[cahenesy]

Implements TDD 0074: tdd-lint workspace grounding and no deferred discovery (PRD FR-106, FR-107; refs #195). Plugin 3.55.0 → 3.56.0.

Stacked on #200 (TDD 0073). Merge #200 first; auto-delete retargets this PR to master.

What it adds

• md_bullet_path … marked. A new mode that prints <path>\t(new) or <path>\t-. It uses the same extraction as paths, which is byte-identical across all 75 TDDs.
• tl_lint_grounding (in tl_lint_all). For TDDs not yet on the integration branch:
  • every Touched-files path must exist there (git -C <root> ls-tree <ref> -- <path>, literal pathspecs) or carry (new);
  • paths with .. or a leading / are reported as grounding.invalid;
  • with no integration branch it falls back to HEAD and says so in the finding;
  • outside git, or with no commits, it skips with a stderr note;
  • any git or extractor failure is rc 2, never a clean result.
• Deferred-discovery phrases. Phrases such as "locate the caller" or "determined during implementation" are blocking placeholder.deferred_discovery findings outside fences. Backtick skipping applies to these new phrases only.
• /tdd-author documents the (new) marker and the new finding codes.

Gates (run 20261012-165626)

Gate	Result
test-first	PASS
ci-checks	PASS (tdd-grounding 28/0; ux-pipeline 61, md-parser 34, bounded-tdd-scope 38, token-spend-reduction 40)
runtime-verify (sonnet)	PASS: obs 1–10. Identical exit codes and stdout to master's tdd-lint on all 75 existing TDDs (54×0, 3×1, 18×2). A git failure gives rc 2. Planted ux.sh/verdicts.sh in the linted repo never run
review	PASS (security checklist): no argument injection (--), traversal flagged, sourcing pinned to the plugin's own directory

Also fixed in this PR

• TDD 0072 sourcing hazard (0e2012d test, fe52be3 fix). tl_lint_ux_citations resolved its lib directory relative to the current directory when it ran. If tdd-lint was sourced by a relative path and the caller then changed into another repo, it sourced that repo's scripts/lib/ux.sh. It now resolves the directory once, absolutely, when the file is sourced. This is the same class of bug as N1 in the 0073 review; the reviewer judged it in scope here.
• Review N2 (026146d test, e300bd3 + 526943a). Grounding now uses GIT_LITERAL_PATHSPECS=1. Before, a Touched-files path like :/x or :(glob)x was interpreted as git pathspec magic: it could pass a wrong path, or fail with a misleading rc 2 that blamed git. Gates were re-recorded on the new HEAD.

Non-blocking residuals

• Two identical lib-dir computations in tdd-lint.sh should be merged into one.
• A finding's line number comes from a substring match, so only the line number can be wrong.
• Test [S1] has no positive control.
• The obs-7/8 baseline pins commit 4f217b3, so those checks fail loudly in a shallow clone.
• The diff is over estimate but within tolerance.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NpGG21Y2VGGhTQaFr4oshB