The token was armed by a bare substring match over every commit message in the
range, so a commit that merely DESCRIBED the mechanism armed it and skipped the
entire `if not token:` block -- all three rationale-rewrite comparisons (active
survivors, active->archive laundering, archive survivors). `removed` and `demoted`
still ran, so the job printed `decisions-validate: OK` while doing nothing. It
bit in PR#605, which had hand-resolved an append-vs-append conflict inside
docs/decisions.md -- precisely the operation the guard exists to police.
Now recognized in exactly two places:
* the commit SUBJECT line -- the established form. All twenty prior tokened
commits append it to the subject (or place it mid-subject, as docs(434)
does); none put it on its own line, so the obvious "own-line only" rule
would have broken every historical use.
* a `Decisions-Edit: <reason>` git trailer -- the forward-looking form, which
can carry a reason the bracketed marker cannot.
Fail-open posture unchanged: unresolvable git means the token reads unarmed, so
the guard still runs.
Verified by measuring the guard rather than reading a green check -- a positive
control over the real corpus across all three placements: no token fires (exit 1),
subject token suppresses (exit 0), body-only mention fires (exit 1). Plus an
end-to-end matcher test against a throwaway git repo covering the established
form, mid-subject placement, the trailer, a merge commit quoting a tokened PR
title, a multi-commit range, and an unresolvable ref.
fixes#609
timothy
4596603020