feat(scanners): the write gate now runs in code, not in the templates' prose

`write-scope.mjs` has existed since M-BUG-41, but only one writer ever called
it. Measured 2026-08-12: 9 files under `scanners/` write to disk, 1 imported
the gate; 21 command templates, 17 mention a write, 5 call `write-scope-cli`.
Five templates paraphrasing one policy is the shape that put the lever table in
five copies (#61) — one level up.

The defect was never "8 ungated writers = 8 bugs". Four of them write the
plugin's own bookkeeping and must STAY ungated: a gate that fires on every run
gets switched off, and then it guards nothing. The defect is that nothing
declared WHICH, so the question was answered by reading, and answered
differently each time it was asked.

`tests/lib/write-gate-coverage.test.mjs` makes the answer structural: every
writer either imports the gate or holds an EXEMPT entry naming where the bytes
land. Seen RED against today's tree before the fix (4 ungated writers), and
each of its four assertions was separately seen red against its own defect.

Two premises in the plan text were falsified by measuring them first:

  - `scan-orchestrator` was carried as "plugin-managed, legitimately exempt".
    `--save-baseline` derives its path from the SCAN TARGET, so `--global`
    lands `~/.claude/.config-audit-baseline.json` — user-scope, require-ok. It
    is gated. `lib/baseline.mjs` is the genuinely exempt one.
  - the first sweep scored 9 writers with a regex that could not match
    `writeFileSync(`, so `lib/backup.mjs` — a real writer — read as clean. The
    guard covers sync and async forms, strips comments before matching, and
    asserts non-emptiness so a regex that stops matching cannot make every
    other assertion vacuously green (#63, #64).

Gated: fix-engine, rollback-engine, campaign-export-cli, scan-orchestrator.
All five call sites share ONE reduction, `evaluateWriteTargets` — four copies
of classify/strongestGate/dedup is the drift this exists to prevent.

`campaign export` still DISCLOSES rather than refuses: cross-repo is by design
there, and tightening it into a refusal would break the feature. A dry run is
still not a write, so it is never gated (#63). A refusal is a verdict about a
config that WAS examined, so it rides in the payload and keeps the 0/1/2 exit
contract (#62) — and the verdict now reaches the success payload too, since
stderr is discarded by `2>/dev/null` (F3's class).

commands/fix.md carries `--approve-scope` from the answer the user gives, with
the rule stated where it can be read: classifying is not approving.

Dogfooded end to end: a target outside the session root refuses with zero bytes
written, then applies under `--approve-scope`.

Suite 1703 -> 1707/0. Frozen v5.0.0 + default-output snapshots: 0 changed files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pkn22uGCgk6QZA738zNmHL

scanners/fix-cli.mjs

@@ -19,8 +19,8 @@ import { humanizeFinding } from './lib/humanizer.mjs';
 // `--dry-run` is a no-op alias: dry-run is already the default. It exists because
 // commands/fix.md documents it in argument-hint, and a documented flag that the
 // CLI silently drops is the same fail-silent class as the unknown-flag sink below.
-const BOOL_FLAGS = ['--apply', '--dry-run', '--json', '--raw', '--global'];
-const VALUE_FLAGS = ['--output-file'];
+const BOOL_FLAGS = ['--apply', '--dry-run', '--json', '--raw', '--global', '--approve-scope'];
+const VALUE_FLAGS = ['--output-file', '--repo'];
 
 async function main() {
   const args = process.argv.slice(2);
@@ -30,6 +30,12 @@ async function main() {
   let rawMode = false;
   let includeGlobal = false;
   let outputFile = null;
+  let approveScope = false;
+  // The session's root, never the scan target (#63). `--global` fixes files
+  // under `~/.claude` while the session still stands somewhere else, so reading
+  // the root off the target would classify a machine-wide write as "in-repo"
+  // and silence the strongest gate exactly where it matters.
+  let repoRoot = process.cwd();
 
   // Same defect class as M-BUG-21 in drift-cli: this loop used to end in
   // `else if (!args[i].startsWith('-')) targetPath = args[i]` with no
@@ -44,13 +50,15 @@ async function main() {
       else if (arg === '--json') jsonMode = true;
       else if (arg === '--raw') rawMode = true;
       else if (arg === '--global') includeGlobal = true;
+      else if (arg === '--approve-scope') approveScope = true;
       // --dry-run: default behaviour, accepted so it is not silently dropped.
     } else if (VALUE_FLAGS.includes(arg)) {
       const value = args[i + 1];
       if (value === undefined || value.startsWith('-')) {
         throw new Error(`Option ${arg} requires a value.`);
       }
-      outputFile = value;
+      if (arg === '--repo') repoRoot = value;
+      else outputFile = value;
       i++;
     } else if (arg.startsWith('-')) {
       throw new Error(
@@ -134,6 +142,12 @@ async function main() {
   let verified = [];
   let regressions = [];
   let backupId = null;
+  // The engine's scope verdict, carried out to the payload. A `disclose` class
+  // writes without withholding anything, so the ONLY place the command can
+  // learn that a write left the project is here — stderr is discarded by
+  // `2>/dev/null` (ux-rules rule 2), which is F3's defect class.
+  let scopeGate = null;
+  let scopeDisclosures = [];
 
   if (fixes.length === 0) {
     const output = { planned: [], applied: [], failed: [], verified: [], regressions: [], manual, backupId: null };
@@ -159,9 +173,43 @@ async function main() {
       process.stderr.write(` Applying ${fixes.length} fixes...\n\n`);
     }
 
-    const result = await applyFixes(fixes, { dryRun: false, backupDir: backup.backupPath });
+    const result = await applyFixes(fixes, {
+      dryRun: false,
+      backupDir: backup.backupPath,
+      repoRoot,
+      approveScope,
+    });
     applied = result.applied;
     failed = result.failed;
+    scopeGate = result.gate ?? null;
+    scopeDisclosures = result.disclosures ?? [];
+
+    // A refused set is a verdict about a config that WAS examined, not a tool
+    // failure — so it rides in the payload and keeps the normal exit contract
+    // (#62). Anything a command must act on has to reach it through
+    // `--output-file`; stderr alone is invisible to the command layer (F3).
+    if (result.requiresApproval && result.refused.length > 0) {
+      const payload = {
+        status: 'refused',
+        reason: 'scope-gate',
+        gate: result.gate,
+        requiresApproval: true,
+        disclosures: result.disclosures,
+        refused: result.refused,
+        backupId,
+      };
+      const json = JSON.stringify(payload, null, 2) + '\n';
+      if (machineMode) process.stdout.write(json);
+      if (outputFile) await writeOutputFile(outputFile, json, 'utf-8');
+      if (!machineMode) {
+        for (const line of result.disclosures) process.stderr.write(`\n ${line}\n`);
+        process.stderr.write(
+          `\n Refused ${result.refused.length} fix(es) pending your go-ahead.`
+          + ' Re-run with --approve-scope to apply them.\n',
+        );
+      }
+      return;
+    }
 
     if (!machineMode) {
       process.stderr.write(` Results: ${applied.length} applied, ${failed.length} failed\n`);
@@ -235,6 +283,8 @@ async function main() {
         recommendation: m.recommendation,
       })),
       backupId,
+      gate: scopeGate,
+      disclosures: scopeDisclosures,
     };
     const serialized = JSON.stringify(output, null, 2) + '\n';
     if (machineMode) process.stdout.write(serialized);