Guard registry: a guard that runs only in its own test

[m2ux]

Summary

The guard suite is a registry. A script listed there runs in check:all and in CI; a script not listed there runs nowhere, whatever else it has. One guard has a script and a test and no entry, so for as long as it has existed it has reported only to its own test file. This adds the entry.

This is finding 3 of #491, and it is the half of that finding that lives with the code. The other half — emptying the class the guard measures, so the entry can land without turning the suite red — merged as #506.

What happens today

The guard measures a defect with a run consequence. A technique's Protocol is parsed into steps by a regex that strips leading whitespace before matching, so a bullet indented to qualify the instruction above it arrives at the parser as a step in its own right. The author wrote a caveat; the run receives an instruction.

The guard finds that shape. Nothing runs the guard. Its sibling from the same body of work — the one reporting a set action that builds its value out of the variable it writes — was registered; this one was not, and no test could catch the omission, because the registry's own test checks that every entry names a real script and that every check:* command in the package manifest has an entry. A script with neither an entry nor a command is invisible to both directions of that check.

The fix

The registry gains the entry, and the package manifest gains the command that entry names, which is what brings it under the existing coverage test. The guard reports findings as structured output, so the entry declares that and the delta tool can read per-finding results rather than an exit code.

The corpus pointer moves to the commit that empties the class, so the entry lands green rather than landing red and waiting. The walk baseline stamp names that same commit, which is what the freshness assertion checks.

Verification

The sweep goes from 27 guards to 28, all passing, against the corpus this pointer names. The full suite is green at 1097 passed, 2 skipped, 0 failed. Typecheck is clean.

The guard was run directly in both modes before registering it — human-readable and structured — to confirm the entry's claims about it are true rather than assumed.

Scope

The registry entry, the command it names, the corpus pointer, and the stamp that has to move with it.

Acceptance criteria

• The branch-as-step guard runs in check:all and in CI.
• The sweep reports 28 guards, and passes.
• The corpus commit the pointer names is the one the walk baseline stamp names.

Non-goals

This does not change what the guard measures or how. Its detection, its carve-outs, and the class it deliberately leaves alone — mutually exclusive branches written as top-level peer bullets — are unchanged.

Nothing here enforces the shape a compliant note takes. The guard measures the branch-as-step class and is indifferent between a note that bullets its items and one that does not; the rule distinguishing them is stated in the workflow-design canon and applied across the corpus in #506, and a future note that ignores it goes unmeasured.

The remaining findings in #491 — the re-entered activity with no forward exit, and the deferred-items register with no raiser — are not here. Neither is the test-location boundary in #497, though the stamp this pull request had to move is an instance of the cost that issue describes: a recording on the code branch carrying the identifier of a corpus commit, needing a re-stamp on every pointer move.