From 017a2cffe19cb64be9c4346140a57f431a52b795 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 25 Oct 2026 16:06:08 -0400
Subject: [PATCH 1/2] fix(planning): let any session re-pin an
 interview-defenses digest

repin.sh no longer refuses without a terminal or asks y/N: it rewrites
the one sha256 literal, adds the reason above the pin, and prints
`<label>: <old> -> <new>` for the commit message. The defenses suite's
header and failure messages drop the attended-only rule; the commit
records old -> new and why the defense holds, and PR review judges it,
as approval and snapshot tests are re-approved by the developer and
reviewed in code review. Every digest stays: phrase and whole-line pins
cannot see a qualifier added beside a pinned line.

Refs: #8220, #10044

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../fix-planning-agent-repin-4b29645c.md      |   7 ++
 .../planning/tests/interview-defenses.test.sh |  28 +++--
 plugins/planning/tests/repin.sh               |  40 ++----
 plugins/planning/tests/repin.test.sh          | 118 ++++--------------
 4 files changed, 55 insertions(+), 138 deletions(-)
 create mode 100644 .changes/planning/fix-planning-agent-repin-4b29645c.md

diff --git a/.changes/planning/fix-planning-agent-repin-4b29645c.md b/.changes/planning/fix-planning-agent-repin-4b29645c.md
new file mode 100644
index 0000000000..890dfa7101
--- /dev/null
+++ b/.changes/planning/fix-planning-agent-repin-4b29645c.md
@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Changed
+
+- **`interview-defenses.test.sh` digest re-pins no longer need a person.** Any session, a lane included, may re-pin a digest after reading the diff of the guarded text: `tests/repin.sh <pin-label> <reason>` runs with no terminal and no y/N prompt, rewrites the one sha256 literal, adds the reason above the pin, and prints `<label>: <old> -> <new>` for the commit message. The suite's failure messages and header drop the attended-only rule; the commit carries old -> new and why the defense holds, and the PR review judges it.
diff --git a/plugins/planning/tests/interview-defenses.test.sh b/plugins/planning/tests/interview-defenses.test.sh
index 390b5f2a88..967a241239 100755
--- a/plugins/planning/tests/interview-defenses.test.sh
+++ b/plugins/planning/tests/interview-defenses.test.sh
@@ -71,9 +71,10 @@
 # Rewording, extending, or qualifying a pinned line is EXPECTED to fail, including a typo
 # fix, and so is any edit inside a digested region. That is the contract for a load-bearing
 # behavioral rule with no runner behind it: re-read the defense, confirm it still holds,
-# then update the skill body and this suite in one change. Recomputing a digest or pin here is
-# attended-only: an unattended run that hits a failing digest reports the pin and the git diff,
-# then stops, and never updates it.
+# then update the skill body and this suite in one change. Any session, a lane included, may
+# re-pin a digest after that re-read: tests/repin.sh rewrites one sha256 literal, and the commit
+# records the old and new digest and why the defense still holds, so the PR review judges the
+# change against the text it guards.
 #
 # Relationship to the older cases. evals.json ships three narrative cases over the same two
 # defenses — `auto-guard-never-folds-user-choice` (2), `lock-mode-does-not-fudge-gap` (3),
@@ -100,10 +101,10 @@ AUDIT="$PLUGIN_DIR/skills/audit-answers/SKILL.md"
 EVALS="$PLUGIN_DIR/skills/interview/evals/evals.json"
 FIXTURES="$PLUGIN_DIR/skills/interview/evals/fixtures"
 
-ATTENDED_ONLY="Recomputing a pin or digest is attended-only: an unattended run reports this pin and the git diff, then stops."
+UPDATE_RULE="Read the git diff of this text first; the commit that updates the pin states, for each pin, old -> new and why the defense still holds."
 # Appended to the digest-pin failures only: repin.sh rewrites a sha256 literal, so the exact-line
 # pins and the boundary failure have nothing for it to recompute.
-REPIN_HINT="After reading the diff, a person re-pins this digest by running, in their own terminal (a Claude Code ! line has no terminal): bash plugins/planning/tests/repin.sh '<pin label text>' '<justification>'"
+REPIN_HINT="Re-pin with: bash plugins/planning/tests/repin.sh '<pin label text>' '<why the defense still holds>'"
 PASS=0
 FAIL=0
 fail() {
@@ -176,7 +177,7 @@ pin_exact() {
   if grep -Fxq -- "$line" "$file"; then
     ok "$label"
   else
-    fail "$label — no line in ${file#"$PLUGIN_DIR/"} matches the pinned defense text EXACTLY. The rule was reworded, extended, or qualified. Re-read it, confirm the defense still holds, then update the pin. Pinned: $line ${ATTENDED_ONLY}"
+    fail "$label — no line in ${file#"$PLUGIN_DIR/"} matches the pinned defense text EXACTLY. The rule was reworded, extended, or qualified. Re-read it, confirm the defense still holds, then update the pin. Pinned: $line ${UPDATE_RULE}"
   fi
 }
 
@@ -243,7 +244,7 @@ pin_section() {
   n_open="$(grep -Fxc -- "$open" "$file" || true)"
   n_close="$(grep -Fxc -- "$close" "$file" || true)"
   if [[ "$n_open" != "1" || "$n_close" != "1" ]]; then
-    fail "$label — the section boundaries are no longer unique whole lines in ${file#"$PLUGIN_DIR/"} (\"$open\" x$n_open, \"$close\" x$n_close). A duplicated or renamed boundary moves the digested region, which is how a region pin gets silently emptied. Restore the headings, or re-anchor the pin and update the digest. ${ATTENDED_ONLY}"
+    fail "$label — the section boundaries are no longer unique whole lines in ${file#"$PLUGIN_DIR/"} (\"$open\" x$n_open, \"$close\" x$n_close). A duplicated or renamed boundary moves the digested region, which is how a region pin gets silently emptied. Restore the headings, or re-anchor the pin and update the digest. ${UPDATE_RULE}"
     return
   fi
   got="$(section_digest "$file" "$open" "$close")"
@@ -252,7 +253,7 @@ pin_section() {
   elif [[ "$got" == "$want" ]]; then
     ok "$label"
   else
-    fail "$label — the section between \"$open\" and \"$close\" in ${file#"$PLUGIN_DIR/"} changed (want $want, got $got). Anything added inside this section can qualify the defense it houses WITHOUT touching a pinned line. Re-read the section, confirm neither defense was weakened, then update the digest. ${ATTENDED_ONLY} ${REPIN_HINT}"
+    fail "$label — the section between \"$open\" and \"$close\" in ${file#"$PLUGIN_DIR/"} changed (want $want, got $got). Anything added inside this section can qualify the defense it houses WITHOUT touching a pinned line. Re-read the section, confirm neither defense was weakened, then update the digest. ${UPDATE_RULE} ${REPIN_HINT}"
   fi
 }
 
@@ -272,7 +273,7 @@ pin_frontmatter() {
   elif [[ "$got" == "$want" ]]; then
     ok "$label"
   else
-    fail "$label — the YAML frontmatter of ${file#"$PLUGIN_DIR/"} changed (want $want, got $got). Frontmatter is loaded before any section, so a qualifier in ANY key here reaches every invocation. Re-read it, confirm neither defense was weakened, then update the digest. ${ATTENDED_ONLY} ${REPIN_HINT}"
+    fail "$label — the YAML frontmatter of ${file#"$PLUGIN_DIR/"} changed (want $want, got $got). Frontmatter is loaded before any section, so a qualifier in ANY key here reaches every invocation. Re-read it, confirm neither defense was weakened, then update the digest. ${UPDATE_RULE} ${REPIN_HINT}"
   fi
 }
 
@@ -290,7 +291,7 @@ pin_case_digest() {
   elif [[ "$got" == "$want" ]]; then
     ok "$label"
   else
-    fail "$label — eval case \"$name\" changed (want $want, got $got). A criterion may have been added that contradicts one already pinned. Re-read the case, confirm it still rejects the silent capture, then update the digest. ${ATTENDED_ONLY} ${REPIN_HINT}"
+    fail "$label — eval case \"$name\" changed (want $want, got $got). A criterion may have been added that contradicts one already pinned. Re-read the case, confirm it still rejects the silent capture, then update the digest. ${UPDATE_RULE} ${REPIN_HINT}"
   fi
 }
 
@@ -307,7 +308,7 @@ pin_file() {
   elif [[ "$got" == "$want" ]]; then
     ok "$label"
   else
-    fail "$label — ${file#"$PLUGIN_DIR/"} changed (want $want, got $got). This fixture IS the case's plant: if it no longer plants a genuinely-open decision (case A) or a resolved-but-one context (case B), the case grades nothing. Re-read it, confirm the plant survives, then update the digest. ${ATTENDED_ONLY} ${REPIN_HINT}"
+    fail "$label — ${file#"$PLUGIN_DIR/"} changed (want $want, got $got). This fixture IS the case's plant: if it no longer plants a genuinely-open decision (case A) or a resolved-but-one context (case B), the case grades nothing. Re-read it, confirm the plant survives, then update the digest. ${UPDATE_RULE} ${REPIN_HINT}"
   fi
 }
 
@@ -327,7 +328,7 @@ pin_case_set() {
   elif [[ "$got" == "$want" ]]; then
     ok "$label"
   else
-    fail "$label — the eval-case roster in ${EVALS#"$PLUGIN_DIR/"} changed (want $want, got $got). Adding a case is fine; adding one that contradicts case 15 or 16 is not. Confirm no new case licenses the silent capture or a fudged gap, then update the digest. ${ATTENDED_ONLY} ${REPIN_HINT}"
+    fail "$label — the eval-case roster in ${EVALS#"$PLUGIN_DIR/"} changed (want $want, got $got). Adding a case is fine; adding one that contradicts case 15 or 16 is not. Confirm no new case licenses the silent capture or a fudged gap, then update the digest. ${UPDATE_RULE} ${REPIN_HINT}"
   fi
 }
 
@@ -430,7 +431,8 @@ declares_both_fixtures B "$CASE_B"
 #
 # Update procedure when one of these fires: read `git diff` for the named section or case,
 # confirm in words that neither defense was weakened, qualified, or contradicted by the
-# change, then recompute and replace the digest below IN THE SAME COMMIT.
+# change, then re-pin the digest below IN THE SAME COMMIT (tests/repin.sh), with old -> new
+# and that reason in the commit message.
 #
 # The boundary tests below MUST match `section_digest`'s — whole-line equality, not a
 # prefix match. They agree on today's content and diverge in exactly the crafted-heading
diff --git a/plugins/planning/tests/repin.sh b/plugins/planning/tests/repin.sh
index 34a367e783..1f511da7e0 100755
--- a/plugins/planning/tests/repin.sh
+++ b/plugins/planning/tests/repin.sh
@@ -1,20 +1,18 @@
 #!/usr/bin/env bash
-# Attended re-pin for one digest pin of interview-defenses.test.sh.
+# Re-pin one digest pin of interview-defenses.test.sh.
 #
 #   repin.sh [--test-file <path>] <pin-label> <justification>
 #
-# A person runs this after reading the git diff of the guarded text and confirming
-# the defense still holds. It refuses to write unless stdin and stdout are both
-# terminals, and then writes only after the person answers y to the shown old and
-# new digest and diff stat. There is no flag or variable to skip either check. It
+# Run it after reading the diff of the guarded text and confirming the defense still holds;
+# the commit carries the printed old -> new line and the reason, and the PR review judges the
+# change. It
 #   1. finds the one digest pin (pin_section, pin_frontmatter, pin_case_digest,
 #      pin_case_set or pin_file) whose call line contains <pin-label> (backslashes
 #      ignored, so a label with backticks is typed plainly),
 #   2. runs the test and reads that pin's `want X, got Y` failure,
-#   3. checks for a terminal, shows the old and new digest and `git diff --stat`
-#      of the plugin, and asks y/N (default N),
-#   4. rewrites only that pin's sha256 literal to Y and inserts `# <justification>`
+#   3. rewrites only that pin's sha256 literal to Y and inserts `# <justification>`
 #      on the line above the call, beside the existing re-pin comments,
+#   4. prints `<label>: <old> -> <new>` for the commit message,
 #   5. reruns the test and prints PASS or FAIL.
 # Every other line of the file stays byte-identical.
 #
@@ -22,7 +20,7 @@
 # 2 usage or an unreadable test file; 3 the label matches no digest pin, or more
 # than one; 4 nothing changed: the digest already matches, or the pin fails for a
 # reason a new digest does not fix (such as a section boundary that is no longer a
-# unique heading line); 5 stdin or stdout is not a terminal; 6 the person declined.
+# unique heading line).
 set -uo pipefail
 
 self="$(basename "$0")"
@@ -87,29 +85,13 @@ run_test() { bash "$test_file" 2>&1; }
 
 out="$(run_test)"
 new="$(printf '%s\n' "$out" | tr -d '\r' | sed -n "s/.*(want $old, got \([0-9a-f]\{64\}\)).*/\1/p" | head -1)"
+# The label is the call's first quoted argument, backslashes dropped.
+pin_label="$(sed -n "${call_line}p" "$test_file" | tr -d "\\\\" | sed 's/^pin_[a-z_]* "\([^"]*\)".*/\1/')"
 if [[ -z "$new" ]]; then
-  stripped="$(sed -n "${call_line}p" "$test_file" | tr -d "\\\\")"
-  echo "$self: nothing to change for ${stripped}: the digest already matches, or the pin fails for a reason a new digest does not fix." >&2
+  echo "$self: nothing to change for ${pin_label}: the digest already matches, or the pin fails for a reason a new digest does not fix." >&2
   exit 4
 fi
 
-if ! [[ -t 0 && -t 1 ]]; then
-  echo "$self: refusing to re-pin: stdin and stdout must both be a terminal. A person runs this in their own terminal after reading the diff; a Claude Code ! line has no terminal, and an unattended run reports the failing pin and stops." >&2
-  exit 5
-fi
-echo "Pin: $(sed -n "${call_line}p" "$test_file" | tr -d "\\\\")"
-echo "Old digest: $old"
-echo "New digest: $new"
-plugin_dir="$(cd "$(dirname "$test_file")/.." && pwd)"
-echo "Changes under $plugin_dir since HEAD:"
-# --no-pager: a pager would read the y/N answer from the terminal.
-git --no-pager -C "$plugin_dir" diff --stat HEAD -- . 2>/dev/null || echo "(no git diff available)"
-read -r -p "Write the new digest? [y/N] " answer || answer=""
-if [[ "$answer" != [yY] && "$answer" != [yY][eE][sS] ]]; then
-  echo "$self: not re-pinned." >&2
-  exit 6
-fi
-
 tmp="$(mktemp "${TMPDIR:-/tmp}/repin.XXXXXX")" || exit 2
 trap 'rm -f "$tmp"' EXIT
 REPIN_NOTE="$justification" awk -v call="$call_line" -v shaln="$sha_line" -v new="$new" '
@@ -121,7 +103,7 @@ REPIN_NOTE="$justification" awk -v call="$call_line" -v shaln="$sha_line" -v new
 # Write through the existing file so its mode and ownership stay.
 cat "$tmp" >"$test_file" || exit 2
 
-echo "$self: re-pinned line $sha_line: $old -> $new"
+echo "${pin_label}: $old -> $new"
 if run_test >/dev/null; then
   echo "PASS"
   exit 0
diff --git a/plugins/planning/tests/repin.test.sh b/plugins/planning/tests/repin.test.sh
index 0797f7612a..01bad9c1c7 100755
--- a/plugins/planning/tests/repin.test.sh
+++ b/plugins/planning/tests/repin.test.sh
@@ -1,23 +1,13 @@
 #!/usr/bin/env bash
 # repin.sh rewrites exactly one digest pin of a copy of the test file: one sha literal and
 # one justification comment change, every other line stays byte-identical; an unknown or
-# ambiguous label is refused and a matching digest is a no-op. It writes only when stdin and
-# stdout are both terminals and the person answers y: any other run refuses and writes
-# nothing. The copy is a stand-in test with the real call shape (label, then the sha256
+# ambiguous label is refused and a matching digest is a no-op. It runs with no terminal, as a
+# lane runs it. The copy is a stand-in test with the real call shape (label, then the sha256
 # literal alone on the last line) that prints the same `want X, got Y` failure, so the real
-# pins are never touched. `script` (util-linux) gives the attended cases a pty; hosts
-# without it skip them.
+# pins are never touched.
 #
 # test-scope: plugins/planning/tests/repin.sh
 set -uo pipefail
-# The stand-in lives in a temporary git repository. Run from a git hook, inherited
-# repository-local variables (GIT_INDEX_FILE among them) would point its git commands at the
-# caller's repository instead. CALLER_INDEX keeps the caller's index path for the check below.
-CALLER_INDEX="${GIT_INDEX_FILE:-}"
-unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
-# shellcheck disable=SC2046 # one word per variable name is intended
-unset $(git rev-parse --local-env-vars)
-
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPIN="$HERE/repin.sh"
 
@@ -39,9 +29,6 @@ sha_of() {
   if command -v sha256sum >/dev/null 2>&1; then sha256sum <"$1" | cut -d' ' -f1; else shasum -a 256 <"$1" | cut -d' ' -f1; fi
 }
 
-CALLER_INDEX_SHA=""
-[[ -f "$CALLER_INDEX" ]] && CALLER_INDEX_SHA="$(sha_of "$CALLER_INDEX")"
-
 printf 'alpha\n' >"$WORK/alpha.txt"
 printf 'beta\n' >"$WORK/beta.txt"
 ALPHA="$(sha_of "$WORK/alpha.txt")"
@@ -73,86 +60,30 @@ exit \$FAILS
 EOF
 }
 
-# Unattended: no terminal on stdin or stdout, as a lane runs it.
+# No terminal on stdin or stdout, as a lane runs it.
 run_repin() { bash "$REPIN" "$@" </dev/null 2>&1; }
 
-# The stand-in lives in tests/ of a git repo with one uncommitted edit, so the attended
-# run's `git diff --stat` has a change to show and a pager to start if it is allowed one.
-PLUGIN="$WORK/plugin"
-mkdir -p "$PLUGIN/tests"
-printf 'guarded\n' >"$PLUGIN/guarded.md"
-if ! { git -C "$PLUGIN" init -q && git -C "$PLUGIN" add guarded.md &&
-  git -C "$PLUGIN" -c user.name=t -c user.email=t@example.invalid commit -qm init; }; then
-  echo "FAIL: cannot set up the git fixture" >&2
-  exit 1
-fi
-printf 'weakened\n' >"$PLUGIN/guarded.md"
-
-# --- an unattended run refuses and writes nothing ----------------------------------------
-t="$PLUGIN/tests/stale.test.sh"
+# --- a stale pin is re-pinned: one pin changes, every other line is byte-identical -------
+t="$WORK/stale.test.sh"
 make_fixture "$STALE" "$BETA" "$t"
 cp "$t" "$WORK/stale.before"
-out="$(run_repin --test-file "$t" 'alpha file' 'An injected justification.')"
+out="$(run_repin --test-file "$t" 'alpha file' 'Alpha text edited; the defense still holds.')"
 rc=$?
-if [[ $rc -eq 5 ]]; then ok "no terminal: exit 5"; else fail "no terminal: expected exit 5, got $rc: $out"; fi
-if [[ "$out" == *"terminal"* ]]; then ok "no terminal: says why"; else fail "no terminal: no reason given: $out"; fi
-if cmp -s "$WORK/stale.before" "$t"; then ok "no terminal: pin unchanged"; else fail "file changed on an unattended run"; fi
-
-# Attended: stdin and stdout on a pty, <answer> typed at the prompt. TTY_SUFFIX, already
-# shell-quoted, is appended to the command line (a redirect). GIT_PAGER reads a line from
-# the terminal, as less does on a key: if repin.sh let git start a pager, it would eat the
-# answer.
-HAVE_PTY=0
-if command -v script >/dev/null 2>&1 && script -qec true /dev/null </dev/null >/dev/null 2>&1; then HAVE_PTY=1; fi
-run_tty() {
-  local answer="$1" cmd
-  shift
-  cmd="$(printf '%q ' bash "$REPIN" "$@")"
-  printf '%s\n' "$answer" | GIT_PAGER='read -r _ </dev/tty; cat' SHELL="$(command -v bash)" timeout 30 script -qec "$cmd${TTY_SUFFIX:-}" /dev/null 2>&1
-}
-
-if [[ $HAVE_PTY -eq 1 ]]; then
-  # --- attended and confirmed: one pin changes, every other line is byte-identical -------
-  make_fixture "$STALE" "$BETA" "$t"
-  out="$(run_tty y --test-file "$t" 'alpha file' 'Alpha text edited; the defense still holds.')"
-  rc=$?
-  if [[ $rc -eq 0 ]]; then ok "stale pin re-pinned: exit 0"; else fail "stale pin: expected exit 0, got $rc: $out"; fi
-  if [[ "$out" == *PASS* ]]; then ok "prints PASS"; else fail "no PASS in output: $out"; fi
-  if [[ "$out" == *"$STALE"* && "$out" == *"$ALPHA"* ]]; then ok "shows old and new digest before asking"; else fail "old/new digest not shown: $out"; fi
-  if [[ "$out" == *"guarded.md"* ]]; then ok "shows the git diff stat before asking"; else fail "diff stat not shown: $out"; fi
-  changes="$(diff "$WORK/stale.before" "$t" | grep -c '^[<>]')"
-  if [[ "$changes" -eq 3 ]]; then ok "exactly three lines differ: old sha, new sha, justification"; else fail "expected 3 differing lines, got $changes"; fi
-  if grep -qx "  \"$ALPHA\"" "$t"; then ok "alpha sha rewritten"; else fail "alpha sha not rewritten"; fi
-  if grep -qx "  \"$BETA\"" "$t"; then ok "beta pin left as it was"; else fail "beta pin changed"; fi
-  if grep -qx '# Alpha text edited; the defense still holds.' "$t"; then ok "justification inserted"; else fail "justification missing"; fi
-  before_call="$(grep -n '^pin_file "alpha' "$t" | cut -d: -f1)"
-  if [[ "$(sed -n "$((before_call - 1))p" "$t")" == '# Alpha text edited; the defense still holds.' ]]; then ok "justification sits beside the pin"; else fail "justification not above the pin call"; fi
-
-  # --- a backslash in the justification is kept literally --------------------------------
-  make_fixture "$STALE" "$BETA" "$t"
-  run_tty y --test-file "$t" 'alpha file' 'Kept a\nliteral \\ backslash.' >/dev/null
-  if grep -qxF '# Kept a\nliteral \\ backslash.' "$t"; then ok "backslashes in the justification stay literal"; else fail "justification was mangled"; fi
-
-  # --- attended but declined (n, or Enter for the default) writes nothing ----------------
-  for answer in n ''; do
-    make_fixture "$STALE" "$BETA" "$t"
-    out="$(run_tty "$answer" --test-file "$t" 'alpha file' 'unused')"
-    rc=$?
-    if [[ $rc -eq 6 ]]; then ok "answer '$answer': exit 6"; else fail "answer '$answer': expected exit 6, got $rc: $out"; fi
-    if cmp -s "$WORK/stale.before" "$t"; then ok "answer '$answer': pin unchanged"; else fail "file changed after answer '$answer'"; fi
-  done
-
-  # --- a terminal on only one of stdin and stdout refuses --------------------------------
-  for half in "stdout to a file:>$(printf '%q' "$WORK/redir.out")" "stdin from /dev/null:</dev/null"; do
-    make_fixture "$STALE" "$BETA" "$t"
-    out="$(TTY_SUFFIX=" ${half#*:}" run_tty y --test-file "$t" 'alpha file' 'unused')"
-    rc=$?
-    if [[ $rc -eq 5 ]]; then ok "${half%%:*}: exit 5"; else fail "${half%%:*}: expected exit 5, got $rc: $out"; fi
-    if cmp -s "$WORK/stale.before" "$t"; then ok "${half%%:*}: pin unchanged"; else fail "file changed with ${half%%:*}"; fi
-  done
-else
-  echo "skip - attended re-pin cases (no util-linux script)"
-fi
+if [[ $rc -eq 0 ]]; then ok "stale pin re-pinned: exit 0"; else fail "stale pin: expected exit 0, got $rc: $out"; fi
+if [[ "$out" == *PASS* ]]; then ok "prints PASS"; else fail "no PASS in output: $out"; fi
+if [[ "$out" == *"alpha file is unchanged (\`lock\` row): $STALE -> $ALPHA"* ]]; then ok "prints label: old -> new for the commit"; else fail "label and old -> new not printed: $out"; fi
+changes="$(diff "$WORK/stale.before" "$t" | grep -c '^[<>]')"
+if [[ "$changes" -eq 3 ]]; then ok "exactly three lines differ: old sha, new sha, justification"; else fail "expected 3 differing lines, got $changes"; fi
+if grep -qx "  \"$ALPHA\"" "$t"; then ok "alpha sha rewritten"; else fail "alpha sha not rewritten"; fi
+if grep -qx "  \"$BETA\"" "$t"; then ok "beta pin left as it was"; else fail "beta pin changed"; fi
+if grep -qx '# Alpha text edited; the defense still holds.' "$t"; then ok "justification inserted"; else fail "justification missing"; fi
+before_call="$(grep -n '^pin_file "alpha' "$t" | cut -d: -f1)"
+if [[ "$(sed -n "$((before_call - 1))p" "$t")" == '# Alpha text edited; the defense still holds.' ]]; then ok "justification sits beside the pin"; else fail "justification not above the pin call"; fi
+
+# --- a backslash in the justification is kept literally ----------------------------------
+make_fixture "$STALE" "$BETA" "$t"
+run_repin --test-file "$t" 'alpha file' 'Kept a\nliteral \\ backslash.' >/dev/null
+if grep -qxF '# Kept a\nliteral \\ backslash.' "$t"; then ok "backslashes in the justification stay literal"; else fail "justification was mangled"; fi
 
 # --- matching digest is a no-op ----------------------------------------------------------
 make_fixture "$ALPHA" "$BETA" "$t"
@@ -181,11 +112,6 @@ out="$(run_repin --test-file "$t" 'alpha file' $'two\nlines')"
 rc=$?
 if [[ $rc -eq 2 ]]; then ok "multi-line justification: exit 2"; else fail "multi-line justification: expected exit 2, got $rc: $out"; fi
 
-# --- the caller's index is untouched -----------------------------------------------------
-if [[ -n "$CALLER_INDEX_SHA" ]]; then
-  if [[ "$(sha_of "$CALLER_INDEX")" == "$CALLER_INDEX_SHA" ]]; then ok "caller's GIT_INDEX_FILE untouched"; else fail "the fixture wrote to the caller's index $CALLER_INDEX"; fi
-fi
-
 echo
 echo "passed: $PASS, failed: $FAIL"
 [[ $FAIL -eq 0 ]]

From d4e68fc3438faf428edfd52a06909f6e84c7b192 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 25 Oct 2026 16:08:43 -0400
Subject: [PATCH 2/2] fix(planning): print the whole pin label when it holds
 escaped quotes

repin.sh cut a label such as `SKILL.md "does NOT do" section ...` at its
first inner quote; the capture now ends at the call line's last quote.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 plugins/planning/tests/repin.sh      | 4 ++--
 plugins/planning/tests/repin.test.sh | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/plugins/planning/tests/repin.sh b/plugins/planning/tests/repin.sh
index 1f511da7e0..66166b9db7 100755
--- a/plugins/planning/tests/repin.sh
+++ b/plugins/planning/tests/repin.sh
@@ -85,8 +85,8 @@ run_test() { bash "$test_file" 2>&1; }
 
 out="$(run_test)"
 new="$(printf '%s\n' "$out" | tr -d '\r' | sed -n "s/.*(want $old, got \([0-9a-f]\{64\}\)).*/\1/p" | head -1)"
-# The label is the call's first quoted argument, backslashes dropped.
-pin_label="$(sed -n "${call_line}p" "$test_file" | tr -d "\\\\" | sed 's/^pin_[a-z_]* "\([^"]*\)".*/\1/')"
+# The label is the call's first argument, backslashes dropped; it ends at the line's last quote.
+pin_label="$(sed -n "${call_line}p" "$test_file" | tr -d "\\\\" | sed 's/^pin_[a-z_]* "\(.*\)"[[:space:]]*$/\1/')"
 if [[ -z "$new" ]]; then
   echo "$self: nothing to change for ${pin_label}: the digest already matches, or the pin fails for a reason a new digest does not fix." >&2
   exit 4
diff --git a/plugins/planning/tests/repin.test.sh b/plugins/planning/tests/repin.test.sh
index 01bad9c1c7..6ab67d99de 100755
--- a/plugins/planning/tests/repin.test.sh
+++ b/plugins/planning/tests/repin.test.sh
@@ -50,7 +50,7 @@ pin_file() {
   if [[ "\$got" == "\$want" ]]; then echo "ok: \$label"; else echo "FAIL: \$label — changed (want \$want, got \$got). Re-read." >&2; FAILS=1; fi
 }
 # Existing justification for the alpha pin.
-pin_file "alpha file is unchanged (\\\`lock\\\` row)" \\
+pin_file "alpha file is unchanged (\\\`lock\\\` row, \\\\\\"quoted\\\\\\")" \\
   "$WORK/alpha.txt" \\
   "$alpha_sha"
 pin_file "beta file is unchanged" \\
@@ -71,7 +71,7 @@ out="$(run_repin --test-file "$t" 'alpha file' 'Alpha text edited; the defense s
 rc=$?
 if [[ $rc -eq 0 ]]; then ok "stale pin re-pinned: exit 0"; else fail "stale pin: expected exit 0, got $rc: $out"; fi
 if [[ "$out" == *PASS* ]]; then ok "prints PASS"; else fail "no PASS in output: $out"; fi
-if [[ "$out" == *"alpha file is unchanged (\`lock\` row): $STALE -> $ALPHA"* ]]; then ok "prints label: old -> new for the commit"; else fail "label and old -> new not printed: $out"; fi
+if [[ "$out" == *"alpha file is unchanged (\`lock\` row, \"quoted\"): $STALE -> $ALPHA"* ]]; then ok "prints label: old -> new for the commit"; else fail "label and old -> new not printed: $out"; fi
 changes="$(diff "$WORK/stale.before" "$t" | grep -c '^[<>]')"
 if [[ "$changes" -eq 3 ]]; then ok "exactly three lines differ: old sha, new sha, justification"; else fail "expected 3 differing lines, got $changes"; fi
 if grep -qx "  \"$ALPHA\"" "$t"; then ok "alpha sha rewritten"; else fail "alpha sha not rewritten"; fi