Lint Slice

lint-slice — the read-only health scan, for a lane that never fixes

You scan the vault your brief names and report what you find. Report only, never fix: you propose, and you write nothing into the vault — no page edit, no wiki/index.md line, no wiki/log.md append, no palette restore, not even an obvious one-character repair. The fix is the head's after the owner confirms it, and a lane that fixed as it went would leave the owner a diff nobody reviewed.

A finding is a fact you probed for, so no check reports clean without its positive control: a zero with a zero control is a broken probe, not a healthy vault. Never put 2>/dev/null on a probe here — it has hidden a scan that searched nothing.

Paths: how to invoke the scripts

Your working directory is the lane home, not the vault, so every path is absolute and every script is invoked by its absolute path. Your brief names the vault root; below it is written <vault> and you substitute the real path. A bare .claude/skills/lint/... finds nothing here.

Each script takes the vault root, but not all in the same spelling — pass it in the form the script accepts:

Read each script's exit code before quoting it, and take the pipe out of any command whose exit code is the verification: a pipeline reports its last stage only.

A path your grants do not reach is a gap, reported at the point you hit it (needs: <path> because <reason>) and never worked around by scanning something adjacent. A check whose input you cannot read is reported as not run (grant missing), never as clean.

1 — Index consistency (the one check that is not a script)

Take the registered page names only — grep -o '^- \[\[[^]|]*' <vault>/wiki/index.md | sed 's/^- \[\[//', Never read index.md whole for this: the check compares names, and its one-line descriptions are waste here. Glob every .md under <vault>/wiki/, excluding index.md and log.md. Report two lists: pages registered in the index but missing on disk, and pages on disk but not registered.

Control: print the number of pages globbed and the number of index entries parsed beside the two findings counts. Zero pages globbed is a broken probe (a wrong root), not a clean vault.

2 — Link health and orphans (scripted; never re-derive a scripted count)

Run check-links.py. It is the single source of truth for the link rules, so you apply none of them yourself: code spans, fenced blocks and HTML comments are not links; frontmatter aliases resolve; vault-path and root-doc targets resolve; wiki/log.md is exempt as a source (append-only history); and media embeds are checked against assets/, a missing target being a dead embed, reported separately from a dead link. Copy its scan totals into your report as its own control line.

Run check-orphans.py --vault <vault>. A page with no inbound links from any other page is an orphan; index, log and maps/ pages are exempt by design (Maps of Content are navigational entry points). Copy its inbound-link control. The pages it lists as reachable from index.md alone are information, not a finding.

You never recount links, embeds or orphans by hand: the scripts hold the rules, and a hand count that disagrees with them is a defect to report, not a number to publish.

Two further helpers sit in that directory and are not yours: tier-cap-check.py and anomaly-lister.py serve the deep-lint pass. Do not run them unless your brief names them.

2b — Pending freshness flags (count only)

grep -rl "^flagged:" <vault>/wiki --include='*.md' | wc -l     # the count
grep -rl "^confidence:" <vault>/wiki --include='*.md' | wc -l  # engine control, must be > 0

Report the count with its control. At five or more flagged pages, say a deep-lint is indicated — the adaptive-cadence signal — and stop there. Never open or reconcile a flagged page: lint counts, deep-lint reconciles.

2c — Attic leak (filenames only; attic contents are never opened)

A live page must never link into the attic: the vault resolves wikilinks vault-wide, so a surviving link to an archived note silently reconnects retired material.

List basenames only — find <vault>/attic -type f -name '*.md' — and skip MANIFEST.md. Attic absent or empty → report attic-leak: n/a and move on. For each basename b, grep the live wiki (excluding wiki/log.md) for the exact link forms [[b]] · [[b| · [[b# · /b]] · /b|. A plain-text mention such as "b (archived)" is the sweep style and is not a finding. Any hit is a leak: report it with the page it sits on and leave the repair to the head.

Control: the same pipeline against one known live page name must return more than zero before you may report "no leaks".

2d — qmd registry guard (one script; silent when qmd is dormant)

wiki/log.md must stay out of the semantic index: embeddings key on a file's whole-content hash, so every append re-embeds the whole timeline. The exclusion lives outside the vault and outside both repositories, so it can vanish silently.

Run check-qmd-registry.sh and copy its one line into your report verbatim. It carries its own control and prints PROBE FAILED rather than "clean" when its premise breaks; quote that line as printed and never soften it.