pipe-exit-scan: catch the SUBSTITUTION clobber — it fires on 27 real commands, 17 of them mine - #650

…eal commands, 3 of them mine

Closes #375. Its population was defined by the SYNTAX it was first seen in rather than
by the QUESTION it answers — #307's glob-that-did-not-recurse, in a regex.

⛔ THE SPECIMEN, DEVOPS's, verbatim in the fixture rather than reconstructed:

    python3 "$s" --self-test --zzz-not-a-flag >/dev/null 2>&1
    printf "  %-34s rc=%s\n" "$(basename $s)" "$?"

`$(basename $s)` is evaluated FIRST and resets `$?`. Six subjects read as accepting a
bogus flag; the true codes were 2,2,2,2,0,0 — and two of those zeros were real defects.
★ NOTHING IS PIPED, so `pipeline_status_read` structurally cannot see it.

THE VERDICT COMES FROM ORDER, not from the presence of two tokens — same shape as the
pipe predicate it sits beside. ⚠ And the span must CLOSE before the read:

    x=$(foo $?)      the `$?` is INSIDE the span — it is the PREVIOUS command's status
                     and is CORRECT. Flagging it fires on an agent doing the right
                     thing, which this file already calls the worst kind of guard.
    f "$(g)" "$?"    the span closes first — the `$?` is g's. The defect.

⇒ IT FIRES ON REAL COMMANDS. Tracked files: 0 — the tree is clean of this. TRANSCRIPTS:
27 findings across executed commands, and the first three are session 15b69750's own:

    PYTHONDONTWRITEBYTECODE=1 python3 "$t" >/dev/null 2>&1; \
      printf "  %-34s exit=%s\n" "$(basename $t)" "$?"

⇒ I committed the defect I am fixing, at least three times, in the reporter's exact
shape. ⚠ My own session is in the corpus (#296 §5); these three are executed probes
from earlier cycles, not this discussion of them.

CONDITION, all three legs of #375:
  1 ✅ reports `$?` read after a command substitution
  2 ✅ KNOWN-NEGATIVES, four, none firing: `x=$(foo $?)` · `RC=$?` captured before any
      substitution (the report's own stated negative) · a `$RC` printf · `$((1+2)) $?`
  3 ✅ the fixture carries the MEASURED specimen, not a reconstruction

  ⛔ the leg DISCRIMINATES: replacing the span test with `if True` gives 5 findings
     where 2 are expected, and the self-test exits 2. Without the negatives a predicate
     that fired on every `$?` in the repo would pass this leg.

Wired into BOTH call sites — tracked files and transcripts — because a predicate with no
caller is the defect this board has found four times today.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…iew found both halves

Two review findings adopted, one declined with the bash output that decides it.

1. ⛔ THE SHORTCUT HAD BOTH FAILURE DIRECTIONS, and the reviewer named both. The test was
   "did any substitution close before the FIRST `$?`", which is wrong twice:

     printf '%s\n' "$(true)" "$(printf '%s' "$?")"
        the `$?` is INSIDE the second span — it reads the first substitution's status,
        which is what that code MEANS. Reported as a defect. FALSE POSITIVE.

     echo "$(a $?)" "$?"
        the first `$?` sits inside a span, the loop returned on it, and the real read
        outside was never reached. MISSED.

   ⇒ Spans are now RANGES and every `$?` is classified independently: inside a span it
   is the previous status and correct; outside one that closed first, it is the defect.
   Both cases are in the fixture now, as a positive and a negative.

2. ⛔ THE LEG ASSERTED A COUNT AND NOW ASSERTS THE LINES. `len(subst_real) == 2` passes
   when a regression misses one required positive AND fires on one known-negative — two
   errors that cancel. ⇒ `{9, 13, 29}`, and the failure message names which line moved.
   ★ That is #636's lesson applied to a suite: a count cannot be re-verified, a set can.
   Demonstrated — breaking the span-containment test now reports
   `fired on lines [9, 13, 29, 32], expected exactly [9, 13, 29]`, naming line 32.

DECLINED — "track completed substitutions across top-level command boundaries", with the
bash output that settles it:

    value=$(false); printf '%s' "$?"     ->  1    the ASSIGNMENT's own status. CORRECT.
    true; x=$(false); printf '%s' "$?"   ->  1    true's status is gone. THE DEFECT.

⇒ The class is real, and it is NOT MECHANICALLY SEPARABLE from correct code: both are
`<assignment with substitution>; <read>`, and only intent distinguishes them. Flagging it
fires on `value=$(false); echo $?`, which is right — the worst kind of guard by this
file's own stance, six lines above. Named as a bound rather than implemented.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>