@chrono-meta/fh-gate 1.4.76 → 1.4.78

package/scripts/fh_node_check.sh

@@ -0,0 +1,184 @@
+#!/usr/bin/env bash
+# fh_node_check.sh — per-NODE environment floor check, fired at SessionStart.
+#
+# WHY A NODE-SCOPED CHECK EXISTS:
+#   A user's context (companion store, memory, session card) travels between machines; the machine's
+#   own wiring does not. A rich context makes an unwired laptop read as "already configured".
+#   Measured 2026-07-30: a machine holding the full companion store and memory ran sessions with its
+#   SessionStart hooks unregistered; nothing surfaced it — it was found by accident.
+#
+# WHY IT IS NOT INSIDE fh_session_load.sh:
+#   That script is registered in the gitignored .claude/settings.local.json, so on a fresh clone it
+#   is not registered — the situation this check exists for is the one in which it could not run.
+#   This script carries no operator-private path, so it can be registered from
+#   templates/settings.SessionStart.snippet.json, which IS tracked and ships with a clone.
+#   HONEST SCOPE: registration still requires the wizard to merge that snippet — every
+#   .claude/settings*.json path in this repo is gitignored, so no SessionStart entry can be tracked.
+#   The chicken-and-egg is REDUCED (script + snippet ship), not ELIMINATED (a user who never runs
+#   the wizard still gets nothing). An earlier revision of this header claimed "survives a clone";
+#   that was false, and a cross-family review caught it before merge. Do not restore the claim
+#   without running `git check-ignore` on the settings paths first.
+#
+# EMISSION IS STATE-BASED, NOT EVENT-BASED — this is the load-bearing design decision:
+#   A missing floor is a PERSISTENT CONDITION, so it is reported EVERY session until fixed.
+#   A healthy machine is silent AFTER its one event line (first session / machine change / infra
+#   delta) — events report once, conditions report until they stop being true.
+#   Earlier revisions fired on events only (first session / machine change / idle >= 7 days / HEAD
+#   advanced >= 20 commits) and that was wrong in both directions: on this hub's measured velocity
+#   (~33 commits/week) the commit axis fired every ~4 days on a healthy machine (noise, and an
+#   ignored detector cannot be revived), while a broken machine reported once then went quiet
+#   forever — reproducing the very accident above.
+#
+# Detector, never a gate: always exits 0, and it RECOMMENDS — it cannot compel.
+# State: tracks/_meta/.fh_node_state (gitignored; excluded from companion sync — it is machine-local
+# by nature, and mirroring it would make node identity flap between machines).
+# FH_NODE_STATE overrides the state path (used by the wizard's verification so that verifying does
+# not consume a one-shot event report).
+
+set -uo pipefail
+
+FH="${HUB_DIR:-${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}}"
+STATE="${FH_NODE_STATE:-$FH/tracks/_meta/.fh_node_state}"
+
+NODE_ID="${FH_MACHINE_ID:-$(hostname -s 2>/dev/null || echo unknown)}"
+HEAD_NOW="$(git -C "$FH" rev-parse --short HEAD 2>/dev/null || echo none)"
+NOW="$(date +%s)"
+
+PREV_ID=""; PREV_EPOCH=0; PREV_HEAD=""
+if [ -f "$STATE" ]; then
+  IFS='|' read -r PREV_ID PREV_EPOCH PREV_HEAD < "$STATE" 2>/dev/null || true
+fi
+# Never feed a file-sourced value straight into arithmetic (bash arithmetic evaluates command
+# substitution inside array subscripts).
+case "${PREV_EPOCH:-}" in ''|*[!0-9]*) PREV_EPOCH=0 ;; esac
+
+# ── floor probes — always run, before any decision about whether to speak ──────
+MISS=""
+
+# ① git-side floor. Probe the EXECUTABLE HOOK, not the config key: `core.hooksPath` unset is a
+#    normal working install when hooks live in .git/hooks, and a set-but-empty path is a broken
+#    install the key alone reports as fine. Resolve the directory with `git rev-parse --git-path`,
+#    which handles set/unset, relative/absolute, AND linked worktrees (where .git is a file, so a
+#    hand-built "$FH/.git/hooks" is simply wrong — FH runs worktree-isolated agents, so that path
+#    is reachable, not hypothetical).
+if ! git -C "$FH" rev-parse --git-dir >/dev/null 2>&1; then
+  # NOT a git repo (plugin-only / marketplace install, or a non-repo directory). A git hook cannot
+  # be installed here at all, so this floor is N/A — not missing. Applicability is decided
+  # mechanically, per CLAUDE.md §Irreversibility Surface-Class: reporting it would print an
+  # UNFIXABLE notice every session (emission is state-based), training the reader to ignore the
+  # one check that must not be ignored.
+  :
+else
+  # --path-format needs git >= 2.31; fall back to the relative form resolved against the repo root
+  # (still correct in a linked worktree, where a hand-built "$FH/.git/hooks" does not exist at all).
+  HD="$(git -C "$FH" rev-parse --path-format=absolute --git-path hooks 2>/dev/null)"
+  if [ -z "$HD" ]; then
+    _rel="$(git -C "$FH" rev-parse --git-path hooks 2>/dev/null || echo .git/hooks)"
+    case "$_rel" in /*) HD="$_rel" ;; *) HD="$(git -C "$FH" rev-parse --show-toplevel 2>/dev/null || echo "$FH")/$_rel" ;; esac
+  fi
+  for h in pre-commit pre-push; do
+    if [ ! -x "$HD/$h" ]; then
+      MISS="${MISS}no executable ${h} hook · "
+    elif ! grep -qE 'fh-gate|FH .*Gate|4-Axis|4축' "$HD/$h" 2>/dev/null; then
+      # Executable is not the same proposition as OURS. husky and pre-commit-framework are standard
+      # equipment in the JS/Python projects FH maps, and they install an executable pre-commit that
+      # runs a linter — under an executable-only probe such a machine reports "floors present" and
+      # then goes silent, which is precisely the accident this check exists to prevent.
+      MISS="${MISS}${h} hook present but not FH's gate (another framework owns it) · "
+    fi
+  done
+fi
+
+# ② companion-load hook (Mode D only). Reported as INFORMATION, never as a missing floor: this hook
+#    is registered for ALL users, and a public non-Mode-D user has no companion store to load, so
+#    listing it under ❌ would be a false positive for the majority path.
+#    APPLICABILITY: "is this a Mode D user", NOT "does settings.local.json exist". Keying on that
+#    file was wrong in the worst possible way — it is gitignored, so a FRESH CLONE never has it, and
+#    a fresh clone with a full companion store is EXACTLY the measured 2026-07-30 incident. The gate
+#    silenced its own flagship case. Mode D signals that survive a clone: an exported BE_DIR, or the
+#    operator's CLAUDE.local.md binding.
+COMPANION_NOTE=""
+_IS_MODE_D=""
+{ [ -n "${BE_DIR:-}" ] && [ -d "$BE_DIR" ]; } && _IS_MODE_D=1
+# CLAUDE.local.md is Claude Code's STANDARD local-override file — anyone may have one for any
+# reason, and having one says nothing about a companion store. Keying on its EXISTENCE re-admitted
+# the majority-path false positive through a second door, and state-based emission made it permanent
+# rather than one-shot (cross-family review 2026-07-30). So key on the file MENTIONING a companion
+# binding instead.
+# The vocabulary spans every backend the wizard documents — the store is a ROLE, not a repo layout
+# (Obsidian vault · gbrain ingest target · *-be repo all qualify), and an FH-flavoured regex would
+# have silently excluded two first-class backends: the same "flagship case goes quiet" shape as the
+# fresh-clone defect, one door over.
+# HONEST SCOPE: this is a MENTION test, not a semantic one. "I do not use a companion store" also
+# matches. The cost of that over-match is one informational line, never a floor claim — deliberately
+# the cheap direction, since the expensive direction is silence.
+[ -f "$FH/CLAUDE.local.md" ] \
+  && grep -qiE 'BE_DIR|companion[ -]store|컴패니언|vault|gbrain|obsidian' "$FH/CLAUDE.local.md" 2>/dev/null \
+  && _IS_MODE_D=1
+if [ -n "$_IS_MODE_D" ] && ! command -v python3 >/dev/null 2>&1; then
+  # not found ≠ 0: without a JSON parser the registration verdict is unknown, not clean.
+  COMPANION_NOTE="companion-load registration UNMEASURED (no python3 — cannot parse the hook config; do not read this as 'registered')"
+elif [ -n "$_IS_MODE_D" ]; then
+  python3 - "$FH" <<'PY' || COMPANION_NOTE="companion-load SessionStart not registered (Mode D — freshness + env-delta will not fire at turn 0)"
+import json, os, sys
+hub = sys.argv[1]
+for p in (os.path.join(hub, ".claude", "settings.local.json"),
+          os.path.expanduser("~/.claude/settings.json")):
+    try:
+        groups = json.load(open(p)).get("hooks", {}).get("SessionStart", [])
+    except Exception:
+        continue
+    if any("fh_session_load" in h.get("command", "") for g in groups for h in g.get("hooks", [])):
+        sys.exit(0)
+sys.exit(1)
+PY
+fi
+
+# ── event: infra delta since the commit this clone last saw ───────────────────
+# Reported ONCE per pull (it is an event). Distinguishes "no change" from "could not measure".
+INFRA=""; INFRA_NOTE=""
+if [ -n "$PREV_HEAD" ] && [ "$PREV_HEAD" != "$HEAD_NOW" ]; then
+  if INFRA_RAW="$(git -C "$FH" diff --name-only "${PREV_HEAD}..HEAD" 2>/dev/null)"; then
+    INFRA="$(printf '%s\n' "$INFRA_RAW" \
+      | grep -E '^(templates/\.git-hooks/|templates/settings\.|scripts/fh_|plugins/[^/]+/skills/install-(wizard|doctor)/)' \
+      | head -6)"
+  else
+    INFRA_NOTE="UNMEASURED — cannot reach the previously seen commit ($PREV_HEAD), so the infra delta was not computed (rebase, shallow clone, or GC). Not the same as 'nothing changed'."
+  fi
+fi
+
+IDENTITY=""
+if [ -z "$PREV_ID" ]; then IDENTITY="first session for this clone"
+elif [ "$PREV_ID" != "$NODE_ID" ]; then IDENTITY="machine changed ($PREV_ID → $NODE_ID)"; fi
+
+# ── state write — unconditional, and a failure is reported, never swallowed ────
+# Writing only when the check speaks would make the recorded timestamp mean "last time it spoke",
+# and a write failure would make this banner repeat forever with no explanation.
+STATE_WARN=""
+if ! { mkdir -p "$(dirname "$STATE")" 2>/dev/null \
+       && printf '%s|%s|%s' "$NODE_ID" "$NOW" "$HEAD_NOW" > "$STATE" 2>/dev/null; }; then
+  STATE_WARN="could not record node state ($STATE) — this notice may repeat every session"
+fi
+
+# ── emit: condition (every session) OR event (once) ───────────────────────────
+[ -n "$MISS$COMPANION_NOTE$INFRA$INFRA_NOTE$IDENTITY$STATE_WARN" ] || exit 0
+
+if [ -n "$MISS" ]; then
+  echo "🖥️  [node] Missing mechanical floor on this machine (node: $NODE_ID): ${MISS% · }"
+  echo "    → Run /install-doctor, then /install-wizard. A rich context (memory, companion store)"
+  echo "      is a different proposition from this machine being wired."
+elif [ -n "$IDENTITY" ]; then
+  echo "🖥️  [node] $IDENTITY (node: $NODE_ID) — floors present."
+fi
+[ -n "$STATE_WARN" ] && echo "    ⚠️  $STATE_WARN"
+[ -n "$COMPANION_NOTE" ] && echo "    ℹ️  $COMPANION_NOTE"
+if [ -n "$INFRA_NOTE" ]; then
+  echo "    ⚠️  $INFRA_NOTE"
+elif [ -n "$INFRA" ]; then
+  echo "    🆕 Install-relevant assets changed since this clone last ran — being registered is not"
+  echo "       the same as being current, and a pull moves files without wiring hooks:"
+  printf '%s\n' "$INFRA" | while IFS= read -r f; do [ -n "$f" ] && echo "       - $f"; done
+  echo "    → Re-run /install-wizard (idempotent)."
+fi
+
+exit 0

package/scripts/fh_session_load.sh

@@ -27,6 +27,51 @@
 set -uo pipefail
 
 FH="${HUB_DIR:-${CLAUDE_PROJECT_DIR:-$HOME/projects/forge-harness}}"
+BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook registration; no public default.
+                   # Resolved HERE (not at the Mode-D block below) because the frontier-digest check
+                   # needs it: on a multi-node setup the digest producer may be a DIFFERENT machine.
+
+# ── node re-entry floor check ────────────────────────────────────────────────
+# 이 검사는 scripts/fh_node_check.sh 로 분리했다. 이유: 이 파일(fh_session_load.sh)은 gitignored
+# settings.local.json 에 등록되므로 새 클론/새 기계에선 애초에 안 돈다 — 검사가 존재 이유가 되는
+# 상황에서 도달 불가였다(Sonnet 타깃-티어 심 2026-07-30 지적).
+# ⚠️ 분리해도 자동 배선은 아니다: .claude/settings.json 도 gitignored 라(.gitignore:3-4) 등록 자체는
+# 추적될 수 없다. 추적되는 건 templates/settings.SessionStart.snippet.json 이고, 배선은 위자드가 한다.
+# 여기서 다시 호출하지 않는다: 두 곳에서 부르면 같은 이벤트를 두 번 찍는다.
+
+# ── §early-refresh: 컴패니언 refresh 를 frontier 판정보다 먼저 한다 ─────────────
+# 왜 순서가 문제인가: frontier 판정은 러너가 아닌 노드에서 $BE/tracks-meta 를 본다. refresh 가
+# 그 뒤에 있으면 **그날의 첫 세션**은 아직 안 끌어온 워킹트리를 읽어 오늘 digest 를 못 보고,
+# 이 수정이 없애려던 바로 그 오경보를 그대로 낸다(하루 한 번, 가장 값진 시점에서 실패).
+# cross-family 리뷰 2026-07-30 [HIGH] 지적. 비-Mode-D(공개) 사용자는 BE 가 비어 통째로 건너뛴다.
+PULL_NOTE="(no companion store configured)"
+if [ -d "$BE/.git" ]; then
+  export GIT_TERMINAL_PROMPT=0
+  export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new}"
+
+  # Hard wall-clock deadline on the ONLY network step. ConnectTimeout bounds the handshake, but a
+  # slow/stalled TRANSFER after connect has no bound — measured 2026-07-12: SessionStart worst-case
+  # 17.5s with 2 hook-timeout kills, all attributable to the fetch. perl-alarm is the portable
+  # watchdog (macOS ships no coreutils `timeout`); on overrun the fetch dies and the offline branch
+  # reports honestly. FH_FETCH_DEADLINE overrides (seconds). If perl is absent the wrapper degrades
+  # to running the command with NO deadline — a missing watchdog must never become a permanently
+  # skipped fetch misreported as "offline" (challenger catch 2026-07-12).
+  if command -v perl >/dev/null 2>&1; then
+    _deadline() { perl -e 'alarm shift @ARGV; exec @ARGV' "$@"; }
+  else
+    _deadline() { shift; "$@"; }
+  fi
+  PULL_NOTE=""
+  if _deadline "${FH_FETCH_DEADLINE:-8}" git -C "$BE" fetch --quiet >/dev/null 2>&1; then
+    if git -C "$BE" merge --ff-only --quiet >/dev/null 2>&1; then
+      PULL_NOTE="fetched + fast-forwarded"
+    else
+      PULL_NOTE="fetched but NOT fast-forward (companion diverged — read local + newest remote)"
+    fi
+  else
+    PULL_NOTE="fetch skipped (offline or deadline hit — read local state)"
+  fi
+fi
 
 # ── frontier-digest: 부재를 0으로 읽지 않는다 ────────────────────────────────────
 # 왜: digest 는 launchd 로 매일 09:00 에 돌지만 **31회 중 6회(19%) 산출물 없이 끝났다**
@@ -51,9 +96,19 @@ _FD_STAMP="$(date +%H:%M) 기준"
 # 존재 판정은 러너 digest_ready 와 동일 술어(glob + -size +1k). 정확명 [ -f ] 는 러너와 관대함이
 # 갈린다 — partial 파일(>0 <1k)이 성공으로 오독되고, suffix 착지가 영구 오경보가 된다
 # (divergent-leniency: 같은 상태를 두 술어가 다르게 읽으면 한쪽 결과가 무음으로 샌다).
-_fd_ready() { find "$FH/tracks/_meta" -maxdepth 1 -name "frontier_digest_$(date +%Y_%m_%d)*.md" -size +1k 2>/dev/null | grep -q .; }
+_fd_hit() { find "$1" -maxdepth 1 -name "frontier_digest_$(date +%Y_%m_%d)*.md" -size +1k 2>/dev/null | grep -q .; }
+# 노드-로컬만 보면 **다른 머신이 만든 산출물이 구조적으로 안 보인다**. 멀티머신에선 러너가 한 대이고
+# 나머지 노드는 컴패니언 스토어로만 그 산출물을 받는다 → 러너 아닌 노드가 매일 "실패다" 오경보를 낸다.
+# (2026-07-30 실측: 프로가 07-24~30 매일 정상 생산 중인데 에어는 7일 연속 FAILED 를 띄웠다.
+# 계기의 스코프가 대상보다 좁았던 케이스 — 대상은 '오늘 digest 가 있나'지 '이 디스크에 있나'가 아니다.)
+# 술어는 로컬과 **동일**(glob + -size +1k) — divergent-leniency 를 만들지 않는다.
+_fd_ready() { _fd_hit "$FH/tracks/_meta" || { [ -n "$BE" ] && _fd_hit "$BE/tracks-meta"; }; }
 if _fd_ready; then
-  :
+  # 로컬엔 없고 컴패니언에만 있으면 = 이 노드는 러너가 아니다. 침묵하면 토폴로지가 안 보이므로 한 줄 알린다.
+  if ! _fd_hit "$FH/tracks/_meta"; then
+    echo "ℹ️  [frontier-digest] 오늘 digest 는 **다른 노드**가 생산했다(컴패니언 스토어 경유) — 이 노드는 러너가 아니다."
+    echo "    읽을 것: \$BE_DIR/tracks-meta/frontier_digest_$(date +%Y_%m_%d)*.md"
+  fi
 elif [ "$((10#$_FD_NOW))" -lt "$_FD_SCHED" ]; then
   echo "ℹ️  [frontier-digest] 오늘 digest 는 09:00 예정 — 아직 전이다($_FD_STAMP). 부재는 정상."
 elif [ -f "$_FD_LOG" ]; then
@@ -77,7 +132,7 @@ elif [ -f "$_FD_LOG" ]; then
 else
   echo "⚠️  [frontier-digest] 스케줄(09:00) 지났는데 로그도 산출물도 없다($_FD_STAMP) — 잡이 아예 안 돌았을 수 있다(launchd 확인)."
 fi
-BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook registration; no public default.
+# (BE is resolved at the top of this script — the frontier-digest block above needs it too.)
 
 # Non-Mode-D / no companion store → silent no-op (this is the majority path for public users).
 [ -d "$BE/.git" ] || exit 0
@@ -89,31 +144,7 @@ BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook re
 #    - fail-fast env: no credential/SSH/host-key prompts can hang SessionStart.
 #    - fetch + merge --ff-only: a fast-forward is the only safe hook mutation; a diverged companion
 #      simply does not advance (no merge commit, no conflict state left behind) and we say so.
-export GIT_TERMINAL_PROMPT=0
-export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new}"
-
-# Hard wall-clock deadline on the ONLY network step. ConnectTimeout bounds the handshake, but a
-# slow/stalled TRANSFER after connect has no bound — measured 2026-07-12: SessionStart worst-case
-# 17.5s with 2 hook-timeout kills, all attributable to the fetch. perl-alarm is the portable
-# watchdog (macOS ships no coreutils `timeout`); on overrun the fetch dies and the offline branch
-# reports honestly. FH_FETCH_DEADLINE overrides (seconds). If perl is absent the wrapper degrades
-# to running the command with NO deadline — a missing watchdog must never become a permanently
-# skipped fetch misreported as "offline" (challenger catch 2026-07-12).
-if command -v perl >/dev/null 2>&1; then
-  _deadline() { perl -e 'alarm shift @ARGV; exec @ARGV' "$@"; }
-else
-  _deadline() { shift; "$@"; }
-fi
-PULL_NOTE=""
-if _deadline "${FH_FETCH_DEADLINE:-8}" git -C "$BE" fetch --quiet >/dev/null 2>&1; then
-  if git -C "$BE" merge --ff-only --quiet >/dev/null 2>&1; then
-    PULL_NOTE="fetched + fast-forwarded"
-  else
-    PULL_NOTE="fetched but NOT fast-forward (companion diverged — read local + newest remote)"
-  fi
-else
-  PULL_NOTE="fetch skipped (offline or deadline hit — read local state)"
-fi
+# (컴패니언 refresh 는 위 §early-refresh 로 올렸다 — frontier 판정이 최신 트리를 보게 하려고.)
 
 # 2) Session card date (the pointer the operator's close chain writes last).
 CARD="$FH/tracks/_meta/reference_next_session_starter.md"

package/scripts/package_coverage_check.sh

@@ -43,6 +43,10 @@ fi
 #       no shipped hook invokes it.
 ACCEPTED_ABSENT=(
   ".claude/registry/LOCAL_SKILL_REGISTRY.md"
+  # An INSTALL DESTINATION the user creates (`cp templates/local_fh_context.md
+  # .claude/rules/local_fh_context.md`), not a file FH ships. Shipping it would overwrite the
+  # user's own cross-context wiring — the template it is copied FROM is what ships.
+  ".claude/rules/local_fh_context.md"
   ".claude/regression/probes.md"
   "scripts/sync-to-be.sh"
   "scripts/sync_guard_check.sh"
@@ -83,6 +87,24 @@ for s in shipped:
         # Only a path that REALLY EXISTS here but is left out of the tarball is this defect.
         # A path that exists nowhere is the ordinary phantom-reference class the ref-path
         # check above already owns; a path outside files[] that is also absent is nothing.
+        # EXISTENCE, not tracked-ness. A 2026-07-30 revision narrowed this to `git ls-files`
+        # to silence what looked like a machine-local false positive; measurement showed that was a
+        # WEAKENING — an existing-but-untracked path named by a shipped doc is exactly the defect
+        # (the npm user cannot have that file), and selfcheck's ref-path check SKIPs gitignored
+        # paths, so nothing else owns it. Reverted.
+        #
+        # WIDENING IS DEFERRED, AND THE REASON IS NOT A MEASUREMENT. Dropping `exists` entirely
+        # (flag every referenced ∧ ¬covered path) is arguably the correct predicate, but it cannot
+        # be evaluated while the extractor below is known-broken: its `(sh|py|js|md|json|…)`
+        # alternation puts `js` before `json`, so `settings.json` is captured as `settings.js`.
+        # A first pass at this comment cited a count of artifacts as evidence that `exists` is
+        # load-bearing — that count came FROM the broken extractor, i.e. an instrument was used to
+        # justify keeping a predicate before the instrument itself was validated (the circularity
+        # CLAUDE.md §Instrument-Calibration exists to forbid; a cross-family review caught it, and
+        # an independent extractor produced materially different numbers).
+        # HONEST STATE: fix the `js|json` alternation first, re-measure, then decide. Until then
+        # this check's true coverage is UNQUANTIFIED — treat a PASS as "no defect of the narrow
+        # exists-and-uncovered kind", not as "every shipped reference is sound".
         if os.path.exists(m) and not covered(m):
             if m in accepted:
                 exercised.add(m)

package/scripts/selfcheck.sh

@@ -132,6 +132,51 @@ fi
 # prevent. test_card_drift_probe.sh had shipped with ZERO callers since it was written; wiring it
 # here closes that, and the anchors are added to files[] in the same change so package mode runs
 # them too rather than reporting a deleted anchor.
+# sidecar_wait stdin plumbing. Its subject is dispatched by auto-decorrelation / steel-quench /
+# sim-conductor / AGENTS.md as the REQUIRED wait form, so a regression there silently empties every
+# cross-family verification. The anchor's first version shipped in tests/ with ZERO callers — the
+# same defect the comment above records for test_card_drift_probe.sh, repeated one file later.
+if [ ! -f scripts/sidecar_wait.sh ]; then
+  echo "SKIP  test_sidecar_wait_stdin.sh (subject scripts/sidecar_wait.sh absent)"
+elif [ -f scripts/test_sidecar_wait_stdin.sh ]; then
+  if ! bash scripts/test_sidecar_wait_stdin.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_sidecar_wait_stdin.sh: sidecar_wait.sh present but its anchor is missing"
+  fail=1
+fi
+
+# fh_node_check.sh gets the same treatment, and for the same reason: three adversarial rounds on it
+# produced defects that were ALL negative legs (floor N/A on a non-git install · another framework's
+# hooks counted as ours · the Mode D applicability gate silencing its own flagship case), and each
+# round's fix reverted a previous one because no anchor pinned it. Subject-present-but-anchor-absent
+# is a FAIL, not a skip — that is how an anchor gets quietly dropped.
+# Same treatment for the sidecar calibrator, same reason: its verdicts are all distinctions between
+# states that look identical from outside ("the sidecar ran" vs "the model I pinned answered",
+# "absent" vs "unmeasured"), and its lanes are hermetic stubs, so running them costs nothing.
+if [ ! -f scripts/sidecar_calibrate.sh ]; then
+  echo "SKIP  test_sidecar_calibrate_lanes.sh (subject scripts/sidecar_calibrate.sh absent)"
+elif [ -f scripts/test_sidecar_calibrate_lanes.sh ]; then
+  if ! bash scripts/test_sidecar_calibrate_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_sidecar_calibrate_lanes.sh: sidecar_calibrate.sh present but its anchor is missing"
+  fail=1
+fi
+
+if [ ! -f scripts/fh_node_check.sh ]; then
+  echo "SKIP  test_node_check_lanes.sh (subject scripts/fh_node_check.sh absent)"
+elif [ -f scripts/test_node_check_lanes.sh ]; then
+  if ! bash scripts/test_node_check_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_node_check_lanes.sh: fh_node_check.sh present but its anchor is missing"
+  fail=1
+fi
+
 for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe.sh; do
   if [ ! -f scripts/session_close_check.sh ]; then
     echo "SKIP  ${_anchor##*/} (subject scripts/session_close_check.sh absent)"

package/scripts/sidecar_calibrate.sh

@@ -0,0 +1,190 @@
+#!/usr/bin/env bash
+# sidecar_calibrate.sh — measure the cross-family sidecar panel before trusting it.
+#
+# WHY: `auto-decorrelation` and the load-bearing cross-family gate both ask "is a different-family
+# auditor reachable?" — and until now that question was answered from memory. Two measured failures
+# on 2026-07-30, one in each direction:
+#   · A marker was written claiming `cross-family unavailable this session`. Probed later in the same
+#     session, codex ran fine. Unavailability was DECLARED, never measured.
+#   · agy pinned with the slug `gemini-3.1-pro-high` answered as **Gemini 3.6 Flash** — silently, with
+#     no error. "The sidecar ran" and "the model I pinned answered" are different propositions, and
+#     only the second one licenses a claim about model-family diversity.
+# A panel you have not probed is not a panel; it is an assumption with a hostname.
+#
+# WHAT IT MEASURES, per runtime — four legs, because each catches a different lie:
+#   REACHABLE          the binary exists and runs at all
+#   PIN-OK / UNTRUSTED-PIN
+#                      a discriminating identity probe: does the answer NAME the model that was
+#                      pinned? A generic "OK" proves nothing — any model returns it. This is the only
+#                      anchor for a runtime that falls back silently.
+#   control: rejects-bogus / accepts-bogus
+#                      pin a model that cannot exist. This measures ONE thing only: whether unknown
+#                      names are validated. It does NOT mean known names are served faithfully, and
+#                      the gap between those is where the real trap lives — agy REJECTS nonsense yet
+#                      silently served Flash for `gemini-3.1-pro-high`, a slug from its own
+#                      catalogue (measured 2026-07-30). So `rejects-bogus` must never be read as
+#                      "the pin is safe": the identity probe still decides. `accepts-bogus` is the
+#                      stronger warning — there, the identity probe is the ONLY evidence at all.
+#   VERDICT-OK / VERDICT-UNPARSEABLE
+#                      ask for one bare token. A runtime that answers with agentic prose cannot carry
+#                      a machine-read verdict. Measured for agy at 1.0.14 (2026-07-04) and NOT
+#                      inherited here: the version has moved, and this file re-measures rather than
+#                      quoting. Fitness is a per-run measurement, not a property.
+#
+# Detector, never a gate: ALWAYS exits 0. It reports; the caller decides. A calibration run that
+# could block would make callers stop running it, which is the failure this exists to prevent.
+#
+# Cost: real API calls (3 short probes per runtime). Use --only to scope. `--stub-model` exists for
+# the lane harness so it can drive stub CLIs without touching a real catalogue.
+#
+# Usage:  bash scripts/sidecar_calibrate.sh [--only codex|agy] [--stub-model NAME] [--quiet]
+# Output: one block per runtime, then a PANEL line — the line a marker's `crossfamily:` leg quotes.
+
+set -uo pipefail
+
+ONLY=""; STUB_MODEL=""; QUIET=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --only) ONLY="${2:-}"; shift 2 ;;
+    --stub-model) STUB_MODEL="${2:-}"; shift 2 ;;
+    --quiet) QUIET=1; shift ;;
+    *) shift ;;
+  esac
+done
+
+TIMEOUT_BIN=""
+command -v timeout >/dev/null 2>&1 && TIMEOUT_BIN="timeout"
+command -v gtimeout >/dev/null 2>&1 && TIMEOUT_BIN="gtimeout"
+# No coreutils timeout on stock macOS. perl's alarm is the portable watchdog; if perl is missing too,
+# run WITHOUT a deadline rather than skipping the probe — a missing watchdog must never become a
+# silently skipped measurement reported as absence (the same rule fh_session_load.sh applies).
+_run() {
+  local secs="$1"; shift
+  if [ -n "$TIMEOUT_BIN" ]; then "$TIMEOUT_BIN" "$secs" "$@"
+  elif command -v perl >/dev/null 2>&1; then perl -e 'alarm shift @ARGV; exec @ARGV' "$secs" "$@"
+  else "$@"; fi
+}
+
+# _answer — reduce a runtime's stdout to THE MODEL'S ANSWER.
+# Measured on the first real run (2026-07-30): matching against whole stdout is unsound, because a
+# real CLI prints a session banner that REPEATS the pinned model back (`codex exec` emits its
+# version, workdir and model config before the reply). Under a whole-stdout match, a runtime that
+# merely echoes its own configuration passes the identity probe — the transport layer supplying the
+# very evidence the probe exists to obtain from the model. So: take the last non-empty line, skipping
+# trailing telemetry (`tokens used`, bare numbers, rule lines).
+# RESIDUAL, named: this is a heuristic on line position. A runtime that prints its answer and then
+# unrecognised trailing chatter would be mis-read. It is checked by the banner-echo lane, not proven
+# in general; a structured output mode (JSON) would replace the heuristic and none is used here yet.
+_answer() {
+  awk 'BEGIN{last=""}
+       {line=$0
+        gsub(/\r/,"",line)
+        gsub(/^[[:space:]]+|[[:space:]]+$/,"",line)
+        if (line=="") next
+        if (line ~ /^[-=_]{3,}$/) next
+        if (tolower(line) ~ /^tokens? used/) next
+        if (line ~ /^[0-9,.]+$/) next
+        last=line}
+       END{print last}'
+}
+
+IDENTITY_PROMPT="Answer with one line only: your exact model name and version."
+VERDICT_PROMPT="Reply with exactly one word, PASS or FAIL, and nothing else. The word is PASS."
+BOGUS_MODEL="zzz-nonexistent-model-9.9"
+
+PANEL=""
+
+# build_cmd <runtime> <model> <prompt> — fills CMD as an argv array.
+# NOT a shell function passed to the watchdog: `timeout`/`gtimeout` exec a BINARY and cannot see
+# shell functions, so an earlier revision fed them a function name and every probe came back as the
+# runtime failing to run (caught by lane 3/4b/5b, not by reading).
+build_cmd() {
+  case "$1" in
+    codex) CMD=(codex exec -m "$2" -c model_reasoning_effort=high --skip-git-repo-check "$3") ;;
+    agy)   CMD=(agy -p "$3" --model "$2" --print-timeout 170s) ;;
+    *)     CMD=("$1" "$3") ;;
+  esac
+}
+
+# probe_runtime <name> <real-model-pin>
+probe_runtime() {
+  local rt="$1" model="$2"
+  [ -n "$ONLY" ] && [ "$ONLY" != "$rt" ] && return 0
+  [ -n "$STUB_MODEL" ] && model="$STUB_MODEL"
+
+  if ! command -v "$rt" >/dev/null 2>&1; then
+    printf '%-6s ABSENT — not installed on this machine (absence measured, not assumed)\n' "$rt"
+    return 0
+  fi
+
+  local id_out pin_state ctl_out ctl_state v_out v_state
+  build_cmd "$rt" "$model" "$IDENTITY_PROMPT"
+  id_out="$(_run 200 "${CMD[@]}" 2>&1 | _answer)"
+
+  # Discriminating check — the answer must be the MODEL's self-report naming the model that was
+  # pinned. What counts as "naming it" is the VERSION token, not every token of the pin slug:
+  # vendors answer with a product name (`gpt-5.6-sol` → "GPT-5.6 Codex"), and demanding the suffix
+  # made this report UNTRUSTED-PIN for a pin that had actually held (measured 2026-07-30). The
+  # version is also exactly where the real failures differ — 3.1 asked, 3.6 answered. If a pin
+  # carries no version token at all, fall back to requiring the name words, since then there is
+  # nothing sharper to test.
+  local ver name_words hit=0
+  ver="$(printf '%s' "$model" | grep -oE '[0-9]+\.[0-9]+' | head -1)"
+  name_words="$(printf '%s' "$model" | tr 'A-Z' 'a-z' | sed -E 's/[^a-z]+/ /g' \
+        | tr ' ' '\n' | grep -E '^[a-z]{3,}$' \
+        | grep -vE '^(high|low|medium|thinking|the|exec)$' | head -1)"
+  if [ -n "$id_out" ]; then
+    if [ -n "$ver" ]; then
+      printf '%s' "$id_out" | grep -qF "$ver" && hit=1
+    elif [ -n "$name_words" ]; then
+      printf '%s' "$id_out" | tr 'A-Z' 'a-z' | grep -qF "$name_words" && hit=1
+    fi
+  fi
+  if [ "$hit" -eq 1 ]; then pin_state="PIN-OK"; else pin_state="UNTRUSTED-PIN"; fi
+
+  build_cmd "$rt" "$BOGUS_MODEL" "$IDENTITY_PROMPT"
+  ctl_out="$(_run 120 "${CMD[@]}" 2>&1)"
+  if [ $? -ne 0 ] || printf '%s' "$ctl_out" | grep -qiE 'not supported|invalid|unknown model|error'; then
+    ctl_state="rejects-bogus"
+  else
+    ctl_state="accepts-bogus"
+  fi
+
+  build_cmd "$rt" "$model" "$VERDICT_PROMPT"
+  v_out="$(_run 200 "${CMD[@]}" 2>&1 | _answer)"
+  # Parseable = a bare verdict token is recoverable from a short answer. Prose that merely CONTAINS
+  # the word does not qualify: a verdict channel must be readable without a human deciding what the
+  # runtime meant.
+  local v_compact
+  v_compact="$(printf '%s' "$v_out" | tr -s '[:space:]' ' ' | sed 's/^ *//; s/ *$//')"
+  if [ "${#v_compact}" -le 12 ] && printf '%s' "$v_compact" | grep -qiE '^(pass|fail)[.!]?$'; then
+    v_state="VERDICT-OK"
+  else
+    v_state="VERDICT-UNPARSEABLE"
+  fi
+
+  printf '%-6s REACHABLE · %s · control: %s · %s\n' "$rt" "$pin_state" "$ctl_state" "$v_state"
+  [ -z "$QUIET" ] && printf '       pinned: %s\n       identity said: %s\n' "$model" "$(printf '%s' "$id_out" | cut -c1-100)"
+  if [ "$ctl_state" = "accepts-bogus" ]; then
+    printf '       ⚠️  this runtime does not validate the pin at all, so the identity probe is the ONLY\n'
+    printf '           evidence that the intended model answered — a clean run proves nothing here.\n'
+  elif [ "$pin_state" = "UNTRUSTED-PIN" ]; then
+    printf '       ⚠️  it rejects UNKNOWN names, which says nothing about serving KNOWN ones faithfully.\n'
+    printf '           The identity probe disagreed with the pin — treat this runtime as substituting.\n'
+  fi
+  # Only a runtime whose pin is trustworthy counts toward the panel. A reachable runtime answering as
+  # some other model contributes no family diversity, which is the entire point of the panel.
+  [ "$pin_state" = "PIN-OK" ] && PANEL="${PANEL:+$PANEL, }$rt"
+  return 0
+}
+
+probe_runtime codex "gpt-5.6-sol"
+probe_runtime agy   "Gemini 3.1 Pro (High)"
+
+if [ -n "$PANEL" ]; then
+  echo "PANEL: $PANEL — usable different-family auditor(s), pin verified this run"
+else
+  echo "PANEL: none — no runtime passed the identity probe on this machine, this run"
+  echo "       State this, do not infer it: a marker's crossfamily leg may say 'none' but never stay silent."
+fi
+exit 0