fix: the findings of the release review of 6.3.0

The review of v6.2.0..f669b87 (BLOCK: 1 BLOCKER, 12 MAJOR, 1 MINOR), each
fixed behind a test that failed first, or, for the two missing tests, a test
shown to fail on a stub of the branch it covers.

- Review steps appended by /trekexecute Phase 7.2 are held to the step rules
  on any plan version: plan-validator --steps-from <N> (on a plan below 1.8 a
  template review step validated and was executed).
- The guard refuses where no one can be asked also when its rules will not
  load; the wave merge path names that refusal instead of MERGE_REFUSED.
  Tests for the classifier-error refusal and post-approval-log's own check.
- release-check: the version files may change only in their version after
  the review (JSON compared without it), README diff lines are read inside
  hunks only, an unreadable diff is exit 2, and npm test runs without
  NODE_TEST_CONTEXT.
- What counts as a step of only tests: a note in parentheses is not a path,
  and a data file under specs/ is not a test. End-to-end: rides on the last
  step that builds behaviour (validator hint, trekplan, template).
- A removed line is cited as <rev>:<path>:<line> (findings-schema hint,
  trekreview re-ask).
- skill-lint counts a trailing newline as no line; regression-check takes
  commandEnv from lib/util/command-env.mjs; CLAUDE.md names four mode-read
  exemptions.
- /security-review, older than v6.2.0: the criteria runner refuses git
  --output, which writes a file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/scripts/release-check.test.mjs

@@ -85,6 +85,7 @@ const DOORS = `### Doors
 function fixture({
   suiteExit = 0, doors = DOORS, verdict = 'ALLOW', writeReview = true,
   reviewSha = 'work', afterRelease = null, dirty = false, version = '1.0.1',
+  testScript = null, files = {}, attributes = null,
 } = {}) {
   const base = mkdtempSync(join(tmpdir(), 'release-check-'));
   const repo = join(base, 'repo');
@@ -94,12 +95,14 @@ function fixture({
   git(repo, 'config', 'user.name', 't');
   git(repo, 'config', 'commit.gpgsign', 'false');
 
-  const pkg = (v) => JSON.stringify({ name: 'fx', version: v, scripts: { test: `node -e "process.exit(${suiteExit})"` } }, null, 2) + '\n';
+  const pkg = (v) => JSON.stringify({ name: 'fx', version: v, scripts: { test: testScript ?? `node -e "process.exit(${suiteExit})"` } }, null, 2) + '\n';
   writeFileSync(join(repo, 'package.json'), pkg('1.0.0'));
   writeFileSync(join(repo, '.claude-plugin', 'plugin.json'), JSON.stringify({ name: 'fx', version: '1.0.0' }) + '\n');
   writeFileSync(join(repo, 'README.md'), '# fx\n\n![Version](https://img.shields.io/badge/version-1.0.0-blue)\n\nText.\n');
   writeFileSync(join(repo, 'CHANGELOG.md'), '# Changelog\n\n## v1.0.0 — 2026-10-01 — first\n\n- first\n');
   writeFileSync(join(repo, 'a.mjs'), 'export const a = 1;\n');
+  for (const [rel, text] of Object.entries(files)) writeFileSync(join(repo, rel), text);
+  if (attributes) writeFileSync(join(repo, '.git', 'info', 'attributes'), attributes);
   git(repo, 'add', '-A');
   git(repo, 'commit', '-q', '-m', 'feat: first');
   writeFileSync(join(repo, 'a.mjs'), 'export const a = 2;\n');
@@ -301,3 +304,59 @@ test('release-check — releaseSection matches the CHANGELOG heading dialects ex
   assert.match(mod.releaseSection(text, '1.10.0'), /ten/);
   assert.equal(mod.releaseSection(text, '2.0.0'), null);
 });
+
+// ---- release review of 6.3.0 (2026-10-10): what counts as bookkeeping ----------
+
+const AFTER_PKG = JSON.stringify({ name: 'fx', version: '1.0.1', scripts: { test: 'node -e "process.exit(0)" && echo changed' } }, null, 2) + '\n';
+
+test('release-check — a change to package.json after the review other than its version → 1', () => {
+  const fx = fixture({ afterRelease: { 'package.json': AFTER_PKG } });
+  try {
+    const r = run(fx);
+    assert.equal(r.status, 1, r.stdout + r.stderr);
+    assert.match(r.stdout, /package\.json \(lines other than the version\)/);
+  } finally { fx.cleanup(); }
+});
+
+test('release-check — a change to plugin.json after the review other than its version → 1', () => {
+  const fx = fixture({ afterRelease: { '.claude-plugin/plugin.json': JSON.stringify({ name: 'fx', version: '1.0.1', hooks: './x.json' }) + '\n' } });
+  try {
+    const r = run(fx);
+    assert.equal(r.status, 1, r.stdout + r.stderr);
+    assert.match(r.stdout, /plugin\.json \(lines other than the version\)/);
+  } finally { fx.cleanup(); }
+});
+
+test('release-check — a README line that starts with "++ " is a change, not a diff header → 1', () => {
+  const fx = fixture({ afterRelease: { 'README.md': '# fx\n\n![Version](https://img.shields.io/badge/version-1.0.1-blue)\n\nText.\n++ new claim\n' } });
+  try {
+    const r = run(fx);
+    assert.equal(r.status, 1, r.stdout + r.stderr);
+    assert.match(r.stdout, /README\.md \(lines other than the version badge\)/);
+  } finally { fx.cleanup(); }
+});
+
+test('release-check — a README diff that cannot be read → 2 (never green)', () => {
+  const fx = fixture({ attributes: 'README.md diff=broken\n' });
+  try {
+    spawnSync('git', ['config', 'diff.broken.textconv', 'false'], { cwd: fx.repo });
+    const r = run(fx);
+    assert.equal(r.status, 2, r.stdout + r.stderr);
+    assert.match(r.stdout, /README\.md/);
+  } finally { fx.cleanup(); }
+});
+
+test('release-check — a red suite is red when the check itself runs under node --test', () => {
+  const fx = fixture({
+    testScript: 'node --test red.test.mjs',
+    files: { 'red.test.mjs': "import { test } from 'node:test';\nimport assert from 'node:assert';\ntest('red', () => assert.equal(1, 2));\n" },
+  });
+  try {
+    const control = run(fx);
+    assert.equal(control.status, 1, `the control: the suite is red: ${control.stdout}`);
+    const r = spawnSync(process.execPath, [CHECK, '--repo', fx.repo, '--review', fx.review],
+      { encoding: 'utf8', env: { ...process.env, NODE_TEST_CONTEXT: 'child-v8' } });
+    assert.equal(r.status, 1, `under a parent test runner: ${r.stdout}`);
+    assert.match(r.stdout, /npm test exited/);
+  } finally { fx.cleanup(); }
+});