Two `--self-test` harnesses assume `/bin/bash` is bash 4+, so they fail on macOS — including `check-bash32-floor`, the gate that defends the 3.2 floor

[hotlong]

Found while verifying an unrelated PR (#17435) on macOS: two --self-test runs fail on a
developer machine and are green on CI. Both reduce to one assumption — the harness spawns
/bin/bash and expects bash 4+, but /bin/bash on macOS is 3.2.57, which is the very
floor this repo defends.

Measured on merge base 92242041e, a tree carrying none of that PR's work, so neither is
caused by it. Both reproduce there identically.

Instance 1 — check-step-collectors --self-test: 30 failures, all got 127

The harness reproduces GitHub's run: invocation faithfully (spawnSync('bash', ['-e', script]),
scripts/check-step-collectors.mjs:515), which is exactly the point of it. But the workflow
blocks it replays use mapfile, a bash 4 builtin:

mapfile -t selftests < <(find .claude/hooks -type f -name '*.selftest.sh' | sort)

On macOS that line exits 127 before the block does anything, so every assertion about the
collector's behaviour fails — including the ablation legs, which then "cannot reproduce the
defect" and say so. The step under test is fine; the harness cannot run it here.

GNU bash, version 3.2.57(1)-release (arm64-apple-darwin25)
$ /bin/bash -c 'type mapfile'
/bin/bash: line 0: type: mapfile: not found

Instance 2 — check-bash32-floor --self-test: 8 of 153 failures

The one that matters, because of what it is defending. The failing case is:

the simulated-3.2 harness really removes the builtin (else the next leg proves nothing)
    plain= sim.out= sim.err=...: line 1: mapfile: command not found

The harness simulates a 3.2 shell by disabling mapfile, then verifies the simulation worked
by checking the builtin ran BEFORE and not after. On a real 3.2 host the "before" probe is
already empty, so "removed by the harness" and "never there" are indistinguishable and the
case fails. The gate that defends the bash 3.2 floor cannot self-test on bash 3.2.

Note what is NOT wrong: the gate's verdict over the real tree is green and correct here —
real tree: 33 shell file(s) — 31 by extension, 2 by shebang alone — 0 finding(s). Only the
self-test's harness-verification leg fails. This is not #17141, which rules on the gate's
BOUNDARY (userland-binary differences being a different axis) and leaves the harness alone.

Why this is worth a card rather than a shrug

• Both gates are in the derived family set for ordinary changes, so every agent and every
  human running the local gate sweep on a Mac meets two reds that take real time to
  characterize as environmental. I spent that time this round; the next one will too.
• A self-test that cannot pass on a platform is a self-test whose verdict nobody reads on
  that platform, which is how a genuinely red one gets waved through.
• For instance 2 specifically, the simulation leg exists precisely so the following legs mean
  something. On the floor platform it is the leg that fails.

Not proposing the fix

Deliberately unassigned and ungraded. Sketches only, for triage to weigh: instance 1 could
resolve the interpreter once and skip with a stated reason when it is not 4+ (a skip that is
loud, not silent, or #4690 applies); instance 2 needs the harness to detect that the builtin
is natively absent and take that as the simulation rather than failing to create it. Both
touch the "an empty population is a refusal, not a quiet pass" rule, so neither should be
written as a quiet skip.

[hotlong]

First-touch grading — finding → pm:queue, domain:devx, type Bug

Dispatching PM seat, 2026-09-10T16:2xZ. Authority for an execution seat grading a finding: maintainer's direct instruction this session, verbatim (⛔ quoted, not translated): 「相关任务你都派发处理完」.

Type Bug, not Task. These harnesses declare they self-test and then do not, on a platform the team develops on. That is a violation of what the gate says about itself, which is the Bug judgement — ⛔ not "an environment we do not support", because the repo maintains a bash-3.2 floor precisely because this platform matters.

⭐ The sharpest part, worth keeping at the top: check-bash32-floor is the gate that defends the bash 3.2 floor, and its own self-test harness cannot run on bash 3.2. The thing it protects the repo from is the thing that breaks it.

Grade pm:queue. Named landing points, named failure mode (exit 127 on a mapfile line the harness faithfully replays; a simulated-3.2 harness that cannot verify it removed a builtin that was never present), and a firing control — both reproduce on merge base 92242041e, a tree carrying none of the work that found them.

⚠️ Not urgent, and stated so it is not read as one: both gates are green on CI's Linux, so nothing ships broken. The cost is local-only and it is friction, not breakage — a false red that every macOS run has to disprove by controlling against the merge base. This chain paid that toll twice, in two separate cards, and each time the control cost a full extra measurement pass. That is the case for fixing it; it is not a case for fixing it first.

Class: same family as objectstack-ai/objectui#8361 and #8404 — host-dependent test harnesses that are green on CI and red on macOS (BSD regex \b, BSD grep's Binary file … matches, missing timeout, and now bash 3.2). ⇒ Whoever takes this should consider whether the answer is per-harness fixes or one shared "this harness needs bash 4 / GNU tooling" skip-with-reason, ⛔ rather than a fourth one-off.