@chrono-meta/fh-gate 1.4.77 → 1.4.78

package/plugins/fh-meta/skills/install-wizard/SKILL_detail.md

@@ -93,8 +93,71 @@ IDX
 WIRING="At session start: read \$BE_DIR/INDEX.md first; then ls -t paper-signals/ handoff/ digests/ and open anything newer than the session card (card=pointer, store commit=truth) — not only handoffs."
 grep -qF "read \$BE_DIR/INDEX.md first" "$HUB_DIR/CLAUDE.local.md" 2>/dev/null \
   || printf '\n## Companion-store session-start read\n%s\n' "$WIRING" >> "$HUB_DIR/CLAUDE.local.md"
+
+# 3. MECHANICAL FLOOR over that prose — register the SessionStart hooks (REQUIRED, not optional).
+#    WHY: step 2 writes an INSTRUCTION into CLAUDE.local.md. An instruction is salience: on task-first
+#    entry (the user's first message is a task, so the onboarding menu is correctly suppressed) or on a
+#    weaker tier, it silently does not fire and the session runs on stale local state. The two hooks
+#    below fire BEFORE turn 0 regardless of what the user types.
+#      - fh_session_load.sh   → companion freshness (this section's own load)
+#      - fh_env_delta_scan.sh → undeployed-sibling-repo discovery (CLAUDE.md claim ②; rated
+#                               PARTIAL/THEATER by the 2026-07-06 three-family audit while prose-only)
+#    Registration lives in the GITIGNORED .claude/settings.local.json — BE_DIR is an operator-private
+#    path and must never land in the project-shared settings.json. Idempotent: re-running replaces, never dups.
+#    Measured miss 2026-07-30 (n=2, a freshly installed second machine): neither hook was registered,
+#    so the Mode D load ran only because the operator happened to open with a greeting. A task-first
+#    first message would have skipped it entirely — on Opus, not merely on a weak tier.
+if [ -n "${BE_DIR:-}" ] && [ -d "$HUB_DIR/scripts" ]; then
+  # The real $BE_DIR is passed IN and baked into the command — never a "<your-store>" placeholder
+  # for the user to swap later. A placeholder written into a config file is a hook that reports
+  # "registered" and then silently resolves to a nonexistent path; the Sonnet target-tier sim
+  # (2026-07-30) named exactly this failure — the script prints success, the operator stops, the
+  # hook is dead. If a value must be substituted, substitute it at write time or do not write.
+  python3 - "$HUB_DIR" "$BE_DIR" <<'PY'
+import json, os, sys, collections
+hub, be = sys.argv[1], sys.argv[2]
+p = os.path.join(hub, ".claude", "settings.local.json")
+d = collections.OrderedDict()
+if os.path.exists(p):
+    with open(p) as fh:
+        d = json.load(fh, object_pairs_hook=collections.OrderedDict)
+cmd = lambda s: {"type": "command",
+                 "command": f'BE_DIR="{be}" bash "$CLAUDE_PROJECT_DIR/scripts/{s}"',
+                 "timeout": 20}
+if os.path.exists(p):   # back up before rewriting someone's config; a traceback mid-write truncates
+    import shutil; shutil.copy2(p, p + ".prewizard")
+hooks = d.setdefault("hooks", collections.OrderedDict())
+# Filter at HOOK level, not GROUP level: a user hook sharing a group with an FH hook would otherwise
+# be deleted with the group (cross-family review 2026-07-30 reproduced that loss).
+FH_HOOKS = ("fh_session_load.sh", "fh_env_delta_scan.sh")
+existing = []
+for g in hooks.get("SessionStart", []):
+    survivors = [h for h in g.get("hooks", [])
+                 if not any(n in h.get("command", "") for n in FH_HOOKS)]
+    if survivors:
+        g = dict(g); g["hooks"] = survivors; existing.append(g)
+hooks["SessionStart"] = existing + [
+    {"matcher": "", "hooks": [cmd("fh_session_load.sh"), cmd("fh_env_delta_scan.sh")]}]
+with open(p, "w") as fh:
+    json.dump(d, fh, indent=2, ensure_ascii=False); fh.write("\n")
+print("SessionStart hooks registered ->", p, "(backup: .prewizard)")
+PY
+  # VERIFY by running it once — a registration that was never executed is not a floor.
+  # Expected: a "companion-store freshness" line on stdout. If it prints nothing, BE_DIR is wrong.
+  BE_DIR="$BE_DIR" bash "$HUB_DIR/scripts/fh_session_load.sh" | head -3
+fi
 ```
 
+> **Known-pair check before calling this done** (per `measurement-integrity-checklist.md
+> §Instrument-Calibration`) — **run both legs, do not copy this verdict**:
+> - **known-positive** — `BE_DIR` set → a `companion-store freshness` line prints.
+> - **known-negative** — `BE_DIR` unset → **no companion block prints** and the script exits 0.
+>   It is *not* fully silent: the frontier-digest section runs above the Mode-D guard and speaks to
+>   every user about their own local digest. That is intended. An earlier draft of this note claimed
+>   the negative leg was silent and made that a ship-blocker; running it showed 171 bytes of correct
+>   frontier output — the note was written without executing the check it prescribed.
+> If the negative leg prints anything referencing the **companion store**, do not ship.
+
 - **Raw / Wiki / Conversation ingest axis** (`sync_push_protocols.md`): classify each artifact by
   processing stage — Raw (unprocessed capture) → stays raw; Wiki (distilled + `[[linked]]`) → the
   compounding layer; Conversation (dialogue/decision log). The Raw→Wiki distill is where linking earns
@@ -102,9 +165,16 @@ grep -qF "read \$BE_DIR/INDEX.md first" "$HUB_DIR/CLAUDE.local.md" 2>/dev/null \
 - **Backend note**: for an **Obsidian** backend the graph view is the *visual* observability surface
   (free for that backend); for the recommended **git `*-be`** form, observability is the agent querying
   INDEX + sections (no visualization needed). gbrain ingests the same markdown.
-- **Salience caveat**: the CLAUDE.local.md session-start read is prose (no SessionStart hook) — on a weak
-  tier it may silently not fire. Accepted limitation (mirrors `operational_adaptation.md §Guards`);
-  revisit if a target-tier sim measures a miss.
+- **Salience → mechanical (corrected 2026-07-30)**: this used to read *"the session-start read is prose
+  (no SessionStart hook) — accepted limitation; revisit if a target-tier sim measures a miss."* **Both
+  halves were wrong by then.** The hook exists (`scripts/fh_session_load.sh`, shipped 2026-07-05), and
+  the revisit-trigger has fired: a freshly installed second machine ran with **neither** SessionStart
+  hook registered, on Opus — the load fired only because that session happened to open with a greeting
+  instead of a task. So step 3 above **registers the hooks**; the CLAUDE.local.md prose stays as the
+  human-readable layer *over* that floor, never as the floor itself.
+  **Residual (named, not closed)**: registration lives in the gitignored `settings.local.json`, so a
+  user who re-clones the hub without re-running the wizard silently loses it again — the honest
+  backstop is `install-doctor`'s check item, not the wizard alone.
 
 
 ---
@@ -446,6 +516,50 @@ source "$FH_DIR/templates/fh_audit_check.zsh"
 EOF
 fi
 
+# Node floor check hook — ALL users, not Mode D only. Source of truth = the tracked snippet
+# templates/settings.SessionStart.snippet.json (`project_settings_json` key). Registration itself
+# cannot be tracked (every .claude/settings*.json path is gitignored), so the wizard is what wires it
+# — which is exactly why this must not be skipped: without it, a user on a fresh machine gets no
+# turn-0 signal that their floors are missing.
+# NPM-INSTALL PRECONDITION: this block reads the snippet from disk, so both it and
+# scripts/fh_node_check.sh must be in package.json `files[]`. They are (added 2026-07-30 after
+# scripts/package_coverage_check.sh caught the omission — without it an npm-installed wizard hit
+# FileNotFoundError here and registered nothing while reporting success upstream).
+python3 - "$FH_DIR" <<'PY'
+import json, os, sys, collections
+hub = sys.argv[1]
+snippet = os.path.join(hub, "templates", "settings.SessionStart.snippet.json")
+target = os.path.join(hub, ".claude", "settings.json")
+entry = json.load(open(snippet))["project_settings_json"]["hooks"]["SessionStart"]
+d = collections.OrderedDict()
+if os.path.exists(target):
+    d = json.load(open(target), object_pairs_hook=collections.OrderedDict)
+    import shutil; shutil.copy2(target, target + ".prewizard")   # back up before rewriting
+hooks = d.setdefault("hooks", collections.OrderedDict())
+# Merge at HOOK level, not group level. A group-level filter drops the whole group when a user's own
+# hook shares a group with the FH one — the common shape when someone hand-edits or appends to an
+# older wizard's output. (Cross-family review 2026-07-30 reproduced the loss: a group holding
+# [my_telemetry.sh, fh_session_load.sh] lost my_telemetry.sh entirely.)
+kept = []
+for g in hooks.get("SessionStart", []):
+    survivors = [h for h in g.get("hooks", []) if "fh_node_check" not in h.get("command", "")]
+    if survivors:
+        g = dict(g); g["hooks"] = survivors; kept.append(g)
+hooks["SessionStart"] = kept + entry
+os.makedirs(os.path.dirname(target), exist_ok=True)
+with open(target, "w") as fh:
+    json.dump(d, fh, indent=2, ensure_ascii=False); fh.write("\n")
+print("node-check SessionStart hook registered ->", target)
+PY
+chmod +x "$FH_DIR/scripts/fh_node_check.sh" 2>/dev/null
+# VERIFY against a THROWAWAY state file (FH_NODE_STATE). Verifying against the real state would
+# consume the user's one-shot event report, so their actual first session goes quiet and the notice
+# is buried in install output instead (cross-family review 2026-07-30).
+# known-pair: healthy machine → run 1 prints an event line, run 2 is SILENT.
+#             missing floor  → prints EVERY run (a floor gap is a condition, not an event).
+_T="$(mktemp)"; FH_NODE_STATE="$_T" bash "$FH_DIR/scripts/fh_node_check.sh"
+FH_NODE_STATE="$_T" bash "$FH_DIR/scripts/fh_node_check.sh"; rm -f "$_T"
+
 # 4-axis verification gate (Mode D / FH-self-development only — OPT-IN, double-confirm required)
 # SCOPE (state this before asking): this gates commits IN YOUR FH CLONE ($FH_DIR) — git commit there is
 #   blocked until the 4-axis markers pass. It is FH-internal infra (hardcodes hub paths/markers) and is

package/scripts/fh_node_check.sh

@@ -0,0 +1,184 @@
+#!/usr/bin/env bash
+# fh_node_check.sh — per-NODE environment floor check, fired at SessionStart.
+#
+# WHY A NODE-SCOPED CHECK EXISTS:
+#   A user's context (companion store, memory, session card) travels between machines; the machine's
+#   own wiring does not. A rich context makes an unwired laptop read as "already configured".
+#   Measured 2026-07-30: a machine holding the full companion store and memory ran sessions with its
+#   SessionStart hooks unregistered; nothing surfaced it — it was found by accident.
+#
+# WHY IT IS NOT INSIDE fh_session_load.sh:
+#   That script is registered in the gitignored .claude/settings.local.json, so on a fresh clone it
+#   is not registered — the situation this check exists for is the one in which it could not run.
+#   This script carries no operator-private path, so it can be registered from
+#   templates/settings.SessionStart.snippet.json, which IS tracked and ships with a clone.
+#   HONEST SCOPE: registration still requires the wizard to merge that snippet — every
+#   .claude/settings*.json path in this repo is gitignored, so no SessionStart entry can be tracked.
+#   The chicken-and-egg is REDUCED (script + snippet ship), not ELIMINATED (a user who never runs
+#   the wizard still gets nothing). An earlier revision of this header claimed "survives a clone";
+#   that was false, and a cross-family review caught it before merge. Do not restore the claim
+#   without running `git check-ignore` on the settings paths first.
+#
+# EMISSION IS STATE-BASED, NOT EVENT-BASED — this is the load-bearing design decision:
+#   A missing floor is a PERSISTENT CONDITION, so it is reported EVERY session until fixed.
+#   A healthy machine is silent AFTER its one event line (first session / machine change / infra
+#   delta) — events report once, conditions report until they stop being true.
+#   Earlier revisions fired on events only (first session / machine change / idle >= 7 days / HEAD
+#   advanced >= 20 commits) and that was wrong in both directions: on this hub's measured velocity
+#   (~33 commits/week) the commit axis fired every ~4 days on a healthy machine (noise, and an
+#   ignored detector cannot be revived), while a broken machine reported once then went quiet
+#   forever — reproducing the very accident above.
+#
+# Detector, never a gate: always exits 0, and it RECOMMENDS — it cannot compel.
+# State: tracks/_meta/.fh_node_state (gitignored; excluded from companion sync — it is machine-local
+# by nature, and mirroring it would make node identity flap between machines).
+# FH_NODE_STATE overrides the state path (used by the wizard's verification so that verifying does
+# not consume a one-shot event report).
+
+set -uo pipefail
+
+FH="${HUB_DIR:-${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}}"
+STATE="${FH_NODE_STATE:-$FH/tracks/_meta/.fh_node_state}"
+
+NODE_ID="${FH_MACHINE_ID:-$(hostname -s 2>/dev/null || echo unknown)}"
+HEAD_NOW="$(git -C "$FH" rev-parse --short HEAD 2>/dev/null || echo none)"
+NOW="$(date +%s)"
+
+PREV_ID=""; PREV_EPOCH=0; PREV_HEAD=""
+if [ -f "$STATE" ]; then
+  IFS='|' read -r PREV_ID PREV_EPOCH PREV_HEAD < "$STATE" 2>/dev/null || true
+fi
+# Never feed a file-sourced value straight into arithmetic (bash arithmetic evaluates command
+# substitution inside array subscripts).
+case "${PREV_EPOCH:-}" in ''|*[!0-9]*) PREV_EPOCH=0 ;; esac
+
+# ── floor probes — always run, before any decision about whether to speak ──────
+MISS=""
+
+# ① git-side floor. Probe the EXECUTABLE HOOK, not the config key: `core.hooksPath` unset is a
+#    normal working install when hooks live in .git/hooks, and a set-but-empty path is a broken
+#    install the key alone reports as fine. Resolve the directory with `git rev-parse --git-path`,
+#    which handles set/unset, relative/absolute, AND linked worktrees (where .git is a file, so a
+#    hand-built "$FH/.git/hooks" is simply wrong — FH runs worktree-isolated agents, so that path
+#    is reachable, not hypothetical).
+if ! git -C "$FH" rev-parse --git-dir >/dev/null 2>&1; then
+  # NOT a git repo (plugin-only / marketplace install, or a non-repo directory). A git hook cannot
+  # be installed here at all, so this floor is N/A — not missing. Applicability is decided
+  # mechanically, per CLAUDE.md §Irreversibility Surface-Class: reporting it would print an
+  # UNFIXABLE notice every session (emission is state-based), training the reader to ignore the
+  # one check that must not be ignored.
+  :
+else
+  # --path-format needs git >= 2.31; fall back to the relative form resolved against the repo root
+  # (still correct in a linked worktree, where a hand-built "$FH/.git/hooks" does not exist at all).
+  HD="$(git -C "$FH" rev-parse --path-format=absolute --git-path hooks 2>/dev/null)"
+  if [ -z "$HD" ]; then
+    _rel="$(git -C "$FH" rev-parse --git-path hooks 2>/dev/null || echo .git/hooks)"
+    case "$_rel" in /*) HD="$_rel" ;; *) HD="$(git -C "$FH" rev-parse --show-toplevel 2>/dev/null || echo "$FH")/$_rel" ;; esac
+  fi
+  for h in pre-commit pre-push; do
+    if [ ! -x "$HD/$h" ]; then
+      MISS="${MISS}no executable ${h} hook · "
+    elif ! grep -qE 'fh-gate|FH .*Gate|4-Axis|4축' "$HD/$h" 2>/dev/null; then
+      # Executable is not the same proposition as OURS. husky and pre-commit-framework are standard
+      # equipment in the JS/Python projects FH maps, and they install an executable pre-commit that
+      # runs a linter — under an executable-only probe such a machine reports "floors present" and
+      # then goes silent, which is precisely the accident this check exists to prevent.
+      MISS="${MISS}${h} hook present but not FH's gate (another framework owns it) · "
+    fi
+  done
+fi
+
+# ② companion-load hook (Mode D only). Reported as INFORMATION, never as a missing floor: this hook
+#    is registered for ALL users, and a public non-Mode-D user has no companion store to load, so
+#    listing it under ❌ would be a false positive for the majority path.
+#    APPLICABILITY: "is this a Mode D user", NOT "does settings.local.json exist". Keying on that
+#    file was wrong in the worst possible way — it is gitignored, so a FRESH CLONE never has it, and
+#    a fresh clone with a full companion store is EXACTLY the measured 2026-07-30 incident. The gate
+#    silenced its own flagship case. Mode D signals that survive a clone: an exported BE_DIR, or the
+#    operator's CLAUDE.local.md binding.
+COMPANION_NOTE=""
+_IS_MODE_D=""
+{ [ -n "${BE_DIR:-}" ] && [ -d "$BE_DIR" ]; } && _IS_MODE_D=1
+# CLAUDE.local.md is Claude Code's STANDARD local-override file — anyone may have one for any
+# reason, and having one says nothing about a companion store. Keying on its EXISTENCE re-admitted
+# the majority-path false positive through a second door, and state-based emission made it permanent
+# rather than one-shot (cross-family review 2026-07-30). So key on the file MENTIONING a companion
+# binding instead.
+# The vocabulary spans every backend the wizard documents — the store is a ROLE, not a repo layout
+# (Obsidian vault · gbrain ingest target · *-be repo all qualify), and an FH-flavoured regex would
+# have silently excluded two first-class backends: the same "flagship case goes quiet" shape as the
+# fresh-clone defect, one door over.
+# HONEST SCOPE: this is a MENTION test, not a semantic one. "I do not use a companion store" also
+# matches. The cost of that over-match is one informational line, never a floor claim — deliberately
+# the cheap direction, since the expensive direction is silence.
+[ -f "$FH/CLAUDE.local.md" ] \
+  && grep -qiE 'BE_DIR|companion[ -]store|컴패니언|vault|gbrain|obsidian' "$FH/CLAUDE.local.md" 2>/dev/null \
+  && _IS_MODE_D=1
+if [ -n "$_IS_MODE_D" ] && ! command -v python3 >/dev/null 2>&1; then
+  # not found ≠ 0: without a JSON parser the registration verdict is unknown, not clean.
+  COMPANION_NOTE="companion-load registration UNMEASURED (no python3 — cannot parse the hook config; do not read this as 'registered')"
+elif [ -n "$_IS_MODE_D" ]; then
+  python3 - "$FH" <<'PY' || COMPANION_NOTE="companion-load SessionStart not registered (Mode D — freshness + env-delta will not fire at turn 0)"
+import json, os, sys
+hub = sys.argv[1]
+for p in (os.path.join(hub, ".claude", "settings.local.json"),
+          os.path.expanduser("~/.claude/settings.json")):
+    try:
+        groups = json.load(open(p)).get("hooks", {}).get("SessionStart", [])
+    except Exception:
+        continue
+    if any("fh_session_load" in h.get("command", "") for g in groups for h in g.get("hooks", [])):
+        sys.exit(0)
+sys.exit(1)
+PY
+fi
+
+# ── event: infra delta since the commit this clone last saw ───────────────────
+# Reported ONCE per pull (it is an event). Distinguishes "no change" from "could not measure".
+INFRA=""; INFRA_NOTE=""
+if [ -n "$PREV_HEAD" ] && [ "$PREV_HEAD" != "$HEAD_NOW" ]; then
+  if INFRA_RAW="$(git -C "$FH" diff --name-only "${PREV_HEAD}..HEAD" 2>/dev/null)"; then
+    INFRA="$(printf '%s\n' "$INFRA_RAW" \
+      | grep -E '^(templates/\.git-hooks/|templates/settings\.|scripts/fh_|plugins/[^/]+/skills/install-(wizard|doctor)/)' \
+      | head -6)"
+  else
+    INFRA_NOTE="UNMEASURED — cannot reach the previously seen commit ($PREV_HEAD), so the infra delta was not computed (rebase, shallow clone, or GC). Not the same as 'nothing changed'."
+  fi
+fi
+
+IDENTITY=""
+if [ -z "$PREV_ID" ]; then IDENTITY="first session for this clone"
+elif [ "$PREV_ID" != "$NODE_ID" ]; then IDENTITY="machine changed ($PREV_ID → $NODE_ID)"; fi
+
+# ── state write — unconditional, and a failure is reported, never swallowed ────
+# Writing only when the check speaks would make the recorded timestamp mean "last time it spoke",
+# and a write failure would make this banner repeat forever with no explanation.
+STATE_WARN=""
+if ! { mkdir -p "$(dirname "$STATE")" 2>/dev/null \
+       && printf '%s|%s|%s' "$NODE_ID" "$NOW" "$HEAD_NOW" > "$STATE" 2>/dev/null; }; then
+  STATE_WARN="could not record node state ($STATE) — this notice may repeat every session"
+fi
+
+# ── emit: condition (every session) OR event (once) ───────────────────────────
+[ -n "$MISS$COMPANION_NOTE$INFRA$INFRA_NOTE$IDENTITY$STATE_WARN" ] || exit 0
+
+if [ -n "$MISS" ]; then
+  echo "🖥️  [node] Missing mechanical floor on this machine (node: $NODE_ID): ${MISS% · }"
+  echo "    → Run /install-doctor, then /install-wizard. A rich context (memory, companion store)"
+  echo "      is a different proposition from this machine being wired."
+elif [ -n "$IDENTITY" ]; then
+  echo "🖥️  [node] $IDENTITY (node: $NODE_ID) — floors present."
+fi
+[ -n "$STATE_WARN" ] && echo "    ⚠️  $STATE_WARN"
+[ -n "$COMPANION_NOTE" ] && echo "    ℹ️  $COMPANION_NOTE"
+if [ -n "$INFRA_NOTE" ]; then
+  echo "    ⚠️  $INFRA_NOTE"
+elif [ -n "$INFRA" ]; then
+  echo "    🆕 Install-relevant assets changed since this clone last ran — being registered is not"
+  echo "       the same as being current, and a pull moves files without wiring hooks:"
+  printf '%s\n' "$INFRA" | while IFS= read -r f; do [ -n "$f" ] && echo "       - $f"; done
+  echo "    → Re-run /install-wizard (idempotent)."
+fi
+
+exit 0

package/scripts/fh_session_load.sh

@@ -27,6 +27,51 @@
 set -uo pipefail
 
 FH="${HUB_DIR:-${CLAUDE_PROJECT_DIR:-$HOME/projects/forge-harness}}"
+BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook registration; no public default.
+                   # Resolved HERE (not at the Mode-D block below) because the frontier-digest check
+                   # needs it: on a multi-node setup the digest producer may be a DIFFERENT machine.
+
+# ── node re-entry floor check ────────────────────────────────────────────────
+# 이 검사는 scripts/fh_node_check.sh 로 분리했다. 이유: 이 파일(fh_session_load.sh)은 gitignored
+# settings.local.json 에 등록되므로 새 클론/새 기계에선 애초에 안 돈다 — 검사가 존재 이유가 되는
+# 상황에서 도달 불가였다(Sonnet 타깃-티어 심 2026-07-30 지적).
+# ⚠️ 분리해도 자동 배선은 아니다: .claude/settings.json 도 gitignored 라(.gitignore:3-4) 등록 자체는
+# 추적될 수 없다. 추적되는 건 templates/settings.SessionStart.snippet.json 이고, 배선은 위자드가 한다.
+# 여기서 다시 호출하지 않는다: 두 곳에서 부르면 같은 이벤트를 두 번 찍는다.
+
+# ── §early-refresh: 컴패니언 refresh 를 frontier 판정보다 먼저 한다 ─────────────
+# 왜 순서가 문제인가: frontier 판정은 러너가 아닌 노드에서 $BE/tracks-meta 를 본다. refresh 가
+# 그 뒤에 있으면 **그날의 첫 세션**은 아직 안 끌어온 워킹트리를 읽어 오늘 digest 를 못 보고,
+# 이 수정이 없애려던 바로 그 오경보를 그대로 낸다(하루 한 번, 가장 값진 시점에서 실패).
+# cross-family 리뷰 2026-07-30 [HIGH] 지적. 비-Mode-D(공개) 사용자는 BE 가 비어 통째로 건너뛴다.
+PULL_NOTE="(no companion store configured)"
+if [ -d "$BE/.git" ]; then
+  export GIT_TERMINAL_PROMPT=0
+  export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new}"
+
+  # Hard wall-clock deadline on the ONLY network step. ConnectTimeout bounds the handshake, but a
+  # slow/stalled TRANSFER after connect has no bound — measured 2026-07-12: SessionStart worst-case
+  # 17.5s with 2 hook-timeout kills, all attributable to the fetch. perl-alarm is the portable
+  # watchdog (macOS ships no coreutils `timeout`); on overrun the fetch dies and the offline branch
+  # reports honestly. FH_FETCH_DEADLINE overrides (seconds). If perl is absent the wrapper degrades
+  # to running the command with NO deadline — a missing watchdog must never become a permanently
+  # skipped fetch misreported as "offline" (challenger catch 2026-07-12).
+  if command -v perl >/dev/null 2>&1; then
+    _deadline() { perl -e 'alarm shift @ARGV; exec @ARGV' "$@"; }
+  else
+    _deadline() { shift; "$@"; }
+  fi
+  PULL_NOTE=""
+  if _deadline "${FH_FETCH_DEADLINE:-8}" git -C "$BE" fetch --quiet >/dev/null 2>&1; then
+    if git -C "$BE" merge --ff-only --quiet >/dev/null 2>&1; then
+      PULL_NOTE="fetched + fast-forwarded"
+    else
+      PULL_NOTE="fetched but NOT fast-forward (companion diverged — read local + newest remote)"
+    fi
+  else
+    PULL_NOTE="fetch skipped (offline or deadline hit — read local state)"
+  fi
+fi
 
 # ── frontier-digest: 부재를 0으로 읽지 않는다 ────────────────────────────────────
 # 왜: digest 는 launchd 로 매일 09:00 에 돌지만 **31회 중 6회(19%) 산출물 없이 끝났다**
@@ -51,9 +96,19 @@ _FD_STAMP="$(date +%H:%M) 기준"
 # 존재 판정은 러너 digest_ready 와 동일 술어(glob + -size +1k). 정확명 [ -f ] 는 러너와 관대함이
 # 갈린다 — partial 파일(>0 <1k)이 성공으로 오독되고, suffix 착지가 영구 오경보가 된다
 # (divergent-leniency: 같은 상태를 두 술어가 다르게 읽으면 한쪽 결과가 무음으로 샌다).
-_fd_ready() { find "$FH/tracks/_meta" -maxdepth 1 -name "frontier_digest_$(date +%Y_%m_%d)*.md" -size +1k 2>/dev/null | grep -q .; }
+_fd_hit() { find "$1" -maxdepth 1 -name "frontier_digest_$(date +%Y_%m_%d)*.md" -size +1k 2>/dev/null | grep -q .; }
+# 노드-로컬만 보면 **다른 머신이 만든 산출물이 구조적으로 안 보인다**. 멀티머신에선 러너가 한 대이고
+# 나머지 노드는 컴패니언 스토어로만 그 산출물을 받는다 → 러너 아닌 노드가 매일 "실패다" 오경보를 낸다.
+# (2026-07-30 실측: 프로가 07-24~30 매일 정상 생산 중인데 에어는 7일 연속 FAILED 를 띄웠다.
+# 계기의 스코프가 대상보다 좁았던 케이스 — 대상은 '오늘 digest 가 있나'지 '이 디스크에 있나'가 아니다.)
+# 술어는 로컬과 **동일**(glob + -size +1k) — divergent-leniency 를 만들지 않는다.
+_fd_ready() { _fd_hit "$FH/tracks/_meta" || { [ -n "$BE" ] && _fd_hit "$BE/tracks-meta"; }; }
 if _fd_ready; then
-  :
+  # 로컬엔 없고 컴패니언에만 있으면 = 이 노드는 러너가 아니다. 침묵하면 토폴로지가 안 보이므로 한 줄 알린다.
+  if ! _fd_hit "$FH/tracks/_meta"; then
+    echo "ℹ️  [frontier-digest] 오늘 digest 는 **다른 노드**가 생산했다(컴패니언 스토어 경유) — 이 노드는 러너가 아니다."
+    echo "    읽을 것: \$BE_DIR/tracks-meta/frontier_digest_$(date +%Y_%m_%d)*.md"
+  fi
 elif [ "$((10#$_FD_NOW))" -lt "$_FD_SCHED" ]; then
   echo "ℹ️  [frontier-digest] 오늘 digest 는 09:00 예정 — 아직 전이다($_FD_STAMP). 부재는 정상."
 elif [ -f "$_FD_LOG" ]; then
@@ -77,7 +132,7 @@ elif [ -f "$_FD_LOG" ]; then
 else
   echo "⚠️  [frontier-digest] 스케줄(09:00) 지났는데 로그도 산출물도 없다($_FD_STAMP) — 잡이 아예 안 돌았을 수 있다(launchd 확인)."
 fi
-BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook registration; no public default.
+# (BE is resolved at the top of this script — the frontier-digest block above needs it too.)
 
 # Non-Mode-D / no companion store → silent no-op (this is the majority path for public users).
 [ -d "$BE/.git" ] || exit 0
@@ -89,31 +144,7 @@ BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook re
 #    - fail-fast env: no credential/SSH/host-key prompts can hang SessionStart.
 #    - fetch + merge --ff-only: a fast-forward is the only safe hook mutation; a diverged companion
 #      simply does not advance (no merge commit, no conflict state left behind) and we say so.
-export GIT_TERMINAL_PROMPT=0
-export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new}"
-
-# Hard wall-clock deadline on the ONLY network step. ConnectTimeout bounds the handshake, but a
-# slow/stalled TRANSFER after connect has no bound — measured 2026-07-12: SessionStart worst-case
-# 17.5s with 2 hook-timeout kills, all attributable to the fetch. perl-alarm is the portable
-# watchdog (macOS ships no coreutils `timeout`); on overrun the fetch dies and the offline branch
-# reports honestly. FH_FETCH_DEADLINE overrides (seconds). If perl is absent the wrapper degrades
-# to running the command with NO deadline — a missing watchdog must never become a permanently
-# skipped fetch misreported as "offline" (challenger catch 2026-07-12).
-if command -v perl >/dev/null 2>&1; then
-  _deadline() { perl -e 'alarm shift @ARGV; exec @ARGV' "$@"; }
-else
-  _deadline() { shift; "$@"; }
-fi
-PULL_NOTE=""
-if _deadline "${FH_FETCH_DEADLINE:-8}" git -C "$BE" fetch --quiet >/dev/null 2>&1; then
-  if git -C "$BE" merge --ff-only --quiet >/dev/null 2>&1; then
-    PULL_NOTE="fetched + fast-forwarded"
-  else
-    PULL_NOTE="fetched but NOT fast-forward (companion diverged — read local + newest remote)"
-  fi
-else
-  PULL_NOTE="fetch skipped (offline or deadline hit — read local state)"
-fi
+# (컴패니언 refresh 는 위 §early-refresh 로 올렸다 — frontier 판정이 최신 트리를 보게 하려고.)
 
 # 2) Session card date (the pointer the operator's close chain writes last).
 CARD="$FH/tracks/_meta/reference_next_session_starter.md"

package/scripts/package_coverage_check.sh

@@ -43,6 +43,10 @@ fi
 #       no shipped hook invokes it.
 ACCEPTED_ABSENT=(
   ".claude/registry/LOCAL_SKILL_REGISTRY.md"
+  # An INSTALL DESTINATION the user creates (`cp templates/local_fh_context.md
+  # .claude/rules/local_fh_context.md`), not a file FH ships. Shipping it would overwrite the
+  # user's own cross-context wiring — the template it is copied FROM is what ships.
+  ".claude/rules/local_fh_context.md"
   ".claude/regression/probes.md"
   "scripts/sync-to-be.sh"
   "scripts/sync_guard_check.sh"
@@ -83,6 +87,24 @@ for s in shipped:
         # Only a path that REALLY EXISTS here but is left out of the tarball is this defect.
         # A path that exists nowhere is the ordinary phantom-reference class the ref-path
         # check above already owns; a path outside files[] that is also absent is nothing.
+        # EXISTENCE, not tracked-ness. A 2026-07-30 revision narrowed this to `git ls-files`
+        # to silence what looked like a machine-local false positive; measurement showed that was a
+        # WEAKENING — an existing-but-untracked path named by a shipped doc is exactly the defect
+        # (the npm user cannot have that file), and selfcheck's ref-path check SKIPs gitignored
+        # paths, so nothing else owns it. Reverted.
+        #
+        # WIDENING IS DEFERRED, AND THE REASON IS NOT A MEASUREMENT. Dropping `exists` entirely
+        # (flag every referenced ∧ ¬covered path) is arguably the correct predicate, but it cannot
+        # be evaluated while the extractor below is known-broken: its `(sh|py|js|md|json|…)`
+        # alternation puts `js` before `json`, so `settings.json` is captured as `settings.js`.
+        # A first pass at this comment cited a count of artifacts as evidence that `exists` is
+        # load-bearing — that count came FROM the broken extractor, i.e. an instrument was used to
+        # justify keeping a predicate before the instrument itself was validated (the circularity
+        # CLAUDE.md §Instrument-Calibration exists to forbid; a cross-family review caught it, and
+        # an independent extractor produced materially different numbers).
+        # HONEST STATE: fix the `js|json` alternation first, re-measure, then decide. Until then
+        # this check's true coverage is UNQUANTIFIED — treat a PASS as "no defect of the narrow
+        # exists-and-uncovered kind", not as "every shipped reference is sound".
         if os.path.exists(m) and not covered(m):
             if m in accepted:
                 exercised.add(m)

package/scripts/selfcheck.sh

@@ -132,21 +132,6 @@ fi
 # prevent. test_card_drift_probe.sh had shipped with ZERO callers since it was written; wiring it
 # here closes that, and the anchors are added to files[] in the same change so package mode runs
 # them too rather than reporting a deleted anchor.
-# consent-class registry floor. Its subject decides whether standing consent may skip an approval
-# prompt, so an uncalibrated instrument there hands out autonomy the operator never granted. The
-# anchor was written into tests/ with ZERO callers first — the same defect this file already
-# records twice above; wiring it here is the fix, not a note about the fix.
-if [ ! -f scripts/consent_registry_check.sh ]; then
-  echo "SKIP  test_consent_registry.sh (subject scripts/consent_registry_check.sh absent)"
-elif [ -f scripts/test_consent_registry.sh ]; then
-  if ! bash scripts/test_consent_registry.sh; then
-    fail=1
-  fi
-else
-  echo "FAIL  test_consent_registry.sh: consent_registry_check.sh present but its anchor is missing"
-  fail=1
-fi
-
 # sidecar_wait stdin plumbing. Its subject is dispatched by auto-decorrelation / steel-quench /
 # sim-conductor / AGENTS.md as the REQUIRED wait form, so a regression there silently empties every
 # cross-family verification. The anchor's first version shipped in tests/ with ZERO callers — the
@@ -162,6 +147,36 @@ else
   fail=1
 fi
 
+# fh_node_check.sh gets the same treatment, and for the same reason: three adversarial rounds on it
+# produced defects that were ALL negative legs (floor N/A on a non-git install · another framework's
+# hooks counted as ours · the Mode D applicability gate silencing its own flagship case), and each
+# round's fix reverted a previous one because no anchor pinned it. Subject-present-but-anchor-absent
+# is a FAIL, not a skip — that is how an anchor gets quietly dropped.
+# Same treatment for the sidecar calibrator, same reason: its verdicts are all distinctions between
+# states that look identical from outside ("the sidecar ran" vs "the model I pinned answered",
+# "absent" vs "unmeasured"), and its lanes are hermetic stubs, so running them costs nothing.
+if [ ! -f scripts/sidecar_calibrate.sh ]; then
+  echo "SKIP  test_sidecar_calibrate_lanes.sh (subject scripts/sidecar_calibrate.sh absent)"
+elif [ -f scripts/test_sidecar_calibrate_lanes.sh ]; then
+  if ! bash scripts/test_sidecar_calibrate_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_sidecar_calibrate_lanes.sh: sidecar_calibrate.sh present but its anchor is missing"
+  fail=1
+fi
+
+if [ ! -f scripts/fh_node_check.sh ]; then
+  echo "SKIP  test_node_check_lanes.sh (subject scripts/fh_node_check.sh absent)"
+elif [ -f scripts/test_node_check_lanes.sh ]; then
+  if ! bash scripts/test_node_check_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_node_check_lanes.sh: fh_node_check.sh present but its anchor is missing"
+  fail=1
+fi
+
 for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe.sh; do
   if [ ! -f scripts/session_close_check.sh ]; then
     echo "SKIP  ${_anchor##*/} (subject scripts/session_close_check.sh absent)"