docs(governance): D-263 — half the tooling is bash, and it gets rewritten

Found on starting the first port: 17 of the 33 tooling executables are bash,
about 900 lines. Both this record and the domain map had assumed a Python tree,
so those are rewrites rather than moves — a materially larger epic than T-1250
was written for.

Decided: rewrite them, do not wrap them. Wrapping would achieve one door while
leaving half the CLI surface outside the contract — no @command, no remedy on
failure, no streaming, no testable service. reach --help would then list verbs
that behave differently from the ones beside them, which is worse than two
doors, because the inconsistency is invisible until something fails.

The cost lands unevenly and the record says where. The grep-pipeline scripts
compute verdicts and gain most from becoming services. The environment scripts
— install-godot, install-rust, worktree-setup — gain least and carry the most
regression risk, because downloading a specific Godot build or driving rustup
is awkward to exercise in a gate. For those, port the decision logic into a
testable service and keep the irreducible external calls behind core/process: a
rewrite that cannot be tested has to be trusted instead, and trusting an
installer is how a working environment becomes an unreproducible one.

The domain map gains the inventory by shape, and a rule that every per-domain
ticket states which of its sources are bash — since that is what turns a port
from mechanical into a rewrite needing its own parity evidence.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tooling/DOMAINS.md

@@ -36,6 +36,27 @@ And two found while reading the tree:
   `db` after that directory would carry the misnomer forward, so its contents
   split between `assets` and `wiki` instead.
 
+## Half the executables are bash
+
+Found 2026-08-31, after this map was first written and while starting the first
+port. **17 of the 33 extensionless executables are bash**, ~900 lines. This map
+originally assigned them as though they were Python files to be moved; they are
+rewrites.
+
+Decided: **rewrite all of them in Python** (D-263). Wrapping would achieve one
+door while leaving half the surface outside the contract, so `reach --help`
+would list verbs that behave differently from the ones beside them — worse than
+two doors, because the inconsistency only shows up at a failure.
+
+| shape | scripts | cost |
+|---|---|---|
+| thin wrappers | `atlas-systems-done` 9, `atlas-names` 17, `generate-brands` 23, `atlas` 24, `generate-corporations` 23, `blender` 28 | near-free; the router calls what the script called |
+| logic | `check-fact-ids` 89, `validate-ron` 137, `godot-parse-sweep` 64, `godot-cold-parse` 96, `pr-watchlist-diff` 37, `atlas-update-field` 59, `atlas-commit-and-sync` 60, `tea-comment` 41 | real rewrite; gains the most — testable, failures that teach |
+| environment | `install-godot` 108, `install-rust` 33, `worktree-setup` 49 | gains least, riskiest — port the *decision* logic, keep the external calls behind `core/process` |
+
+A **bash** source turns a port from mechanical into a rewrite that needs its own
+parity evidence. Each per-domain ticket must say which of its sources are bash.
+
 ## Domains
 
 | domain | what it is | sources |