check bare paths in scripts/, and record why one file has no .sh

Two answers to "add .sh to sh files". Exactly one file lacks the suffix:
scripts/hooks/pre-commit. git locates a hook by exact filename, so renaming it
would leave a gate that looks present and does nothing — verified in a throwaway
repository, where hooks/pre-commit printed and hooks/pre-commit.sh was ignored
while the commit succeeded regardless. The name belongs to git, so the file keeps
it and conventions.md now states the exception rather than leaving it as an
inconsistency someone will try to tidy again.

The extension was never the defect anyway. The dangling-path gate had only ever
matched backticked citations, so `git add docs/surface.md` in the hook — an
argument, not a citation — survived the docs/ rename and surfaced as a fatal
inside a commit that otherwise succeeded. That gate now also reads paths in
scripts/ unquoted, which is the check that would have caught it.

Proven both ways: restoring the exact bug fails the gate with "reference to a
path that does not exist: docs/surface.md", and a working tree passes. The first
attempt did not catch it — docs had been dropped from the alternation because the
directory no longer exists, which is precisely the class of stale reference worth
failing on, so docs is in the bare pattern on purpose.

Backslashes are stripped before comparing, so a path written as a regex —
\.claude/settings\.json — is checked as the file it means rather than flagged as
the file it is not. Prose is still checked only inside backticks: a sentence
saying "under harness/" makes a point no filesystem can verify, while a script
naming a path either has it right or is broken.

One gate label changed with it. `pass "harness/HARNESS.md coupling"` read fine
while the directory was docs/ and now parses as a filename, which the new check
duly flagged; it is "harness and HARNESS.md move together". No doc cited the old
label.

4 files. No rule or threshold moved — one gate widened, one convention written down.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/verify.sh

@@ -92,7 +92,7 @@ if [ -d .git ] && command -v git >/dev/null 2>&1; then
     if [ -n "$harnesschanged" ] && ! echo "$changed" | grep -qx 'HARNESS.md'; then
       bad "the harness changed (CLAUDE.md, scripts/ or .claude/) but HARNESS.md did not — the guide to the machine is part of the machine"
     else
-      pass "harness/HARNESS.md coupling"
+      pass "harness and HARNESS.md move together"
     fi
   fi
 
@@ -142,8 +142,18 @@ if [ -d .git ] && command -v git >/dev/null 2>&1; then
   [ -d .scratch ] && scratchpat='|\.scratch'
   refs=$(grep -rhoE "\`(harness|scripts|ideas|reference|\.claude$scratchpat)/[A-Za-z0-9_./-]+\`" \
            harness CLAUDE.md HARNESS.md ideas reference .claude scripts 2>/dev/null | tr -d '`' | sort -u)
+  # Bare paths in the gate's own scripts, where a backtick is prose but the path is what actually runs.
+  # `git add harness/surface.md` in the pre-commit hook is not a citation, it is an argument — and the hook
+  # staged a deleted path for two commits because this check had only ever looked inside backticks. Only
+  # scripts/ is scanned bare: prose says "under harness/" for reasons a filesystem cannot check, while a
+  # shell script naming a path either has it right or is broken.
+  #
+  # Backslashes are stripped first, so a path written as a regex — `\.claude/settings\.json` — is compared
+  # as the file it means rather than flagged as the file it is not.
+  bare=$(sed 's/\\//g' $(find scripts -type f) 2>/dev/null |
+           grep -ohE '(harness|docs|scripts|ideas|reference)/[A-Za-z0-9_./-]+' | sed 's/[.]$//' | sort -u)
   dangling=""
-  for f in $refs; do [ -e "$f" ] || dangling="$dangling $f"; done
+  for f in $refs $bare; do [ -e "$f" ] || dangling="$dangling $f"; done
   [ -n "$dangling" ] && bad "reference to a path that does not exist:$dangling"
 
   adrs=$(grep -rhoE 'ADR-[0-9]{4}' harness CLAUDE.md HARNESS.md ideas reference .claude scripts cmd internal 2>/dev/null | sort -u)