fix(secret-gate): a documented fake id must not stop the machine tier

The live-sync heartbeat failed three hourly ticks (22:25, 23:27, 00:28) because a
managed skill that documents how to write a secret gate quotes the vendor's
all-zeros placeholder access-key id, and the shape rule fired on the
documentation. The machine tier is prose ABOUT credentials — the gate's own header
says a gate that fires there gets overridden until it means nothing — and a
heartbeat that cannot commit is a fleet that silently stops syncing config.

- shape hits are judged on the matched token, not the line: a documented fake is
  inert, one live token sharing the file still blocks. The match is judged with
  its following context, because a fixed quantifier truncates `EXAMPLE` to `EXA`
  and the placeholder would vanish from what is examined.
- assignment values keep the stricter rule from the previous commit: a comment on
  the same line cannot vouch for the token beside it.
- `ALLOW_SECRETS` remains the only override; nothing here widens what is scanned,
  it only stops flagging text that was never a credential.

Verified against the payload that is stuck right now: the skill page that the
heartbeat cannot commit passes the fixed hook and was refused by the live one.

Refs #60

.githooks/pre-commit

@@ -79,7 +79,24 @@ while IFS= read -r -d '' f; do
   # gate refused the redaction of the password it exists to catch.
   added=$(printf '%s\n' "$diff" | grep -E '^\+' | grep -vE '^\+\+\+' | sed 's/^+//' || true)
   [ -z "$added" ] && continue
-  hits=$(printf '%s\n' "$added" | grep -Ei "$shapes" || true)
+  # Shape hits are judged on the MATCHED TOKEN, not on the whole line. Documentation about
+  # credentials quotes vendor placeholders — AWS publishes an all-zeros access-key id that ends
+  # in EXAMPLE for exactly this purpose — and
+  # a gate that blocks prose over an inert example gets worked around until it means nothing:
+  # the live-sync heartbeat failed three ticks on 2026-10-21 because a managed skill page quotes
+  # exactly that id. A line is exempted only when EVERY shape on it is inert, so one live token
+  # sharing the file with a documented fake still blocks.
+  hits=$(printf '%s\n' "$added" | while IFS= read -r line; do
+           live=0
+          while IFS= read -r m; do
+            # The shape regexes carry fixed quantifiers, so the match they return is TRUNCATED:
+            # `AKIA` + exactly 16 characters stops inside the word EXAMPLE and the placeholder
+            # disappears from what is judged. Judge the match plus what follows it instead.
+            ctx=$(printf '%s' "$line" | awk -v m="$m" '{ i = index($0, m); print (i > 0 ? substr($0, i, length(m) + 8) : m) }')
+            printf '%s' "$ctx" | grep -Eiq 'EXAMPLE|X{4,}|Y{4,}|Z{4,}|_{4,}|REDACTED|CHANGEME|PLACEHOLDER' || live=1
+          done < <(printf '%s\n' "$line" | grep -Eio "$shapes" || true)
+           [ "$live" = 1 ] && printf '%s\n' "$line"
+         done)
   if [ "${f##*.}" != "md" ]; then
     # The placeholder filter reads the VALUE, never the whole line. A trailing comment that
     # says `# example` says nothing about the token the same line assigns; scoping the filter

omp-docs/log.md

@@ -20,28 +20,63 @@ This page is the bundle's **only** work log: one file, at the root. Never start
 second one in a subdirectory or under another name — `scripts/kb-lint.sh` reports any
 `log.md` that is not this one.
 
+## 2026-10-21 — reviewing a day of work, and finding checks that lie
+
+Two-axis review (Standards / Spec) of everything landed 2026-10-20 → 2026-10-21: 51 commits,
+30 findings, worked on `fix/60-review-findings` (issue #60). Three findings were the same shape —
+a check that reports confidence it did not earn:
+
+- **A guard that cannot see must refuse.** `pcie-probe.sh` dropped the `/dev/kfd` half of its
+  busy check when `fuser` was absent, and `gpu_busy_percent` reads `0` for a resident-but-idle
+  service: the tool measured beside a live endpoint while its own LAW said not to. Missing
+  visibility is now a refusal (exit `3`), not a narrower check.
+- **A swallowed status is a false report.** `deploy.sh` printed `ENABLE` for units systemd
+  refuses to enable (`live-sync.service` has no `[Install]` section; its timer arms it), and the
+  loop walked `*.service` only, so a rebuilt box deployed the heartbeat and never armed its
+  timer. Every outcome now reports what actually happened.
+- **A gate that reads a quoted path reads nothing.** git quotes non-ASCII paths in
+  `--name-only` output; the quoted name came back as an empty diff and the secret gate
+  `continue`d past it. Fail closed means `-z`, and it means the placeholder filter reads the
+  assigned value — a comment saying `# example` cannot vouch for the token beside it.
+
+The law that cost the most, from the probe: **a test that observes the tool's environment instead
+of what the tool passed on cannot see the bug.** The stub probe echoed `$HIP_VISIBLE_DEVICES`
+rather than its argument, so the suite asserted the mask was set and per-card bandwidth was
+unobtainable on the 2×R9700 box. Model the platform rule in the stub and the existing test goes
+red against the old code — that is the red-proof worth having.
+
+Incident, found while verifying the gate: the live-sync heartbeat had failed three hourly ticks,
+because a managed skill that documents how to write a secret gate quotes the vendor's all-zeros
+placeholder id and the gate's shape rule fired on the documentation. Prose about credentials is
+what the machine tier is made of; a gate that blocks it is worked around, and the workaround is
+the hole. Placeholder judgement reads the matched token — plus what follows it, because a fixed
+quantifier truncates `EXAMPLE` to `EXA` — never the whole line. `ALLOW_SECRETS` stays the only
+override, and the heartbeat's own payload was replayed through the fixed hook to prove it lands.
+
 ## 2026-10-21 — a documented mode the panel never had
 
 The home ultrawide had been running at 60 Hz for weeks while `desk-1-home.kdl`
 asked for `3440x1440@239.999`. The page that owns that file documented the same
 phantom mode, so every reader — including tonight's inspection — trusted it.
-`niri msg outputs` says the Sceptre M34's EDID tops out at 180 Hz; there is no
+The panel does offer a 240-class mode: `niri msg outputs` lists `3440x1440@239.998`. The defect
-240 Hz mode to ask for.
+was one character — niri matches mode strings verbatim, and `239.999` is not `239.998`.
 
 Laws, now on [tools/niri/displays](tools/niri/displays.md):
 
-- **An impossible mode does not fail, it falls back.** niri logs
+- **A mode string must match the advertised string verbatim.** niri does not round:
-  `configured mode … could not be found, falling back to preferred` and drives
+  `3440x1440@239.999` does not select `3440x1440@239.998`. It logs
-  the EDID preferred mode — 60 Hz here. A config typo therefore looks like a
+  `configured mode … could not be found, falling back to preferred` and drives the EDID
-  dying monitor, and every connector drop re-enacts it.
+  preferred mode — 60 Hz here. A one-character typo therefore looks like a dying monitor, and
+  every connector drop re-enacts it.
 - **Three layers, three signatures:** config fallback, DP link drops, and
   amdgpu `DMCUB` errors with `EINVAL` page flips after s2idle. Only the first
   yields to a file edit; only the last yields to a reboot. Triage table and
   probes are on the page.
-- **A number in a page is a claim, not a measurement.** Modes, refresh rates and
+- **A number in a page is a claim, not a measurement.** Mode strings, refresh rates and tool
-  tool availability were wrong on four pages at once — `wlr-randr` was listed as
+  availability were wrong on several pages at once — `wlr-randr` was listed as installed while
-  installed while `pacman -Qs wlr` matches nothing. Read the hardware before
+  `pacman -Qs wlr` matches nothing. Read the hardware before writing a mode into a runbook, and
-  writing a mode into a runbook, and destroy the stale copies.
+  destroy the stale copies. A correction is itself a measurement: the first pass at this entry
+  published a second wrong hardware fact, with a `verified:` date stamped on it.
 
 Fix: `desk-1-home.kdl` 239.999 → 180.000 on the identity block and both legacy
 connector blocks, applied live with `niri msg output <panel> mode <mode>` — the

tests/secret-gate.bats

@@ -189,3 +189,16 @@ export API_KEY_FILE=/run/secrets/api_key'
   printf '%s\n' "$output" | grep -qx '  b/two.env'
   ! printf '%s\n' "$output" | grep -qE 'hunter2corp2026 +b/two\.env'
 }
+
+@test "a documented fake id in prose is committable; a live-shaped id in the same file is not" {
+  # Measured on blankpad 2026-10-21: the live-sync heartbeat failed three ticks in a row
+  # because a managed-skill page documents how to write a secret gate and quotes AWS's own
+  # placeholder id. A gate that blocks the machine tier over an inert example gets worked
+  # around, and a workaround is the hole. The exemption reads the matched token, so a real
+  # id in the same file still blocks.
+  try_commit "docs.md" 'Inert fixtures look like AKIAIOSFODNN7EXAMPLE or AKIA0000000000000EXAMPLE.'
+  [ "$status" -eq 0 ]
+  try_commit "docs.md" 'Inert fixture AKIAIOSFODNN7EXAMPLE and a live one AKIAQZR4W7DBPCFG7V3Q.'
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"docs.md"* ]]
+}