Two failures T-1261 found and fixed by hand, left unguarded. They now fail
the conformance gate:
- (8) An interpreter-prefixed invocation — `python -m tooling`,
`python3 -m tooling`, `.venv/bin/reach` — anywhere in the Makefile, the
hooks, .claude or docs. One such line silently forks the PATH guarantee.
Lines that FORBID the pattern are exempt, since docs/DEVOPS.md states the
rule in those words and a check that flags its own documentation gets muted.
- (9) The installed reach (read from its shebang) and the .venv the gate
tests run in must be the same Python minor version, and it must be the one
the Makefile pins. uv once installed reach on 3.11 against a 3.14 venv, so
the tests were proving nothing about the interpreter the hooks run.
Both proven to fail: an appended `python3 -m tooling.main` make target is
caught at its line, and a fake `reach` with a 3.12 shebang first on PATH
trips both version comparisons. The invariant list in the docstring now
covers all nine, not the first five.
Also: the canvas-version units ran under system python3 while every other
gate test uses $(VENV_PY). Now they match.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>