@chrono-meta/fh-gate 1.4.77 → 1.4.79

package/plugins/fh-meta/skills/install-wizard/SKILL_detail.md

@@ -93,8 +93,71 @@ IDX
 WIRING="At session start: read \$BE_DIR/INDEX.md first; then ls -t paper-signals/ handoff/ digests/ and open anything newer than the session card (card=pointer, store commit=truth) — not only handoffs."
 grep -qF "read \$BE_DIR/INDEX.md first" "$HUB_DIR/CLAUDE.local.md" 2>/dev/null \
   || printf '\n## Companion-store session-start read\n%s\n' "$WIRING" >> "$HUB_DIR/CLAUDE.local.md"
+
+# 3. MECHANICAL FLOOR over that prose — register the SessionStart hooks (REQUIRED, not optional).
+#    WHY: step 2 writes an INSTRUCTION into CLAUDE.local.md. An instruction is salience: on task-first
+#    entry (the user's first message is a task, so the onboarding menu is correctly suppressed) or on a
+#    weaker tier, it silently does not fire and the session runs on stale local state. The two hooks
+#    below fire BEFORE turn 0 regardless of what the user types.
+#      - fh_session_load.sh   → companion freshness (this section's own load)
+#      - fh_env_delta_scan.sh → undeployed-sibling-repo discovery (CLAUDE.md claim ②; rated
+#                               PARTIAL/THEATER by the 2026-07-06 three-family audit while prose-only)
+#    Registration lives in the GITIGNORED .claude/settings.local.json — BE_DIR is an operator-private
+#    path and must never land in the project-shared settings.json. Idempotent: re-running replaces, never dups.
+#    Measured miss 2026-07-30 (n=2, a freshly installed second machine): neither hook was registered,
+#    so the Mode D load ran only because the operator happened to open with a greeting. A task-first
+#    first message would have skipped it entirely — on Opus, not merely on a weak tier.
+if [ -n "${BE_DIR:-}" ] && [ -d "$HUB_DIR/scripts" ]; then
+  # The real $BE_DIR is passed IN and baked into the command — never a "<your-store>" placeholder
+  # for the user to swap later. A placeholder written into a config file is a hook that reports
+  # "registered" and then silently resolves to a nonexistent path; the Sonnet target-tier sim
+  # (2026-07-30) named exactly this failure — the script prints success, the operator stops, the
+  # hook is dead. If a value must be substituted, substitute it at write time or do not write.
+  python3 - "$HUB_DIR" "$BE_DIR" <<'PY'
+import json, os, sys, collections
+hub, be = sys.argv[1], sys.argv[2]
+p = os.path.join(hub, ".claude", "settings.local.json")
+d = collections.OrderedDict()
+if os.path.exists(p):
+    with open(p) as fh:
+        d = json.load(fh, object_pairs_hook=collections.OrderedDict)
+cmd = lambda s: {"type": "command",
+                 "command": f'BE_DIR="{be}" bash "$CLAUDE_PROJECT_DIR/scripts/{s}"',
+                 "timeout": 20}
+if os.path.exists(p):   # back up before rewriting someone's config; a traceback mid-write truncates
+    import shutil; shutil.copy2(p, p + ".prewizard")
+hooks = d.setdefault("hooks", collections.OrderedDict())
+# Filter at HOOK level, not GROUP level: a user hook sharing a group with an FH hook would otherwise
+# be deleted with the group (cross-family review 2026-07-30 reproduced that loss).
+FH_HOOKS = ("fh_session_load.sh", "fh_env_delta_scan.sh")
+existing = []
+for g in hooks.get("SessionStart", []):
+    survivors = [h for h in g.get("hooks", [])
+                 if not any(n in h.get("command", "") for n in FH_HOOKS)]
+    if survivors:
+        g = dict(g); g["hooks"] = survivors; existing.append(g)
+hooks["SessionStart"] = existing + [
+    {"matcher": "", "hooks": [cmd("fh_session_load.sh"), cmd("fh_env_delta_scan.sh")]}]
+with open(p, "w") as fh:
+    json.dump(d, fh, indent=2, ensure_ascii=False); fh.write("\n")
+print("SessionStart hooks registered ->", p, "(backup: .prewizard)")
+PY
+  # VERIFY by running it once — a registration that was never executed is not a floor.
+  # Expected: a "companion-store freshness" line on stdout. If it prints nothing, BE_DIR is wrong.
+  BE_DIR="$BE_DIR" bash "$HUB_DIR/scripts/fh_session_load.sh" | head -3
+fi
 ```
 
+> **Known-pair check before calling this done** (per `measurement-integrity-checklist.md
+> §Instrument-Calibration`) — **run both legs, do not copy this verdict**:
+> - **known-positive** — `BE_DIR` set → a `companion-store freshness` line prints.
+> - **known-negative** — `BE_DIR` unset → **no companion block prints** and the script exits 0.
+>   It is *not* fully silent: the frontier-digest section runs above the Mode-D guard and speaks to
+>   every user about their own local digest. That is intended. An earlier draft of this note claimed
+>   the negative leg was silent and made that a ship-blocker; running it showed 171 bytes of correct
+>   frontier output — the note was written without executing the check it prescribed.
+> If the negative leg prints anything referencing the **companion store**, do not ship.
+
 - **Raw / Wiki / Conversation ingest axis** (`sync_push_protocols.md`): classify each artifact by
   processing stage — Raw (unprocessed capture) → stays raw; Wiki (distilled + `[[linked]]`) → the
   compounding layer; Conversation (dialogue/decision log). The Raw→Wiki distill is where linking earns
@@ -102,9 +165,16 @@ grep -qF "read \$BE_DIR/INDEX.md first" "$HUB_DIR/CLAUDE.local.md" 2>/dev/null \
 - **Backend note**: for an **Obsidian** backend the graph view is the *visual* observability surface
   (free for that backend); for the recommended **git `*-be`** form, observability is the agent querying
   INDEX + sections (no visualization needed). gbrain ingests the same markdown.
-- **Salience caveat**: the CLAUDE.local.md session-start read is prose (no SessionStart hook) — on a weak
-  tier it may silently not fire. Accepted limitation (mirrors `operational_adaptation.md §Guards`);
-  revisit if a target-tier sim measures a miss.
+- **Salience → mechanical (corrected 2026-07-30)**: this used to read *"the session-start read is prose
+  (no SessionStart hook) — accepted limitation; revisit if a target-tier sim measures a miss."* **Both
+  halves were wrong by then.** The hook exists (`scripts/fh_session_load.sh`, shipped 2026-07-05), and
+  the revisit-trigger has fired: a freshly installed second machine ran with **neither** SessionStart
+  hook registered, on Opus — the load fired only because that session happened to open with a greeting
+  instead of a task. So step 3 above **registers the hooks**; the CLAUDE.local.md prose stays as the
+  human-readable layer *over* that floor, never as the floor itself.
+  **Residual (named, not closed)**: registration lives in the gitignored `settings.local.json`, so a
+  user who re-clones the hub without re-running the wizard silently loses it again — the honest
+  backstop is `install-doctor`'s check item, not the wizard alone.
 
 
 ---
@@ -446,6 +516,50 @@ source "$FH_DIR/templates/fh_audit_check.zsh"
 EOF
 fi
 
+# Node floor check hook — ALL users, not Mode D only. Source of truth = the tracked snippet
+# templates/settings.SessionStart.snippet.json (`project_settings_json` key). Registration itself
+# cannot be tracked (every .claude/settings*.json path is gitignored), so the wizard is what wires it
+# — which is exactly why this must not be skipped: without it, a user on a fresh machine gets no
+# turn-0 signal that their floors are missing.
+# NPM-INSTALL PRECONDITION: this block reads the snippet from disk, so both it and
+# scripts/fh_node_check.sh must be in package.json `files[]`. They are (added 2026-07-30 after
+# scripts/package_coverage_check.sh caught the omission — without it an npm-installed wizard hit
+# FileNotFoundError here and registered nothing while reporting success upstream).
+python3 - "$FH_DIR" <<'PY'
+import json, os, sys, collections
+hub = sys.argv[1]
+snippet = os.path.join(hub, "templates", "settings.SessionStart.snippet.json")
+target = os.path.join(hub, ".claude", "settings.json")
+entry = json.load(open(snippet))["project_settings_json"]["hooks"]["SessionStart"]
+d = collections.OrderedDict()
+if os.path.exists(target):
+    d = json.load(open(target), object_pairs_hook=collections.OrderedDict)
+    import shutil; shutil.copy2(target, target + ".prewizard")   # back up before rewriting
+hooks = d.setdefault("hooks", collections.OrderedDict())
+# Merge at HOOK level, not group level. A group-level filter drops the whole group when a user's own
+# hook shares a group with the FH one — the common shape when someone hand-edits or appends to an
+# older wizard's output. (Cross-family review 2026-07-30 reproduced the loss: a group holding
+# [my_telemetry.sh, fh_session_load.sh] lost my_telemetry.sh entirely.)
+kept = []
+for g in hooks.get("SessionStart", []):
+    survivors = [h for h in g.get("hooks", []) if "fh_node_check" not in h.get("command", "")]
+    if survivors:
+        g = dict(g); g["hooks"] = survivors; kept.append(g)
+hooks["SessionStart"] = kept + entry
+os.makedirs(os.path.dirname(target), exist_ok=True)
+with open(target, "w") as fh:
+    json.dump(d, fh, indent=2, ensure_ascii=False); fh.write("\n")
+print("node-check SessionStart hook registered ->", target)
+PY
+chmod +x "$FH_DIR/scripts/fh_node_check.sh" 2>/dev/null
+# VERIFY against a THROWAWAY state file (FH_NODE_STATE). Verifying against the real state would
+# consume the user's one-shot event report, so their actual first session goes quiet and the notice
+# is buried in install output instead (cross-family review 2026-07-30).
+# known-pair: healthy machine → run 1 prints an event line, run 2 is SILENT.
+#             missing floor  → prints EVERY run (a floor gap is a condition, not an event).
+_T="$(mktemp)"; FH_NODE_STATE="$_T" bash "$FH_DIR/scripts/fh_node_check.sh"
+FH_NODE_STATE="$_T" bash "$FH_DIR/scripts/fh_node_check.sh"; rm -f "$_T"
+
 # 4-axis verification gate (Mode D / FH-self-development only — OPT-IN, double-confirm required)
 # SCOPE (state this before asking): this gates commits IN YOUR FH CLONE ($FH_DIR) — git commit there is
 #   blocked until the 4-axis markers pass. It is FH-internal infra (hardcodes hub paths/markers) and is

package/scripts/fh_node_check.sh

@@ -0,0 +1,184 @@
+#!/usr/bin/env bash
+# fh_node_check.sh — per-NODE environment floor check, fired at SessionStart.
+#
+# WHY A NODE-SCOPED CHECK EXISTS:
+#   A user's context (companion store, memory, session card) travels between machines; the machine's
+#   own wiring does not. A rich context makes an unwired laptop read as "already configured".
+#   Measured 2026-07-30: a machine holding the full companion store and memory ran sessions with its
+#   SessionStart hooks unregistered; nothing surfaced it — it was found by accident.
+#
+# WHY IT IS NOT INSIDE fh_session_load.sh:
+#   That script is registered in the gitignored .claude/settings.local.json, so on a fresh clone it
+#   is not registered — the situation this check exists for is the one in which it could not run.
+#   This script carries no operator-private path, so it can be registered from
+#   templates/settings.SessionStart.snippet.json, which IS tracked and ships with a clone.
+#   HONEST SCOPE: registration still requires the wizard to merge that snippet — every
+#   .claude/settings*.json path in this repo is gitignored, so no SessionStart entry can be tracked.
+#   The chicken-and-egg is REDUCED (script + snippet ship), not ELIMINATED (a user who never runs
+#   the wizard still gets nothing). An earlier revision of this header claimed "survives a clone";
+#   that was false, and a cross-family review caught it before merge. Do not restore the claim
+#   without running `git check-ignore` on the settings paths first.
+#
+# EMISSION IS STATE-BASED, NOT EVENT-BASED — this is the load-bearing design decision:
+#   A missing floor is a PERSISTENT CONDITION, so it is reported EVERY session until fixed.
+#   A healthy machine is silent AFTER its one event line (first session / machine change / infra
+#   delta) — events report once, conditions report until they stop being true.
+#   Earlier revisions fired on events only (first session / machine change / idle >= 7 days / HEAD
+#   advanced >= 20 commits) and that was wrong in both directions: on this hub's measured velocity
+#   (~33 commits/week) the commit axis fired every ~4 days on a healthy machine (noise, and an
+#   ignored detector cannot be revived), while a broken machine reported once then went quiet
+#   forever — reproducing the very accident above.
+#
+# Detector, never a gate: always exits 0, and it RECOMMENDS — it cannot compel.
+# State: tracks/_meta/.fh_node_state (gitignored; excluded from companion sync — it is machine-local
+# by nature, and mirroring it would make node identity flap between machines).
+# FH_NODE_STATE overrides the state path (used by the wizard's verification so that verifying does
+# not consume a one-shot event report).
+
+set -uo pipefail
+
+FH="${HUB_DIR:-${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}}"
+STATE="${FH_NODE_STATE:-$FH/tracks/_meta/.fh_node_state}"
+
+NODE_ID="${FH_MACHINE_ID:-$(hostname -s 2>/dev/null || echo unknown)}"
+HEAD_NOW="$(git -C "$FH" rev-parse --short HEAD 2>/dev/null || echo none)"
+NOW="$(date +%s)"
+
+PREV_ID=""; PREV_EPOCH=0; PREV_HEAD=""
+if [ -f "$STATE" ]; then
+  IFS='|' read -r PREV_ID PREV_EPOCH PREV_HEAD < "$STATE" 2>/dev/null || true
+fi
+# Never feed a file-sourced value straight into arithmetic (bash arithmetic evaluates command
+# substitution inside array subscripts).
+case "${PREV_EPOCH:-}" in ''|*[!0-9]*) PREV_EPOCH=0 ;; esac
+
+# ── floor probes — always run, before any decision about whether to speak ──────
+MISS=""
+
+# ① git-side floor. Probe the EXECUTABLE HOOK, not the config key: `core.hooksPath` unset is a
+#    normal working install when hooks live in .git/hooks, and a set-but-empty path is a broken
+#    install the key alone reports as fine. Resolve the directory with `git rev-parse --git-path`,
+#    which handles set/unset, relative/absolute, AND linked worktrees (where .git is a file, so a
+#    hand-built "$FH/.git/hooks" is simply wrong — FH runs worktree-isolated agents, so that path
+#    is reachable, not hypothetical).
+if ! git -C "$FH" rev-parse --git-dir >/dev/null 2>&1; then
+  # NOT a git repo (plugin-only / marketplace install, or a non-repo directory). A git hook cannot
+  # be installed here at all, so this floor is N/A — not missing. Applicability is decided
+  # mechanically, per CLAUDE.md §Irreversibility Surface-Class: reporting it would print an
+  # UNFIXABLE notice every session (emission is state-based), training the reader to ignore the
+  # one check that must not be ignored.
+  :
+else
+  # --path-format needs git >= 2.31; fall back to the relative form resolved against the repo root
+  # (still correct in a linked worktree, where a hand-built "$FH/.git/hooks" does not exist at all).
+  HD="$(git -C "$FH" rev-parse --path-format=absolute --git-path hooks 2>/dev/null)"
+  if [ -z "$HD" ]; then
+    _rel="$(git -C "$FH" rev-parse --git-path hooks 2>/dev/null || echo .git/hooks)"
+    case "$_rel" in /*) HD="$_rel" ;; *) HD="$(git -C "$FH" rev-parse --show-toplevel 2>/dev/null || echo "$FH")/$_rel" ;; esac
+  fi
+  for h in pre-commit pre-push; do
+    if [ ! -x "$HD/$h" ]; then
+      MISS="${MISS}no executable ${h} hook · "
+    elif ! grep -qE 'fh-gate|FH .*Gate|4-Axis|4축' "$HD/$h" 2>/dev/null; then
+      # Executable is not the same proposition as OURS. husky and pre-commit-framework are standard
+      # equipment in the JS/Python projects FH maps, and they install an executable pre-commit that
+      # runs a linter — under an executable-only probe such a machine reports "floors present" and
+      # then goes silent, which is precisely the accident this check exists to prevent.
+      MISS="${MISS}${h} hook present but not FH's gate (another framework owns it) · "
+    fi
+  done
+fi
+
+# ② companion-load hook (Mode D only). Reported as INFORMATION, never as a missing floor: this hook
+#    is registered for ALL users, and a public non-Mode-D user has no companion store to load, so
+#    listing it under ❌ would be a false positive for the majority path.
+#    APPLICABILITY: "is this a Mode D user", NOT "does settings.local.json exist". Keying on that
+#    file was wrong in the worst possible way — it is gitignored, so a FRESH CLONE never has it, and
+#    a fresh clone with a full companion store is EXACTLY the measured 2026-07-30 incident. The gate
+#    silenced its own flagship case. Mode D signals that survive a clone: an exported BE_DIR, or the
+#    operator's CLAUDE.local.md binding.
+COMPANION_NOTE=""
+_IS_MODE_D=""
+{ [ -n "${BE_DIR:-}" ] && [ -d "$BE_DIR" ]; } && _IS_MODE_D=1
+# CLAUDE.local.md is Claude Code's STANDARD local-override file — anyone may have one for any
+# reason, and having one says nothing about a companion store. Keying on its EXISTENCE re-admitted
+# the majority-path false positive through a second door, and state-based emission made it permanent
+# rather than one-shot (cross-family review 2026-07-30). So key on the file MENTIONING a companion
+# binding instead.
+# The vocabulary spans every backend the wizard documents — the store is a ROLE, not a repo layout
+# (Obsidian vault · gbrain ingest target · *-be repo all qualify), and an FH-flavoured regex would
+# have silently excluded two first-class backends: the same "flagship case goes quiet" shape as the
+# fresh-clone defect, one door over.
+# HONEST SCOPE: this is a MENTION test, not a semantic one. "I do not use a companion store" also
+# matches. The cost of that over-match is one informational line, never a floor claim — deliberately
+# the cheap direction, since the expensive direction is silence.
+[ -f "$FH/CLAUDE.local.md" ] \
+  && grep -qiE 'BE_DIR|companion[ -]store|컴패니언|vault|gbrain|obsidian' "$FH/CLAUDE.local.md" 2>/dev/null \
+  && _IS_MODE_D=1
+if [ -n "$_IS_MODE_D" ] && ! command -v python3 >/dev/null 2>&1; then
+  # not found ≠ 0: without a JSON parser the registration verdict is unknown, not clean.
+  COMPANION_NOTE="companion-load registration UNMEASURED (no python3 — cannot parse the hook config; do not read this as 'registered')"
+elif [ -n "$_IS_MODE_D" ]; then
+  python3 - "$FH" <<'PY' || COMPANION_NOTE="companion-load SessionStart not registered (Mode D — freshness + env-delta will not fire at turn 0)"
+import json, os, sys
+hub = sys.argv[1]
+for p in (os.path.join(hub, ".claude", "settings.local.json"),
+          os.path.expanduser("~/.claude/settings.json")):
+    try:
+        groups = json.load(open(p)).get("hooks", {}).get("SessionStart", [])
+    except Exception:
+        continue
+    if any("fh_session_load" in h.get("command", "") for g in groups for h in g.get("hooks", [])):
+        sys.exit(0)
+sys.exit(1)
+PY
+fi
+
+# ── event: infra delta since the commit this clone last saw ───────────────────
+# Reported ONCE per pull (it is an event). Distinguishes "no change" from "could not measure".
+INFRA=""; INFRA_NOTE=""
+if [ -n "$PREV_HEAD" ] && [ "$PREV_HEAD" != "$HEAD_NOW" ]; then
+  if INFRA_RAW="$(git -C "$FH" diff --name-only "${PREV_HEAD}..HEAD" 2>/dev/null)"; then
+    INFRA="$(printf '%s\n' "$INFRA_RAW" \
+      | grep -E '^(templates/\.git-hooks/|templates/settings\.|scripts/fh_|plugins/[^/]+/skills/install-(wizard|doctor)/)' \
+      | head -6)"
+  else
+    INFRA_NOTE="UNMEASURED — cannot reach the previously seen commit ($PREV_HEAD), so the infra delta was not computed (rebase, shallow clone, or GC). Not the same as 'nothing changed'."
+  fi
+fi
+
+IDENTITY=""
+if [ -z "$PREV_ID" ]; then IDENTITY="first session for this clone"
+elif [ "$PREV_ID" != "$NODE_ID" ]; then IDENTITY="machine changed ($PREV_ID → $NODE_ID)"; fi
+
+# ── state write — unconditional, and a failure is reported, never swallowed ────
+# Writing only when the check speaks would make the recorded timestamp mean "last time it spoke",
+# and a write failure would make this banner repeat forever with no explanation.
+STATE_WARN=""
+if ! { mkdir -p "$(dirname "$STATE")" 2>/dev/null \
+       && printf '%s|%s|%s' "$NODE_ID" "$NOW" "$HEAD_NOW" > "$STATE" 2>/dev/null; }; then
+  STATE_WARN="could not record node state ($STATE) — this notice may repeat every session"
+fi
+
+# ── emit: condition (every session) OR event (once) ───────────────────────────
+[ -n "$MISS$COMPANION_NOTE$INFRA$INFRA_NOTE$IDENTITY$STATE_WARN" ] || exit 0
+
+if [ -n "$MISS" ]; then
+  echo "🖥️  [node] Missing mechanical floor on this machine (node: $NODE_ID): ${MISS% · }"
+  echo "    → Run /install-doctor, then /install-wizard. A rich context (memory, companion store)"
+  echo "      is a different proposition from this machine being wired."
+elif [ -n "$IDENTITY" ]; then
+  echo "🖥️  [node] $IDENTITY (node: $NODE_ID) — floors present."
+fi
+[ -n "$STATE_WARN" ] && echo "    ⚠️  $STATE_WARN"
+[ -n "$COMPANION_NOTE" ] && echo "    ℹ️  $COMPANION_NOTE"
+if [ -n "$INFRA_NOTE" ]; then
+  echo "    ⚠️  $INFRA_NOTE"
+elif [ -n "$INFRA" ]; then
+  echo "    🆕 Install-relevant assets changed since this clone last ran — being registered is not"
+  echo "       the same as being current, and a pull moves files without wiring hooks:"
+  printf '%s\n' "$INFRA" | while IFS= read -r f; do [ -n "$f" ] && echo "       - $f"; done
+  echo "    → Re-run /install-wizard (idempotent)."
+fi
+
+exit 0

package/scripts/fh_session_load.sh

@@ -27,6 +27,51 @@
 set -uo pipefail
 
 FH="${HUB_DIR:-${CLAUDE_PROJECT_DIR:-$HOME/projects/forge-harness}}"
+BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook registration; no public default.
+                   # Resolved HERE (not at the Mode-D block below) because the frontier-digest check
+                   # needs it: on a multi-node setup the digest producer may be a DIFFERENT machine.
+
+# ── node re-entry floor check ────────────────────────────────────────────────
+# 이 검사는 scripts/fh_node_check.sh 로 분리했다. 이유: 이 파일(fh_session_load.sh)은 gitignored
+# settings.local.json 에 등록되므로 새 클론/새 기계에선 애초에 안 돈다 — 검사가 존재 이유가 되는
+# 상황에서 도달 불가였다(Sonnet 타깃-티어 심 2026-07-30 지적).
+# ⚠️ 분리해도 자동 배선은 아니다: .claude/settings.json 도 gitignored 라(.gitignore:3-4) 등록 자체는
+# 추적될 수 없다. 추적되는 건 templates/settings.SessionStart.snippet.json 이고, 배선은 위자드가 한다.
+# 여기서 다시 호출하지 않는다: 두 곳에서 부르면 같은 이벤트를 두 번 찍는다.
+
+# ── §early-refresh: 컴패니언 refresh 를 frontier 판정보다 먼저 한다 ─────────────
+# 왜 순서가 문제인가: frontier 판정은 러너가 아닌 노드에서 $BE/tracks-meta 를 본다. refresh 가
+# 그 뒤에 있으면 **그날의 첫 세션**은 아직 안 끌어온 워킹트리를 읽어 오늘 digest 를 못 보고,
+# 이 수정이 없애려던 바로 그 오경보를 그대로 낸다(하루 한 번, 가장 값진 시점에서 실패).
+# cross-family 리뷰 2026-07-30 [HIGH] 지적. 비-Mode-D(공개) 사용자는 BE 가 비어 통째로 건너뛴다.
+PULL_NOTE="(no companion store configured)"
+if [ -d "$BE/.git" ]; then
+  export GIT_TERMINAL_PROMPT=0
+  export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new}"
+
+  # Hard wall-clock deadline on the ONLY network step. ConnectTimeout bounds the handshake, but a
+  # slow/stalled TRANSFER after connect has no bound — measured 2026-07-12: SessionStart worst-case
+  # 17.5s with 2 hook-timeout kills, all attributable to the fetch. perl-alarm is the portable
+  # watchdog (macOS ships no coreutils `timeout`); on overrun the fetch dies and the offline branch
+  # reports honestly. FH_FETCH_DEADLINE overrides (seconds). If perl is absent the wrapper degrades
+  # to running the command with NO deadline — a missing watchdog must never become a permanently
+  # skipped fetch misreported as "offline" (challenger catch 2026-07-12).
+  if command -v perl >/dev/null 2>&1; then
+    _deadline() { perl -e 'alarm shift @ARGV; exec @ARGV' "$@"; }
+  else
+    _deadline() { shift; "$@"; }
+  fi
+  PULL_NOTE=""
+  if _deadline "${FH_FETCH_DEADLINE:-8}" git -C "$BE" fetch --quiet >/dev/null 2>&1; then
+    if git -C "$BE" merge --ff-only --quiet >/dev/null 2>&1; then
+      PULL_NOTE="fetched + fast-forwarded"
+    else
+      PULL_NOTE="fetched but NOT fast-forward (companion diverged — read local + newest remote)"
+    fi
+  else
+    PULL_NOTE="fetch skipped (offline or deadline hit — read local state)"
+  fi
+fi
 
 # ── frontier-digest: 부재를 0으로 읽지 않는다 ────────────────────────────────────
 # 왜: digest 는 launchd 로 매일 09:00 에 돌지만 **31회 중 6회(19%) 산출물 없이 끝났다**
@@ -51,9 +96,35 @@ _FD_STAMP="$(date +%H:%M) 기준"
 # 존재 판정은 러너 digest_ready 와 동일 술어(glob + -size +1k). 정확명 [ -f ] 는 러너와 관대함이
 # 갈린다 — partial 파일(>0 <1k)이 성공으로 오독되고, suffix 착지가 영구 오경보가 된다
 # (divergent-leniency: 같은 상태를 두 술어가 다르게 읽으면 한쪽 결과가 무음으로 샌다).
-_fd_ready() { find "$FH/tracks/_meta" -maxdepth 1 -name "frontier_digest_$(date +%Y_%m_%d)*.md" -size +1k 2>/dev/null | grep -q .; }
+_fd_hit() { find "$1" -maxdepth 1 -name "frontier_digest_$(date +%Y_%m_%d)*.md" -size +1k 2>/dev/null | grep -q .; }
+# 노드-로컬만 보면 **다른 머신이 만든 산출물이 구조적으로 안 보인다**. 멀티머신에선 러너가 한 대이고
+# 나머지 노드는 컴패니언 스토어로만 그 산출물을 받는다 → 러너 아닌 노드가 매일 "실패다" 오경보를 낸다.
+# (2026-07-30 실측: 프로가 07-24~30 매일 정상 생산 중인데 에어는 7일 연속 FAILED 를 띄웠다.
+# 계기의 스코프가 대상보다 좁았던 케이스 — 대상은 '오늘 digest 가 있나'지 '이 디스크에 있나'가 아니다.)
+# 술어는 로컬과 **동일**(glob + -size +1k) — divergent-leniency 를 만들지 않는다.
+_fd_ready() { _fd_hit "$FH/tracks/_meta" || { [ -n "$BE" ] && _fd_hit "$BE/tracks-meta"; }; }
+# THE SECOND HALF OF THE SAME SCOPE BUG (2026-07-31). The comment above got the principle right —
+# "대상은 '오늘 digest 가 있나'지 '이 디스크에 있나'가 아니다" — and then widened the predicate by
+# exactly ONE surface (the companion store), leaving it file-only. There are TWO live producers:
+# the launchd file runner AND an app routine that posts the digest as a comment on GitHub issue
+# #102 (measured 2026-07-31: 47 comments, one per day, including today's at 09:09 KST). So on a day
+# when the file runner fails, today's digest EXISTS and the hook said "부재가 아니라 실패다" — a
+# true statement about this disk stated as a claim about the digest.
+# The fix is NOT to call the network from a SessionStart hook (it must never block turn 0 and must
+# never fail on an offline node). It is to stop over-claiming: report the scope actually measured
+# ("this node's file output failed") and NAME the surface not measured, so the reader checks it in
+# one step instead of re-running a job whose output already exists elsewhere.
+_fd_issue_note() {
+  echo "    ⓘ 파일만 본 판정이다 — 오늘치는 **GH issue #102**(앱 routine, 매일 ~09:09 KST)에 이미 있을 수 있다."
+  echo "      확인: gh issue view 102 --repo chrono-meta/forge-harness --comments | tail -40"
+  echo "      → 파일 재생성이 필요한지는 그걸 보고 판단하라. '오늘은 뉴스 없음'으로 읽지 말 것."
+}
 if _fd_ready; then
-  :
+  # 로컬엔 없고 컴패니언에만 있으면 = 이 노드는 러너가 아니다. 침묵하면 토폴로지가 안 보이므로 한 줄 알린다.
+  if ! _fd_hit "$FH/tracks/_meta"; then
+    echo "ℹ️  [frontier-digest] 오늘 digest 는 **다른 노드**가 생산했다(컴패니언 스토어 경유) — 이 노드는 러너가 아니다."
+    echo "    읽을 것: \$BE_DIR/tracks-meta/frontier_digest_$(date +%Y_%m_%d)*.md"
+  fi
 elif [ "$((10#$_FD_NOW))" -lt "$_FD_SCHED" ]; then
   echo "ℹ️  [frontier-digest] 오늘 digest 는 09:00 예정 — 아직 전이다($_FD_STAMP). 부재는 정상."
 elif [ -f "$_FD_LOG" ]; then
@@ -70,14 +141,37 @@ elif [ -f "$_FD_LOG" ]; then
   if [ -n "$_FD_ALIVE" ]; then
     echo "ℹ️  [frontier-digest] 잡이 아직 돌고 있는 중일 수 있다($_FD_STAMP, $_FD_ALIVE) — 실패 판정 보류, 나중에 재확인."
   else
-    echo "⚠️  [frontier-digest] 오늘 잡은 돌았는데 **산출물이 없다**($_FD_STAMP) — 부재가 아니라 실패다."
+    echo "⚠️  [frontier-digest] **이 노드의 파일 산출**이 실패했다($_FD_STAMP) — 부재가 아니라 실패다."
     echo "    마지막 로그: $(tail -1 "$_FD_LOG" 2>/dev/null | cut -c1-90)"
-    echo "    → 수동 재실행하거나 실패 원인을 보라. '오늘은 뉴스 없음'으로 읽지 말 것."
+    _fd_issue_note
   fi
 else
-  echo "⚠️  [frontier-digest] 스케줄(09:00) 지났는데 로그도 산출물도 없다($_FD_STAMP) — 잡이 아예 안 돌았을 수 있다(launchd 확인)."
+  echo "⚠️  [frontier-digest] 스케줄(09:00) 지났는데 로그도 파일 산출물도 없다($_FD_STAMP) — 이 노드에서 잡이 아예 안 돌았을 수 있다(launchd 확인)."
+  _fd_issue_note
+fi
+# (BE is resolved at the top of this script — the frontier-digest block above needs it too.)
+
+# 1-b) Weekly-audit cadence — mechanical, for the same reason the frontier-digest block above is.
+# MEASURED 2026-07-31: operations.md §Session start auto-detection (L1) promises "propose the audit
+# if 7+ days elapsed", and the audit had not run for FIFTY days. The frontier-digest cadence, which
+# is instrumented, never went a day unnoticed over the same window. The difference is not
+# importance; it is that one cadence is a hook and the other is prose, and this repo's own N=3
+# escalation rule says to instrument rather than to add a habit. One line in a hook that already
+# runs, not a new mechanism. Advisory by design: an overdue audit is not an irreversible surface,
+# so it surfaces and never blocks. Silent when current, and silent when the dir does not exist
+# (a fresh clone has no audit history and must not be nagged about one).
+_AUDIT_DIR="$FH/tracks/_audit"
+if [ -d "$_AUDIT_DIR" ]; then
+  _LATEST_AUDIT="$(find "$_AUDIT_DIR" -maxdepth 1 -name 'weekly_audit_*.md' -print 2>/dev/null \
+                   | sort | tail -1)"
+  if [ -n "$_LATEST_AUDIT" ]; then
+    _AUDIT_AGE_D=$(( ( $(date +%s) - $(_mtime "$_LATEST_AUDIT") ) / 86400 ))
+    if [ "$_AUDIT_AGE_D" -ge 7 ]; then
+      echo "🗓️  [weekly-audit] 마지막 감사가 ${_AUDIT_AGE_D}일 전이다($(basename "$_LATEST_AUDIT")) — 캐던스는 7일."
+      echo "    → /harvest-loop (lightweight) 또는 operations.md §Weekly Improvement Cycle 수동 절차."
+    fi
+  fi
 fi
-BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook registration; no public default.
 
 # Non-Mode-D / no companion store → silent no-op (this is the majority path for public users).
 [ -d "$BE/.git" ] || exit 0
@@ -89,31 +183,7 @@ BE="${BE_DIR:-}"   # companion-store path — supplied by the gitignored hook re
 #    - fail-fast env: no credential/SSH/host-key prompts can hang SessionStart.
 #    - fetch + merge --ff-only: a fast-forward is the only safe hook mutation; a diverged companion
 #      simply does not advance (no merge commit, no conflict state left behind) and we say so.
-export GIT_TERMINAL_PROMPT=0
-export GIT_SSH_COMMAND="${GIT_SSH_COMMAND:-ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new}"
-
-# Hard wall-clock deadline on the ONLY network step. ConnectTimeout bounds the handshake, but a
-# slow/stalled TRANSFER after connect has no bound — measured 2026-07-12: SessionStart worst-case
-# 17.5s with 2 hook-timeout kills, all attributable to the fetch. perl-alarm is the portable
-# watchdog (macOS ships no coreutils `timeout`); on overrun the fetch dies and the offline branch
-# reports honestly. FH_FETCH_DEADLINE overrides (seconds). If perl is absent the wrapper degrades
-# to running the command with NO deadline — a missing watchdog must never become a permanently
-# skipped fetch misreported as "offline" (challenger catch 2026-07-12).
-if command -v perl >/dev/null 2>&1; then
-  _deadline() { perl -e 'alarm shift @ARGV; exec @ARGV' "$@"; }
-else
-  _deadline() { shift; "$@"; }
-fi
-PULL_NOTE=""
-if _deadline "${FH_FETCH_DEADLINE:-8}" git -C "$BE" fetch --quiet >/dev/null 2>&1; then
-  if git -C "$BE" merge --ff-only --quiet >/dev/null 2>&1; then
-    PULL_NOTE="fetched + fast-forwarded"
-  else
-    PULL_NOTE="fetched but NOT fast-forward (companion diverged — read local + newest remote)"
-  fi
-else
-  PULL_NOTE="fetch skipped (offline or deadline hit — read local state)"
-fi
+# (컴패니언 refresh 는 위 §early-refresh 로 올렸다 — frontier 판정이 최신 트리를 보게 하려고.)
 
 # 2) Session card date (the pointer the operator's close chain writes last).
 CARD="$FH/tracks/_meta/reference_next_session_starter.md"

package/scripts/halffix_propagation_scan.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# halffix_propagation_scan.sh — pre-commit advisory: this fix may have landed in only one copy.
+#
+# THE DEFECT — "반쪽-수리" (half-fix)
+#   A defect class lives in N sibling copies. The fix lands in ONE and nothing says so. Measured 3x
+#   in this project, and the shape is worse than the count: every one of the three occurred INSIDE
+#   an edit that was itself repairing an earlier half-fix. scripts/psa_scan_lib.sh's header records
+#   five such divergences found in a single 2026-07-26 audit — every confidentiality defect that
+#   audit found was a divergence between duplicated copies, not a flaw in the idea.
+#
+# WHAT IT DOES
+#   Takes the distinctive symbols and path literals touched by the staged diff, re-greps the tree,
+#   and NAMES the tracked files that carry the same token but are not staged. That is the whole
+#   contribution: the author already knows what they fixed; what they lose is the sibling.
+#
+# MARK, DO NOT BLOCK — this is mandated, not preferred. The spec for this debt is explicit:
+#   "표시(차단 아님 — 정당한 복제도 있다)". Legitimate duplication exists (templates/ ships a
+#   field-propagated copy of scripts/ ON PURPOSE, and selfcheck asserts they stay byte-identical).
+#   A detector that blocks on correct duplication is a detector that gets disabled.
+#
+# THE DISCRIMINATOR — if every copy is staged, the fix propagated and this stays SILENT.
+#   Without that, the scan fires loudest exactly when the author did the right thing. Two prior
+#   claims on this same mistake in this repo: S5 (9/9 false positives, narrowed 2026-07-28) and
+#   S6 (0 true positives on the planned surface, retargeted 2026-07-31). Lane N3 pins it.
+#
+# Usage:  bash scripts/halffix_propagation_scan.sh          # reads the staged diff of $PWD
+# Opt out: put `noqa: half-fix` on any added line in the commit.
+
+set -u
+cd "$(git rev-parse --show-toplevel 2>/dev/null || echo .)" || exit 0
+git rev-parse --git-dir >/dev/null 2>&1 || exit 0
+
+# Deletions are excluded (ACM): a removed file's symbols surviving elsewhere is not a half-fix,
+# it is the normal state of a deletion, and flagging it would be pure noise.
+STAGED=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null)
+[ -n "$STAGED" ] || exit 0
+
+DIFF=$(git diff --cached -U0 --diff-filter=ACM 2>/dev/null)
+printf '%s' "$DIFF" | grep -qE '^\+.*noqa:?[[:space:]]*half-fix' && exit 0
+
+# Anchor tokens, from CHANGED lines only (added and removed — a removed spelling is exactly what a
+# sibling may still carry). Two shapes:
+#   · identifiers >= 10 chars — long enough that a collision is meaningful. Shell/py keywords and
+#     the everyday vocabulary (`then`, `echo`, `return`, `local`) are all shorter, so the length
+#     floor does the keyword filtering without a denylist to maintain. (Lane N6.)
+#   · path literals `a/b` — the spec names filenames as anchors alongside symbols. (Lane P7.)
+# The ENCLOSING function counts as a changed symbol even when the edited line itself carries no
+# distinctive token — and a half-fix is a function-level thing, so this is the common case, not an
+# edge one. git already hands it over in the hunk header (`@@ -2 +2 @@ psa_low_allowlisted() {`),
+# so the context comes for free rather than from a hand-rolled scope parser.
+# Found by lane P1 failing: the fix edited only a `case` line, whose longest token was 9 chars, and
+# the scan went silent on a textbook two-copy divergence.
+CHANGED=$( { printf '%s\n' "$DIFF" | grep -E '^[+-]' | grep -vE '^(\+\+\+|---)'
+             printf '%s\n' "$DIFF" | sed -n 's/^@@ .* @@ //p'
+           } )
+TOKENS=$( { printf '%s\n' "$CHANGED" | grep -oE '[A-Za-z_][A-Za-z0-9_-]{9,}'
+            printf '%s\n' "$CHANGED" | grep -oE '[A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+'
+          } | sort -u )
+# NO early exit here. R1 (tokens) and R2 (whole-file copies) are INDEPENDENT rules, and an empty
+# token set is the normal state for a short edit — `a() { :; }` → `a() { echo fixed; }` carries no
+# 10-char anchor at all. An early `exit 0` on empty tokens silently disabled R2 for exactly the
+# edits R2 exists to catch. (Caught by lane R2p, 2026-07-31, after the same shape had already
+# passed 10/10 in the other lanes — a rule can be correct and unreachable.)
+
+# Cap, and SAY SO when it bites. A silent truncation reads as "checked everything" when it did not.
+MAX_TOKENS="${HALFFIX_MAX_TOKENS:-60}"
+TOTAL=$(printf '%s\n' "$TOKENS" | grep -c .)
+if [ "$TOTAL" -gt "$MAX_TOKENS" ]; then
+  echo "  ℹ️  half-fix scan: $TOTAL anchor tokens in this diff, examining the first $MAX_TOKENS (raise with HALFFIX_MAX_TOKENS)." >&2
+  TOKENS=$(printf '%s\n' "$TOKENS" | head -n "$MAX_TOKENS")
+fi
+
+# A token in many files is framework vocabulary, not a duplicated fix site. (Lane N5.)
+MAX_FILES="${HALFFIX_MAX_FILES:-8}"
+staged_has() { printf '%s\n' "$STAGED" | grep -qxF "$1"; }
+
+hits=""
+while IFS= read -r tok; do
+  [ -n "$tok" ] || continue
+  files=$(git grep -l --fixed-strings -e "$tok" -- . 2>/dev/null)
+  [ -n "$files" ] || continue
+  n=$(printf '%s\n' "$files" | grep -c .)
+  [ "$n" -le "$MAX_FILES" ] || continue
+  others=""
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    staged_has "$f" || others="${others}${others:+, }$f"
+  done <<< "$files"
+  [ -n "$others" ] || continue          # every copy staged → propagated → silent (lane N3)
+  hits="${hits}  ⚠️  HALF-FIX \`$tok\` also lives in: $others
+"
+done <<< "$TOKENS"
+
+# ── R2 — whole-file copy divergence. ─────────────────────────────────────────────────────────
+# The token rule alone missed this repo's real duplicate pair: a script's NAME lives in 11–18 files
+# here (docs, CATALOG, the manifest, selfcheck refs), so the ubiquity filter suppressed it, while an
+# internal symbol like psa_low_allowlisted lives in 2. Measured 2026-07-31 — lanes 10/10 green, live
+# probe silent. The lanes were necessary and not sufficient.
+#
+# Exact, not heuristic: the sibling was BYTE-IDENTICAL at HEAD and only one side is staged, so it is
+# a divergence by construction and needs no threshold. Same-basename files that were never copies
+# (CLAUDE.md vs templates/CLAUDE.md, the 40 SKILL.md files) stay silent — a basename rule would have
+# flooded on exactly those.
+while IFS= read -r sf; do
+  [ -n "$sf" ] || continue
+  base=$(basename "$sf")
+  head_blob=$(git rev-parse "HEAD:$sf" 2>/dev/null) || continue
+  while IFS= read -r cand; do
+    [ -n "$cand" ] && [ "$cand" != "$sf" ] || continue
+    staged_has "$cand" && continue
+    cand_blob=$(git rev-parse "HEAD:$cand" 2>/dev/null) || continue
+    [ "$cand_blob" = "$head_blob" ] || continue     # were they the SAME file before this edit?
+    hits="${hits}  ⚠️  HALF-FIX \`$sf\` was byte-identical to \`$cand\` at HEAD — only one side is staged
+"
+  done <<< "$(git ls-files -- "*/$base" "$base" 2>/dev/null)"
+done <<< "$STAGED"
+
+[ -n "$hits" ] || exit 0
+
+{
+  echo "⚠️  HALF-FIX PROPAGATION — symbols you changed also exist in files you did NOT stage."
+  echo "   Not a verdict: templates/ ships deliberate copies of scripts/. Judge each, then proceed."
+  printf '%s' "$hits"
+  echo "   Silence this commit with a \`noqa: half-fix\` comment on any added line."
+} >&2
+exit 0