test(pril): codify C4 gitignored-exemption in suite; fix shellcheck findings in ported TDD specs

merge-when-true gate findings on PR #95, closed instead of waived:

- C4 behavior had only manual verification — now 7 suite assertions in
  test_runtime_integrity_layer.sh against a real dynamic git fixture:
  exempt+visible-NOTE, non-ignored file still blocks, violation names the
  real file, tracked-but-ignore-matching never exempted, --strict-gitignored
  re-blocks
- shellcheck: SC2317/SC2329 directives on indirectly-invoked helpers
  (is_deny/hook_out, called via assert's eval), drop genuinely-unused
  out1/rc2 captures in test_reality_wired_in_prod.sh

Full suite local (with shellcheck installed): ALL CHECKS PASSED.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: BenPerro

config/claude/tests/test_pretool_wait_state_hook.sh

@@ -55,13 +55,15 @@ run_hook() { # run_hook <project> <stdin-json>
 }
 # A genuine deny: decision=="deny" OR a deliberate non-zero from an EXISTING hook
 # (1 or 2). 255 = "hook absent" sentinel, 127 = bash missing-file: NOT a deny.
+# shellcheck disable=SC2317,SC2329  # invoked indirectly via assert's eval'd condition string
 is_deny() { # is_deny "<decision>|<rc>"
   local d="${1%%|*}" rc="${1##*|}"
   [ "$d" = "deny" ] && return 0
   { [ "$rc" = "1" ] || [ "$rc" = "2" ]; } && return 0
   return 1
 }
 # Capture the hook's stdout text for stop-code assertions (empty when absent).
+# shellcheck disable=SC2317,SC2329  # invoked indirectly via command substitution inside assert args
 hook_out() { # hook_out <project> <stdin-json>
   local project="$1" payload="$2"
   [ ! -f "$HOOK" ] && { printf ''; return; }

config/claude/tests/test_reality_wired_in_prod.sh

@@ -45,7 +45,7 @@ assert_file "A0: reality-check binary present" "$REALITY"
 # A1 (positive control / gap exposure): plain mode currently PASSES a not-wired
 # record. This assertion PASSES today and documents the hole.
 set +e
-out1="$("$REALITY" --repo "$repo" --feature "$FEAT" --min-evidence integration 2>&1)"; rc1=$?
+"$REALITY" --repo "$repo" --feature "$FEAT" --min-evidence integration >/dev/null 2>&1; rc1=$?
 set -e
 assert_eq "A1 gap: plain reality-check currently PASSES the not-wired record (exit 0)" "0" "$rc1"
 
@@ -54,7 +54,7 @@ assert_eq "A1 gap: plain reality-check currently PASSES the not-wired record (ex
 # name is a placeholder for the fix; the load-bearing assertions are the
 # STOP-WIRED-PROD behaviour and naming the culprit REQ, not the exact CLI).
 set +e
-out2="$("$REALITY" --repo "$repo" --feature "$FEAT" --min-evidence integration --require-wired 2>&1)"; rc2=$?
+out2="$("$REALITY" --repo "$repo" --feature "$FEAT" --min-evidence integration --require-wired 2>&1)"
 set -e
 assert_contains "A2 RED: wired-enforcing rejection carries stop-code STOP-WIRED-PROD" "$out2" "STOP-WIRED-PROD"
 assert_contains "A2 RED: rejection names the not-wired requirement (REQ-X1)" "$out2" "REQ-X1"

config/claude/tests/test_runtime_integrity_layer.sh

@@ -163,6 +163,42 @@ assert_output_contains "broad [a-z]* scope error names too-broad pattern" "too b
 assert_exit "literal-anchored glob-class scope still passes" 0 \
   "$SCOPE_BIN" --repo "$FIXTURES/scope-broad-literalclass" --feature demo --changed-files "$FIXTURES/scope-broad-literalclass/changed-files.txt"
 
+# C4 (2026-07-08 retro): paths that are BOTH gitignored AND untracked are
+# session-tooling droppings (e.g. `.claude-flow/` daemon state), not feature
+# edits — they are exempted with a visible NOTE instead of false-positiving the
+# gate. Tracked files are never exempted; `--strict-gitignored` restores the old
+# behavior. Needs a REAL git repo (check-ignore), so this fixture is built
+# dynamically instead of living under fixtures/.
+C4_REPO="$(mktemp -d)"
+git -C "$C4_REPO" init -q -b main
+mkdir -p "$C4_REPO/docs/canvas" "$C4_REPO/src/demo" "$C4_REPO/.claude-flow"
+cp "$FIXTURES/scope-pass/docs/canvas/demo.canvas.md" "$C4_REPO/docs/canvas/demo.canvas.md"
+printf '.claude-flow/\n' > "$C4_REPO/.gitignore"
+printf 'runtime\n' > "$C4_REPO/.claude-flow/daemon.pid"
+printf 'ok\n' > "$C4_REPO/src/demo/app.py"
+printf '.claude-flow/daemon.pid\nsrc/demo/app.py\n' > "$C4_REPO/changed-dropping.txt"
+assert_exit "C4: gitignored+untracked dropping is exempted (pass)" 0 \
+  "$SCOPE_BIN" --repo "$C4_REPO" --feature demo --changed-files "$C4_REPO/changed-dropping.txt"
+C4_NOTE_OUT="$("$SCOPE_BIN" --repo "$C4_REPO" --feature demo --changed-files "$C4_REPO/changed-dropping.txt" 2>&1)"
+assert_contains "C4: exemption is visible (NOTE names the dropping)" "$C4_NOTE_OUT" ".claude-flow/daemon.pid"
+assert_contains "C4: exemption is labeled as tool artifacts, not silent" "$C4_NOTE_OUT" "NOTE: ignoring gitignored+untracked tool artifacts"
+# A real out-of-scope file (untracked but NOT gitignored) must still block.
+printf 'nope\n' > "$C4_REPO/rogue.py"
+printf '.claude-flow/daemon.pid\nrogue.py\n' > "$C4_REPO/changed-rogue.txt"
+assert_nonzero "C4: non-ignored out-of-scope file still blocks" \
+  "$SCOPE_BIN" --repo "$C4_REPO" --feature demo --changed-files "$C4_REPO/changed-rogue.txt"
+assert_output_contains "C4: violation names the real file, not the dropping" "rogue.py" \
+  "$SCOPE_BIN" --repo "$C4_REPO" --feature demo --changed-files "$C4_REPO/changed-rogue.txt"
+# A TRACKED file matching a gitignore pattern is a real edit — never exempted.
+git -C "$C4_REPO" add -f .claude-flow/daemon.pid -- >/dev/null 2>&1
+assert_nonzero "C4: tracked-but-ignore-matching file is NOT exempted" \
+  "$SCOPE_BIN" --repo "$C4_REPO" --feature demo --changed-files "$C4_REPO/changed-rogue.txt"
+git -C "$C4_REPO" rm -q --cached .claude-flow/daemon.pid >/dev/null 2>&1
+# --strict-gitignored restores the old fail-closed behavior for droppings.
+assert_nonzero "C4: --strict-gitignored re-blocks the dropping" \
+  "$SCOPE_BIN" --repo "$C4_REPO" --feature demo --changed-files "$C4_REPO/changed-dropping.txt" --strict-gitignored
+rm -rf "$C4_REPO"
+
 # G2-REQ-002: redaction rejects unsafe persistence and can produce a safe redacted stream.
 assert_exit "redaction safe JSONL check exits 0" 0 \
   "$REDACT_BIN" --mode check < "$FIXTURES/redaction/safe.jsonl"