Merge nucleic/sleek-thistle-egret-fyej into dev

NUCLEIC_FORK.md

@@ -22,6 +22,8 @@ Every fork change is marked with a `// nash:` comment. Current patches:
 | `brush-core/src/interp.rs` | `ExecutionParameters.nash_redirects` accumulator; `setup_redirect` records file (`>`,`>>`,`<`,`2>`,`&>`,`<>`), heredoc, and here-string redirects |
 | `brush-core/src/commands.rs` | gate wrapper drains `nash_redirects` into `ExecStart` for post-run read-back |
 | `brush-core/src/expansion.rs` | command-substitution arm calls `gate().on_cmdsub` with the trimmed output |
+| `brush-core/src/gate.rs` | pipe tap (docs/NASH.md §5.3): `PipeEvent` + `Gate::on_pipe` default hook + `is_active()`/`next_pipeline_id()` gating |
+| `brush-core/src/interp.rs` | `spawn_pipeline_processes` interposes a tee on each `a \| b` link when observation is active (`nash_spawn_pipe_tee`): a copier thread mirrors a bounded prefix, preserving backpressure and SIGPIPE, reports before closing the write end. No tee on the unobserved fast path. |
 
 Verification (this container): brush compat suite `2067 ran: 1684 succeeded, 6
 failed, 377 known to fail, 38 skipped` — the 6 failures are identical to a
@@ -30,11 +32,9 @@ pristine `brush-shell-v0.4.0` baseline run (environmental: ANSI-C quote and
 zero fork-caused regressions; +3 successes vs baseline are the repaired IFS
 tests. nash corpus: 94/94.
 
-Planned (M2 remainder, per docs/NASH.md §5.3): inline tees on the pipe wiring
-in `interp.rs::spawn_pipeline_processes` (the `std::io::pipe()` links between
-`a | b` stages) — the one data-flow channel not yet tapped. Deferred as the most
-invasive change (async copier + backpressure + SIGPIPE); regular-file
-redirections, heredoc/here-string, and command substitution are all captured.
+Planned (M3, per docs/NASH.md / NAROS.md): image-side delivery — nash baked and
+forced on every Linux surface via narOS. No further brush-core patches expected
+for M3; enforcement (`Hold`/`Deny` verdicts) remains post-M6.
 
 Updating: diff against the upstream tag, re-vendor, re-apply `// nash:` patches
 (grep for the marker), then re-run `shell/corpus/replay.py` and the brush compat