fix(shell-gate): || is not a pipe, and |& is (backend#2264)

[LukasWodka]

Part of tracebloc/backend#2264.

The gate rejected the output of its own remediation

Converting the fleet for #2264 produces exactly this line:

cmd || grep -q needle <<<"$out"

There is no pipe in it. But the hazard regex matched the second bar of the ||, so the scanner reported the very form this repo documents as the house idiom. It would have blocked every cleanup PR in the #2264 wave — and a gate that rejects its own fix is how a gate teaches people to switch it off.

Found by running the gate against my own converted cli scripts, not by reading it.

Fix

Neutralise || into \001\001 on a probe copy before the hazard test. \001 cannot occur in a shell source line, and the original line is still what gets printed, so offender output is byte-identical.

Second, smaller gap found while writing that test: |& — bash's pipe-both-streams — is a pipe and carries the identical hazard, but the bar had to be followed by space-or-name, so noisy |& head -1 was missed entirely. The bar now takes an optional &. A gate that misses a real pipe form is the "advice, not a gate" failure from the house rules, so I fixed it here rather than filing it.

Mutation-proof

Baseline 33 green. Each mutation asserted its anchor matched exactly one line before running — an inert mutation and real coverage are indistinguishable in a log otherwise.

mutation	reddens
remove the || neutralisation	3 — tests 27, 28, 29
hazard test reads line, not probe	1 — test 28
drop |& from the head arm	1 — test 32
drop |& from the grep -q arm	1 — test 33

Every mutation is caught by the test that names the property, not by one shared failure that any mutation would trip.

The load-bearing test is "a real pipe is still flagged on a line that also contains ||". Without it, the three new spare-cases would all pass if the hazard test were deleted outright — three tests asserting the right property and proving nothing. That's the shape client#776 is about, so it would have been a poor look to ship it here.

Verification

• the gate reports zero over the whole tree
• check-style.sh clean, gen-manifest.sh --check up to date
• 23 other bats suites run, 0 failures (the remainder are unaffected — this touches only the scanner and its own test file)

Sequencing note

This wants to land before the remaining #2264 conversion PRs, or the gate will be wrong about them once it's armed. It does not block them from merging today, since the gate is not yet a required check anywhere.

🤖 Generated with Claude Code

---

Note

Low Risk
Linter-only regex and test changes; no runtime, auth, or data-path code. Residual risk is false positives/negatives in the style gate, which the new tests pin.

Overview
Stops the pipefail early-close scanner from flagging the house remediation idiom (cmd || grep -q …) by treating || as not a pipeline, while still catching real | / |& hazards on the same line.

The matcher now runs on a probe copy where || is replaced with a \001 stand-in that also acts as a regex boundary, so a later || grep -q cannot be borrowed by a plain | grep, and glued forms like head||die stay flagged. |& (pipe both streams) is now recognized as a pipe.

Also documents and pins a known false positive: set inside a multi-line quoted fixture is read as the file’s own options; # pipefail-guard: allow remains the workaround.

^{Reviewed by Cursor Bugbot for commit a0a9d3f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit aa80689. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a0a9d3f. Configure here.}

[aptracebloc]

Re-review — approving. Fixes two operator misclassifications in pipefail-early-close.awk (the shell-lint early-close gate): || was wrongly read as a pipe, and |& was wrongly not.

The false-negative regression I flagged last pass — producer | head||die silently dropped because the ||→\001 rewrite left head before a \001 not in its terminator class — is fixed in a0a9d3fab: \001 was added to the head terminator class ([)"'\;|&\001]), mirroring the grep arms' [^|\001]*. Verified in code; confirmed the || (true|:)guard still runs first sohead||true/head|| : aren't newly flagged; and confirmed the author added the pinning tests my finding said were missing (head||dieand|& head||dieflagged,head||true/head|| :` spared) — derived, mutation-proof, specific. My thread is resolved, CI green, 0 open threads, MERGEABLE.

— drafted with Claude Code