From d28d932f9d592bb8915ec11268ca29a3512323d2 Mon Sep 17 00:00:00 2001
From: Jay Wedgeworth <12656028+jaywedgeworth22@users.noreply.github.com>
Date: Sun, 25 Oct 2026 10:30:23 -0500
Subject: [PATCH 1/4] ios-fleet: test the review's glued-hash argument line and
 a hash inside quotes against the raw-line comment start (Kody, AFC-517)

---
 scripts/ios-fleet/test-asc-credentials.sh | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/scripts/ios-fleet/test-asc-credentials.sh b/scripts/ios-fleet/test-asc-credentials.sh
index 83bd2286..334e106c 100755
--- a/scripts/ios-fleet/test-asc-credentials.sh
+++ b/scripts/ios-fleet/test-asc-credentials.sh
@@ -955,7 +955,7 @@ extract_ship_prelude() {
 # refused by the check it is meant to trip:  a cut that never stops and a
 # cut that stops at the wrong line must not pass for one another, so every
 # variant asserts the words of its own refusal.
-for variant in missing reformatted moved nodef tight assignchain assignchainbare assignother assignsubst assignbacktick assignsubstbare assignprocin assignprocout fleetdirother indented strayclose secondopener indentedclose commentbrace gluedbrace; do
+for variant in missing reformatted moved nodef tight assignchain assignchainbare assignother assignsubst assignbacktick assignsubstbare assignprocin assignprocout fleetdirother indented strayclose secondopener indentedclose commentbrace gluedbrace gluedarg quotedhash; do
   synth="${tmp}/synth-ship-${variant}.sh"
   sentinel="${tmp}/synth-sentinel-${variant}"
   {
@@ -971,6 +971,18 @@ for variant in missing reformatted moved nodef tight assignchain assignchainbare
         # it closes the body.  The indented command that follows is then a
         # top-level command the cut would run.
         echo '  true "x"#;}'
+      elif [[ "$variant" == gluedarg ]]; then
+        # The review's own shape:  a `#` glued to a closing quote is not a
+        # comment start, so the `}` after it is still counted.  Here it is
+        # an argument to `true`, and the guard stays conservative:  it
+        # closes the body on that count, so the indented command after it
+        # is refused rather than waved through as body text.
+        echo '  true "x"# }'
+      elif [[ "$variant" == quotedhash ]]; then
+        # A `#` inside a quoted string that follows whitespace is not a
+        # comment start either:  the `}` after the string is still a
+        # structural brace that closes the body.
+        echo '  true " #";}'
       else
         echo '  _rejected_key_dir="$(mktemp -d)"'
       fi
@@ -981,7 +993,7 @@ for variant in missing reformatted moved nodef tight assignchain assignchainbare
       if [[ "$variant" == secondopener ]]; then
         echo 'other_func() {'
       fi
-      if [[ "$variant" == gluedbrace ]]; then
+      if [[ "$variant" == gluedbrace || "$variant" == gluedarg || "$variant" == quotedhash ]]; then
         # The body was already closed by the line above.
         :
       elif [[ "$variant" == indentedclose || "$variant" == commentbrace ]]; then
@@ -1075,6 +1087,11 @@ for variant in missing reformatted moved nodef tight assignchain assignchainbare
       # is a top-level command the cut would run.
       gluedbrace) echo "  printf 'SHIP-BODY-RAN\\n' > '${sentinel}'"
                   echo 'init_rejected_key_file || echo "could not init" >&2' ;;
+      # The same indented command behind the review's `cmd "x"# }` line and
+      # behind a `#` that sits inside a quoted string:  in both the `}`
+      # counts, so the command is outside the body and has to be refused.
+      gluedarg|quotedhash) echo "  printf 'SHIP-BODY-RAN\\n' > '${sentinel}'"
+                           echo 'init_rejected_key_file || echo "could not init" >&2' ;;
     esac
     echo "printf 'SHIP-BODY-RAN\\n' > '${sentinel}'"
     echo 'exit 0'
@@ -1104,6 +1121,8 @@ for variant in missing reformatted moved nodef tight assignchain assignchainbare
     indentedclose) expect="positional" ;;
     commentbrace) expect="positional" ;;
     gluedbrace) expect="positional" ;;
+    gluedarg)   expect="positional" ;;
+    quotedhash) expect="positional" ;;
     *)           fail "an unknown variant ${variant} reached the refusal check" ;;
   esac
   [[ "$synth_out" == *"$expect"* ]] \

From 62723e51f511563e5a5e37171c2dfa7ae8083eb9 Mon Sep 17 00:00:00 2001
From: Jay Wedgeworth <12656028+jaywedgeworth22@users.noreply.github.com>
Date: Sun, 25 Oct 2026 12:07:55 -0500
Subject: [PATCH 2/4] ios-fleet: positive control that a brace inside a quoted
 string is not structural (Kody, AFC-517)

---
 scripts/ios-fleet/test-asc-credentials.sh | 24 +++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/scripts/ios-fleet/test-asc-credentials.sh b/scripts/ios-fleet/test-asc-credentials.sh
index 334e106c..25ede464 100755
--- a/scripts/ios-fleet/test-asc-credentials.sh
+++ b/scripts/ios-fleet/test-asc-credentials.sh
@@ -1214,6 +1214,30 @@ if ! op_out="$(extract_ship_prelude "$op_synth" "$op_prelude")"; then
 fi
 rm -f "$op_sentinel"
 
+# 12a-quint. The positive control for a QUOTED brace:  a VALID prelude whose
+# body holds a brace inside a quoted string is accepted.  A brace in a quoted
+# string is not a structural brace, so the body does not end early, the
+# indented line after it is still body text, and the guard must not refuse
+# the prelude as a positional command.
+qb_synth="${tmp}/synth-ship-quotedbraceok.sh"
+qb_sentinel="${tmp}/synth-sentinel-quotedbraceok"
+qb_prelude="${tmp}/synth-prelude-quotedbraceok.sh"
+rm -f "$qb_sentinel"
+{
+  echo '#!/bin/bash'
+  echo 'init_rejected_key_file() {'
+  echo '  echo "a } b"'
+  echo '  _rejected_key_dir="$(mktemp -d)"'
+  echo '}'
+  echo 'init_rejected_key_file || echo "could not init" >&2'
+  echo "printf 'SHIP-BODY-RAN\\n' > '${qb_sentinel}'"
+  echo 'exit 0'
+} > "$qb_synth"
+if ! qb_out="$(extract_ship_prelude "$qb_synth" "$qb_prelude")"; then
+  fail "a valid prelude with a brace inside a quoted string was refused: ${qb_out}"
+fi
+rm -f "$qb_sentinel"
+
 # 12b. The real ship script passes the same checks, and only then is its
 # prelude sourced.
 prelude_err="$(extract_ship_prelude "$script" "${tmp}/ship-prelude.sh")" || fail "$prelude_err"

From b2ce4108b96e6ab157f3da9734e9bee4af7c0554 Mon Sep 17 00:00:00 2001
From: Jay Wedgeworth <12656028+jaywedgeworth22@users.noreply.github.com>
Date: Sun, 25 Oct 2026 12:58:44 -0500
Subject: [PATCH 3/4] ios-fleet: two-space sentence boundary in the 12a-quint
 comment

The positive-control comment added for the quoted-brace case ends its
section label with a single space, which the two-space file sentence
rule flags.  Fix the one space so the new lines in this branch are
rule-clean.

Refs AFC-517.  Copy-rule fix by BF-DEPLOYER so the branch can land.
---
 scripts/ios-fleet/test-asc-credentials.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 mode change 100755 => 100644 scripts/ios-fleet/test-asc-credentials.sh

diff --git a/scripts/ios-fleet/test-asc-credentials.sh b/scripts/ios-fleet/test-asc-credentials.sh
old mode 100755
new mode 100644
index 25ede464..8f0df862
--- a/scripts/ios-fleet/test-asc-credentials.sh
+++ b/scripts/ios-fleet/test-asc-credentials.sh
@@ -1214,7 +1214,7 @@ if ! op_out="$(extract_ship_prelude "$op_synth" "$op_prelude")"; then
 fi
 rm -f "$op_sentinel"
 
-# 12a-quint. The positive control for a QUOTED brace:  a VALID prelude whose
+# 12a-quint.  The positive control for a QUOTED brace:  a VALID prelude whose
 # body holds a brace inside a quoted string is accepted.  A brace in a quoted
 # string is not a structural brace, so the body does not end early, the
 # indented line after it is still body text, and the guard must not refuse

From d3da8a3233e3a29bfb28fe8b8c45eb867e91aa6a Mon Sep 17 00:00:00 2001
From: Jay Wedgeworth <12656028+jaywedgeworth22@users.noreply.github.com>
Date: Sun, 25 Oct 2026 13:18:53 -0500
Subject: [PATCH 4/4] Revert the 12a-quint spacing change and restore the
 script's executable bit

Jay ruled that code comments are exempt from the sentence-spacing rule, so the
12a-quint label keeps the single space its neighbouring section headers use.
b2ce410 also dropped the executable bit (100755 to 100644); this restores it.
---
 scripts/ios-fleet/test-asc-credentials.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 mode change 100644 => 100755 scripts/ios-fleet/test-asc-credentials.sh

diff --git a/scripts/ios-fleet/test-asc-credentials.sh b/scripts/ios-fleet/test-asc-credentials.sh
old mode 100644
new mode 100755
index 8f0df862..25ede464
--- a/scripts/ios-fleet/test-asc-credentials.sh
+++ b/scripts/ios-fleet/test-asc-credentials.sh
@@ -1214,7 +1214,7 @@ if ! op_out="$(extract_ship_prelude "$op_synth" "$op_prelude")"; then
 fi
 rm -f "$op_sentinel"
 
-# 12a-quint.  The positive control for a QUOTED brace:  a VALID prelude whose
+# 12a-quint. The positive control for a QUOTED brace:  a VALID prelude whose
 # body holds a brace inside a quoted string is accepted.  A brace in a quoted
 # string is not a structural brace, so the body does not end early, the
 # indented line after it is still body text, and the guard must not refuse