fix: round 7 of the release review of 6.3.0, for 6.3.1

Round 7 (516dffa..45aa9e1, WARN: 12 MAJOR, 0 BLOCKER) and the fence defect
found while writing its review.md. Each fix began with a test that failed on
0f400d3 (v6.3.0); suite 2208 (2206/0/2), 14 tests more.

- Tests-only (operator 2026-10-11): the plan's Files: alone decides, and the
  text says so (red-proof, trekexecute Sub-step B, step-implementer,
  HANDOVER-CONTRACTS). red-proof no longer reads the step's diff, so a change
  already in the tree when the step began no longer counts against it, and a
  plan placed outside .claude/ reads the same. The round-6 test that had the
  diff overrule the plan is rewritten to the new rule.
- The Files: reader keeps a plain file beside a backticked path
  (", Dockerfile", "the CLI entry src/cli.mjs", "and Makefile"). Measured on
  the 520 Files: fields in 182 plans: no field reads differently.
- Red proof reports a command its timeout killed as killed after the timeout,
  not "could not start"; the release check tells a timeout from output past
  its buffer and from another signal. One reading of a stop
  (criteria-runner stoppedBy) for red proof, the criteria runner and the
  release check.
- A trailing `# comment` is dropped in a backticked check too, and in a
  command passed as written, so the words screened are the words run.
- The release check reads a relative --review in --repo.
- The 15-minute timeout is defined once (criteria-runner.mjs).
- The findings check reads each cited file once per validation.
- One isMain helper (lib/util/is-main.mjs) for every CLI: the 31 copies of
  the realpath guard and the 20 modules still on the file:// guard, which
  exited 0 having done nothing under a symlink or a path with a space.
- The Bash guard writes its no-one-to-ask refusal once, on a direct condition.
- The findings check ends a ```json block only at a fence on its own line, so
  three backticks inside a JSON string no longer end it (also in 6.2.0).
- Brief-conformance notes: a test for test-lock green on exit 127 (it
  passed at once; it fails when 127 is read as could-not-run); the prose now
  names the git revision `@~1` as the one leading-@ exception.

Not changed: the example plan's steps 1-2 keep their tests-only warning
(operator decision 2026-10-09; the r5 test records it). Brief note 4 (a
Regression: whose runner is not installed goes to the fix rounds) is a
routing question for the operator.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hooks/scripts/pre-bash-executor.mjs

@@ -218,20 +218,27 @@ if (!command || typeof command !== 'string') {
 }
 
 // In the permission mode where Claude Code shows no prompts, an "ask" reaches
-// no one and the call runs unattended (see the refusal below).
+// no one and the call runs unattended (see the refusals below).
 const NO_PROMPT_MODE = 'bypassPermissions';
 const noOneToAsk = input.permission_mode === NO_PROMPT_MODE;
 
+// The one refusal text for "no one to ask", with the way forward (release
+// review of 6.3.0, round 7: it was written out twice).
+function refuseUnattended(what, commandLine, way) {
+  process.stderr.write(
+    `[voyage] BLOCKED: ${what} with no one to ask\n` + commandLine +
+    '  This session runs in the permission mode where Claude Code asks nothing, so the guard cannot ask a person. ' +
+    `Way forward: ${way}\n`
+  );
+  process.exit(2);
+}
+
 if (loadError) {
   // A guard that cannot read its rules asks about every command; where no one
   // can be asked it refuses instead (release review of 6.3.0, 2026-10-10).
   if (noOneToAsk) {
-    process.stderr.write(
-      `[voyage] BLOCKED: Voyage's Bash guard could not load its rules (${loadError.message}) and there is no one to ask\n` +
-      '  This session runs in the permission mode where Claude Code asks nothing, so the guard cannot ask a person. ' +
-      'Way forward: reinstall Voyage to restore the guard, or run the command yourself.\n'
-    );
-    process.exit(2);
+    refuseUnattended(`Voyage's Bash guard could not load its rules (${loadError.message})`, '',
+      'reinstall Voyage to restore the guard, or run the command yourself.');
   }
   process.stdout.write(JSON.stringify({
     hookSpecificOutput: {
@@ -295,15 +302,10 @@ try {
 // decisions 2026-10-09: first merge and push, then the other two classes).
 // /trekexecute relies on this: its main-merge gate is a lock, and this guard's
 // question is the one question.
-const unattended = noOneToAsk ? approvals : [];
-if (unattended.length > 0) {
-  process.stderr.write(
-    `[voyage] BLOCKED: ${unattended.map((m) => m.name).join(', ')} with no one to ask\n` +
-    `  Command: ${normalized.slice(0, 200)}${normalized.length > 200 ? '...' : ''}\n` +
-    '  This session runs in the permission mode where Claude Code asks nothing, so the approval guard ' +
-    'cannot ask a person. Way forward: run the command yourself, or switch to a mode that asks, then retry.\n'
-  );
-  process.exit(2);
+if (noOneToAsk && approvals.length > 0) {
+  refuseUnattended(approvals.map((m) => m.name).join(', '),
+    `  Command: ${normalized.slice(0, 200)}${normalized.length > 200 ? '...' : ''}\n`,
+    'run the command yourself, or switch to a mode that asks, then retry.');
 }
 
 if (approvals.length > 0) {