[melodic-automation-lanes]

Refs: #12894

Summary

Ad hoc tidy sweep of plugins/repo-fleet-hygiene/** (no lane file; anchor commit: none (ad hoc)). One structure-only tidying, Beck #3 Normalize Symmetries: append_decision in skills/apply/scripts/apply-plan.sh pushed positional parameters 12-15 before 1-11. It now appends $1 through $15 in order, matching the D_* declaration order above it.

Fix

• plugins/repo-fleet-hygiene/skills/apply/scripts/apply-plan.sh: moved the four D_REMOTE / D_CLASS / D_KEY / D_REPO appends after D_WT_PATH (+4 / -4). Each line appends to its own array, so the order of the appends cannot change any record.
• .changes/repo-fleet-hygiene/…-e9cae37a.md: patch changelog fragment.

Verification

• shellcheck -x on apply-plan.sh: clean.
• bash plugins/repo-fleet-hygiene/skills/apply/scripts/apply-plan.test.sh: one failure, block-dangerous-git allows the lease-guarded delete. That test runs the guardrails hook against this environment, and it fails the same way on the base commit with the change stashed. The PASS/FAIL lines with and without the change are identical.
• Hunt results: shellcheck -x over every .sh in the plugin found only SC2317 info notes in sync-fleet.test.sh (helpers invoked indirectly). No function is defined without a reference.

Related

• Deferred candidates: none. The scope budget deferred nothing.
• Not candidates: scripts/fleet-discovery.sh and scripts/scope-resolve.sh are canonical copies that plugins/source-control/scripts/ mirrors byte for byte (scripts/cross-plugin-source-registry.txt). worktree-root-resolve.sh and worktree-root-legacy.sh copy source-control's canonical files, and lib/prerequisites.* are generated shared copies. A tidy confined to this area cannot edit any of them, so they were not hunted.
• main_worktree is defined in both audit-fleet.sh and sync-fleet.sh, but the two bodies differ (probe wrapper, CR handling, empty-path check). Merging them would change behavior, so it was not filed as a tidying.

[github-actions]

claude-security-review reviewed 07344c96b3602c2643e57dcd52be69358580b1ad: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

Security review: no security issues found

I read the whole diff for both changed files. Neither matches a trusted-path glob.

• plugins/repo-fleet-hygiene/skills/apply/scripts/apply-plan.sh: in append_decision, the four appends D_REMOTE, D_CLASS, D_KEY and D_REPO (from ${12:-} through ${15:-}) now come after D_WT_PATH instead of before D_PHASE. The statements and their parameter expansions are unchanged; only their order moved. Each line appends to its own array and none of them reads another, so every record comes out the same. Nothing new is quoted, expanded, run or allowed through.
• .changes/repo-fleet-hygiene/...-e9cae37a.md: a patch changelog fragment, prose only.

The change touches no plugin manifest, trust control, merge hold, token scope or standing instruction. The PR description contains no embedded directives aimed at this lane. There are no prior findings: 0 rounds so far, cap 3, not past the cap.

critical-findings: 0

[github-actions]

claude-review reviewed 07344c96b3602c2643e57dcd52be69358580b1ad: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings

I read every hunk of both changed files. Neither matches a trusted-path glob.

• plugins/repo-fleet-hygiene/skills/apply/scripts/apply-plan.sh: append_decision now appends D_REMOTE, D_CLASS, D_KEY and D_REPO after D_WT_PATH, not before D_PHASE. Each line appends one positional parameter to its own array. No line reads another array or changes the positional parameters, so moving them cannot change any record. The body now runs $1 through ${15} in the same order as the D_* declarations at lines 497–511 (head L513-L529).
  • If a caller passed fewer than 11 arguments, set -u would stop the script before or after the moved lines. The script exits either way, so this changes nothing in practice.
• .changes/repo-fleet-hygiene/…-e9cae37a.md: bump: patch fits a change that only reorders lines and leaves behavior the same. No plugin manifest changed, so no manifest checks apply.

Closing issue: the PR context names no closing-issue section. The body only says Refs: #12894, so I had no acceptance criteria to check against.

Verification: the author says shellcheck -x is clean and that the one failing test in apply-plan.test.sh also fails on the base commit. Both claims are the author's and unverified: I had no shell, so I ran nothing.

No prior findings; round 1 of a cap of 3.

[melodic-automation-lanes]

The unattended merge path armed native auto-merge at head 07344c96b3602c2643e57dcd52be69358580b1ad.

[melodic-automation-lanes]

The post-merge check verified merge commit 02534fd017cc9f5ea0c41b7bf1af0601d6eb721a; later checks count it verified from this comment.