From 99f5ed4dfbeed8cd2372bd71696cb00b830a728a Mon Sep 17 00:00:00 2001
From: Jakub Zych <jakub@golem15.com>
Date: Fri, 23 Oct 2026 20:16:32 +0200
Subject: [PATCH] fix(19.7): RA-IN-06 demo_pins refuses a failing pin check
 with no mismatch line

demo_pins counts the mismatch lines it accepts and refuses when
check-pins.sh exits non-zero without one, instead of passing on the single
empty line of an empty output. The self-test plants a silent failing
check-pins.sh (pins-silent-failure).
---
 scripts/check-phase19.7.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/scripts/check-phase19.7.sh b/scripts/check-phase19.7.sh
index 90d746c3..af2931e1 100755
--- a/scripts/check-phase19.7.sh
+++ b/scripts/check-phase19.7.sh
@@ -808,6 +808,8 @@ run_self_test() {
 	git -C "$canon" checkout -q -
 	expect_mode pins-released-unreleased 1 "refuse: PHASE197_RELEASED=1" --demo-pins "DEMO_APP=$demo" "USER_PLUGIN=$canon" PHASE197_RELEASED=1
 	unset -f planted_pins
+	printf '#!/usr/bin/env bash\nexit 1\n' >"$demo/scripts/check-pins.sh"
+	expect_mode pins-silent-failure 1 "without a mismatch line" --demo-pins "DEMO_APP=$demo" "USER_PLUGIN=$canon" PHASE197_RELEASED=0
 	rm -rf "$demo"
 
 	# The final verdict: unqualified only without unreleased drift.
@@ -1013,7 +1015,7 @@ canonical_checkout() {
 # plugin's canonical checkout (reported as unreleased commits, released
 # after verification); any other mismatch fails.
 demo_pins() {
-	local out rc=0 line name want head full changed canonical
+	local out rc=0 line name want head full changed canonical accepted=0
 	[[ -f "$DEMO_APP/scripts/check-pins.sh" ]] || {
 		echo "refuse: $DEMO_APP/scripts/check-pins.sh not found" >&2
 		return 1
@@ -1041,6 +1043,7 @@ demo_pins() {
 			changed="$(git -C "$DEMO_APP/$name" diff --name-only "$want" HEAD | grep -vE '_test\.go$' || true)"
 			if [[ -z "$changed" ]]; then
 				echo "pins: $name is ahead of its pin $want by test-only commits (release not needed for shipped code)"
+				accepted=$((accepted + 1))
 				continue
 			fi
 			canonical="$(canonical_checkout "$name")"
@@ -1051,6 +1054,7 @@ demo_pins() {
 				if [[ -n "${PHASE197_PINS_FILE:-}" ]]; then
 					printf '%s\n' "$name" >>"$PHASE197_PINS_FILE"
 				fi
+				accepted=$((accepted + 1))
 				continue
 			fi
 			printf '%s\n' "$changed" >&2
@@ -1061,6 +1065,11 @@ demo_pins() {
 		echo "refuse: the demo's pin check failed" >&2
 		return 1
 	done <<<"$out"
+	# A failing check-pins.sh that printed no mismatch line never passes.
+	if [[ "$accepted" -eq 0 ]]; then
+		echo "refuse: the demo's pin check failed (exit $rc) without a mismatch line" >&2
+		return 1
+	fi
 }
 
 docker_up() {