chore: self-heal — 3 backlog items

[fxmaxvl]

Three items from the 2026-10-04 audit backlog. Each removes a token cost that recurs on every run.

#81 and #83 stay open because both still have items left. It overlaps with #78 in skills/review/SKILL.md only, in different hunks: the convention-resolution lines here, the scope section there.

#83 item 2 — Add a convention resolver script instead of a 3-probe lookup by the model

Ask: move the per-convention lookup out of the model and into a script, and remove the copies of the procedure.

Change:

• New skills/scan-conventions/scripts/resolve-conventions.sh <name>.... It prints {"<name>": "<winning path>" | null} for each name.
• Convention Lookup in plugin-main.md keeps the three-tier rule as the definition and now tells callers to use the script.
• The word-for-word copies at micro/execute/SKILL.md:22 and feature/quality-gate/SKILL.md:29 now point to it.

Verified: bash -n, then the script was run on fixtures, checking both the match and no-match cases.

Case	Result
Plugin files only	Resolves dev, testing and git from conventions/
Project, user and plugin tiers all present	The project's dev wins, the user's testing wins over the plugin's, and git falls back to the plugin
.md suffix in the name	Accepted
Unknown name	null
No argument	Usage error, exit 2
Outside a git repo	Falls back to the user tier

The static audit reports no orphan script.

#83 item 3 — Have a script filter the branch diff for added TODO lines

Ask: stop loading the whole git diff <base>...HEAD into context just to find added TODO lines.

Change:

• New skills/feature/scripts/added-todos.sh <base> [<file>...]. It prints [{file, line, text, context}] for added or modified lines that match todo (case-insensitive). line is the line number at HEAD, and context holds up to 2 lines on each side.
• collect-todos step 1 calls the script and keeps the remote-tracking-base rule.

Verified: bash -n, then the script was run on a fixture repo, checking both the match and no-match cases.

Case	Result
Branch adds two TODOs, one lowercase, and a TODO already existed	Reports the two new ones at their HEAD lines; the pre-existing one is excluded
Restricted to one file	Only that file's TODO
Context	±2 lines around the TODO, taken from HEAD
A file with no TODO	[]
Bad base	{"error":"bad_base"}, exit 1

#81 item 2 — Pass sub-skill paths, not contents, in feature's parallel audit fan-out

Ask: the parallel audit branch passed the contents of three SKILL.md files to its agents, against the Agent invocation rule at feature/SKILL.md:29.

Change: feature/SKILL.md:378-380 now says "dispatch feature/<x>/SKILL.md as an Agent", matching :29 and the sequential branch at :352-354.

Verified (documentation): I re-read the edited lines. No "contents of" phrasing is left in feature/SKILL.md.

Review follow-ups (/bf:review, two fix rounds, final status PASS)

added-todos.sh hardening

• A failed git diff (for example, no merge base) is now a diff_failed error instead of [].
• The parse no longer depends on user diff config: --no-color --no-ext-diff and explicit prefixes.
• +++ counts as a file header only before the first hunk.
• todo must be a standalone word: TODO:, TODO-123 and # todo x match; todos, added-todos.sh and mastodon don't.
• Errors are built with jq, use exit 1, and the script runs under set -euo pipefail like the scripts beside it.

Convention tiers in one place

• New sourced helper skills/scan-conventions/scripts/convention-tiers.sh.
• resolve-conventions.sh and discover-conventions.sh both read the tier order from it, and discover's output is unchanged.
• discover-conventions.sh no longer uses declare -A, so it runs on stock macOS bash 3.2. This bug was already on main.

Lookup migration finished

• review (dry-run and Phase 1), decide and discuss now call resolve-conventions.sh instead of probing the tiers.
• The review edge case for a missing convention now keys on null.

Smoke scripts

• added-todos-smoke.sh (10 cases) and resolve-conventions-smoke.sh (11 cases) both pass with /bin/bash 3.2 first on PATH, which covers the scripts they call too.
• They're indexed in the new maintainer note skills/SMOKE-TESTS.md. The static audit's orphan check counts any .md under skills/ as a reference, so this keeps the run-the-smoke notes out of runtime SKILL.md text.
• In mutation checks, reverting the TODO-123 fix or putting declare -A back each makes a smoke script fail.

Left as non-blocking notes

• The smoke pointer for added-todos appears in two places.
• No smoke case covers a path containing a space. It was checked by hand.
• A crash in a script under test stops its smoke script with no FAIL line, though the run still exits non-zero.

---

Refs #81, #83