[BasilZafar11]

The sweep helpers assigned their working variables globally, allowing calls to overwrite caller state. Declare Bash variables local in sweep_one, build_summary, and main, including the loop variable and scanner exit status. Keep the scanner command and status capture separate so local cannot mask its exit code. do_compare needs no Bash declarations because its assignments occur inside a separate Python process.

Add tests/gate03_sweep_test.sh and run it in CI. It checks caller-variable preservation through direct helper calls and main, scanner exit codes 0/1/2, missing directories, manifest and summary output, and equal/different finding comparisons.

Validation:

• bash -n scripts/gate03-sweep.sh and bash -n tests/gate03_sweep_test.sh pass.
• The regression check fails against the upstream script and passes against the fixed script.
• Executed on Git Bash 5.2 with installed Python 3.13 (mapped to python3 locally because Windows' python3 alias is inactive).
• git diff --check passes. No Rust code or patterns changed; the full Rust suite was not rerun locally.

Closes #181.

[hermanngeorge15]

Reviewed. The fix is correct and, importantly, complete — I checked every assignment in the three functions against the local declarations rather than taking the diff at face value:

function	variables assigned	declared local
sweep_one	out_dir dir abs_dir slug report status files_scanned findings	all 8
build_summary	out_dir	yes
main	out_dir, plus the loop variable dir	both

Nothing is left global. do_compare correctly needs none, since its assignments live inside the Python heredoc, as you said.

Keeping the scanner invocation and the status capture on separate lines is the right call and worth the comment you gave it — local status=$(...) would have masked the command's exit code behind local's own, which is exactly the class of bug this PR is fixing.

"The check fails against upstream and passes with the fix" is the right way to demonstrate a regression test. Thank you for stating it that way.

CI is red on PERF-01 only; that is a pre-existing flake on main, not this PR. See #188.

Two non-blocking suggestions:

1. tests/gate03_sweep_test.sh is added with mode 100644, while scripts/gate03-sweep.sh is 100755. CI invokes it as bash tests/... so it works, but ./tests/gate03_sweep_test.sh will not. Worth chmod +x for consistency with the rest of the repo.

2. source <(sed '/^main "\$@"$/d' ...) depends on the entry point being the exact literal line main "$@". If that line is ever reformatted — wrapped in a guard, given an argument, indented — the sed silently stops matching and the test starts executing the real main at source time, which would be confusing to debug. The sturdier idiom is to guard it in the script itself:

   if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then main "$@"; fi

   Then the test can source the script unmodified. Your call whether that is worth the churn in this PR or a follow-up.

Approving.