Judge Marker Corruption Against the File, and Collapse a Duplicate on Install

An install onto an already-corrupted CLAUDE.md wrote the corruption into
the stamp. `blocks_present` returns nothing for a duplicated or
half-written block, the stamp records that same nothing, and every later
run found them equal and reported CURRENT. Two wrong answers agreeing read
as a match.

`marker_corruption` judges the file alone. Markers present that yield no
valid block are reported regardless of what the stamp recorded.

The installer also could not clear it. `re.sub` replaced every match with
the snippet, so a file arriving with two blocks kept two, and the remedy
the report prints was a dead end for the one case that most needs it. It
now keeps the first and drops the rest, and says how many it removed.

Five cases added, all failing against the previous code, including that a
stamp hand-edited to record no blocks cannot agree its way to a clean
verdict.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ptr727

host-setup/agent-safety/install.py

@@ -180,6 +180,24 @@ def blocks_present(claude_md):
     return found
 
 
+def marker_corruption(claude_md):
+    """Markers present in the file that yield no valid block, meaning duplicated or half-written.
+
+    Judged against the file alone, never against the stamp. An install onto an already-corrupted
+    CLAUDE.md records the same empty block set it reads, so the stamp and the file agree and the
+    corruption reads as a match. Two wrong answers agreeing is the failure this exists to catch.
+    """
+    if not claude_md.is_file():
+        return []
+    text = claude_md.read_text(encoding="utf-8", errors="replace")
+    valid = blocks_present(claude_md)
+    out = []
+    for marker in ("agent-safety", "fleet-bootstrap"):
+        if re.search(rf"<!-- {marker} v\d+ (?:start|end) -->", text) and marker not in valid:
+            out.append(f"the {marker} markers in CLAUDE.md are duplicated or incomplete")
+    return out
+
+
 def installed_digest(claude_home):
     """A digest over the bytes actually on this machine, or None where the kit is not fully there.
 
@@ -347,6 +365,9 @@ def report(claude_home):
         problems.append("the installed content differs from what this checkout would write")
     # Correct bytes on disk are not a running guard, so the wiring is checked as well.
     problems.extend(registration_problems(claude_home))
+    # Read from the file rather than compared against the stamp.
+    # An install onto a corrupted file writes the corruption into the stamp, and the two then agree.
+    problems.extend(marker_corruption(claude_home / "CLAUDE.md"))
     if live != stamp.get("blocks"):
         problems.append(f"CLAUDE.md now holds {live or 'no blocks'}, where the stamp recorded {stamp.get('blocks') or 'none'}")
     if stamp.get("source", {}).get("dirty"):
@@ -522,7 +543,17 @@ def reject(where, held, want):
         snippet = (HERE / filename).read_text(encoding="utf-8").strip()
         block_re = re.compile(rf"<!-- {marker} v\d+ start -->.*?<!-- {marker} v\d+ end -->", re.DOTALL)
         if block_re.search(existing):
-            existing, action = block_re.sub(lambda _: snippet, existing), "updated"
+            # Keep the first occurrence and drop any duplicate, rather than rewriting each in place.
+            # Substituting every match preserved the duplication, so a file arriving with two blocks kept two.
+            # The report's own remedy of re-running could then never clear it.
+            written = []
+
+            def once(_match, _snippet=snippet, _written=written):
+                _written.append(True)
+                return _snippet if len(_written) == 1 else ""
+
+            existing = block_re.sub(once, existing)
+            action = "updated" if len(written) == 1 else f"updated, {len(written) - 1} duplicate(s) removed"
         else:
             sep = "" if existing == "" or existing.endswith("\n\n") else ("\n" if existing.endswith("\n") else "\n\n")
             existing, action = existing + sep + snippet + "\n", "appended"

host-setup/agent-safety/test_install.py

@@ -296,6 +296,58 @@ def test_reinstalling_clears_an_unregistered_hook(self):
         self.assertEqual(run(self.home, "--report").returncode, 0)
 
 
+class TestPreexistingCorruption(StampCase):
+    """A file corrupted before the install, where the stamp records the corruption and agrees."""
+
+    def _duplicate(self, marker="agent-safety"):
+        text = self.md.read_text(encoding="utf-8")
+        block = re.search(rf"<!-- {marker} v1 start -->.*?<!-- {marker} v1 end -->",
+                          text, re.DOTALL).group(0)
+        self.md.write_text(text + "\n" + block + "\n", encoding="utf-8")
+
+    def test_installing_onto_a_duplicated_block_does_not_report_current(self):
+        """The stamp is built from the same empty block set the file yields, so both agree."""
+        self.install()
+        self._duplicate()
+        # Install again: the stamp is now written from a file that already carries the duplicate.
+        self.install()
+        r = run(self.home, "--report")
+        self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
+        # The install collapsed it, which is why this is CURRENT rather than a standing STALE.
+        self.assertEqual(install.blocks_present(self.md), {"agent-safety": "v1", "fleet-bootstrap": "v1"})
+
+    def test_the_installer_collapses_a_duplicate_rather_than_preserving_it(self):
+        """Substituting every match kept both blocks, so the printed remedy never worked."""
+        self.install()
+        self._duplicate()
+        self.assertEqual(install.blocks_present(self.md), {"fleet-bootstrap": "v1"})
+        self.install()
+        text = self.md.read_text(encoding="utf-8")
+        self.assertEqual(len(re.findall(r"<!-- agent-safety v1 start -->", text)), 1)
+
+    def test_markers_that_yield_no_valid_block_are_reported_regardless_of_the_stamp(self):
+        """A stamp recording no blocks must not agree its way into a clean verdict."""
+        self.install()
+        self._duplicate()
+        stamp = json.loads(self.stamp.read_text(encoding="utf-8"))
+        stamp["blocks"] = {}
+        self.stamp.write_text(json.dumps(stamp) + "\n", encoding="utf-8")
+        r = run(self.home, "--report")
+        self.assertEqual(r.returncode, 1, r.stdout + r.stderr)
+        self.assertIn("duplicated or incomplete", r.stdout)
+
+    def test_a_half_written_block_is_reported_as_corruption(self):
+        self.install()
+        text = self.md.read_text(encoding="utf-8")
+        self.md.write_text(re.sub(r"<!-- agent-safety v1 end -->", "", text), encoding="utf-8")
+        self.assertEqual(install.marker_corruption(self.md),
+                         ["the agent-safety markers in CLAUDE.md are duplicated or incomplete"])
+
+    def test_a_clean_file_reports_no_corruption(self):
+        self.install()
+        self.assertEqual(install.marker_corruption(self.md), [])
+
+
 class TestStampVersion(StampCase):
     def test_a_stamp_from_a_different_format_version_is_rejected(self):
         """The field exists so a shape change is detectable, which needs it to be read."""