@chrono-meta/fh-gate 1.4.77 → 1.4.79

package/scripts/test_card_drift_probe.sh

@@ -29,6 +29,25 @@ run_fixture() {  # $1=name  $2=card-content  $3=make-artifact(0/1)  $4=expect-wa
   local out; out=$(bash "$CHECK" "$T" 2>/dev/null)
   local warned=0
   printf '%s\n' "$out" | grep -q "⑤-b card-drift" && warned=1
+  # RUN EVERY FIXTURE TWICE — ambient locale AND LC_ALL=C. Added 2026-07-31 after the probe passed
+  # 3/3 here for weeks while returning warn=0 for EVERY lane on the ubuntu runner. Cause: the
+  # absence regex held a Hangul RANGE `[^가-힣]`, which GNU grep in the C locale rejects with
+  # "Invalid collation character" — it exits 2 and prints nothing, which downstream is
+  # indistinguishable from "no match", so the probe reported the card clean on every input.
+  # BSD grep accepts the range, so no amount of running this suite on macOS could ever have caught
+  # it. MEASURED LIMIT, stated because the first version of this comment overclaimed: LC_ALL=C on
+  # macOS is NOT a stand-in for GNU grep — reverting the Hangul range with this dual-run in place
+  # still passed here. So this leg detects the class only where GNU grep runs, i.e. in CI. It is
+  # kept because a locale-divergent verdict is a defect wherever it is observed, and it costs one
+  # extra invocation; the platform-independent detector is the source lint below.
+  local out_c; out_c=$(LC_ALL=C LANG=C bash "$CHECK" "$T" 2>/dev/null)
+  local warned_c=0
+  printf '%s\n' "$out_c" | grep -q "⑤-b card-drift" && warned_c=1
+  if [ "$warned" != "$warned_c" ]; then
+    echo "❌ $name — LOCALE-DIVERGENT: ambient warn=$warned but LC_ALL=C warn=$warned_c"
+    echo "     텍스트 계기가 로케일에 따라 다른 판정을 낸다 — 어느 쪽이 맞든 캘리브레이션 실패다."
+    rm -rf "$T"; FAILED=1; return
+  fi
   rm -rf "$T"
   if [ "$warned" = "$expect" ]; then
     echo "✅ $name (warn=$warned, expected=$expect)"
@@ -73,5 +92,41 @@ run_fixture "P4 영어 부재주장 (A-4 앵커)" \
 run_fixture "N7 인용된 부재키워드+정정 → 무경고 (실카드 07-22 클래스)" \
   "- 🔴 foo-digest 산출 누락. 기존 카드의 \"미가동\" 주장은 오판정이었음" 1 0
 
+
+# ── LOCALE-RANGE LINT (platform-independent, added 2026-07-31) ─────────────────────────
+# The behavioural dual-run above cannot fire on BSD grep, so the class needs a detector that does
+# not depend on which grep is installed. This one reads the SOURCE: a bracket expression containing
+# a non-ASCII RANGE (`[^가-힣]`, `[ㄱ-ㅎ]`, …) is collation-dependent by construction and will be
+# rejected outright by GNU grep in the C locale — "Invalid collation character", exit 2, no output,
+# which downstream reads as "no match" and therefore as clean.
+# Alternation of non-ASCII literals (`(🔴|🟡)`, `미가동|부재`) is NOT flagged: it carries no
+# collation, and the runner proved it works (the emoji line-selection stage passed there while the
+# range stage errored). Flagging it would push an author to mangle working code.
+echo "-- locale-range lint: 비ASCII 문자 범위를 쓰는 정규식 (collation 의존) --"
+LINT_OUT=$(python3 - "$SCRIPT_DIR" <<'LINTPY'
+import re, sys, glob, os
+root = sys.argv[1]
+# a bracket expression containing  <non-ascii> - <non-ascii>
+rng = re.compile(r'\[[^]\n]*[^\x00-\x7F]-[^\x00-\x7F][^]\n]*\]')
+hits = []
+for f in sorted(glob.glob(os.path.join(root, '*.sh'))):
+    for i, line in enumerate(open(f, encoding='utf-8', errors='replace'), 1):
+        if line.lstrip().startswith('#'):
+            continue
+        m = rng.search(line)
+        if m:
+            hits.append(f"{os.path.basename(f)}:{i}: {m.group(0)}")
+print('\n'.join(hits))
+LINTPY
+)
+if [ -n "$LINT_OUT" ]; then
+  echo "❌ 비ASCII 범위 발견 — GNU grep(C 로케일)에서 exit 2 로 죽고 결과가 '무매치'로 읽힌다:"
+  printf '%s\n' "$LINT_OUT" | sed 's/^/     /'
+  FAILED=1
+else
+  echo "✅ locale-range lint: 비ASCII 문자 범위 없음"
+fi
+
+
 echo "── card-drift probe calibration: $([ "$FAILED" -eq 0 ] && echo "PASS (전 픽스처) — 배선 가능" || echo "FAIL — 계기 불량, 배선 금지") ──"
 exit "$FAILED"

package/scripts/test_halffix_lanes.sh

@@ -0,0 +1,170 @@
+#!/usr/bin/env bash
+# test_halffix_lanes.sh — known pairs for scripts/halffix_propagation_scan.sh
+#
+# WHY, AND WHY LANES FIRST
+#   2026-07-30 harvest #1: rounds that wrote the lane BEFORE touching the code had zero
+#   fix-reverts-fix regressions. Order made the convergence, not the patch.
+#
+# THE DEFECT BEING GUARDED — "반쪽-수리" (half-fix)
+#   A defect class lives in N sibling copies. The fix lands in ONE. The siblings keep the bug, and
+#   nothing says so. Measured 3x in this project, and the shape is worse than it sounds: every one
+#   of the three occurred INSIDE an edit that was itself repairing an earlier half-fix.
+#   scripts/psa_scan_lib.sh's header records five such divergences found in a single audit — the
+#   override-readable check, the fail-closed-on-no-patterns branch, the SPACE-vs-TAB row, the
+#   `head -1` shielding, and the LOW allowlist — each repaired where it was found and nowhere else.
+#
+# THE DISCRIMINATOR THAT MAKES THIS USEFUL INSTEAD OF NOISY (lane N3)
+#   If BOTH copies are staged, the fix WAS propagated and the scan must stay silent. A detector that
+#   fires on correct propagation is a detector that gets ignored — the S5 lesson (9/9 FP, narrowed
+#   2026-07-28) and the S6 lesson (0 true positives on the planned surface, retargeted 2026-07-31)
+#   are the two prior claims on this exact mistake in this repo.
+#
+# ADVISORY BY MANDATE, not by preference: the operator's spec for this debt says "표시(차단 아님 —
+#   정당한 복제도 있다)" — mark, do not block, because legitimate duplication exists.
+
+set -u
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SCAN="$ROOT/scripts/halffix_propagation_scan.sh"
+pass=0; fail=0
+
+# mkrepo <dir> — a throwaway git repo; caller populates and stages.
+mkrepo() {
+  rm -rf "$1"; mkdir -p "$1"; ( cd "$1" && git init -q . && git config user.email t@e && git config user.name t )
+}
+
+# expect <label> <FLAG|SILENT> <repo> [needle]
+expect() {
+  local label="$1" want="$2" repo="$3" needle="${4:-}" out got
+  out=$( cd "$repo" && bash "$SCAN" 2>&1 )
+  if printf '%s' "$out" | grep -q 'HALF-FIX'; then got=FLAG; else got=SILENT; fi
+  if [ "$got" = "$want" ] && { [ -z "$needle" ] || printf '%s' "$out" | grep -q "$needle"; }; then
+    printf '  ✅ %-50s %s\n' "$label" "$got"; pass=$((pass+1))
+  else
+    printf '  ❌ %-50s %s (expected %s%s)\n' "$label" "$got" "$want" \
+      "${needle:+, needle '$needle'}"; fail=$((fail+1))
+    printf '     out: %s\n' "$(printf '%s' "$out" | head -6)"
+  fi
+}
+
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+echo "[halffix] known pairs"
+
+# ── P1: the canonical shape — a distinctive symbol duplicated in a sibling, only one staged ──
+R="$T/p1"; mkrepo "$R"
+printf 'psa_low_allowlisted() {\n  case "$1" in templates/*) return 0 ;; esac\n}\n' > "$R/a.sh"
+printf 'psa_low_allowlisted() {\n  case "$1" in templates/*) return 0 ;; esac\n}\n' > "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'psa_low_allowlisted() {\n  case "$1" in templates/*|docs/*) return 0 ;; esac\n}\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "P1 sibling copy left unstaged" FLAG "$R" "b.sh"
+
+# ── P2: three copies, one staged — both remaining siblings named ──
+R="$T/p2"; mkrepo "$R"
+for f in a b c; do printf 'validate_marker_fields_strictly() { :; }\n' > "$R/$f.sh"; done
+( cd "$R" && git add . && git commit -qm base )
+printf 'validate_marker_fields_strictly() { echo fixed; }\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "P2 two siblings, both named"   FLAG "$R" "c.sh"
+
+# ── N3: THE DISCRIMINATOR — both copies staged means the fix propagated. Silence. ──
+R="$T/n3"; mkrepo "$R"
+printf 'psa_low_allowlisted() { :; }\n' > "$R/a.sh"; cp "$R/a.sh" "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'psa_low_allowlisted() { echo fixed; }\n' > "$R/a.sh"; cp "$R/a.sh" "$R/b.sh"
+( cd "$R" && git add a.sh b.sh )
+expect "N3 both staged = propagated"   SILENT "$R"
+
+# ── N4: unique content — nothing to propagate to ──
+R="$T/n4"; mkrepo "$R"
+printf 'lonely_unique_helper_fn() { :; }\n' > "$R/a.sh"
+printf 'something_entirely_different() { :; }\n' > "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'lonely_unique_helper_fn() { echo x; }\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "N4 no sibling holds the symbol"  SILENT "$R"
+
+# ── N5: ubiquitous token — a word in 12 files is framework noise, not a half-fix ──
+R="$T/n5"; mkrepo "$R"
+for i in $(seq 1 12); do printf 'REPO_ROOT_DIRECTORY=/x\n' > "$R/f$i.sh"; done
+( cd "$R" && git add . && git commit -qm base )
+printf 'REPO_ROOT_DIRECTORY=/y\n' > "$R/f1.sh"
+( cd "$R" && git add f1.sh )
+expect "N5 ubiquitous token suppressed"  SILENT "$R"
+
+# ── N6: short/common tokens must not anchor (would flag on `then`, `echo`, `return`) ──
+R="$T/n6"; mkrepo "$R"
+printf 'if [ -f x ]; then echo a; fi\n' > "$R/a.sh"
+printf 'if [ -f y ]; then echo b; fi\n' > "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'if [ -f x ]; then echo c; fi\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "N6 short shell keywords ignored"  SILENT "$R"
+
+# ── P7: filenames count as symbols too (the spec says "수정 심볼·파일명") ──
+R="$T/p7"; mkrepo "$R"
+printf 'bash scripts/sidecar_calibrate.sh --run\n' > "$R/a.sh"
+printf 'bash scripts/sidecar_calibrate.sh --run\n' > "$R/doc.md"
+( cd "$R" && git add . && git commit -qm base )
+printf 'bash scripts/sidecar_calibrate.sh --run --strict\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "P7 filename token propagates"    FLAG "$R" "doc.md"
+
+# ── N8: nothing staged at all ──
+R="$T/n8"; mkrepo "$R"; printf 'x\n' > "$R/a.sh"; ( cd "$R" && git add . && git commit -qm base )
+expect "N8 empty staging area"           SILENT "$R"
+
+# ── N9: opt-out ──
+R="$T/n9"; mkrepo "$R"
+printf 'psa_low_allowlisted() { :; }\n' > "$R/a.sh"; cp "$R/a.sh" "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'psa_low_allowlisted() { echo x; }  # noqa: half-fix\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "N9 noqa suppresses"              SILENT "$R"
+
+# ── N10: deleted file must not crash the scan ──
+R="$T/n10"; mkrepo "$R"
+printf 'psa_low_allowlisted() { :; }\n' > "$R/a.sh"; cp "$R/a.sh" "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+( cd "$R" && git rm -q a.sh )
+expect "N10 deletion does not crash"     SILENT "$R"
+
+echo "-- R2: whole-file copy divergence (found by LIVE calibration, not by the lanes above) --"
+# The token rule alone MISSED this repo's real duplicate pair (scripts/degrade_direction_scan.sh ↔
+# templates/degrade_direction_scan.sh) because a script's NAME appears in 11–18 files here — docs,
+# CATALOG, the manifest, selfcheck references — so the ubiquity filter suppressed it, while an
+# internal symbol like psa_low_allowlisted appears in 2. Measured 2026-07-31: the lanes were 10/10
+# green and the live probe was silent. Lanes are necessary and not sufficient.
+#
+# The predicate is exact rather than heuristic: the sibling was BYTE-IDENTICAL at HEAD and only one
+# side is staged. That is a divergence by construction, so it needs no threshold — and it stays
+# silent for same-basename files that were never copies (CLAUDE.md vs templates/CLAUDE.md, the 40
+# SKILL.md files), which a basename rule would have flooded.
+R="$T/r2p"; mkrepo "$R"; mkdir -p "$R/scripts" "$R/templates"
+printf 'a() { :; }\nb() { :; }\n' > "$R/scripts/x.sh"
+cp "$R/scripts/x.sh" "$R/templates/x.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'a() { echo fixed; }\nb() { :; }\n' > "$R/scripts/x.sh"
+( cd "$R" && git add scripts/x.sh )
+expect "R2 byte-identical copy diverges"  FLAG "$R" "templates/x.sh"
+
+R="$T/r2n"; mkrepo "$R"; mkdir -p "$R/scripts" "$R/templates"
+printf 'hub version, quite different\n' > "$R/scripts/x.sh"
+printf 'template version, also different\n' > "$R/templates/x.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'hub version, edited\n' > "$R/scripts/x.sh"
+( cd "$R" && git add scripts/x.sh )
+expect "R2 same name but never a copy"    SILENT "$R"
+
+R="$T/r2b"; mkrepo "$R"; mkdir -p "$R/scripts" "$R/templates"
+printf 'a() { :; }\n' > "$R/scripts/x.sh"; cp "$R/scripts/x.sh" "$R/templates/x.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'a() { echo fixed; }\n' > "$R/scripts/x.sh"; cp "$R/scripts/x.sh" "$R/templates/x.sh"
+( cd "$R" && git add scripts/x.sh templates/x.sh )
+expect "R2 both staged = propagated"      SILENT "$R"
+
+echo
+if [ "$fail" -eq 0 ]; then
+  echo "[halffix] ✅ all $pass known pairs hold"; exit 0
+else
+  echo "[halffix] ❌ $fail/$((pass+fail)) lanes failed"; exit 1
+fi

package/scripts/test_node_check_lanes.sh

@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+# test_node_check_lanes.sh — regression lanes for scripts/fh_node_check.sh.
+#
+# WHY THIS FILE EXISTS: across three adversarial rounds on the node check, every surviving defect
+# was a NEGATIVE leg nobody was testing — "the floor does not apply here", "those are someone
+# else's hooks", "that file is absent on a fresh clone". Each round's fix reverted a previous
+# round's fix because no lane pinned it. The lanes below are that pin: they encode the *shape* of
+# each defect, not just its instance.
+#
+# Usage:  bash scripts/test_node_check_lanes.sh
+# Exit:   0 = all lanes pass; 1 = at least one lane failed (prints which and why).
+
+set -uo pipefail
+
+FH_REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CHECK="$FH_REPO/scripts/fh_node_check.sh"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+PASS=0; FAIL=0
+ok()   { PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
+bad()  { FAIL=$((FAIL+1)); printf '  ❌ %s\n     got: %s\n' "$1" "$(printf '%s' "$2" | tr '\n' '|' | cut -c1-220)"; }
+
+# run <hubdir> <statefile> [env assignments...] → stdout of one check run
+run() { local hub="$1" st="$2"; shift 2; env "$@" HUB_DIR="$hub" FH_NODE_STATE="$st" bash "$CHECK" 2>&1; }
+
+mk_git_hub() {   # a git repo with FH-style hooks installed and executable
+  local d="$1" fh_sentinel="${2:-yes}"
+  mkdir -p "$d" && git -C "$d" init -q && git -C "$d" config user.email t@t && git -C "$d" config user.name t
+  echo x > "$d/f" && git -C "$d" add f && git -C "$d" -c commit.gpgsign=false commit -qm init
+  mkdir -p "$d/.git/hooks"
+  local body='#!/bin/sh\nexit 0\n'
+  [ "$fh_sentinel" = "yes" ] && body='#!/bin/sh\n# FH 4-Axis Gate Pre-Commit Hook\nfh-gate\nexit 0\n'
+  printf "$body" > "$d/.git/hooks/pre-commit"; printf "$body" > "$d/.git/hooks/pre-push"
+  chmod +x "$d/.git/hooks/pre-commit" "$d/.git/hooks/pre-push"
+}
+
+echo "── node-check lanes ──"
+
+# LANE 1 (S3-1) — NOT a git repo. The git-hook floor cannot be installed here at all, so it is
+# N/A, not missing. Reporting it would be an unfixable notice repeating every session forever.
+mkdir -p "$TMP/nogit"
+out="$(run "$TMP/nogit" "$TMP/s1" FH_MACHINE_ID=nogitbox)"
+# POSITIVE CONTROL: assert what MUST appear alongside what must not. Absence-only lanes are
+# satisfied by a script that prints nothing at all — an `exit 0` stub passed lanes 1, 4 and 7
+# (cross-family mutation 2026-07-30), so each now pins an expected utterance too.
+case "$out" in
+  *"Missing mechanical floor"*) bad "lane1 non-git: must NOT claim a missing floor (N/A, unfixable)" "$out" ;;
+  *"first session for this clone"*) ok "lane1 non-git: N/A on the git floor, but still reports the node event" ;;
+  *) bad "lane1 non-git: silent — a stub would pass this lane" "$out" ;;
+esac
+
+# LANE 2 (S3-2) — hooks exist but belong to another framework (husky/pre-commit). Executable ≠ FH's
+# gate. Silence here is the exact accident this check was built for: FH gates absent, machine quiet.
+mk_git_hub "$TMP/husky" no
+out="$(run "$TMP/husky" "$TMP/s2" FH_MACHINE_ID=huskybox)"
+case "$out" in
+  *"Missing mechanical floor"*) ok "lane2 foreign hooks: FH gate absence reported" ;;
+  *) bad "lane2 foreign hooks: non-FH hooks were accepted as FH floors" "$out" ;;
+esac
+
+# LANE 3 (S3-3) — Mode D user on a FRESH clone: companion store present, settings.local.json absent
+# (it is gitignored, so a clone never has it). This is the MEASURED 2026-07-30 incident. Must speak.
+mk_git_hub "$TMP/moded" yes
+mkdir -p "$TMP/companion/.git"
+out="$(run "$TMP/moded" "$TMP/s3" FH_MACHINE_ID=modedbox BE_DIR="$TMP/companion")"
+case "$out" in
+  *companion-load*) ok "lane3 fresh Mode D clone: companion-load absence surfaced" ;;
+  *) bad "lane3 fresh Mode D clone: SILENT — the measured incident would recur" "$out" ;;
+esac
+
+# LANE 4 (M2-4) — public non-Mode-D user: no companion store anywhere. The companion item must not
+# appear, or the majority path gets a false positive for a feature it does not use.
+mk_git_hub "$TMP/public" yes
+out="$(run "$TMP/public" "$TMP/s4" FH_MACHINE_ID=publicbox)"
+case "$out" in
+  *companion-load*) bad "lane4a non-Mode-D: companion item shown to a user with no store" "$out" ;;
+  *"first session for this clone"*) ok "lane4a non-Mode-D: companion absent, node event still reported" ;;
+  *) bad "lane4a non-Mode-D: silent — a stub would pass this lane" "$out" ;;
+esac
+
+# LANE 4b (S4-1) — CLAUDE.local.md is Claude Code's STANDARD local-override file; anyone may keep
+# one for any reason. Its mere EXISTENCE must not classify a user as Mode D, or the majority path
+# gets a companion notice every session forever (state-based emission makes it permanent, not
+# one-shot). Only the binding INSIDE the file counts.
+printf '# my local notes\nuse tabs not spaces\n' > "$TMP/public/CLAUDE.local.md"
+out="$(run "$TMP/public" "$TMP/s4b" FH_MACHINE_ID=publicbox)"
+case "$out" in
+  *companion-load*) bad "lane4b plain CLAUDE.local.md: existence alone classified the user as Mode D" "$out" ;;
+  *) ok "lane4b plain CLAUDE.local.md: not treated as a Mode D signal" ;;
+esac
+
+# LANE 4c — the same file WITH a companion binding must classify as Mode D and speak. Without this
+# leg, "never classify as Mode D" would also pass 4b.
+# One fixture PER alternative: a single fixture like `BE_DIR=/some/companion-store` satisfies two
+# alternatives at once, so either could be deleted and the lane would still pass. The store is a
+# ROLE, not a repo layout (install-wizard SKILL.md: Obsidian vault / gbrain ingest target / *-be
+# repo all qualify) — so the vocabulary variants are the documented user base, not hypotheticals.
+i=0
+# `backend: obsidian` carries no other keyword on purpose — with a `vault:` fixture only, the
+# `obsidian` alternative is never exercised and could be deleted with the suite staying green
+# (verified: removing it left 16/16). An untested alternative is an untested branch.
+for binding in 'BE_DIR=/x/store' 'companion store: ~/notes' '컴패니언 스토어: ~/notes' \
+               'vault: ~/vaults/notes' 'gbrain ingest target: ~/gbrain' 'backend: obsidian'; do
+  i=$((i+1))
+  printf '# local\n%s\n' "$binding" > "$TMP/public/CLAUDE.local.md"
+  out="$(run "$TMP/public" "$TMP/s4c$i" FH_MACHINE_ID=publicbox)"
+  case "$out" in
+    *companion-load*) ok "lane4c.$i Mode D detected via: $binding" ;;
+    *) bad "lane4c.$i binding present but Mode D not detected: $binding" "$out" ;;
+  esac
+done
+rm -f "$TMP/public/CLAUDE.local.md"
+
+# LANE 5 — emission model: a healthy machine speaks once (event) then goes silent.
+mk_git_hub "$TMP/healthy" yes
+r1="$(run "$TMP/healthy" "$TMP/s5" FH_MACHINE_ID=healthybox)"
+r2="$(run "$TMP/healthy" "$TMP/s5" FH_MACHINE_ID=healthybox)"
+if [ -n "$r1" ] && [ -z "$r2" ]; then ok "lane5 healthy: event once, then silent"
+else bad "lane5 healthy: expected run1 non-empty and run2 empty" "r1=[$r1] r2=[$r2]"; fi
+
+# LANE 6 (S2-4) — a missing floor is a CONDITION: it must be reported on every run, not once.
+mk_git_hub "$TMP/broken" yes
+rm -f "$TMP/broken/.git/hooks/pre-commit"
+n=0
+for i in 1 2 3; do
+  o="$(run "$TMP/broken" "$TMP/s6" FH_MACHINE_ID=brokenbox)"
+  case "$o" in *"Missing mechanical floor"*) n=$((n+1)) ;; esac
+done
+[ "$n" -eq 3 ] && ok "lane6 broken: reported on all 3 runs (condition, not event)" \
+               || bad "lane6 broken: reported $n/3 runs — a broken machine went quiet" "n=$n"
+
+# LANE 7 (M2-2) — linked worktree: .git is a FILE there, so a hand-built "$FH/.git/hooks" does not
+# exist and working hooks read as missing.
+mk_git_hub "$TMP/wt" yes
+git -C "$TMP/wt" worktree add -q "$TMP/wt_linked" -b lane7 2>/dev/null
+out="$(run "$TMP/wt_linked" "$TMP/s7" FH_MACHINE_ID=wtbox)"
+case "$out" in
+  *"Missing mechanical floor"*) bad "lane7 worktree: false missing-floor (hooks resolve to the main gitdir)" "$out" ;;
+  *"first session for this clone"*) ok "lane7 worktree: hooks resolved correctly, node event reported" ;;
+  *) bad "lane7 worktree: silent — a stub would pass this lane" "$out" ;;
+esac
+
+# LANE 8 (M3-3) — python3 unavailable: the companion verdict is UNMEASURED, never silently "fine".
+# Simulated by a PATH with no python3, for a Mode D hub (so the check is applicable).
+mk_git_hub "$TMP/nopy" yes
+mkdir -p "$TMP/emptybin" "$TMP/companion2/.git"
+out="$(PATH="$TMP/emptybin:/usr/bin:/bin" run "$TMP/nopy" "$TMP/s8" FH_MACHINE_ID=nopybox BE_DIR="$TMP/companion2")"
+if command -v python3 >/dev/null 2>&1 && [ -x /usr/bin/python3 ]; then
+  ok "lane8 skipped: /usr/bin/python3 exists so absence cannot be simulated via PATH"
+else
+  case "$out" in
+    *UNMEASURED*|*unmeasured*) ok "lane8 no python3: reported UNMEASURED, not silence" ;;
+    *) bad "lane8 no python3: absence read as pass" "$out" ;;
+  esac
+fi
+
+# LANE 9 (S4-2) — the sentinel regex is coupled to PROSE THAT LIVES IN ANOTHER FILE. Every other
+# lane hands it a fixture containing the string it expects, so the suite would stay fully green
+# while a purely cosmetic edit to the real hook headers (which no gate checks) made every FH machine
+# report "not FH's gate" every session. Calibrate the instrument against the shipped article.
+# DERIVE the regex from the script — never retype it. A hardcoded copy is the divergent-copy class
+# this repo already paid for once (SYNC_EXCLUDES in three places, which needed its own parity
+# checker): tighten the script's regex and a duplicated lane keeps validating the SHIPPED hooks
+# against the OLD pattern, staying green while the real check drifts.
+SENT="$(sed -n "s/.*grep -qE '\([^']*\)'.*/\1/p" "$FH_REPO/scripts/fh_node_check.sh" | head -1)"
+if [ -z "$SENT" ]; then
+  bad "lane9 sentinel: could not derive the regex from fh_node_check.sh (extraction broke — not a pass)" "empty"
+  SENT='__never_matches__'
+fi
+for h in "$FH_REPO"/templates/.git-hooks/pre-commit "$FH_REPO"/templates/.git-hooks/pre-push; do
+  if [ ! -f "$h" ]; then bad "lane9 sentinel: shipped hook missing: $h" "absent"; continue; fi
+  if grep -qE "$SENT" "$h"; then ok "lane9 sentinel matches shipped $(basename "$h")"
+  else bad "lane9 sentinel does NOT match shipped $(basename "$h") — every FH machine would report 'not FH gate'" "$(head -3 "$h")"; fi
+done
+
+printf '\nnode-check lanes: %d passed, %d failed\n' "$PASS" "$FAIL"
+[ "$FAIL" -eq 0 ] || exit 1
+exit 0

package/scripts/test_ollama_panel_lanes.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# test_ollama_panel_lanes.sh — hermetic known pairs for the ollama panel leg of sidecar_calibrate.sh
+#
+# Hermetic by construction: every lane runs against a stub HTTP server on loopback. No network, no
+# spend, no dependence on a node being powered on — the same property the CLI lanes get from stub
+# binaries. A calibrator whose own tests need the thing it calibrates cannot fail honestly.
+#
+# WHAT MAKES THIS LEG DIFFERENT FROM codex/agy, AND WHY IT NEEDED ITS OWN LANES
+#   The CLI legs anchor PIN-OK on the model's SELF-REPORT. That anchor is invalid here and the
+#   measurement says so: asked which model it was, `gpt-oss:20b` answered "The underlying model is
+#   GPT-4 (likely)" (2026-07-31). Open-weight models do not reliably know their own name, so a
+#   self-report anchor would mark an EXACT pin as UNTRUSTED and drop it from the panel — an
+#   instrument that cannot separate known-positive from known-negative on its target. The anchor is
+#   therefore the SERVER's response envelope: a server-side fact, not a model's claim.
+#   Lane S2 is the reason that distinction has teeth — it is the agy failure in this protocol's
+#   spelling: the server quietly answers as a different model than the one pinned.
+
+set -u
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CAL="$ROOT/scripts/sidecar_calibrate.sh"
+pass=0; fail=0
+PORT="${FH_LANE_PORT:-18011}"
+SRV_PID=""
+
+# `wait` after the kill, so bash reaps the child quietly instead of printing "Terminated: 15" into
+# the lane output — a harness that litters CI logs teaches people to stop reading them.
+stop_stub() {
+  [ -n "$SRV_PID" ] || return 0
+  kill "$SRV_PID" 2>/dev/null
+  wait "$SRV_PID" 2>/dev/null
+  SRV_PID=""
+}
+trap 'stop_stub' EXIT
+
+# The stub is written to a file so the heredoc cannot collide with the lane script's own quoting.
+STUB="$(mktemp -d)/stub.py"
+cat > "$STUB" <<'PY'
+import json, sys
+from http.server import BaseHTTPRequestHandler, HTTPServer
+PORT = int(sys.argv[1]); MODE = sys.argv[2]
+
+class H(BaseHTTPRequestHandler):
+    def log_message(self, *a): pass
+    def _send(self, obj, code=200):
+        b = json.dumps(obj).encode()
+        self.send_response(code); self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(b))); self.end_headers(); self.wfile.write(b)
+    def do_GET(self):
+        if self.path == "/api/version": self._send({"version": "stub"})
+        elif self.path == "/api/tags": self._send({"models": [{"name": "stub-model:1b"}]})
+        else: self._send({}, 404)
+    def do_POST(self):
+        n = int(self.headers.get("Content-Length", 0))
+        req = json.loads(self.rfile.read(n) or b"{}")
+        m = req.get("model", "")
+        if m.startswith("fh-calib-nonexistent"):
+            # BOGUS control. 'accept' mode is the dangerous server: it serves SOMETHING for a name
+            # that cannot exist, so the pin is never validated at all.
+            if MODE == "accept": self._send({"model": m, "response": "PASS"})
+            else: self._send({"error": f"model '{m}' not found"})
+            return
+        if MODE == "substitute":  # the agy failure, in this protocol
+            self._send({"model": "some-other-model:9b", "response": "PASS"}); return
+        if MODE == "starved":     # reasoning model spent the whole budget thinking
+            self._send({"model": m, "response": "", "thinking": "x" * 780}); return
+        if MODE == "prose":       # cannot carry a machine-read verdict
+            self._send({"model": m, "response": "Well, I would say this looks like a PASS overall."}); return
+        self._send({"model": m, "response": "PASS"})
+HTTPServer(("127.0.0.1", PORT), H).serve_forever()
+PY
+# shellcheck disable=SC2016
+start_stub() {
+  stop_stub
+  python3 "$STUB" "$PORT" "$1" >/dev/null 2>&1 &
+  SRV_PID=$!
+  for _ in $(seq 1 40); do
+    curl -sf --max-time 1 "http://127.0.0.1:$PORT/api/version" >/dev/null 2>&1 && return 0
+    sleep 0.25
+  done
+  return 1
+}
+
+# expect <label> <mode> <expect-in-panel: YES|NO> [needle]
+expect() {
+  local label="$1" mode="$2" want="$3" needle="${4:-}" out inpanel
+  start_stub "$mode" || { printf '  ❌ %-44s stub failed to start\n' "$label"; fail=$((fail+1)); return; }
+  out=$( FH_OLLAMA_HOST="http://127.0.0.1:$PORT" FH_OLLAMA_MODELS="stub-model:1b" \
+         bash "$CAL" --only ollama --quiet 2>&1 )
+  stop_stub
+  if printf '%s' "$out" | grep -q 'PANEL:.*ollama:stub-model:1b'; then inpanel=YES; else inpanel=NO; fi
+  if [ "$inpanel" = "$want" ] && { [ -z "$needle" ] || printf '%s' "$out" | grep -q "$needle"; }; then
+    printf '  ✅ %-44s in-panel=%s\n' "$label" "$inpanel"; pass=$((pass+1))
+  else
+    printf '  ❌ %-44s in-panel=%s (expected %s%s)\n' "$label" "$inpanel" "$want" "${needle:+, needle '$needle'}"
+    printf '     out: %s\n' "$(printf '%s' "$out" | head -4)"; fail=$((fail+1))
+  fi
+}
+
+echo "[ollama-panel] known pairs (hermetic stub server)"
+expect "S1 envelope matches pin, verdict parses" ok         YES "PIN-OK(envelope)"
+expect "S2 server substitutes a DIFFERENT model" substitute NO  "UNTRUSTED-PIN"
+expect "S3 empty answer (budget starvation)"     starved    NO  "larger FH_OLLAMA_NUM_PREDICT"
+expect "S4 prose answer cannot carry a verdict"  prose      NO  "VERDICT-UNPARSEABLE"
+expect "S5 server accepts a bogus model name"    accept     YES "accepts-bogus"
+
+# S6 — absence must be MEASURED, never assumed. No server at the host at all.
+out=$( FH_OLLAMA_HOST="http://127.0.0.1:$((PORT+7))" bash "$CAL" --only ollama --quiet 2>&1 )
+if printf '%s' "$out" | grep -q 'ABSENT — no server at the configured host'; then
+  printf '  ✅ %-44s reported ABSENT\n' "S6 no server at host"; pass=$((pass+1))
+else
+  printf '  ❌ %-44s (expected a measured ABSENT line)\n' "S6 no server at host"
+  printf '     out: %s\n' "$(printf '%s' "$out" | head -3)"; fail=$((fail+1))
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then
+  echo "[ollama-panel] ✅ all $pass known pairs hold"; exit 0
+else
+  echo "[ollama-panel] ❌ $fail/$((pass+fail)) lanes failed"; exit 1
+fi