@chrono-meta/fh-gate 1.4.58 → 1.4.60

package/knowledge/shared/harness-core/claude_md_gate_details.md

@@ -103,9 +103,79 @@ pass/block verdict* — e.g. `agent-composer`, `goal-quench`, `asset-placement-g
 
 ---
 
+## §Cross-Family-Complement
+
+Execution detail for CLAUDE.md §FH Improvement 4-Axis Auto-Gate → *Cross-family complement*. The rule
+that a load-bearing change recruits ≥1 different-family auditor, that it is autonomous once consented,
+and that the governor keeps the terminal verdict + source-grounds every finding — all stay in CLAUDE.md.
+
+**Sidecar mapping (per the UAP)** — pick by task class, not by preference:
+
+| Task class | Recruit | Why |
+|---|---|---|
+| Repo-grounded code / security audit | `codex` (`gpt-5.5`, xhigh) | reads the actual tree; strongest on verdict-code logic |
+| Breadth / multimodal / frontier scan | `agy` (Gemini) | wide recall, video + image ingest |
+| Batch / free-tier arm | local 4090 over Tailscale | no token cost; weaker judge — anchor it |
+
+**Degrade**: when no different-family auditor is reachable, say so and fall back to single-session — but
+note the exception in §Field-Harness Load-Bearing Change Gate, where an unreachable cross-family panel is
+**NOT-CONVERGED** rather than a silent same-family pass (that surface is pre-merge and irreversible-adjacent).
+
+**Dogfood evidence (2026-06-27)**: a cross-family pass caught a HIGH execution-side-effect blind spot that
+the same-family reviewers **and** the target-tier sim all shared. That is the decorrelation value made
+concrete: the miss was not a depth failure (the sim ran at the right tier) but a *correlation* failure —
+every reviewer in the Claude family read the change the same optimistic way. Decorrelation is the only
+lever that moves a correlated blind spot; more same-family review does not.
+
+---
+
+## §Destructive-Op-Hook-Coverage
+
+Execution detail for CLAUDE.md §Destructive-Op Gate. The **order invariant** (enumerate → recover →
+destroy), the **3 steps**, the `DESTRUCTIVE_OP_OK=1` override, and the **fail-closed degrade direction**
+stay in CLAUDE.md — they are load-bearing every session. What follows is the mechanics + honest scope.
+
+**Per-ref verdict (pre-push hook)**: the hook detects the destructive refspec on stdin — *delete* = local
+SHA all-zeros; *force* = remote SHA not an ancestor of local — then judges each ref:
+
+| Ref state | Verdict | Hook action |
+|---|---|---|
+| Branch delete, fully merged | SAFE | allowed |
+| Branch delete, commits off base + 0 unique paths | CHECK | **blocked** — needs a judged content look |
+| Branch delete, unique paths present | REVIEW | **blocked** — recovery mandatory |
+| Force / non-ff push | — | **always blocked** |
+| Tag / notes delete | — | **always blocked** |
+
+The verdict is load-bearing, not decorative: a merged-branch cleanup passes, a silent-loss CHECK does not.
+This is the enumerate step as a mechanical floor rather than prose.
+
+**What it does and does NOT close (honest)**: it closes the **honest-weak-model** gap — an agent that
+simply *forgot* the prose gate is now mechanically stopped. It does **not** close the
+**injected/adversarial** gap: an agent under instruction can set the override or pass `--no-verify`, and a
+client-side hook is readable and bypassable by design. The hard floor for the adversarial case is
+**server-side branch protection** (GitHub *Restrict deletions* / *Restrict force pushes*) — this hook is
+the honest-model floor, branch protection is the hard floor.
+
+**Scope**: covers only git pushes *from a hook-installed repo*. `npm publish` is mechanized separately via
+`prepublishOnly` (see §Pre-Publish-Hook-Coverage (c)); the remaining non-git surface — a separate-repo
+`gh repo create --public` / visibility flip — is genuinely un-hookable and stays prose +
+`PRE-PUBLISH-CHECKLIST.md`.
+
+**Portability defect class**: the hook is bash-3.2 safe (macOS default `/bin/bash`). The original draft
+used a bash-4 associative array that crashed **fail-OPEN** on 3.2 — caught in test. Worth naming: a
+portability break in a gate degrades toward permissive unless the gate is written to fail closed on its
+own errors.
+
+**Origin (2026-06-10 branch cleanup)**: pre-deletion enumeration recovered a parallel session's card
+(weekly-audit completion + #88 merge state) that existed **only on an unmerged branch** with zero unique
+paths — exactly the CHECK class, and invisible to "is it merged?" intuition. Deletion without the gate
+destroys live state without anyone noticing. This is why the loss class is called *silent*.
+
+---
+
 ## §Pre-Publish-Hook-Coverage
 
-**Hook coverage — two distinct actions (refined 2026-06-17)**:
+**Hook coverage — three distinct actions** (refined 2026-06-17 for (a)/(b); (c) added 2026-06-27):
 - **(a) repo-go-public** (`gh repo create --public` / a visibility flip) is irreversible and usually in a
   **separate repo** — the FH pre-commit hook **cannot** catch it. That stays **AI-behavioral** (proactive
   trigger) **+ a portable checklist** (`templates/PRE-PUBLISH-CHECKLIST.md`), run on any repo/machine.
@@ -126,6 +196,23 @@ pass/block verdict* — e.g. `agent-composer`, `goal-quench`, `asset-placement-g
   plaintext only (encoded tokens out of scope); a line-split backstop catches a token wrapped across
   lines; `PUBLIC_SURFACE_OK=1` overrides and is logged to a gitignored audit trail for the weekly audit.
   Residuals (split-encoding, override-not-populated, override abuse) are documented, not silent.
+- **(c) `npm publish`** — mechanically gated by `scripts/public_surface_scan_files.sh`, wired into
+  `prepublishOnly` (`npm run release` also runs it *outside* the lifecycle). Unlike (b) it scans the
+  **full content of the exact npm-published file set** (`npm pack --dry-run`), *not* a commit diff — so a
+  token committed **before the scan existed**, or carried in a `files[]` entry, is still caught at the
+  registry boundary. HIGH/MED block; `PUBLIC_SURFACE_OK=1` overrides + logs. **Fail-closed** when patterns
+  or the file set are unresolved, when the parse looks partial, **or when the gitignored operator override
+  is absent** — defaults-only would otherwise green-PASS a HIGH company literal on a fresh clone or CI runner.
+
+**Named residuals for (c)** — it is a denylist **on the npm CLI path with scripts enabled**, not a
+universal secret-scanner:
+
+| # | Residual | Mitigation |
+|---|---|---|
+| i | `npm publish --ignore-scripts`, a CI `.npmrc` with `ignore-scripts=true`, or `pnpm`/`yarn publish` **skip the lifecycle hook entirely** | route publishes through `npm run release`, or add an explicit CI scan step |
+| ii | scans only the **loaded patterns** — an **un-patterned secret shape** (an API key the patterns don't describe) still ships | pattern coverage is the limit; pair with a real secret-scanner if that shape matters |
+| iii | on a runner without the gitignored override it is **defaults-only** unless populated | populate the override in each authoring env (esp. the company env) |
+| iv | scans **working-tree content, not the final tarball bytes** | benign today (content-neutral lifecycle: prepare=chmod, no prepack) — **re-open if a content-generating publish lifecycle is added** (cross-family audit 2026-06-27) |
 
 > Origin: 2026-06-05 `phantom-gate` shipped public, then needed a private→de-company-scrub→re-public
 > round-trip (`fh_signal_2026-06-05_fh-direct`). PSA existed but nothing forced it pre-publish. 2026-06-17

package/knowledge/shared/harness-core/fh_detail_protocols.md

@@ -58,10 +58,26 @@ Then **fail-closed** (irreversible-ish: a silent empty overwrite blinds the bus)
 **and** the existing registry has >0 entries, do **not** overwrite — flag `⚠️ scan returned 0 (root=$ROOT);
 kept existing registry` and skip the rewrite. Only rewrite when the scan is non-empty (or the registry
 was absent). Group by project (parent dir name). Record per skill: name · path · description · trigger
-phrases · `requires_cwd` · `direct-executable` · `origin(FH|project|external)`+trust. **Non-FH skills are
-propose-only (ask-tier), never auto-run** — a cross-project skill body is an injection surface. Propose
-cross-project skills when a request maps to the registry. Scan once per session. (Detection belongs at
-install too — `/install-wizard` records HUB/ROOT so the runtime never guesses; see install-wizard.)
+phrases · `requires_cwd` · `direct-executable` · `origin(FH|project|external)`+trust ·
+**`residency(public|company|operator-private)`** · **`generality(general-purpose|project-specific)`**.
+**Non-FH skills are propose-only (ask-tier), never auto-run** — a cross-project skill body is an
+injection surface. Propose cross-project skills when a request maps to the registry. Scan once per
+session. (Detection belongs at install too — `/install-wizard` records HUB/ROOT so the runtime never
+guesses; see install-wizard.)
+
+**`residency` derivation (mechanical, not asserted)** — from the project's git remote at scan time:
+company org/account (e.g. a known company-dev namespace) → `company`; the operator's own account, repo
+not `public` on the host → `operator-private`; else → `public`. **`generality` derivation (judged, not
+mechanical — the scan flags a candidate, a session confirms)**: a skill whose description names no
+project/company-specific noun and needs no project-local context to run elsewhere → `general-purpose`
+candidate; confirmed only when a session actually reads the skill body and judges it works outside its
+origin project (never auto-confirmed from the tag alone — chamber run #7, 2026-07-14, found the
+generality field itself absent and the confirmed-general-purpose seed count effectively 0, which is
+exactly the gap these two fields close). **Output landing-surface rule** (residency-restricted
+combinations must never reach a public surface): any derived recommendation, "better-together" list, or
+synergy output that names a `company`/`operator-private` residency entry lands **only** in gitignored
+`tracks/_meta/` (or the private companion store) — **never** in tracked `tracks/{project}/` or any other
+public-tracked file. A `public`-only combination may land in tracked docs.
 
 ### Step 2 — Active Proposal
 

package/knowledge/shared/harness-core/harness_incubator_doctrine.md

@@ -99,19 +99,38 @@ this chamber's field emit terminus); an **FH-internal utility** (a skill/script/
 field harness) instead routes through the **New-Skill Pre-Commit gate + `asset-placement-gate`** (the
 same gate every FH asset passes). KILL emits nothing — the workspace stays as the evidence record.
 
-**EMIT-worthiness — the measured screening criterion (run #5, 2026-07-14)**: five chamber runs, EMIT 0/5,
-all KILL. Run #5 (`degrade-lint`) measured *why* the chamber has not birthed, and the finding is a reusable
-screen: a candidate is emit-worthy only if it clears **all three** of — (1) **net-new** (not a reinvention
-of an existing FH/official asset, nor a cosmetic re-wrap of code that already ships — runs #2–#4 died here);
+**EMIT-worthiness — the measured screening criterion (runs #5–#6, 2026-07-14)**: six chamber runs, EMIT
+0/6, all KILL. A candidate is emit-worthy only if it clears **all four** of — (1) **net-new** (not a
+reinvention of an existing FH/official asset, nor a cosmetic re-wrap of code that already ships — runs
+#2–#4 died here, and run #6 partially here too — its core was already conceived in a parked FH signal);
 (2) **artifact-shaped** (a tool/script/rule that stands alone, *not* a judgment-method — run #5's genuine
 niche was real, but its value lived in a scan∪cross-family *lens*, i.e. an LLM judgment, which cannot be
-`npm publish`ed); (3) **real-code-precision-adequate** (its mechanical form, measured on real external code,
-does not cry-wolf — run #5's rule scored 5/5 false-positive on 111 real files because the fail-open shape is
-syntactically identical to ubiquitous-benign skip-if-empty code; the real/benign split is semantic, not
-grep-able). 0/5 candidates cleared all three. This is not "keep trying" — it is a **pre-screen for future
-candidates**: a KILL that fails (1) or (2) is cheap to predict; only (3) needs a measurement leg (semgrep
-baseline + real-repo FP run), which run #5 established as the decisive test. The chamber's honest value to
-date remains *screening* — preventing reinventions and low-precision births — not yet *birthing*.
+`npm publish`ed); (3) **real-code/real-data-precision-adequate** (its mechanical form, measured on real
+external inputs, does not cry-wolf — run #5's rule scored 5/5 false-positive on 111 real files; run #6's
+heuristic scored 14/22 false-fire on a real sibling-folder scan); (4) **hub-state-independent** (run #6,
+new axis — a capability whose value structurally depends on hub-held state, e.g. the curated registry +
+company-residency knowledge, is not a standalone-first candidate: run #6's `harness-orchestrator` hit
+private/company repos it structurally could not know to suppress, because residency knowledge lives only
+in the hub. Contrast with fh-commons's 4 skills, which graduated cleanly to portable precisely because they
+never depended on hub state). 0/6 candidates cleared all four. This is not "keep trying" — it is a
+**pre-screen for future candidates**, cheapest-to-costliest: (1)/(2)/(4) are cheap to predict from the
+candidate's own design (does it need hub-only knowledge to work correctly?); only (3) needs a measurement
+leg (a real-input precision run), which runs #5–#6 established as the decisive test. The chamber's honest
+value to date remains *screening* — preventing reinventions, low-precision births, and premature
+standalone graduations — not yet *birthing*. **Graduation order** (run #6's positive finding): a
+hub-state-dependent capability graduates hub-internal → proven in use → THEN extracted portable, never
+speculated standalone-first — the only path every successfully-portable FH asset actually took.
+
+**Chamber scope — what belongs in the chamber at all (run #7, 2026-07-14)**: run #7 tested a hub-internal
+reactivation of the cluster-wizard signal and KILLed it — decisively on its own merits (its "narrow
+net-new" claim collapsed against the real shipped registry and an already-existing synergy skill), but
+it also surfaced a scope question worth keeping regardless: **a small feature graft onto an
+already-shipped hub-internal mechanism is ordinary Mode D self-development under the 4-axis gate, not
+automatically a chamber-EMIT question.** The chamber screens candidates that would become a **new
+independent artifact** (a skill, a plugin, a standalone tool) — not every internal feature extension.
+Route by this test: *would this, if built, be net-new as a standalone thing someone installs/adopts, or
+is it two lines added to something already shipped?* The former is chamber-scope; the latter is ordinary
+self-dev review.
 
 *Vocabulary reservation (term hygiene, not standardization)*: a run of this skeleton is a **chamber
 run** — going forward, run/workspace/log labels use "chamber" for incubation and keep "sim/simulation"

package/knowledge/shared/harness-core/ship_readiness_gate.md

@@ -109,20 +109,26 @@ decision is logged here and the tag's notes state the real status.
 | ③ | 거버넌스 게이트 (governance) | 🟢 GREEN | pre-commit/pre-push physically block; moat measured 3–4 family blind (HITL 8/8 ABSENT); cross-family caught a real companion-store-name leak 2026-07-14 (fail-closed) |
 | ⑤ | 증폭자 (amplifier) | 🟢 GREEN | short-intent→literature-grounding→ultimate-doc real instances; rules-diet −18.2k measured; intent-routing probe 94% (below) |
 | ④ | 프런티어→조직 전파 | 🟡 YELLOW | frontier-digest launchd auto + AX submission docs both real, but digest→org never closed as ONE pipeline |
-| ① | 멀티하네스 클러스터 (연속경유) | 🔴 RED | mapping/routing materials work, but continuous relay channel + external-harness recommend are "not built yet" (source-admitted); cluster-wizard parked |
-| ② | 프로젝트 인큐베이터 (챔버 EMIT) | 🔴 RED | chamber ran **5×, EMIT 0× (5 KILL)**. run #5 (2026-07-14) *measured* why it hasn't birthed: all 5 candidates were either **reinventions** (#2 sim-conductor, #3 G4/resume, #4 steel-quench) or a **non-artifact judgment-method** (#5 degrade-lint — a genuine niche, but the mechanical rule scored **5/5 false-positive on 111 real qasp files**; the valuable capability is scan∪cross-family *judgment*, which cannot be shipped as a standalone tool). A real EMIT needs **net-new ∧ artifact-shaped ∧ real-code-precision-adequate** — 0/5 cleared all three. Runner wired; the gap is a candidate, not the pipe |
+| ① | 멀티하네스 클러스터 | 🟡 PARTIAL | routing runs for real — 17 nodes mapped, sidecar-orchestrator, Skill Bus routing qasp/dashboard/stockbattle (so NOT 🔴 ideal-only). Missing: continuous 2-node relay channel + external-harness recommend (cluster-wizard parked) → 🟡 not 🟢 |
+| ② | 프로젝트 인큐베이터 | 🟡 PARTIAL | incubation is running — **stockbattle is being incubated now** (S1 built, mid-flight) + qasp/pmh spin-out precedent + scaffold-emit shipped (doctrine: "emit shipped today as scaffold+approval; the chamber flow is the named target"). What's still 0 is the **formal chamber simulate-then-emit** mechanism (6 runs, 6 KILL — runs #5–#6 *measured* the emit-worthiness criterion: net-new ∧ artifact-shaped ∧ real-data-precision-adequate ∧ hub-state-independent, 0/6 cleared all four; run #6 also confirmed the graduation-order principle — hub-internal proof before standalone extraction, never the reverse). That mechanism is ONE path of ②, not the whole identity → 🔴 was too narrow; incubation runs but no closed emit-via-incubation yet → 🟡 |
 
 **Cross-cutting measured (intent-based autonomous completion)**: blind floor-tier Sonnet trigger-accuracy
 probe (n=10, 2026-07-14): **should-fire 7.5/8 (94%), false-fire 0/2**. One weak trigger (simulate-first /
 incubator entry absorbed into deep-clarify) — the identity-② weakness surfaces in routing too.
 
-**Verdict (2026-07-14)**: FH is tagged **`v0.1.0` = honest baseline**, not all-green. ③⑤ are 🟢, ④ 🟡,
-①② 🔴 — the `v0.1.0` notes state exactly this and make no all-green claim (per the refined 0.x↔1.0 mapping
-above). **`v1.0.0` remains the all-green target.** What blocks v1.0 is **real runs, not wiring**: ①'s live
-2-node orchestration, ②'s first *net-new ∧ artifact-shaped ∧ precision-adequate* chamber candidate (the
-measured criterion from run #5), ④'s closed digest→org pipeline. Each remedy is a run that leaves an
-artifact, tracked in `tracks/_meta/identity_audit_*.md`. The honest baseline is publishable *because* 0.x
-carries an incomplete status by design; forcing a green it hasn't earned would be the theater the gate bars.
+**Verdict (2026-07-14, ①② corrected)**: FH is tagged **`v0.1.0` = honest baseline**, not all-green. ③⑤ are
+🟢, ①②④ 🟡, **none 🔴** — the `v0.1.0` notes state this and make no all-green claim (per the refined 0.x↔1.0
+mapping above). **`v1.0.0` remains the all-green target.** What blocks v1.0 is **closing the 🟡s**: ①'s
+continuous 2-node relay channel, ②'s first closed emit-via-incubation (formal chamber first EMIT — criterion
+measured in run #5 — or a chamber-incubated spin-out closing), ④'s closed digest→org pipeline. Each remedy
+is a run that leaves an artifact, tracked in `tracks/_meta/identity_audit_*.md`.
+
+> **①② correction (2026-07-14)**: an earlier pass marked ①② 🔴 by collapsing each identity onto its most
+> advanced *single mechanism* — ② onto the formal chamber EMIT (0/5), ① onto the continuous-relay channel.
+> That contradicts the doctrine (emit is "shipped today as scaffold+approval; the chamber is the named
+> target") and the live reality (routing runs; **stockbattle is being incubated now**; qasp/pmh spun out).
+> An identity whose broad path *runs* is not 🔴 ideal-only. Both are 🟡: running, not yet closed. Lesson:
+> do not score an identity by its hardest sub-mechanism — that reads a live-but-incomplete path as zero.
 
 ## For a field harness (e.g. pmh, qasp)
 Same gate, its own identities. A field harness ships to its team when its identity checklist is all-green,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.58",
+  "version": "1.4.60",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -63,6 +63,7 @@
     "scripts/fh-goal.sh",
     "scripts/count_check.sh",
     "scripts/selfcheck.sh",
+    "scripts/test_fh_gate_regressions.sh",
     "templates/local_fh_context.md",
     "plugins/fh-meta/.claude-plugin/plugin.json",
     "plugins/fh-meta/skills",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.58",
+  "version": "1.4.60",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.58",
+  "version": "1.4.60",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/skills/harness-doctor/SKILL.md

@@ -70,29 +70,128 @@ confirms the gap*, never a verdict the report emits on its own; surface each gap
 
 ### Step 3. L2 — Complexity Diagnosis
 
+**Scope the instrument first — field vs meta** (CLAUDE.md §Identity Core Axis): a **field harness** must get
+"simpler over time" (complexity = warning signal), so raw size is a real signal there. A **meta-harness**
+(the FH hub itself) *optimizes* rather than simplifies — **complexity earns its scope**, and the doctrine's
+red flags are **orphaned, redundant, and decorative units, not size**. Applying the field rule to a
+meta-harness produces a false M-tier on healthy growth.
+
+**Scope is mechanical, never self-declared** — else any repo dodges the line rows by calling itself meta
+(the self-label loophole CLAUDE.md already names for "docs-only" at the Irreversibility gate). A target is
+**meta** iff its root holds **all three**: `tracks/` **and** `knowledge/` **and** `plugins/` (Step 1's FH-environment
+test). Anything else is **field** — including a repo that merely *contains* skills or a `.claude/` dir:
+
+**The test is rooted at the TARGET, never at cwd.** FH's own default mode diagnoses a field project
+*without* switching cwd (CLAUDE.md §Agent Dispatch — "Direct edit … no cwd switch needed"), so a bare
+`[ -d tracks ]` run from the hub misclassifies **every** field target as meta and silently deletes the
+field rows — a permissive misread reachable through the harness's own recommended workflow. Always pass
+the target path explicitly:
+
+```bash
+# meta iff all three exist AT THE TARGET ROOT — otherwise field. TARGET is required, never implied by cwd.
+TARGET="${1:?pass the target root explicitly — cwd is not the target}"
+[ -d "$TARGET/tracks" ] && [ -d "$TARGET/knowledge" ] && [ -d "$TARGET/plugins" ] \
+  && echo "scope: meta ($TARGET)" || echo "scope: field ($TARGET)"
+```
+
+Scope is a **coarse instrument-selector, not a security boundary**: `[ -d ]` tests existence, not contents,
+so three empty dirs would flip field→meta. That is acceptable here (the operator names the target; there is
+no adversary picking it) — but it means scope must never gate anything that matters on its own, only *which
+size instrument* is read. The footprint rows below apply to **both** scopes and are the actual verdict.
+
 | Check | Verdict |
 |---|---|
-| CLAUDE.md ~100 lines | Normal (project) / FH threshold: 500 lines |
-| CLAUDE.md 100~200 lines | S-tier warning |
-| CLAUDE.md 200+ lines | M-tier — separation or reduction needed |
-| 15+ `##` sections in CLAUDE.md | S-tier warning |
+| **Field/project** CLAUDE.md 100~200 lines | S-tier warning |
+| **Field/project** CLAUDE.md 200+ lines | M-tier — separation or reduction needed |
+| **Field/project** 15+ `##` sections in CLAUDE.md | S-tier warning |
+| **Meta-harness (FH hub)** CLAUDE.md — raw line / section count | **Not a verdict.** Judge by the always-loaded footprint rows below (char-based = actual token cost) + the doctrine's red flags (orphaned · redundant · decorative). Report the count as context only |
+| **Meta-harness** growth since last run: decompose into *new sections* vs *existing-section growth* (mechanical — diff `##` section names + line counts vs the prior run's commit; **first run / no prior commit → report both as n/a, no tier**) | **Tier is decided by the two counts alone**: **S-tier iff existing-section growth > new-section growth** (the file is thickening faster than it is gaining capability); otherwise advisory, no tier. Report both numbers **and** the new sections' names — the names are *reporting output for the human*, never an input to the tier. Do not judge "was this growth capability-bearing?" per line |
 | SKILL.md > 300 lines AND no `SKILL_detail.md` | S-tier — propose `/salience-splitter` (governance-semantic split, not compression) |
 | Rules files unreferenced in CLAUDE.md | R-tier |
-| Always-loaded footprint (CLAUDE.md + every `.claude/rules/*.md` lacking `paths:` frontmatter) > 40k chars | S-tier — relocate detail rules to a non-loaded dir (e.g. `knowledge/shared/rules/`), pointers stay in CLAUDE.md |
-| Always-loaded footprint > 80k chars | M-tier — same prescription, mandatory |
+| Always-loaded footprint > 40k chars (see scan below for what counts) | S-tier — **lever depends on where the chars live**: rules/detail still auto-loading → relocate to a non-loaded dir (e.g. `knowledge/shared/rules/`), pointers stay in CLAUDE.md · narrative inside CLAUDE.md → `/salience-splitter` · **behavioral content only, nothing left to relocate** → capability-level (merge/retire a governance unit) |
+| Always-loaded footprint > 80k chars | M-tier — same lever selection, mandatory, **and never self-discharged** (see below) |
 | **Pointer-illusion**: a CLAUDE.md "detail/detailed procedure" pointer whose target is itself an always-loaded `.claude/rules/*.md` | S-tier — the split saves zero context (rules/ auto-loads regardless); move the target out of auto-load, keep the pointer |
 | weekly_audit 14~30 days elapsed | S-tier |
 | weekly_audit 30+ days elapsed | M-tier |
 
+**Per-unit ≠ aggregate — do not slide between them.** "Every section earns its scope" (the per-unit
+doctrine test) and "the always-loaded total is affordable" (the budget test) are **different questions, and
+both can be true at once**. A meta-harness can pass the red-flag test on every single section and still be
+over its footprint budget. So a per-unit PASS never discharges the footprint rows — and conversely, a
+footprint M-tier is *not* evidence that some section failed to earn its scope. When footprint is over
+budget but every unit earns its scope, the remaining lever is **capability-level** — merge or retire a
+governance unit — **not** a salience split, which by construction only moves narrative and returns ~nothing
+when the content is behavioral.
+
+**No M-tier in this skill is ever self-discharged — not just the footprint one.** "The cost is priced /
+accepted", "it's all necessary", "over budget but fine" are **not** verdicts this skill may reach on its
+own: an M-tier stands in the report and is closed only by an explicit operator acknowledgment logged to
+`tracks/_meta/` (same shape as any other logged override). This is **row-agnostic on purpose** — the
+rationale (a run under ship pressure prices away the one row that fired) is not specific to footprint, so
+scoping the prohibition to a single row would leave every other M-tier open to the same silent PASS. That
+is the default-toward-PASS class `field_verdict_crossfamily_gate.md` exists to catch, committed inside the
+diagnostic that names it. **Report it; do not price it.**
+
+> Origin (2026-07-15, dogfood): a run read FH's CLAUDE.md at 891 lines, fired the raw-count M-tier, and
+> prescribed `/salience-splitter`. Measurement inverted both halves: **+244 of the +381 30-day growth (64%)
+> was 6 new governance sections**, each behavioral and salience-passing (two — Voice/Tone, Envelope-Boundary —
+> had been *promoted* to always-loaded precisely because memory-only placement made them miss), and actually
+> running the splitter on 4 sections yielded **−27 lines / −3.2k chars (−3.7%)** — confirming salience-splitter's
+> own Target Selection rule ("splitting a file with only behavioral content adds structure without governance
+> value"). The **footprint** row meanwhile fired M-tier correctly and had been M since 06-15. Two rows measured
+> the same property; the worse instrument drove the verdict. The line-count rows are now field-scoped.
+
 Always-loaded + pointer-illusion checks are mechanical (found 2026-07-12 — FH itself shipped ~50k chars of rules/ behind "detail pointers" that saved nothing; the meta-harness blind spot this row closes):
 
 ```bash
-# always-loaded footprint (chars): CLAUDE.md + rules files with no paths: frontmatter
-T=$(wc -c < CLAUDE.md 2>/dev/null); for f in .claude/rules/*.md; do [ -f "$f" ] || continue; head -5 "$f" | grep -q '^paths:' || T=$((T + $(wc -c < "$f"))); done; echo "always-loaded: $T chars"
-# pointer-illusion: CLAUDE.md pointers targeting still-auto-loaded rules files
-grep -oE '\.claude/rules/[a-z_]+\.md' CLAUDE.md | sort -u | while read p; do [ -f "$p" ] && echo "ILLUSION: $p (pointed-to AND always-loaded)"; done
+# always-loaded footprint (chars). Counts every file the session loads before turn 1:
+#   CLAUDE.md + CLAUDE.local.md + rules files lacking paths: frontmatter + their DIRECT @-imports.
+# EVERY path is rooted at $TARGET — the same root the scope test used. Reading from cwd instead
+# measures whichever harness you happen to be standing in (usually the hub, while diagnosing a
+# field target) — a wrong-target measurement that reports the hub's number as the target's.
+TARGET="${1:?pass the target root explicitly — cwd is not the target}"
+T=0
+for f in "$TARGET/CLAUDE.md" "$TARGET/CLAUDE.local.md"; do
+  [ -f "$f" ] && T=$((T + $(wc -c < "$f")))
+done
+# find | while, not a glob: an unmatched glob aborts under zsh, and a here-string of "" still yields
+# one empty line -> head -5 "" errors and the sum breaks. A scan that dies mid-run reports a LOW
+# number (= toward PASS), so guard the empty case explicitly.
+while IFS= read -r f; do
+  [ -n "$f" ] || continue
+  head -5 "$f" | grep -q '^paths:' || T=$((T + $(wc -c < "$f")))
+done < <(find "$TARGET/.claude/rules" -name '*.md' 2>/dev/null)
+# DIRECT @-imports only (not transitive — a nested import chain is a named residual below).
+# Resolve against the IMPORTING FILE's own dir first, then ~/.claude/. SUM into T — never
+# print-and-ask-the-reader-to-add: a scan that delegates arithmetic re-introduces the judgment
+# it exists to remove, and the omission points toward PASS.
+for f in "$TARGET/CLAUDE.md" "$TARGET/CLAUDE.local.md"; do
+  [ -f "$f" ] || continue
+  d=$(dirname "$f")
+  for i in $(grep -oE '^@[A-Za-z0-9_./-]+' "$f" 2>/dev/null | sed 's/^@//'); do
+    for c in "$d/$i" "$HOME/.claude/$i"; do
+      [ -f "$c" ] && { T=$((T + $(wc -c < "$c"))); echo "  +import $c: $(wc -c < "$c") chars"; break; }
+    done
+  done
+done
+echo "always-loaded TOTAL ($TARGET): $T chars"
+# Verdict: the HIGHEST tripped threshold wins — 80k supersedes 40k. Reporting only the
+# S-tier row while >80k is a silent FAIL->CONDITIONAL_PASS downgrade.
+[ "$T" -gt 80000 ] && echo "  => M-tier (>80k)" || { [ "$T" -gt 40000 ] && echo "  => S-tier (>40k)" || echo "  => footprint ok"; }
+# pointer-illusion: CLAUDE.md pointers targeting still-auto-loaded rules files (any filename shape)
+grep -oE '\.claude/rules/[A-Za-z0-9_./-]+\.md' "$TARGET/CLAUDE.md" 2>/dev/null | sort -u | while read -r p; do
+  [ -f "$TARGET/$p" ] && echo "ILLUSION: $p (pointed-to AND always-loaded)"
+done
 ```
 
+**Named residuals of this scan** (all documented, none silent): **transitive imports are not followed** —
+an import chain `CLAUDE.md → A.md → B.md` counts A but not B, so a deep chain under-counts *toward PASS*;
+**`head -5 … grep '^paths:'`** is a proxy, not a frontmatter parser — an incidental early `paths:` line
+falsely excludes an always-loaded rule (toward PASS), while a `paths:` below line 5 over-counts (toward
+FAIL, the safe direction); and the scope test reads directory *existence*, so three empty dirs flip
+field→meta (acceptable: the operator names the target, and the footprint rows apply to **both** scopes
+regardless — but it does skip the field-only line rows).
+
 ### Step 3-L. Language Lint (`--lint` mode only)
 
 > Activate with `/harness-doctor --lint` or when harvest-loop surfaces a P10-series signal. Skipped in standard runs.

package/scripts/count_check.sh

@@ -74,7 +74,14 @@ if [ "$meta_sk" -eq 0 ]; then
 fi
 
 count_check() { # count_check <label> <file> <expected-string>
-  if read_tree "$2" | grep -q "$3"; then
+  # Containment, not equality, was the bug: every expected string starts with a digit, so a
+  # stale "16 skills + 2 agents" CONTAINS "6 skills + 2 agents" and a plain `grep -q` reported
+  # PASS while the count had actually drifted. Guard the boundaries so a longer number cannot
+  # satisfy a shorter one, and escape the expected text (it carries `+` and `(` `)`, which are
+  # ERE metacharacters) so it is matched as the literal it is meant to be.
+  local esc
+  esc=$(printf '%s' "$3" | sed 's/[][\.*^$+?(){}|\\/]/\\&/g')
+  if read_tree "$2" | grep -qE "(^|[^0-9])${esc}([^0-9]|\$)"; then
     echo "PASS  count: $1"
   else
     echo "FAIL  count: $1 — expected \"$3\" in $2 (actual: fh-meta ${meta_sk}sk/${meta_ag}ag, fh-commons ${com_sk}sk/${com_ag}ag)"