@chrono-meta/fh-gate 1.4.76 → 1.4.77

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.76",
+      "version": "1.4.77",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.76",
+      "version": "1.4.77",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/CLAUDE.md

@@ -531,7 +531,7 @@ Proposal format: `"I see [X]. Want me to run /[skill] to [one-line description]?
 | **"진단해줘", "개선해줘", "diagnose this", "improve this harness", "check this project", "audit this project"** — said while working **in a mapped project** (not a single-file ask) | **Field-Harness Diagnostic** (see §Field-Harness Diagnostic above → compose existing checks into one ranked M/S/R list → HITL approval per item, nothing auto-fixed) |
 | **"새 프로젝트", "하네스 작성해줘", "이 프로젝트 가속화", "harness-ify this", "accelerate this project"** — an onboarding/acceleration door (returning-menu ①②③) | **Onboarding / Acceleration Autopilot** (see §Onboarding / Acceleration Autopilot above → Phase 0 auto-discover + branch → innovator-centered recommend → ranked install plan → HITL per item, non-overwriting; "끝까지 자율로" → full-autonomy under /goal-quench gate) |
 
-**Guard**: Do not propose a skill that is already running. One signal = one-line proposal (no pressure). Before proposing, consult the UAP (§Operational Adaptation Loop): a skill the user has rejected 3+ times is **suppressed**, not re-proposed.
+**Guard**: Do not propose a skill that is already running. One signal = one-line proposal (no pressure). Before proposing, consult the UAP (§Operational Adaptation Loop): a skill the user has rejected 3+ times is **suppressed**, not re-proposed — and, symmetrically, a class **accepted 3× consecutively** earns a one-time "stop asking?" offer (§Consent promotion; never on irreversible surfaces).
 For per-skill utterance patterns, see the relevant `SKILL.md §Trigger Phrases` section.
 
 ### Cadence Rules — Check at Session Start
@@ -564,7 +564,8 @@ Some proposals are not *time*-overdue — they fire **once when a specific work
 Self-healing is not only FH-self-dev (Mode D 4-axis) and reactive (`verify-bidirectional`). A **standing, per-user operational loop** tunes FH behavior to the individual during normal field use, and escalates **only generalizable** learnings to the `field-harvest` → FH-origin PR funnel — idiosyncratic taste stays local (drift guard).
 
 - **User Adaptation Profile (UAP)** — `tracks/_meta/user_adaptation_profile.md` (local/gitignored; **behavioral prefs only, never domain content**). Records skill-proposal outcomes (`accepted`/`rejected`/`sustained` — same vocabulary as `operations.md`), preferred tier/language/cadence, recurring friction, muted nags.
-- **Pass** — rides `field-harvest` Mode B at field-session close (no new trigger, one per session): READ to apply (suppress a 3×-rejected proposal, default to preferred tier, mute declined cadence nags), WRITE to update outcomes.
+- **Pass** — rides `field-harvest` Mode B at field-session close (no new trigger, one per session): READ to apply (suppress a 3×-rejected proposal, **offer standing consent on a 3×-accepted class**, default to preferred tier, mute declined cadence nags), WRITE to update outcomes.
+- **Consent promotion (accept-side)** — repeated approval must offer to stop asking, not bill the same prompt forever: 3 consecutive `accepted` on a **registered** class (`tracks/_meta/consent_classes.yaml` — classes are declared, never minted mid-run) → **offer once, quoting the three approvals and the exact scope** → granted = a **time-limited lease**, revocable, and every unprompted run announces itself. **Not symmetric with suppression**: a bad suppression costs a re-ask, a bad grant has side effects. **Floor, decided mechanically from the registry — never by the session's own judgment**: a class never promotes if its sinks are irreversible (publish · delete · history-rewrite), if it *feeds* such a sink (**taint propagates through reversible steps**), or if that is **unknown** — unknown is not reversible. No UAP / no registry entry / expired → keep asking (absent ≠ granted). **Named residual: the ledger is self-attested** — mitigated (append-only, quoted evidence), not closed.
 - **Generalization gate** — idiosyncratic → UAP local; generalizable (any user benefits; `≥40%` reject = redefine candidate / `≥60%` accept = reinforce, per `operations.md` gate) → `field-harvest` Mode A → FH PR (HITL).
 - **Ephemeral guard** — UAP is gitignored, wiped on cloud reclaim; in ephemeral sessions operate from defaults, do not fabricate it.
 
@@ -699,6 +700,10 @@ Closing phrase detected ("wrap up", "done", "good work", "end session", etc.)
        outcomes. ⑤ is ATOMIC and owns BOTH writes: (a) append any close-time finding to
        `fh_completed_{date}.md` FIRST, (b) then write the card. Once ⑤ starts, `fh_completed`
        is CLOSED — a later append re-opens the violation ⑤ exists to prevent.
+       **Late finding (named case)**: a finding that surfaces AFTER (b) — including while writing
+       the final message to the operator — means ⑤ is **not done**. Re-run ⑤ **whole**: append,
+       then **rewrite the card**. Appending alone is the violation; the card must never be older
+       than `fh_completed`.
   → ⑥ Commit card + push
 ```
 

package/knowledge/shared/rules/operational_adaptation.md

@@ -28,9 +28,136 @@ This loop fills that gap. It is deliberately thin: it **reuses** existing parts
 
 Runs at field-session close, **riding `field-harvest` Mode B** — no new trigger, never an interception. One pass per session.
 
-- **READ** (session start / proposal time): apply UAP — suppress a skill proposal rejected 3+ times (an `accepted` record carries **no** positive auto-action — the skill simply stays surfaced; do not auto-run on acceptance), default to the preferred tier, mute cadence nags the user always declines, and **apply capability-escalation consent** (`sidecar_consent`/`floorup_consent` `declined` → route to the Sonnet / Tier-3 floor, recommend-only, no re-nag; `unset` → ask-once at first need per the consent protocol). (Tier note: the UAP tier default is a session-depth setting; the Mode D model notice is model-only + advisory and never overrides it.)
+- **READ** (session start / proposal time): apply UAP — suppress a skill proposal rejected 3+ times, apply any **standing consent** granted per §Consent promotion below (an `accepted` record on its own still carries **no** positive auto-action — acceptance alone never auto-runs anything; only a granted standing consent does), default to the preferred tier, mute cadence nags the user always declines, and **apply capability-escalation consent** (`sidecar_consent`/`floorup_consent` `declined` → route to the Sonnet / Tier-3 floor, recommend-only, no re-nag; `unset` → ask-once at first need per the consent protocol). (Tier note: the UAP tier default is a session-depth setting; the Mode D model notice is model-only + advisory and never overrides it.)
 - **WRITE** (session close): update outcome counts + new friction points.
 
+## Consent promotion (accept-side) — repeated approval must offer to stop asking
+
+The suppression rule above is **one-directional**: repeated *rejection* changes FH's behavior, repeated
+*approval* changed nothing, so a user who approves the same class every time keeps paying the same
+prompt forever. That asymmetry is the defect this section closes. It is the general-user form of the
+elastic-granularity principle already granted to the operator (`feedback_hitl_elastic_granularity_cto`):
+**the floor is fixed, the approval grain is not.**
+
+**Promotion is not the mirror image of suppression.** Rejection suppresses a *proposal* — a wrong
+suppression costs one manual re-ask. Acceptance authorizes an *action* with the user absent — a wrong
+grant has side effects. Symmetric machinery over asymmetric stakes is itself the error (cross-family
+review, 2026-07-29). So the accept side carries three things the reject side does not: an **explicitly
+scoped** class, an **expiry**, and a **separate confirmation** that is not the same "yes" that approved
+the action in front of the user.
+
+**Classes are declared, never minted at runtime** (this is what makes the trigger mechanical). A class
+is promotion-eligible only if it exists in the **consent-class registry**, `tracks/_meta/consent_classes.yaml`,
+declaring: `owner` (gate/skill) · `mode` · `target scope` · `capabilities` (read / local-write /
+network / dispatch / repo-mutation) · `sinks` (what downstream surface the action can reach). A session
+may **propose** a registry entry (HITL, like any asset) but may **not** invent one mid-run and start
+counting against it. *Origin: without a registry the guard below did not bind — the class could simply
+be recorded over-broad at birth (`sim-conductor` rather than `dispatch read-only sim on a local
+artifact`), and no after-the-fact widening rule can catch a class that was born wide.*
+
+**Registry authorship is itself a capture surface** (cross-family round 2): closing runtime minting
+still leaves the agent drafting a broad entry, framing it as housekeeping, and later enjoying the
+approved breadth. So a proposed entry is promotion-eligible only after it carries (a) an explicit
+`excludes:` list of neighbouring actions the class must **not** cover, (b) 2+ **adversarial examples** —
+concrete actions a reader might assume are inside and that the author asserts are outside — and (c) a
+review by something other than the proposing session (the human, or a cross-family auditor). A class
+definition is reviewed as a **grant of future autonomy**, not as a config row.
+
+**Mechanical floor**: `scripts/consent_registry_check.sh` — joins `standing_consent` against the
+registry and enforces schema, eligibility soundness (a class naming an irreversible or unlisted sink
+**cannot** declare itself promotable), registration, expiry, and recorded scope. Missing registry → N/A
++ promotion disabled; unparseable → fail-closed. Run it before trusting any grant; the prose above is
+the salience layer over this check, not the enforcement.
+
+**Trigger**: the same registered class recorded `accepted` **3 consecutive times**, counted across
+sessions from the UAP outcome log. Refinements that keep the count honest:
+- *Consecutive* means consecutive **within that class's own entries**; other classes interleaved do not
+  break the streak, a single `rejected` or `modified` does. An approval the user altered before granting
+  is logged `modified`, never `accepted`.
+- **Only a promotion-eligible approval prompt counts** — one user gesture, one entry. **Retries of the
+  same operation count once**, and one "yes, do those three" is **one** approval, not three. Ordinary
+  supervised retry ("응, 다시 해봐" ×3) is not durable consent and must never reach the threshold.
+- The running count is **visible to the user at each approval** (`1/3` · `2/3` · `3/3`), so the offer is
+  never the first time they learn a streak was being tallied.
+
+**Action — offer once, with the evidence in the offer**:
+
+> "`<class>` 을 3번 연속 승인했다 (`<date1>`, `<date2>`, `<date3>` — 각각 `<one-line what was approved>`).
+>  범위: `<mode · target · capabilities · sinks>`. 앞으로 `<N>`일간 안 묻고 진행할까?
+>  (언제든 '다시 물어봐')"
+
+The offer **quotes the three approvals and the exact scope**; a grant the user cannot audit is not
+consent. Then:
+
+- **granted** → write `standing_consent: <class>: {granted: <date>, expires: <date+N>, effects: [...]}`.
+  Later instances run unprompted, each **states in one line what it did**, and each **appends a durable
+  entry to `tracks/_meta/consent_runs.log`**. *Post-action chat notice is not a control* (cross-family
+  round 2): a line the user scrolls past has stopped the prompt without replacing it. The chat line is
+  courtesy; the log is the audit surface, and it is the reason standing consent may cover only actions
+  that are **recoverable and locally reviewable** — an unrecoverable action was already excluded by the
+  floor, and an unreviewable one is excluded here.
+  **Expiry is not optional** — at expiry the consent lapses to `unset` and the class is asked again;
+  standing consent is a renewable lease, not a transfer of the decision.
+- **declined** → write `declined`. **Never ask again for that class version** — the same no-re-nag rule
+  as muted cadence reminders. *Scoped to the version, not forever*: a user may decline because the
+  timing was wrong, and permanent suppression with no renewal path is its own defect. A re-offer is
+  allowed only when the class is **materially narrowed** (a new registry version with strictly smaller
+  scope) or the user asks. Re-offering the same scope is a nag.
+- Revocation is always available and never negotiated: "다시 물어봐" / "revoke" → `unset`.
+
+**Floor — what never promotes (규약; this is the whole constraint)**: promotion is available only where
+the *protocol still passes*. Applicability is decided **mechanically, from the registry entry — never by
+the running session's judgment**, because the session that wants to stop being asked is the worst
+possible arbiter of whether it may. A class never promotes, at any count, when:
+
+1. its `sinks` include an **irreversible surface** — publish / go-public, delete, history-rewrite, or any
+   surface guarded by a fail-closed Irreversibility gate (`CLAUDE.md §Irreversibility Gates`); **or**
+2. it **feeds, queues, or enables** such a sink even though it does not itself cross one — **sink
+   tainting**. Reversible steps compose into irreversible outcomes: "edit workflow config" + "write
+   release notes" + "create local commit" are each locally reversible, and a CI workflow publishes the
+   result. Taint propagates along that chain; the floor is inherited, not re-derived per step; **or**
+3. its irreversibility is **unknown or not yet classified** → **no promotion, ask**. Unknown is not
+   reversible. (An unregistered class is by definition unknown, which is why 1–3 collapse to a single
+   mechanical test against the registry.)
+
+Their cost is not the prompt, it is that the thing cannot be undone — grain-independent by construction.
+**The promotion offer itself is HITL**: this section grants no path to auto-approval the user did not
+answer "yes" to once, knowingly and in scope, which is why it does not contradict the "acceptance alone
+never auto-runs" rule above.
+
+**Degrade direction (fail-closed), three ways**: no UAP (ephemeral/cloud session, wiped profile) → **no
+promotion, keep asking**. No registry entry → **no promotion, keep asking**. Expired or unparseable
+record → **`unset`, keep asking**. A missing consent record is never `granted` — an absent measurement is
+not a yes.
+
+**Named residual — the ledger is self-attested (cross-family, 2026-07-29, HIGH, NOT closed).** The UAP
+outcome log is written by the same agent that benefits from fewer prompts, and it is gitignored, so there
+is no ordinary review trail. Nothing in this section fixes that; the honest mitigations only *narrow* it:
+consent events are **append-only** (an entry is superseded, never edited or deleted), the offer must
+**quote the three approvals verbatim** so a user can catch a fabricated streak at the one moment it
+matters, and every unprompted run **announces itself**. A real fix requires the consent record to be
+produced by the approval channel rather than by the consuming agent — outside this rule's reach. **Until
+then, treat every standing consent as auditable-by-the-user-only, and never widen the mechanism's scope
+on the assumption the ledger is trustworthy.**
+
+**Consent binds to the action's SHAPE, not its label** (found by blind target-tier sim, 2026-07-29):
+a class name is a string, and the action behind it can change after consent is granted. A sim that
+merely returned a report when you said "stop asking" may, ten sessions later, write into shared memory
+and trigger a downstream commit — same label, different blast radius, HITL skipped. So a grant records
+**what it was granted for**: the owning gate/skill, and the set of **effect classes** the action had at
+grant time (reads · local writes · network · dispatch · repo-mutation) **plus the `target` scope and
+the `sinks` fingerprint**. On any later run whose fingerprint is **not a subset** of the granted one,
+standing consent **reverts to `unset` and asks again**, naming what widened. Effect classes alone are
+too coarse to be the whole test (cross-family round 2): "local write" stays "local write" whether the
+target is a scratch report or a policy file — the *target* is where that drift shows, which is why it
+is part of the fingerprint and not merely descriptive. Widening is the trigger; narrowing is not. This is the same discipline as the
+byte-identity anchors used elsewhere: consent is pinned to a fingerprint, not to a name, because
+**the name is exactly what does not change when the danger does.**
+
+**Guard against class inflation**: the class recorded is the *narrow* one that was actually approved
+3×, never a widened parent. Three approvals of "dispatch a Sonnet sim" do not grant "dispatch any
+agent" (`feedback_scope_widening_needs_grounding` — widening judgments get no free pass).
+
 ## Generalization gate → reverse-PR funnel
 
 This is the operator's **"원본 반영 가치"** criterion made mechanical. Split each UAP learning:
@@ -46,6 +173,8 @@ This is the operator's **"원본 반영 가치"** criterion made mechanical. Spl
 
 - **UAP WRITE ran** at field-session close (or was correctly skipped — absent profile / ephemeral session). *Check class: mandatory-pass (binary — did Step 5-B.1 execute or log a skip reason).*
 - **UAP READ applied** at session start / proposal time when a profile exists (preferred tier defaulted, 3×-rejected proposals suppressed, declined cadence nags muted). *Check class: judged, pair: the target-tier blind sim below.*
+- **A class at 3 consecutive `accepted`** was either offered promotion once, or correctly not offered with the reason recorded (irreversible surface · already `declined` · no UAP). *Check class: measured — the consecutive count is read off the UAP outcome log, not recalled.*
+- **Every `standing_consent` key resolves to a registry entry whose `sinks` are irreversible-free, and is unexpired.** *Check class: mandatory-pass (binary — join `standing_consent` keys against `consent_classes.yaml`, reject any key that is unregistered, taint-reachable to an irreversible sink, or past `expires`; any hit is a defect, not a judgment call).*
 - **No domain content** entered the UAP this session. *Check class: judged, pair: phantom/content scan of the UAP diff.*
 
 ## Guards

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.76",
+  "version": "1.4.77",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -106,6 +106,10 @@
     "scripts/test_memory_link_check.sh",
     "scripts/memory_nearcheck.py",
     "scripts/sidecar_wait.sh",
+    "scripts/test_sidecar_wait_stdin.sh",
+    "scripts/consent_registry_check.sh",
+    "scripts/test_consent_registry.sh",
+    "templates/consent_classes.yaml.example",
     "scripts/test_session_close_lanes.sh",
     "scripts/test_card_drift_probe.sh",
     "scripts/universal_guard_check.sh",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.76",
+  "version": "1.4.77",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.76",
+  "version": "1.4.77",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/scripts/consent_registry_check.sh

@@ -0,0 +1,390 @@
+#!/usr/bin/env bash
+# consent_registry_check.sh — mechanical floor for accept-side consent promotion.
+#
+# WHY (cross-family review round 2, 2026-07-29)
+#   Round 1 verdict on the prose rule was REJECT; the revision moved it to NARROW-IT, and the
+#   reviewer's sharpest remaining point was that the revision "reads mechanical" while several of its
+#   predicates — sink tainting, promotion eligibility, effect-subset, expiry — were still semantic.
+#   A rule that reads as a control but cannot be checked is worse than an absent one: it buys the
+#   confidence without the enforcement. This script is the missing half. It does not judge; it joins
+#   `standing_consent` against the declared registry and fails closed on anything it cannot decide.
+#
+# WHAT IT ENFORCES (all mechanical — no model, no judgment)
+#   R1  registry schema — every class carries all required fields
+#   R2  eligibility soundness — promotion_eligible:true is FORBIDDEN when sinks/feeds are non-empty
+#       or contain `unknown` (the taint + unknown-is-not-reversible rules)
+#   R3  join     — every standing_consent key resolves to a registered class
+#   R4  floor    — every standing_consent key resolves to a promotion_eligible class
+#   R5  lease    — every grant carries `expires` and is not past it
+#   R6  scope    — every grant records `effects` AND `target`, so the subset check has something to
+#                  compare against (a grant whose scope was never recorded cannot be re-validated)
+#
+# WHAT IT DOES *NOT* CHECK (named, so the prose above it cannot over-claim)
+#   - the effect-SUBSET comparison itself. R6 proves a baseline was recorded; it does not compare a
+#     live action's fingerprint against it, because this script never sees the live action. That
+#     comparison is still a runtime obligation of the rule, i.e. still salience-dependent.
+#   - the 3-consecutive count, retry dedupe, and same-operation identity — those live in the UAP
+#     logger, not here.
+#   - `excludes` / adversarial examples / independent review on a registry entry — required by the
+#     rule, not yet mechanized. Do not read a PASS here as "the registry was reviewed."
+#   - the existence or contents of `consent_runs.log`.
+#   A PASS from this script means the registry and the grants are WELL-FORMED and the floor join
+#   holds. It does not mean the promotion mechanism as a whole was verified.
+#
+# DEGRADE DIRECTION
+#   No registry file        -> exit 0, prints "N/A: promotion DISABLED" (safe: nothing can promote)
+#   No UAP file             -> exit 0, same
+#   Unparseable either file -> exit 1 (fail-closed: cannot decide == not allowed)
+#   Any R1-R6 violation     -> exit 1
+#
+#   "N/A" is printed as N/A, never as PASS — an unmeasured surface is not a clean one.
+#
+# Usage: bash scripts/consent_registry_check.sh [registry.yaml] [uap.md-or-yaml]
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REG="${1:-$ROOT/tracks/_meta/consent_classes.yaml}"
+UAP="${2:-$ROOT/tracks/_meta/user_adaptation_profile.md}"
+
+python3 - "$REG" "$UAP" <<'PY'
+import sys, os, re, datetime
+reg_path, uap_path = sys.argv[1], sys.argv[2]
+
+def out(sym, msg): print(f"  {sym} {msg}")
+
+if not os.path.exists(reg_path):
+    print(f"consent-registry: N/A — no registry at {reg_path}; promotion DISABLED (not a PASS)")
+    sys.exit(0)
+
+try:
+    import yaml
+except ImportError:
+    print("consent-registry: FAIL — pyyaml unavailable, cannot validate; fail-closed")
+    sys.exit(1)
+
+# H9 DUPLICATE YAML KEYS. yaml.safe_load is last-wins on duplicate mapping keys, so
+# `expires: 2020-01-01` followed by `expires: 2099-01-01` silently keeps the future one, and a
+# duplicated grant key keeps whichever was written last. A consent record whose meaning depends on
+# which duplicate a parser happens to keep is not a record. Reject duplicates at load time.
+class NoDupLoader(yaml.SafeLoader):
+    pass
+
+def _no_dup(loader, node, deep=False):
+    # Resolve `<<: *anchor` merge keys FIRST. Without this the merge key survives as a literal `<<`
+    # entry and a perfectly ordinary DRY registry was refused (measured: a valid grant written via
+    # a merge key exited 1 as an unregistered class). Over-blocking is not a safety win — it trains
+    # the override reflex and turns the gate into decoration, so it counts as a defect like any
+    # fail-open.
+    loader.flatten_mapping(node)
+    seen = set()
+    for k, _ in node.value:
+        key = loader.construct_object(k, deep=deep)
+        try:
+            if key in seen:
+                raise ValueError(f"duplicate key {key!r}")
+        except TypeError:
+            pass
+        seen.add(key)
+    return yaml.SafeLoader.construct_mapping(loader, node, deep)
+
+NoDupLoader.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, _no_dup)
+
+def load(text_or_stream, what):
+    global fails
+    try:
+        return yaml.load(text_or_stream, Loader=NoDupLoader)
+    except Exception as e:
+        print(f"consent-registry: FAIL — {what} unparseable ({e}); fail-closed")
+        sys.exit(1)
+
+fails = 0
+reg = load(open(reg_path), "registry")
+
+REQUIRED = ["name", "owner", "mode", "target", "capabilities", "sinks", "feeds", "promotion_eligible"]
+STR_FIELDS = ["name", "owner", "mode", "target"]
+IRREVERSIBLE = {"go-public", "publish", "delete", "history-rewrite", "unknown"}
+NON_GRANT = {"declined", "unset", "revoked"}
+MAX_LEASE_DAYS = 365
+
+# The single normalizer for every scope comparison. Case-SENSITIVE by choice (a capability name is
+# an identifier, not prose) and whitespace-insensitive; the point is that one function decides, so
+# the two sides of a comparison can never drift apart.
+def _norm(s):
+    return str(s).strip()
+
+# H1 FALSY CONTAINERS. `reg or {}` / `classes or []` laundered `false`, `0`, `[]` and a bare
+# `classes:` into a valid-empty registry that exited 0 — the same falsy-collapse defect already
+# fixed on the GRANT side, left unfixed here. Half a fix propagated is a hole. Sentinel, then type,
+# then default — and an empty registry is stated as N/A, never as a clean pass.
+if not isinstance(reg, dict):
+    print(f"consent-registry: FAIL — registry root is {type(reg).__name__}, not a mapping; fail-closed")
+    sys.exit(1)
+if "classes" not in reg:
+    print("consent-registry: FAIL — registry has no `classes` key; fail-closed")
+    sys.exit(1)
+classes = reg["classes"]
+if classes is None:
+    classes = []
+if not isinstance(classes, list):
+    print(f"consent-registry: FAIL — `classes` is {type(classes).__name__}, not a list; fail-closed")
+    sys.exit(1)
+if not classes:
+    print("consent-registry: N/A — registry declares zero classes; promotion DISABLED (not a PASS)")
+    sys.exit(0)
+
+by_name = {}
+for i, c in enumerate(classes):
+    if not isinstance(c, dict):
+        out("❌", f"R1 class #{i} is not a mapping"); fails += 1; continue
+    nm = c.get("name", f"<unnamed #{i}>")
+    missing = [f for f in REQUIRED if f not in c]
+    if missing:
+        out("❌", f"R1 `{nm}` missing required field(s): {', '.join(missing)}"); fails += 1
+        continue
+    # R1-b STRICT TYPES. `promotion_eligible: "false"` (quoted) is a truthy STRING, so every
+    # eligibility test below silently inverts and an intended-ineligible class becomes promotable.
+    # Measured 2026-07-29 against a control: quoted "false" PASSed a grant that real `false` blocked.
+    # One quote character disarmed the floor — so the type is checked, not coerced.
+    if not isinstance(c["promotion_eligible"], bool):
+        out("❌", f"R1-b `{nm}` promotion_eligible must be a YAML boolean, got "
+                  f"{type(c['promotion_eligible']).__name__} {c['promotion_eligible']!r} "
+                  f"(a quoted \"false\" is truthy and would invert the floor)")
+        fails += 1; continue
+    # H2 scalar fields: a `mode: 123` or `target: ""` described nothing, so the entry a human was
+    # asked to review as a grant-of-future-autonomy was unreadable. H3 list ITEMS were never typed,
+    # only their container — `sinks: [123]` counted as a declared sink.
+    bad_field = False
+    for fld in STR_FIELDS:
+        if not isinstance(c[fld], str) or not c[fld].strip():
+            out("❌", f"R1-b `{nm}` `{fld}` must be a non-blank string, got "
+                      f"{type(c[fld]).__name__} {c[fld]!r}")
+            fails += 1; bad_field = True
+    for fld in ("capabilities", "sinks", "feeds"):
+        if not isinstance(c[fld], list):
+            out("❌", f"R1-b `{nm}` `{fld}` must be a list, got {type(c[fld]).__name__}")
+            fails += 1; bad_field = True
+        elif not all(isinstance(x, str) and x.strip() for x in c[fld]):
+            out("❌", f"R1-b `{nm}` `{fld}` must contain only non-blank strings, got {c[fld]!r} "
+                      f"— an unreadable sink is an UNDECLARED sink, and undeclared is unknown")
+            fails += 1; bad_field = True
+    if bad_field:
+        continue
+    # R1-c UNIQUE NAMES. Consent is keyed by class name; a duplicate silently shadowed the earlier
+    # entry, so appending an eligible twin below an ineligible one granted the ineligible class.
+    if nm in by_name:
+        out("❌", f"R1-c duplicate class name `{nm}` — consent is keyed by name, so a duplicate "
+                  f"shadows the earlier entry and can launder an ineligible class")
+        fails += 1; continue
+    by_name[nm] = c
+    # R2 — eligibility must be SOUND, not merely asserted. This is the line that stops a class from
+    # declaring itself promotable while naming an irreversible sink two fields above.
+    taint = set(map(str, c["sinks"] or [])) | set(map(str, c["feeds"] or []))
+    bad = taint & IRREVERSIBLE
+    if c["promotion_eligible"] and bad:
+        out("❌", f"R2 `{nm}` claims promotion_eligible:true but sinks/feeds include {sorted(bad)}")
+        fails += 1
+    elif c["promotion_eligible"] and taint:
+        out("❌", f"R2 `{nm}` claims promotion_eligible:true with non-empty sinks/feeds {sorted(taint)} "
+                  f"— unlisted sinks are UNKNOWN, and unknown is not reversible")
+        fails += 1
+
+if fails == 0:
+    out("✅", f"R1/R2 registry schema + eligibility soundness ({len(by_name)} class(es))")
+
+# ---- standing_consent side --------------------------------------------------------
+if not os.path.exists(uap_path):
+    print(f"consent-registry: N/A — no UAP at {uap_path}; nothing granted (not a PASS)")
+    sys.exit(1 if fails else 0)
+
+raw = open(uap_path, errors="replace").read()
+# Match BOTH the block form (`standing_consent:` then an indented body) and the inline flow form
+# (`standing_consent: {a: {...}}`). The first version matched only the block form, so an inline
+# grant — including an EXPIRED one — was read as "no standing consent recorded" and reported PASS.
+# A grant the checker cannot see is not an absent grant; that is a false clean, the worst outcome
+# for a floor. Measured 2026-07-29 with a control (block form caught it, inline form did not).
+grants = {}
+# FIRST-MATCH SHADOWING (cross-family round 4, confirmed against a control): reading only the first
+# `standing_consent:` meant a benign or empty one earlier in the file HID a real grant later in it —
+# `standing_consent: {}` followed by an expired grant reported PASS, while the same expired grant
+# alone was caught. A checker that stops at the first occurrence is trivially defeated by appending.
+# There is exactly one consent block or the file is not decidable.
+# YAML-KEY EQUIVALENCE (round 6): `standing_consent : {...}` — a space or tab before the colon —
+# is the SAME YAML key but did not match `^standing_consent:`. Standalone it still failed closed
+# via the no-known-form net below; but paired with a normal empty block it was invisible to both
+# the count and the extraction, so the empty block was parsed and the real grant vanished. All
+# three patterns now allow `[ \t]*` before the colon.
+# RESIDUAL — MEASURED OVER-BLOCK (2026-07-29): a grant written with a YAML merge key
+# (`defaults: &d {...}` + `standing_consent:\n  <<: *d`) is REFUSED, because the anchor `&d` lives
+# outside the extracted fragment and the alias is undefined when the fragment is re-parsed alone.
+# That is ordinary DRY YAML, and over-blocking is a defect of the same weight as a fail-open: it
+# trains the override reflex and turns the gate into decoration. A whole-file-parse-first path was
+# attempted and reverted the same session — it regressed 16 of 40 anchor lanes, and shipping a
+# broken floor to close an over-block is a worse trade. Anchor lane N4 pins the current behaviour so
+# the next attempt is a measured delta, not a rediscovery.
+# RESIDUAL (named): this is regex-scraping a YAML key out of a markdown file, so it approximates
+# the YAML spec rather than implementing it (quoted keys, anchors, multi-doc streams are not
+# handled). The mitigation is the fail-closed net below, not a claim of completeness.
+occurrences = re.findall(r"^standing_consent[ \t]*:", raw, re.M)
+if len(occurrences) > 1:
+    out("❌", f"R3 the UAP declares `standing_consent` {len(occurrences)} times — ambiguous which "
+              f"is authoritative, and an early benign block would shadow a later grant; fail-closed")
+    fails += 1
+    body = None
+    grants = None
+else:
+    m = re.search(r"^standing_consent[ \t]*:[ \t]*(\{.*)$", raw, re.M)   # inline flow form
+    if not m:
+        m = re.search(r"^standing_consent[ \t]*:[ \t]*$(.*?)(?=^\S|\Z)", raw, re.M | re.S)  # block form
+        body = ("standing_consent:\n" + m.group(1)) if m else None   # re-emitted canonically
+    else:
+        body = "standing_consent: " + m.group(1)
+if grants is not None and body is not None:
+    try:
+        # NoDupLoader here too. The duplicate-key rejection was added on the registry side and
+        # NOT here in the same edit — the third half-fix of this session, committed while
+        # fixing a half-fix. Duplicate grant keys were still last-wins: an expired grant
+        # followed by a future one silently kept the future one.
+        parsed = yaml.load(body, Loader=NoDupLoader)
+        # NO `or {}` HERE. `[] or {}` / `False or {}` / `0 or {}` all evaluate to `{}`, which reached
+        # the type check already laundered into a valid-empty mapping — so `standing_consent:\n  []`
+        # reported "no standing consent recorded" and exit 0, while the truthy `[a, b]` was caught
+        # (measured with that control, cross-family round 5). The falsy branch is exactly the one an
+        # accident produces. Sentinel first, type check second, defaulting last.
+        grants = (parsed if isinstance(parsed, dict) else {}).get("standing_consent", {})
+        if grants is None:
+            grants = {}            # an explicitly empty `standing_consent:` key is a real empty set
+        if not isinstance(grants, dict):
+            out("❌", f"R3 standing_consent is not a mapping ({type(grants).__name__}); fail-closed")
+            fails += 1; grants = None
+    except Exception as e:
+        out("❌", f"R3 standing_consent block unparseable ({e}); fail-closed"); fails += 1
+        grants = None
+elif re.search(r"standing_consent", raw):
+    # The key appears but neither form matched — do not silently read that as "nothing granted".
+    out("❌", "R3 `standing_consent` appears in the UAP but matched no known form; fail-closed")
+    fails += 1; grants = None
+
+if grants is None:
+    pass
+elif not grants:
+    out("✅", "R3-R6 no standing consent recorded (nothing to validate)")
+else:
+    today = datetime.date.today()
+    validated = 0
+    for name, g in grants.items():
+        # H4 grant key: registry `name: 123` + UAP `123:` used to join fine because neither side was
+        # typed. Both sides are strings or the join is meaningless.
+        if not isinstance(name, str) or not name.strip():
+            out("❌", f"R3 grant key {name!r} must be a non-blank string"); fails += 1; continue
+        # `declined` / `unset` / `revoked` are first-class states in this storage model, not grants.
+        # Coercing them into `{"granted": ...}` turned a legitimate refusal into a malformed grant
+        # and reported violations against a user who said no.
+        if isinstance(g, str) and g.strip().lower() in NON_GRANT:
+            continue
+        if not isinstance(g, dict):
+            out("❌", f"R3 `{name}` has value {g!r} — not a grant mapping and not one of "
+                      f"{sorted(NON_GRANT)}; fail-closed")
+            fails += 1; continue
+        # Normalize identically to the scalar branch above. Without .strip() a `state: "revoked "`
+        # fell through and was validated as an ACTIVE grant (cross-family round 4) — two spellings of
+        # the same state judged by two different normalizers is the divergent-normalizer class.
+        # H6 UNKNOWN STATE. Only the three canonical states were recognized; anything else — a typo
+        # like `revokedd`, or a state a future version adds — fell through and was validated as an
+        # ACTIVE grant. A record whose state we cannot read is not a grant we may honour.
+        if "state" in g:
+            st = g["state"]
+            if not isinstance(st, str) or st.strip().lower() not in (NON_GRANT | {"granted"}):
+                out("❌", f"R3 `{name}` has unrecognized state {st!r} — expected one of "
+                          f"{sorted(NON_GRANT | {'granted'})}; fail-closed")
+                fails += 1; continue
+            if st.strip().lower() in NON_GRANT:
+                continue
+        validated += 1
+        c = by_name.get(name)
+        if c is None:
+            out("❌", f"R3 `{name}` granted but NOT in the registry (unregistered == unknown)"); fails += 1; continue
+        if not c.get("promotion_eligible"):
+            out("❌", f"R4 `{name}` granted but registry says promotion_eligible:false"); fails += 1; continue
+        # H5 `granted` was never checked at all — a grant with no grant date cannot be audited
+        # against the three approvals that were supposed to produce it.
+        def _date(v, fld):
+            if isinstance(v, datetime.date):
+                return v
+            if isinstance(v, str) and re.fullmatch(r"\d{4}-\d{2}-\d{2}", v.strip()):
+                try:
+                    return datetime.date.fromisoformat(v.strip())
+                except ValueError:
+                    return None
+            return None   # ints like 29991231 are NOT dates; basic-format parsing accepted them
+        gd = _date(g.get("granted"), "granted")
+        if gd is None:
+            out("❌", f"R5 `{name}` has missing or non-ISO `granted` ({g.get('granted')!r}) — "
+                      f"expected YYYY-MM-DD"); fails += 1
+        elif gd > today:
+            # A consent dated in the future has not been given. `granted: 2099-01-01` passed.
+            out("❌", f"R5 `{name}` is `granted` {gd}, in the FUTURE — a consent that has not "
+                      f"happened yet cannot authorize anything"); fails += 1
+        exp = g.get("expires")
+        if exp is None:
+            out("❌", f"R5 `{name}` granted with no `expires` — standing consent is a lease, not a transfer"); fails += 1
+        else:
+            d = _date(exp, "expires")
+            if d is None:
+                out("❌", f"R5 `{name}` has non-ISO expires={exp!r} — expected YYYY-MM-DD "
+                          f"(`29991231` parsed as a date under basic-format rules and slipped through)")
+                fails += 1
+            elif d < today:
+                out("❌", f"R5 `{name}` expired {d} — must lapse to unset, not keep running"); fails += 1
+            # H7 LEASE BOUND. `expires: 9999-12-31` satisfied "has an expiry" while defeating the
+            # entire point of one. A lease longer than the maximum is a transfer wearing a lease's
+            # clothes.
+            elif gd is not None and (d - gd).days > MAX_LEASE_DAYS:
+                out("❌", f"R5 `{name}` lease is {(d - gd).days} days (max {MAX_LEASE_DAYS}) — "
+                          f"an unbounded expiry is a transfer, not a lease"); fails += 1
+        # R6 — a grant with no recorded scope can never be re-validated against a drifted action.
+        # R6 — presence AND type. The registry side got strict types at R1-b; the grant side did not,
+        # so `effects: true` / `target: 123` were "recorded" and passed while a MISSING field was
+        # caught (measured with that control, cross-family round 7). Half a fix propagated is a hole:
+        # a baseline that is not a list-of-effects and a real target string cannot be compared against
+        # anything later, which is the entire purpose of recording it.
+        eff, tgt = g.get("effects"), g.get("target")
+        if eff is None or tgt is None:
+            out("❌", f"R6 `{name}` grant records no `effects`+`target` — the subset check has no baseline")
+            fails += 1
+        else:
+            if not isinstance(eff, list) or not eff or not all(isinstance(e, str) and e.strip() for e in eff):
+                out("❌", f"R6 `{name}` `effects` must be a non-empty list of strings, got "
+                          f"{type(eff).__name__} {eff!r} — an uncomparable baseline is not a baseline")
+                fails += 1
+            if not isinstance(tgt, str) or not tgt.strip():
+                out("❌", f"R6 `{name}` `target` must be a non-empty string, got "
+                          f"{type(tgt).__name__} {tgt!r}")
+                fails += 1
+            # R7 STORED-SCOPE SUBSET. The grant recorded its own scope and nothing compared it to
+            # what the registry actually authorizes, so `effects: [repo-mutation]` sat happily under
+            # a `capabilities: [read]` class. This is the mechanizable HALF of the subset rule: it
+            # cannot see a LIVE action (still a runtime obligation, still named as residual), but a
+            # STORED grant wider than its own class is checkable right here — and was not checked.
+            if isinstance(eff, list) and all(isinstance(e, str) for e in eff):
+                # One normalizer, both sides. Before this the grant side was stripped and the
+                # registry side was not, so `[" read "]` matched while `[READ]` did not — whitespace
+                # forgiving, case strict, for no stated reason. Divergent normalizers on the two
+                # sides of a comparison is the same defect class this file already fixed twice.
+                over = sorted({_norm(e) for e in eff} - {_norm(x) for x in c["capabilities"]})
+                if over:
+                    out("❌", f"R7 `{name}` grant claims effect(s) {over} outside its registered "
+                              f"capabilities {c['capabilities']} — the grant is wider than the class")
+                    fails += 1
+            if isinstance(tgt, str) and _norm(tgt) != _norm(str(c["target"])):
+                out("❌", f"R7 `{name}` grant target {tgt!r} does not match the registered target "
+                          f"{c['target']!r} — scope drift between grant and class")
+                fails += 1
+    if fails == 0:
+        skipped = len(grants) - validated
+        note = f" ({skipped} non-grant state(s) skipped)" if skipped else ""
+        out("✅", f"R3-R6 all {validated} active grant(s) registered, eligible, unexpired, "
+                  f"scope-recorded{note}")
+
+print("----")
+print(f"consent-registry: {'PASS' if fails == 0 else f'{fails} violation(s)'}")
+sys.exit(0 if fails == 0 else 1)
+PY

package/scripts/selfcheck.sh

@@ -132,6 +132,36 @@ fi
 # prevent. test_card_drift_probe.sh had shipped with ZERO callers since it was written; wiring it
 # here closes that, and the anchors are added to files[] in the same change so package mode runs
 # them too rather than reporting a deleted anchor.
+# consent-class registry floor. Its subject decides whether standing consent may skip an approval
+# prompt, so an uncalibrated instrument there hands out autonomy the operator never granted. The
+# anchor was written into tests/ with ZERO callers first — the same defect this file already
+# records twice above; wiring it here is the fix, not a note about the fix.
+if [ ! -f scripts/consent_registry_check.sh ]; then
+  echo "SKIP  test_consent_registry.sh (subject scripts/consent_registry_check.sh absent)"
+elif [ -f scripts/test_consent_registry.sh ]; then
+  if ! bash scripts/test_consent_registry.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_consent_registry.sh: consent_registry_check.sh present but its anchor is missing"
+  fail=1
+fi
+
+# sidecar_wait stdin plumbing. Its subject is dispatched by auto-decorrelation / steel-quench /
+# sim-conductor / AGENTS.md as the REQUIRED wait form, so a regression there silently empties every
+# cross-family verification. The anchor's first version shipped in tests/ with ZERO callers — the
+# same defect the comment above records for test_card_drift_probe.sh, repeated one file later.
+if [ ! -f scripts/sidecar_wait.sh ]; then
+  echo "SKIP  test_sidecar_wait_stdin.sh (subject scripts/sidecar_wait.sh absent)"
+elif [ -f scripts/test_sidecar_wait_stdin.sh ]; then
+  if ! bash scripts/test_sidecar_wait_stdin.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_sidecar_wait_stdin.sh: sidecar_wait.sh present but its anchor is missing"
+  fail=1
+fi
+
 for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe.sh; do
   if [ ! -f scripts/session_close_check.sh ]; then
     echo "SKIP  ${_anchor##*/} (subject scripts/session_close_check.sh absent)"

package/scripts/sidecar_wait.sh

@@ -41,12 +41,59 @@ shift 2
 [ "${1:-}" = "--" ] && shift
 [ $# -gt 0 ] || { echo "sidecar_wait: no command given" >&2; exit 2; }
 
-: > "$OUT"
-"$@" > "$OUT" 2>&1 &
+# Forward stdin to the child with an explicit fd dup.
+#
+# The hole (measured 2026-07-29, known-pair): `"$@" > "$OUT" 2>&1 &` gave the child /dev/null for
+# stdin in a non-interactive shell, so the documented pipe form reached codex with NO prompt, codex
+# answered "No prompt provided via stdin", and this wrapper reported COMPLETE — the exact 0-output
+# misjudgment it exists to prevent, produced by itself.
+#
+# `<&0` is the whole fix: POSIX substitutes /dev/null ONLY when stdin is not explicitly redirected.
+# The first repair spooled stdin to a tempfile instead, and adversarial review (Axis 2) showed that
+# mechanism was both unnecessary AND strictly worse than the bug — reproduced, not argued:
+#   - the unbounded `cat` ran BEFORE the child, so an inherited never-EOF stdin hung the wrapper
+#     forever and the timeout budget never applied (`-- true` with inherited stdin → rc=124);
+#   - it CONSUMED the caller's stdin, so a caller reading 3 lines after the call read 0.
+# A bounded-wait wrapper with an unbounded pre-step, and an input-preserving tool that eats input.
+# The lesson is kept in the file: the simplest correct fix was one token, and the machinery built
+# around it introduced two S-grade defects the original bug did not have.
+: > "$OUT" || { echo "SIDECAR_VERDICT=OUTFILE_UNWRITABLE path=$OUT" >&2; exit 2; }
+set -m   # own process group per child, so the TIMEOUT kill can reach grandchildren
+if [ -t 0 ]; then
+  # On a controlling tty, a child that READS stdin raises SIGTTIN and stops the whole process
+  # group — the wrapper with it — so the budget never fires and no verdict is emitted (measured:
+  # `cat` under a tty gave rc=124 and zero verdict lines, while `sleep 30` correctly TIMEOUTed).
+  # Interactive callers have no prompt to pipe anyway; the documented pipe form is never a tty.
+  "$@" < /dev/null > "$OUT" 2>&1 &
+else
+  "$@" <&0 > "$OUT" 2>&1 &
+fi
 PID=$!
 
 waited=0
 last_size=0
+# Poll interval is overridable so the regression anchor is not charged the 5s floor per
+# invocation (a 25s anchor is an anchor people skip).
+POLL="${SIDECAR_POLL:-5}"
+# Validate it. Caller-controlled and unvalidated, this knob RESTORED the very failure the wrapper
+# exists to prevent (measured 2026-07-29, budget 3s under an external timeout 10):
+#   SIDECAR_POLL=0    -> rc=124, `waited` never advances, TIMEOUT never fires, zero typed verdicts
+#   SIDECAR_POLL=0.5  -> rc=124, arithmetic error each iteration, assignment never lands
+#   SIDECAR_POLL=abc  -> exits 1 (the documented TIMEOUT code) with NO verdict line and a live child
+# The file's own "a 25s anchor is an anchor people skip" comment invites tuning this, and `0.5` is
+# the obvious next step for someone doing that. An unbounded wait must not be reachable by typo.
+# `10#` forces base 10: `test` reads 08 as decimal-8 and PASSES it, then $((waited + 08)) dies with
+# "value too great for base" every iteration, waited never advances, and the wait is unbounded again
+# — the first guard did not close its own finding (measured: 08/09 -> rc=124, zero verdicts).
+# The ceiling matters just as much: the budget is checked at the TOP of the loop, so any POLL above
+# it makes the effective wait POLL, not BUDGET (SIDECAR_POLL=600 -> rc=124). 600 is exactly what
+# someone copying the budget argument into the knob writes.
+_poll_raw="$POLL"
+case "$POLL" in ''|*[!0-9]*) POLL=5 ;; *) POLL=$((10#$POLL)) 2>/dev/null || POLL=5 ;; esac
+{ [ "$POLL" -ge 1 ] && [ "$POLL" -le 60 ]; } 2>/dev/null || POLL=5
+# Never coerce silently on a script whose whole thesis is a typed channel.
+[ "$POLL" = "$_poll_raw" ] || [ -z "${SIDECAR_POLL:-}" ] || \
+  echo "sidecar_wait: ignoring SIDECAR_POLL='$_poll_raw' (not an integer in 1..60); using $POLL" >&2
 # Poll rather than `wait`, so a live-but-quiet process is distinguishable from a dead one and the
 # caller can SEE progress. A silent minute on a reasoning model is normal; the earlier misreading
 # happened precisely because silence was treated as termination.
@@ -54,11 +101,14 @@ while kill -0 "$PID" 2>/dev/null; do
   if [ "$waited" -ge "$BUDGET" ]; then
     size=$(wc -c < "$OUT" 2>/dev/null | tr -d ' ')
     echo "SIDECAR_VERDICT=TIMEOUT waited=${BUDGET}s bytes=${size:-0} pid=$PID"
-    echo "  the process is STILL RUNNING — this is not 'no output'. Raise the budget, or kill $PID" >&2
+    echo "  the process is STILL RUNNING — this is not 'no output'. Raise the budget if it needs longer." >&2
+    # Kill the GROUP. `kill "$PID"` reaches only the direct child, so `sh -c 'sleep N & wait'`
+    # left a live grandchild behind while the lane stayed green (measured wave 4).
+    kill -- -"$PID" 2>/dev/null || kill "$PID" 2>/dev/null
     exit 1
   fi
-  sleep 5
-  waited=$((waited + 5))
+  sleep "$POLL"
+  waited=$((waited + POLL))
   size=$(wc -c < "$OUT" 2>/dev/null | tr -d ' ')
   if [ "${size:-0}" -ne "$last_size" ]; then
     echo "  … ${waited}s elapsed, ${size} bytes so far (alive)" >&2

package/scripts/test_consent_registry.sh

@@ -0,0 +1,255 @@
+#!/usr/bin/env bash
+# test_consent_registry.sh — known-pair anchor for scripts/consent_registry_check.sh.
+#
+# WHY (cross-family review rounds 1-3, 2026-07-29)
+#   The accept-side consent-promotion rule went REJECT -> NARROW-IT -> NARROW-IT across three
+#   adversarial rounds. Round 3 stopped attacking the prose and attacked the validator, and found
+#   four ways the FLOOR ITSELF was fail-open. Three were confirmed against controls:
+#
+#     - `promotion_eligible: "false"` (quoted) is a truthy STRING. Every eligibility test inverted,
+#       so an intended-ineligible class was granted. One quote character disarmed the floor.
+#     - a duplicate class name silently shadowed the earlier entry, so appending an eligible twin
+#       below an ineligible one laundered the ineligible class into a grant.
+#     - `standing_consent: {inline: ...}` matched no pattern, so an EXPIRED inline grant was read as
+#       "no standing consent recorded" and reported PASS — a grant the checker cannot see is not an
+#       absent grant, it is a false clean.
+#
+#   Each of those is a check that reported green while doing nothing, which is worse than an absent
+#   check: it buys confidence without enforcement. Hence this anchor.
+#
+# Lanes: N* = known-negative (must pass) · P* = known-positive (must be caught) · D* = degrade.
+# Exit 0 = all lanes correct. Exit 1 = the validator regressed toward permissiveness.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CHK="$ROOT/scripts/consent_registry_check.sh"
+[ -f "$CHK" ] || { echo "FAIL: $CHK not found"; exit 1; }
+
+pass=0; fail=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+TD="$(mktemp -d)"; trap 'rm -rf "$TD"' EXIT
+
+# want_rc: expected exit. want_rule: a rule id that must appear in the output ("" = don't care).
+lane() {
+  local desc="$1" want_rc="$2" want_rule="$3"
+  bash "$CHK" "$TD/r.yaml" "$TD/u.md" >"$TD/o" 2>&1
+  local rc=$?
+  if [ "$rc" -ne "$want_rc" ]; then
+    bad "$desc — exit $rc, expected $want_rc"; sed 's/^/     /' "$TD/o"; return
+  fi
+  if [ -n "$want_rule" ] && ! grep -q "❌ $want_rule" "$TD/o"; then
+    bad "$desc — exit was right but rule $want_rule was not the reason"; sed 's/^/     /' "$TD/o"; return
+  fi
+  ok "$desc"
+}
+
+OKCLASS='  - {name: ok, owner: o, mode: m, target: t, capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}'
+mkreg() { printf 'classes:\n%s\n' "$1" > "$TD/r.yaml"; }
+mkuap() { printf '%s\n' "$1" > "$TD/u.md"; }
+
+mkreg "$OKCLASS"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "N1 a well-formed registry + eligible unexpired scoped grant passes" 0 ""
+
+mkuap 'standing_consent:
+  ok: declined'
+lane "N2 a declined record is a valid non-grant state, not a malformed grant" 0 ""
+
+mkreg '  - {name: s, owner: o, mode: m, target: t, capabilities: [read], sinks: [go-public], feeds: [], promotion_eligible: true}'
+mkuap 'standing_consent: {}'
+lane "P1 a class naming an irreversible SINK cannot declare itself promotable" 1 "R2"
+
+mkreg '  - {name: f, owner: o, mode: m, target: t, capabilities: [read], sinks: [], feeds: [go-public], promotion_eligible: true}'
+lane "P2 taint — a class that FEEDS an irreversible sink cannot be promotable" 1 "R2"
+
+mkreg "$OKCLASS"
+mkuap 'standing_consent:
+  ghost: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "P3 a grant on an unregistered class is refused (unregistered == unknown)" 1 "R3"
+
+mkuap 'standing_consent:
+  ok: {granted: 2026-01-01, expires: 2026-06-30, effects: [read], target: t}'
+lane "P4 an expired lease does not keep running" 1 "R5"
+
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31}'
+lane "P5 a grant with no recorded scope has no re-validation baseline" 1 "R6"
+
+# P6-P8 are the round-3 fail-opens. Each of these PASSED before the fix.
+mkreg '  - {name: q, owner: o, mode: m, target: t, capabilities: [read], sinks: [], feeds: [], promotion_eligible: "false"}'
+mkuap 'standing_consent:
+  q: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "P6 quoted \"false\" is rejected as a type error, not read as truthy" 1 "R1-b"
+
+mkreg '  - {name: d, owner: o, mode: m, target: t, capabilities: [read], sinks: [go-public], feeds: [], promotion_eligible: false}
+  - {name: d, owner: o, mode: m, target: t, capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}'
+mkuap 'standing_consent:
+  d: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "P7 a duplicate class name cannot launder an ineligible class" 1 "R1-c"
+
+mkreg "$OKCLASS"
+mkuap 'standing_consent: {ok: {granted: 2026-01-01, expires: 2020-01-01, effects: [read], target: t}}'
+lane "P8 an INLINE grant is parsed, not silently read as 'nothing granted'" 1 "R5"
+
+# P10-P11 are the round-4 fail-opens. Both PASSED before the fix, and both were confirmed against a
+# control: the SAME expired grant was caught when it stood alone.
+mkreg "$OKCLASS"
+mkuap 'standing_consent: {}
+
+notes in between
+
+standing_consent:
+  ok: {granted: 2026-01-01, expires: 2020-01-01, effects: [read], target: t}'
+lane "P10 an early empty consent block cannot shadow a later grant (first-match)" 1 "R3"
+
+mkuap 'standing_consent:
+  ok: {state: "revoked ", granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+if bash "$CHK" "$TD/r.yaml" "$TD/u.md" 2>&1 | grep -q "0 active grant"; then
+  ok "P11 a mapping non-grant state is normalized like the scalar one (no divergent normalizer)"
+else
+  bad "P11 \`state: \"revoked \"\` was validated as an ACTIVE grant"
+  bash "$CHK" "$TD/r.yaml" "$TD/u.md" 2>&1 | sed 's/^/     /'
+fi
+
+# P12 is the round-5 fail-open: `or {}` collapsed FALSY non-mappings into a valid-empty mapping
+# before the type check, so `[]`, `false` and `0` all reported "no standing consent" and exit 0 —
+# while the truthy `[a, b]` was caught. The falsy branch is the one an accident actually produces.
+for badval in '  []' '  false' '  0'; do
+  mkreg "$OKCLASS"
+  printf 'standing_consent:\n%s\n' "$badval" > "$TD/u.md"
+  lane "P12 a falsy non-mapping standing_consent ($badval) is a type error, not 'none granted'" 1 "R3"
+done
+
+# P13/N3 — round-6 fail-open: `standing_consent :` (space or tab before the colon) is the SAME YAML
+# key but matched none of the patterns. Standalone it still failed closed via the no-known-form net;
+# paired with a normal empty block it was invisible to both the count and the extraction, so the
+# empty block parsed and the real grant vanished. Confirmed against a control (the identical expired
+# grant in canonical form was caught).
+mkreg "$OKCLASS"
+mkuap 'standing_consent: {}
+
+standing_consent : {ok: {granted: 2026-01-01, expires: 2020-01-01, effects: [read], target: t}}'
+lane "P13 a space-before-colon key cannot hide behind a canonical block" 1 "R3"
+
+mkuap 'standing_consent :
+  ok: {granted: 2026-01-01, expires: 2020-01-01, effects: [read], target: t}'
+lane "P13-b a space-before-colon BLOCK form is parsed and its grant validated" 1 "R5"
+
+mkuap "$(printf 'standing_consent\t: {ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}}')"
+lane "N3 a tab-before-colon key with a VALID grant passes (no over-block)" 0 ""
+
+# P14 — round-7 fail-open: R6 presence-checked `effects`/`target` but never typed them, while the
+# registry side had strict types since R1-b. A fix propagated to one side only is a hole. Control:
+# a MISSING field was caught; a type-wrong one passed.
+mkreg "$OKCLASS"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: true, target: 123}'
+lane "P14 a type-wrong grant scope is rejected, not counted as recorded" 1 "R6"
+
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: "read", target: "  "}'
+lane "P14-b a scalar effects / whitespace-only target is rejected" 1 "R6"
+
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [], target: t}'
+lane "P14-c an EMPTY effects list is not a baseline" 1 "R6"
+
+# H1-H9 — round-8 exhaustive field audit found NINE remaining holes in one pass, after four rounds
+# of one-per-round trickle. The reframe ("audit every field, don't hand me the most important one")
+# is what surfaced them; the per-round drip was a slow enumeration, not convergence.
+mkuap 'standing_consent: {}'
+printf 'classes: false\n' > "$TD/r.yaml"
+lane "H1 a falsy \`classes\` is not laundered into an empty registry" 1 ""
+printf 'classes:\n' > "$TD/r.yaml"
+lane "H1-b a null \`classes\` is N/A, not a clean PASS" 0 ""
+if grep -q 'N/A' "$TD/o"; then ok "H1-c the empty registry is LABELLED N/A"; else bad "H1-c empty registry read as clean"; fi
+
+mkreg '  - {name: n, owner: o, mode: 123, target: t, capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}'
+lane "H2 a non-string scalar registry field is a type error" 1 "R1-b"
+mkreg '  - {name: n, owner: o, mode: m, target: "", capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}'
+lane "H2-b a blank registry target is a type error" 1 "R1-b"
+mkreg '  - {name: n, owner: o, mode: m, target: t, capabilities: [read], sinks: [123], feeds: [], promotion_eligible: false}'
+lane "H3 an unreadable sink item is UNDECLARED, not an empty sink list" 1 "R1-b"
+
+mkreg "$OKCLASS"
+mkuap 'standing_consent:
+  ok: {expires: 2026-12-31, effects: [read], target: t}'
+lane "H5 a grant with no \`granted\` date cannot be audited" 1 "R5"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 29991231, effects: [read], target: t}'
+lane "H7 a non-ISO integer expiry is not a date" 1 "R5"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 9999-12-31, effects: [read], target: t}'
+lane "H7-b an unbounded lease is a transfer wearing a lease's clothes" 1 "R5"
+mkuap 'standing_consent:
+  ok: {state: revokedd, granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "H6 a typo'\''d state fails closed instead of passing as active" 1 "R3"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [repo-mutation], target: t}'
+lane "H8 a grant wider than its registered capabilities is refused" 1 "R7"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: everything}'
+lane "H8-b grant/class target drift is refused" 1 "R7"
+mkuap 'standing_consent:
+  ok: {granted: 2026-07-29, expires: 2020-01-01, effects: [read], target: t}
+  ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane "H9 duplicate YAML keys are rejected, not resolved last-wins" 1 ""
+
+# H4 had a fix but NO lane — the mutation sweep caught that (disabling it failed zero lanes).
+# An uncovered check is a check that gets deleted quietly later.
+# NOTE the assertion is on the MESSAGE, not the rule id: with the type check disabled a numeric key
+# still exits 1 via "not in the registry", so a rule-id assertion passed either way and the mutation
+# sweep caught zero lanes. A lane that cannot separate two paths is not measuring the one it names.
+mkuap 'standing_consent:
+  123: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+bash "$CHK" "$TD/r.yaml" "$TD/u.md" >"$TD/o" 2>&1
+if [ $? -eq 1 ] && grep -q 'grant key 123 must be a non-blank string' "$TD/o"; then
+  ok "H4 a non-string grant key is refused AS A TYPE ERROR (not merely as unregistered)"
+else
+  bad "H4 numeric grant key was not refused by the type check"
+  sed 's/^/     /' "$TD/o"
+fi
+
+mkreg '  - {name: c, owner: o, mode: m, target: t, capabilities: "read", sinks: [], feeds: [], promotion_eligible: true}'
+mkuap 'standing_consent: {}'
+lane "P9 a scalar where a list is required is a type error" 1 "R1-b"
+
+# N4 — PINS A KNOWN OVER-BLOCK, it does not endorse it. A grant written with a YAML merge key is
+# currently REFUSED because the anchor lives outside the extracted fragment (see the residual note
+# in consent_registry_check.sh). This lane asserts the CURRENT behaviour so that a future fix shows
+# up as a lane change rather than being rediscovered from scratch — and so nobody reads the 40/40
+# as "no known over-block".
+mkreg "$OKCLASS"
+mkuap 'defaults: &d {ok: {granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}}
+standing_consent:
+  <<: *d'
+bash "$CHK" "$TD/r.yaml" "$TD/u.md" >"$TD/o" 2>&1
+if [ $? -eq 1 ]; then
+  ok "N4 merge-key grant is refused — KNOWN OVER-BLOCK, pinned not endorsed (see residual note)"
+else
+  ok "N4 merge-key grant now PASSES — the over-block was fixed; update this lane and the residual note"
+fi
+
+rm -f "$TD/r.yaml"
+lane "D1 a missing registry is N/A with promotion disabled (never a silent PASS)" 0 ""
+if grep -q 'N/A' "$TD/o"; then
+  ok "D1-b the missing-registry result is LABELLED N/A, not reported as clean"
+else
+  bad "D1-b a missing registry produced exit 0 without an N/A label — that reads as PASS"
+fi
+
+printf 'classes: [ {name: broken\n' > "$TD/r.yaml"
+lane "D2 an unparseable registry fails closed (cannot decide == not allowed)" 1 ""
+
+# The shipped example must satisfy the validator — otherwise the artifact FH hands users is the
+# first counter-example. (Hand-verify-one-sample discipline, applied to our own template.)
+if bash "$CHK" "$ROOT/templates/consent_classes.yaml.example" /dev/null >/dev/null 2>&1; then
+  ok "S1 the shipped templates/consent_classes.yaml.example validates"
+else
+  bad "S1 the shipped example registry does NOT validate"
+fi
+
+echo "----"
+echo "consent-registry anchor: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/test_sidecar_wait_stdin.sh

@@ -0,0 +1,169 @@
+#!/usr/bin/env bash
+# test_sidecar_wait_stdin.sh — known-pair anchor for scripts/sidecar_wait.sh's stdin plumbing.
+#
+# WHY (measured 2026-07-29)
+#   `sidecar_wait.sh` shipped in v1.4.76 documenting this invocation in its own header:
+#       printf '%s' "$prompt" | bash scripts/sidecar_wait.sh out.txt 600 -- codex exec -m gpt-5.5 -
+#   It did not work. `"$@" > "$OUT" 2>&1 &` gives the child /dev/null for stdin in a
+#   non-interactive shell, so codex received no prompt, answered "No prompt provided via stdin",
+#   and the wrapper reported SIDECAR_VERDICT=COMPLETE — a sidecar that never ran, reported as
+#   complete. That is the exact misjudgment the script exists to prevent, produced by the script.
+#
+#   The FIRST repair was worse than the bug, and adversarial review caught it before it shipped.
+#   It spooled stdin to a tempfile; reproduced consequences:
+#     - the unbounded `cat` ran BEFORE the child, so an inherited never-EOF stdin hung the wrapper
+#       forever and the timeout budget never applied (`-- true` with inherited stdin → rc=124);
+#     - it CONSUMED the caller's stdin (a caller reading 3 lines afterwards read 0).
+#   The correct fix is one token: `<&0`. POSIX substitutes /dev/null only when stdin is NOT
+#   explicitly redirected. Lanes P2/P3 exist because the anchor's first version reported 4/4 green
+#   in the same shell where the argv form returned rc=124 — it bound only P1.
+#
+# Lanes
+#   P1  piped stdin REACHES the child                        (the original hole)
+#   P2  argv-form with an inherited never-EOF stdin does NOT hang   (spool regression)
+#   P3  the caller's own stdin is NOT consumed by the wrapper       (spool regression)
+#   P4  verdict codes: TIMEOUT=1 · EMPTY=0 · COMPLETE=0, and EMPTY/COMPLETE are distinguished
+#   P5  an unwritable outfile is exit 2, not "EMPTY" (a false clean on the typed channel)
+#
+# Verdicts are read by running the wrapper DIRECTLY — piping it into `tail` and reading `$?`
+# answers with tail's status and turns a real exit 1 green.
+#
+# Exit 0 = all lanes correct. Exit 1 = the plumbing regressed.
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SW="$ROOT/scripts/sidecar_wait.sh"
+[ -f "$SW" ] || { echo "FAIL: $SW not found"; exit 1; }
+# NOTE: SIDECAR_POLL is set PER LANE, never exported globally. A global export pinned the knob for
+# every lane and thereby MASKED a bad default — a regression to `SIDECAR_POLL:-0` passed 5/5.
+FAST="SIDECAR_POLL=1"
+
+pass=0; fail=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+TD="$(mktemp -d)"; trap 'rm -rf "$TD"' EXIT
+
+# P1 — `cat` echoes whatever it receives; an empty outfile means stdin was swallowed, which is
+# exactly what the shipped version did.
+printf 'MARKER_STDIN_ARRIVED' | SIDECAR_POLL=1 bash "$SW" "$TD/p1.out" 20 -- cat >/dev/null 2>&1
+if grep -q 'MARKER_STDIN_ARRIVED' "$TD/p1.out" 2>/dev/null; then
+  ok "P1 piped stdin reaches the child process"
+else
+  bad "P1 STDIN HOLE IS BACK — child saw no stdin (got: '$(head -c 60 "$TD/p1.out" 2>/dev/null)')"
+fi
+
+# P2 — the lane the first anchor lacked. A never-EOF stdin must not block the wrapper: the child is
+# launched immediately and the budget governs. `sleep 20 |` keeps the pipe open with no data.
+( sleep 6 | SIDECAR_POLL=1 timeout 5 bash "$SW" "$TD/p2.out" 3 -- echo ARGV_OK ) >/dev/null 2>&1
+rc_hang=$?
+if [ "$rc_hang" -ne 124 ] && grep -q 'ARGV_OK' "$TD/p2.out" 2>/dev/null; then
+  ok "P2 an inherited never-EOF stdin does not hang the wrapper (child still runs)"
+else
+  bad "P2 the wrapper HUNG or never ran the child on inherited stdin (rc=$rc_hang, out='$(head -c 40 "$TD/p2.out" 2>/dev/null)')"
+fi
+
+# P3 — the wrapper must not eat the caller's stream. `echo` reads nothing, so all three lines must
+# remain readable afterwards. The spool version left zero.
+n=$(printf 'l1\nl2\nl3\n' | { SIDECAR_POLL=1 bash "$SW" "$TD/p3.out" 20 -- echo x >/dev/null 2>&1
+                              c=0; while read -r _; do c=$((c+1)); done; echo "$c"; })
+if [ "$n" = "3" ]; then
+  ok "P3 the caller's own stdin survives the call (3/3 lines still readable)"
+else
+  bad "P3 the wrapper consumed the caller's stdin ($n of 3 lines left)"
+fi
+
+# P4 — verdict channel. `-- true` writes nothing and is EMPTY, NOT COMPLETE; the first anchor
+# labelled that lane "COMPLETE" and so never exercised COMPLETE at all.
+SIDECAR_POLL=1 bash "$SW" "$TD/p4t.out" 2 -- sleep 30 >"$TD/p4t.txt" 2>&1 </dev/null; rc_t=$?
+SIDECAR_POLL=1 bash "$SW" "$TD/p4e.out" 20 -- true      >"$TD/p4e.txt" 2>&1 </dev/null; rc_e=$?
+SIDECAR_POLL=1 bash "$SW" "$TD/p4c.out" 20 -- echo hi   >"$TD/p4c.txt" 2>&1 </dev/null; rc_c=$?
+if [ "$rc_t" -eq 1 ] && [ "$rc_e" -eq 0 ] && [ "$rc_c" -eq 0 ] \
+   && grep -q 'SIDECAR_VERDICT=TIMEOUT'  "$TD/p4t.txt" \
+   && grep -q 'SIDECAR_VERDICT=EMPTY'    "$TD/p4e.txt" \
+   && grep -q 'SIDECAR_VERDICT=COMPLETE' "$TD/p4c.txt"; then
+  ok "P4 verdicts intact and distinguished (TIMEOUT=1 · EMPTY=0 · COMPLETE=0)"
+else
+  bad "P4 verdict channel drifted (timeout rc=$rc_t, empty rc=$rc_e, complete rc=$rc_c)"
+  head -1 "$TD/p4t.txt" "$TD/p4e.txt" "$TD/p4c.txt" 2>/dev/null | sed 's/^/     /'
+fi
+
+# P5 — an outfile that cannot be written made `wc -c` fail, `${size:-0}` read 0, and the wrapper
+# announce EMPTY with exit 0. The sidecar had in fact produced output. Same false-clean class as
+# the bug this file anchors, on the typed channel itself.
+SIDECAR_POLL=1 bash "$SW" "$TD/nodir/x.out" 10 -- echo hi >/dev/null 2>&1 </dev/null
+rc_w=$?
+if [ "$rc_w" -eq 2 ]; then
+  ok "P5 an unwritable outfile fails closed (exit 2), never 'EMPTY'"
+else
+  bad "P5 an unwritable outfile returned rc=$rc_w — a sidecar that ran reported as saying nothing"
+fi
+
+# P6 — the knob added while making this anchor cheap re-opened the unbounded wait. Each bad value
+# must still produce a bounded TIMEOUT. Deliberately NOT using $FAST: the point is a bad POLL.
+p6=0
+for badpoll in 0 0.5 abc 08 09 600; do
+  SIDECAR_POLL="$badpoll" timeout 12 bash "$SW" "$TD/p6.out" 2 -- sleep 30 >"$TD/p6.txt" 2>&1
+  rc6=$?
+  if [ "$rc6" -eq 1 ] && grep -q 'SIDECAR_VERDICT=TIMEOUT' "$TD/p6.txt"; then p6=$((p6+1)); fi
+done
+if [ "$p6" -eq 6 ]; then
+  ok "P6 a malformed SIDECAR_POLL (0·0.5·abc·08·09·600) still times out — the budget is not disarmable"
+else
+  bad "P6 only $p6/6 malformed poll values produced a bounded TIMEOUT (unbounded wait is reachable)"
+fi
+
+# P7 — TIMEOUT must not orphan the sidecar, INCLUDING grandchildren: `kill "$PID"` reached only the
+# direct child, so `sh -c 'sleep N & wait'` survived while this lane stayed green. The marker is
+# per-run: a machine-global `pgrep -f 'sleep 25'` false-FAILs on any concurrent sleep and its
+# failure branch would kill unrelated host processes.
+MARK="p7_$$_$(date +%s 2>/dev/null || echo x)"
+SIDECAR_POLL=1 bash "$SW" "$TD/p7.out" 2 -- sh -c "sleep 25 & wait # $MARK" >"$TD/p7.txt" 2>&1 </dev/null
+sleep 1
+if ! pgrep -f "$MARK" >/dev/null 2>&1; then
+  ok "P7 a timed-out sidecar is killed with its grandchildren, not orphaned past our exit"
+else
+  bad "P7 a grandchild survived TIMEOUT (orphan restored)"; pkill -f "$MARK" 2>/dev/null
+fi
+
+# P9 — the tty path. HONEST SCOPE, do not read this lane as more than it is.
+#
+# It asserts that a stdin-reading child under an allocated pty still produces a bounded verdict. It
+# does NOT bind the `if [ -t 0 ]` branch: removing that branch entirely leaves this lane GREEN
+# (measured 2026-07-29). Cross-family review reproduced a SIGTTIN stop (rc=124, no verdict) under a
+# pty before `set -m` was added for the group-kill; this harness cannot reproduce that condition,
+# so whether the branch is still load-bearing is UNMEASURED — the branch is kept as defensive, not
+# as something this anchor proves.
+#
+# A lane that cannot separate a known-positive from a known-negative is not measuring; it is
+# generating. Shipping it as a plain green would manufacture exactly the false confidence this
+# file exists to prevent, so it is labelled instead of silently counted.
+if command -v script >/dev/null 2>&1; then
+  # `< /dev/null` on `script` itself: with the harness's inherited stdin it could not allocate a pty
+  # at all and wrote no rc file, so the lane failed identically with AND without the fix under test
+  # — it discriminated nothing. The pty it allocates for the inner command is what matters.
+  # The inner shell writes its rc to a FILE. Parsing `script`'s own stdout fails: it emits ^D and
+  # CRLF, and the first version of this lane read rc as empty and reported a defect that did not
+  # exist — the target was fine, the instrument was not.
+  script -q /dev/null bash -c "SIDECAR_POLL=1 timeout 12 bash '$SW' '$TD/p9.out' 3 -- cat >'$TD/p9.txt' 2>&1; echo \$? > '$TD/p9rc'" >/dev/null 2>&1 < /dev/null
+  rc9=$(tr -dc '0-9' < "$TD/p9rc" 2>/dev/null)
+  if [ -n "$rc9" ] && [ "$rc9" != "124" ] && grep -q 'SIDECAR_VERDICT=' "$TD/p9.txt" 2>/dev/null; then
+    ok "P9 the tty path runs and emits a verdict (UNCALIBRATED — see note; does NOT bind the branch)"
+  else
+    bad "P9 tty case rc='${rc9:-<unread>}' verdict='$(head -1 "$TD/p9.txt" 2>/dev/null)'"
+  fi
+else
+  bad "P9 UNCALIBRATED — \`script\` unavailable, the tty branch cannot be exercised here"
+fi
+
+# P8 — the child's stderr AND its exit code must reach the typed channel. Dropping `2>&1` or
+# hardcoding rc=0 both passed the earlier anchor: it grepped the verdict WORD and the wrapper's
+# own rc, never the child's.
+SIDECAR_POLL=1 bash "$SW" "$TD/p8.out" 20 -- sh -c 'echo STDERR_MARK >&2; exit 3' >"$TD/p8.txt" 2>&1 </dev/null
+if grep -q 'STDERR_MARK' "$TD/p8.out" 2>/dev/null && grep -q 'exit=3' "$TD/p8.txt"; then
+  ok "P8 child stderr is captured and its exit code reaches the verdict line"
+else
+  bad "P8 stderr or child exit code lost (out='$(head -c 40 "$TD/p8.out" 2>/dev/null)' verdict='$(head -1 "$TD/p8.txt")')"
+fi
+
+echo "----"
+echo "sidecar_wait stdin anchor: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/templates/consent_classes.yaml.example

@@ -0,0 +1,75 @@
+# consent_classes.yaml — the consent-class registry.
+#
+# Copy to `tracks/_meta/consent_classes.yaml` (gitignored, per-environment) to enable
+# accept-side consent promotion. See `knowledge/shared/rules/operational_adaptation.md`
+# §Consent promotion.
+#
+# WHY A REGISTRY AT ALL (cross-family review, 2026-07-29)
+#   The first draft let the running session name the class it was counting approvals against.
+#   That defeats the class-inflation guard before it fires: the class does not need to be WIDENED
+#   later if it was born wide. Recording three approvals as `sim-conductor` instead of
+#   `dispatch read-only sim on a local artifact` silently grants every future sim-conductor mode.
+#   So classes are DECLARED here, reviewed by a human, and the session may only count against
+#   an entry that already exists. A session may propose a new entry; it may not mint one mid-run.
+#
+# THE FLOOR IS READ FROM THIS FILE, NOT JUDGED AT RUNTIME
+#   `sinks` is the field the irreversibility floor is decided from. A session asking itself
+#   "is this reversible?" is the wrong arbiter — it is the party that wants to stop being asked.
+#   Absent entry / absent file / unparseable entry => NO promotion, keep asking. Unknown is not
+#   reversible.
+#
+# TAINT
+#   A class inherits the floor if it FEEDS an irreversible sink, not only if it crosses one.
+#   `local-commit` below is the worked example: committing is locally reversible, but if a
+#   post-commit hook, sync daemon, or CI workflow publishes from that commit, the chain crossed
+#   go-public and the class must be marked tainted. Declare `feeds:` honestly — the whole point
+#   is that no single step in a bad chain looks dangerous on its own.
+
+classes:
+  # ---- promotion-eligible example -------------------------------------------------
+  - name: dispatch-readonly-sim-local-artifact
+    owner: fh-meta:sim-conductor          # the gate/skill that does the asking
+    mode: blind-target-tier-sim
+    target: a single local file under the current repo
+    capabilities: [read, dispatch]        # read · local-write · network · dispatch · repo-mutation
+    sinks: []                             # crosses nothing irreversible
+    feeds: []                             # enables/queues nothing irreversible
+    promotion_eligible: true
+    lease_days: 30                        # standing consent is a renewable lease, never permanent
+
+  # ---- NOT promotion-eligible: sink is irreversible --------------------------------
+  - name: npm-publish
+    owner: Pre-Publish Surface Gate
+    mode: registry-publish
+    target: the package tarball file set
+    capabilities: [read, network]
+    sinks: [go-public]                    # irreversible => never promotes, at any count
+    feeds: []
+    promotion_eligible: false
+    reason: "publish is effectively irreversible — a package is live the instant it ships and may
+             be cached or forked before any scrub (CLAUDE.md §Pre-Publish Surface Gate)."
+
+  # ---- NOT promotion-eligible: TAINTED (this is the one that looks safe) -----------
+  - name: local-commit
+    owner: FH 4-axis commit gate
+    mode: git-commit
+    target: the working tree
+    capabilities: [local-write, repo-mutation]
+    sinks: []                             # committing itself is reversible
+    feeds: [go-public]                    # ...but CI/sync publishes from it
+    promotion_eligible: false
+    reason: "taint — reversible in isolation, feeds an irreversible sink. Every step in the
+             workflow-edit -> release-notes -> commit -> CI-publish chain is individually
+             reversible; the chain is not."
+
+  # ---- NOT promotion-eligible: unclassified ---------------------------------------
+  - name: run-arbitrary-shell
+    owner: (none — catch-all)
+    mode: unrestricted
+    target: unbounded
+    capabilities: [read, local-write, network, dispatch, repo-mutation]
+    sinks: [unknown]                      # unknown is NOT reversible
+    feeds: [unknown]
+    promotion_eligible: false
+    reason: "sinks cannot be enumerated, so the floor cannot be decided mechanically. A class
+             whose blast radius is unbounded is never a candidate, regardless of approval count."