@chrono-meta/fh-gate 1.4.78 → 1.4.79

package/scripts/test_card_drift_probe.sh

@@ -29,6 +29,25 @@ run_fixture() {  # $1=name  $2=card-content  $3=make-artifact(0/1)  $4=expect-wa
   local out; out=$(bash "$CHECK" "$T" 2>/dev/null)
   local warned=0
   printf '%s\n' "$out" | grep -q "⑤-b card-drift" && warned=1
+  # RUN EVERY FIXTURE TWICE — ambient locale AND LC_ALL=C. Added 2026-07-31 after the probe passed
+  # 3/3 here for weeks while returning warn=0 for EVERY lane on the ubuntu runner. Cause: the
+  # absence regex held a Hangul RANGE `[^가-힣]`, which GNU grep in the C locale rejects with
+  # "Invalid collation character" — it exits 2 and prints nothing, which downstream is
+  # indistinguishable from "no match", so the probe reported the card clean on every input.
+  # BSD grep accepts the range, so no amount of running this suite on macOS could ever have caught
+  # it. MEASURED LIMIT, stated because the first version of this comment overclaimed: LC_ALL=C on
+  # macOS is NOT a stand-in for GNU grep — reverting the Hangul range with this dual-run in place
+  # still passed here. So this leg detects the class only where GNU grep runs, i.e. in CI. It is
+  # kept because a locale-divergent verdict is a defect wherever it is observed, and it costs one
+  # extra invocation; the platform-independent detector is the source lint below.
+  local out_c; out_c=$(LC_ALL=C LANG=C bash "$CHECK" "$T" 2>/dev/null)
+  local warned_c=0
+  printf '%s\n' "$out_c" | grep -q "⑤-b card-drift" && warned_c=1
+  if [ "$warned" != "$warned_c" ]; then
+    echo "❌ $name — LOCALE-DIVERGENT: ambient warn=$warned but LC_ALL=C warn=$warned_c"
+    echo "     텍스트 계기가 로케일에 따라 다른 판정을 낸다 — 어느 쪽이 맞든 캘리브레이션 실패다."
+    rm -rf "$T"; FAILED=1; return
+  fi
   rm -rf "$T"
   if [ "$warned" = "$expect" ]; then
     echo "✅ $name (warn=$warned, expected=$expect)"
@@ -73,5 +92,41 @@ run_fixture "P4 영어 부재주장 (A-4 앵커)" \
 run_fixture "N7 인용된 부재키워드+정정 → 무경고 (실카드 07-22 클래스)" \
   "- 🔴 foo-digest 산출 누락. 기존 카드의 \"미가동\" 주장은 오판정이었음" 1 0
 
+
+# ── LOCALE-RANGE LINT (platform-independent, added 2026-07-31) ─────────────────────────
+# The behavioural dual-run above cannot fire on BSD grep, so the class needs a detector that does
+# not depend on which grep is installed. This one reads the SOURCE: a bracket expression containing
+# a non-ASCII RANGE (`[^가-힣]`, `[ㄱ-ㅎ]`, …) is collation-dependent by construction and will be
+# rejected outright by GNU grep in the C locale — "Invalid collation character", exit 2, no output,
+# which downstream reads as "no match" and therefore as clean.
+# Alternation of non-ASCII literals (`(🔴|🟡)`, `미가동|부재`) is NOT flagged: it carries no
+# collation, and the runner proved it works (the emoji line-selection stage passed there while the
+# range stage errored). Flagging it would push an author to mangle working code.
+echo "-- locale-range lint: 비ASCII 문자 범위를 쓰는 정규식 (collation 의존) --"
+LINT_OUT=$(python3 - "$SCRIPT_DIR" <<'LINTPY'
+import re, sys, glob, os
+root = sys.argv[1]
+# a bracket expression containing  <non-ascii> - <non-ascii>
+rng = re.compile(r'\[[^]\n]*[^\x00-\x7F]-[^\x00-\x7F][^]\n]*\]')
+hits = []
+for f in sorted(glob.glob(os.path.join(root, '*.sh'))):
+    for i, line in enumerate(open(f, encoding='utf-8', errors='replace'), 1):
+        if line.lstrip().startswith('#'):
+            continue
+        m = rng.search(line)
+        if m:
+            hits.append(f"{os.path.basename(f)}:{i}: {m.group(0)}")
+print('\n'.join(hits))
+LINTPY
+)
+if [ -n "$LINT_OUT" ]; then
+  echo "❌ 비ASCII 범위 발견 — GNU grep(C 로케일)에서 exit 2 로 죽고 결과가 '무매치'로 읽힌다:"
+  printf '%s\n' "$LINT_OUT" | sed 's/^/     /'
+  FAILED=1
+else
+  echo "✅ locale-range lint: 비ASCII 문자 범위 없음"
+fi
+
+
 echo "── card-drift probe calibration: $([ "$FAILED" -eq 0 ] && echo "PASS (전 픽스처) — 배선 가능" || echo "FAIL — 계기 불량, 배선 금지") ──"
 exit "$FAILED"

package/scripts/test_halffix_lanes.sh

@@ -0,0 +1,170 @@
+#!/usr/bin/env bash
+# test_halffix_lanes.sh — known pairs for scripts/halffix_propagation_scan.sh
+#
+# WHY, AND WHY LANES FIRST
+#   2026-07-30 harvest #1: rounds that wrote the lane BEFORE touching the code had zero
+#   fix-reverts-fix regressions. Order made the convergence, not the patch.
+#
+# THE DEFECT BEING GUARDED — "반쪽-수리" (half-fix)
+#   A defect class lives in N sibling copies. The fix lands in ONE. The siblings keep the bug, and
+#   nothing says so. Measured 3x in this project, and the shape is worse than it sounds: every one
+#   of the three occurred INSIDE an edit that was itself repairing an earlier half-fix.
+#   scripts/psa_scan_lib.sh's header records five such divergences found in a single audit — the
+#   override-readable check, the fail-closed-on-no-patterns branch, the SPACE-vs-TAB row, the
+#   `head -1` shielding, and the LOW allowlist — each repaired where it was found and nowhere else.
+#
+# THE DISCRIMINATOR THAT MAKES THIS USEFUL INSTEAD OF NOISY (lane N3)
+#   If BOTH copies are staged, the fix WAS propagated and the scan must stay silent. A detector that
+#   fires on correct propagation is a detector that gets ignored — the S5 lesson (9/9 FP, narrowed
+#   2026-07-28) and the S6 lesson (0 true positives on the planned surface, retargeted 2026-07-31)
+#   are the two prior claims on this exact mistake in this repo.
+#
+# ADVISORY BY MANDATE, not by preference: the operator's spec for this debt says "표시(차단 아님 —
+#   정당한 복제도 있다)" — mark, do not block, because legitimate duplication exists.
+
+set -u
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SCAN="$ROOT/scripts/halffix_propagation_scan.sh"
+pass=0; fail=0
+
+# mkrepo <dir> — a throwaway git repo; caller populates and stages.
+mkrepo() {
+  rm -rf "$1"; mkdir -p "$1"; ( cd "$1" && git init -q . && git config user.email t@e && git config user.name t )
+}
+
+# expect <label> <FLAG|SILENT> <repo> [needle]
+expect() {
+  local label="$1" want="$2" repo="$3" needle="${4:-}" out got
+  out=$( cd "$repo" && bash "$SCAN" 2>&1 )
+  if printf '%s' "$out" | grep -q 'HALF-FIX'; then got=FLAG; else got=SILENT; fi
+  if [ "$got" = "$want" ] && { [ -z "$needle" ] || printf '%s' "$out" | grep -q "$needle"; }; then
+    printf '  ✅ %-50s %s\n' "$label" "$got"; pass=$((pass+1))
+  else
+    printf '  ❌ %-50s %s (expected %s%s)\n' "$label" "$got" "$want" \
+      "${needle:+, needle '$needle'}"; fail=$((fail+1))
+    printf '     out: %s\n' "$(printf '%s' "$out" | head -6)"
+  fi
+}
+
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+echo "[halffix] known pairs"
+
+# ── P1: the canonical shape — a distinctive symbol duplicated in a sibling, only one staged ──
+R="$T/p1"; mkrepo "$R"
+printf 'psa_low_allowlisted() {\n  case "$1" in templates/*) return 0 ;; esac\n}\n' > "$R/a.sh"
+printf 'psa_low_allowlisted() {\n  case "$1" in templates/*) return 0 ;; esac\n}\n' > "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'psa_low_allowlisted() {\n  case "$1" in templates/*|docs/*) return 0 ;; esac\n}\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "P1 sibling copy left unstaged" FLAG "$R" "b.sh"
+
+# ── P2: three copies, one staged — both remaining siblings named ──
+R="$T/p2"; mkrepo "$R"
+for f in a b c; do printf 'validate_marker_fields_strictly() { :; }\n' > "$R/$f.sh"; done
+( cd "$R" && git add . && git commit -qm base )
+printf 'validate_marker_fields_strictly() { echo fixed; }\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "P2 two siblings, both named"   FLAG "$R" "c.sh"
+
+# ── N3: THE DISCRIMINATOR — both copies staged means the fix propagated. Silence. ──
+R="$T/n3"; mkrepo "$R"
+printf 'psa_low_allowlisted() { :; }\n' > "$R/a.sh"; cp "$R/a.sh" "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'psa_low_allowlisted() { echo fixed; }\n' > "$R/a.sh"; cp "$R/a.sh" "$R/b.sh"
+( cd "$R" && git add a.sh b.sh )
+expect "N3 both staged = propagated"   SILENT "$R"
+
+# ── N4: unique content — nothing to propagate to ──
+R="$T/n4"; mkrepo "$R"
+printf 'lonely_unique_helper_fn() { :; }\n' > "$R/a.sh"
+printf 'something_entirely_different() { :; }\n' > "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'lonely_unique_helper_fn() { echo x; }\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "N4 no sibling holds the symbol"  SILENT "$R"
+
+# ── N5: ubiquitous token — a word in 12 files is framework noise, not a half-fix ──
+R="$T/n5"; mkrepo "$R"
+for i in $(seq 1 12); do printf 'REPO_ROOT_DIRECTORY=/x\n' > "$R/f$i.sh"; done
+( cd "$R" && git add . && git commit -qm base )
+printf 'REPO_ROOT_DIRECTORY=/y\n' > "$R/f1.sh"
+( cd "$R" && git add f1.sh )
+expect "N5 ubiquitous token suppressed"  SILENT "$R"
+
+# ── N6: short/common tokens must not anchor (would flag on `then`, `echo`, `return`) ──
+R="$T/n6"; mkrepo "$R"
+printf 'if [ -f x ]; then echo a; fi\n' > "$R/a.sh"
+printf 'if [ -f y ]; then echo b; fi\n' > "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'if [ -f x ]; then echo c; fi\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "N6 short shell keywords ignored"  SILENT "$R"
+
+# ── P7: filenames count as symbols too (the spec says "수정 심볼·파일명") ──
+R="$T/p7"; mkrepo "$R"
+printf 'bash scripts/sidecar_calibrate.sh --run\n' > "$R/a.sh"
+printf 'bash scripts/sidecar_calibrate.sh --run\n' > "$R/doc.md"
+( cd "$R" && git add . && git commit -qm base )
+printf 'bash scripts/sidecar_calibrate.sh --run --strict\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "P7 filename token propagates"    FLAG "$R" "doc.md"
+
+# ── N8: nothing staged at all ──
+R="$T/n8"; mkrepo "$R"; printf 'x\n' > "$R/a.sh"; ( cd "$R" && git add . && git commit -qm base )
+expect "N8 empty staging area"           SILENT "$R"
+
+# ── N9: opt-out ──
+R="$T/n9"; mkrepo "$R"
+printf 'psa_low_allowlisted() { :; }\n' > "$R/a.sh"; cp "$R/a.sh" "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'psa_low_allowlisted() { echo x; }  # noqa: half-fix\n' > "$R/a.sh"
+( cd "$R" && git add a.sh )
+expect "N9 noqa suppresses"              SILENT "$R"
+
+# ── N10: deleted file must not crash the scan ──
+R="$T/n10"; mkrepo "$R"
+printf 'psa_low_allowlisted() { :; }\n' > "$R/a.sh"; cp "$R/a.sh" "$R/b.sh"
+( cd "$R" && git add . && git commit -qm base )
+( cd "$R" && git rm -q a.sh )
+expect "N10 deletion does not crash"     SILENT "$R"
+
+echo "-- R2: whole-file copy divergence (found by LIVE calibration, not by the lanes above) --"
+# The token rule alone MISSED this repo's real duplicate pair (scripts/degrade_direction_scan.sh ↔
+# templates/degrade_direction_scan.sh) because a script's NAME appears in 11–18 files here — docs,
+# CATALOG, the manifest, selfcheck references — so the ubiquity filter suppressed it, while an
+# internal symbol like psa_low_allowlisted appears in 2. Measured 2026-07-31: the lanes were 10/10
+# green and the live probe was silent. Lanes are necessary and not sufficient.
+#
+# The predicate is exact rather than heuristic: the sibling was BYTE-IDENTICAL at HEAD and only one
+# side is staged. That is a divergence by construction, so it needs no threshold — and it stays
+# silent for same-basename files that were never copies (CLAUDE.md vs templates/CLAUDE.md, the 40
+# SKILL.md files), which a basename rule would have flooded.
+R="$T/r2p"; mkrepo "$R"; mkdir -p "$R/scripts" "$R/templates"
+printf 'a() { :; }\nb() { :; }\n' > "$R/scripts/x.sh"
+cp "$R/scripts/x.sh" "$R/templates/x.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'a() { echo fixed; }\nb() { :; }\n' > "$R/scripts/x.sh"
+( cd "$R" && git add scripts/x.sh )
+expect "R2 byte-identical copy diverges"  FLAG "$R" "templates/x.sh"
+
+R="$T/r2n"; mkrepo "$R"; mkdir -p "$R/scripts" "$R/templates"
+printf 'hub version, quite different\n' > "$R/scripts/x.sh"
+printf 'template version, also different\n' > "$R/templates/x.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'hub version, edited\n' > "$R/scripts/x.sh"
+( cd "$R" && git add scripts/x.sh )
+expect "R2 same name but never a copy"    SILENT "$R"
+
+R="$T/r2b"; mkrepo "$R"; mkdir -p "$R/scripts" "$R/templates"
+printf 'a() { :; }\n' > "$R/scripts/x.sh"; cp "$R/scripts/x.sh" "$R/templates/x.sh"
+( cd "$R" && git add . && git commit -qm base )
+printf 'a() { echo fixed; }\n' > "$R/scripts/x.sh"; cp "$R/scripts/x.sh" "$R/templates/x.sh"
+( cd "$R" && git add scripts/x.sh templates/x.sh )
+expect "R2 both staged = propagated"      SILENT "$R"
+
+echo
+if [ "$fail" -eq 0 ]; then
+  echo "[halffix] ✅ all $pass known pairs hold"; exit 0
+else
+  echo "[halffix] ❌ $fail/$((pass+fail)) lanes failed"; exit 1
+fi

package/scripts/test_ollama_panel_lanes.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+# test_ollama_panel_lanes.sh — hermetic known pairs for the ollama panel leg of sidecar_calibrate.sh
+#
+# Hermetic by construction: every lane runs against a stub HTTP server on loopback. No network, no
+# spend, no dependence on a node being powered on — the same property the CLI lanes get from stub
+# binaries. A calibrator whose own tests need the thing it calibrates cannot fail honestly.
+#
+# WHAT MAKES THIS LEG DIFFERENT FROM codex/agy, AND WHY IT NEEDED ITS OWN LANES
+#   The CLI legs anchor PIN-OK on the model's SELF-REPORT. That anchor is invalid here and the
+#   measurement says so: asked which model it was, `gpt-oss:20b` answered "The underlying model is
+#   GPT-4 (likely)" (2026-07-31). Open-weight models do not reliably know their own name, so a
+#   self-report anchor would mark an EXACT pin as UNTRUSTED and drop it from the panel — an
+#   instrument that cannot separate known-positive from known-negative on its target. The anchor is
+#   therefore the SERVER's response envelope: a server-side fact, not a model's claim.
+#   Lane S2 is the reason that distinction has teeth — it is the agy failure in this protocol's
+#   spelling: the server quietly answers as a different model than the one pinned.
+
+set -u
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CAL="$ROOT/scripts/sidecar_calibrate.sh"
+pass=0; fail=0
+PORT="${FH_LANE_PORT:-18011}"
+SRV_PID=""
+
+# `wait` after the kill, so bash reaps the child quietly instead of printing "Terminated: 15" into
+# the lane output — a harness that litters CI logs teaches people to stop reading them.
+stop_stub() {
+  [ -n "$SRV_PID" ] || return 0
+  kill "$SRV_PID" 2>/dev/null
+  wait "$SRV_PID" 2>/dev/null
+  SRV_PID=""
+}
+trap 'stop_stub' EXIT
+
+# The stub is written to a file so the heredoc cannot collide with the lane script's own quoting.
+STUB="$(mktemp -d)/stub.py"
+cat > "$STUB" <<'PY'
+import json, sys
+from http.server import BaseHTTPRequestHandler, HTTPServer
+PORT = int(sys.argv[1]); MODE = sys.argv[2]
+
+class H(BaseHTTPRequestHandler):
+    def log_message(self, *a): pass
+    def _send(self, obj, code=200):
+        b = json.dumps(obj).encode()
+        self.send_response(code); self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(b))); self.end_headers(); self.wfile.write(b)
+    def do_GET(self):
+        if self.path == "/api/version": self._send({"version": "stub"})
+        elif self.path == "/api/tags": self._send({"models": [{"name": "stub-model:1b"}]})
+        else: self._send({}, 404)
+    def do_POST(self):
+        n = int(self.headers.get("Content-Length", 0))
+        req = json.loads(self.rfile.read(n) or b"{}")
+        m = req.get("model", "")
+        if m.startswith("fh-calib-nonexistent"):
+            # BOGUS control. 'accept' mode is the dangerous server: it serves SOMETHING for a name
+            # that cannot exist, so the pin is never validated at all.
+            if MODE == "accept": self._send({"model": m, "response": "PASS"})
+            else: self._send({"error": f"model '{m}' not found"})
+            return
+        if MODE == "substitute":  # the agy failure, in this protocol
+            self._send({"model": "some-other-model:9b", "response": "PASS"}); return
+        if MODE == "starved":     # reasoning model spent the whole budget thinking
+            self._send({"model": m, "response": "", "thinking": "x" * 780}); return
+        if MODE == "prose":       # cannot carry a machine-read verdict
+            self._send({"model": m, "response": "Well, I would say this looks like a PASS overall."}); return
+        self._send({"model": m, "response": "PASS"})
+HTTPServer(("127.0.0.1", PORT), H).serve_forever()
+PY
+# shellcheck disable=SC2016
+start_stub() {
+  stop_stub
+  python3 "$STUB" "$PORT" "$1" >/dev/null 2>&1 &
+  SRV_PID=$!
+  for _ in $(seq 1 40); do
+    curl -sf --max-time 1 "http://127.0.0.1:$PORT/api/version" >/dev/null 2>&1 && return 0
+    sleep 0.25
+  done
+  return 1
+}
+
+# expect <label> <mode> <expect-in-panel: YES|NO> [needle]
+expect() {
+  local label="$1" mode="$2" want="$3" needle="${4:-}" out inpanel
+  start_stub "$mode" || { printf '  ❌ %-44s stub failed to start\n' "$label"; fail=$((fail+1)); return; }
+  out=$( FH_OLLAMA_HOST="http://127.0.0.1:$PORT" FH_OLLAMA_MODELS="stub-model:1b" \
+         bash "$CAL" --only ollama --quiet 2>&1 )
+  stop_stub
+  if printf '%s' "$out" | grep -q 'PANEL:.*ollama:stub-model:1b'; then inpanel=YES; else inpanel=NO; fi
+  if [ "$inpanel" = "$want" ] && { [ -z "$needle" ] || printf '%s' "$out" | grep -q "$needle"; }; then
+    printf '  ✅ %-44s in-panel=%s\n' "$label" "$inpanel"; pass=$((pass+1))
+  else
+    printf '  ❌ %-44s in-panel=%s (expected %s%s)\n' "$label" "$inpanel" "$want" "${needle:+, needle '$needle'}"
+    printf '     out: %s\n' "$(printf '%s' "$out" | head -4)"; fail=$((fail+1))
+  fi
+}
+
+echo "[ollama-panel] known pairs (hermetic stub server)"
+expect "S1 envelope matches pin, verdict parses" ok         YES "PIN-OK(envelope)"
+expect "S2 server substitutes a DIFFERENT model" substitute NO  "UNTRUSTED-PIN"
+expect "S3 empty answer (budget starvation)"     starved    NO  "larger FH_OLLAMA_NUM_PREDICT"
+expect "S4 prose answer cannot carry a verdict"  prose      NO  "VERDICT-UNPARSEABLE"
+expect "S5 server accepts a bogus model name"    accept     YES "accepts-bogus"
+
+# S6 — absence must be MEASURED, never assumed. No server at the host at all.
+out=$( FH_OLLAMA_HOST="http://127.0.0.1:$((PORT+7))" bash "$CAL" --only ollama --quiet 2>&1 )
+if printf '%s' "$out" | grep -q 'ABSENT — no server at the configured host'; then
+  printf '  ✅ %-44s reported ABSENT\n' "S6 no server at host"; pass=$((pass+1))
+else
+  printf '  ❌ %-44s (expected a measured ABSENT line)\n' "S6 no server at host"
+  printf '     out: %s\n' "$(printf '%s' "$out" | head -3)"; fail=$((fail+1))
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then
+  echo "[ollama-panel] ✅ all $pass known pairs hold"; exit 0
+else
+  echo "[ollama-panel] ❌ $fail/$((pass+fail)) lanes failed"; exit 1
+fi

package/scripts/test_package_coverage_lanes.sh

@@ -0,0 +1,250 @@
+#!/usr/bin/env bash
+# test_package_coverage_lanes.sh — regression anchor for scripts/package_coverage_check.sh.
+#
+# WHY THIS EXISTS (measured 2026-07-31):
+#   package_coverage_check.sh gated itself on `[ ! -d .git ]`. In a git WORKTREE `.git` is a FILE
+#   (a gitdir pointer), so every worktree fell into the "installed package" branch and the check
+#   printed `SKIP` and exited 0 without scanning anything. That is a FALSE CLEAN of the worst shape:
+#   a worktree is the standard way to approximate a fresh CI checkout, so the surface used to argue
+#   "CI would be green" was precisely the surface on which this check silently did not run.
+#   It was found by using the instrument, then asking whether the instrument had run at all —
+#   CLAUDE.md §Instrument-Calibration, applied to FH's own tooling.
+#
+#   Second reason: selfcheck.sh enforces "subject present but anchor missing => FAIL" for eight
+#   other scripts, and package_coverage_check.sh was the one subject exempted from its own rule.
+#   An unanchored checker is one revert away from being decoration.
+#
+# The lanes pin, in order: the source-checkout predicate across all four tree shapes (worktree /
+# ordinary checkout / package mode / no manifest), and a KNOWN PAIR — a tree that must FAIL and an
+# otherwise identical tree that must PASS. A predicate that cannot separate that pair is not
+# measuring coverage, it is emitting a verdict.
+#
+# Usage:  bash scripts/test_package_coverage_lanes.sh
+# Exit:   0 = no lane FAILED. 1 = a regression.
+#         NOT "all lanes passed": a lane whose precondition is absent (no git) is counted as
+#         UNCALIBRATED and printed in the summary, and exit stays 0. Stated precisely because the
+#         earlier wording promised more than the code delivers, and an exit contract that overstates
+#         is exactly the false-clean this suite exists to prevent (round-3 review, LOW).
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SUBJECT="$REPO_ROOT/scripts/package_coverage_check.sh"
+[ -f "$SUBJECT" ] || { echo "FAIL: $SUBJECT not found"; exit 1; }
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+pass=0; fail=0; skipped=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+# A skip is COUNTED and reported. An uncounted skip is how "could not run" becomes indistinguishable
+# from "ran and passed" in the summary line — measured on this very suite in review round 2, where a
+# broken git produced "7 passed, 0 failed" and exit 0 while the real-worktree claim went untested.
+# Degrade direction per CLAUDE.md §Instrument-Calibration: label it UNCALIBRATED, never a bare pass.
+skip() { printf '  ⏭  UNCALIBRATED — %s\n' "$1"; skipped=$((skipped+1)); }
+
+# Build a hermetic fake source tree. `git_shape` is one of: file | dir | none.
+# `ship_the_doc` decides whether the referenced path is inside files[] (the known pair).
+make_tree() { # make_tree <dir> <git_shape> <cover_target:yes|no> [omit_manifest]
+  local d="$1" git_shape="$2" cover="$3" omit="${4:-}"
+  mkdir -p "$d/scripts" "$d/docs"
+  cp "$SUBJECT" "$d/scripts/package_coverage_check.sh"
+
+  # A shipped document that points at scripts/helper.sh, and that file really exists here.
+  # "exists here but absent from files[]" is exactly the defect class this check owns.
+  printf 'Run `scripts/helper.sh` before the gate.\n' > "$d/docs/guide.md"
+  printf '#!/usr/bin/env bash\necho helper\n' > "$d/scripts/helper.sh"
+
+  if [ "$cover" = "yes" ]; then
+    printf '{"files":["docs/guide.md","scripts/helper.sh"]}\n' > "$d/package.json"
+  else
+    printf '{"files":["docs/guide.md"]}\n' > "$d/package.json"
+  fi
+  [ -n "$omit" ] && rm -f "$d/package.json"
+
+  case "$git_shape" in
+    dir)  mkdir -p "$d/.git" ;;
+    file) printf 'gitdir: /somewhere/else/.git/worktrees/x\n' > "$d/.git" ;;
+    none) : ;;
+  esac
+}
+
+run_tree() { bash "$1/scripts/package_coverage_check.sh" 2>&1; }
+rc_tree()  { bash "$1/scripts/package_coverage_check.sh" >/dev/null 2>&1; echo $?; }
+
+# Assert a POSITIVE outcome, never merely the absence of the SKIP line. Cross-family review caught
+# the first draft here: it checked only that `SKIP  package-coverage` was missing, so a checker that
+# exited 1 on every worktree — the opposite defect, equally broken — would have passed the lane that
+# exists to prove the worktree path works. "Did not say the wrong thing" is not "did the right
+# thing"; a lane phrased as a negative can only ever fail one way.
+ran_clean() { # ran_clean <dir> -> 0 iff the check actually ran AND reported a clean scan
+  local d="$1" o rc
+  o=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); rc=$?
+  [ "$rc" -eq 0 ] && printf '%s' "$o" | grep -q 'PASS  package-coverage' \
+    && ! printf '%s' "$o" | grep -q 'SKIP  package-coverage'
+}
+caught_defect() { # caught_defect <dir> -> 0 iff the check FOUND the planted omission
+  local d="$1" o rc
+  o=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); rc=$?
+  [ "$rc" -eq 1 ] && printf '%s' "$o" | grep -q 'scripts/helper.sh'
+}
+# A CLEAN LANE ALONE PROVES NOTHING ABOUT THE WORKTREE PATH. Cross-family review round 2 demonstrated
+# this by EXECUTION: it replaced the subject with a mutant that printed `PASS  package-coverage`
+# whenever `.git` was a file, without scanning anything — and all eight lanes passed, suite exit 0.
+# The lanes proved "returned a PASS-shaped string", not "ran the coverage logic". The known-positive
+# fixtures existed but only under the `.git`-is-a-DIRECTORY shape, so nothing exercised detection in
+# the very shape the fix was about. Every worktree lane below is now a PAIR: the same tree must go
+# clean->PASS and planted-omission->FAIL. A bypassing mutant fails the second half by construction.
+wt_pair() { # wt_pair <label> <dir> <git_shape>
+  local label="$1" d="$2" shape="$3"
+  make_tree "$d" "$shape" yes
+  if ! ran_clean "$d"; then
+    bad "$label — clean leg: did not run to a PASS ($(run_tree "$d" | head -1))"; return
+  fi
+  make_tree "$d" "$shape" no        # identical tree, files[] no longer covers the referenced path
+  if ! caught_defect "$d"; then
+    bad "$label — DEFECT leg: planted omission not caught, so the clean PASS proved nothing"; return
+  fi
+  ok "$label"
+}
+
+# ── L1 · THE REGRESSION ANCHOR ───────────────────────────────────────────────────────
+wt_pair "L1 worktree (.git is a FILE): scans for real — clean PASSes, planted omission FAILs" \
+        "$TMP/l1" file
+
+# ── L1-b · a REAL git worktree, not a hand-written pointer ───────────────────────────
+# The synthetic fixture writes a gitdir pointer whose target does not exist, so it proves the
+# predicate accepts "a file named .git" — not that it accepts a genuine worktree. This lane builds
+# an actual repo and an actual `git worktree add`.
+# ISOLATION (review round 2, LOW): the git commands run with signing off, hooks disabled, and both
+# config files pointed at /dev/null, so a configured signing prompt or a global hook cannot hang the
+# suite or write outside $TMP. GIT_TERMINAL_PROMPT=0 turns any credential prompt into an error.
+# SKIP ACCOUNTING (review round 2, MED — confirmed by execution): the first draft printed a skip and
+# incremented nothing, so a machine with a broken git reported "7 passed, 0 failed" and exited 0 —
+# a lane that cannot run must not read as a lane that passed. Now: git ABSENT is a legitimate skip
+# but is counted and surfaced as UNCALIBRATED in the summary; git PRESENT but setup failing is a
+# FAILURE, because there the claim was testable and the test did not run.
+GIT_ISO=(-c commit.gpgsign=false -c core.hooksPath=/dev/null -c user.email=a@b -c user.name=t)
+# CONFIG isolation is not REPOSITORY-ROUTING isolation. Round-3 review reproduced this on Apple Git
+# 2.50.1: with GIT_DIR pointing at an unrelated repo, this suite reported "8 passed, 0 failed" while
+# that external repo's commit count went 0 -> 1. So the lane could pass by exercising — and WRITING
+# TO — a repository that is not its fixture. A test that mutates state outside its own $TMP is not
+# a test, and the green summary is the worst part: it reports calibration it did not perform.
+# Every routing variable is cleared, and the resolved git-dir is then ASSERTED to live under $TMP
+# rather than assumed — the unset list is a denylist and a denylist is never proof; the assertion is.
+# SECOND LEAK CHANNEL, same class, found by the reviewer running the attack rather than reading for
+# it: GIT_CONFIG_PARAMETERS injects config that GIT_CONFIG_GLOBAL/SYSTEM=/dev/null does NOT suppress.
+# Reproduced here: with `init.templateDir` pointed at a directory whose `refs` is a symlink to an
+# external dir, `git init` populated that external dir — and the suite still printed
+# "8 passed, 0 failed". The git-dir assertion cannot see this one, because the git-dir DOES resolve
+# inside $TMP; the escape is through the template, not the routing. So the assertion is necessary and
+# not sufficient, and the config-injection channels have to be closed by name.
+# `--template=` with an empty directory is the belt to that braces: even if a config channel is
+# missed, init has an explicit, empty template to copy from.
+unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_COMMON_DIR GIT_OBJECT_DIRECTORY \
+      GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_NAMESPACE GIT_CEILING_DIRECTORIES \
+      GIT_CONFIG_PARAMETERS GIT_CONFIG_COUNT GIT_TEMPLATE_DIR
+export GIT_TERMINAL_PROMPT=0 GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null
+if ! command -v git >/dev/null 2>&1; then
+  skip "L1-b real git worktree (git not installed — the on-disk layout under test cannot exist here)"
+else
+  mkdir -p "$TMP/realrepo"
+  # BOTH SIDES NORMALIZED. First version compared the raw `mktemp -d` path against
+  # `rev-parse --absolute-git-dir`, and on macOS that fails for a clean tree: mktemp hands back
+  # /var/folders/... while git resolves symlinks and returns /private/var/folders/... . The
+  # assertion then rejected its OWN correct fixture — a false positive on a safety check, which is
+  # the same defect class as a false negative and would have trained the next reader to delete it.
+  # `pwd -P` resolves the $TMP side; the other side is already physical because
+  # `rev-parse --absolute-git-dir` resolves symlinks itself. The raw "$TMP"/* branch is kept as a
+  # belt for platforms where it does not. (An earlier comment said "both sides normalized via
+  # pwd -P" — only one side uses it.)
+  _TMP_REAL="$(cd "$TMP" && pwd -P)"
+  # NAME THE ORDER HONESTLY: `git init` runs FIRST and this assertion runs immediately after, so it
+  # gates every subsequent write (commit, worktree add) — not the init itself. init is bounded
+  # separately by the unset list plus the explicit empty --template. An earlier comment claimed
+  # "before anything is written", which overstated it by one step.
+  _gitdir_ok() { # the fixture repo must resolve INSIDE $TMP before anything FURTHER is written
+    local r; r=$(git "${GIT_ISO[@]}" -C "$TMP/realrepo" rev-parse --absolute-git-dir 2>/dev/null) || return 1
+    case "$r" in
+      "$_TMP_REAL"/*|"$TMP"/*) return 0 ;;
+      *) echo "  ↳ git-dir resolved OUTSIDE the fixture: $r" >&2; return 1 ;;
+    esac
+  }
+  mkdir -p "$TMP/emptytpl"
+  if git "${GIT_ISO[@]}" -C "$TMP/realrepo" init -q --template="$TMP/emptytpl" . >/dev/null 2>&1 \
+     && _gitdir_ok \
+     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" commit -q --allow-empty -m init >/dev/null 2>&1 \
+     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" worktree add -q --detach "$TMP/realwt" >/dev/null 2>&1 \
+     && [ -f "$TMP/realwt/.git" ]; then
+    wt_pair "L1-b real \`git worktree add\` (.git is a genuine gitdir pointer): scans for real" \
+            "$TMP/realwt" none          # the REAL .git file is already in place; do not overwrite it
+  else
+    bad "L1-b git IS installed but the real-worktree fixture could not be built — the claim was testable and was not tested"
+  fi
+fi
+
+# ── L2 · ordinary checkout keeps working ─────────────────────────────────────────────
+wt_pair "L2 ordinary checkout (.git is a DIR): scans for real — both legs" "$TMP/l2" dir
+
+# ── L3 · package mode must STILL skip ────────────────────────────────────────────────
+# The widening from -d to -e must not cost the legitimate skip. An installed npm package has no
+# .git of either kind; making it fail there would fire on every consumer running `npm test`.
+make_tree "$TMP/l3" none yes
+out=$(run_tree "$TMP/l3"); rc=$(rc_tree "$TMP/l3")
+if printf '%s' "$out" | grep -q 'SKIP  package-coverage' && [ "$rc" -eq 0 ]; then
+  ok "L3 package mode (no .git): still skips, exit 0"
+else
+  bad "L3 package mode (no .git): expected SKIP+0, got rc=$rc / $(printf '%s' "$out" | head -1)"
+fi
+
+# ── L4 · a checkout with no manifest is UNMEASURED, not clean ────────────────────────
+# EXPECTATION CORRECTED by cross-family review, 2026-07-31. The first draft asserted SKIP+0 here
+# and would have ANCHORED a fail-open: inside a checkout, a missing package.json means the shipped
+# file list cannot be read, which is "cannot measure", not "nothing to measure". An anchor that
+# pins the wrong direction is worse than no anchor — it makes the hole look deliberate.
+make_tree "$TMP/l4" dir yes omit
+out=$(run_tree "$TMP/l4"); rc=$(rc_tree "$TMP/l4")
+if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'UNMEASURED, not clean'; then
+  ok "L4 .git present but no package.json: FAILS as unmeasured, not a clean skip"
+else
+  bad "L4 no package.json: expected exit 1 (unmeasured), got rc=$rc / $(printf '%s' "$out" | head -1)"
+fi
+
+# ── L5/L6 · KNOWN PAIR ───────────────────────────────────────────────────────────────
+# Same tree twice; the ONLY difference is whether files[] covers the referenced path.
+# L5 known-POSITIVE: referenced, exists, not shipped -> must FAIL.
+make_tree "$TMP/l5" dir no
+out=$(run_tree "$TMP/l5"); rc=$(rc_tree "$TMP/l5")
+if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'scripts/helper.sh'; then
+  ok "L5 known-positive (referenced ∧ exists ∧ ¬shipped): FAIL, names the path"
+else
+  bad "L5 known-positive: expected exit 1 naming scripts/helper.sh, got rc=$rc"
+fi
+
+# L6 known-NEGATIVE: identical, but the path is in files[] -> must PASS.
+make_tree "$TMP/l6" dir yes
+out=$(run_tree "$TMP/l6"); rc=$(rc_tree "$TMP/l6")
+if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -q 'PASS  package-coverage'; then
+  ok "L6 known-negative (same tree, path shipped): PASS"
+else
+  bad "L6 known-negative: expected exit 0 PASS, got rc=$rc"
+fi
+
+# ── L7 · the impossible-zero guard is not reachable by an empty files[] ──────────────
+# A manifest with no shipped docs must report the extractor as broken, not print a pass.
+mkdir -p "$TMP/l7/scripts"; cp "$SUBJECT" "$TMP/l7/scripts/"; mkdir -p "$TMP/l7/.git"
+printf '{"files":[]}\n' > "$TMP/l7/package.json"
+out=$(run_tree "$TMP/l7"); rc=$(rc_tree "$TMP/l7")
+if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'the check broke, it did not pass'; then
+  ok "L7 zero shipped docs: reported as broken extractor, not as a pass"
+else
+  bad "L7 zero shipped docs: expected exit 1 'check broke', got rc=$rc"
+fi
+
+echo
+if [ "$skipped" -gt 0 ]; then
+  echo "package-coverage lanes: ${pass} passed, ${fail} failed, ${skipped} UNCALIBRATED (not verified here)"
+else
+  echo "package-coverage lanes: ${pass} passed, ${fail} failed"
+fi
+[ "$fail" -eq 0 ] || exit 1