All four LOW; no HIGH remained. The subject_of fix from round 2 was confirmed
correct across every message shape and all 38 historical commits.
1. The old-git compat check was a VALUE sentinel: it blanked any trailer whose
value happened to equal the atom string, so a legitimate
`Decisions-Edit: %(trailers:key=Decisions-Edit,valueonly)` was silently
discarded. Replaced with a capability probe on `git --version` (>= 2.22).
Detecting by version instead of by sniffing output removes the collision
class entirely rather than narrowing it. Unknown/unparseable version resolves
to False -- trailers ignored, subject-only matching -- which is the safe
direction: a trailer-only token not arming is an annoyance, whereas reading an
unexpanded atom as a value would falsely arm and disable the guard.
2. The compat test never called `_token_armed`, so it pinned nothing -- deleting
the guard would have left it green. Replaced with three tests that drive the
real function through a stubbed `_run`, covering old git (trailers ignored),
modern git (trailer arms), a tokened subject surviving an unusable trailer,
and version-string parsing incl. unparseable input. Proven non-vacuous:
forcing the probe True makes the old-git test fail.
3. `_repo()` still ignored return codes from init/config/base-commit and never
checked that the base sha resolved, so a rejected base could leave it
returning ("", <root sha>) and negative range tests would pass vacuously. All
commands are now checked and the base sha is asserted to be a full 40 chars.
4. docs/decisions.md line 65 still said "append it, as every prior use does".
37 of 38 append; docs(434) is mid-subject.
timothy
851dca2596