v3.5.1

Fixed

• Empty project scripts survive init/uninstall; empty prepare fails
  before writes.
• Pre-commit linting, formatting, related-test discovery, and optional test
  execution now inspect one immutable tree created from an exact copy of the
  active Git index, including Git's temporary commit --all index. Unstaged or
  untracked files can no longer hide staged problems, satisfy missing-test
  checks, enter test runs, or create false CRLF/filter warnings; deletion-only
  commits also evaluate source/test relationships in the resulting commit tree
  without changing partial staging. Blob contents are materialized in bounded
  batches, and Windows keeps dependency junctions on a traversable filesystem
  without requiring privileged symbolic-link creation.
• init now composes install-time repair safely when a project-owned
  prepare ends in a semicolon, background operator, trailing whitespace,
  quoted shell text, or multiple lines. It repairs the exact malformed suffix
  generated by older composition, while init, doctor, and uninstall
  refuse heredoc composition plus displaced or duplicate repair commands,
  including repairs inside shell control flow, before mutation; uninstall
  restores the original project command byte-for-byte and never claims complete
  removal while an ambiguous owned repair remains.
• Production installs no longer fail when commitment-issues is intentionally
  omitted as a development dependency. init now generates a Node-only
  prepare repair guard that invokes the exact project-local CLI when its
  package is installed and exits successfully when the package is absent,
  without a global, npx, package-runner, or network fallback. Direct package
  removal therefore cannot brick the next install, while normal installs still
  repair clone-local hooks.
• fix:staged and commit:fix now treat a timeout, signal, spawn failure, or
  missing local fixer as an interruption, discard incomplete stdout, stop
  before later tool phases, and refuse before applying, staging, or amending.
  The exact pre-run index and HEAD remain unchanged. If a tool changed a
  target path directly, the command reports every affected path and leaves its
  worktree bytes untouched rather than risk overwriting concurrent user work;
  completed nonzero lint runs can still contribute attributable fixes.
• fix:staged and commit:fix now refuse before fixer tools when a target has
  assume-unchanged, skip-worktree, core.ignoreStat-derived, intent-to-add,
  sparse-checkout, unresolved, or other non-ordinary index state. Snapshot
  capture binds each regular target's exact index blob to its worktree identity
  and bytes, then revalidates the complete index and target snapshot after Git
  probes, preventing hidden private edits or mixed-time inspection from being
  formatted, staged, cached, or amended.
• commit:fix now refuses before fixer tools or repository mutation whenever
  Git reports an active merge, cherry-pick, revert, rebase, git am, or
  sequencer state. Worktree-specific operation paths are inspected fail-closed,
  including clean-index and empty-operation pauses, and revalidated before
  tools, worktree writes, index staging, and amend so continuation state is
  preserved exactly.
• Runtime checks, fixers, panic, and direct commit-message checks now resolve
  the owning Git worktree before loading root configuration, interpreting
  Git-reported paths, finding local tools, or launching child processes.
  Commands behave consistently from repository descendants, nested
  repositories, submodules, and linked worktrees; setup, doctor, and uninstall
  now refuse descendant directories explicitly while recognizing alternate
  filesystem spellings of the root, including Windows short paths.
• Parent SIGINT, SIGTERM, and SIGHUP now terminate active attached tool
  trees before signal-appropriate exit. Timeouts share this cleanup, and a
  bounded fallback releases pipes held by unreclaimable escaped descendants.
• Project-file and fixer transactions now treat hardlink count as part of file
  identity. Existing hardlinked repository paths are replaced instead of
  modified through the shared inode, so external aliases retain their original
  bytes; co-selected fixer targets that share one inode are refused before
  mutation, and a hardlink added or removed while tools run causes a
  fail-closed refusal.
• commit:fix now refuses detached or non-branch HEAD, signed commits, and
  commits retained by a local tag or locally known remote ref. It revalidates
  the exact branch attachment and protected-ref snapshot before mutation, and
  documents the honest offline boundary: remote-only refs remain unknowable
  until fetched, because the command never contacts the network.
• fix:staged and commit:fix now bind automatic fixes to the exact HEAD,
  index file, and target bytes inspected before local tools run.
  ESLint and Prettier transform those captured bytes through stdin; the
  commands revalidate repository and publication state before staging or
  amending, install only attributable blobs under Git's index lock, and refuse
  detected concurrent edits, deletion, type replacement, index updates, HEAD
  moves, or publication without absorbing user work. Per-file tool processes
  use bounded concurrency and one shared timeout for the complete fix.
• Setup and uninstall no longer truncate consumer-owned project files in
  place. Complete replacement bytes are staged, permissioned, synced, closed,
  and revalidated byte-for-byte through a no-follow descriptor before an atomic
  commit; short writes and later filesystem failures leave each file as a
  complete old or new version, never empty or partial. Retry also removes
  reserved transaction files left by a terminated writer without touching an
  active process's stage.