Fix facts registry commands and make precheck parsing escape-aware

Why: F2 token extraction predates the two-section (HOME/IMC) layout of
~/.secrets/gitea so it concatenated both tokens and always failed; F6
registered a grep BRE alternation that facts-verify unescapes into a
literal pipe, failing re-verification and misaligning precheck's naive
pipe split into a spurious F6 date-format expiry warning, while both
underlying facts still hold.

Evidence: make facts-verify now 6/6 PASS with last_verified refreshed
to 2026-10-14; new regression test for escaped pipes in facts rows;
full governance suite 342 tests OK (18 skipped); precheck [facts] line
reports all facts fresh on the fixed parser.

Impact: policy/facts.md F2 (HOME-section awk extraction) and F6
(negated pipe-free grep); scripts/task.sh precheck neutralizes escaped
pipes the same way facts-verify does; tests/test_task.py covers it.

Refs: precheck WARN 过期事实 F6(日期格式); AGENTS.md 证据与验证门禁.

policy/facts.md

@@ -10,9 +10,9 @@
 
 | ID | 事实 | 验证命令 | last_verified | TTL(天) |
 |---|---|---|---|---|
-| F1 | Gitea Web/API 可达：https://git-home.u1680832.nyat.app:30319（1.27.3） | `curl -fsS -m 10 https://git-home.u1680832.nyat.app:30319/api/v1/version` | 2026-10-05 | 30 |
-| F2 | API token 存在且可用（值在 ~/.secrets/gitea，文件为 markdown 列表格式 `- ACCESS_TOKEN=…`，不入仓不回显） | `t=$(sed -n "s/^[ -]*ACCESS_TOKEN=//p" ~/.secrets/gitea); test -n "$t" && curl -fsS -m 10 -o /dev/null -H "Authorization: token $t" https://git-home.u1680832.nyat.app:30319/api/v1/user` | 2026-10-05 | 30 |
-| F3 | Git over SSH 可达：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/<Repo>.git（key ~/.ssh/home_gitea） | `GIT_SSH_COMMAND="ssh -i ~/.ssh/home_gitea -o BatchMode=yes" git ls-remote ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git HEAD` | 2026-10-05 | 30 |
-| F4 | 旧端点 git-panel.u1680832.nyat.app:30319 已失效（TLS 握手失败），不得使用 | `! curl -fsS -m 8 https://git-panel.u1680832.nyat.app:30319/api/v1/version` | 2026-10-05 | 180 |
-| F5 | 基座 users 表存有姓名（name 列，CreateAccount/ListUsersAdmin 读写；EXT-19 目录自 P3 起向授权管理读面下发） | `cd modules/backend && go test ./internal/app/ -run TestInprocHostSearchAccounts -count=1` | 2026-10-13 | 180 |
-| F6 | 基座账号无停用位（users 表无 disabled；EXT-19 Valid 恒为存在性）——停用机制未实现，不得当已具备 | `cd modules/backend && grep -rn "disabled\|Disabled" internal/store/auth.go pkg/extension/extension.go` | 2026-10-13 | 180 |
+| F1 | Gitea Web/API 可达：https://git-home.u1680832.nyat.app:30319（1.27.3） | `curl -fsS -m 10 https://git-home.u1680832.nyat.app:30319/api/v1/version` | 2026-10-14 | 30 |
+| F2 | API token 存在且可用（值在 ~/.secrets/gitea，HOME/IMC 两段各一组 `- ACCESS_TOKEN=…`，本条取 HOME 段；不入仓不回显） | `t=$(awk '/^HOME:/{h=1;next} /^IMC:/{h=0} h&&sub(/^- ACCESS_TOKEN=/,""){print;exit}' ~/.secrets/gitea); test -n "$t" && curl -fsS -m 10 -o /dev/null -H "Authorization: token $t" https://git-home.u1680832.nyat.app:30319/api/v1/user` | 2026-10-14 | 30 |
+| F3 | Git over SSH 可达：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/<Repo>.git（key ~/.ssh/home_gitea） | `GIT_SSH_COMMAND="ssh -i ~/.ssh/home_gitea -o BatchMode=yes" git ls-remote ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git HEAD` | 2026-10-14 | 30 |
+| F4 | 旧端点 git-panel.u1680832.nyat.app:30319 已失效（TLS 握手失败），不得使用 | `! curl -fsS -m 8 https://git-panel.u1680832.nyat.app:30319/api/v1/version` | 2026-10-14 | 180 |
+| F5 | 基座 users 表存有姓名（name 列，CreateAccount/ListUsersAdmin 读写；EXT-19 目录自 P3 起向授权管理读面下发） | `cd modules/backend && go test ./internal/app/ -run TestInprocHostSearchAccounts -count=1` | 2026-10-14 | 180 |
+| F6 | 基座账号无停用位（users 表无 disabled；EXT-19 Valid 恒为存在性）——停用机制未实现，不得当已具备 | `cd modules/backend && ! grep -rn -e disabled -e Disabled internal/store/auth.go pkg/extension/extension.go` | 2026-10-14 | 180 |

scripts/task.sh

@@ -91,7 +91,10 @@ cmd_precheck() {
   # [facts] 外部事实登记表过期项（policy/facts.md；引用前先跑其验证命令，AGENTS.md 证据与验证门禁）。
   if [ -f policy/facts.md ]; then
     local fid lv ttl expired="" ftotal=0
-    while IFS='|' read -r _ fid _ _ lv ttl _; do
+    while read -r factline; do
+      # 单元格内转义竖线（\|）先中和，与 facts-verify 的还原约定一致，避免命令列把日期列顶偏
+      factline=${factline//\\|/$'\x01'}
+      IFS='|' read -r _ fid _ _ lv ttl _ <<<"$factline"
       fid=$(echo "${fid:-}" | tr -d ' '); case "$fid" in F[0-9]*) ;; *) continue ;; esac
       ftotal=$((ftotal+1))
       lv=$(echo "$lv" | tr -d ' '); ttl=$(echo "$ttl" | tr -d ' ')

tests/test_task.py

@@ -120,6 +120,21 @@ class TaskLifecycleTests(unittest.TestCase):
         reading = next(line for line in result.stdout.splitlines() if line.startswith("[required-reading]"))
         self.assertIn("policy/delivery.md", reading)
 
+    def test_precheck_facts_row_with_escaped_pipe_stays_fresh(self):
+        facts = self.repo / "policy/facts.md"
+        facts.parent.mkdir(exist_ok=True)
+        facts.write_text(
+            "| ID | 事实 | 验证命令 | last_verified | TTL(天) |\n"
+            "|---|---|---|---|---|\n"
+            "| F1 | 含转义竖线的验证命令 | `echo a\\|b` | 2026-10-13 | 9999 |\n"
+        )
+        self.git(self.repo, "add", "policy")
+        self.git(self.repo, "commit", "-m", "Add facts registry with escaped pipe")
+        result = self.task(self.repo, "precheck")
+        line = next(l for l in result.stdout.splitlines() if l.startswith("[facts]"))
+        self.assertIn("均在有效期内", line)
+        self.assertNotIn("日期格式", line)
+
     def test_sync_same_base_preserves_head_and_card(self):
         wt = self.worktree()
         card = self.record_task_card(wt)