docs(roadmap): add diff commit argument hang

ROADMAP.md

@@ -6625,3 +6625,5 @@ Original filing (2026-04-18): the session emitted `SessionStart hook (completed)
 534. **`bootstrap-plan` and `acp` unknown/extra arguments zero-byte hang, so setup/editor-integration diagnostics still fall through to runtime instead of enforcing their tiny command grammars** — dogfooded 2026-05-21 from the `#clawcode-building-in-public` 09:00 UTC nudge on `/home/bellman/Workspace/claw-code-pr2967` with branch/origin `docs/roadmap-workdir-provenance@d2a4b7b` and binary `./rust/target/debug/claw` built from source SHA `25d663d`. Clean-home probes from a minimal temp workspace: `claw bootstrap-plan bogus`, `claw bootstrap-plan bogus --output-format json`, and `claw bootstrap-plan --output-format json bogus` each timed out after 6s with `stdout=0`/`stderr=0`; the sweep then reached `claw acp bogus`, which also entered the same zero-output wait before the run was killed. `bootstrap-plan` should be a bounded setup/planning helper, and `acp [serve]` is documented as an editor-integration status/server surface with a closed action set. Unknown positionals or misplaced JSON selectors should never start prompt/runtime machinery. **Required fix shape:** (a) make `bootstrap-plan` strict about accepted args/flags and reject extras with `kind:"unexpected_argument"`; (b) make `acp` accept only the documented empty/status form and `serve`, with typed `kind:"unsupported_action"` for anything else; (c) support or explicitly reject `--output-format json` placements without hanging; (d) add elapsed-time regressions for the four probes above plus `acp serve`/bare `bootstrap-plan` controls; (e) include these in the shared no-fallthrough parser audit covering #529-#533. **Why this matters:** setup and editor integration commands are often called by installers, editors, and wrappers. A typo in those integration paths should return a clear command error, not look like editor server startup, prompt delivery, or bootstrap planning has deadlocked. Source: gaebal-gajae dogfood response to Clawhip message `1506944672889831516` on 2026-05-21.
 
 535. **`help` unknown/extra arguments zero-byte hang, so the command meant to explain CLI usage is itself not parse-safe when users ask for a bad topic or misplace JSON flags** — dogfooded 2026-05-21 from the `#clawcode-building-in-public` 09:30 UTC nudge on `/home/bellman/Workspace/claw-code-pr2967` with branch/origin `docs/roadmap-workdir-provenance@c8e2ae4` and binary `./rust/target/debug/claw` built from source SHA `25d663d`. Clean-home probes from a minimal temp workspace: `claw help bogus`, `claw help bogus --output-format json`, and `claw help --output-format json bogus` each timed out after 6s with `stdout=0`/`stderr=0`; the sweep then reached `claw acp bogus --output-format json`, which also entered the same wait before the run was killed. #534 already captured bare `acp bogus`; this entry isolates the help surface. `help` should either print top-level usage, show a known topic, or return a bounded `unknown_help_topic` / `unexpected_argument` diagnostic. It must never fall through to prompt/runtime startup because a user asked for an invalid help topic. **Required fix shape:** (a) give `help` a strict topic parser with known topics/aliases and a bounded unknown-topic error; (b) if JSON help output is unsupported, reject `--output-format json` with `kind:"unsupported_flag_for_command"` rather than hanging; (c) include `topic`, `supported_topics`, and examples in the diagnostic; (d) add elapsed-time regressions for `help bogus`, `help bogus --output-format json`, `help --output-format json bogus`, valid `help`, and valid `--help`; (e) fold `help` into the global no-fallthrough audit so usage-discovery paths remain safe even when malformed. **Why this matters:** help is the recovery path after a parse error. If malformed help requests hang silently, users lose the most basic self-service diagnostic and wrappers cannot safely probe supported command topics. Source: gaebal-gajae dogfood response to Clawhip message `1506952218346127553` on 2026-05-21.
+
+536. **`diff` and `commit` malformed arguments zero-byte hang, so core git/tooling surfaces fall through to runtime instead of rejecting stray tokens before touching workspace state** — dogfooded 2026-05-21 from the `#clawcode-building-in-public` 10:00 UTC nudge on `/home/bellman/Workspace/claw-code-pr2967` with branch/origin `docs/roadmap-workdir-provenance@03fefd2` and binary `./rust/target/debug/claw` built from source SHA `25d663d`. Clean-home probes from a minimal temp workspace: `claw diff bogus`, `claw diff bogus --output-format json`, and `claw diff --output-format json bogus` each timed out after 6s with `stdout=0`/`stderr=0`; the sweep then reached `claw commit bogus`, which also entered the same zero-output wait before the run was killed. `diff` should be a bounded local git inspection command and `commit` should have a documented commit-message/context grammar or reject unexpected args. Neither should silently route malformed invocations into prompt/runtime wait. **Required fix shape:** (a) make `diff` strict about accepted flags/positionals and reject extras with `kind:"unexpected_argument"`; (b) make `commit` either document/parse a single optional context/message argument or reject stray positionals before runtime startup; (c) support `--output-format json` consistently in valid positions and reject malformed placements with a bounded JSON/text parse error; (d) add elapsed-time regressions for the four probes above plus `commit bogus --output-format json`, `pr bogus`, and `issue bogus` if those share the same tool-command parser; (e) fold these git/tool commands into the global no-fallthrough parser audit. **Why this matters:** diff/commit are the coding loop's safety rails. A malformed diff command should not look like a stuck git process, and a malformed commit command should not start opaque model/session work before proving the CLI syntax is valid. Source: gaebal-gajae dogfood response to Clawhip message `1506959769838026895` on 2026-05-21.