fix: rule-test self-checks pass under BusyBox grep

CHANGELOG.md

@@ -8,6 +8,10 @@ Please choose versions by [Semantic Versioning](http://semver.org/).
 * MINOR version when you add functionality in a backwards-compatible manner, and
 * PATCH version when you make backwards-compatible bug fixes.
 
+## Unreleased
+
+- fix: **`scripts/resume-block-card-rule-test.sh` and `scripts/checkpoint-state-rule-test.sh` pass inside the Alpine github-update-go-agent image.** Their unreadable-file self-check passes a directory to `grep -qF` and expects exit 2. BusyBox grep exits 1 on a directory, which reads as "no match", so `make precommit` exited 2 in every vault-cli update-go Job while passing on macOS. Both helpers now report `UNREADABLE` for any non-regular file before calling grep, so the check no longer depends on how grep treats a directory.
+
 ## v0.178.1
 
 - fix: **`/vault-cli:update-topic` reads goals grouped under `###` subsections.** v0.178.0 bounded the Goals section at the next heading of *any* level, so it stopped at the first `### ` and read only the entries above it: on `Development Pipeline Throughput`, whose 31 entries keep 29 of themselves inside `### Lever A/B/C/D`, it reported **28 goals missing against a true diff of 0** and would have duplicated them all into `## Goals`. The bound is now **level-relative** — `## Goals` runs to the next `#` or `##`, `# Goals` to the next `#` — which keeps the protection against a sibling section while including the grouping the page actually uses. ⚠️ **The entry rule is now a shipped, tested script** rather than prose the model re-derives each run: `scripts/update-topic-goal-entries.sh` prints `<name><TAB><status token or "none">`, exits **3** on a page with no Goals heading instead of printing an empty list (which reads as "page matches disk" and would propose adding every tagging goal), and `scripts/update-topic-goal-entries-test.sh` pins the grouped-page case, the H1 case, a deeper `####` sub-grouping that must not end the section, a numbered list item and a bold prose line that must not be entries, and the token rule. ⚠️ **The status token is the first backticked span that is a known goal status**, not the first backticked span: a real entry reads ``— SC5 lever on `intake/spec`, `in_progress` (phase `planning`)``, where the first span is a flow-stage name and taking it would rewrite the wrong token.

scripts/checkpoint-state-rule-test.sh

@@ -88,12 +88,16 @@ check() { # check <label> <want> <got>
 # Both helpers below separate 0 / 1 / 2+ rather than 0 / non-0 for that reason, and
 # their polarities are named in their own first line so a call site cannot invert
 # them by accident — which is exactly how this file's first draft failed.
+# ⚠️ **A non-regular file is UNREADABLE before grep ever runs.** grep's exit on a
+# directory is not portable: BSD and GNU grep exit 2, BusyBox grep (the Alpine
+# github-update-go-agent image) exits 1 — read as "no match". Measured 2026-10-22.
 GREP_NO_MATCH=1
 
 # absent_lines <root> <file> — prints each pattern NOT found (the "must be present"
 # half), or one UNREADABLE line when the file cannot be read.
 absent_lines() {
 	local root=$1 file=$2 pat rc
+	[ -f "$root/$file" ] || { printf 'UNREADABLE: %s\n' "$file"; return 0; }
 	for pat in "${MARKERS[@]}"; do
 		grep -qF -- "$pat" "$root/$file" 2>/dev/null
 		rc=$?
@@ -110,6 +114,7 @@ absent_lines() {
 # half), or one UNREADABLE line when the file cannot be read.
 present_lines() {
 	local root=$1 file=$2 pat rc
+	[ -f "$root/$file" ] || { printf 'UNREADABLE: %s\n' "$file"; return 0; }
 	for pat in "${MARKERS[@]}"; do
 		grep -qF -- "$pat" "$root/$file" 2>/dev/null
 		rc=$?

scripts/resume-block-card-rule-test.sh

@@ -91,12 +91,17 @@ check() { # check <label> <want> <got>
 # UNREADABLE file reports nothing and the half passes without measuring anything.
 # That is the second time this class surfaced in this file (the first was a missing
 # file), which is why both halves now separate 0 / 1 / 2+ rather than 0 / non-0.
+# ⚠️ **A non-regular file is UNREADABLE before grep ever runs.** grep's exit on a
+# directory is not portable: BSD and GNU grep exit 2 ("Is a directory"), but BusyBox
+# grep — the one in the Alpine github-update-go-agent image — exits 1, which reads as
+# "no match" and let self-check 5 report []. Measured 2026-10-22.
 GREP_NO_MATCH=1
 
 # missing_markers <root> <file> — the markers the file does not carry, or a single
 # UNREADABLE line when the file cannot be read at all.
 missing_markers() {
 	local root=$1 file=$2 m rc
+	[ -f "$root/$file" ] || { printf 'UNREADABLE: %s\n' "$file"; return 0; }
 	for m in "${MARKERS[@]}"; do
 		grep -qF -- "$m" "$root/$file" 2>/dev/null
 		rc=$?
@@ -113,6 +118,7 @@ missing_markers() {
 # or a single UNREADABLE line when the file cannot be read at all.
 restated_markers() {
 	local root=$1 file=$2 m rc
+	[ -f "$root/$file" ] || { printf 'UNREADABLE: %s\n' "$file"; return 0; }
 	for m in "${MARKERS[@]}"; do
 		grep -qF -- "$m" "$root/$file" 2>/dev/null
 		rc=$?