fix(docs-hygiene): accumulate soft-wrapped sentences before negation (0.21.7)

[kyle-sexton]

Closes #3195

Summary

0.21.1's "the line must close its own sentence" gate withheld every hard-wrapped prohibition. Do not use markdown on one line with in the summary body. on the next never reached a verdict, even though no positive is paired anywhere in that sentence. That is a silent withhold — the one failure mode the detector-findings admission test asks this rule set to fail away from.

Fix

detect.sh now joins paragraph lines before the negation classifier runs. The other eight shapes stay line-scoped. Frontmatter, fenced code, exempt sections and opt-out markers still bound the accumulation.

A wrapped finding is attributed to the first physical line of the triggering sentence — the line the cue opens on — so the fix action lands on the instruction's start rather than its wrap continuation.

The SKILL.md "known limitation" bullet is removed. The detector-findings crosswalk row is patched (2.5.1) so its selection text matches the detector that ships.

Verification

• Wrapped sentence with its positive on the next line is not flagged (pinned; previously passing only incidentally)
• Wrapped sentence with no positive is flagged, Finding line = first line of the sentence
• Unwrapped control still flags
• Citation does not accumulate across a soft wrap (line-scoped sibling pinned)
• Fenced and opt-out wraps do not leak into a later body wrap
• Existing detect.test.sh cases pass (140 checks)
• skill-quality:check docs-hygiene:audit-noise — PASS
• check-detector-findings-crosswalk.sh --check — PASS

Related

• Refs feat(docs-hygiene): negation-without-positive detector on audit-noise, wired to the findings relay (0.21.0) #3194 — introduced the shape and the limitation this fixes
• Refs fix(docs-hygiene): narrow audit-noise's negation shape to imperatives (0.21.1) #3202 — shipped the closed-sentence gate that inverted the error direction
• Refs fix(docs-hygiene): correct audit-noise's stated negation limitation (0.21.2) #3205 — corrected the stated limitation; this PR removes it

[claude]

Claude finished @kyle-sexton's task in 1m 22s —— View job

---

Security review

• Gather context (PR diff, changed files)
• Skip-gate check (open PR, security-relevant surface, prior review)
• Review changed files for security issues
• Post findings / no-findings summary

No security-relevant surface. This PR changes a docs-hygiene bash text classifier (detect.sh, lib/noise-shapes.sh) that scans the repo's own committed/uncommitted markdown files for prose-noise patterns, plus its test fixtures, SKILL.md/README.md/CHANGELOG.md prose, and a plugin version bump. It is entirely read-only string/regex processing over local Markdown content — no eval, no dynamic command construction from file content, no network calls, no auth/access-control logic, no secrets handling, and no GitHub Actions workflow or permissions changes. The new flush_negation paragraph-accumulation path and the audit_noise_emit_finding helper only affect which findings get emitted/attributed; they don't introduce a new trust boundary or an injection surface (findings are printf'd, not passed to eval/source/subshells built from file content).

Per the skip gate, this lane reports security issues only — I'm not flagging correctness/style items (e.g. general code-review concerns belong to /review:code-review).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90609bb6be

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Last security-reviewed head: 90609bb6be1cd5a39394e108d4c9014c9a0c6241. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @cursor[bot]'s task in 10m 10s —— View job

---

Code review (/review:code-review)

• Gather context (PR diff, changed files, REVIEW.md, skip-gate check)
• Review changed files for correctness / maintainability findings
• Post findings / no-findings summary

Skip gate: none apply — open PR, non-trivial diff, no prior review on this head. Scope: this is the code-review lane; security is a separate lane per REVIEW.md and out of scope here.

This PR's second commit (2d60f62) already addresses all four issues Codex flagged on the first commit (90609bb): every qualifying sentence in an accumulated paragraph is now emitted, accumulation stops at list-item boundaries, attribution offsets are computed on one normalized (neg_unwrapped) representation, and findings are buffered and sorted by line number before printing. I traced each of those fixes by hand against the current detect.sh / noise-shapes.sh and they hold up.

Finding (posted inline)

detect.sh:286-294 — a residual case of the same class of bug Codex's third comment flagged: when an accumulated negation paragraph contains two sentences with identical text (e.g. Do not use markdown. repeated on two physical lines), prefix="${neg_unwrapped%%"${s}"*}" resolves to the first occurrence's position for both loop iterations (bash's %% always anchors the longest-suffix match at the earliest textual occurrence), so the second finding is misattributed to the first sentence's line instead of its own. I had an independent subagent verify this trace before posting; it confirmed the mechanism and reproduction. Full detail and a suggested fix direction are in the inline comment.

Not flagged (checked, no issue)

• Attribution across an inline-backtick-containing earlier line (the exact case Codex's third comment raised) — confirmed correctly fixed by hand-tracing the NEG_TICK_ATTR test case against the current offset logic.
• List-sibling non-pairing, paragraph flush at frontmatter/fence/heading/opt-out boundaries, and line-number-ordered output — all traced through and consistent with the new tests.
• Doc/version-bump consistency (SKILL.md, plugin CHANGELOG.md, detector-findings crosswalk 2.5.1) — text changes match the shipped behavior.

Not independently verified

I could not execute detect.test.sh or any ad hoc shell/python snippet myself — this environment's Bash tool required interactive approval for anything beyond a few allowlisted git/gh read commands, which isn't available in this unattended run. The 140-check test-suite pass, skill-quality:check, and check-detector-findings-crosswalk.sh --check results in the PR description are author-claimed and unverified by me; everything above is from static tracing of the diff, not from running it.

[github-actions]

Claude has reviewed this PR 2 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude finished @cursor[bot]'s task in 1m 11s —— View job

---

Code review (/review:code-review)

• Gather context (PR state, trigger instructions)
• Skip-gate check
• Post summary

Skip gate: PR is closed (merged), not open. Per the code-review lane's skip gate ("PR is closed or not open" → stop early, post nothing else), no review is performed. This PR (#3230) shows as MERGED in the pre-fetched context, so there is no open review surface to comment on — a fresh code review on a merged PR wouldn't be actionable for the author, and any residual findings should instead be raised as follow-up issues or a new PR against main.

If this was triggered unintentionally by a stale synchronize event delivered after merge, no action is needed. If a fresh review is actually wanted (e.g. re-checking the merged state, or reviewing a follow-up), please re-invoke @claude with that specific ask.