feat(safety-net): vault-integrity-check for Hive vault_patch corruption (SDD-006)

[mlorentedev]

Summary

Closes a meta-issue surfaced by the user: the safety net has to keep improving itself. In one session, Hive's vault_patch MCP wrote the literal [BS-n] sequence into dotfiles/11-tasks.md four times instead of interpreting it as a newline. The corruption is invisible in rendered markdown but breaks init-spec.sh's vault-gate grep and any downstream line-based parser. Each occurrence was patched manually; no guard was added. By the 4th occurrence the principle was clear: every bug class encountered must emit a CI assertion or health check in the SAME PR.

Three sibling instances this session reinforce the pattern: BUG-001/002 verify-string drift (fixed retroactively with tests/setup-windows.bats parity asserts), AI-019 missing .github/copilot-instructions.md Model Tier section (fixed in SDD-005 with tests/docs-drift.bats), and now this Hive [BS-n] corruption.

SDD checklist

• Vault entry SDD-006-vault-integrity-check in 11-tasks.md
• Spec folder specs/SDD-006-vault-integrity-check/
• proposal.md filled (Why / What / AC / Risks)
• tasks.md in TDD order
• verification.md filled with evidence

SDD skip rationale

Changes

• scripts/check-md-escapes.sh: standalone scanner. Accepts file/dir, exits 0/1/2. Detects the canonical corruption signature ([BS-n] followed by -#>*). set -euo pipefail; shellcheck --severity=error clean.
• tests/check-md-escapes.bats: 9 test cases including a self-test that scans the entire dotfiles repo. Future corruption in this repo fails CI loud at PR time.
• Vault lesson dotfiles/90-lessons.md: incident-to-guard pattern documented with three sibling instances.

Test plan

• bats tests/check-md-escapes.bats → 9/9 green:
  • existence + executable
  • usage error (no args)
  • missing-path error
  • bullet-merge corruption detected
  • header-merge corruption detected
  • healthy markdown stays silent
  • recursive directory scan
  • excludes .obsidian/ + node_modules/ + .git/
  • self-test: dotfiles repo markdown is clean
• bats tests/*.bats → 659/659 pass (was 650; +9 from new bats file)
• shellcheck --severity=error scripts/check-md-escapes.sh clean
• Manual smoke against vault 11-tasks.md and entire dotfiles repo → both clean

Notable decisions

• Narrow pattern [BS-n][-#>*] over [BS-n] alone. Real corruption matched the narrow pattern in 4/4 occurrences; broadening only adds noise.
• Standalone script + bats coverage instead of wiring into vault-health.sh. vault-health.sh requires Obsidian GUI running which CI cannot satisfy. Standalone script + self-test runs anywhere.
• Self-test runs against entire $DOTFILES_DIR, not curated allowlist. Catches future markdown corruption without maintenance.

Out of scope

• Fixing Hive's MCP tool. Out of this repo's control.
• Wiring into vault-health.sh Section 7. Defer (GUI dependency).
• Pre-commit hook in the vault repo. Lives in the vault repo, not dotfiles.
• Triple-backtick code-block exclusion in v1 (re-evaluate if a real false positive emerges).