09-20 over 60 specs it printed 677 of those where coverage found 190 untested functions, disagreeing on 59 of the 60 - it warns about bit_to_trit_pair in specs/base/ternary_encoding.t27, which test bit_to_trit_pair_zero calls on line 249. Read it as a hint; coverage is the answer.
• t27c typecheck <spec> - types, before generation. Prints Typecheck OK (0 errors, 0 warnings) or the errors.
• t27c test-report <spec> - builds this spec and runs its own tests, which is what the oracle does. BLOCKED means the generated Zig does not compile, with the error beside it.
• python3 tools/dupe_scan.py --name <function> - where that function already lives, if it does. 576 of 4021 bodies here are byte-identical copies.

The rest of the toolbelt is in docs/BEE_TOOLBELT.md.