tools: wire bash retirement inventory guard

.github/workflows/gate.yml

@@ -569,6 +569,29 @@ jobs:
           printf '  %s\n' "${files[@]}"
           shellcheck --format=gcc --severity=style "${files[@]}"
 
+  lint-bash-retirement-inventory:
+    # Bash-retirement guard for the TypeScript/Bun migration trajectory:
+    # Zeta-owned post-install repo scripts should not grow new `.sh`
+    # entrypoints after Bucket B reached zero. The retained shell surface is
+    # setup/bootstrap only because it runs before Bun exists.
+    name: lint (bash retirement inventory)
+    timeout-minutes: 3
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install toolchain via three-way-parity script (GOVERNANCE §24)
+        # Provides bun via mise's pin in .mise.toml. The inventory guard is
+        # intentionally separate from shellcheck: shellcheck validates the
+        # retained setup scripts, while this job fails any new non-allowlisted
+        # tracked `.sh` surface before it reaches main.
+        run: ./tools/setup/install.sh
+
+      - name: Run bash-retirement inventory guard
+        run: bun run hygiene:check-bash-retirement-inventory
+
   lint-workflows:
     # actionlint catches .github/workflows/*.yml bugs: unknown
     # context refs, invalid runner labels, shellcheck-style warnings

docs/trajectories/typescript-bun-migration/RESUME.md

@@ -1,11 +1,12 @@
 # Trajectory — TypeScript / Bun migration
 
-**Status**: Soak + bash-retirement phase (Lane B slice 21 merged — [#908](https://github.com/Lucent-Financial-Group/Zeta/pull/908); **Bucket B is empty**; retained non-Lean bash surface is setup/bootstrap only)
-**Milestone**: 42 ported. All clusters complete: budget (14/18/19), peer-call (15/16/17), git (13/20), pr-preservation (21). Bucket B is empty as of 2026-04-30T08:07:32Z. The remaining non-Lean `.sh` inventory is guarded by `tools/hygiene/check-bash-retirement-inventory.ts`.
+**Status**: Soak + bash-retirement phase (Lane B slice 21 merged — [#908](https://github.com/Lucent-Financial-Group/Zeta/pull/908); bash-retirement inventory guard landed — [#2764](https://github.com/Lucent-Financial-Group/Zeta/pull/2764); **Bucket B is empty**; retained non-Lean bash surface is setup/bootstrap only)
+**Milestone**: 42 ported. All clusters complete: budget (14/18/19), peer-call (15/16/17), git (13/20), pr-preservation (21). Bucket B is empty as of 2026-04-30T08:07:32Z. The remaining non-Lean `.sh` inventory is guarded by `tools/hygiene/check-bash-retirement-inventory.ts` and wired through package script `hygiene:check-bash-retirement-inventory` plus the `gate.yml` bash-retirement inventory lint job.
 **Current blocker**: None.
-**Next concrete action**: Land the bash-retirement inventory check, then wire it
-into the appropriate hygiene/CI surface after one clean soak pass. Do not revive
-the old Cluster G/H/I or budget-cluster port queues.
+**Next concrete action**: Shepherd the bash-retirement inventory wire-in PR
+through review and CI; after merge, decide whether the bash-retirement phase can
+move from soak to closed-maintained. Do not revive the old Cluster G/H/I or
+budget-cluster port queues.
 **Last updated**: 2026-05-12
 
 ## Why this trajectory exists
@@ -32,6 +33,7 @@ Per the maintainer-channel correction via the multi-AI review surface (2026-04-2
 | [#882](https://github.com/Lucent-Financial-Group/Zeta/pull/882) | 2026-04-30 (commit `02266a7`) | `tools/hygiene/validate-agencysignature-pr-body.{sh→ts}`, `tools/hygiene/audit-agencysignature-main-tip.{sh→ts}`, `tools/hygiene/capture-tick-snapshot.{sh→ts}` | Merged |
 | [#883](https://github.com/Lucent-Financial-Group/Zeta/pull/883) | 2026-04-30 (commit `271bc38`) | `tools/hygiene/counterweight-audit.{sh→ts}`, `tools/hygiene/append-tick-history-row.{sh→ts}` | Merged |
 | [#884](https://github.com/Lucent-Financial-Group/Zeta/pull/884) | 2026-04-30 (commit `9237756`) | `tools/skill-catalog/backfill_dv2_frontmatter.{sh→ts}`, `tools/audit-packages.{sh→ts}` | Merged |
+| [#2764](https://github.com/Lucent-Financial-Group/Zeta/pull/2764) | 2026-05-12 (commit `b563ba0`) | `tools/hygiene/check-bash-retirement-inventory.ts`, `tools/hygiene/check-bash-retirement-inventory.test.ts` | Merged |
 
 ## Inventory — Python (tools/, Zeta-authored)
 
@@ -45,6 +47,7 @@ Current count is repo-derived and guarded by:
 
 ```bash
 bun tools/hygiene/check-bash-retirement-inventory.ts --enforce
+bun run hygiene:check-bash-retirement-inventory
 ```
 
 The expected retained surface is setup/bootstrap only. Any new non-Lean `.sh`

package.json

@@ -14,7 +14,8 @@
     "typecheck": "tsc --noEmit",
     "test:typescript": "bun test",
     "hygiene:sort-tick-history": "bun ./tools/hygiene/sort-tick-history-canonical.ts",
-    "hygiene:fix-markdown": "bun ./tools/hygiene/fix-markdown-md032-md026.ts"
+    "hygiene:fix-markdown": "bun ./tools/hygiene/fix-markdown-md032-md026.ts",
+    "hygiene:check-bash-retirement-inventory": "bun ./tools/hygiene/check-bash-retirement-inventory.ts --enforce"
   },
   "devDependencies": {
     "@eslint/js": "10.0.1",