Merge nucleic/sleek-thistle-egret-fyej into dev

NUCLEIC_FORK.md

@@ -14,6 +14,10 @@ Every fork change is marked with a `// nash:` comment. Current patches:
 | `brush-core/src/expansion.rs` | corpus divergence D1: added `ExpansionPiece::LiteralText` — literal unquoted text is never field-split (bash splits only expansion results) but keeps glob characters active. Parameter-expansion substitutions (`${v:-word}` etc.) convert back to splittable at the expansion boundary; `ExpanderOptions.field_split_literal_text` lets data-string callers opt in. Upstream candidate. |
 | `brush-core/src/completion.rs` | `compgen -W` word list opts into `field_split_literal_text` (the -W string is data) |
 | `brush-shell/tests/cases/compat/ifs.yaml` | removed `known_failure` from 3 IFS tests the D1 fix repairs |
+| `brush-core/src/gate.rs` (new) + `lib.rs` | the `Gate` trait (docs/NASH.md §4.2): process-global, verdict-shaped hook; allow-all default so an unconfigured shell behaves exactly like upstream |
+| `brush-core/src/commands.rs` | `SimpleCommand::execute` split into gate wrapper + `execute_inner`: `on_exec` before dispatch (Deny short-circuits), completion correlated through all three spawn-result variants |
+| `brush-core/src/processes.rs` | `ChildProcess.gate_token` + `on_exit` reporting from `wait()`/`poll()` (128+signal for signal deaths) |
+| `brush-shell/src/entry.rs` | `set_exit_hook` seam so nash can flush its event buffer before `process::exit` |
 
 Verification (this container): brush compat suite `2067 ran: 1684 succeeded, 6
 failed, 377 known to fail, 38 skipped` — the 6 failures are identical to a
@@ -22,8 +26,8 @@ pristine `brush-shell-v0.4.0` baseline run (environmental: ANSI-C quote and
 zero fork-caused regressions; +3 successes vs baseline are the repaired IFS
 tests. nash corpus: 94/94.
 
-Planned (M1, per docs/NASH.md §4.2): `brush-core` `Gate` trait (verdict-shaped
-observation hooks) — the only substantial divergence from upstream.
+Planned (M2, per docs/NASH.md §5.2–5.3): redirect/pipe tap hooks on the `Gate`
+trait (`on_redirect`/`on_pipe`) in `interp.rs`/`openfiles.rs`.
 
 Updating: diff against the upstream tag, re-vendor, re-apply `// nash:` patches
 (grep for the marker), then re-run `shell/corpus/replay.py` and the brush compat