fix: round 7 of the release review of 6.3.0, for 6.3.1

Round 7 (516dffa..45aa9e1, WARN: 12 MAJOR, 0 BLOCKER) and the fence defect
found while writing its review.md. Each fix began with a test that failed on
0f400d3 (v6.3.0); suite 2208 (2206/0/2), 14 tests more.

- Tests-only (operator 2026-10-11): the plan's Files: alone decides, and the
  text says so (red-proof, trekexecute Sub-step B, step-implementer,
  HANDOVER-CONTRACTS). red-proof no longer reads the step's diff, so a change
  already in the tree when the step began no longer counts against it, and a
  plan placed outside .claude/ reads the same. The round-6 test that had the
  diff overrule the plan is rewritten to the new rule.
- The Files: reader keeps a plain file beside a backticked path
  (", Dockerfile", "the CLI entry src/cli.mjs", "and Makefile"). Measured on
  the 520 Files: fields in 182 plans: no field reads differently.
- Red proof reports a command its timeout killed as killed after the timeout,
  not "could not start"; the release check tells a timeout from output past
  its buffer and from another signal. One reading of a stop
  (criteria-runner stoppedBy) for red proof, the criteria runner and the
  release check.
- A trailing `# comment` is dropped in a backticked check too, and in a
  command passed as written, so the words screened are the words run.
- The release check reads a relative --review in --repo.
- The 15-minute timeout is defined once (criteria-runner.mjs).
- The findings check reads each cited file once per validation.
- One isMain helper (lib/util/is-main.mjs) for every CLI: the 31 copies of
  the realpath guard and the 20 modules still on the file:// guard, which
  exited 0 having done nothing under a symlink or a path with a space.
- The Bash guard writes its no-one-to-ask refusal once, on a direct condition.
- The findings check ends a ```json block only at a fence on its own line, so
  three backticks inside a JSON string no longer end it (also in 6.2.0).
- Brief-conformance notes: a test for test-lock green on exit 127 (it
  passed at once; it fails when 127 is read as could-not-run); the prose now
  names the git revision `@~1` as the one leading-@ exception.

Not changed: the example plan's steps 1-2 keep their tests-only warning
(operator decision 2026-10-09; the r5 test records it). Brief note 4 (a
Regression: whose runner is not installed goes to the fix rounds) is a
routing question for the operator.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/util/approval-log.mjs

@@ -45,7 +45,7 @@ import {
   appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rmdirSync, statSync,
 } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { isMain } from './is-main.mjs';
 
 export const APPROVAL_KINDS = Object.freeze(['intent', 'plan', 'review', 'merge', 'release']);
 export const LOG_RELPATH = '.claude/voyage/approvals.jsonl';
@@ -278,15 +278,7 @@ function shaFromArgs(args) {
   return { sha: raw === undefined ? undefined : normalizeHex(raw), raw };
 }
 
-function isMain() {
-  try {
-    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
-  } catch {
-    return false;
-  }
-}
-
-if (isMain()) {
+if (isMain(import.meta.url)) {
   const [cmd, ...args] = process.argv.slice(2);
   if (cmd === 'answer') {
     let text = opt(args, '--text');

lib/util/artifact-commit.mjs

@@ -21,8 +21,8 @@
 import { spawnSync } from 'node:child_process';
 import { appendFileSync, existsSync, readFileSync, realpathSync } from 'node:fs';
 import { isAbsolute, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { LOG_RELPATH, logPath, normalizeSubject } from './approval-log.mjs';
+import { isMain } from './is-main.mjs';
 
 export const ARTIFACT_STORES = Object.freeze(['git', 'local']);
 const DEFAULT_MESSAGE = 'docs(voyage): record approval';
@@ -85,15 +85,7 @@ export function commitArtifacts({ repo, store, artifacts = [], message = DEFAULT
   return { ...res, exit: 0, committed: true, commit: git(repo, ['rev-parse', 'HEAD']).stdout.trim() };
 }
 
-function isMain() {
-  try {
-    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
-  } catch {
-    return false;
-  }
-}
-
-if (isMain()) {
+if (isMain(import.meta.url)) {
   const args = process.argv.slice(2);
   const opt = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : undefined; };
   const artifacts = args.flatMap((a, i) => (a === '--artifact' && args[i + 1] !== undefined ? [args[i + 1]] : []));

lib/util/autonomy-gate.mjs

@@ -22,6 +22,8 @@
 //
 // Pure data; no I/O. Re-entry to `completed` is idempotent.
 
+import { isMain } from './is-main.mjs';
+
 export const STATES = Object.freeze({
   IDLE: 'idle',
   GATES_ON: 'gates_on',
@@ -114,7 +116,7 @@ function parseArgs(argv) {
   return out;
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMain(import.meta.url)) {
   const args = parseArgs(process.argv.slice(2));
   if (!args.state || !args.event) {
     process.stdout.write(JSON.stringify({

lib/util/is-main.mjs

@@ -0,0 +1,26 @@
+// lib/util/is-main.mjs
+// Whether a module is the script node was started with, so a module can be both
+// a library and a CLI: `if (isMain(import.meta.url)) { ... }`.
+//
+// Real paths on both sides. The older guard, import.meta.url === `file://${argv[1]}`,
+// is false under a symlinked path (import.meta.url is the realpath) and under a
+// path with a space (URL-encoded), and the CLI then exits 0 having done nothing
+// (measured 2026-10-04). One helper instead of a copy per CLI (release review of
+// 6.3.0, round 7: 31 copies of the fixed guard and 20 of the old one).
+
+import { realpathSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * @param {string} url - the calling module's import.meta.url
+ * @param {string|undefined} [argv1] - the started script (process.argv[1])
+ * @returns {boolean}
+ */
+export function isMain(url, argv1 = process.argv[1]) {
+  if (!argv1) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(url));
+  } catch {
+    return false;
+  }
+}

lib/util/research-loop-cap.mjs

@@ -42,6 +42,7 @@
 import { existsSync, mkdirSync, appendFileSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
+import { isMain } from './is-main.mjs';
 
 export const MAX_CONV_TURNS = 3;
 export const MAX_TOTAL_DIMENSIONS = 8; // settings.json:16 maxDimensions — whole list, not discovered-only
@@ -325,7 +326,7 @@ function parseArgs(argv) {
   return out;
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMain(import.meta.url)) {
   const args = parseArgs(process.argv.slice(2));
 
   // The dimension ceiling is a Phase 4.5 concern, and Phase 4.5 never calls the

lib/util/session-orders.mjs

@@ -29,6 +29,7 @@
 import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, rmSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join, dirname, basename, extname, isAbsolute } from 'node:path';
+import { isMain } from './is-main.mjs';
 
 function sectionBody(text, heading) {
   const lines = text.split('\n');
@@ -301,7 +302,7 @@ const NEEDS = {
   'record-merged': ['plan', 'wave'], 'next-wave': ['plan'], clear: [],
 };
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMain(import.meta.url)) {
   const args = parseArgs(process.argv.slice(2));
   const usage = 'usage: session-orders.mjs write|status|archive|record-merged --plan <repo-relative plan> --wave <W> --session-dir <dir> [--branch <b>]\n'
     + '       session-orders.mjs next-wave --plan <repo-relative plan> --session-dir <dir>\n'

lib/util/test-lock.mjs

@@ -37,14 +37,13 @@
 // Credit: locking tests during a fix is Claude Code's own hook pattern
 // (hooks-guide "Block edits to protected files").
 
-import { readFileSync, writeFileSync, mkdirSync, rmSync, existsSync, realpathSync, readdirSync } from 'node:fs';
+import { readFileSync, writeFileSync, mkdirSync, rmSync, existsSync, readdirSync } from 'node:fs';
 import { join, resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { createHash } from 'node:crypto';
 import { tmpdir } from 'node:os';
 import { resolveRepo, canonicalPath } from '../verification/repo-tools.mjs';
-import { allowedCommand, runCommand, screenCommand } from '../verification/criteria-runner.mjs';
-import { DEFAULT_TIMEOUT_MS } from '../verification/red-proof.mjs';
+import { DEFAULT_TIMEOUT_MS, allowedCommand, runCommand, screenCommand } from '../verification/criteria-runner.mjs';
+import { isMain } from './is-main.mjs';
 
 export const LOCK_VERSION = 1;
 
@@ -225,12 +224,4 @@ function main(argv) {
   process.exit(0);
 }
 
-function isMain() {
-  try {
-    return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
-  } catch {
-    return false;
-  }
-}
-
-if (isMain()) main(process.argv.slice(2));
+if (isMain(import.meta.url)) main(process.argv.slice(2));