fix: three more measured false positives, all reported the same day v0.1.2 shipped

- extractChangelogTop truncated PEP 440 pre-release versions (0.5.0a2 -> 0.5.0),
  so VERSION-CHANGELOG disagreed with VERSION-TAG over a version everything
  already agreed on. Reported by llm-ingestion-okf with a repro.
- BADGE-STATIC-CLAIM treated a bare `status` badge as a run claim, same as
  tests/build/CI. A self-declared maturity label asserts no run, same class
  as version/licence/platform. Reported by llm-ingestion-pipeline-security.
- BOILERPLATE flagged FIXME when a scanner's own docs named the TODO/FIXME
  convention rather than an instance of it. Reported by config-audit.

92 tests green, up from 86.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uwwfdmrfnp7FuGQ4z25RKH

scripts/repo-standard-check.test.mjs

@@ -28,6 +28,7 @@ import {
   classifyRepo,
   levelOf,
   parseRepoNameFromRemote,
+  extractChangelogTop,
 } from './repo-standard-check.mjs';
 
 const REGISTER = {
@@ -490,6 +491,22 @@ test('a released version with no matching tag is an ERROR', () => {
   assert.equal(f.some((x) => x.level === 'ERROR' && x.code === 'VERSION-TAG'), true);
 });
 
+// Reported by llm-ingestion-okf (coord, 2026-08-03): a PEP 440 pre-release
+// (`0.5.0a2`) matches the manifest and the tag exactly, but the CHANGELOG
+// extractor truncated it to `0.5.0` — the only way to reach 0 ERROR would have
+// been to announce a release that never happened.
+test('extractChangelogTop keeps a PEP 440 pre-release suffix, not just X.Y.Z', () => {
+  assert.equal(extractChangelogTop('## [0.5.0a2] - 2026-07-31'), '0.5.0a2');
+  assert.equal(extractChangelogTop('## [0.1.1] — 2026-08-03'), '0.1.1');
+});
+
+test('a PEP 440 pre-release version agrees with its own CHANGELOG heading', () => {
+  const f = checkVersionConsistency({
+    pluginVersion: '0.5.0a2', readmeBadge: '0.5.0a2', changelogTop: extractChangelogTop('## [0.5.0a2] - 2026-07-31'), tags: ['v0.5.0a2'],
+  });
+  assert.equal(f.some((x) => x.level === 'ERROR'), false);
+});
+
 // -------------------------------------------------------- required headings
 
 test('required headings are per class — Non-goals is required, not optional', () => {
@@ -530,6 +547,22 @@ test('a build badge that links to a real run is fine', () => {
   assert.equal(checkBadges({ readme }).filter((f) => f.level !== 'OK').length, 0);
 });
 
+// Reported by llm-ingestion-pipeline-security (coord, 2026-08-03): a bare
+// `status` badge is a self-declared maturity label ("alpha", "experimental"),
+// the same class as version/licence/platform, which already assert no run —
+// not a run claim like "build status" or "CI status".
+test('a static maturity-status badge asserts no run, unlike build/CI status', () => {
+  const f = checkBadges({ readme: '![Status](https://img.shields.io/badge/status-alpha-orange)' });
+  assert.equal(f.some((x) => x.code === 'BADGE-STATIC-CLAIM'), false);
+});
+
+test('a build- or CI-status badge is still caught — only bare "status" was too wide', () => {
+  const build = checkBadges({ readme: '![Build Status](https://img.shields.io/badge/build-passing-green)' });
+  assert.equal(build.some((x) => x.code === 'BADGE-STATIC-CLAIM'), true);
+  const ci = checkBadges({ readme: '![CI Status](https://img.shields.io/badge/ci-passing-green)' });
+  assert.equal(ci.some((x) => x.code === 'BADGE-STATIC-CLAIM'), true);
+});
+
 // -------------------------------------------------------------- boilerplate
 
 test('unfinished template text is a finding', () => {
@@ -540,6 +573,27 @@ test('unfinished template text is a finding', () => {
   assert.equal(g.some((x) => x.code === 'BOILERPLATE'), true);
 });
 
+test('a lone FIXME with no TODO alongside is still caught', () => {
+  const f = checkBoilerplate({ files: { 'NOTES.md': 'FIXME: handle the null case here.' } });
+  assert.equal(f.some((x) => x.level === 'WARN'), true);
+});
+
+// Reported by config-audit (coord, 2026-08-03): a scanner whose JOB is to find
+// TODO/FIXME markers in OTHER repos names its own detection target in its own
+// docs — prose and a table row, neither wrapped in backticks. "TODO/FIXME"
+// named together is the convention itself, not a forgotten instance of one.
+test('"TODO/FIXME" named together as the convention is not a live marker', () => {
+  const listItem = checkBoilerplate({
+    files: { 'agents/scanner-agent.md': "- Flag TODO/FIXME markers that haven't been addressed" },
+  });
+  assert.equal(listItem.some((x) => x.level === 'WARN'), false);
+
+  const tableRow = checkBoilerplate({
+    files: { 'knowledge/anti-patterns.md': '| 5 | TODO/FIXME comments in CLAUDE.md | CA-CML-005 | low |' },
+  });
+  assert.equal(tableRow.some((x) => x.level === 'WARN'), false);
+});
+
 test('ordinary prose is not boilerplate', () => {
   const f = checkBoilerplate({ files: { 'README.md': 'This project solves a real problem.' } });
   assert.equal(f.filter((x) => x.level !== 'OK').length, 0);