refactor: simplify pass (trekexecute)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/review/instruction-scope.mjs

@@ -67,8 +67,11 @@ const REGULAR_MODES = new Set(['100644', '100755']);
 const TREE_ENTRY_RE = /^(\d{6}) ([a-z]+) ([0-9a-f]{40}|[0-9a-f]{64})$/;
 const NAMES = ['CLAUDE.md', 'AGENTS.md'];
 const RULES_DIR = '.claude/rules/';
-// The `.md` test of isInstructionFile below, for the part after `<d>/.claude/rules/`.
-const RULES_REST_RE = /^(?:[^/]+\/)*[^/]+\.md$/;
+// The `.md` test for the part after `<d>/.claude/rules/`; isInstructionFile
+// below builds its own test from the same source, so set and classifier agree.
+const RULES_REST = '(?:[^/]+\\/)*[^/]+\\.md$';
+const RULES_REST_RE = new RegExp(`^${RULES_REST}`);
+const RULES_ANY_DEPTH_RE = new RegExp(`(?:^|\\/)\\.claude\\/rules\\/${RULES_REST}`);
 
 // The argv git helper of lib/review/reviewed-commit.mjs:64-66 (copied, not exported there).
 function git(repo, args) {
@@ -202,7 +205,7 @@ export function isInstructionFile(path) {
   if (typeof path !== 'string' || path === '') return false;
   const p = path.replace(/^\.\//, '');
   if (NAMES.includes(posix.basename(p))) return true;
-  return /(?:^|\/)\.claude\/rules\/(?:[^/]+\/)*[^/]+\.md$/.test(p);
+  return RULES_ANY_DEPTH_RE.test(p);
 }
 
 function opt(args, name) {

lib/review/merge-evidence.mjs

@@ -25,7 +25,10 @@
 // is read ({"written": false}, "branch name <b> is ambiguous ..."): when
 // `refs/tags/<b>` or `refs/<b>` resolves, or an entry of any kind
 // `<git dir>/<b>` or `<git common dir>/<b>` exists (so `voyage`, the evidence
-// directory's parent, is refused). The guard's reader keeps the same rule.
+// directory's parent, is refused). The guard's reader (hooks/lib/merge-evidence.mjs)
+// is stricter: it also refuses a directory at `refs/<b>` or `refs/tags/<b>`
+// (a branch named `heads`, a tag `feat/x`), so it may show no evidence for a
+// file this writer wrote; never the reverse.
 // Before writing, evidence files in that directory older than 30 days are
 // removed (regular files named `<hex>.json` only). The file is written
 // atomically (a temp file in the same directory, then rename).

lib/review/review-rounds.mjs

@@ -184,7 +184,7 @@ export function prepare({ projectDir, since, repo, workflow = false, dryRun = fa
   if (workflow) {
     return { exit: 1, reason: 'from round 2 /trekreview runs on the standard path — re-run without --workflow' };
   }
-  const base = reviewedSha(text);
+  const base = ownEnd;
   if (!base || !isAncestorOfHead(repo ?? projectDir, base)) {
     return notMeasured('round base is not an ancestor of HEAD');
   }

lib/review/verdict-gate.mjs

@@ -169,8 +169,8 @@ export function decideVerdict(text) {
   const jsonList = payload.findings.map((f) => f.id);
   const jsonDup = jsonList.find((id, i) => jsonList.indexOf(id) !== i);
   if (jsonDup !== undefined) return undecided(`duplicate finding id ${jsonDup} in the trailing JSON block`, verdict);
-  const fmIds = new Set(Array.isArray(fm.findings) ? fm.findings : []);
-  const jsonIds = new Set(payload.findings.map((f) => f.id));
+  const fmIds = new Set(fmList);
+  const jsonIds = new Set(jsonList);
   if (fmIds.size !== jsonIds.size || [...fmIds].some((id) => !jsonIds.has(id))) {
     return undecided('frontmatter findings: list and the JSON block finding ids differ', verdict);
   }

tests/lib/merge-evidence-writer-head.test.mjs

@@ -9,8 +9,8 @@
 // measured".
 // [AMB] The writer refuses a branch name git would read as something else (a
 // tag `refs/tags/<b>`, a ref `refs/<b>`, an entry `<git dir>/<b>` or
-// `<git common dir>/<b>`), so it writes no evidence the guard's reader would
-// refuse to show (the reader keeps the same rule).
+// `<git common dir>/<b>`). The guard's reader refuses at least these names (it
+// is stricter: a directory at `refs/<b>` or `refs/tags/<b>` too).
 // `keep:` cases hold at the base already and stay untagged.
 // The writer module loads through `import * as m`, so a missing export is a
 // failed assertion at the red base, never a crash. Every child gets