fix(gitea): 補齊稽核缺失並修掉護欄失效

What：依 jsc-meta:skill-check 的稽核結果修正技能與工具——補上每個步驟的可檢核完成條件、
把留在內文的標準輸入輸出流程下放 tools/、修正查表與退碼路由造成的誤判。

Why：稽核發現這些缺失會讓技能在實際執行時走錯分支或靜默通過。
完成條件缺漏是最常被違反的一項；退碼誤判與查表錯誤則會讓良性狀況被當成失敗。

How：逐項對照 references/guidelines.md 的審核檢查清單修正，新增的工具都有
documented exit codes，並以真實執行驗證每條路徑。

Who：jsc-meta:skill-check 例行稽核（2026-08-25）。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/check-wiki-rules.sh

@@ -1,11 +1,15 @@
 #!/usr/bin/env sh
 # check-wiki-rules — 驗證 wiki repo 解析與 hash-id 規則。
+# 涵蓋全部九種頁面類型，每種三項：專用變數優先、退回共用變數、不得跨類型代用。
+# 全部通過印 OK 並 exit 0；任一項不符印出差異並 exit 1。
 set -eu
 
 dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 gitea="$dir/gitea.sh"
 hash_id="$dir/hash-id"
 
+TYPES='QUESTION PLAN ANALYZE DELIVER MAINTAIN REPO LOG LEARN ERROR'
+
 fail() {
   printf '%s\n' "$1" >&2
   exit 1
@@ -18,7 +22,7 @@ expect_eq() {
   [ "$got" = "$want" ] || fail "$label: want=$want got=$got"
 }
 
-check_repo() {
+check_repo() { # type label want [VAR=值...]
   type=$1
   label=$2
   want=$3
@@ -27,6 +31,19 @@ check_repo() {
   expect_eq "$got" "$want" "$label"
 }
 
+check_no_repo() { # type label [VAR=值...]：期望 exit 3 且不印出任何 {owner}/{repo}
+  type=$1
+  label=$2
+  shift 2
+  if got=$(env -i PATH="${PATH:-/usr/bin:/bin}" "$@" "$gitea" wiki-repo "$type" 2>/dev/null); then
+    code=0
+  else
+    code=$?
+  fi
+  [ "$code" -eq 3 ] || fail "$label: want exit=3 got exit=$code output=$got"
+  [ -z "$got" ] || fail "$label: want no output got=$got"
+}
+
 check_hash() {
   input=$1
   want=$2
@@ -34,47 +51,42 @@ check_hash() {
   expect_eq "$got" "$want" "hash-id $input"
 }
 
-check_repo REPO 'REPO specific wins' 'records/REPO' \
-  JSC_WIKI_REPO_REPO='records/REPO' \
-  JSC_WIKI_REPO_ANALYZE='knowledges/ANALYZE' \
-  JSC_WIKI_REPO='shared/wiki'
+# 其他八個類型的誘餌值。跨類型代用一旦發生，回傳的就會是 decoy/{別的類型}。
+decoys() { # $1=要排除的類型
+  for t in $TYPES; do
+    [ "$t" = "$1" ] || printf 'JSC_WIKI_REPO_%s=decoy/%s ' "$t" "$t"
+  done
+}
 
-check_repo REPO 'REPO falls back to shared only' 'shared/wiki' \
-  JSC_WIKI_REPO_ANALYZE='knowledges/ANALYZE' \
-  JSC_WIKI_REPO='shared/wiki'
+for ty in $TYPES; do
+  # 1. 自己的變數贏過共用變數，也贏過其他類型的誘餌。
+  check_repo "$ty" "$ty specific wins" "own/$ty" \
+    $(decoys "$ty") "JSC_WIKI_REPO_$ty=own/$ty" JSC_WIKI_REPO='shared/wiki'
 
-check_repo ANALYZE 'ANALYZE specific wins' 'knowledges/ANALYZE' \
-  JSC_WIKI_REPO_REPO='records/REPO' \
-  JSC_WIKI_REPO_ANALYZE='knowledges/ANALYZE' \
-  JSC_WIKI_REPO='shared/wiki'
+  # 2. 自己的變數未設定時，只退回共用變數。
+  check_repo "$ty" "$ty falls back to shared only" 'shared/wiki' \
+    $(decoys "$ty") JSC_WIKI_REPO='shared/wiki'
 
-check_repo ANALYZE 'ANALYZE falls back to shared only' 'shared/wiki' \
-  JSC_WIKI_REPO_REPO='records/REPO' \
-  JSC_WIKI_REPO='shared/wiki'
+  # 3. 自己的變數與共用變數都沒有時，exit 3，不借用別的類型。
+  check_no_repo "$ty" "$ty never borrows another type" $(decoys "$ty")
+done
 
-check_repo LEARN 'LEARN specific wins' 'lessons/LEARN' \
-  JSC_WIKI_REPO_LEARN='lessons/LEARN' \
-  JSC_WIKI_REPO='shared/wiki'
-
-check_repo LEARN 'LEARN falls back to shared only' 'shared/wiki' \
-  JSC_WIKI_REPO_LOG='records/LOG' \
-  JSC_WIKI_REPO='shared/wiki'
-
-check_repo DELIVER 'DELIVER specific wins' 'handover/DELIVER' \
-  JSC_WIKI_REPO_DELIVER='handover/DELIVER' \
-  JSC_WIKI_REPO='shared/wiki'
-
-check_repo DELIVER 'DELIVER falls back to shared only' 'shared/wiki' \
-  JSC_WIKI_REPO_ANALYZE='knowledges/ANALYZE' \
-  JSC_WIKI_REPO='shared/wiki'
-
-check_repo ERROR 'ERROR uses its own repo' 'errors/wiki' \
-  JSC_WIKI_REPO_ERROR='errors/wiki' \
-  JSC_WIKI_REPO='shared/wiki'
+# 未知類型 exit 2，與「設定不足」的 exit 3 分開。
+if got=$(env -i PATH="${PATH:-/usr/bin:/bin}" JSC_WIKI_REPO='shared/wiki' \
+         "$gitea" wiki-repo NOSUCH 2>/dev/null); then
+  code=0
+else
+  code=$?
+fi
+[ "$code" -eq 2 ] || fail "unknown type: want exit=2 got exit=$code"
+[ -z "$got" ] || fail "unknown type: want no output got=$got"
 
+# hash-id：首碼 0-9/A/B/C 改成 H 加前 7 碼；其餘首碼原樣輸出 8 碼大寫。
 check_hash 'case-2' 'H5172CB7'
 check_hash 'case-11' 'HA9A6662'
 check_hash 'case-1' 'HB6EC7FD'
 check_hash 'case-12' 'HCCA8D42'
+check_hash 'case-3' 'D3E5AA27'
+check_hash 'case-7' 'D794C002'
 
 printf '%s\n' 'OK'