bug: define and enforce attributes for caller-owned output variables #509

Goal

define and enforce attributes for caller-owned output variables.

Background and verified evidence

Review date: 2026-09-17. Reviewed commit: 38042cbf23b9380c626aae6c9fe168f97096c1cc. Parent: #214.

The shared __base_bash_libs_std_assert_writable_output__ only checks the named variable for readonly. base_app_config_get copying string hello into declare -i output=42 returns 0 and publishes 0; copying AbC into declare -u output returns 0 and publishes ABC. A nameref to a readonly destination passes preflight and returns raw Bash failure status 1 instead of the documented usage status 2. Equivalent output paths use printf -v/eval across std, str, list, arg, cli, app, git, and gh. Ordinary untyped outputs and useful numeric-result outputs must remain supported.

Scope and acceptance criteria

• Document supported scalar, array, integer, case-conversion and nameref output contracts.
• Reject incompatible destinations before side effects or publication; do not silently change arbitrary string data.
• Resolve or explicitly reject namerefs safely, including readonly targets, cycles and reserved internal targets on Bash versions supporting them.
• Generalize the output-contract test matrix across public named-output APIs while preserving Bash 4.2 support.

Validation

Use harmless strings and typed/readonly destination fixtures; assert exact status, value preservation and no side effects. Run affected module BATS and all strict-option combinations.

Non-goals

No unrelated API expansion or automatic release publication. Preserve immutable published assets and unrelated consumer files.

Project fields

• Status: Ready
• Priority: P2
• Area: Runtime
• Initiative: Adoption Polish
• Size: M
• Milestone: v2.2.0
• Target date: unset; no delivery date has been committed.
• Type: Bug

Agent assignment

Assignee: codeforester. This is review/backlog intake; implementation has not started.