fix(test): bare '!' assertions are silent no-ops — convert all 22 + hygiene guard (#303)

[frankbria]

Summary

Implements #303. bats-core's ERR trap doesn't fire for negated commands, so a mid-test ! cmd line asserts nothing — discovered in #75 when 9 such assertions let 5 product mutations survive.

• Audit: 22 occurrences across 6 test files — every one a negative grep assertion
• All converted to the count-based form from PR feat(sandbox): E2B cloud sandbox execution — ralph --sandbox e2b (#75) #302: [[ $(cmd | grep -c PAT) -eq 0 ]] (flags like -x/-- preserved; missing-file semantics unchanged — empty substitution compares equal to 0, same as the old silent pass)
• New tests/unit/test_bats_hygiene.bats: guard forbidding line-leading bare ! in any .bats file (was RED with all 22 listed before conversion), modeled on the sha-pinning guard

Test Plan

• Guard test written first; RED with 22 offenders, GREEN after conversion
• Full suite: 1268 unit+integration + 18 e2e, 100%
• Mutation verification, one conversion per file, 6/6 killed:
  • sandbox_docker: running container made to call docker start → test fails
  • cli_modern: set +e injected into the live block → test fails
  • enable_core: .gitignore made to preserve old content → test fails
  • github_import: --model always passed → test fails
  • prd_import: conversion call made to inherit --plan-model → test fails
  • e2e full_loop: --resume made unconditional → test fails

Known Limitations / Intentionally Deferred

• Guard scope is .bats files only; sourced .bash helpers may use ! inside functions whose return value is checked at the call site (that pattern works correctly).

Closes #303

[coderabbitai]

Warning

Review limit reached

@frankbria, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 7 minutes and 18 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0b6e50cd-a585-4ffe-864f-0276a10af9b1

📥 Commits

Reviewing files that changed from the base of the PR and between 7582b9d and 252ede4.

📒 Files selected for processing (7)

• tests/e2e/test_full_loop.bats
• tests/integration/test_prd_import.bats
• tests/unit/test_bats_hygiene.bats
• tests/unit/test_cli_modern.bats
• tests/unit/test_enable_core.bats
• tests/unit/test_github_import.bats
• tests/unit/test_sandbox_docker.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/issue-303-bats-bare-negation

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

This is a clean, well-motivated fix for a real silent-failure problem in bats. The dual approach — converting all 22 occurrences and adding a hygiene guard to prevent regression — is exactly right.

Conversion correctness: Every substitution is faithful. The -x flag is preserved in the grep -cx forms (e.g., the argv_1.log checks in the E2E test), the pipe structure in compound expressions like sed ... | grep -c and _docker_args | grep -c is maintained, and missing-file semantics are unchanged: $( ) returns empty on error, and [[ "" -eq 0 ]] is true in bash arithmetic context — the same silent-pass behavior as the old \! grep -q on a missing file.

Guard design: The ERE '^\[[:space:]]*\!\[[:space:]]' is correct. It catches any line-leading \! cmd with or without leading indentation, while leaving \![ alone (no space after the bang). The || true on the grep prevents failure when the repo is clean. The guard is intentionally broader than grep-only: it also catches future \! [[ ... ]] violations since those have the same ERR-trap problem in bats-core.

Mutation testing: 6/6 kills across all 6 changed files confirms that each conversion now makes the test meaningful. That is the right quality bar for a fix of this nature.

Count verification: 3 (e2e) + 6 (prd_import) + 4 (cli_modern) + 1 (enable_core) + 6 (github_import) + 2 (sandbox_docker) = 22 conversions, matching the stated number.

No issues found. The logic is correct, the guard closes the loop on regression, and the mutation evidence confirms the assertions now have teeth. Mergeable as-is.