@chrono-meta/fh-gate 1.4.72 → 1.4.73

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.72",
+  "version": "1.4.73",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,10 +1,10 @@
 {
   "name": "fh-meta",
-  "version": "1.4.72",
+  "version": "1.4.73",
   "engines": {
     "claudeCode": ">=1.0.0"
   },
-  "description": "Hub meta-engineering toolkit — 35 skills + 7 agents. New in 1.4.71: SKILL_detail.md brought inside the 4-axis gate — the gate matched the literal `SKILL.md`, which `SKILL_detail.md` does not contain, leaving 27.7% of the skill-spec surface ungated (measured; it leaked twice for real). Fix escalated from a name list to a directory scope after an enumeration sweep found a real uncovered file on its first run; anchored by scripts/gate_pathspec_check.sh (known-pair, wired into pre-commit). One-way mirror sync gains a destination-newer abort + mechanically injected mirror banner after two session cards were silently overwritten, anchored by scripts/sync_guard_check.sh. dialogue-harvest gains Step 4-b cross-corpus provenance (absorbed / held-unused / declined) for single-author corpora, where the original provenance labels were free and measured nothing. frontier-digest arxiv leg category-scoped after a relevance drift the staleness rule structurally could not catch (known-pair calibration recorded). templates/CLAUDE.md hub paths switched to {FH_ROOT} so a copied harness stops carrying one operator's absolute paths into org-visible checkouts. New in 1.4.70: dialogue-harvest (mines AI-dialogue logs — sycophancy strip first, induced-vs-independent provenance labeling, EN+KO known-pair calibration shipped); asset-placement-gate Step 0.6 official-corpora check (Claude Cookbook as Tier-0 consult corpus, judged-flag semantics); context-doctor built-in-/doctor-first sister anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor gains a command-output axis — routes to a command-output proxy/hook (rtk) to trim verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce environments (lossy filtering, off gate-input paths). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard scaffolds the companion store as a queryable wiki (INDEX + session-start read + Raw/Wiki/Conversation ingest axis). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment, calibration-gated) + video-ingest (capability-routed video ingestion). New in 1.4.37: corpus-grounding-expander + persona-roster-expander (field-harvested verbatim-relay capability skills). New in 1.3.0: public-surface-audit (git-tracked private-token leak scan), field-harvest Mode B session-end auto-trigger, 4-axis gate scope extension (docs/ + AGENTS.md). New in 1.2.0: pipeline-conductor (4-pipeline gated sweep), return-path-gate (chain closure audit), goal-quench (Stop hook + quality gate), steel-quench Wave 5 (multi-model sidecar challenger), 2-layer architecture docs, YAML validation script. Validated cross-CLI: Claude Code, Codex, Gemini.",
+  "description": "New in 1.4.73: the mechanical floor now ships — templates/.git-hooks (pre-commit/pre-push) plus every script they actually invoke, their regression anchors, and the .claude/rules data they read. Until now the package shipped the prose that tells you to run the gates while omitting the gates, and 35 shipped-doc references pointed at files the tarball did not contain. Verified by unpacking the tarball, installing the hooks in a scratch repo and committing through them, not by inspecting files[]. degrade_direction_scan gains shell probes: it collected .sh files that no probe could match and reported them clean (known-positive scored 0/4); git hooks were invisible entirely because the extension test ran against the path, not the basename. The field-propagated templates/ copy had drifted from scripts/ and is now byte-pinned by an anchor. Hub meta-engineering toolkit — 35 skills + 7 agents. New in 1.4.71: SKILL_detail.md brought inside the 4-axis gate — the gate matched the literal `SKILL.md`, which `SKILL_detail.md` does not contain, leaving 27.7% of the skill-spec surface ungated (measured; it leaked twice for real). Fix escalated from a name list to a directory scope after an enumeration sweep found a real uncovered file on its first run; anchored by scripts/gate_pathspec_check.sh (known-pair, wired into pre-commit). One-way mirror sync gains a destination-newer abort + mechanically injected mirror banner after two session cards were silently overwritten, anchored by scripts/sync_guard_check.sh. dialogue-harvest gains Step 4-b cross-corpus provenance (absorbed / held-unused / declined) for single-author corpora, where the original provenance labels were free and measured nothing. frontier-digest arxiv leg category-scoped after a relevance drift the staleness rule structurally could not catch (known-pair calibration recorded). templates/CLAUDE.md hub paths switched to {FH_ROOT} so a copied harness stops carrying one operator's absolute paths into org-visible checkouts. New in 1.4.70: dialogue-harvest (mines AI-dialogue logs — sycophancy strip first, induced-vs-independent provenance labeling, EN+KO known-pair calibration shipped); asset-placement-gate Step 0.6 official-corpora check (Claude Cookbook as Tier-0 consult corpus, judged-flag semantics); context-doctor built-in-/doctor-first sister anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor gains a command-output axis — routes to a command-output proxy/hook (rtk) to trim verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce environments (lossy filtering, off gate-input paths). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard scaffolds the companion store as a queryable wiki (INDEX + session-start read + Raw/Wiki/Conversation ingest axis). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment, calibration-gated) + video-ingest (capability-routed video ingestion). New in 1.4.37: corpus-grounding-expander + persona-roster-expander (field-harvested verbatim-relay capability skills). New in 1.3.0: public-surface-audit (git-tracked private-token leak scan), field-harvest Mode B session-end auto-trigger, 4-axis gate scope extension (docs/ + AGENTS.md). New in 1.2.0: pipeline-conductor (4-pipeline gated sweep), return-path-gate (chain closure audit), goal-quench (Stop hook + quality gate), steel-quench Wave 5 (multi-model sidecar challenger), 2-layer architecture docs, YAML validation script. Validated cross-CLI: Claude Code, Codex, Gemini.",
   "author": {
     "name": "chrono-meta",
     "email": "chrono-meta@users.noreply.github.com"

package/plugins/fh-meta/skills/context-doctor/SKILL.md

@@ -20,7 +20,7 @@ Diagnoses the main causes of session token waste and prescribes immediate remedi
 3. Not using `/clear` after direction changes → continuing work with accumulated noise
 4. Verbose CLI output → every `git`/`ls`/build/test call floods context with stdout (a *different* layer from 1–3 — see §Command-Output Reduction)
 
-**Two reduction axes — keep them distinct.** Causes 1–3 are the **context-footprint** axis (what gets read *into* context: files, history). Cause 4 is the **command-output** axis (tokens produced *by* the tools you run). `.claudeignore` cannot touch command output, and a command-output proxy cannot touch file reads — they are complementary, not substitutes.
+**Two reduction axes — keep them distinct.** Causes 1–3 are the **context-footprint** axis (what gets read *into* context: files, history). Cause 4 is the **command-output** axis (tokens produced *by* the tools you run). `.claudeignore` cannot touch command output, and a command-output proxy cannot touch file reads — they are complementary, not substitutes. (Step 3.5 below adds an optional **third**, orthogonal lever — provider-side cache billing — distinct from both.)
 
 **Standalone install** — this skill works normally with plugin install only, without cloning the full meta-harness.
 
@@ -111,6 +111,39 @@ When context is near the limit and you want to *preserve state* rather than rese
 
 > Models are tools for allocating the right expertise to complexity. Opus for simple tasks = wasted expertise; Haiku for design decisions = insufficient expertise. Switch models when task nature changes.
 
+### Step 3.5. Cache-Boundary Audit (prompt caching, optional third lever)
+
+Distinct from both axes above: Steps 1–3 reduce what occupies the context *window*; this
+reduces what the provider re-bills as **fresh input tokens** on each turn by preserving
+prompt-cache hits. **Optional** — run it when a metered/quota-limited backend makes cache
+cost the binding constraint (same gating logic as §Command-Output Reduction: diagnose and
+recommend, do not chase this when tokens are merely plentiful).
+
+**Audit checklist**:
+- Is the system prompt / CLAUDE.md content **stable byte-for-byte** across turns in a
+  session? Any turn-to-turn diff in the fixed prefix invalidates the cache for that prefix —
+  which is in tension with Step 5's CLAUDE.md-compression prescription: compress at session
+  boundaries (before a fresh cache is built), never mid-session (which would invalidate one
+  already warm).
+- Is session-specific / dynamic content (task state, recent results) placed at the
+  **end of the user message**, not interleaved into the system prompt or early context?
+
+**Reported, UNCALIBRATED by FH** (2026-07-27 frontier digest, issue #102): input:output token
+ratio **> 10:1** favors cache/context engineering over model-level optimization; **> 50:1**,
+prefix caching dominates; cache-boundary control reportedly raised hit rate ~7%→84% in one
+production case (arXiv:2603.09619 *Context Engineering: From Prompts to Corporate Multi-Agent
+Architecture* · appscale.blog).
+
+**What is and is not verified** — the two are separate checks and only one has been run:
+the cited paper's **existence** was confirmed 2026-07-28 (arxiv.org/abs/2603.09619 → HTTP 200,
+title matches; measured alongside a known-real control ID, so the check itself is calibrated).
+The **figures** above were not read out of the paper — they are still traced only to the digest
+comment. Treat the ratio thresholds as illustrative, not a calibrated gate, until the source
+text is read directly.
+
+> **Detail**: See `SKILL_detail.md §CacheBoundary` — full citation text and the 403 grounding
+> note — read before citing these figures elsewhere.
+
 ### Step 4. harvest-loop Integration (burst pattern recording)
 
 When burst pattern is detected and `tracks/_audit/` exists: locate the latest weekly_audit file and suggest adding the Token Efficiency Check items to it (bash + checklist block in §Step-Bash).
@@ -132,6 +165,8 @@ Run the audit bash (§Step-Bash) and apply thresholds:
 
 **Frequency**: When explicitly called with `/context-doctor` or auto-invoked at session start when MEMORY.md is detected at 180+ lines.
 
+**Cache-boundary note**: apply CLAUDE.md compression (above) at a session boundary, not mid-session — see Step 3.5's cache-invalidation tension if that step is also in scope.
+
 ## Context Hierarchy (L1/L2/L3)
 
 Information buried in the middle of a long context window suffers measurable accuracy loss — the "lost in the middle" effect, ~10–30% degradation for mid-context information (see `../../../../knowledge/shared/harness-core/harness_frontier_diagnosis_2026-06-02.md`). The remedy is two-fold: tier the context, and place the most important instructions at the **start and end**, never buried in the middle.
@@ -187,8 +222,8 @@ The reductions above all act on the **context-footprint** axis (files, history r
 
 | Environment | Behavior |
 |---|---|
-| Meta-harness cloned (Mode A) | Perform full Steps 1–5 / integrate with harvest-loop files |
-| Plugin only (Mode C) | Perform Steps 1–3 / Step 4 output only (no file writes) |
+| Meta-harness cloned (Mode A) | Perform full Steps 1–5 (+ optional Step 3.5) / integrate with harvest-loop files |
+| Plugin only (Mode C) | Perform Steps 1–3 (+ optional Step 3.5, no file writes needed) / Step 4 output only (no file writes) |
 | External general environment | Focus on `.claudeignore` generation + large file guidance |
 
 ## Invocation Triggers
@@ -231,6 +266,7 @@ Explicit invocation (`/context-doctor`) always runs regardless of suppress state
 - "context diet", "memory audit", "CLAUDE.md is heavy", "MEMORY.md size"
 - "context engineering", "context rot", "context collapse"
 - "command output is huge", "verbose output", "rtk", "token killer", "trim command output"
+- "prompt caching", "cache hit rate", "cache boundary", "why are my API costs so high"
 
 ### Natural Language Triggers (activates without internal vocabulary)
 
@@ -247,6 +283,7 @@ Also activates when an external user expresses without token/context terminology
 | "Context is getting full", "context meter is high" | Approaching context limit | Step 3 — propose Wrap-then-Compact pattern |
 | "context engineering", "doing context engineering", "context rot setting in" | 2026 industry term for context discipline (Chroma 2025 / Anthropic) | Step 2 + Step 3 |
 | "every git command dumps a wall of text", "the build output eats my context" | Verbose command output flooding context | §Command-Output Reduction (route to proxy/hook) |
+| "our token bill is high but context looks fine", "cache keeps missing" | Suspected cache-boundary invalidation, not context bloat | Step 3.5 (optional) |
 
 ## Three-Doctor Loop Integration
 
@@ -277,9 +314,10 @@ context-doctor (token/context) · harness-doctor (structure) · sim-conductor (s
 
 | Condition | Completion verdict |
 |---|---|
-| Diagnosis results output to conversation (relevant stages among Steps 1~5) | ✅ Diagnosis complete |
+| Diagnosis results output to conversation (relevant stages among Steps 1~5, incl. optional 3.5) | ✅ Diagnosis complete |
 | `.claudeignore` created or modified + path output | ✅ Prescription complete |
 | Large file detected with split strategy guidance output | ✅ Step 2 complete |
+| Step 3.5 run: checklist findings output, thresholds labeled UNCALIBRATED per source above | ✅ Cache-boundary audit complete (only when Step 3.5 was triggered) |
 | "No context structure issues" judgment output | ✅ Health check complete |
 
 **This skill's Done When = "diagnosis report output complete"**. Actual resolution of prescription items is in the user's or follow-up work domain and is not included in this skill's completion criteria.

package/plugins/fh-meta/skills/context-doctor/SKILL_detail.md

@@ -93,6 +93,44 @@ CC Context Audit Results
 
 ---
 
+## §CacheBoundary — prompt-caching evidence (Step 3.5, provisional)
+
+Full citation for the Step 3.5 evidence line, kept out of the always-read SKILL.md body
+per this file's own role (detail loads on-demand, SKILL.md stays lean).
+
+**Source**: forge-harness GitHub issue #102 ("Frontier Digest Log"), 2026-07-27 daily comment,
+itself citing:
+- arXiv:2603.09619 — reported input:output token-ratio thresholds (>10:1 favors context/cache
+  engineering over model-level optimization; >50:1, prefix caching dominates) and a
+  41–80% cost reduction / 13–31% TTFT improvement range attributed to prompt caching.
+- appscale.blog/en/blog/context-engineering-production-llm-agents-token-budget-compaction-2026
+  — the ~7%→84% cache-hit-rate figure from cache-boundary control (fixed system prompt,
+  dynamic content at the user-message end).
+
+**Grounding status — split verdict (2026-07-28 re-check).** Two separate questions; only one
+is closed. Do not collapse them:
+
+| Question | Verdict | Evidence |
+|---|---|---|
+| Does the cited paper exist? | ✅ **VERIFIED** | `arxiv.org/abs/2603.09619` → HTTP 200, title *"Context Engineering: From Prompts to Corporate Multi-Agent Architecture"*. Measured alongside a known-real control ID (1706.03762 → 200), so the instrument is calibrated for this check. |
+| Do the paper/blog actually state these figures? | ❌ **UNVERIFIED** | The source text was never read. The numbers are traced only to the digest comment. |
+
+⚠️ **Instrument note (kept because it nearly produced a wrong verdict).** The first re-check
+used the arXiv **API** (`export.arxiv.org/api/query`) and returned empty for the target — but
+also empty for the known-real control, i.e. the instrument was dead, not the paper missing.
+An absence measured without a live control is not evidence. Switching to the `abs` page gave a
+working control and flipped the existence verdict to VERIFIED. Original 403 note below for
+provenance.
+
+**Original (2026-07-27) note**: both URLs returned HTTP 403 when that session attempted
+to fetch and verify the claimed spans directly (`WebFetch`), matching the same sandbox
+network-policy limitation the daily frontier-digest routine logged on every run this week
+(WebSearch fallback, no direct API access). The figures above are therefore traced only to
+the digest comment's own text — a real, read GitHub source — and are **not** independently
+re-verified against the original paper/post. Per the Instrument-Calibration doctrine
+(`CLAUDE.md`), do not treat the 10:1 / 50:1 thresholds as a calibrated gate and do not cite
+the ~7%→84% figure elsewhere without re-fetching from an environment with access first.
+
 ## §Headroom — Tooling (external option)
 
 The compression pass in SKILL.md is tool-agnostic, but a concrete, reversible, local-first implementation exists: **Headroom** (`github.com/chopratejas/headroom`, open source, v0.22). It compresses tool outputs, logs, files, and RAG chunks before they reach the LLM — **vendor/coverage-reported** at 60–95% fewer tokens with the same answers ([The Register, 2026-05-31](https://www.theregister.com/ai-ml/2026/05/31/netflix-wiz-creates-app-to-slash-ai-bills-then-open-sources-it/5248702); figures unverified by FH). General token-efficiency basis: `../../../../knowledge/shared/harness-core/harness_frontier_diagnosis_2026-06-02.md`.

package/scripts/chamber_candidate_collect.sh

@@ -0,0 +1,223 @@
+#!/usr/bin/env bash
+# chamber_candidate_collect.sh — chamber candidate discovery: 6-source converge → dedup → rank → screen.
+#
+# The second half of the discovery entrance (the first half = chamber_candidate_screen.sh, the reinvention
+# first-pass). Design home: tracks/_meta/fh_signal_2026-07-14_self-dev.md (design v2, 2-family verified).
+#
+# WHAT IT DOES: pulls candidate signals from the 6 sources, deduplicates the same gap arriving multiple
+# ways (2-family finding: harvest-loop/fh_signal/UAP observe the SAME session → triple-listing), ranks by
+# source-diversity + frequency, and runs each survivor through the reinvention screener. Output = a ranked
+# candidate queue for the operator's HITL "run the chamber?" decision (judged uncertainty/failure-cost
+# filters stay with the human — this tool does the mechanizable converge/dedup/rank/screen).
+#
+# CANDIDATE-EMISSION CONVENTION (why a convention, not source-specific parsing): the 2-family review
+# flagged per-source parsing as fragile/hand-wave. So a source declares a candidate with ONE robust line:
+#     CHAMBER-CANDIDATE: <one-line description of the capability/project to incubate>
+# Any of the 6 sources adds this line when it surfaces something chamber-worthy. Sources adopt it
+# incrementally — until they do, the queue is honestly SPARSE (the design's "6-source volume = n=0,
+# measured only after wiring"; this tool IS that wiring, and its first run measures the volume).
+#
+# NOT MECHANIZED HERE (stays judged/HITL, by design): uncertainty + failure-cost filters (operator judges
+# the ranked survivors); chamber injection (goal-quench budget gate + HITL). This tool ranks; it does not
+# admit. A high rank is a suggestion, never an auto-run.
+#
+# Usage:  bash scripts/chamber_candidate_collect.sh [--min-jaccard N]   (default 50)
+#   exit 0 = ran (ranked queue on stdout; empty queue is a valid honest result)
+#   exit 2 = harness error (FH root not found)
+
+set -uo pipefail
+
+FH="$(cd "$(dirname "$0")/.." && pwd)"
+if [ ! -d "$FH/tracks/_meta" ] || [ ! -d "$FH/plugins" ]; then
+  echo "❌ FH root not found at '$FH' — run from the FH repo." >&2
+  exit 2
+fi
+SCREEN="$FH/scripts/chamber_candidate_screen.sh"
+MINJ=50
+[ "${1:-}" = "--min-jaccard" ] && MINJ="${2:-50}"
+case "$MINJ" in ''|*[!0-9]*) echo "❌ --min-jaccard must be an integer 0-100 (got '$MINJ')" >&2; exit 2 ;; esac
+
+WORK="${TMPDIR:-/tmp}/cand_collect.$$"
+# fail-CLOSED on workdir failure (Axis-2 challenger MED): an unwritable TMPDIR must NOT masquerade as the
+# design's valid "honest-empty queue" — a genuine infra failure and "no markers surfaced" are otherwise
+# indistinguishable. Route infra failure to exit 2 (harness error), never to green-empty.
+mkdir -p "$WORK" 2>/dev/null || { echo "❌ cannot create workdir under '${TMPDIR:-/tmp}' — cannot collect (NOT an empty queue)" >&2; exit 2; }
+trap 'rm -rf "$WORK"' EXIT
+RAW="$WORK/raw"; : > "$RAW" 2>/dev/null || { echo "❌ cannot write workfile (NOT an empty queue)" >&2; exit 2; }
+
+# --- LAYER 1: 6-source converge. Each source = a label + a glob; grep the convention line. ---
+# (source label · file glob) — sources that don't exist yet simply contribute nothing (fail-visible below).
+_pull() { # $1=source-label  $2..=files
+  local label="$1"; shift
+  local f
+  for f in "$@"; do
+    [ -f "$f" ] || continue
+    # convention line: "CHAMBER-CANDIDATE: <desc>" (case-insensitive marker, desc after the colon)
+    grep -inE '^[[:space:]]*CHAMBER-CANDIDATE:' "$f" 2>/dev/null \
+      | sed -E 's/^[0-9]+:[[:space:]]*CHAMBER-CANDIDATE:[[:space:]]*//I' \
+      | while IFS= read -r desc; do
+          [ -n "$desc" ] && printf '%s\t%s\n' "$label" "$desc" >> "$RAW"
+        done
+  done
+}
+SRC_SEEN=0
+for spec in \
+  "harness-doctor:$FH/tracks/_meta/*harness_doctor*.md" \
+  "harvest-loop:$FH/tracks/_audit/*.md" \
+  "fh-signal:$FH/tracks/_meta/fh_signal_*.md" \
+  "field-harvest:$FH/tracks/_contrib/*.md" \
+  "frontier-digest:$FH/tracks/_meta/frontier_digest_*.md" \
+  "uap:$FH/tracks/_meta/user_adaptation_profile.md" ; do
+  label="${spec%%:*}"; glob="${spec#*:}"
+  # word-split the glob deliberately (globbing); nullglob-safe via the -f check in _pull
+  files=$(ls $glob 2>/dev/null || true)
+  [ -n "$files" ] && SRC_SEEN=$((SRC_SEEN+1))
+  # shellcheck disable=SC2086
+  _pull "$label" $files
+done
+
+NRAW=$(grep -c . "$RAW" 2>/dev/null); NRAW=${NRAW:-0}
+echo "── chamber candidate collect ──"
+echo "sources present: $SRC_SEEN/6 · raw candidate markers found: $NRAW"
+if [ "$NRAW" -eq 0 ]; then
+  echo "queue EMPTY — no 'CHAMBER-CANDIDATE:' markers in any source yet (convention not adopted / nothing surfaced)."
+  echo "  This is an honest result, not an error: the discovery volume is n=0 until sources emit the marker."
+  echo "  (Add 'CHAMBER-CANDIDATE: <desc>' to a harness-doctor / fh_signal / frontier-digest / harvest entry.)"
+  exit 0
+fi
+
+# --- keyword signature per candidate (for dedup) ---
+STOP='^(that|this|from|into|over|when|what|will|your|there|their|then|than|with|chamber|candidate|skill|agent|tool|does|done|after|before|which|about|through)$'
+_sig() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9가-힣' ' ' | tr -s ' ' '\n' \
+         | awk 'length($0)>=4' | grep -vE "$STOP" | sort -u; }
+# kill-side signature for the seen-filter: keeps 2+ char tokens (a slug's meaningful short tokens like
+# "qa"/"ui" are dropped by _sig's ≥4 filter → an all-short slug yields an EMPTY sig → kkn=0 → the old
+# match never fired → a KILLed candidate re-entered the queue SILENTLY, Axis-2 MED-3b). Drops stopwords only.
+_ksig() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9가-힣' ' ' | tr -s ' ' '\n' \
+          | awk 'length($0)>=2' | grep -vE "$STOP" | sort -u; }
+
+# --- LAYER 2: dedup by greedy jaccard clustering ---
+# cluster files: $WORK/cluster.N holds "source<TAB>desc" lines; $WORK/sig.N holds the union keyword sig.
+NC=0
+idx=0
+while IFS=$'\t' read -r label desc; do
+  idx=$((idx+1))
+  _sig "$desc" > "$WORK/candsig.$idx"
+  merged=0
+  c=1
+  while [ "$c" -le "$NC" ]; do
+    inter=$(comm -12 "$WORK/sig.$c" "$WORK/candsig.$idx" 2>/dev/null | grep -c . || true)
+    union=$(sort -u "$WORK/sig.$c" "$WORK/candsig.$idx" 2>/dev/null | grep -c . || true)
+    jac=0; [ "${union:-0}" -gt 0 ] && jac=$(( inter * 100 / union ))
+    if [ "$jac" -ge "$MINJ" ]; then
+      printf '%s\t%s\n' "$label" "$desc" >> "$WORK/cluster.$c"
+      sort -u "$WORK/sig.$c" "$WORK/candsig.$idx" > "$WORK/sig.$c.tmp" && mv "$WORK/sig.$c.tmp" "$WORK/sig.$c"
+      merged=1; break
+    fi
+    c=$((c+1))
+  done
+  if [ "$merged" -eq 0 ]; then
+    NC=$((NC+1))
+    printf '%s\t%s\n' "$label" "$desc" > "$WORK/cluster.$NC"
+    cp "$WORK/candsig.$idx" "$WORK/sig.$NC"
+  fi
+done < "$RAW"
+
+# --- seen-filter: pull already-KILLed candidates from the G4 run ledger so a re-listed marker for a
+# candidate the chamber already killed does NOT re-enter the main queue (the run-#3 real-use gap). It is
+# EXCLUDED from the ranked queue but SURFACED in a trailing section (re-emit trigger visibility — a KILL
+# is revisitable once its measured observation lands, so we don't silently erase it). Degrade: no ledger
+# → no seen-filter (fail-visible; equals the pre-seen behavior, safe). ---
+LEDGER="$FH/tracks/_chamber/INDEX.md"
+KILLED="$WORK/killed"; : > "$KILLED"
+if [ -f "$LEDGER" ]; then
+  # KILL rows: a run-log table data row (`| #N | date | candidate | VERDICT | ... |`) whose VERDICT
+  # field ($5) says KILL. Scope the KILL test to the verdict field — NOT a whole-line grep, which would
+  # match "kill" inside "skill" in any row's carry-text (Axis-2 HIGH-1: an EMIT row folding a sliver
+  # "into goal-quench skill" would be misread as KILL). Candidate = $4; strip backticks/asterisks/space.
+  awk -F'|' '$0 ~ /^\| *#/ && NF>=5 && toupper($5) ~ /KILL/ {print $4}' "$LEDGER" 2>/dev/null \
+    | sed 's/[`*]//g; s/^ *//; s/ *$//' | grep -v '^$' >> "$KILLED"
+fi
+NKILL=$(grep -c . "$KILLED" 2>/dev/null); NKILL=${NKILL:-0}
+SEENOUT="$WORK/seen_out"; : > "$SEENOUT"
+
+# --- LAYER 2: rank each cluster = source-diversity*2 + frequency; then screen for reinvention ---
+RANKED="$WORK/ranked"; : > "$RANKED"
+c=1
+while [ "$c" -le "$NC" ]; do
+  freq=$(grep -c . "$WORK/cluster.$c" 2>/dev/null); freq=${freq:-0}
+  ndiv=$(cut -f1 "$WORK/cluster.$c" | sort -u | grep -c . || true)
+  srcs=$(cut -f1 "$WORK/cluster.$c" | sort -u | paste -sd, -)
+  rep=$(head -1 "$WORK/cluster.$c" | cut -f2-)
+  score=$(( ndiv * 2 + freq ))
+  # seen-filter: does this candidate match an already-KILLed ledger entry? Two decorrelated tests, either
+  # sufficient: (1) kill-name keyword recall ≥60% (the common multi-token case); (2) normalized-substring
+  # fallback — the flattened slug (alnum-only, ≥5 chars) appearing in the flattened candidate — which
+  # closes the all-short-token silent-re-entry hole (MED-3b) that recall alone leaves open. Residual
+  # (documented, accepted): a paraphrased re-listing (router→routing) can still under-recall (MED-4), and
+  # a generic slug can over-exclude — but over-exclusion is VISIBLE in the SEEN-KILLED section (operator
+  # catches a wrong match), whereas silent re-entry was invisible. Visible-imprecise ≻ silent-miss.
+  if [ "$NKILL" -gt 0 ]; then
+    _ksig "$rep" > "$WORK/repsig"
+    repflat=$(printf '%s' "$rep" | tr '[:upper:]' '[:lower:]' | tr -cd 'a-z0-9')
+    seen_match=""
+    while IFS= read -r kname; do
+      [ -z "$kname" ] && continue
+      _ksig "$kname" > "$WORK/ksig"
+      kkn=$(grep -c . "$WORK/ksig" 2>/dev/null || true); kkn=${kkn:-0}
+      matched=0; [ "$kkn" -gt 0 ] && matched=$(comm -12 "$WORK/ksig" "$WORK/repsig" 2>/dev/null | grep -c . || true)
+      kpct=0; [ "$kkn" -gt 0 ] && kpct=$(( matched * 100 / kkn ))
+      kflat=$(printf '%s' "$kname" | tr '[:upper:]' '[:lower:]' | tr -cd 'a-z0-9')
+      if [ "$kkn" -gt 0 ] && [ "$kpct" -ge 60 ]; then seen_match="$kname"; break; fi
+      if [ "${#kflat}" -ge 5 ] && printf '%s' "$repflat" | grep -qF "$kflat"; then seen_match="$kname"; break; fi
+    done < "$KILLED"
+    if [ -n "$seen_match" ]; then
+      printf '%s\t%s\n' "$seen_match" "$rep" >> "$SEENOUT"
+      c=$((c+1)); continue
+    fi
+  fi
+  # reinvention first-pass on the representative description. Capture BOTH the verdict AND the matched
+  # anchor the screener already emits ("top asset overlap: X") so a DUPLICATE-CANDIDATE is ACTIONABLE
+  # ("DUP:skill:goal-quench") instead of a uniform non-discriminating flag (Axis-2 challenger Axis-5).
+  verdict="?"
+  if [ -x "$SCREEN" ] || [ -f "$SCREEN" ]; then
+    sout=$(bash "$SCREEN" "$rep" 2>/dev/null)
+    verdict=$(printf '%s\n' "$sout" | grep -oE 'VERDICT: [A-Z-]+' | head -1 | sed 's/VERDICT: //')
+    [ -z "$verdict" ] && verdict="?"
+    if [ "$verdict" = "DUPLICATE-CANDIDATE" ]; then
+      anchor=$(printf '%s\n' "$sout" | grep -oE 'top asset overlap: [^ ]+' | head -1 | sed 's/top asset overlap: //')
+      [ -n "$anchor" ] && verdict="DUP:$anchor"
+    fi
+  fi
+  printf '%03d\t%s\t%s\t%s\t%s\n' "$score" "$ndiv" "$srcs" "$verdict" "$rep" >> "$RANKED"
+  c=$((c+1))
+done
+
+echo "deduped candidates: $NC (from $NRAW raw markers)"
+echo ""
+printf '%-5s  %-6s  %-24s  %-18s  %s\n' "SCORE" "SRCS" "SOURCES" "REINVENTION" "CANDIDATE"
+printf '%-5s  %-6s  %-24s  %-18s  %s\n' "-----" "------" "------------------------" "------------------" "---------"
+sort -rn "$RANKED" | while IFS=$'\t' read -r score ndiv srcs verdict rep; do
+  # drop leading zeros for display
+  printf '%-5d  %-6d  %-24s  %-18s  %s\n' "$((10#$score))" "$ndiv" "$srcs" "$verdict" "$rep"
+done
+echo ""
+echo "NOTE: SCORE = source-diversity×2 + frequency. REINVENTION is a first-pass flag (DUPLICATE-CANDIDATE"
+echo "= HITL KILL review, not auto-drop). Uncertainty/failure-cost stay JUDGED — operator picks which"
+echo "survivors actually enter the chamber (goal-quench budget gate + HITL). This tool ranks; it never admits."
+
+# seen-filter trailing section: candidates the G4 ledger already KILLed are shown here (NOT in the ranked
+# queue) so a re-listed marker does not silently re-enter the chamber, yet the KILL stays visible (a KILL
+# is revisitable once its re-emit trigger lands — see the run's EMISSION_VERDICT for that condition).
+if [ -s "$SEENOUT" ]; then
+  echo ""
+  echo "SEEN-KILLED — excluded from the queue (G4 ledger $LEDGER already KILLed these):"
+  while IFS=$'\t' read -r kn rep; do
+    [ -z "$rep" ] && continue
+    echo "  · \"$rep\"  ↔ killed as \"$kn\"  (재등재 스킵; re-emit only when that run's trigger condition is met)"
+  done < "$SEENOUT"
+elif [ ! -f "$LEDGER" ]; then
+  echo ""
+  echo "SEEN-FILTER: skipped — no G4 ledger at $LEDGER (fail-visible; no seen-exclusion applied this run)."
+fi
+exit 0

package/scripts/degrade_direction_scan.sh

@@ -0,0 +1,222 @@
+#!/usr/bin/env bash
+# degrade_direction_scan.sh — mechanical pre-screen for the "default-toward-PASS" smell
+#
+# The correlated blind spot measured 2026-07-03 across 3 harnesses (qasp/the-bible/pmh):
+#   "When a verdict surface cannot mechanically ground its judgment, it defaults toward
+#    PASS instead of safe-fail." Same-family review (even frontier + target-tier sim)
+#   shares the author's optimistic reading of that discretion and misses it; a
+#   different-family auditor catches it. This script is the cheap MECHANICAL pre-screen
+#   that runs BEFORE the cross-family pass — it flags the code shapes where a permissive
+#   value lands on an unconstrained branch, so the reviewer's attention goes there first.
+#
+# IT IS A REVIEW SURFACE, NOT A HARD GATE. Grep-heuristic → false positives are expected.
+# A hit means "prove this is not default-toward-PASS", not "this is a bug". It never
+# blocks a commit on its own (advisory exit code). The terminal verdict is the
+# cross-family adversarial review + governor source-grounding, never this scan alone.
+# (Irreversibility-gate note: because it is advisory, a degraded/empty run is a no-op,
+#  not a free pass — the cross-family review is the load-bearing check it feeds.)
+#
+# NAMED RECALL RESIDUALS (cross-family audit, gpt-5.5, 2026-07-28 — accepted, not closed):
+#   * Indirection defeats every probe. `allow() { exit 0; }` … `check || allow` is the same
+#     fail-open shape one function call away, and a line-oriented grep cannot follow it. This is
+#     inherent to the heuristic, not a bug to patch — it is why the terminal verdict is the
+#     cross-family review, and why a clean run is never evidence of safety.
+#   * The regression anchor proves the probes on the fixture GRAMMAR it ships, not on every
+#     spelling of each class (e.g. `if ! cmd; then :; fi`, arithmetic-context defaults).
+#
+# Usage:
+#   bash scripts/degrade_direction_scan.sh [path ...]        # scan dirs/files (default: .)
+#   git diff --name-only main..HEAD -- '*.py' | xargs bash scripts/degrade_direction_scan.sh
+# Exit:  0 = no smells found; 2 = smells found (ADVISORY signal — do not hard-block on it)
+set -uo pipefail
+
+TARGETS=("$@")
+[ ${#TARGETS[@]} -eq 0 ] && TARGETS=(".")
+
+# Permissive values a verdict/gate surface must never land on by *default* / fall-through.
+PASS='(True|"PASS"|'"'"'PASS'"'"'|"ALLOW"|'"'"'ALLOW'"'"'|"OK"|'"'"'OK'"'"'|"VALID"|'"'"'VALID'"'"'|"GRANTED"|'"'"'GRANTED'"'"'|"PASSED"|'"'"'PASSED'"'"'|allow|ALLOW)'
+
+# Collect target files. Scannable = py + sh (the smell probes are Python-shaped but bash surfaces —
+# incl. this gate's own pre-push/pre-commit-hook trigger category — must not be invisibly dropped).
+# Anything else is tracked as UNSCANNABLE so a load-bearing surface in another language is reported
+# as "not covered", never silently folded into an "advisory clean" (M#2, steel-quench 2026-07-03).
+FILES=(); UNSCANNABLE=()
+for t in "${TARGETS[@]}"; do
+  if [ -d "$t" ]; then
+    while IFS= read -r f; do FILES+=("$f"); done < <(find "$t" -type f \( -name '*.py' -o -name '*.sh' \) 2>/dev/null)
+    # Shebang pass — this is what makes git hooks visible at all. Measured 2026-07-28:
+    # `templates/.git-hooks` (files named `pre-push`, no extension, under a dotted directory) —
+    # FH's own mechanical floor — reported "no scannable (py/sh) target files", exit 0.
+    # Shebang pass. Deliberately NOT restricted to extensionless names: a cross-family audit
+    # (2026-07-28, gpt-5.5) found that an earlier draft skipped any dotted basename, so a shell
+    # file named `helper.bash` carrying an identical known-positive was dropped from a DIRECTORY
+    # target in silence — while the explicit-file branch reported the same file as UNSCANNABLE.
+    # Silent-drop on one path and honest-report on the other is the fail-open half. Confirmed by
+    # running both paths on the same fixture before accepting the finding.
+    while IFS= read -r f; do
+      b="${f##*/}"                      # basename — a dotted DIRECTORY (.git-hooks) is not an extension
+      case "$b" in
+        *.py|*.sh) continue ;;          # already collected above
+        *.md|*.json|*.yaml|*.yml|*.txt|*.lock|*.png|*.jpg|*.svg|*.pdf|*.zip) continue ;;
+      esac
+      head -n1 "$f" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b' && FILES+=("$f")
+    done < <(find "$t" -type f 2>/dev/null)
+  elif [ -f "$t" ]; then
+    tb="${t##*/}"
+    case "$tb" in
+      *.py|*.sh) FILES+=("$t") ;;
+      *.*) UNSCANNABLE+=("$t") ;;
+      *) if head -n1 "$t" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b'; then FILES+=("$t"); else UNSCANNABLE+=("$t"); fi ;;
+    esac
+  fi
+done
+if [ ${#FILES[@]} -eq 0 ]; then
+  if [ ${#UNSCANNABLE[@]} -gt 0 ]; then
+    echo "degrade-scan: ${#UNSCANNABLE[@]} changed file(s) are OUTSIDE the scannable set (py/sh) — NOT scanned, NOT 'clean':"
+    printf '  (unscannable) %s\n' "${UNSCANNABLE[@]}"
+    echo "A load-bearing surface in another language must go straight to cross-family review."
+    exit 2   # advisory non-clean — an orchestrator keying on exit code must not read this as clean
+  fi
+  echo "degrade-scan: no scannable (py/sh) target files"; exit 0
+fi
+
+hits=0
+emit() { printf '  %s:%s\n    [%s] %s\n' "$1" "$2" "$3" "$4"; hits=$((hits+1)); }
+
+for f in "${FILES[@]}"; do
+  # ---- Shell-shaped probes (S*) -------------------------------------------------------------
+  # Calibration finding (2026-07-28, known-pair): every probe below the S-block is PYTHON-shaped
+  # (`except:` / `.get(k, True)` / `if not x:` / `.split()`), none of which exist in bash. A .sh file
+  # was still COLLECTED and counted, so a fail-open shell gate printed "no smells in 1 scanned py/sh
+  # file" — a FALSE CLEAN, which is worse than honest non-coverage. A known-positive .sh carrying four
+  # distinct default-toward-PASS shapes scored 0/4. These probes close that; they run on any file
+  # whose basename ends in .sh OR that carries a shell shebang (see the is_sh test below).
+  is_sh=""; fb="${f##*/}"
+  case "$fb" in
+    *.sh) is_sh=1 ;;
+    *.py) ;;
+    # Any other collected file reached FILES only via the shebang pass, or is a dotted shell name
+    # like `helper.bash`. Re-check the shebang rather than keying on the extension — keying on the
+    # extension is what produced the collect-but-never-probe false clean this whole block exists to
+    # close (n+10). Collected-but-unprobed must not be reachable again.
+    *) head -n1 "$f" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b' && is_sh=1 ;;
+  esac
+  if [ -n "$is_sh" ]; then
+    # S1 — permissive short-circuit on a FAILING CHECK: `scan=$(...) || return 0`, `verify … || exit 0`.
+    #   The check errored and the surface reports success. Safe-fail is `|| return 1` / `|| exit 1`.
+    #   SCOPED to check-shaped left-hand sides (command substitution, or a verb like
+    #   scan/check/verify/grep/audit/validate/gate). A PRECONDITION guard — `[ -d x ] || exit 0`,
+    #   `[[ $d =~ … ]] || return 0` — is deliberately excluded: "this run does not apply here" is not
+    #   the same claim as "this check passed". Hand-measured 2026-07-28: unscoped, 6/6 sampled hits
+    #   were false positives, 4 of them precondition guards.
+    #   EXCEPTION, re-added after an adversarial pass on this very scoping: a `-f`/`-x` test is a
+    #   DEPENDENCY check, not a scope check. `[ -f "$GUARD_LIB" ] || exit 0` means "my guard library
+    #   is missing, therefore allow" — the fail-open shape that bit qasp on 2026-07-28. Excluding it
+    #   with the scope guards would have hidden exactly the class this scan exists to find.
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "S1:||→PASS(sh)" "failing check short-circuits to a permissive result (\`|| return 0\` / \`|| exit 0\` / \`|| true\`) — an errored check must fail closed, not report success"
+    done < <(grep -nE '\|\|[[:space:]]*(return[[:space:]]+0|exit[[:space:]]+0|true)([[:space:]]*(#|;|$))' "$f" 2>/dev/null \
+             | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade' \
+             | grep -vE '^[0-9]+:[[:space:]]*(if[[:space:]]+)?\[\[?[[:space:]]*(-[dznN][[:space:]]|[^]]*=~)' \
+             | grep -E '(\$\(|`|\[[[:space:]]*-[fx][[:space:]]|\b(scan|check|verify|validate|audit|grep|gate|assert|lint|test_)[A-Za-z_]*[[:space:](])')
+
+    # S2 — `else` fall-through to a permissive exit/return within 2 lines (unenumerated case → allow).
+    while IFS= read -r ln; do
+      emit "$f" "$ln" "S2:else→PASS(sh)" "else/fall-through branch exits permissively — the unenumerated case should fail closed"
+    done < <(grep -nE -A2 '^[[:space:]]*else[[:space:]]*$' "$f" 2>/dev/null \
+             | grep -E '^[0-9]+[-:][[:space:]]*(exit[[:space:]]+0|return[[:space:]]+0)[[:space:]]*(#.*)?$' \
+             | grep -oE '^[0-9]+' | sort -u)
+
+    # S3 — empty/unset defaulted to a permissive VERDICT: `${V:-PASS}` / `V="PASS"` after a failed read.
+    #   "the value never arrived" must not be spelled the same way as "the value said PASS".
+    #   `${V:-0}` and `${V:-true}` are NOT flagged: numeric defaulting is the prescribed integer
+    #   sanitization against the pipefail-fallback class (see S5), and flagging it would push an
+    #   author to delete the remedy. Measured 2026-07-28 — `${PRS:-0}` in session_close_check.sh is
+    #   the fix, not the defect. Only explicit verdict words count.
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "S3:default→PASS(sh)" "unset/empty defaults to a permissive verdict — absent is not clean (\`not found\` ≠ \`0\`); default to the blocking value"
+    done < <(grep -nE "(\\$\{[A-Za-z_][A-Za-z0-9_]*:?-[[:space:]]*(PASS|OK|ALLOW|GRANTED|VALID|PASSED)\}|\|\|[[:space:]]*[A-Za-z_][A-Za-z0-9_]*=[\"']?(PASS|OK|ALLOW|GRANTED|VALID))" "$f" 2>/dev/null \
+             | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
+
+    # S4 — empty-output guard treated as clean: `if [ -z "$out" ]; then return 0/exit 0`.
+    #   Identical to Probe E's falsy-sentinel class, in shell spelling: an errored scan produces empty
+    #   output, so "found nothing" and "never ran" become indistinguishable.
+    while IFS= read -r ln; do
+      emit "$f" "$ln" "S4:empty→PASS(sh)" "empty output treated as clean — a scan that errored also produces empty output; distinguish 'errored/absent' from 'verified clean'"
+    done < <(grep -nE -A2 '^[[:space:]]*(if|elif)[[:space:]]+\[+[[:space:]]*-z[[:space:]]' "$f" 2>/dev/null \
+             | grep -E '^[0-9]+[-:][[:space:]]*(exit[[:space:]]+0|return[[:space:]]+0)[[:space:]]*(#.*)?$' \
+             | grep -oE '^[0-9]+' | sort -u)
+
+    # S5 — the pipefail-fallback disarm: `... | grep -c ... || echo 0` appends a SECOND line under
+    #   `set -o pipefail`, so the later `-gt` integer test becomes a bash error (= false) and the guard
+    #   passes silently, with the error going only to stderr. Measured class, 2026-07-26.
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline — under \`set -o pipefail\` this yields a multi-line value whose integer comparison errors out and silently passes the guard; split the pipeline and sanitize to an integer"
+    done < <(grep -nE '\|[^|]+\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+             | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
+  fi
+
+  # Probe A — except/else/finally block returning a permissive value within 2 lines.
+  #   The classic "swallow the error → report success". A safe-fail returns BLOCK/None/raise.
+  while IFS= read -r line; do
+    ln="${line%%:*}"
+    emit "$f" "$ln" "A:except/else→PASS" "permissive return on an error/fall-through branch — safe-fail must return BLOCK/None or re-raise"
+  done < <(grep -nE -A2 '^[[:space:]]*(except([[:space:]][^:]*)?|else|finally)[[:space:]]*:' "$f" 2>/dev/null \
+           | grep -E "return[[:space:]]+$PASS([[:space:],)]|$)" | grep -oE '^[0-9]+' | sort -u | sed 's/$/:/')
+
+  # Probe B — dict default / setdefault to a permissive value (unknown key → PASS).
+  while IFS= read -r m; do
+    emit "$f" "${m%%:*}" "B:default→PASS" "unknown-key default is permissive — unenumerated case should default to safe-fail"
+  done < <(grep -nE "(\.get\([^,]+,[[:space:]]*$PASS[[:space:])]|setdefault\([^,]+,[[:space:]]*$PASS[[:space:])])" "$f" 2>/dev/null)
+
+  # Probe C — substring membership on a grounding/verdict/state line (loose match, not exact).
+  #   `if tok in text` masks paid⊂prepaid / 완료⊂미완료. Exact/word-boundary is the safe form.
+  while IFS= read -r m; do
+    emit "$f" "${m%%:*}" "C:substring-grounding" "substring 'in' on a verdict/state/present line — use exact or word-boundary match, not containment"
+  done < <(grep -nE '\b(verdict|present|ground|state|match|expected|assert)\w*\b' "$f" 2>/dev/null \
+           | grep -vE ':[[:space:]]*(#|//|from |import )' | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade' \
+           | grep -E '[^._a-zA-Z]in[[:space:]]' | grep -vE '\bfor\b|__contains__|not in|in \(|in \[|in \{|in range|in enumerate|in [A-Z_]+\b' \
+           | grep -oE '^[0-9]+' | sed 's/$/:/')
+
+  # Probe C2 — bare `VAR in VAR` in an if/return/assert/while context, WITHOUT a grounding keyword.
+  #   Probe C is keyword-gated (low-noise) and therefore misses the doc's own headline example
+  #   `tok in text` (paid⊂prepaid) when the variables aren't named verdict/state (M#4, steel-quench).
+  #   C2 closes that: simple var-in-var (not a collection literal / range / for) = a likely
+  #   containment check that should be exact/word-boundary if it grounds a verdict. Higher noise; advisory.
+  while IFS= read -r m; do
+    emit "$f" "${m%%:*}" "C2:substring-boolean" "bare 'X in Y' in if/return/assert — if this grounds a presence/verdict check, use exact/word-boundary match, not containment"
+  done < <(grep -nE '^[[:space:]]*(if|elif|return|assert|while)[[:space:]]+[A-Za-z_][A-Za-z0-9_]*[[:space:]]+in[[:space:]]+[A-Za-z_][A-Za-z0-9_.]*[[:space:]]*[:)]?[[:space:]]*$' "$f" 2>/dev/null \
+           | grep -vE '\bfor\b|in range|in enumerate|not in' \
+           | grep -vE '\b(verdict|present|ground|state|match|expected)\w*\b')
+
+  # Probe E — negated-falsy guard returning permissive (dominance-benchmark round-2 f2 class): an error
+  # SENTINEL (None / {} / "" / []) is falsy, so `if not X: return <PASS>` treats "the check errored / never
+  # ran" identically to "the check ran and found nothing clean". Distinguish errored from clean before allowing.
+  while IFS= read -r ln; do
+    emit "$f" "$ln" "E:falsy-sentinel→PASS" "negated-falsy guard returns permissive — a falsy error sentinel (None/{}/'') masquerades as 'clean'; a gate must distinguish 'errored/absent' from 'verified clean'"
+  done < <(grep -nE -A2 '^[[:space:]]*if[[:space:]]+not[[:space:]]+[A-Za-z_][A-Za-z0-9_.]*[[:space:]]*:' "$f" 2>/dev/null \
+           | grep -E "return[[:space:]]+$PASS([[:space:],)]|$)" | grep -oE '^[0-9]+' | sort -u | sed 's/$/:/')
+
+  # Probe F — positional field-select from a split result feeding a decision (round-2 c3 class): taking the
+  # decision from `parts[-1]`/`parts[0]` of an attacker-influenceable split lets a crafted field (e.g. a
+  # signed DENY whose free-form comment ends "::ALLOW") negate the verdict. Validate structure, don't select by position.
+  if grep -qE '\.r?split\(' "$f" 2>/dev/null; then
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "F:split-positional-verdict" "decision taken by position ([-1]/[0]) from a split result — an attacker-controlled trailing/leading field can negate the verdict; validate structure, don't select by position"
+    done < <(grep -nE '\[[[:space:]]*-?[01][[:space:]]*\]' "$f" 2>/dev/null \
+             | grep -iE 'decision|verdict|allow|deny|approv|grant|status|result|policy')
+  fi
+done
+
+echo "----"
+[ ${#UNSCANNABLE[@]} -gt 0 ] && printf 'note: %s changed file(s) outside py/sh — NOT covered by this scan (send to cross-family directly).\n' "${#UNSCANNABLE[@]}"
+if [ "$hits" -gt 0 ]; then
+  echo "degrade-scan: $hits smell(s) — ADVISORY. Each = 'prove this is not default-toward-PASS'."
+  echo "Terminal verdict = cross-family adversarial review (auto-decorrelation), not this scan."
+  exit 2
+fi
+# Scope-honest clean message (M#2): "clean" means only "no py/sh-pattern smells in the SCANNED set" —
+# it does NOT assert the changed load-bearing surface is safe (other languages, non-code surfaces,
+# and the lint's own recall gaps are out of scope). The load-bearing check is the cross-family review.
+echo "degrade-scan: no default-toward-PASS smells in ${#FILES[@]} scanned py/sh file(s) — does NOT cover other languages / non-code surfaces / the cross-family check (advisory)."
+exit 0