fix(update): self-heal a present-but-stale manifest (pre-#76 vintage)

closes the stuck-vintage gap for hosts instantiated between #60 and #76:
their manifest is present but does not list itself, so every sync run
assembles the old file list and can never deliver the manifest's own
replacement — the host stays behind forever. First field case:
ND-DAC-DOME/naval-sensor-fusion (instantiated 2026-06-30): three files
permanently undeliverable (template-manifest.sh, ask.md,
wiki-reciprocity.py) and Edge-Types.md.template un-updatable (on disk
from instantiation, but outside the stale sync list).

The existing #74 self-heal only fired on a MISSING manifest. Extend the
trigger: also heal when the local manifest lacks the quoted entry
"scripts/lib/template-manifest.sh" — every post-#76 manifest carries its
own path as an array entry, so the probe is an unambiguous vintage
signature (verified: zero occurrences of the string anywhere in the
c19eec8-era file, entry present in every manifest since).

Red-first via the new integration fixture stale-manifest-self-heal:
against the unfixed script, 5 assertions fail — no heal note, manifest
unreplaced, post-#76 files undelivered. With the fix: 11/11, including
convergence (run 2 sources the healed on-disk manifest, does not
re-trigger, reports Changed (0)). Reverting the fix brings back the
same 5 failures.

Field-validated on a clone of naval-sensor-fusion itself: run 1 (their
2026-06-30 updater) delivers 8 files off the old list; run 2 (the new
updater) prints the heal note and delivers the final 3; run 3 reports
Changed (0).

Author: psaboia

scripts/test/tests/integration/stale-manifest-self-heal/assertions.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Assertions: update-from-template.sh must detect a PRESENT-but-STALE local
+# manifest (pre-#76: does not list itself), assemble this run's file list
+# from the template ref's manifest instead, and thereby deliver both the
+# manifest replacement and the files only the new manifest lists. Without
+# the stale trigger the run uses the old list and the host is stuck forever.
+
+STAGE="$SANDBOX/stale-manifest-self-heal"
+H="$STAGE/host"
+
+RUN1_LOG="$STAGE/run1.log"
+( cd "$H" && bash scripts/update-from-template.sh --template-url="$STAGE/template-src" ) \
+    > "$RUN1_LOG" 2>&1
+RC1=$?
+
+assert "run 1 exits 0" "[ $RC1 -eq 0 ]"
+assert "run 1 announces the stale-manifest self-heal" \
+    "grep -qF 'predates #76' '$RUN1_LOG'"
+
+# The core of the fix: files only the CURRENT manifest lists arrive.
+assert "manifest on disk replaced (now lists itself)" \
+    "grep -qF '\"scripts/lib/template-manifest.sh\"' '$H/scripts/lib/template-manifest.sh'"
+assert "wiki/Edge-Types.md.template delivered" \
+    "[ -f '$H/wiki/Edge-Types.md.template' ]"
+assert ".claude/commands/ask.md delivered" \
+    "[ -f '$H/.claude/commands/ask.md' ]"
+assert "scripts/wiki-reciprocity.py delivered" \
+    "[ -f '$H/scripts/wiki-reciprocity.py' ]"
+
+# Control: the normal sync path is unaffected (old-list file synced with
+# {{REPO_NAME}} substituted from the on-disk wiki name).
+CTRL="$H/.claude/commands/wiki-experiment.md"
+assert "control: old-list file synced" "grep -q 'command for stalehost' '$CTRL'"
+assert "control: no {{REPO_NAME}} left" "! grep -q '{{REPO_NAME}}' '$CTRL'"
+
+# Convergence: a second run sources the now-healthy on-disk manifest, does
+# not re-trigger the self-heal, and reports nothing to change.
+RUN2_LOG="$STAGE/run2.log"
+( cd "$H" && bash scripts/update-from-template.sh --template-url="$STAGE/template-src" ) \
+    > "$RUN2_LOG" 2>&1
+RC2=$?
+
+assert "run 2 exits 0" "[ $RC2 -eq 0 ]"
+assert "run 2 does NOT re-trigger the self-heal" \
+    "! grep -qF 'predates #76' '$RUN2_LOG'"
+assert "run 2 reports zero changed files" \
+    "grep -qF 'Changed (0):' '$RUN2_LOG'"

scripts/test/tests/integration/stale-manifest-self-heal/patch.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Patch: fixture for the stale-manifest self-heal in update-from-template.sh.
+#
+# Field case: hosts instantiated between the manifest consolidation (#60,
+# 2026-06-28) and the manifest-ships-itself fix (#76, 2026-07-10) carry a
+# manifest that is PRESENT but does not list itself. Their update runs
+# assemble the file list from that stale manifest, which can never deliver
+# its own replacement — the host is stuck on the old list forever (first
+# observed on ND-DAC-DOME/naval-sensor-fusion, instantiated 2026-06-30).
+#
+# Effects: creates $SANDBOX/stale-manifest-self-heal/ with:
+#   template-src/  stand-in template repo (branch main) holding the CURRENT
+#                  manifest plus three files only the current manifest lists
+#                  (wiki/Edge-Types.md.template, .claude/commands/ask.md,
+#                  scripts/wiki-reciprocity.py) and one old-list file with a
+#                  {{REPO_NAME}} token (control: normal sync still works)
+#   host/          project with the CURRENT sync tooling under scripts/ but a
+#                  STALE manifest: derived from the current one by deleting
+#                  the self-listing and the three post-#76 entries — the
+#                  exact shape of the stuck vintage (functional, sources
+#                  cleanly, omits itself)
+#
+# Hermetic: the "remote" is a local path.
+
+set -uo pipefail
+
+HERE_PATCH="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEMPLATE_ROOT="$(cd "$HERE_PATCH/../../../../.." && pwd)"
+
+STAGE="$SANDBOX/stale-manifest-self-heal"
+mkdir -p "$STAGE"
+
+g() { git "$@"; }
+
+# --- template-src: minimal current-shape template repo ---
+T="$STAGE/template-src"
+g init -q "$T"
+g -C "$T" symbolic-ref HEAD refs/heads/main
+mkdir -p "$T/scripts/lib" "$T/.claude/commands" "$T/wiki"
+cp "$TEMPLATE_ROOT/scripts/lib/template-manifest.sh" "$T/scripts/lib/"
+printf '# Edge-Types for {{REPO_NAME}} (rendered by init-wiki)\n' > "$T/wiki/Edge-Types.md.template"
+printf 'ask command body\n'            > "$T/.claude/commands/ask.md"
+printf '#!/usr/bin/env python3\n'      > "$T/scripts/wiki-reciprocity.py"
+printf 'command for {{REPO_NAME}}\n'   > "$T/.claude/commands/wiki-experiment.md"
+g -C "$T" add -A
+g -C "$T" commit -q -m "template content"
+
+# --- host: current tooling + genuinely stale manifest ---
+H="$STAGE/host"
+g init -q "$H"
+mkdir -p "$H/wiki/stalehost.wiki" "$H/.claude/commands" "$H/scripts/lib"
+: > "$H/wiki/stalehost.wiki/SCHEMA_stalehost.md"
+printf 'stale local content\n' > "$H/.claude/commands/wiki-experiment.md"
+cp "$TEMPLATE_ROOT/scripts/update-from-template.sh" "$H/scripts/"
+cp "$TEMPLATE_ROOT/scripts/check-template-version.sh" "$H/scripts/"
+cp "$TEMPLATE_ROOT"/scripts/lib/*.sh "$H/scripts/lib/"
+
+# Stale manifest: current one minus the self-listing and the post-#76
+# entries. Still valid bash, still assembles — just the stuck-vintage list.
+sed -e '/"scripts\/lib\/template-manifest.sh"/d' \
+    -e '/"wiki\/Edge-Types.md.template"/d' \
+    -e '/".claude\/commands\/ask.md"/d' \
+    -e '/"scripts\/wiki-reciprocity.py"/d' \
+    "$TEMPLATE_ROOT/scripts/lib/template-manifest.sh" \
+    > "$H/scripts/lib/template-manifest.sh"
+
+# Sanity: the stale manifest must source cleanly and must NOT list itself —
+# otherwise the fixture is not exercising the stuck vintage at all.
+bash -n "$H/scripts/lib/template-manifest.sh"
+if grep -qF '"scripts/lib/template-manifest.sh"' "$H/scripts/lib/template-manifest.sh"; then
+    echo "  ERROR: fixture failed to produce a stale (non-self-listing) manifest" >&2
+    exit 1
+fi
+
+echo "  stale-manifest-self-heal patch applied: fixtures at $STAGE"

scripts/update-from-template.sh

@@ -89,23 +89,45 @@ TEMPLATE_REF="template/$TEMPLATE_BRANCH"
 TEMPLATE_SHA=$(git rev-parse --short "$TEMPLATE_REF")
 echo "Template HEAD: $TEMPLATE_SHA"
 
-# --- Load the template manifest (bootstrap when the host lacks it, #74) ---
-# Hosts adopted before the manifest shipped itself have an updater whose
-# file list lives in a file they never received; sourcing it directly would
-# die before the fetch that could deliver the fix. Materialize the manifest
-# from the just-fetched template ref into a TEMP file and source that — the
-# sync loop below then installs scripts/lib/template-manifest.sh on disk
-# like any other missing manifest-listed file (or reports it, on --dry-run).
+# --- Load the template manifest (self-heal when the host's copy can't) ---
+# Two vintages need healing. Hosts adopted before the manifest shipped
+# itself (#74) have an updater whose file list lives in a file they never
+# received; sourcing it directly would die before the fetch that could
+# deliver the fix. Hosts instantiated between #60 and #76 have a manifest
+# that is PRESENT but does not list itself, so a sync assembled from it can
+# never deliver its own replacement. In both cases, materialize the
+# manifest from the just-fetched template ref into a TEMP file and source
+# that — the sync loop below then installs/updates the on-disk copy like
+# any other manifest-listed file (or reports it, on --dry-run).
 MANIFEST_PATH="$HERE/lib/template-manifest.sh"
+_manifest_heal_reason=""
 if [[ ! -f "$MANIFEST_PATH" ]]; then
+    _manifest_heal_reason="missing (host adopted before #74)"
+elif ! grep -qF '"scripts/lib/template-manifest.sh"' "$MANIFEST_PATH"; then
+    # Present but stale: a pre-#76 manifest does not list itself, so a sync
+    # assembled from it can never deliver its own replacement — the host
+    # stays on the old file list forever (hosts instantiated between #60
+    # and #76; first field case: naval-sensor-fusion, 2026-06-30 vintage).
+    # Every post-#76 manifest carries its own path as an array entry, so
+    # the quoted-string probe is an unambiguous vintage signature.
+    _manifest_heal_reason="present but stale (predates #76: does not list itself)"
+fi
+if [[ -n "$_manifest_heal_reason" ]]; then
     MANIFEST_PATH=$(mktemp)
     if ! git show "$TEMPLATE_REF:scripts/lib/template-manifest.sh" > "$MANIFEST_PATH" 2>/dev/null; then
         rm -f "$MANIFEST_PATH"
-        echo "error: scripts/lib/template-manifest.sh is missing locally AND absent from $TEMPLATE_REF; cannot assemble the sync file list" >&2
+        echo "error: scripts/lib/template-manifest.sh is unusable locally AND absent from $TEMPLATE_REF; cannot assemble the sync file list" >&2
         exit 1
     fi
-    echo "note: local scripts/lib/template-manifest.sh missing (host adopted before #74);"
-    echo "      bootstrapped this run's copy from $TEMPLATE_REF. The sync below installs it."
+    if [[ "$_manifest_heal_reason" == missing* ]]; then
+        # Wording kept verbatim from the #74 fix (the adopted-host-sync
+        # fixture pins it as the legacy host's observable signal).
+        echo "note: local scripts/lib/template-manifest.sh missing (host adopted before #74);"
+        echo "      bootstrapped this run's copy from $TEMPLATE_REF. The sync below installs it."
+    else
+        echo "note: local scripts/lib/template-manifest.sh $_manifest_heal_reason;"
+        echo "      using $TEMPLATE_REF's copy for this run. The sync below updates it on disk."
+    fi
 fi
 # shellcheck source=lib/template-manifest.sh
 source "$MANIFEST_PATH"