fix(hooks): now-gate matched a bold NOW stamp nothing writes; correct the symlink comment; drop 835 lines of base64

[gHashTag]

Closes #2299. Three small, independent defects found while analysing the docs/NOW.md bottleneck.

Everything below was verified against origin/master at 7e8de87b10bf2754c27500e107345b289f26d700, not against a working branch. That mattered: the local checkout is 2,400 commits behind and its .gitattributes still says merge=theirs, which would have produced a false finding for defect 2.

1. tri hooks now-gate required a format nothing produces

cli/tri/src/hooks.rs matched the bold stamp:

r"(?m)^\*\*Last updated:\*\*\s*(\d{4}-\d{2}-\d{2})"

The producer disagrees — cli/tri/src/nownote.rs writes the plain form:

format!("# NOW -- {title} ({date})\n\nLast updated: {date}\n\n## {title}{suffix}\n\n");

On master:

$ git show origin/master:docs/NOW.md | grep -c '^\*\*Last updated:\*\*'
0
$ git show origin/master:docs/NOW.md | grep -c '^Last updated:'
136

Zero bold against 136 plain, so the gate always fell to its None branch and bailed with "no line found". Fixed on the consumer side — changing 136 stamps to satisfy a regex would be backwards. ** stays optional so archived snapshots and root NOW.md, which still carry the old bold style, keep matching.

The tests were self-matching

Both existing now_gate tests write their own fixture in the bold form, then assert the regex reads it back. The fixture matched because the same commit authored both sides; neither test ever saw nownote.rs's output or the real document. Two added:

• now_gate_accepts_the_plain_form_nownote_writes — pins the shape nownote.rs actually emits. Fails against the pre-fix pattern.
• now_gate_agrees_with_the_live_gate_on_the_real_document — runs the gate against the real docs/NOW.md, deriving the expected date with the live gate's own rule (bootstrap/src/suite.rs takes the first line containing Last updated:). It asserts the two implementations agree. It deliberately does not assert freshness, so it cannot go red merely because the file is a day old, and it no-ops rather than failing outside a checkout.

This is dead code, and saying so changes the severity

Nothing invokes tri hooks now-gate or tri hooks pre-commit. The gate that actually runs at commit time is a separate implementation: .githooks/pre-commit → scripts/tri check-now → t27c check-now (bootstrap/src/suite.rs), which matches on contains("Last updated:") and therefore accepts plain. Outside hooks.rs itself, the only mentions are two table rows in MIGRATION_AUDIT.md.

So no commit is blocked today. It is still worth fixing: MIGRATION_AUDIT.md presents tri hooks as the Rust port that replaces the shell gates, and it would reject every commit the moment anything wires it up.

2. .gitattributes described a symlink that does not exist

The comment read "The root file is a symlink, so git merges the link target, not the text".

$ git ls-tree origin/master NOW.md
100644 blob 4d8a8afdb238043b84692d55d6a356bcee85e9f2	NOW.md

100644 is a regular file; a symlink would be 120000. Root NOW.md is its own divergent document stamped Last updated: 2026-08-09 while docs/NOW.md is stamped today.

A second claim was backwards: "the rule above names the SYMLINK, not the file that actually conflicts". The pattern NOW.md has no slash, so git matches it by basename at any depth — it already covers docs/NOW.md. Verified:

$ git check-attr merge -- NOW.md docs/NOW.md sub/dir/NOW.md
NOW.md: merge: union
docs/NOW.md: merge: union
sub/dir/NOW.md: merge: union

Comments only — no rule changed. git check-attr merge returns union for the same three paths before and after this commit.

Whether root NOW.md should become a real symlink, be deleted, or keep its own content is deliberately not decided here. #2253 raised that and stays open for it; this PR fixes only the comment-accuracy half.

3. docs/NOW.md.master — 835 lines of committed base64

Landed in d063152ad, evidently a .master conflict side-file that was base64'd and committed. Verified junk before removing:

• Decodes cleanly to 35,328 bytes of an obsolete NOW snapshot stamped **Last updated:** 2026-04-08 — note the bold form, which is the format defect 1's regex was written against.
• git grep -n "NOW\.md\.master" origin/master returns zero hits tree-wide. No script, workflow, test or doc reads the path.

Being base64, it was unreadable in review, ungreppable and undiffable — inert bytes. Removed.

A number in the brief did not survive checking

The task I worked from said "137 entries". Measured on master it is 136 Last updated: stamps across 74 ^# NOW -- headers. Corrected in the issue, the commit message and the NOW entry rather than repeated. The load-bearing figure for the defect is the zero, not the 136.

Verification

$ git show --numstat HEAD
18	11	.gitattributes
59	2	cli/tri/src/hooks.rs
86	0	docs/NOW.md      <- pure prepend, 0 deleted
0	835	docs/NOW.md.master

• docs/NOW.md: 0 removed lines — existing entries untouched.
• No conflict markers in any changed file.
• File list is exactly the four intended paths.
• Both gate rules resolve to the same stamp on the new file (line 3, 2026-08-20); the old bold-only pattern still finds nothing there, which is the defect reproducing on the live document.

Compilation — not done locally, since confirmed by CI

I did not run cargo locally (out of scope for this change), so when this was opened the Rust edits were reviewed by reading only. CI has since compiled and run them. The cli-tri job reports 155 passed / 1 failed, and all five now_gate tests are green, including both new ones:

test hooks::tests::now_gate_accepts_the_plain_form_nownote_writes ... ok
test hooks::tests::now_gate_agrees_with_the_live_gate_on_the_real_document ... ok
test hooks::tests::now_gate_accepts_today_override ... ok
test hooks::tests::now_gate_rejects_stale_date ... ok

The liveness test passing is the meaningful one: it ran the gate against the real docs/NOW.md in a fresh checkout and the two implementations agreed.

The three red checks are pre-existing on master

build (cli-tri), coverage (seal-coverage) and withdrawn-live (withdrawn-live-gate) fail here, and they fail on master too — including at 7e8de87b1, the exact commit this branched from:

$ gh run list --branch master --workflow cli-tri.yml --limit 2
failure  2026-08-20T05:43:24Z  b6cb1ec69
failure  2026-08-20T04:27:09Z  7e8de87b1   <- this PR's base

None is caused by this change. The cli-tri failure is fpga::tests::test_smoke_gate_json_synthetic_verify_lean at cli/tri/src/fpga.rs:9977, which trips on [smoke-gate] SKIP: yosys not on PATH — unrelated to hooks.rs. All four required contexts (check-now-freshness, validate, check, check-linked-issue) pass.

One thing observed and deliberately not changed: now_gate computes "today" from Utc::now(), while the live t27c check-now uses the local clock. Those can disagree either side of midnight. Out of scope — flagged for whoever wires tri hooks up.

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

[github-actions]

PR Dashboard

Generated at: 2026-08-20 05:43:07 UTC

• fix(hooks): now-gate matched a bold NOW stamp nothing writes; correct the symlink comment; drop 835 lines of base64 #2300 fix(hooks): now-gate matched a bold NOW stamp nothing writes; correct the symlink comment; drop 835 lines of base64 | Created: 2026-08-20 | Updated: 2026-08-20 | 16 failing / 25 total
• fix(ci): one NOW entry per file, and retire merge=union #2298 fix(ci): one NOW entry per file, and retire merge=union | Created: 2026-08-20 | Updated: 2026-08-20 | 6 failing / 34 total
• ci: eleven merge-critical gates were silent on stacked PRs #2169 ci: eleven merge-critical gates were silent on stacked PRs | Created: 2026-08-14 | Updated: 2026-08-14 | 5 failing / 30 total
• corpus: freeze the damage, patch one class at a time, and say where one rule stops #2161 corpus: freeze the damage, patch one class at a time, and say where one rule stops | Created: 2026-08-14 | Updated: 2026-08-20 | 0 failing / 9 total
• tri triage: five ordered classes, and blocked is tested before actionable (#2156) #2157 tri triage: five ordered classes, and blocked is tested before actionable (#2156) | Created: 2026-08-14 | Updated: 2026-08-14 | 0 failing / 17 total
• parser: nesting decides the separator, never the terminator (#2127) #2151 parser: nesting decides the separator, never the terminator (#2127) | Created: 2026-08-14 | Updated: 2026-08-14 | 2 failing / 26 total
• Unbreak FPGA CI and correct two unbacked hardware claims #2081 Unbreak FPGA CI and correct two unbacked hardware claims | Created: 2026-08-11 | Updated: 2026-08-20 | 5 failing / 27 total
• feat(igla): Wave Loop 898 — module-scope [615][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1900 feat(igla): Wave Loop 898 — module-scope [615][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-07 | Updated: 2026-08-07 | 1 failing / 3 total
• chore: civilian mesh positioning — drop drone wording (bpsk.t27) #1874 chore: civilian mesh positioning — drop drone wording (bpsk.t27) | Created: 2026-08-07 | Updated: 2026-08-07 | 2 failing / 25 total
• feat(igla): Wave Loop 897 — module-scope [613][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1858 feat(igla): Wave Loop 897 — module-scope [613][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-07 | Updated: 2026-08-07 | 1 failing / 3 total
• feat(igla): Wave Loop 896 — module-scope [611][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1856 feat(igla): Wave Loop 896 — module-scope [611][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-07 | Updated: 2026-08-07 | 1 failing / 3 total
• feat(igla): Wave Loop 895 — module-scope [609][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1854 feat(igla): Wave Loop 895 — module-scope [609][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-07 | Updated: 2026-08-07 | 1 failing / 3 total
• feat(igla): Wave Loop 894 — module-scope [607][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1852 feat(igla): Wave Loop 894 — module-scope [607][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-07 | Updated: 2026-08-07 | 1 failing / 3 total
• feat(igla): Wave Loop 893 — module-scope [605][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1850 feat(igla): Wave Loop 893 — module-scope [605][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-07 | Updated: 2026-08-07 | 1 failing / 3 total
• feat(igla): Wave Loop 892 — module-scope [603][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1847 feat(igla): Wave Loop 892 — module-scope [603][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-07 | Updated: 2026-08-07 | 1 failing / 3 total
• feat(igla): Wave Loop 891 — module-scope [601][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1844 feat(igla): Wave Loop 891 — module-scope [601][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-07 | Updated: 2026-08-07 | 0 failing / 4 total
• feat(igla): Wave Loop 890 — module-scope [599][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1842 feat(igla): Wave Loop 890 — module-scope [599][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-07 | Updated: 2026-08-07 | 0 failing / 4 total
• feat(igla): Wave Loop 883 — module-scope [585][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1815 feat(igla): Wave Loop 883 — module-scope [585][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-06 | Updated: 2026-08-06 | 0 failing / 1 total
• feat(igla): Wave Loop 882 — module-scope [583][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1813 feat(igla): Wave Loop 882 — module-scope [583][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-06 | Updated: 2026-08-06 | 0 failing / 12 total
• feat(igla): Wave Loop 881 — module-scope [581][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes #1810 feat(igla): Wave Loop 881 — module-scope [581][2]^6 Pt non-power-of-two outer-dimension array-of-struct variable from call with indexed signed writes | Created: 2026-08-06 | Updated: 2026-08-06 | 0 failing / 12 total

Summary

Status	Count
Total Open PRs	20
PRs with Failing Checks	5
PRs with All Checks Green	15
READY	7
FAILING	5
PENDING	0

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=cbbfac87dff3 != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).