E-SECTION-SCAN reports through err, so a scan fault can be downgraded to a warning

[randomparity]

Found while implementing #63. Recorded in ADR 0008's Consequences with this issue as its owner.

Problem

check_sections in check-records.sh reports its scan fault through err:

*)
  err "E-SECTION-SCAN: $label: could not scan $file for section '$section' (grep exit $grep_status)"
  continue
  ;;

err is the downgradable channel. For a record that was already non-conforming at the base ref the checker runs in downgrade mode, where err relabels the finding as ::warning::W-LEGACY-SHAPE and never sets failed=1 — so the gate exits 0 over a section it could not scan.

ADR 0005 states the rule this breaks, in its Consequences:

Reporting goes through err_full rather than err, so a scan fault cannot be downgraded to W-LEGACY-SHAPE for a record that was already non-conforming — a fault describes the scan, not the record.

check_title_number in profiles/adr.sh follows that rule and carries a comment explaining it. check_sections does not, and appears to predate it: E-SECTION-SCAN came from #25's sweep, before ADR 0005 was written.

Why it is narrow, and still worth fixing

The fault has to coincide with a record that is non-conforming at the base ref. A record that is conforming at base runs in report mode, where err and err_full behave alike — which is why the existing test for this code passes: it drives a tree-only fault (chmod 000 on the working-tree file) while the base pass reads a readable temp copy of the blob.

So this is not a live false green on the repo's current records. It is a rule that holds by accident of which pass faults, and the grandfathered-record path is exactly where a gate is least examined.

#63 hit the same distinction from the other side: E-SECTION-BODY-SCAN had to use err_full because section_body's awk faults in both passes, which marks the record non-conforming at base and downgrades the finding. The two codes now sit adjacent in the same function on different channels.

Expected

1. E-SECTION-SCAN reports through err_full, with a comment giving the reason, matching check_title_number.
2. A sweep of the remaining E-*-SCAN codes for the same inconsistency — this was one reading of one function, not a mechanical check.
3. A regression test that fails on the current channel: a record non-conforming at the base ref whose section scan then faults, asserting exit 1 and E-SECTION-SCAN rather than W-LEGACY-SHAPE.
4. Both mirrors (.github/scripts/ ↔ skills/tome-of-lore/assets/) stay byte-identical.

Provenance

ADR 0005 (accepted) states the rule. ADR 0008 records the divergence and defers it here rather than widening #63's charter, which was scoped to the pipeline idiom.

[randomparity]

Scope — issue #90

• Annotation token: q90-d6de4563
• Scope identity: E-SECTION-SCAN reports through err, so a scan fault can be downgraded to a warning #90; q90-d6de4563
• Outcome: Make E-SECTION-SCAN a non-downgradable scan fault in the record validator.
• Completion criteria: (1) E-SECTION-SCAN reports through err_full with the governing reason at the call site; source issue body. (2) Sweep remaining E-*-SCAN sites for the same channel inconsistency; source issue body. (3) Add a regression test using a base-nonconforming record whose section scan faults, asserting exit 1 and E-SECTION-SCAN rather than W-LEGACY-SHAPE; source issue body. (4) Keep .github/scripts and skills/tome-of-lore/assets mirrors byte-identical; source issue body and repository instructions.
• Provenance: Outcome and criteria 1-4 come from issue E-SECTION-SCAN reports through err, so a scan fault can be downgraded to a warning #90; mirror construction and plugin version bump come from repository CLAUDE.md; the scan-fault principle is recorded in ADR 0005 and carried forward by accepted ADRs 0024 and 0025.
• Exclusions: No new generalized guard, abstraction, dependency, public contract, schema, authentication, concurrency, persistence, migration, or external-service behavior; owner: issue E-SECTION-SCAN reports through err, so a scan fault can be downgraded to a warning #90 scope.
• Surface: .github/scripts/check-records.sh, its mirrored skills/tome-of-lore/assets/check-records.sh, their byte-identical test mirrors, and .claude-plugin/plugin.json; direct dependencies are existing test fixture helpers and just records/verify recipes.
• Ambiguities: none.
• Interaction: interactive.
• Blast radius: small; one validation branch and its mirrored regression suite.
• Change hazards: preserving Bash 3.2 behavior, proving the legacy-base downgrade path, avoiding accidental mirror drift, and keeping the scan-code sweep within the shared failure-channel root cause.
• Complexity: S.
• Decompose verdict: one independently testable pull request; do not decompose.
• Classification: non-trivial workflow path because the cited governing ADR is formally superseded and does not qualify as a non-superseded governed-small-change authority.

[randomparity]

Trajectory — issue #90

• Outcome: handed off — PR fix(records): keep section scan faults at full severity #275 green+mergeable, awaiting human merge.
• Branch: feat/fix-section-scan-90
• Pull request: fix(records): keep section scan faults at full severity #275
• Guardrails: focused record suite passed 214 cases; just records passed; just verify passed locally, in the managed pre-push worktree, and in CI on Ubuntu and macOS; Pages build passed.
• Review: branch trial-loop approved in one iteration with zero findings; security pass not triggered; simplification was a no-op and its guardrail rerun passed.
• Surprises: the cited ADR was formally superseded, so the workflow used the full design and scope-audit path; no implementation scope expansion or deferral resulted.
• Human action: merge PR fix(records): keep section scan faults at full severity #275 with the repository's non-squash merge method.
  MERGE-READY: fix(records): keep section scan faults at full severity #275 @ 1959710