@chrono-meta/fh-gate 1.4.74 → 1.4.75

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.74",
+      "version": "1.4.75",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.74",
+      "version": "1.4.75",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/CHEATSHEET.md

@@ -497,7 +497,7 @@ Claude agents feature
 | `asset-placement-gate` | Routes a new skill/agent/plugin to the right place (hub vs project), no role overlap | "where does this go", "should this be shared", "hub or project" |
 | `marketplace-gate` | Scores a repo against 5 listing criteria (README, zero-config, maintenance, dup, safety) | "is this OK to publish", "ready for the marketplace", "pre-publish check" |
 | `public-surface-audit` | Scans git-tracked files for operator-private tokens (real username, corp names, home paths) | "did I leak anything", "scan for private tokens", "is my split clean" |
-| `self-marketing-lint` | Flags self-promotional / hype wording in descriptions (plain-text discipline) | "lint the marketing language", "is this description hyped" |
+| `harness-doctor --lint` | Flags self-promotional / hype wording in descriptions (plain-text discipline) | "lint the marketing language", "is this description hyped" |
 
 > **Going public?** Don't run these one at a time — say **"publish"** / **"make this repo public"** and Claude
 > fires the **Pre-Publish Surface Gate** (CLAUDE.md), which runs `public-surface-audit` + `marketplace-gate`

package/CLAUDE.md

@@ -695,7 +695,10 @@ Closing phrase detected ("wrap up", "done", "good work", "end session", etc.)
        **(b) flag the matching card carry item resolved for ⑤** — ⑤ owns the card write (card-last
        guard), ④-c never edits the card. **First-run no-op** if no matching handoff/carry exists.
        (Why-its-own-step origin + ownership split + salience/backstops → §detail below.)
-  → ⑤ Card update ← ABSOLUTE LAST: must capture ①–④-c outcomes
+  → ⑤ **Log-close + card update, in that internal order** ← ABSOLUTE LAST: must capture ①–④-c
+       outcomes. ⑤ is ATOMIC and owns BOTH writes: (a) append any close-time finding to
+       `fh_completed_{date}.md` FIRST, (b) then write the card. Once ⑤ starts, `fh_completed`
+       is CLOSED — a later append re-opens the violation ⑤ exists to prevent.
   → ⑥ Commit card + push
 ```
 
@@ -709,6 +712,16 @@ Closing phrase detected ("wrap up", "done", "good work", "end session", etc.)
 new findings, a carry item flipped to DONE) feeds INTO ⑤ — card is never written mid-sequence and
 then left open for more work to accumulate after it.
 
+**Why ⑤ became atomic (N=3, 2026-07-28 — three closes in one day)**: the miss was always the same
+shape — a finding surfaced *during* the close and the reflex appended it to `fh_completed`, which is
+correct under ④ and fatal after ⑤. The three prose repairs ("next time write it into the card first")
+all failed, including one session that stated the vow and then broke it in the same close. So the
+sequence is restructured rather than re-promised: `fh_completed` is not a step that runs alongside ⑤,
+it is the **first half of** ⑤. A close-time finding has exactly one landing order — log, then card —
+and there is no remaining moment where appending is the natural move. *Honest scope*: this removes
+the ordering ambiguity, not the reflex; the pre-push gate stays the floor, and on a violation it now
+**names the offending files and prints their last lines** so re-running ⑤ is a delta, not a re-read.
+
 **Mid-session card writes are drafts**: If a task (e.g., a calibration run) internally updates
 the card, that is a draft. The close chain always re-runs ⑤ to capture post-draft activities.
 Never skip ⑤ because "the card was just updated" — check for delta first.

package/knowledge/shared/harness-core/harness_frontier_diagnosis_2026-06-02.md

@@ -56,7 +56,7 @@ hierarchical-context remedy (L1 always-on / L2 session / L3 on-demand) + prompt
 | Candidate | Frontier basis | FH hook |
 |---|---|---|
 | **Machine-readable `agent-card`-style capability registry** for the FH agents (capability / input-output contract, synced to actual file counts) | A2A Agent Card = the discovery standard | Closes the "count drift / no canonical registry" gap already flagged in `fh_ecosystem_positioning.md` |
-| **Coordination-overhead budget** in `context-bridge-dispatch`: parallel-fan-out cap (3–4) + capability-aware routing | Centralized = +285% tokens; team size caps at 3–4 | `plugins/fh-meta/skills/context-bridge-dispatch`, `agent-composer` |
+| **Coordination-overhead budget** (then in `context-bridge-dispatch`, merged into `agent-composer` Step 3-a on 2026-06-02): parallel-fan-out cap (3–4) + capability-aware routing | Centralized = +285% tokens; team size caps at 3–4 | `plugins/fh-meta/skills/agent-composer` |
 
 ### ② Frontier → Org Propagation
 

package/knowledge/shared/harness-core/meta_harness_engineering_definition.md

@@ -55,7 +55,7 @@ Proposed three-layer harness taxonomy:
 |---|---|---|
 | Harness interface | Context injection layer | `CLAUDE.md` · `.claude/rules/*.md` · `MEMORY.md` |
 | Harness mechanisms | Skill bus | `verify-bidirectional` · `steel-quench` · `phantom-quench` · `agent-composer` |
-| Scale | Multi-agent dispatch | Agent View · `context-bridge-dispatch` · `agent-composer` parallel dispatch |
+| Scale | Multi-agent dispatch | Agent View · `agent-composer` parallel dispatch (Step 3-a — absorbed the former context-bridge-dispatch) |
 | *(meta layer, not in taxonomy)* | Harness evolution | `harvest-loop` · `harness-doctor` · `frontier-digest` · `prompt-regression` |
 
 The academic taxonomy covers the **static structure** of a harness. FH adds the **dynamic evolution layer** — the mechanism by which the harness improves itself over time.

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -552,3 +552,12 @@
   finding: "Ran the adversarial pass INLINE instead. It did find a HIGH (S1 scope-exclusion swallowed `[ -f lib ] || exit 0` dependency guards — the fail-open class), closed with a regression anchor. But inline review is same-context by construction, so the isolation property the gate asks for was NOT obtained."
   note: "Recorded as `sustained` (decided NOT to invoke) because the session carries a standing instruction: no Agent tool unless the user requests it. FIRST `sustained` entry in this log — and directly relevant to fh_signal_2026-07-28_decorrelation-log-uncalibrated, which measured 0 rejected / 0 sustained across 74 entries and argued the log is written selectively toward optimistic outcomes. Operator decision pending on dispatching before merge."
 
+
+- date: 2026-07-28
+  agent: general-purpose Sonnet blind sim (NOT invoked)
+  model: n/a
+  purpose: "Target-tier sim gate (fh_4axis_gate.md) on the salience-dependent CLAUDE.md ⑤ atomicity change"
+  prompt_summary: "Would have been: cold-read the rewritten Session Wrap-up ⑤ at Sonnet and close a session with a finding arriving mid-close — does the atomic ordering actually fire, or does the fh_completed append still happen after the card?"
+  outcome: sustained
+  finding: "Not run. The four other worklist items are mechanical (scripts/hooks — tier-independent, exempt by the gate's own enforcement-column test) and were verified by known-pair + mutation + positive control. The CLAUDE.md ⑤ change is the one item the sim gate actually targets, and it is therefore UNVERIFIED at floor tier — recorded as a residual in the Axes 2-3 marker rather than absorbed silently."
+  note: "Second `sustained` in this log, same cause as the first: standing session instruction forbids the Agent tool unless the user requests it. The pattern is now n=2 — the gate's near-mandatory sim is structurally unreachable in sessions carrying that instruction, which is a governance question (whose exception is it?) rather than a per-session judgment call. Candidate for fh_signal."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.74",
+  "version": "1.4.75",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -102,6 +102,12 @@
     "scripts/prepush_guard_check.sh",
     "scripts/psa_scan_lib.sh",
     "scripts/session_close_check.sh",
+    "scripts/memory_link_check.py",
+    "scripts/test_memory_link_check.sh",
+    "scripts/memory_nearcheck.py",
+    "scripts/sidecar_wait.sh",
+    "scripts/test_session_close_lanes.sh",
+    "scripts/test_card_drift_probe.sh",
     "scripts/universal_guard_check.sh",
     "scripts/test_prepush_stdin_integrity.sh",
     "scripts/public_surface_scan_files.sh",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.74",
+  "version": "1.4.75",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.74",
+  "version": "1.4.75",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/scripts/degrade_direction_scan.sh

@@ -150,9 +150,24 @@ for f in "${FILES[@]}"; do
     # S5 — the pipefail-fallback disarm: `... | grep -c ... || echo 0` appends a SECOND line under
     #   `set -o pipefail`, so the later `-gt` integer test becomes a bash error (= false) and the guard
     #   passes silently, with the error going only to stderr. Measured class, 2026-07-26.
+    #
+    # NARROWED 2026-07-28 after hand-verifying all 9 hits this repo produced: 9/9 were false
+    # positives, i.e. the probe was pure noise for its own class, and 100% FP trains dismissal of
+    # the one hit that will matter. Two distinct causes, both mechanically reproduced:
+    #   (a) `a || b || echo 0` was read as a pipeline — the old regex could anchor its `\|` on the
+    #       SECOND bar of the first `||`. No pipe exists, so no second line can ever be produced.
+    #       (Every `_mtime() { stat -c %Y … || stat -f %m … || echo 0; }` in the tree was flagged.)
+    #   (b) a real pipeline whose failing stage emits NOTHING (`… | jq -r … || echo 0`) — the
+    #       fallback then supplies the only line, which is exactly the intended behavior.
+    # The disarm needs BOTH a real pipe AND a final stage that emits regardless of upstream failure
+    # — a counter (`grep -c`, `wc`). That is the measured shape: `find … | grep -c . || echo 0`
+    # yields "9\n0" and the `-gt` guard goes silent. Verified as a known pair (both directions) in
+    # scripts/test_degrade_scan_shell_probes.sh; narrowing without that anchor would just trade a
+    # noisy probe for a blind one.
     while IFS= read -r m; do
-      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline — under \`set -o pipefail\` this yields a multi-line value whose integer comparison errors out and silently passes the guard; split the pipeline and sanitize to an integer"
-    done < <(grep -nE '\|[^|]+\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline ending in a counter (grep -c/wc) — that stage emits even when an upstream stage fails, so under \`set -o pipefail\` the value gains a SECOND line, the integer comparison errors out, and the guard passes silently; split the pipeline and sanitize to an integer"
+    done < <(grep -nE '[^|]\|[[:space:]]*([a-z]+[[:space:]]+)*(grep[^|]*-c|wc)[^|]*\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+             | grep -vE '^[0-9]+:[[:space:]]*#' \
              | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
   fi
 

package/scripts/memory_link_check.py

@@ -0,0 +1,237 @@
+#!/usr/bin/env python3
+"""memory_link_check.py — wikilink integrity over the memory graph.
+
+WHY THIS EXISTS (measured 2026-07-28, 872 links across 210 notes)
+
+`memory_intent_recall.md` makes the memory store a GRAPH: nodes are files, edges are `[[links]]`,
+and recall walks one hop from an index hit. That doctrine is only as good as the edges. Nothing
+checked them, and the first measurement found **50 edges pointing at a note that exists under a
+different separator** (`[[feedback-pmh-issue-routing]]` while the file is
+`feedback_pmh_issue_routing.md`) plus **22 pointing at nothing at all**. A 1-hop walk across a dead
+edge returns nothing and looks exactly like "there is nothing related" — the failure is silent, and
+it degrades the one mechanism that is supposed to surface a forgotten lesson.
+
+Absorbed from obsidian-mind's `wikilinks.ts` (MIT, breferrari) — the concern, not the code.
+
+TWO INSTRUMENT RULES LEARNED WHILE WRITING IT, both from wrong first numbers:
+
+  1. RESOLVE ACROSS EVERY STORE THE AUTHOR CAN LINK INTO. A first pass scanned only the memory
+     directory and reported 39 "missing". 17 of those resolve in the hub repo or the companion
+     store — legitimate cross-store edges. Counting them as broken would have overstated the
+     defect by 44% and sent someone hunting for files that are exactly where they belong.
+  2. EXCLUDE THE DOC TEMPLATE. `[[link]]` / `[[name]]` appear inside prose that DESCRIBES the
+     convention. Scoring the instructions as defects is the "probe flags its own remedy" class.
+
+CLASSES (a link is exactly one)
+  ok            resolves in the memory store as written
+  ambiguous     two notes share a normalized name — NEVER auto-fixed, a human picks
+  separator     resolves after -/_ normalization — mechanically repairable, and the only class
+                `--fix-separators` will touch
+  cross-store   resolves in the hub repo or companion store — reported, never "fixed"
+  placeholder   the convention's own example text
+  dangling      resolves nowhere. A human decides: write the note, or drop the edge.
+
+DEGRADE DIRECTION: advisory. This is a reversible surface (a memory edit is re-editable), so it
+reports and never blocks. `--fix-separators` writes, and only for the one class where the target is
+proven to exist.
+
+Usage:
+  python3 scripts/memory_link_check.py [--memory DIR] [--fix-separators] [--quiet]
+Exit: 0 = scanned (always, unless the extractor itself broke) · 2 = extractor found no notes
+"""
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from collections import Counter
+from pathlib import Path
+
+LINK_RE = re.compile(r"\[\[([^\]|#]+)")
+# Fenced blocks are QUOTED CONTENT — a `[[wrong-form]]` inside one is usually an example of the
+# convention, and "fixing" it destroys the documentation that teaches the rule. Skipped on the
+# write path only; they are still COUNTED, because a reader deserves to know they exist.
+#
+# Inline backticks are deliberately NOT skipped. Measured on this corpus (2026-07-28): 25 of the
+# 150 repaired links sat inside inline code and every one was a real link the author had merely
+# styled with backticks — that is this store's citation convention. Fenced-block changes in the
+# same run: 0. So the two spans are not the same thing here, and treating them alike would either
+# damage examples (skip nothing) or leave a quarter of the dead edges dead (skip both).
+FENCE_RE = re.compile(r"```.*?```", re.S)
+PLACEHOLDERS = {"link", "name", "their-name"}
+def default_memory() -> Path | None:
+    """Locate this project's Claude-Code memory dir WITHOUT hard-coding a username or path.
+
+    Claude Code stores per-project memory under ~/.claude/projects/<encoded-abs-path>/memory, and
+    the encoding maps path separators to '-', so it differs per user and per OS. Globbing the
+    encoded tail (parent + project folder) is portable AND keeps an operator's real home path out
+    of a public file — the confidentiality gate rejected the first draft of this line for exactly
+    that reason, which is the gate working.
+    """
+    root = Path(__file__).resolve().parents[1]
+    tail = f"{root.parent.name}-{root.name}"
+    base = Path.home() / ".claude/projects"
+    if not base.is_dir():
+        return None
+    for d in sorted(base.glob(f"*{tail}")):
+        if (d / "memory").is_dir():
+            return d / "memory"
+    return None
+
+
+def extra_roots() -> list[Path]:
+    """Other stores an author may legitimately link into.
+
+    The hub itself, plus any sibling store named by MEMORY_LINK_EXTRA_ROOTS (colon-separated).
+    A private companion store is NOT named here: its name is operator configuration, not a
+    property of this tool, and embedding it would publish a private repo name.
+    """
+    import os
+    roots = [Path(__file__).resolve().parents[1]]
+    for raw in filter(None, os.environ.get("MEMORY_LINK_EXTRA_ROOTS", "").split(":")):
+        roots.append(Path(raw).expanduser())
+    return [r for r in roots if r.is_dir()]
+
+
+def norm(s: str) -> str:
+    return s.replace("-", "_").lower()
+
+
+# Normalized keys whose bucket holds MORE THAN ONE distinct memory note. Auto-fixing these would
+# pick whichever file sorted first and silently reroute an edge to the wrong note — and the reroute
+# is permanent, because the rewritten link then resolves exactly and no later run flags it.
+# Cross-family review (gpt-5.5, 2026-07-29) supplied the reachable input: `alpha-beta.md` and
+# `alpha_beta.md` both exist, a note links `[[Alpha_Beta]]` meaning the underscore one, and case
+# drift alone is enough to send it to the hyphen one. Reported as ambiguous, never rewritten.
+AMBIGUOUS: set[str] = set()
+
+
+def build_index(memory: Path) -> dict[str, tuple[str, str]]:
+    idx: dict[str, tuple[str, str]] = {}
+    AMBIGUOUS.clear()
+    seen: dict[str, str] = {}
+    for p in sorted(memory.glob("*.md")):
+        k = norm(p.stem)
+        if k in seen and seen[k] != p.name:
+            AMBIGUOUS.add(k)
+        seen[k] = p.name
+        idx.setdefault(k, ("memory", p.name))
+    for root in extra_roots():
+        for p in root.rglob("*.md"):
+            if ".git" in p.parts:
+                continue
+            idx.setdefault(norm(p.stem), (root.name, str(p.relative_to(root))))
+    return idx
+
+
+def classify(target: str, memory: Path, idx: dict) -> str:
+    t = target.strip()
+    if t in PLACEHOLDERS:
+        return "placeholder"
+    if (memory / f"{t}.md").exists():
+        return "ok"
+    k = norm(t)
+    hit = idx.get(k)
+    if hit is None:
+        return "dangling"
+    if hit[0] == "memory":
+        return "ambiguous" if k in AMBIGUOUS else "separator"
+    return "cross-store"
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--memory", type=Path, default=None)
+    ap.add_argument("--fix-separators", action="store_true",
+                    help="rewrite ONLY the separator class, whose target is proven to exist")
+    ap.add_argument("--quiet", action="store_true")
+    a = ap.parse_args()
+
+    memory = a.memory or default_memory()
+    if memory is None or not memory.is_dir():
+        print(f"memory-link-check: SKIP (no memory dir at {memory})")
+        return 0
+    notes = sorted(memory.glob("*.md"))
+    if not notes:
+        # Impossible-zero guard: a store with no notes means the path or glob broke. A scan that
+        # cannot see its subject must not report a clean graph.
+        print("memory-link-check: FAIL — 0 notes found; the scan broke, it did not pass", file=sys.stderr)
+        return 2
+
+    idx = build_index(memory)
+    counts: Counter[str] = Counter()
+    dangling: list[tuple[str, str]] = []
+    ambiguous: list[tuple[str, str]] = []
+    seps: list[tuple[Path, str, str]] = []
+
+    for p in notes:
+        text = p.read_text(encoding="utf-8", errors="ignore")
+        for raw in LINK_RE.findall(text):
+            t = raw.strip()
+            k = classify(t, memory, idx)
+            counts[k] += 1
+            if k == "dangling":
+                dangling.append((p.name, t))
+            elif k == "ambiguous":
+                ambiguous.append((p.name, t))
+            elif k == "separator":
+                seps.append((p, t, idx[norm(t)][1][:-3]))
+
+    total = sum(counts.values())
+    if not a.quiet:
+        print(f"memory-link-check: {len(notes)} notes · {total} links")
+        for k in ("ok", "separator", "ambiguous", "cross-store", "placeholder", "dangling"):
+            print(f"  {k:12s} {counts[k]}")
+        if counts["ambiguous"]:
+            print("\n  ambiguous — two notes share a normalized name; a human must pick, the fixer will not:")
+            for t, n in Counter(t for _, t in ambiguous).most_common():
+                print(f"    {n}x  [[{t}]]")
+        if dangling:
+            print("\n  dangling (nothing on disk answers these — write the note, or drop the edge):")
+            for t, n in Counter(t for _, t in dangling).most_common():
+                print(f"    {n}x  [[{t}]]")
+
+    if a.fix_separators and seps:
+        touched, skipped, fixed = 0, 0, 0
+        for p in {s[0] for s in seps}:
+            text = p.read_text(encoding="utf-8")
+            # Split on fenced blocks and rewrite only the parts OUTSIDE them, then rejoin. Doing it
+            # by span keeps the fence contents byte-identical instead of relying on the replacement
+            # string being unique.
+            parts, last, out = [], 0, []
+            for m in FENCE_RE.finditer(text):
+                parts.append((text[last:m.start()], True))
+                parts.append((m.group(0), False))
+                last = m.end()
+            parts.append((text[last:], True))
+            for chunk, editable in parts:
+                if editable:
+                    for _, wrong, right in [s for s in seps if s[0] == p]:
+                        # Rewrite the TARGET only, leaving whatever follows it intact — an anchor
+                        # (`#section`), an alias (`|shown as`), or nothing.
+                        #
+                        # An earlier version enumerated the closing forms by hand (`]]` and `|`)
+                        # and therefore silently skipped `[[target#anchor]]`: the link was still
+                        # COUNTED as repairable, so every later run flagged it again (idempotence
+                        # broken) and the summary reported more fixes than it had made. Found by a
+                        # cross-family reviewer and confirmed by execution before being accepted.
+                        pat = re.compile(r"\[\[" + re.escape(wrong) + r"(?=[\]|#])")
+                        chunk, n = pat.subn(f"[[{right}", chunk)
+                        fixed += n
+                else:
+                    skipped += sum(chunk.count(f"[[{s[1]}") for s in seps if s[0] == p)
+                out.append(chunk)
+            p.write_text("".join(out), encoding="utf-8")
+            touched += 1
+        # Report what was ACTUALLY rewritten, not what was eligible. The two diverged once and the
+        # summary over-reported; a fixer that miscounts its own writes cannot be checked by reading
+        # its output.
+        print(f"\n  fixed {fixed} separator link(s) across {touched} file(s)"
+              + (f"; left {skipped} inside fenced blocks (quoted examples)" if skipped else ""))
+    elif seps and not a.quiet:
+        print(f"\n  {len(seps)} separator link(s) are mechanically repairable → --fix-separators")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/scripts/memory_nearcheck.py

@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""nearcheck.py — read-only near-duplicate probe over a markdown memory store.
+
+Design absorbed from obsidian-mind's `memory-similarity.ts` (MIT, breferrari) — the PROPOSITIONS,
+not the code:
+  * lexical, not semantic. An embedding call on the write hot path costs latency and money, and
+    the failure being prevented is the LITERAL re-record (a session restating a lesson in nearly
+    the same words), not two genuinely different phrasings. Semantics is what RECALL is for.
+  * facet-gated: two notes are only comparable when their declared reach overlaps.
+  * pure: no IO in the scoring core, so it can be calibrated on fixtures.
+
+DEVIATION, and why: obsidian-mind tokenizes on word boundaries. This corpus is majority KOREAN,
+where whitespace tokens are morphologically inflected and word-level overlap under-reports badly —
+the same failure class this repo already measured (an ASCII-token scanner over a Korean corpus
+produced ~96% false positives). So the shingles here are CHARACTER 3-grams over NFC-normalized,
+markup-stripped text, which is script-agnostic.
+
+READ-ONLY. Writes nothing. Exit 0 always — this is a measurement, not a gate.
+"""
+from __future__ import annotations
+import re, sys, unicodedata
+from pathlib import Path
+from itertools import combinations
+
+N = 3          # character shingle size
+TOP = 40       # how many pairs to print
+
+def strip_markup(t: str) -> str:
+    t = re.sub(r"```.*?```", " ", t, flags=re.S)      # fenced code
+    t = re.sub(r"`[^`]*`", " ", t)                    # inline code
+    t = re.sub(r"\[\[([^\]]*)\]\]", r"\1", t)         # wikilinks -> text
+    t = re.sub(r"\[([^\]]*)\]\([^)]*\)", r"\1", t)    # md links -> text
+    t = re.sub(r"https?://\S+", " ", t)
+    t = re.sub(r"[#*_>|\-–—·:;,.!?()\[\]{}\"'`~^=+/\\]", " ", t)
+    return re.sub(r"\s+", " ", t).strip()
+
+def parse(p: Path) -> dict:
+    raw = p.read_text(encoding="utf-8", errors="ignore")
+    fm, body = {}, raw
+    if raw.startswith("---"):
+        end = raw.find("\n---", 3)
+        if end > 0:
+            for line in raw[3:end].splitlines():
+                if ":" in line and not line.startswith(" "):
+                    k, v = line.split(":", 1)
+                    fm[k.strip()] = v.strip().strip('"')
+            body = raw[end + 4 :]
+    return {
+        "path": p,
+        "name": fm.get("name", p.stem),
+        "desc": fm.get("description", ""),
+        "type": fm.get("type", ""),
+        "body": unicodedata.normalize("NFC", strip_markup(body)),
+    }
+
+def shingles(t: str) -> set[str]:
+    t = t.replace(" ", "")
+    return {t[i : i + N] for i in range(max(0, len(t) - N + 1))}
+
+def jaccard(a: set, b: set) -> float:
+    if not a or not b:
+        return 0.0
+    inter = len(a & b)
+    return inter / (len(a) + len(b) - inter)
+
+def containment(a: set, b: set) -> float:
+    """Asymmetric: how much of the SMALLER note is inside the larger.
+
+    Jaccard alone under-reports the case that matters most here — a short lesson later restated
+    inside a longer note.
+
+    SIZE-GATED (repaired 2026-07-28 after the probe's first run): without the gate this metric
+    SATURATES on size-asymmetric pairs. Korean character 3-grams have a very high base rate
+    (inflectional endings and particles recur everywhere), so a 22 KB note "contains" almost every
+    short note's shingles and the top of the ranking became one large file paired with everything.
+    Hand-check that killed it: user_role.md (658 B, "user is a QA engineer") scored 0.80 against a
+    22 KB provenance note. Not a near-duplicate by any reading — an instrument artifact.
+    A restatement worth flagging is of COMPARABLE size; a short note swallowed by a long one is
+    the containment metric measuring the alphabet, not the content.
+    """
+    if not a or not b:
+        return 0.0
+    small, large = (a, b) if len(a) <= len(b) else (b, a)
+    if len(small) < 0.34 * len(large):
+        return 0.0
+    return len(small & large) / len(small)
+
+def main(argv):
+    root = Path(argv[1])
+    docs = [parse(p) for p in sorted(root.glob("*.md"))
+            if p.name not in {"MEMORY.md", "MEMORY_archive.md"}]
+    if not docs:
+        print("EXTRACTOR_BROKE: 0 documents parsed — the probe did not run", file=sys.stderr)
+        return 2
+    # Corpus-frequency filter — the second half of the same repair. A shingle present in most
+    # notes carries no evidence of duplication; it is this corpus's alphabet. Dropping the common
+    # band is the lexical equivalent of a stopword list, derived rather than hand-listed so it
+    # transfers to a corpus in any script.
+    from collections import Counter
+    df = Counter()
+    for d in docs:
+        d["sh_raw"] = shingles(d["body"])
+        df.update(d["sh_raw"])
+    cutoff = max(2, int(0.15 * len(docs)))
+    common = {g for g, n in df.items() if n > cutoff}
+    for d in docs:
+        d["sh"] = d["sh_raw"] - common
+        d["shd"] = shingles(d["desc"]) - common
+
+    empty = [d["path"].name for d in docs if len(d["sh"]) < 20]
+    pairs = []
+    for a, b in combinations(docs, 2):
+        j = jaccard(a["sh"], b["sh"])
+        c = containment(a["sh"], b["sh"])
+        jd = jaccard(a["shd"], b["shd"])
+        if j >= 0.25 or c >= 0.55 or jd >= 0.45:
+            pairs.append((max(j, c), j, c, jd, a, b))
+    pairs.sort(key=lambda t: -t[0])
+
+    print(f"scanned: {len(docs)} notes  (skipped index files)")
+    print(f"corpus-common shingles dropped: {len(common)} (present in >{cutoff} notes)")
+    print(f"too-short-to-score (<20 shingles): {len(empty)}" + (f" → {empty}" if empty else ""))
+    print(f"candidate pairs above threshold: {len(pairs)}\n")
+    for score, j, c, jd, a, b in pairs[:TOP]:
+        print(f"[{score:.2f}] jac={j:.2f} cont={c:.2f} desc={jd:.2f}")
+        print(f"    A {a['path'].name}")
+        print(f"    B {b['path'].name}")
+    return 0
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

package/scripts/package_coverage_check.sh

@@ -73,6 +73,7 @@ pat = re.compile(
 )
 
 phantom = {}
+exercised = set()   # accepted entries a shipped doc ACTUALLY still points at
 for s in shipped:
     try:
         text = open(s, encoding='utf-8', errors='ignore').read()
@@ -82,8 +83,11 @@ for s in shipped:
         # Only a path that REALLY EXISTS here but is left out of the tarball is this defect.
         # A path that exists nowhere is the ordinary phantom-reference class the ref-path
         # check above already owns; a path outside files[] that is also absent is nothing.
-        if os.path.exists(m) and not covered(m) and m not in accepted:
-            phantom.setdefault(m, set()).add(s)
+        if os.path.exists(m) and not covered(m):
+            if m in accepted:
+                exercised.add(m)
+            else:
+                phantom.setdefault(m, set()).add(s)
 
 # Impossible-zero guard: this repo always has shipped docs. Zero scanned means the extractor
 # broke — report that as a failure rather than letting a dead check print a pass
@@ -94,6 +98,11 @@ if not shipped:
 
 for p, srcs in sorted(phantom.items(), key=lambda kv: (-len(kv[1]), kv[0])):
     print(f"{p}\t{len(srcs)}\t{sorted(srcs)[0]}")
+
+# An exception nobody exercises is a SILENCER waiting for a future real case to land on it.
+# Report the unexercised ones so the list stays a set of decisions, not accumulated residue.
+for a in sorted(accepted - exercised):
+    print(f"STALE\t{a}")
 raise SystemExit(1 if phantom else 0)
 PY
 )
@@ -104,9 +113,13 @@ if [ "$rc" -eq 2 ] || [ "$out" = "EXTRACTOR_BROKE" ]; then
   exit 1
 fi
 
+STALE_LIST=$(printf '%s\n' "$out" | grep '^STALE	' | cut -f2- || true)
+STALE_N=$(printf '%s' "$STALE_LIST" | grep -c . || true)
+EXERCISED_N=$(( ${#ACCEPTED_ABSENT[@]} - ${STALE_N:-0} ))
+
 if [ "$rc" -ne 0 ]; then
   echo "FAIL  package-coverage: shipped document(s) point at file(s) the package omits:"
-  printf '%s\n' "$out" | while IFS=$'\t' read -r path n src; do
+  printf '%s\n' "$out" | grep -v '^STALE	' | while IFS=$'\t' read -r path n src; do
     [ -z "$path" ] && continue
     printf '        %s  (named by %s shipped doc(s), e.g. %s)\n' "$path" "$n" "$src"
   done
@@ -115,5 +128,13 @@ if [ "$rc" -ne 0 ]; then
   exit 1
 fi
 
-echo "PASS  package-coverage: every referenced path is shipped or explicitly accepted (${#ACCEPTED_ABSENT[@]} accepted)"
+# Advisory only — a stale exception is hygiene, not a shipped-doc defect, so it must not
+# convert a clean package into a red gate (that trains the runner to ignore the check).
+if [ "${STALE_N:-0}" -gt 0 ]; then
+  echo "⚠️  package-coverage: ${STALE_N} ACCEPTED_ABSENT entry(ies) no longer exercised — remove, or a"
+  echo "    future real omission can land on the stale exception and be silenced:"
+  printf '%s\n' "$STALE_LIST" | sed 's/^/        /'
+fi
+
+echo "PASS  package-coverage: every referenced path is shipped or explicitly accepted (${#ACCEPTED_ABSENT[@]} accepted, ${EXERCISED_N} exercised)"
 exit 0

package/scripts/selfcheck.sh

@@ -111,6 +111,41 @@ if [ -f scripts/package_coverage_check.sh ]; then
   fi
 fi
 
+# memory-link-check — the memory store is a GRAPH (memory_intent_recall.md: nodes=files,
+# edges=[[links]], recall walks one hop). Measured 2026-07-28: 50 of 872 edges pointed at a note
+# that existed under a different separator and 22 at nothing — a dead edge returns nothing and is
+# indistinguishable from "nothing is related", so the doctrine degraded silently. The checker's
+# --fix-separators path WRITES, so its anchor runs here rather than being invoked by hand.
+# Package/other-machine mode: the checker self-SKIPs when no memory dir exists.
+if [ -f scripts/test_memory_link_check.sh ] && [ -f scripts/memory_link_check.py ]; then
+  if ! bash scripts/test_memory_link_check.sh; then
+    fail=1
+  fi
+elif [ -f scripts/memory_link_check.py ]; then
+  echo "FAIL  memory-link-check: checker present but scripts/test_memory_link_check.sh missing"
+  fail=1
+fi
+
+# session-close gate lanes (② harvest-loop discharge + ⑤ card-last) and the ⑤-b card-drift probe.
+# Both anchors calibrate scripts/session_close_check.sh, which the pre-push hook runs on every push
+# — an uncalibrated instrument there produces exactly the false verdicts the close chain exists to
+# prevent. test_card_drift_probe.sh had shipped with ZERO callers since it was written; wiring it
+# here closes that, and the anchors are added to files[] in the same change so package mode runs
+# them too rather than reporting a deleted anchor.
+for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe.sh; do
+  if [ ! -f scripts/session_close_check.sh ]; then
+    echo "SKIP  ${_anchor##*/} (subject scripts/session_close_check.sh absent)"
+  elif [ -f "$_anchor" ]; then
+    if ! bash "$_anchor"; then
+      fail=1
+    fi
+  else
+    # subject present, anchor gone => the calibration was deleted. Real failure, not a skip.
+    echo "FAIL  ${_anchor##*/}: session_close_check.sh present but its anchor is missing"
+    fail=1
+  fi
+done
+
 # Referenced-path existence is a source-tree check. The npm package intentionally
 # ships a narrower runtime surface, so package-mode selfcheck skips this section.
 if [ -d ".claude/rules" ]; then

package/scripts/session_close_check.sh

@@ -42,10 +42,28 @@ fi
 # masking a real match as pipeline failure so the warning NEVER fired on true positives
 # (caught by a Sonnet blind probe 2026-07-10, 5/5 deterministic repro). `grep -c` reads the
 # whole stream; `|| true` guards its exit-1-on-zero.
+#
+# SATISFIABLE (2026-07-28): this warning used to fire on EVERY close that touched an FH asset, with
+# no way for the session to discharge it — the script had no means of observing whether harvest-loop
+# ran. A permanently-firing line is noise, and noise trains the runner to skim past the ❌ lines that
+# do matter (the same objection raised against pre-push:484 on 2026-07-28 — one standard, both places).
+# So the obligation now has a mechanical discharge: a `harvest-loop` mention in TODAY's fh_completed
+# file. HONEST SCOPE: this tests ACKNOWLEDGMENT, not execution — the script cannot see a skill run.
+# Recording "harvest-loop: skipped, <reason>" discharges it exactly as recording a run does, which is
+# correct: CLAUDE.md ② accepts "harvest-loop (or an explicit skip note)". What it now catches is the
+# real miss class — closing with FH assets changed and *no decision recorded either way*.
 FH_CHANGED=$(git -C "$FH" log --since="today 00:00" --name-only --pretty=format: 2>/dev/null \
      | grep -cE '^(plugins/.*SKILL\.md|\.claude/rules/|templates/|CLAUDE\.md|knowledge/)' || true)
 if [ "${FH_CHANGED:-0}" -gt 0 ]; then
-  echo "⚠️  ② FH assets changed today ($FH_CHANGED path-touch(es)) — harvest-loop (or an explicit skip note) is owed"
+  HL_NOTED=0
+  [ -f "$FH/tracks/_meta/fh_completed_${TODAY}.md" ] \
+    && HL_NOTED=$(grep -ciE 'harvest[-_]loop' "$FH/tracks/_meta/fh_completed_${TODAY}.md" || true)
+  if [ "${HL_NOTED:-0}" -gt 0 ]; then
+    echo "✅ ② FH assets changed today ($FH_CHANGED path-touch(es)) — harvest-loop decision recorded in fh_completed_${TODAY}.md"
+  else
+    echo "⚠️  ② FH assets changed today ($FH_CHANGED path-touch(es)) and fh_completed_${TODAY}.md records no"
+    echo "     harvest-loop decision — run it, or write one line stating the skip and why (either discharges this)"
+  fi
 fi
 
 # ④ real-time completion log — required whenever any commit landed today
@@ -100,6 +118,18 @@ if [ -f "$CARD" ]; then
   NEWER=$(find "$FH/tracks/_meta" -maxdepth 1 -type f \( -name "fh_completed_*.md" -o -name "fh_signal_*.md" \) -newer "$CARD" 2>/dev/null | wc -l | tr -d ' ')
   if [ "$NEWER" -gt 0 ]; then
     echo "❌ ⑤ card-last violated — $NEWER close artifact(s) newer than the session card; re-run ⑤ (delta update)"
+    # NAME the offenders. Recurrence N=3 (2026-07-28, three closes in one day): every repair so far
+    # was a prose vow ("next time I'll write the finding into the card first") and every one failed,
+    # because the reflex fires mid-close. What is mechanizable is not the reflex but the COST of the
+    # miss — a bare count makes ⑤ a re-read of the whole session, while naming the files and showing
+    # what landed after the card makes the delta update a minute's work, which is what actually gets
+    # done rather than deferred. Diagnosis, not prevention: this line does not claim to stop the miss.
+    find "$FH/tracks/_meta" -maxdepth 1 -type f \( -name "fh_completed_*.md" -o -name "fh_signal_*.md" \) -newer "$CARD" 2>/dev/null \
+      | while IFS= read -r f; do
+          echo "     ↳ ${f#"$FH"/}"
+          tail -n 3 "$f" 2>/dev/null | sed 's/^/         │ /'
+        done
+    echo "     → fold the above into the card, save the card LAST, then re-push."
     FAIL=1
   else
     echo "✅ ⑤ card is the newest close artifact (card-last holds)"

package/scripts/sidecar_wait.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# sidecar_wait.sh — run a sidecar to COMPLETION and report a typed verdict about it.
+#
+# WHY THIS EXISTS (measured twice, 2026-07-28 and 2026-07-29)
+#
+#   A session dispatched `codex exec` and `agy -p` into the background and read their output files
+#   one second and thirty seconds later. Both were empty at that moment, so the session recorded
+#   "both sidecars returned 0-output", wrote that into a gate marker, a PR body, a session card and
+#   a memory file, and did the adversarial work itself instead.
+#
+#   Both sidecars had in fact answered. codex produced 48 KB containing three findings — one HIGH
+#   (a normalization collision that silently reroutes a link and then looks clean forever) and one
+#   MED that showed the change was OVER-APPLIED. agy produced a HIGH of its own (anchor-form links
+#   were counted as fixable but never rewritten, so the fixer broke idempotence and over-reported
+#   its own writes). Every one was real; all were confirmed by execution and fixed.
+#
+#   So the failure was never the sidecars. It was reading a still-running process and calling the
+#   silence a result. That mis-reading then propagated as a claim about ANOTHER system — the worst
+#   shape a measurement error can take, because it retires a working mechanism.
+#
+#   The reflex fires mid-work and prose does not stop it (three consecutive card-last violations the
+#   day before are the same lesson). So the wait becomes mechanical: this script will not emit a
+#   verdict while the process is alive, and "no output" is only sayable after the process exits.
+#
+# VERDICTS (typed — grep these, never the prose)
+#   SIDECAR_VERDICT=COMPLETE exit=<n> bytes=<n>   process exited on its own
+#   SIDECAR_VERDICT=TIMEOUT  waited=<n>s bytes=<n> still alive when the budget ran out; NOT a result
+#   SIDECAR_VERDICT=EMPTY    exit=<n>             exited cleanly having written nothing — the only
+#                                                 state in which "the sidecar said nothing" is true
+#
+# Usage:
+#   bash scripts/sidecar_wait.sh <outfile> <timeout_seconds> -- <command> [args...]
+#   printf '%s' "$prompt" | bash scripts/sidecar_wait.sh out.txt 600 -- codex exec -m gpt-5.5 -
+#
+# Exit: 0 = COMPLETE (with or without output) · 1 = TIMEOUT (verdict withheld, not a failure claim)
+set -uo pipefail
+
+OUT="${1:?usage: sidecar_wait.sh <outfile> <timeout_s> -- <cmd...>}"
+BUDGET="${2:?missing timeout seconds}"
+shift 2
+[ "${1:-}" = "--" ] && shift
+[ $# -gt 0 ] || { echo "sidecar_wait: no command given" >&2; exit 2; }
+
+: > "$OUT"
+"$@" > "$OUT" 2>&1 &
+PID=$!
+
+waited=0
+last_size=0
+# Poll rather than `wait`, so a live-but-quiet process is distinguishable from a dead one and the
+# caller can SEE progress. A silent minute on a reasoning model is normal; the earlier misreading
+# happened precisely because silence was treated as termination.
+while kill -0 "$PID" 2>/dev/null; do
+  if [ "$waited" -ge "$BUDGET" ]; then
+    size=$(wc -c < "$OUT" 2>/dev/null | tr -d ' ')
+    echo "SIDECAR_VERDICT=TIMEOUT waited=${BUDGET}s bytes=${size:-0} pid=$PID"
+    echo "  the process is STILL RUNNING — this is not 'no output'. Raise the budget, or kill $PID" >&2
+    exit 1
+  fi
+  sleep 5
+  waited=$((waited + 5))
+  size=$(wc -c < "$OUT" 2>/dev/null | tr -d ' ')
+  if [ "${size:-0}" -ne "$last_size" ]; then
+    echo "  … ${waited}s elapsed, ${size} bytes so far (alive)" >&2
+    last_size=${size:-0}
+  fi
+done
+
+wait "$PID"; rc=$?
+size=$(wc -c < "$OUT" 2>/dev/null | tr -d ' ')
+if [ "${size:-0}" -eq 0 ]; then
+  echo "SIDECAR_VERDICT=EMPTY exit=$rc"
+else
+  echo "SIDECAR_VERDICT=COMPLETE exit=$rc bytes=$size"
+fi
+exit 0

package/scripts/test_card_drift_probe.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# test_card_drift_probe.sh — session_close_check.sh ⑤-b 카드-드리프트 프로브의 known-pair 픽스처.
+#
+# WHY: 프로브 자체가 계기다 — CLAUDE.md §Instrument Calibration 이 요구하는 known-pair
+# (양성 1 + 음성 1)를 통과하지 못하는 프로브는 배선하면 안 된다(다음 오판정의 원천이 된다).
+# 이 파일이 그 캘리브레이션의 회귀 앵커: 프로브 정규식/토큰추출을 고칠 때마다 재실행.
+#
+# 픽스처 3종:
+#   P  (known-positive): 카드가 🔴 "foo-digest 미가동 — 산출물 0" 주장 + 실물
+#                        tracks/_meta/foo_digest_2026_07_22.md 존재 → ⑤-b 경고가 떠야 한다
+#   N1 (known-negative): 카드가 부재 주장하는 bar-report 는 진짜 없음 → 경고 0
+#   N2 (과발화 가드):    같은 실물이 있어도 부재-주장이 아닌 🟢 줄 → 경고 0
+#                        (건강한 날 뜨는 경고는 무시를 학습시킨다 — 과발화도 결함)
+#
+# Exit 0 = 3/3 캘리브레이션 통과 · exit 1 = 프로브 계기 불량 (배선 금지)
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CHECK="$SCRIPT_DIR/session_close_check.sh"
+FAILED=0
+
+run_fixture() {  # $1=name  $2=card-content  $3=make-artifact(0/1)  $4=expect-warn(0/1)
+  local name="$1" card="$2" mkart="$3" expect="$4"
+  local T; T=$(mktemp -d)
+  mkdir -p "$T/tracks/_meta/logs"
+  printf '%s\n' "$card" > "$T/tracks/_meta/reference_next_session_starter.md"
+  [ "$mkart" = 1 ] && touch "$T/tracks/_meta/foo_digest_2026_07_22.md"
+  # git 없는 디렉토리라도 다른 스텝은 조용히 지나간다(모두 2>/dev/null 가드)
+  local out; out=$(bash "$CHECK" "$T" 2>/dev/null)
+  local warned=0
+  printf '%s\n' "$out" | grep -q "⑤-b card-drift" && warned=1
+  rm -rf "$T"
+  if [ "$warned" = "$expect" ]; then
+    echo "✅ $name (warn=$warned, expected=$expect)"
+  else
+    echo "❌ $name — warn=$warned, expected=$expect"
+    FAILED=1
+  fi
+}
+
+run_fixture "P  known-positive: 부재주장+실물존재 → 경고" \
+  "- 🔴 **foo-digest 잡 미가동(07-22)** — 로그도 산출물도 0(launchd 확인 필요)." 1 1
+
+run_fixture "N1 known-negative: 부재주장+진짜부재 → 무경고" \
+  "- 🔴 **bar-report 잡 미가동** — 산출물 0, 미착수." 0 0
+
+run_fixture "N2 과발화가드: 실물존재+부재주장아님 → 무경고" \
+  "- 🟢 **foo-digest 가동 중** — 오늘자 산출 확인." 1 0
+
+run_fixture "N3 정정문맥가드: 부재주장 인용+오판정 명시 → 무경고" \
+  "- 🔴 **foo-digest 산출 누락 수리 미완**. 기존 카드의 \"미가동\"은 오판정이었음." 1 0
+
+run_fixture "N4 날짜토큰가드: 부재주장이나 토큰이 날짜뿐 → 무경고" \
+  "- 🔴 잡 미가동 2026-07-22 산출물 0" 1 0
+
+# challenger A-1 반례 (2026-07-23): 살아있는 주장 + 무관한 debunk 어휘 = 경고가 떠야 한다.
+# debunk-단독 가드는 이 두 줄을 무음 삼켰다(FN) — 인용부 조건이 판별자.
+run_fixture "P2 살아있는 주장+무관한 '정정 필요' → 경고 (A-1 FN 앵커)" \
+  "- 🔴 **foo-digest 미가동 지속** — 산출물 0. 지난 카드의 실행횟수 수치는 정정 필요." 1 1
+
+run_fixture "P3 살아있는 주장+무관한 '거짓' → 경고 (A-1 FN 앵커)" \
+  "- 🔴 **foo-digest 미가동** — 산출물 0, 로그는 거짓 성공만 찍힘" 1 1
+
+run_fixture "N5 위치-언급 디렉토리 → 무경고 (A-2 FP 앵커)" \
+  "- 🟡 bar-report 미생성 — tracks/_meta/ 산출물 0" 0 0
+
+run_fixture "N6 카드 자신 매치 제외 (A-3 FP 앵커)" \
+  "- 🔴 next_session_starter 갱신 부재 — 0건" 0 0
+
+run_fixture "P4 영어 부재주장 (A-4 앵커)" \
+  "- 🔴 **foo-digest job not running** — zero outputs" 1 1
+
+run_fixture "N7 인용된 부재키워드+정정 → 무경고 (실카드 07-22 클래스)" \
+  "- 🔴 foo-digest 산출 누락. 기존 카드의 \"미가동\" 주장은 오판정이었음" 1 0
+
+echo "── card-drift probe calibration: $([ "$FAILED" -eq 0 ] && echo "PASS (전 픽스처) — 배선 가능" || echo "FAIL — 계기 불량, 배선 금지") ──"
+exit "$FAILED"

package/scripts/test_degrade_scan_shell_probes.sh

@@ -155,6 +155,32 @@ n=$(s_hits "$TMP/dependency_guards.sh")
 [ "$n" -eq 2 ] && ok "dependency guards (\`[ -f lib ] || exit 0\`) still detected — scope exclusion did not swallow them" \
                 || bad "dependency guards: expected 2 S-hits, got $n — 'guard library missing → allow' is hidden again"
 
+# S5 known pair — added 2026-07-28 when the probe shipped with NO fixture of its own and every one
+# of the 9 hits it produced in this repo turned out to be a false positive. Both directions are
+# pinned because narrowing an all-FP probe is one edit away from a blind one.
+cat > "$TMP/s5_positive.sh" <<'EOF'
+#!/usr/bin/env bash
+set -uo pipefail
+N=$(find /nope . -maxdepth 1 2>/dev/null | grep -c . || echo 0)
+M=$(git log --oneline 2>/dev/null | wc -l || echo 0)
+EOF
+cat > "$TMP/s5_negative.sh" <<'EOF'
+#!/usr/bin/env bash
+set -uo pipefail
+# `a || b || echo 0` is NOT a pipeline — no stage can emit a second line.
+_mtime() { stat -c %Y "$1" 2>/dev/null || stat -f %m "$1" 2>/dev/null || echo 0; }
+# A pipeline whose failing stage emits nothing: the fallback supplies the only line, as intended.
+J=$(printf '%s' "$x" | jq -r '.a // 0' 2>/dev/null || echo 0)
+# A comment describing the defect must not be scored as the defect: cmd | grep -c . || echo 0
+EOF
+n=$(s_hits "$TMP/s5_positive.sh")
+[ "$n" -eq 2 ] && ok "S5 known-positive: counter-stage fallbacks (grep -c, wc) detected 2/2" \
+                || bad "S5 known-positive: expected 2 S-hits, got $n — the pipefail disarm is invisible"
+
+n=$(s_hits "$TMP/s5_negative.sh")
+[ "$n" -eq 0 ] && ok "S5 known-negative: \`||\` chains, empty-on-failure pipelines and comments stay silent" \
+                || bad "S5 known-negative: $n hit(s) — S5 is noise again (9/9 FP was its measured state)"
+
 n=$(p_hits "$TMP/kp.py")
 [ "$n" -ge 1 ] && ok "python known-positive: pre-existing probes still fire" \
                 || bad "python known-positive: no hits — the Python probes regressed"

package/scripts/test_memory_link_check.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+# test_memory_link_check.sh — known-pair anchor for scripts/memory_link_check.py.
+#
+# WHY: the checker's --fix-separators path WRITES to personal knowledge files. Everything it gets
+# wrong, it gets wrong silently and in bulk. Two of its rules were found only by attacking it:
+#   * a first draft rewrote links inside FENCED blocks — i.e. it "corrected" the examples that
+#     document the convention, which is the probe-damages-the-remedy class;
+#   * a first measurement counted cross-store links as broken, overstating the defect by 44%.
+# Both are pinned below, alongside the classes.
+#
+# Lanes
+#   C1  the five classes separate on a fixture (ok / separator / cross-store-absent / placeholder / dangling)
+#   F1  a link inside a fenced block is COUNTED but never REWRITTEN
+#   F2  a link inside inline backticks IS rewritten (this corpus styles real links that way —
+#       measured 2026-07-28: 25 such links repaired, 0 fenced changes in the same run)
+#   F3  aliased links [[target|alias]] keep their alias
+#   F4  re-running the fixer changes nothing (idempotent)
+#   G1  an empty store reports an extractor failure, never a clean graph
+#
+# Exit 0 = 6/6.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CHK="$ROOT/scripts/memory_link_check.py"
+[ -f "$CHK" ] || { echo "FAIL: $CHK missing"; exit 1; }
+
+pass=0; fail=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+
+TD="$(mktemp -d)"; trap 'rm -rf "$TD"' EXIT
+mkdir -p "$TD/store"
+printf -- '---\nname: real_target\n---\nbody\n' > "$TD/store/real_target.md"
+cat > "$TD/store/src.md" <<'EOF'
+---
+name: src
+---
+plain ok: [[real_target]]
+plain separator: [[real-target]]
+alias: [[real-target|shown as this]]
+inline: `[[real-target]]`
+dangling: [[nothing_here]]
+placeholder: [[link]]
+
+```
+fenced example — must NOT be rewritten: [[real-target]]
+```
+EOF
+
+_run() { python3 "$CHK" --memory "$TD/store" "$@" 2>/dev/null; }
+
+out=$(_run)
+# FIRST match only. `dangling` appears twice in the report — once as a count row and once as a
+# section header ("dangling (nothing on disk...)") — so an unbounded match returned two lines and
+# the numeric comparison silently failed against a correct tool. Instrument fault, fixed here.
+_n() { printf '%s\n' "$out" | awk -v k="$1" '$1==k && $2 ~ /^[0-9]+$/ {print $2; exit}'; }
+if [ "$(_n ok)" = "1" ] && [ "$(_n placeholder)" = "1" ] && [ "$(_n dangling)" = "1" ] && [ "$(_n separator)" -ge 4 ]; then
+  ok "C1 classes separate (ok=$(_n ok) separator=$(_n separator) placeholder=$(_n placeholder) dangling=$(_n dangling))"
+else
+  bad "C1 class counts wrong"; printf '%s\n' "$out" | sed 's/^/     /'
+fi
+
+_run --fix-separators --quiet >/dev/null
+body=$(cat "$TD/store/src.md")
+
+if printf '%s' "$body" | sed -n '/```/,/```/p' | grep -q '\[\[real-target\]\]'; then
+  ok "F1 fenced example left untouched (the documentation of the rule survives the fixer)"
+else
+  bad "F1 the fixer rewrote a link inside a fenced block — it corrected its own example"
+fi
+
+if printf '%s' "$body" | grep -q 'inline: `\[\[real_target\]\]`'; then
+  ok "F2 inline-backticked link repaired (this store's citation style is a real link)"
+else
+  bad "F2 inline-backticked link was not repaired"
+fi
+
+if printf '%s' "$body" | grep -q '\[\[real_target|shown as this\]\]'; then
+  ok "F3 alias preserved through the rewrite"
+else
+  bad "F3 alias lost or target not rewritten"
+fi
+
+before=$(cat "$TD/store/src.md")
+_run --fix-separators --quiet >/dev/null
+if [ "$before" = "$(cat "$TD/store/src.md")" ]; then
+  ok "F4 idempotent on re-run"
+else
+  bad "F4 a second run changed the file again"
+fi
+
+mkdir -p "$TD/empty"
+if python3 "$CHK" --memory "$TD/empty" >/dev/null 2>&1; then
+  bad "G1 an empty store exited 0 — a scan that cannot see its subject reported a clean graph"
+else
+  ok "G1 empty store fails as an extractor error, not a pass"
+fi
+
+
+# H1/A1 — cross-family findings, both confirmed by execution before acceptance.
+#   H1 (agy): an anchor-form link `[[target#section]]` was COUNTED as repairable but the rewrite
+#             enumerated closing forms by hand and never matched it — so it was flagged on every
+#             run (idempotence broken) and the summary reported more fixes than it made.
+#   A1 (gpt-5.5): two notes sharing a normalized name let the fixer reroute an edge to whichever
+#             sorted first, and the wrong link then resolves exactly, so no later run flags it.
+printf -- '---\nname: my_topic\n---\nbody\n' > "$TD/store/my_topic.md"
+printf -- '---\nname: anchored\n---\nanchor: [[my-topic#section-1]]\nplain: [[my-topic]]\n' > "$TD/store/anchored.md"
+_run --fix-separators --quiet >/dev/null
+if grep -q '\[\[my_topic#section-1\]\]' "$TD/store/anchored.md"; then
+  ok "H1 anchor-form link rewritten (target only, #section preserved)"
+else
+  bad "H1 [[target#anchor]] left unrewritten — flagged forever, and the fix count over-reports"
+fi
+# Idempotence here is a STABLE count, not zero: the fenced example is counted every run and
+# deliberately never rewritten, so zero is unreachable by design. Asserting zero was an instrument
+# error in this anchor's first draft — it scored a correct tool as failing.
+before_n=$(out=$(_run); printf '%s\n' "$out" | awk '$1=="separator" && $2 ~ /^[0-9]+$/ {print $2; exit}')
+_run --fix-separators --quiet >/dev/null
+after_n=$(out=$(_run); printf '%s\n' "$out" | awk '$1=="separator" && $2 ~ /^[0-9]+$/ {print $2; exit}')
+if [ "$before_n" = "$after_n" ]; then
+  ok "H1b idempotent with anchor forms present (count stable at $after_n — the fenced example)"
+else
+  bad "H1b count moved $before_n → $after_n across a second fix pass"
+fi
+printf -- 'A\n' > "$TD/store/collide-x.md"; printf -- 'B\n' > "$TD/store/collide_x.md"
+out=$(_run)
+if printf '%s\n' "$out" | grep -q 'ambiguous'; then
+  ok "A1 colliding normalized names surface as a reported class"
+else
+  bad "A1 no ambiguous class — a colliding pair can still be auto-rerouted"
+fi
+
+echo "----"
+echo "memory-link-check anchor: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/test_session_close_lanes.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# test_session_close_lanes.sh — known-pair anchor for session_close_check.sh ② (harvest-loop
+# obligation) and ⑤ (card-last invariant).
+#
+# WHY (2026-07-28): ② used to be an UNSATISFIABLE warning — it fired whenever an FH asset was
+# touched today and the script had no way to observe whether harvest-loop ran, so no session could
+# ever discharge it. A line that fires on every healthy close is noise, and noise trains the runner
+# to skim past the ❌ lines that matter. The repair gave it a mechanical discharge (a harvest-loop
+# decision recorded in TODAY's fh_completed file). This file is that repair's regression anchor:
+# the fix is only real if the ⚠️ still fires when NOTHING is recorded, and stops firing when it is.
+#
+# Lanes (each is a decision the gate must get right, not a smoke test):
+#   ②-N   FH asset touched today, no harvest-loop line anywhere  → ⚠️  MUST fire
+#   ②-P1  same, plus "harvest-loop 실행 완료"                     → ✅  must NOT fire
+#   ②-P2  same, plus an explicit SKIP note                        → ✅  must NOT fire
+#         (CLAUDE.md ② accepts "harvest-loop (or an explicit skip note)" — a recorded skip is
+#          a discharged obligation, not an evaded one)
+#   ②-C   no FH asset touched today                               → neither line appears at all
+#         (over-firing is a defect in its own right — the whole reason this repair exists)
+#   ⑤-N   a close artifact newer than the card                    → ❌ card-last MUST fire (exit 1)
+#   ⑤-P   card is the newest artifact                             → ✅ card-last holds
+#
+# Exit 0 = 7/7 lanes calibrated · exit 1 = the gate's instrument is wrong (do not trust its verdict)
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CHECK="$SCRIPT_DIR/session_close_check.sh"
+TODAY=$(date +%Y-%m-%d)
+FAILED=0
+
+if [ ! -f "$CHECK" ]; then
+  echo "FAIL  session-close lanes: subject $CHECK missing"
+  exit 1
+fi
+
+# Builds a throwaway repo whose HEAD commit touches (or does not touch) an FH asset path.
+_fixture() {  # $1=touch_fh_asset(0/1)  $2=completed-file body (empty = no file)
+  local touch_fh="$1" body="$2" T
+  T=$(mktemp -d)
+  ( cd "$T" \
+    && git init -q . \
+    && git config user.email anchor@local && git config user.name anchor \
+    && if [ "$touch_fh" = 1 ]; then echo x > CLAUDE.md; else echo x > unrelated.txt; fi \
+    && git add -A && git commit -qm "fixture" ) >/dev/null 2>&1
+  mkdir -p "$T/tracks/_meta"
+  [ -n "$body" ] && printf '%s\n' "$body" > "$T/tracks/_meta/fh_completed_${TODAY}.md"
+  printf '# card\n' > "$T/tracks/_meta/reference_next_session_starter.md"
+  printf '%s' "$T"
+}
+
+_lane() {  # $1=name  $2=grep-pattern  $3=expect(0/1)  $4=fixture dir
+  local name="$1" pat="$2" expect="$3" T="$4" out hit
+  out=$(bash "$CHECK" "$T" 2>/dev/null)
+  hit=0
+  printf '%s\n' "$out" | grep -q "$pat" && hit=1
+  rm -rf "$T"
+  if [ "$hit" = "$expect" ]; then
+    echo "✅ $name (hit=$hit, expected=$expect)"
+  else
+    echo "❌ $name — hit=$hit, expected=$expect"
+    printf '%s\n' "$out" | sed 's/^/     /'
+    FAILED=1
+  fi
+}
+
+WARN2='⚠️  ② FH assets changed today'
+OK2='✅ ② FH assets changed today'
+
+_lane "②-N  no harvest-loop decision recorded → warns" "$WARN2" 1 "$(_fixture 1 '- 항목 하나')"
+_lane "②-P1 harvest-loop run recorded → silent"        "$WARN2" 0 "$(_fixture 1 '- harvest-loop 실행 완료')"
+_lane "②-P2 explicit skip note → silent"               "$WARN2" 0 "$(_fixture 1 '- harvest-loop: skipped — 3-repo session, deferred')"
+_lane "②-P1 run recorded → prints the ✅ form"          "$OK2"   1 "$(_fixture 1 '- harvest-loop 실행 완료')"
+_lane "②-C  no FH asset touched → no ② line at all"    ' ② '    0 "$(_fixture 0 '- 항목 하나')"
+
+# ⑤ card-last: an artifact newer than the card is the bug class the invariant exists to catch.
+T=$(_fixture 1 '- harvest-loop 실행 완료')
+touch "$T/tracks/_meta/fh_completed_${TODAY}.md"   # make it strictly newer than the card
+if bash "$CHECK" "$T" >/dev/null 2>&1; then
+  echo "❌ ⑤-N  artifact newer than card → expected exit 1, got 0 (card-last not enforced)"
+  FAILED=1
+else
+  echo "✅ ⑤-N  artifact newer than card → exit 1 (card-last enforced)"
+fi
+touch "$T/tracks/_meta/reference_next_session_starter.md"   # card becomes newest
+if bash "$CHECK" "$T" >/dev/null 2>&1; then
+  echo "✅ ⑤-P  card newest → exit 0"
+else
+  echo "❌ ⑤-P  card newest → expected exit 0, got 1 (over-blocking: trains --no-verify)"
+  bash "$CHECK" "$T" 2>&1 | sed 's/^/     /'
+  FAILED=1
+fi
+rm -rf "$T"
+
+if [ "$FAILED" -ne 0 ]; then
+  echo "SESSION-CLOSE LANES: FAIL — the gate's instrument is miscalibrated"
+  exit 1
+fi
+echo "SESSION-CLOSE LANES: PASS (7/7)"
+exit 0

package/templates/degrade_direction_scan.sh

@@ -150,9 +150,24 @@ for f in "${FILES[@]}"; do
     # S5 — the pipefail-fallback disarm: `... | grep -c ... || echo 0` appends a SECOND line under
     #   `set -o pipefail`, so the later `-gt` integer test becomes a bash error (= false) and the guard
     #   passes silently, with the error going only to stderr. Measured class, 2026-07-26.
+    #
+    # NARROWED 2026-07-28 after hand-verifying all 9 hits this repo produced: 9/9 were false
+    # positives, i.e. the probe was pure noise for its own class, and 100% FP trains dismissal of
+    # the one hit that will matter. Two distinct causes, both mechanically reproduced:
+    #   (a) `a || b || echo 0` was read as a pipeline — the old regex could anchor its `\|` on the
+    #       SECOND bar of the first `||`. No pipe exists, so no second line can ever be produced.
+    #       (Every `_mtime() { stat -c %Y … || stat -f %m … || echo 0; }` in the tree was flagged.)
+    #   (b) a real pipeline whose failing stage emits NOTHING (`… | jq -r … || echo 0`) — the
+    #       fallback then supplies the only line, which is exactly the intended behavior.
+    # The disarm needs BOTH a real pipe AND a final stage that emits regardless of upstream failure
+    # — a counter (`grep -c`, `wc`). That is the measured shape: `find … | grep -c . || echo 0`
+    # yields "9\n0" and the `-gt` guard goes silent. Verified as a known pair (both directions) in
+    # scripts/test_degrade_scan_shell_probes.sh; narrowing without that anchor would just trade a
+    # noisy probe for a blind one.
     while IFS= read -r m; do
-      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline — under \`set -o pipefail\` this yields a multi-line value whose integer comparison errors out and silently passes the guard; split the pipeline and sanitize to an integer"
-    done < <(grep -nE '\|[^|]+\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline ending in a counter (grep -c/wc) — that stage emits even when an upstream stage fails, so under \`set -o pipefail\` the value gains a SECOND line, the integer comparison errors out, and the guard passes silently; split the pipeline and sanitize to an integer"
+    done < <(grep -nE '[^|]\|[[:space:]]*([a-z]+[[:space:]]+)*(grep[^|]*-c|wc)[^|]*\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+             | grep -vE '^[0-9]+:[[:space:]]*#' \
              | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
   fi
 

package/plugins/fh-meta/skills/context-bridge-dispatch/SKILL.md

@@ -1,32 +0,0 @@
----
-name: context-bridge-dispatch
-description: >-
-  DEPRECATED — merged into agent-composer Step 3-a (2026-06-02).
-  Context Card injection (N≤2 standard / N≥3 Registry mode) + coordination-overhead budget + Focus Mode
-  are now part of agent-composer Step 3. Invoke /agent-composer for parallel dispatch.
-user-invocable: false
-allowed-tools: []
-model: sonnet
-deprecated: true
-deprecated_reason: absorbed into agent-composer Step 3-a
-deprecated_date: 2026-06-02
-successor: agent-composer
----
-
-# context-bridge-dispatch — DEPRECATED
-
-> **Merged into `agent-composer` Step 3-a (2026-06-02).**
-> Context Card injection, Registry mode, coordination-overhead budget, and Focus Mode are now part of agent-composer Step 3.
-> Use `/agent-composer` for all parallel dispatch with context injection.
-
-## Content preserved at
-
-`plugins/fh-meta/skills/agent-composer/SKILL.md §Step 3-a` — the live successor.
-
-> The original pre-merge content is preserved in git history (this stub's earlier revisions); the
-> shipped `SKILL_detail.md` archive was removed in the curator shrink (2026-06-16) as redundant with
-> git history. No live content lost — the functional content lives in agent-composer Step 3-a.
-
-## Done When
-
-Deprecated — no active execution path. Done When: skill is never directly invoked; all dispatch routes through `/agent-composer` Step 3-a (the successor). This entry satisfies the harness-doctor L2 M-tier requirement for missing Done When (CLAUDE.md §New Skill Creation Pre-Commit Gate).

package/plugins/fh-meta/skills/self-marketing-lint/SKILL.md

@@ -1,30 +0,0 @@
----
-name: self-marketing-lint
-description: >-
-  DEPRECATED — merged into harness-doctor --lint mode (2026-06-02).
-  Language pattern detection (self-marketing, cushion words, version labels) is now Step 3-L of harness-doctor.
-  Use /harness-doctor --lint instead.
-user-invocable: false
-allowed-tools: []
-model: sonnet
-deprecated: true
-deprecated_reason: absorbed into harness-doctor Step 3-L (--lint mode)
-deprecated_date: 2026-06-02
-successor: harness-doctor
----
-
-# self-marketing-lint — DEPRECATED
-
-This skill was absorbed into **harness-doctor** on 2026-06-02. Its self-marketing /
-cushion-word / version-brag detection patterns now live in **harness-doctor Step 3-L
-(`--lint` mode)**, which carries the canonical baseline.
-
-**Use instead:**
-
-```
-/harness-doctor --lint
-```
-
-Triggers that previously reached this skill (`check FH files`, `remove marketing
-language`, `description diet`) now route to harness-doctor Step 3-L. This stub remains
-only so old references resolve.