[finding] tests/premerge.test.sh — 2 findings #772

@TheFJK — /premerge flagged a blocker finding on PR #768.

Origin: 2c6db44177351a84156c12e838aceecd76f8713b
Agent: premerge.review.code_review
File: tests/premerge.test.sh:1315
Severity: blocker (Phase premerge)
Disposition: DEFERRED (premerge-repair-budget-exhausted)
Tier: BLOCKER
Blocks: #768

Findings (2)

1. tests/premerge.test.sh:1315 — blocker / BLOCKER / DEFERRED (premerge-repair-budget-exhausted) — P22b's 'nothing appends to the assigned list' guard is anchored to end-of-line, so the realistic bypass shape evades it,

Lenses: premerge.review.code_review

assert_not_in runs grep -qE. Every producer line in that fence is written with a trailing || exit 2, so a bypass added in house style - jq -r '.blocked_on[].file' <blocked-on-01.json >>"$PREMERGE_ASSIGNED_LIST" || exit 2 - does not end the line at the closing quote and is not matched. The P22c anti-vacuity mutant happens to end its append line at the quote, so the mutant matches, P22c prints PASS, and the vacuity check certifies a guard that cannot see the defect it names. The row would go on printing PASS after the security property it guards had been broken.

2. tests/premerge.test.sh:1222 — suggestion / SUGGESTION / DEFERRED (premerge-repair-budget-exhausted) — Nothing compares the producer and consumer spellings of fix-scope-.modified; only the library-side literal is assert

Lenses: premerge.review.code_review

This PR renames the fence's list to fix-scope-$PREMERGE_ATTEMPT_PAD.pending and publishes .modified with an mv after the push. The only coverage is assert_fixed "$LIB" 'fix-scope-%02d.modified' - a grep of the consumer's own format string. Delete or misspell the mv line and _read_repair_scope returns None on every attempt: GROWTH=- forever, STOP_SELF_REFERENTIAL structurally dead - and the suite still prints PASS for every row. This is the 'one contract, N uncompared copies' class; neither side carries a CONTRACT: marker.

To resolve: address the findings above in code and close this issue. Closing resolves exactly the findings listed in this body and the findings added by a later comment on it — one index records both, and closing resolves that recorded set and nothing else. A finding in this file that this issue never recorded is filed as a NEW issue rather than suppressed, so closing never mutes the file. Before closing, apply finding:true-positive if it was a real defect or finding:false-positive if it was not — that label is the eval ground truth (RFC 0018).