Audit fixes: close two confident-false-green paths and 13 related defects

[inth3shadows]

Summary

This PR fixes the findings from a module-by-module audit of testgraph (2026-10-08). For every finding below, two separate agents either reproduced it independently or both found it. Each fix is its own commit with a regression test, and each test was confirmed to fail on the old code.

Critical: the tool printed a green it could not back up

• C1, select. The diff parser only recognised +++ b/… headers. When the user's git config set diff.noprefix=true or color.diff=always, or a changed file's name had a non-ASCII character, a space or a quote, that file was silently dropped. The output was then "journeys to test: NONE (no product-behavior change detected)". Git's output format is now pinned regardless of user config (--no-color --src-prefix=a/ --dst-prefix=b/ -c core.quotePath=false --no-ext-diff --no-textconv). Quoted paths are decoded. Every diff --git block now resets the parser state, so a header it can't read no longer gives its hunks to the previous file. A block with no readable header is reported as unparseable instead of being dropped. A mode-only change (chmod) is ignored.
• C2, verify. It exited 0 ("every selected journey ran and passed") in four cases: a journey whose only test was skipped or xfailed inside its body; a declared test that failed before reaching an entry; a test that errored in setup; and a test whose JUnit verdict didn't match its trace (that journey was also missing from the report). Now a journey counts as verified only if it is credited pass. Any failing declared test fails every journey it declares. Skipped or verdict-less journeys exit 3, and are reported on their own ! ran, but not a pass line. An abnormal pytest exit can no longer produce 0.

High

• M2. base/head were passed to git as possible options. Through the MCP tool, --output=… emptied a file chosen by the caller and still returned a clean NONE. Now --end-of-options is passed, revisions starting with - are refused before any git call, and ledger.resolve_commit refuses them too.
• H1. verify used strict_registry=False, a mode TECHNICAL.md reserves for analysing history. A registered journey that could never be selected became a warning under exit 0. It is now refused (exit 2).
• M5. The pre-push hook hard-defaulted a new branch's base to main. In a master repo, a multi-commit first push was diffed over its tip only, with no warning. It now tries wt.base, then origin/HEAD, main, master and the origin/ variants.
• H4. _join_key split on :: before splitting off [params], unlike pytest. A test like test_p[a::b] lost its verdict, which fed C2.
• H5. An unapproved proj.draft.json sorted before the approved proj.json and replaced it. An approved registry now wins within a directory; a lone draft still runs, loudly, as before.
• H6. propose crashed when one file had two decorated Python handlers with the same name. They are now merged, as TypeScript hits already were.

Medium

• H2. export defaulted to honeyslate's registry and a personal path. It now finds the registry by target the same way select does, and refuses when there is none. --repo defaults to . in both commands.
• H3. The hook depended on GNU timeout, which stock macOS doesn't have, and threw away stderr, so the hook silently did nothing there. It now uses a portable POSIX-sh watchdog that prints a heartbeat every 5 s and kills the run at the limit, and it shows the first stderr line when the selector crashes. It still always exits 0. Ctrl-C skips the step that is running.
• M1. resolve_symbol matched with LIKE '%suffix': no directory boundary, case-insensitive, and _/% acting as wildcards. That inflated the integrity spot-checks. Matching now respects directory boundaries and case.
• M4. CI ran on 3.11 only. It now runs a 3.11–3.13 matrix, plus a job with pytest installed. That job has nothing pytest-specific to run yet; CI: add an end-to-end verify test that drives real pytest + tgtrace #114 tracks the end-to-end test it needs.
• M6. sqlite connections are now closed deterministically, which makes the MCP docstring's claim true.
• M10. On 3.11 the tracer missed worker threads; it now also calls threading.setprofile.
• M11. Skill docs: the registry path is now under .testgraph/journeys/, the skill also lists untracked new files, and the "NONE is trustworthy" rule now includes the unapproved-registry case.

Not in this PR

• Verified findings deferred because they change how the measurement tools reason: reconcile: strict oracle labels real edges phantom-confirmed for common call shapes #95–harness/journey_tests_testgraph.json has no tests mapped to J7 or J8 #103.
• Single-source leads labelled needs-verification: propose: module-level 'use server' hidden by a multi-line /* */ header #104–verify render: NONE line may read as clean when select's unknown_because is set #113 and reconcile / ground_truth pass only the file basename to resolve_symbol #115.
• CI end-to-end gap: CI: add an end-to-end verify test that drives real pytest + tgtrace #114.

Testing

• python3 -m unittest discover -s tests: 477 tests OK on Python 3.11, 3.12 and 3.13, and in a venv with pytest installed (422 tests before this PR).
• New tests/test_pre_push.py runs the real hook script under sh, dash and bash, with no timeout on PATH.
• No release label is set, so merging does not publish.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Gsh2XjQprosodq2YbgyFQa

---

Generated by Claude Code