fix(GATE-ISSUE-INDEX-TABLE-SHAPE): count the index's cells, and repair the row that proves nothing did (#1033)

[localai-bot]

check_table_shapes already carried the right measurement -- unescaped pipes
per table line, re.findall(r"(?<!\\)\|", line) at
scripts/check-agent-record.py:1292 -- and its call site handed it the roadmap,
coordination, every matrix and every live spec. It did not hand it
.agents/issue-index.md, and nothing else in the tree counts that file's cells.
So the one record surface every change must write, whose rows are prose long
enough to hide a stray pipe inside a code span, was the only markdown table in
the record set with no shape gate at all.

The function is untouched. Only its argument list was short, and widening the
function to absorb a red would be the move AGENTS.md forbids.

RED, then GREEN

Path added, #1003 unrepaired, run bare:

$ python3 scripts/check-agent-record.py
ERROR: .agents/issue-index.md:279: table has 9 pipes; expected 5
RC=1

Exactly one row, which is the stop condition this spec set: a second red would
have meant another defect landed while this was in flight and would have needed
its own issue rather than a silent repair here. After escaping the four pipes,
the same command bare:

$ python3 scripts/check-agent-record.py
agent record OK: ENGINE=157 MODEL=377 QUANT=82 KERNEL=51 BACKEND=83
RC=0

tests/scripts/test_agent_record.py gains three cases and is red on both counts
before the call-site change (FAILED (failures=2), exit 1), green after (80
tests, exit 0). The first captures the paths main() really hands the gate,
from the real call rather than from the source text, so a commented-out line or
an unused constant cannot satisfy it. The second runs the gate on the shipped
file. The third mutates a copy -- strips the trailing pipe from the last row --
and asserts on the error text, which cannot be produced unless the mutation was
both written and read back.

The row repair, and the exception it needs

Line 279 is the #1003 ORACLE-LLAMACPP-REPIN-STOCK row, which arrived with
283c7e492 (#1051) carrying four unescaped pipes inside code spans, at columns
2705, 3106, 3115 and 3338. Only the escaping changes: the repaired line is
byte-identical to the original once the four added backslashes are removed, it
is four bytes longer, and it is the only line of the file that differs from
main. Every other row is byte-identical and in the same order, the key list is
a strict prefix plus #1033, and a pipe histogram over all 290 table lines now
reads {5: 290}.

That edit is what scripts/check-issue-index-append-only.py forbids, and that
gate is RED on this branch. It is not weakened, and there is no waiver registry,
so the argument lives here with the diff. The append-only contract cannot repair
a malformed row: appending a corrected copy leaves the broken one in place and
adds a duplicate key, which makes check-agent-record angrier, and the file
only becomes well-formed by editing the row where it sits. The two gates are in
genuine contradiction on this tree, and that contradiction is the defect. This
is the same argument ff264cb82 (#1025) made for the duplicate #995 repair,
and the same containment: the gate is preflight-only, .github/workflows/ci.yml
runs the record gate at :121 and runs no append-only job, so this costs no CI
red, and once merged a later branch diffs a main whose row is already
repaired and sees no removal in its range.

Two premises of the report measured false

Recorded rather than quietly dropped, because a wrong premise that survives
costs the next reader an investigation.

The checker does NOT stop at the first finding. #1033 attributes part of the
two-day concealment to that shape. main() threads one errors list through
every check and prints all of it at the end; the if not errors: guard above
the block covers only the missing-canonical-record case. A scratch index
carrying a duplicate key, a short row and the unrepaired #1003 row reports all
three in one run and exits 1 once. So there was nothing to contain and nothing
is changed there -- the concealment was real, and its only cause was that
check_table_shapes never saw this path.

The four pipes are not in a git diff piped into grep. That span does not
exist in the row: it carries one git diff and three git grep, none piped.
They were located by re-running the checker's own regex over the line, which is
the only reason the discrepancy is visible.

Gates

scripts/agent-preflight.sh --quiet at 271fff52c, exit 1, one failure and
zero skips:

  FAIL issue-index append-only
         FAIL: .agents/issue-index.md is append-only, and this range removes or edits lines.
1 gate(s) failed: issue-index append-only

That is the exception argued above, and it is the only red. Every other record
gate, mutation suite, committed-range gate and trailer gate is ok.

CI's windows-msvc-cpu and windows-msvc-vulkan are red on every pull request
(#584, #968) with no main baseline. Not this change: the diff is one checker,
one test file, one spec and one record, and carries no C++.

Spec: .agents/specs/gate-issue-index-table-shape.md.
The spec commits first (aed1424aa), the implementation second (271fff52c),
so the commit order proves spec-before-code inside the one pull request.

The index will go CONFLICTING here

.gitattributes gives .agents/issue-index.md merge=union, and GitHub does
not run that driver, so this file conflicts on the web the moment main appends
a row. Do not take the auto-merge. Merge origin/main locally, discard the
merged file (git checkout <main-sha> -- .agents/issue-index.md), re-apply the
four #1003 escapes and re-append the #1033 row, then assert by hand that
main's file is a strict prefix apart from line 279 and that every other row is
byte-identical and in the same order.

Closes #1033.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5 [claude-code]