fix(commands): stop answering questions the caller did not ask

Dogfooding `campaign` + `knowledge-refresh` against a throwaway ledger. Seven
defects, all found by running the commands as written and measuring, not by
reading them.

The headline pair only existed together. `knowledge-refresh` built
`STALE_AFTER="--stale-after 30"` and expanded it unquoted, trusting the shell to
split it in two. bash does; zsh — the macOS default, and what the Bash tool runs
here — does not. The CLI got one argv entry, matched no flag, and because it had
no unknown-flag branch, silently kept the 90-day default and reported "✓ All 14
register entries were re-verified within the last 90 days": a true-sounding
sentence about a threshold the user had just overridden. Fixing either half alone
leaves a silent wrong answer or a loud one; both are fixed, and a guard now
rejects any template that packs a flag and its value into one variable.

`knowledge-refresh` also read one register and wrote another: step 6 named an
unanchored `knowledge/best-practices.json` while the CLI reads
`${CLAUDE_PLUGIN_ROOT}/…`, which for an installed plugin is the cache. The
validation gate then ran the cached test against the cached register — green no
matter what was written. The two copies were byte-identical that day, which is
exactly why it was invisible.

`campaign` vouched for repos it could not read. `add /finnes/ikke` returned
`added` + exit 0; `refresh-tokens` then put the phantom in `swept[]` with a
0-token delta and left `skipped[]` empty, so the machine-wide bill claimed
coverage of three repos on a machine with two. Paths stay tracked — an unmounted
volume is a legitimate absence — but are reported as `addedUnverified`, and the
command names them.

Two class sweeps, both measured rather than assumed. `posture` was the single
scanner (1 of 14) whose fatal catch exited 1, which ux-rules defines as a normal
WARNING grade — a crash indistinguishable from a result. And all 13 payload
writers failed on a `--output-file` whose parent did not exist, which on a fresh
machine turned `campaign`'s first run into "the ledger may be corrupt"; they now
share `scanners/lib/write-output.mjs`.

Predicted breadth was too wide for the first time in five sessions: 6 of 8 CLIs
predicted to lack unknown-flag rejection, 4 measured. `drift` and `fix` already
reject them, via a construct the grep did not recognise — a grep matches an
implementation, the invariant is a behaviour. The sweep was rewritten to run each
CLI with a bogus flag and read the exit code.

Suite 1453 → 1469/0. Frozen snapshots untouched. `optimize-lens-cli` and
`token-hotspots-cli` share the unknown-flag defect and are deferred to the v5.14
argument-handling chunk with their positional-swallow arm; the count is recorded
in the guard rather than rounded down to zero.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012NHWjN8EnoxSqRvMTLK2NE

tests/commands/command-shell-state-shape.test.mjs

@@ -215,3 +215,38 @@ test('state.yaml: phase commands name all four fields the rule requires', async
   }
   assert.deepEqual(violations, [], `Incomplete state.yaml contracts:\n${violations.join('\n')}`);
 });
+
+/**
+ * Session #51 — the instruction that CAUSED the $TODAY defect must not outlive its fix.
+ *
+ * #49 fixed campaign.md by re-deriving `TODAY=$(date +%F)` inside each of the six write
+ * blocks. But step 1 still carried the original prose — "Set a shared date stamp for any
+ * write: `TODAY=$(date +%F)`" — which is not in a fence, cannot set anything, and directly
+ * contradicts the six comments added below it. A template that argues with itself is not a
+ * contract, and the next edit is the one that believes the wrong half.
+ *
+ * The guard above asserts fences; this one asserts that no PROSE line instructs the reader
+ * to establish shell state for later blocks.
+ */
+test('no command template instructs shell state to be set outside a fence', async () => {
+  const offenders = [];
+
+  for (const file of await commandFiles()) {
+    const content = await readFile(resolve(COMMANDS_DIR, file), 'utf-8');
+    const { lines, blockIndexOf } = parseFences(content);
+    lines.forEach((line, i) => {
+      if (blockIndexOf(i) !== -1) return; // inside a fence: that is where state belongs
+      if (/`[A-Z_][A-Z0-9_]*=\$\(/.test(line) || /^\s*[A-Z_][A-Z0-9_]*=\$\(/.test(line)) {
+        offenders.push(`${file}:${i + 1}  ${line.trim()}`);
+      }
+    });
+  }
+
+  assert.deepEqual(
+    offenders,
+    [],
+    'Prose that tells the reader to set a shell variable implies it survives to a later\n' +
+      'block. It does not — every fence is its own process. Delete the instruction; the\n' +
+      'blocks that need the value derive it themselves:\n  ' + offenders.join('\n  '),
+  );
+});