fix(meta): PR #175 review round — all 14 findings addressed

H1 godot-cold-parse exit-code guard (+bonus: import-pass for cold checkouts, found live); H2 pr-watchlist-diff loud registry failure; H3/T1 deny list :* normalization (add-only) + uniform allow syntax; H4/T7 helper-script allows; H5 get_api_key env-only (config.json is tracked — no secret fallback); H6 TEAM.md active/standby split; H7 troblum solo-profiling note; H8 pr-review frontmatter Task->Agent; H9 conventions doc taxonomies fixed vs real tree; T2 ask-gate leash files (settings/hooks) in tracked settings; T3 R-013 cross-reference; T4 governance README index regenerated (pql decisions sync); T5 dudley briefing ACTIVE; T6 pr-process step 7 run-from-main.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tooling/pr-watchlist-diff

@@ -17,7 +17,16 @@ set -euo pipefail
 BASE="${1:?usage: tooling/pr-watchlist-diff <base> <head>}"
 HEAD="${2:?usage: tooling/pr-watchlist-diff <base> <head>}"
 
-mapfile -t GENERATOR_SOURCES < <(python3 tooling/generator_sources.py --list)
+# Load the registry via plain assignment (set -e sees its failure), not
+# `mapfile < <(...)` — a failed process substitution is invisible to set -e
+# and would silently yield an empty watch list, disabling the DB-staleness
+# net exactly when the shared registry breaks. Guard the empty case too.
+SOURCES_RAW="$(python3 tooling/generator_sources.py --list)"
+if [ -z "$SOURCES_RAW" ]; then
+    echo "pr-watchlist-diff: generator_sources.py --list returned nothing" >&2
+    exit 1
+fi
+mapfile -t GENERATOR_SOURCES <<< "$SOURCES_RAW"
 
 git diff --name-only "$BASE...$HEAD" -- \
   "${GENERATOR_SOURCES[@]}" \