[Agent safety] Fingerprint guard: lane-throw coverage, deletion classification, anchor precision (PR #1850 review residuals)

[Chris0Jeky]

Residual gaps noted by the PR #1850 fresh-context review (PR closed #1832; fail-closed today, tracked for completeness):

1. No executable coverage for the lane-throw + clean-checkout path (guard exit 0 -> throw $laneError rethrown after the finally). Pre-existing gap, more relevant now that the harness test anchors the recipe statically — add one harness case that drives it end-to-end.
2. Lane deletion of a clean tracked file (outside the status baseline) exits 1 with "status artifact disappeared before it could be fingerprinted" rather than a classified deleted record. Fail-closed and wave-stopping (correct), but the diagnostic under-describes; classify it.
3. Static anchor precision. The harness test "requires both batch skill wrappers to propagate lane failure after cleanup" anchors on IndexOf('throw $laneError', $cleanup) — the anchor is satisfiable by comment text as well as code; tighten to a structural match.

Source: PR #1850 review (non-blocking items 1-3).

[Chris0Jeky]

[Codex lane claim]\n\nScope: TD-1860-anchor-precision only. I will harden the existing guard-wrapper test so the unwind/rethrow assertion recognizes an executable PowerShell throw statement rather than comment/string text, and add a comment-only negative control.\n\nOwned paths: scripts/agentic/Test-Assert-TaskdeckCheckoutFingerprint.ps1 only. No production guard behavior, lane-throw coverage, or deleted-file classification changes.\n\nAcceptance: focused fingerprint test suite remains green; the negative control proves a comment-only hrow cannot satisfy the assertion; diff remains test-only.\n\nBase: origin/main at execution time.\n\nStatus: active.

[Chris0Jeky]

[Codex lane release]\n\nPR: #2647 (https://github.com/Chris0Jeky/Taskdeck/pull/2647)\nexact head: 2b76df4\nresult: ready for review; test-only TD-1860-anchor-precision slice.\n\nChanged scripts/agentic/Test-Assert-TaskdeckCheckoutFingerprint.ps1 so the lane-error rethrow anchor is found through PowerShell AST executable statements, then added a negative control for comment/string text. Production guard behavior is unchanged.\n\nVerification: pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/agentic/Test-Assert-TaskdeckCheckoutFingerprint.ps1 -> 30 passed, 0 failed; git diff HEAD^ HEAD --check passed.\n\nThe parent issue remains open for the lane-throw and deleted-diagnostic rows.

[Chris0Jeky]

Coordinator note (2026-09-05, D-12 sweep): the Codex session's PR on this issue was reviewed by one fresh-context Opus 5 reviewer (record on the PR) and merged with a merge commit. The PR body used Refs, so this issue stays open; what merged and what remains, from the review:

• PR #2647 merged as 8449a47fa: item 3, the lane-error rethrow anchor is now a PowerShell AST executable-statement check with a negative control (comments and string literals no longer satisfy it). Items 1 and 2 remain. LOWs tracked here: the parse assertion message says "synthetic guard source did not parse" but the helper also parses the production file; the negative control exercises the helper against synthetic text only.