gitpush.sh exported ONLY_PATHS only at the push step, so every repo hook gating on it ran whole-tree - and inherited a stale value when the caller had one

REPORTED by coder-mars-cc 2026-10-06 10:30 ART, measured on mars, CONFIRMED here by reading the code rather than by agreeing with the report. THE DEFECT. ONLY_PATHS is exported only inside gpc_push (gitpush-core.sh:649), which runs at the PUSH step (gitpush.sh:465). The pre-push hook runs much earlier (gitpush.sh:304). So every repo hook that gates on ONLY_PATHS ran in its whole-tree branch. On mars a 4-file --only push aborted because ANOTHER LANE's untracked migrations 183/184 tripped the repo hook's reference-data staleness check; exporting ONLY_PATHS by hand before the call cleared it. THE HALF NOBODY REPORTED, AND IT IS WORSE. The variable was not reset, only absent - so a caller who had exported ONLY_PATHS earlier LEAKED IT INTO THE HOOK, scoping somebody else's file list onto this push. Forced red as case [2]: against v5.5 the fixture hook saw 'somebody/elses/file.txt'. gitpush-core.sh's own contract comment names exactly this hazard for gitmerge.sh and fixes it by exporting on every path including the empty case; the hook now gets the same treatment. THE FIX REVERSES A DOCUMENTED DECISION, AND THE REVERSAL IS THE ARGUMENT. The hook call site carried a paragraph saying nothing is exported to the hook, because an env var is a second source of truth and the hooks already read git. The first half stands. The second half is FALSE IN A SHARED CHECKOUT: ls-files --others and diff --name-only HEAD both return the other lane's work, and nothing in the repository records WHICH PATHS THE CALLER ASKED TO PUSH. The scope exists only in argv, so for that one fact the env var is not a second source of truth - it is the only one. A hook left to infer it must either sweep and gate on files it was told not to touch, or guess. The paragraph is rewritten in place with the mars measurement cited, not deleted: a reversal that erases its own prior reasoning is unreviewable. FORCED RED BEFORE ACCEPTANCE. New suite gitpush-hookscope.test.sh v1.0 runs the REAL script against throwaway repos with local bare origins and takes GITPUSH_SH so a candidate is testable before deployment. Against v5.5: 3 FAILED / 2 passed - hook saw <UNSET>, hook saw the inherited value, and the mars incident reproduced exactly as 'the push died on a file outside its scope'. Against v5.6: 6/6. Case [4] keeps [3] honest by proving an IN-scope path can still fail the hook, so [3] is not satisfiable by a hook that never fails. Case [5] asserts gpc_push's own export survives, because gitmerge.sh's scope depends on it and the hook fix must not consume it. ONE FIXTURE BUG FOUND ON THE WAY, same class as the defect: plain 'git status --porcelain' COLLAPSES an untracked directory to '?? db/', so the fixture hook's path match found nothing and case [3] PASSED against the very defect it exists to catch until -uall was added. A case the defect also passes proves nothing. ALSO RUN: gitpush-prestage-abort-test.sh against the candidate, 17 passed 0 failed. version-gate rc=0. Deployed by temp-file-plus-mv in the same directory per the PATH deploy rule, never edited in place. STATUS: v5.6 is LIVE on venus and the suite is green against it. THE PUSH TO sh.git IS NOT DONE - the venus-host.push-gate is held by coder-venus-cc, the gate refused before staging anything, and I am registered for the release DM. Not polling. Until that push lands, whey and lezama still run v5.5 and mars's hook still needs its manual export there.