fix(policy): v1.2.43 consolidation — read-lane FP residual + retention landing + one-time prune [t_40022daf]

[maximalang]

Card

fleet-ops t_40022daf — fleet-policy: context-aware pattern matching (stop false-positive blocks on read-only commands) + enforce retention so the live event-store never regrows unbounded.

Base: codex/company-os @ 9b09444. Version: 1.2.43 (collision guard: {"collision": false, "released_max": "1.2.36"}; open PRs hold 1.2.37–1.2.42).

What this PR is

A consolidation of three in-flight, unmerged fix branches onto current trunk, plus the residual fix that none of them covered:

PR	Version	Content	State in this branch
#56	1.2.37	live lexical-delta capture D1/D2/D2e (t_9412d7d5)	merged (pr-56), version-pin conflicts resolved
#57	1.2.38	FP root classes: read-lane CLI, literal-traps as data, truthful remediation, deploy_policy.sh (t_e393b6e8)	merged (pr-57) — was CONFLICTING on GitHub, conflicts resolved here
#63	1.2.42	built-in retention, verified archive, size guard, hot-path indexes (t_1d99b96b)	merged (pr-63)

The three source cards are done but their PRs never landed, so the live gate kept biting. This PR makes them landable as one unit; the source PRs can be closed after merge.

Residual fix (the gap none of the PRs closed)

Live evidence (policy event-store, ventures .state/fleet-policy.db):

• event f3b2e0d2cd9e0edaedaccbbaa88849fd7fa1b2703ce03f4ab4222876c09578ba (2026-10-08T14:13:22Z, task t_40022daf call 41): a read-only sqlite3 "file:...state.db?mode=ro" "SELECT ... MATCH '<word>' ...;" 2>&1 | head blocked as irreversible_data_loss / approval_required — the keyword sat inside quoted SQL data.
• event class of t_3d503c82 (2026-10-08, 06:49/06:58): python -c QA-bench runner whose embedded prompt text tripped the same keyword rule.

Root causes found and fixed:

1. _SHELL_METACHARACTERS matched the & inside fd duplication (2>&1), contradicting its own comment ("handled by the redirect scanner, not matched here"). Every read pipeline with stderr redirection failed closed into state_change and then into the keyword rules. Fixed: (?<![&>])&(?!&); cmd &, &> f, &>> f still fail closed. (v1.2.23 had pinned the buggy behavior as an adversary case; re-pinned with justification, plus a new adversary proving fd-dup + real file redirect still writes-deny.)
2. sqlite read lane rejected the standard trailing ; and counted the 2>&1 token as a positional. Both fixed; interior ;, dot-commands, multi-statement chains stay fail-closed.
3. MUTATOR pre-filter scanned bare search patterns: grep -rn deploy src/ flipped to deploy_external_runtime (evidence-gated at runtime). v1.2.22 masked only quoted spans. Now search-tool operands (grep/rg/findstr/select-string/find patterns, paths, value-flag values) are blanked in the MUTATOR view only — the write-marker scan keeps the raw command, and every stage still passes its own read-only check, so masking cannot launder a mutating stage.
4. Hardening (direction reversed): the rm keyword anchor accepted only (?:^|\s), so python -c "os.system('rm -rf /x')" and bash -c 'rm -rf ...' slipped through as scoped_state_change/allow. Anchor widened with quote chars; pinned by tests.

Not fixed by design: python -c with prompt text embedded in the code string stays strictly scanned (no nested-literal masking — that would open an os.system evasion). Sanctioned lane: write_file + python file.py (file contents are data). Documented in CHANGELOG.

One-time prune of the live ~450 MB store (D2-b)

• scripts/prune_policy_db.py — operator-only: pre-flight counts → SQLite backup-API snapshot + MANIFEST.json/sha256 → forced maintenance tick (verified archive before delete, from feat(policy): v1.2.42 built-in event retention, verified archive, size guard, hot-path indexes [t_1d99b96b] #63) → full VACUUM → post-run sidecar re-verify + PRUNE-REPORT.json. Dry-run posture by default; --yes to execute.
• Runbook: docs/fleet-ops/fleet-policy-prune-runbook.md (preconditions, steps, post-verify, rollback).
• Worker-side execution against the live store stays denied by the protected-path gate — this runs in the company operator session after deploy.

Verification (local, Windows worktree C:/tmp/fp-t40022daf)

• uv run --frozen python -m pytest tests/ -q → 1011 passed (merged baseline 981; +25 read-lane battery test_v1243_readlane_fp.py, +3 prune battery test_v1243_prune_script.py, +2 re-pinned v1223 adversaries).
• uv lock --check OK; compileall src tests scripts integrations OK.
• fleet-policy --root . drift-check → {"missing": [], "ok": true}; --version → 1.2.43.
• build-bundle (92 files) + verify-bundle → ok.
• check_version_uniqueness → {"collision": false, "version": "1.2.43"}.
• Classification battery before/after on the incident shapes: E1 (sqlite FTS w/ keyword + 2>&1) approval_required → read_only/allow; grep bare/quoted keyword patterns → read_only/allow; TP controls (rm -rf, push -f, reset --hard, drop table, multi-statement splice, backgrounding, &> write redirect, os.system/bash -c evasion) all stay escalated.

Merge protocol

Same as the source PRs: independent QA review on this exact head, company GO anchor, merge by company/operations. After merge: deploy via scripts/deploy_policy.sh (tag route per the deploy runbook), then the one-time prune per the prune runbook.

Finances: 0 ₽ incremental.