@chrono-meta/fh-gate 1.4.80 → 1.4.82

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.80",
+      "version": "1.4.82",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.80",
+      "version": "1.4.82",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/CLAUDE.md

@@ -313,10 +313,12 @@ pipeline**, not an afterthought, and a below-floor orchestrator RUNS the review
 ## Field-Harness Diagnostic — "진단해줘 / 개선해줘" on a mapped project (compose → rank → HITL)
 
 The **on-demand pull sibling** of the gate above: a *project-level* "diagnose / improve this harness" ask
-composes the checks FH **already has** across **six lenses** — leak (`/public-surface-audit`, incl. **Step 3c ignore-verification** — a file believed gitignored but actually tracked is the leak this sub-step exists to catch) · split
+composes the checks FH **already has** across **seven lenses** — leak (`/public-surface-audit`, incl. **Step 3c ignore-verification** — a file believed gitignored but actually tracked is the leak this sub-step exists to catch) · split
 integrity (`/phantom-quench` **Step 2.7**) · token/salience (`/context-doctor` · `/salience-splitter`) · structure
 (`/harness-doctor`) · verdict degrade (`scripts/degrade_direction_scan.sh`) · loop-readiness
-(`loop_engineering.md`) — into **one ranked `M`/`S`/`R` list**. No-reinvention: it only routes and ranks.
+(`loop_engineering.md`) · built-but-unwired (per-module caller grep — a completed module with zero
+external call sites; the dominant class of the 2026-08-01 qasp audit) — into **one ranked `M`/`S`/`R`
+list**. No-reinvention: it only routes and ranks.
 
 **Resident guards (do not defer these to the detail file)**: **nothing is auto-fixed** — the list is the
 skill's job, the *go* is the human's; and **company residency (absolute)** — **raw company source, secrets,

package/knowledge/shared/harness-core/field_harness_diagnostic.md

@@ -23,6 +23,8 @@ is HITL — the diagnostic **proposes**, never auto-edits.
 | **Verdict/gate degrade** | `scripts/degrade_direction_scan.sh` | a field verdict/gate helper that degrades toward permissive (advisory pre-screen) |
 | **Loop-readiness** (황민호 loop-eng 5-question lens, 2026-07-10 — detail home: `loop_engineering.md`, incl. the FH loop inventory + design-time discipline) | *Loop-runtime axis — net-new vs Structure* (harness-doctor scans static form; this scans whether the path closes a loop). **Mechanical grep**: `/goal-quench`·`/loop` wiring present · check-class token declared. **Judged**: is the persisted state (card/handoff/memory) actually reloaded · is the declared check-class anchored, not judged-only · does the path halt. Done-When *presence* → see Structure row (no double-grep). **Adversarial pair** (for the judged sub-checks — decorrelated, behavior-vs-checklist): a target-tier blind sim that *runs* the path and observes whether it halts + persists, rather than re-checklisting it (the harness litmus shares this lens's axis, so it is a co-lens, not the adversary). | an agent path that *runs but doesn't loop*: no completion criterion (Done-When absent), judged-only validation with no anchor, no halt/budget guard (runaway/cost), or no state carried to the next run — the 5 questions (initiate · complete · validate · halt · persist) with 0 answers |
 
+| **Built-but-unwired scan** (2026-08-01, from the qasp full audit) | **Mechanical grep**: for each module/entry-point under the project's source root, count call/import sites outside its own file and tests — `grep -rn "module_name" --include="*.py" | grep -v "module_file\|tests/"` per module (adapt the include glob per language). 0 external callers on a *completed* module = a finding. **Judged**: is it staged-for-later (documented as such) or genuinely orphaned capability? | the dominant defect class of the 2026-08-01 qasp audit: most M/S prescriptions were not "build new" but **wire what exists** — ET·delivery·feasibility modules complete with ZERO callers. A harness that keeps building finished capability nobody invokes reads as progress while shipping none; harness-doctor's Structure lens sees orphaned *harness units*, this lens sees orphaned *product modules* (net-new axis) |
+
 > **Considered-and-held, 7th-lens candidate (2026-07-24)**: the context-quality 7-criteria rubric
 > (arXiv:2607.14275 — role clarity · guardrail coverage · instruction consistency · tool schema ·
 > grounding sufficiency · injection hardening · token efficiency) is **not** adopted as a lens: its

package/knowledge/shared/harness-core/gate_locality_principle.md

@@ -47,6 +47,25 @@ actually loads (e.g. `AGENTS.md` alone, no `CLAUDE.md`) and present a trap the g
 refuse; post-fix it refuses, citing the now-local gate. The behavioral delta *is* the proof of
 locality — review alone cannot show it (review reads all files; the runtime does not).
 
+## External anchors (independent evidence, added 2026-08-01)
+
+- **[arXiv 2607.25398 — "HANDBOOK.md: A Benchmark for Long-Context Agentic Instruction Following"](https://arxiv.org/abs/2607.25398)**
+  (Panavas et al.): 65 agentic tasks governed by expert-written SOPs of 20–124 pages, 824 programmatic
+  criteria; **the best of thirty evaluated model configurations passes 36.2% of trials, most frontier
+  configurations below 25%**. This anchors the *adjacent, stronger* claim this principle rests on:
+  even a prose gate the actor **does** load under-enforces at scale — placement is necessary but the
+  enforcement *modality* (hook/code vs prose) decides whether it fires. Cross-operator, cross-provider
+  evidence that a prose-only control layer is substantially under-enforced at scale — the salience-layer-over-
+  mechanical-floor split (CLAUDE.md 4-axis gate "Why hook", `[[feedback_vcs_layer_gate_enforcement]]`)
+  is independently reproduced, not FH-idiosyncratic.
+- **[arXiv 2607.08028 — "From Prompts to Contracts: Harness Engineering for Auditable Enterprise LLM Agents"](https://arxiv.org/abs/2607.08028)**
+  (Ahn · Kim): independent convergence on code-enforced behavioral contracts over prompt instructions;
+  their ablation shows code-owned enforcement blocks violations prompting alone permits. Cross-audit:
+  `tracks/_audit/session_2026_08_01_prompts-to-contracts-sister.md` (B-tier, 2 imports identified).
+
+These are external anchors for the **prose-vs-mechanical premise**; the locality claim itself
+(N=2, one operator) still awaits direct cross-operator confirmation as named above.
+
 ## Relationship to other FH assets
 
 - **steel-quench** carries this as a Wave-1 attack angle ("Gate-locality — is every safety gate

package/knowledge/shared/harness-core/multi_model_sidecar_strategy.md

@@ -149,6 +149,31 @@ human-review floor is structural, not a transitional patch. (Its Faros AI number
 the author's own caveat travels with any citation.)
 "Aggressive" Codex/Gemini use is bounded by the fit task-class above, never a blanket main-seat swap.
 
+### Decorrelation axes — model family AND authoring context (measured 2026-08-01)
+
+Decorrelation has been treated as one axis (model family). A codex-outage session measured a second,
+independent axis: **authoring-context share**. A 3-leg panel (agy/Gemini + local qwen3.6:35b + a
+**same-family Claude challenger in an isolated context**) ran 3 rounds over qasp changes; the
+distribution was sharp — the cheap local leg produced only refutable findings (2/2 source-rejected),
+the cross-family leg caught real HIGHs, and the **context-independent same-family leg caught the
+subtlest class** (a just-closed false-negative re-opened by an empty-canonical-key fall-through ·
+a fabricated expected value · a doc insertion truncating a bullet). Author-optimism largely falls
+away when the *context* is cut, even with the family held constant.
+
+Operational rules this adds:
+- A same-family isolated-context leg is a **legitimate decorrelation leg**, not a degraded
+  substitute — count it as one axis covered (context), with family still uncovered. The honest
+  disclosure when cross-family is unreachable is "family axis uncovered", not "no decorrelation".
+- The two axes compose: cross-family + context-independent is stronger than either alone. The
+  2026-08-01 follow-up run confirmed composition empirically — a GPT leg (OpenRouter, operator-directed
+  codex substitute) surfaced whole defect classes that both a Gemini leg and a context-independent
+  Claude leg had passed over (parser-bypass construction paths, duplicate-JSON-key ambiguity), while
+  the earlier legs had caught classes GPT did not re-find.
+- **Review-target pinning corollary** (accidental pattern, worth reproducing deliberately): pin the
+  review target to a COMMIT while fixes proceed uncommitted in parallel — two legs then cross-confirm
+  each other when their findings independently converge on the same defects, converting duplication
+  into validation instead of waste.
+
 ### Vendor-native harness — the main layer stays multi-CLI, never Copilot-consolidated
 
 The harness-depth thesis has a **per-vendor corollary**: a frontier model realizes its *highest effective

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -594,3 +594,17 @@
   outcome: accepted
   evidence: "Two findings, both closed. (1) The node check was unreachable on the fresh-machine case because it lived in a gitignored registration — drove the split into scripts/fh_node_check.sh + a tracked snippet. (2) The wizard wrote a literal '<your-store>' placeholder and reported success, leaving a dead hook — the real BE_DIR is now baked in at write time."
   note: "Sonnet tier was the right instrument here: both findings are about instructions being followed literally, which is exactly where a weaker tier diverges from an author's intent."
+- date: 2026-08-01
+  agent: fh-meta:challenger
+  task: "Axis-2 adversarial review of destructive_pre_gate.sh + lanes + snippet + gate_locality anchors"
+  mode: isolated Agent, fable-5, paired with cross-family agy sidecar (below)
+  outcome: accepted
+  evidence: "2 HIGH + 5 MED + 1 LOW, every finding probe-measured (not asserted). HIGH #1 (git -C bypass) explicitly tied to this environment's own trained command shape. Re-fetched both arXiv abstracts independently — figures double-sourced. One MED (#9) corrected the knowledge doc's rhetoric ('decorative'→'under-enforced'). Its noqa-self-grant observation was accepted as a design property, not a defect."
+  note: "The guard fired live on the challenger's own probe command mid-review — the mention-as-data FP class demonstrating itself inside the review that named it."
+- date: 2026-08-01
+  agent: agy sidecar (Gemini 3.1 Pro (High), display-name pinned)
+  task: "Cross-family review x3: destructive_pre_gate (R1), qasp verdict_computer (R1), qasp fixes (R2 convergence)"
+  mode: headless agy -p, prompt-inlined sources (public/dev-track content only)
+  outcome: accepted
+  evidence: "Guard R1: 7 bypass + 3 FP classes, JSON-contract violations 0; 3 findings overlapped challenger = independent convergence; 1 suggestion (start-anchoring) refuted with recorded reason, later PARTIALLY vindicated by live prose FPs — resolved with leading-separator class instead of command-position anchor. qasp R1: HIGH status-enum hole independently converged with governor read; core_override_flag requiredness grounded in contract §105 before acting. R2: 5/5 CLOSED, CONVERGED."
+  note: "codex unavailable (~8/6); agy carried the cross-family leg for both FH and qasp reviews, mirroring the 07-31 panel precedent."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.80",
+  "version": "1.4.82",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -137,6 +137,10 @@
     "scripts/test_sidecar_calibrate_lanes.sh",
     "scripts/pipe_verdict_guard.sh",
     "scripts/test_pipe_verdict_guard_lanes.sh",
+    "scripts/test_destructive_pre_gate_lanes.sh",
+    "scripts/destructive_pre_gate.sh",
+    "scripts/test_stale_clone_guard_lanes.sh",
+    "scripts/stale_clone_guard.sh",
     "templates/settings.PreToolUse.snippet.json",
     "scripts/halffix_propagation_scan.sh",
     "scripts/test_halffix_lanes.sh",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.80",
+  "version": "1.4.82",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.80",
+  "version": "1.4.82",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/scripts/destructive_pre_gate.sh

@@ -0,0 +1,191 @@
+#!/usr/bin/env bash
+# destructive_pre_gate.sh — PreToolUse(Bash) advisory: a destructive command about to run.
+#
+# THE DEFECT
+#   A session under ship pressure self-justifies a destructive git/rm command and runs it in the
+#   same breath ("contents are identical, so reset --hard is safe"). Observed 2026-08-01 on a
+#   below-floor sidecar (GLM 4-bit): self-justification THEN `git reset --hard origin/main` — the
+#   weaker the tier, the weaker the self-inhibition, so the counterweight must be mechanical, not
+#   prose. Origin prototype: pmh-dev scripts/destructive_pre_gate.sh (field→meta reverse
+#   propagation, hardened here to the pipe_verdict_guard pattern).
+#
+# ROLE DECONFLICTION (no double-gate)
+#   templates/.git-hooks/pre-push already HARD-BLOCKS the git-side irreversible surface at push
+#   time (force/non-ff push, remote branch delete — DESTRUCTIVE_OP_OK channel). This guard is the
+#   shift-left SALIENCE layer at the Bash-call surface, and its net-new coverage is the LOCAL
+#   destructive ops no hook currently sees: reset --hard, clean -f, checkout ., stash drop/clear,
+#   rm -rf on root/home/cwd. For force-push it fires earlier than pre-push but never replaces it.
+#
+# DEGRADE DIRECTION: advisory. Warns and exits 0 — a false block on a developer's shell trains
+#   the --no-verify reflex on the hooks that DO guard irreversible surfaces. Set
+#   FH_DESTRUCTIVE_BLOCK=1 to escalate to exit 2 (stderr → model, call blocked).
+#   Unparseable/absent payload → silent exit 0 (an unparsed input is not a finding; block mode
+#   fails open on a dead python3 — same accepted residual as pipe_verdict_guard, the surface is
+#   the reversible Bash call, not the irreversible act itself).
+#
+# PRECISION OVER RECALL (named residuals, deliberate — the full list, per the Axis-2 pass 2026-08-01)
+#   NOT flagged, by decision or by construction:
+#   - `rm -rf <absolute path>` other than /, ~, . — scratchpad/build cleanup lives there and 100%
+#     FP trains dismissal of the one hit that matters (pipe_verdict S5 lesson).
+#   - `git rebase` — reflog-recoverable, and interactive rebase is unsupported here anyway.
+#   - Env-var / eval indirection (`rm -rf $HOME`, `OPT=--hard; git reset $OPT`), `find -delete`,
+#     `xargs rm -rf`, shell aliases — unreachable by a regex over the literal command by
+#     construction; a parser would be over-build for an advisory layer. Registered, not closed.
+#   - Mention-as-data FP: heredoc bodies, `echo "git reset --hard"`, `git log -S '…'` DO fire —
+#     the flatten step cannot tell code from quoted data (measured live: the guard fired on the
+#     Axis-2 reviewer's own probe command). Advisory-tolerated; use `# noqa: destructive-op` when
+#     editing/documenting this guard itself.
+#   - Two JSON-emitting hooks on one matcher (this + pipe_verdict_guard): per the hook docs each
+#     hook's stdout is parsed independently; simultaneous-fire not runtime-verified (LOW).
+#   - noqa smuggling: the opt-out is checked against the WHOLE command, so a multi-statement
+#     payload with a destructive line 1 and a `# noqa: destructive-op` on line 2 exempts both.
+#     Accepted: noqa is self-grantable by design on this advisory surface (same trust channel as
+#     the DESTRUCTIVE_OP_OK env ack) — the hard floor for the irreversible half stays pre-push.
+#   - Shell-escape reconstruction (`\g\i\t reset --hard`, `$'git' reset`) and quoted-space git -C
+#     paths (`git -C "/tmp/my repo" reset --hard`) — regex-with-normalization cannot dequote like
+#     a shell; a Bash-compatible tokenizer would be over-build for an advisory layer (GPT-round,
+#     registered). Deliberate-obfuscation is outside this guard's threat model anyway: it counters
+#     SELF-JUSTIFICATION, not adversarial evasion.
+#   - Block mode (FH_DESTRUCTIVE_BLOCK=1) is an ESCALATED ADVISORY, not an enforcement boundary:
+#     malformed payload / dead python3 / grep processing failure all fail open by the documented
+#     degrade direction (reversible surface). A project needing a hard floor on these ops wires a
+#     PreToolUse permission rule or server-side protection, not this guard (GPT-round, pinned by
+#     the fault-injection lanes).
+#
+# DELIVERY CHANNEL: advisory emits JSON on stdout — hookSpecificOutput.additionalContext (model)
+#   + systemMessage (user). permissionDecision DELIBERATELY ABSENT: the guard must never
+#   auto-approve what it exists to question (PR#217 contract, memory
+#   feedback_advisory_invisible_to_actor).
+#
+# Usage:
+#   hook:  PreToolUse matcher "Bash" → bash scripts/destructive_pre_gate.sh
+#   test:  printf '%s' "<command>" | bash scripts/destructive_pre_gate.sh --stdin-raw
+# Opt out on a single command with a trailing `# noqa: destructive-op`.
+
+set -u
+
+CMD=""
+if [ "${1:-}" = "--stdin-raw" ]; then
+  CMD=$(cat)
+else
+  RAW=$(cat)
+  CMD=$(printf '%s' "$RAW" | python3 -c '
+import json,sys
+try: d = json.load(sys.stdin)
+except Exception: sys.exit(0)
+if d.get("tool_name") != "Bash": sys.exit(0)
+sys.stdout.write(d.get("tool_input", {}).get("command", "") or "")
+' 2>/dev/null) || CMD=""
+fi
+[ -n "$CMD" ] || exit 0
+
+# Explicit opt-out, checked before any rule.
+printf '%s' "$CMD" | LC_ALL=C grep -qE '#[[:space:]]*noqa:?[[:space:]]*destructive-op' && exit 0
+
+# Flatten to ONE line (grep is line-oriented; multi-line commands are the recurring shape) and pad
+# with spaces so end-of-string flags match uniformly (` -f` at line end == ` -f `).
+# Normalizations, each closing a measured bypass (cross-family Axis-2 pass, 2026-08-01):
+#   backslash-newline joined  → `rm -rf \` + newline + `/` no longer splits the statement (A1)
+#   \r stripped               → CRLF payloads no longer break the `[ ;]` terminators (A10)
+#   quotes stripped           → `rm -rf "/"` matches like its unquoted twin (A3; mention-as-data
+#                               FP surface unchanged — that class fires with or without quotes)
+#   tabs → spaces, squeezed   → `git  reset --hard` (double space) matches (A2)
+# Anchoring: rows require a leading separator `[ (/]` before the command word (NOT command-position
+# anchoring — sudo/env/xargs wrappers keep a space before the word and stay caught). This closes the
+# measured prose FP where "Confi**rm** each … -toward-PASS … *" satisfied the rm row through a word
+# TAIL (fired live twice on this guard's own review commands, 2026-08-01). Full command-position
+# anchoring stays REJECTED (would drop sudo/env wrappers); `/` in the class keeps `/bin/rm` caught.
+# GPT-round (R4) semantics fixes, each lane-pinned:
+#   backslash-newline joins with EMPTY string, matching shell semantics — a space here let
+#   `git re\` + newline + `set --hard` split the token and miss (measured bypass).
+#   Separators `&& || | & ( )` are space-padded so `:&&git reset --hard` and `--force|cat`
+#   satisfy the leading/trailing boundary classes without whitespace in the original.
+JOINED="${CMD//\\$'\n'/}"
+FLAT=" $(printf '%s' "$JOINED" | tr -d '\r' | tr '\n' ';' | sed 's/;/; /g' \
+  | sed -E 's/(\&\&|\|\||[|&()])/ \1 /g' | tr -d '"'"'" | tr '\t' ' ' | tr -s ' ') "
+
+# Normalize git global options down to bare `git` BEFORE matching — the Axis-2 pass measured
+# `git -C /repo reset --hard` sailing through every git row, and this environment specifically
+# TRAINS that shape ("cwd resets between calls, use absolute paths / git -C"), so the origin
+# defect (a self-justifying model) would most naturally emit exactly it. GPT-round extended the
+# consumed set: --no-pager, -c k=v, -p/-P, and the space-separated --git-dir/--work-tree forms.
+FLAT=$(printf '%s' "$FLAT" | sed -E 's/git( +(-C +[^ ;]+|--git-dir[= ][^ ;]+|--work-tree[= ][^ ;]+|-c +[^ ;]+|--no-pager|-[pP]))+/git/g')
+
+# Dry-run neutralizer: `git clean -fdn` / `--dry-run` is non-destructive; rewrite it to a token no
+# row matches, so the clean row cannot FP on a dry run (Axis-2 #6 — an FP here violates the very
+# S5 lesson the header cites). GPT-round scoping: only OPTION tokens may sit between `clean` and
+# the dry-run flag — a nested `"$(echo -n build)"` or a post-`--` pathspec `-n` no longer
+# neutralizes a real deletion (`--` itself is not matched by the option-token group, so
+# consumption stops there by construction).
+FLAT=$(printf '%s' "$FLAT" | sed -E 's/git clean( +--?[a-zA-Z][a-zA-Z=-]*)* +(-[a-zA-Z]*n[a-zA-Z]*|--dry-run)( +--?[a-zA-Z][a-zA-Z=-]*)*/git clean DRYRUN/g')
+
+# cwd-glob canonicalization: `././*` and friends collapse to `./*` so the rm row's target
+# alternation sees the canonical spelling (GPT-round; brace-expansion globs stay a residual).
+FLAT=$(printf '%s' "$FLAT" | sed -E 's/(\.\/)+/.\//g')
+
+# ── Destructive pattern table: regex@@description ─────────────────────────────────────────────
+# Delimiter is @@ because the regexes themselves carry `|` (alternation) — a `|` delimiter
+# truncated every alternation-bearing pattern at split time (caught by the known-pair lanes on
+# first run, 2026-08-01: 25/46 lanes failed with "brackets not balanced" before any live use).
+# Matched with grep -E against the padded FLAT. Keep each pattern precise; add a lane pair in
+# scripts/test_destructive_pre_gate_lanes.sh for every row you add (known-pair rule).
+# GPT-round (R4) token-boundary discipline: every destructive OPTION must start its own token
+# (preceded by a space) — `docs--hard`, `release--force`, `--exclude=cache`'s x, and
+# `rm --verbose`'s r no longer satisfy rows through substrings of unrelated tokens. Long-form
+# spellings the boundary would orphan are added explicitly (--force for clean, --recursive for
+# rm, --force-with-lease=<ref>, worktree -f, restore -W).
+PATTERNS=(
+  '[ (/]git reset ([^|;&]* )?--hard[ ;]@@git reset --hard discards ALL uncommitted changes irreversibly'
+  '[ (/]git clean ([^|;&]* )?(--force[ ;]|-[a-zA-Z]*[fxX][a-zA-Z]*[ ;])@@git clean -f/-x permanently deletes untracked files'
+  '[ (/]git checkout ([^|;&]*-- )?\.\/? @@git checkout . reverts every local modification'
+  '[ (/]git restore ([^|;&]* )?(--worktree|-[a-zA-Z]*W[a-zA-Z]*[ ;])@@git restore --worktree reverts working-tree changes'
+  '[ (/]git restore \.\/? @@git restore . reverts every local modification'
+  '[ (/]git push ([^|;&]* )?(--force(-with-lease(=[^ ;]+)?)?[ ;]|-[a-zA-Z]*f[a-zA-Z]*[ ;]|\+[^ ;]+[ ;])@@force push rewrites remote history (pre-push hook will also gate this — enumerate first)'
+  '[ (/]git branch ([^|;&]* )?(-[a-zA-Z]*D[ ;]|--delete( [^|;&]*)? --force[ ;]|--force( [^|;&]*)? --delete[ ;])@@git branch -D force-deletes a branch without merge check'
+  '[ (/]git stash (drop|clear)[ ;]@@git stash drop/clear permanently discards stashed work'
+  '[ (/]git worktree remove ([^|;&]* )?(--force[ ;]|-[a-zA-Z]*f[a-zA-Z]*[ ;])@@git worktree remove --force discards a dirty worktree'
+  '[ (/]rm ([^|;&]* )?(--recursive|-[a-zA-Z]*[rR][a-zA-Z]*)[^|;&]* (/\*?|~/?|\.\/?\*?|\*)[ ;]@@rm -rf on root/home/cwd/glob deletes irreplaceably'
+  '[ (/]rm ([^|;&]* )?--no-preserve-root@@rm --no-preserve-root is never routine'
+)
+
+hits=""
+for entry in "${PATTERNS[@]}"; do
+  pattern="${entry%%@@*}"
+  desc="${entry#*@@}"
+  # LC_ALL=C: an inherited locale must never change what an ASCII pattern matches (the collation
+  # class killed a sibling probe silently — card-drift 2026-07-31; patterns here are ASCII-only).
+  if printf '%s' "$FLAT" | LC_ALL=C grep -qE "$pattern"; then
+    hits="${hits}  ⚠️  DESTRUCTIVE-OP ${desc}
+"
+  fi
+done
+[ -n "$hits" ] || exit 0
+
+hits="${hits}      Before running: is uncommitted/stashed state enumerated (git status / predelete_check.sh)?
+      Destructive-Op Gate order: enumerate → recover → destroy — never destroy-then-check.
+      Intentional and reviewed → re-run with trailing \`# noqa: destructive-op\`."
+
+if [ "${FH_DESTRUCTIVE_BLOCK:-0}" = "1" ]; then
+  # Block mode: exit 2 = stderr fed to the model as the blocking reason; stdout ignored by contract.
+  printf '%s\n' "$hits" >&2
+  printf '%s\n' "      [BLOCKED] FH_DESTRUCTIVE_BLOCK=1 — unset or add noqa after review to proceed." >&2
+  exit 2
+fi
+
+# Advisory mode: JSON on stdout, exit 0. Capture-then-emit; PYTHONIOENCODING pinned because the
+# text carries non-ASCII (⚠️) and an inherited ascii codec was measured to kill the emission
+# (pipe_verdict_guard lane C4). python3 owns escaping; on failure degrade to stderr (delivery
+# lost, call undisturbed).
+if json_out=$(printf '%s' "$hits" | PYTHONIOENCODING=utf-8 python3 -c '
+import json, sys
+h = sys.stdin.read()
+print(json.dumps({
+    "systemMessage": h,
+    "hookSpecificOutput": {"hookEventName": "PreToolUse", "additionalContext": h},
+}))
+' 2>/dev/null) && [ -n "$json_out" ]; then
+  printf '%s\n' "$json_out"
+  exit 0
+fi
+printf '%s' "$hits" >&2
+exit 0

package/scripts/pipe_verdict_guard.sh

@@ -29,6 +29,26 @@
 #   reflexes on hooks that DO guard irreversible surfaces. Set FH_PIPE_VERDICT_BLOCK=1 to escalate.
 #   If the command cannot be extracted, it stays silent: an unparsed input is not a finding.
 #
+# DELIVERY CHANNEL (added 2026-07-31 — closes N=8: detection 100%, delivery 0%)
+#   The first shipped version wrote its warning to stderr and exited 0. Per the hook contract
+#   (code.claude.com/docs/en/hooks), on exit 0 stderr is IGNORED and stdout is parsed for JSON —
+#   so the warning reached the transcript, never the model. The actor making the mistake never saw
+#   the guard fire (measured: the guard's own author repeated the guarded mistake twice the day
+#   after shipping it, N=7/N=8).
+#   Advisory now emits JSON on stdout: `hookSpecificOutput.additionalContext` (wrapped by CC in a
+#   system-reminder and injected into MODEL context) + top-level `systemMessage` (shown to the
+#   USER). Two audiences, two fields, one emission.
+#   ⚠️ `permissionDecision` is DELIBERATELY ABSENT: emitting "allow" alongside the warning would
+#   auto-approve the flagged command past the permission system — the guard must never grant what
+#   it exists to question. Block mode keeps the exit-2 path (stderr → fed to Claude, call blocked);
+#   on exit 2 stdout/JSON is ignored by contract, so stderr is the correct channel there.
+#   NAMED RESIDUAL (cross-family, 2026-07-31): with python3 broken/absent, payload extraction
+#   yields CMD="" and the guard exits 0 even under FH_PIPE_VERDICT_BLOCK=1 — block mode fails
+#   open on a dead interpreter. Accepted, not fixed: the Bash-call surface is re-runnable
+#   (reversible → degrade-to-advisory per the Surface-Class Degrade Invariant), and the
+#   alternative — exit 2 whenever python3 is missing — would block EVERY Bash call on such a
+#   machine, the exact false-block storm the advisory design exists to avoid.
+#
 # Usage:
 #   hook:  PreToolUse matcher "Bash" → bash scripts/pipe_verdict_guard.sh
 #   test:  printf '%s' "<command>" | bash scripts/pipe_verdict_guard.sh --stdin-raw
@@ -88,6 +108,32 @@ fi
 
 [ -n "$hits" ] || exit 0
 
+if [ "${FH_PIPE_VERDICT_BLOCK:-0}" = "1" ]; then
+  # Block mode: exit 2 = stderr fed to the model as the blocking reason; stdout ignored by contract.
+  printf '%s' "$hits" >&2
+  exit 2
+fi
+
+# Advisory mode: JSON on stdout, exit 0. additionalContext → model, systemMessage → user.
+# NO permissionDecision — see DELIVERY CHANNEL header. python3 owns the JSON escaping; if it
+# fails, degrade to the old stderr emission (delivery lost, but the call is never disturbed).
+# Capture-then-emit, not stream: a producer that prints partial output and dies must never leave
+# half a JSON object on the hook's stdout (cross-family finding, 2026-07-31). The codec pin must
+# be PYTHONIOENCODING itself — the hits text carries non-ASCII (⚠️), an inherited
+# PYTHONIOENCODING=ascii was measured to kill the emission (silently restoring the exact delivery
+# loss this rewrite closes), and PYTHONUTF8=1 does NOT win over an explicit PYTHONIOENCODING
+# (measured by lane C4: the UTF8-mode pin still emitted 0 bytes under the ascii env).
+json_out=$(printf '%s' "$hits" | PYTHONIOENCODING=utf-8 python3 -c '
+import json, sys
+h = sys.stdin.read()
+print(json.dumps({
+    "systemMessage": h,
+    "hookSpecificOutput": {"hookEventName": "PreToolUse", "additionalContext": h},
+}))
+' 2>/dev/null)
+if [ -n "$json_out" ]; then
+  printf '%s\n' "$json_out"
+  exit 0
+fi
 printf '%s' "$hits" >&2
-if [ "${FH_PIPE_VERDICT_BLOCK:-0}" = "1" ]; then exit 2; fi
 exit 0

package/scripts/stale_clone_guard.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# stale_clone_guard.sh — PreToolUse(Write) advisory: building on a stale clone.
+#
+# THE DEFECT (fh_signal_2026-07-31_qasp-wiring)
+#   found→extend is wired at the artifact/wiki level (R1-b), but nothing measures the LOCAL CLONE's
+#   freshness before a build starts. Measured 2026-07-31: a session built an act2 router on a qasp
+#   clone that was 46+ PRs behind origin — the tie-break lane it built already existed upstream, so
+#   it manufactured a partial duplicate. The session-start load refreshes only the hub's own
+#   companion store — mapped project clones are nobody's job, hence this guard.
+#
+# DESIGN
+#   Trigger = Write (file creation — the mechanical proxy for "build work entry"), NOT session
+#   start: fetching every mapped repo at session start is over-cost; the signal names work-entry
+#   as the correct trigger. Throttle: once per repo per day (marker in TMPDIR) — the freshness
+#   question is answered once, not per file.
+#   Advisory contract identical to pipe_verdict_guard/destructive_pre_gate: stdout JSON
+#   additionalContext (model) + systemMessage (user), NO permissionDecision, exit 0 always.
+#   A guard about freshness must never block writing — it surfaces `behind N`, the session decides
+#   (fetch may legitimately be skipped mid-hotfix).
+#
+# DEGRADE DIRECTION: fail-open everywhere — non-repo path, no upstream, fetch failure/timeout,
+#   dead python3, detached HEAD: all silent exit 0. A freshness advisory that blocks or errors
+#   trains hook resentment; the irreversible surfaces have their own gates.
+#
+# Test hooks (lanes): FH_STALE_CLONE_NO_FETCH=1 skips the network fetch (fixture repos already
+#   carry their remote state); FH_STALE_CLONE_MARKER_DIR overrides the throttle dir.
+#
+# NAMED RESIDUALS (GPT pass 2026-08-01 — registered, not fixed; advisory proportionality):
+#   day-scale throttle means an upstream advance AFTER the day's check goes unseen until tomorrow
+#   (the incident class is day-scale, deliberate cost trade) · fork-canonical baseline (current
+#   with origin/feature yet behind upstream/main) unmeasured — @{u} is the baseline · no-upstream /
+#   detached HEAD silent · prune-free fetch can report a deleted upstream · nested-repo/submodule
+#   ownership ambiguity on missing path levels · concurrent-Write double-fetch (duplicate advisory,
+#   harmless) · CRC marker-key collision · dead python3 → inert (consistent with sibling guards).
+
+set -u
+
+RAW=$(cat)
+FILE=$(printf '%s' "$RAW" | python3 -c '
+import json,sys
+try: d = json.load(sys.stdin)
+except Exception: sys.exit(0)
+if d.get("tool_name") != "Write": sys.exit(0)
+sys.stdout.write(d.get("tool_input", {}).get("file_path", "") or "")
+' 2>/dev/null) || FILE=""
+[ -n "$FILE" ] || exit 0
+
+# Creation-only scope (GPT pass): "build entry" means a NEW file — overwrites of existing files
+# (generated output, doc touch-ups, conflict repair) neither fetch nor warn.
+[ -e "$FILE" ] && exit 0
+
+# Walk up to the nearest EXISTING ancestor — a Write may create several missing levels at once.
+DIR=$(dirname "$FILE")
+while [ ! -d "$DIR" ] && [ "$DIR" != "/" ] && [ -n "$DIR" ]; do
+  DIR=$(dirname "$DIR")
+done
+[ -d "$DIR" ] || exit 0
+ROOT=$(git -C "$DIR" rev-parse --show-toplevel 2>/dev/null) || exit 0
+
+# Throttle: one SUCCESSFUL check per repo per day. The marker is written only after a completed
+# comparison (GPT pass: an attempt-marker turned every early-exit into a day-long silence).
+# Default marker home is TMPDIR (user-private 0700 on macOS); the explicit subdir is created 0700
+# so a /tmp fallback is not other-user-writable.
+umask 077
+MARKER_DIR="${FH_STALE_CLONE_MARKER_DIR:-${TMPDIR:-/tmp}/fh-stale-clone}"
+mkdir -p "$MARKER_DIR" 2>/dev/null || exit 0
+MARKER="$MARKER_DIR/$(printf '%s' "$ROOT" | cksum | cut -d' ' -f1)-$(date +%Y%m%d)"
+[ -e "$MARKER" ] && exit 0
+
+UPSTREAM=$(git -C "$ROOT" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null) || exit 0
+REMOTE="${UPSTREAM%%/*}"   # fetch the remote @{u} actually tracks, not a hardcoded origin (GPT pass)
+[ -n "$REMOTE" ] || exit 0
+
+if [ "${FH_STALE_CLONE_NO_FETCH:-0}" != "1" ]; then
+  # Bounded fetch: GIT_TERMINAL_PROMPT=0 kills the credential-prompt hang class; the hook-level
+  # timeout is the hard bound for wedged transports (macOS ships no GNU timeout).
+  GIT_TERMINAL_PROMPT=0 git -C "$ROOT" fetch -q "$REMOTE" 2>/dev/null || exit 0
+fi
+
+BEHIND=$(git -C "$ROOT" rev-list --count 'HEAD..@{u}' 2>/dev/null) || exit 0
+case "$BEHIND" in ''|*[!0-9]*) exit 0 ;; esac
+: > "$MARKER" 2>/dev/null || true   # comparison completed — only now does the day-throttle arm
+[ "$BEHIND" -gt 0 ] || exit 0
+
+MSG="  ⚠️  STALE-CLONE $ROOT is behind $UPSTREAM by $BEHIND commit(s).
+      Building on a stale clone manufactures duplicates of work that already exists upstream
+      (measured: a 46-PR-behind clone rebuilt an existing lane, 2026-07-31).
+      Before creating new files here: git -C $ROOT pull --ff-only  (or rebase your branch).
+      found→extend applies at repo level too — check what upstream already has."
+
+if json_out=$(printf '%s' "$MSG" | PYTHONIOENCODING=utf-8 python3 -c '
+import json, sys
+h = sys.stdin.read()
+print(json.dumps({
+    "systemMessage": h,
+    "hookSpecificOutput": {"hookEventName": "PreToolUse", "additionalContext": h},
+}))
+' 2>/dev/null) && [ -n "$json_out" ]; then
+  printf '%s\n' "$json_out"
+  exit 0
+fi
+printf '%s\n' "$MSG" >&2
+exit 0

package/scripts/test_destructive_pre_gate_lanes.sh

@@ -0,0 +1,226 @@
+#!/usr/bin/env bash
+# test_destructive_pre_gate_lanes.sh — known pairs for scripts/destructive_pre_gate.sh
+#
+# LANES FIRST (2026-07-30 harvest #1): write the lane before touching the detector — rounds that
+# did had zero fix-reverts-fix regressions. Every PATTERNS row in the guard owes a HIT lane and at
+# least one adjacent CLEAN lane (the known-pair rule: an instrument that cannot separate a case you
+# already know the answer to is not measuring, it is generating).
+#
+# WHAT IS BEING GUARDED
+#   A destructive command self-justified and executed in one breath (origin: GLM 4-bit sidecar ran
+#   `git reset --hard origin/main` after declaring it "safe", 2026-08-01, pmh-dev prototype).
+#   Advisory by default; FH_DESTRUCTIVE_BLOCK=1 escalates. The FP lanes matter as much as the HIT
+#   lanes: noise trains dismissal of the one warning that will matter (pipe_verdict S5 lesson).
+
+set -u
+G="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/destructive_pre_gate.sh"
+pass=0; fail=0
+
+# expect <label> <expected: HIT|CLEAN> <command-string>
+expect() {
+  local label="$1" want="$2" cmd="$3" out got
+  out=$(printf '%s' "$cmd" | bash "$G" --stdin-raw 2>&1)
+  if printf '%s' "$out" | grep -q 'DESTRUCTIVE-OP'; then got=HIT; else got=CLEAN; fi
+  if [ "$got" = "$want" ]; then
+    printf '  ✅ %-52s %s (expected %s)\n' "$label" "$got" "$want"; pass=$((pass+1))
+  else
+    printf '  ❌ %-52s %s (expected %s)\n' "$label" "$got" "$want"; fail=$((fail+1))
+    printf '     cmd: %s\n     out: %s\n' "$cmd" "$out"
+  fi
+}
+
+echo "[destructive-pre-gate] known pairs"
+echo "-- git working-tree destroyers --"
+expect "reset --hard (the measured origin shape)"  HIT   'git reset --hard origin/main'
+expect "reset --hard bare"                         HIT   'git reset --hard'
+expect "reset --soft is CLEAN"                     CLEAN 'git reset --soft HEAD~1'
+expect "reset (mixed, default) is CLEAN"           CLEAN 'git reset HEAD~1'
+expect "clean -fd"                                 HIT   'git clean -fd'
+expect "clean -fdx"                                HIT   'git clean -fdx'
+expect "clean -n dry-run is CLEAN"                 CLEAN 'git clean -nd'
+expect "checkout ."                                HIT   'git checkout .'
+expect "checkout -- ."                             HIT   'git checkout -- .'
+expect "checkout .gitignore is CLEAN"              CLEAN 'git checkout .gitignore'
+expect "checkout branch is CLEAN"                  CLEAN 'git checkout feature/x'
+expect "restore --worktree"                        HIT   'git restore --staged --worktree src/'
+expect "restore ."                                 HIT   'git restore .'
+expect "restore single file is CLEAN"              CLEAN 'git restore src/app.py'
+
+echo "-- history / remote / branch destroyers --"
+expect "push --force"                              HIT   'git push --force origin main'
+expect "push -f trailing (prototype [^i] missed)"  HIT   'git push origin main -f'
+expect "push --force-with-lease still flagged"     HIT   'git push --force-with-lease'
+expect "plain push is CLEAN"                       CLEAN 'git push origin feature/x'
+expect "push -u is CLEAN"                          CLEAN 'git push -u origin feature/x'
+expect "branch -D"                                 HIT   'git branch -D old-branch'
+expect "branch -d (merge-checked) is CLEAN"        CLEAN 'git branch -d merged-branch'
+expect "stash drop"                                HIT   'git stash drop'
+expect "stash clear"                               HIT   'git stash clear'
+expect "stash pop is CLEAN"                        CLEAN 'git stash pop'
+expect "worktree remove --force"                   HIT   'git worktree remove --force ../wt'
+expect "worktree remove plain is CLEAN"            CLEAN 'git worktree remove ../wt'
+
+echo "-- rm scope (precision over recall: only root/home/cwd/glob) --"
+expect "rm -rf /"                                  HIT   'rm -rf /'
+expect "rm -rf ~"                                  HIT   'rm -rf ~'
+expect "rm -rf ."                                  HIT   'rm -rf .'
+expect "rm -rf ./"                                 HIT   'rm -rf ./'
+expect "rm -rf *"                                  HIT   'rm -rf *'
+expect "rm -fr / (flag order)"                     HIT   'rm -fr /'
+expect "rm --no-preserve-root"                     HIT   'rm -rf --no-preserve-root /tmp/x'
+expect "rm -rf scratch path is CLEAN (residual)"   CLEAN 'rm -rf /tmp/scratch/build'
+expect "rm -rf named dir is CLEAN"                 CLEAN 'rm -rf node_modules'
+expect "rm single file is CLEAN"                   CLEAN 'rm -f out.log'
+
+echo "-- adversarial shapes --"
+expect "multi-line command still caught"           HIT   'cd /repo
+git reset --hard origin/main'
+expect "compound command still caught"             HIT   'git fetch origin && git reset --hard origin/main'
+expect "multi-line legit stays CLEAN"              CLEAN 'cd /repo
+git status
+git log --oneline -5'
+expect "reset --hard with pathspec"                HIT   'git reset --keep x; git reset --hard HEAD~2'
+
+echo "-- Axis-2 round 2: cross-family + challenger bypass shapes (2026-08-01) --"
+expect "git -C reset --hard (trained shape)"       HIT   'git -C /repo reset --hard origin/main'
+expect "git -C clean -fd"                          HIT   'git -C /repo clean -fd'
+expect "git --git-dir reset --hard"                HIT   'git --git-dir=/r/.git reset --hard'
+expect "git -C on safe subcommand is CLEAN"        CLEAN 'git -C /repo status'
+expect "checkout HEAD -- ."                        HIT   'git checkout HEAD -- .'
+expect "checkout ./"                               HIT   'git checkout ./'
+expect "branch --delete --force"                   HIT   'git branch --delete --force old'
+expect "rm -rf /* (root glob)"                     HIT   'rm -rf /*'
+expect "rm -rf ./* (cwd glob)"                     HIT   'rm -rf ./*'
+expect "rm -Rf / (uppercase R)"                    HIT   'rm -Rf /'
+expect "rm -r -f / (split flags)"                  HIT   'rm -r -f /'
+expect "rm -rf quoted root"                        HIT   'rm -rf "/"'
+expect "double space between tokens"               HIT   'git  reset  --hard'
+expect "backslash line continuation"               HIT   $'rm -rf \\\n/'
+expect "CRLF payload"                              HIT   $'rm -rf /\r'
+expect "push +refspec force"                       HIT   'git push origin +main'
+expect "push-option with + is CLEAN"               CLEAN 'git push origin main --push-option=a+b'
+expect "clean -fdn dry-run is CLEAN"               CLEAN 'git clean -fdn'
+expect "clean -n -fdx dry-run is CLEAN"            CLEAN 'git clean -n -fdx'
+expect "stash dropstash substring is CLEAN"        CLEAN 'git stash dropstash'
+expect "stash drop with ref still HIT"             HIT   'git stash drop stash@{1}'
+# Named residuals pinned as lanes so a future "fix" that silently changes them is visible:
+expect "residual: rm -rf \$HOME stays CLEAN"       CLEAN 'rm -rf $HOME'
+expect "residual: find -delete stays CLEAN"        CLEAN 'find . -delete'
+expect "residual: mention-as-data DOES fire"       HIT   'echo "git reset --hard is dangerous"'
+expect "residual: sudo wrapper still caught"       HIT   'sudo rm -rf /'
+expect "path-prefix /bin/rm still caught"          HIT   '/bin/rm -rf /'
+expect "subshell (git reset --hard) caught"        HIT   'out=$(git reset --hard 2>&1)'
+# Round 3 (measured live 2x): English prose satisfied the rm row via the word TAIL of
+# "Confirm" + a dash-word carrying r + a stray glob — leading-separator class kills it.
+expect "prose word-tail rm FP stays CLEAN"         CLEAN 'echo Round 2 verification. Confirm each prior finding is closed WITHOUT introducing a new default-toward-PASS hole (attack) * done'
+expect "legit reset word-tail stays CLEAN"         CLEAN 'echo the legit reset --hard flag docs'
+
+echo "-- Round 4: GPT-family (gpt-5.6-sol via OpenRouter) decorrelation shapes (2026-08-01) --"
+expect "token-split continuation gi\\ t"           HIT   $'git re\\\nset --hard'
+expect ":&&git no-whitespace separator"            HIT   ':&&git reset --hard'
+expect "false||git separator"                      HIT   'false||git reset --hard'
+expect "trailing |cat after --force"               HIT   'git push --force|cat'
+expect "(rm -rf ~) closing paren"                  HIT   '(rm -rf ~)'
+expect "git --no-pager global opt"                 HIT   'git --no-pager reset --hard'
+expect "git -c k=v global opt"                     HIT   'git -c core.a=b reset --hard'
+expect "git --git-dir space form"                  HIT   'git --git-dir /r/.git reset --hard'
+expect "nested \$(echo -n) not a dry-run"          HIT   'git clean -fd "$(echo -n build)"'
+expect "post-'--' -n pathspec not a dry-run"       HIT   'git clean -fd -- -n'
+expect "--force-with-lease=<ref>"                  HIT   'git push --force-with-lease=main'
+expect "push -fu bundle"                           HIT   'git push -fu origin main'
+expect "worktree remove -f short"                  HIT   'git worktree remove -f ../wt'
+expect "restore -W short"                          HIT   'git restore -W src/'
+expect "rm -rf ././* canonicalized"                HIT   'rm -rf ././*'
+expect "rm --recursive long form"                  HIT   'rm --recursive --force /'
+expect "FP: docs--hard operand stays CLEAN"        CLEAN 'git reset HEAD -- docs--hard'
+expect "FP: clean --exclude=cache stays CLEAN"     CLEAN 'git clean --exclude=cache build/'
+expect "FP: branch name release--force CLEAN"      CLEAN 'git branch --delete release--force'
+expect "FP: rm --verbose / stays CLEAN"            CLEAN 'rm --verbose /'
+expect "FP: push --follow-tags stays CLEAN"        CLEAN 'git push --follow-tags'
+expect "dry-run with long opt before -n CLEAN"     CLEAN 'git clean --quiet -n -fd'
+
+echo "-- Round 4: fault-injection (pins the DOCUMENTED degrade, not a safety claim) --"
+c_out=$(printf '%s' 'not json at all' | bash "$G" 2>/dev/null); c_rc=$?
+if [ "$c_rc" -eq 0 ] && [ -z "$c_out" ]; then
+  printf '  ✅ %-52s %s\n' "F1 malformed payload: silent exit 0 (advisory)" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s\n' "F1 malformed payload: silent exit 0 (advisory)" "$c_rc" "$c_out"; fail=$((fail+1))
+fi
+c_out=$(printf '%s' 'not json at all' | FH_DESTRUCTIVE_BLOCK=1 bash "$G" 2>/dev/null); c_rc=$?
+if [ "$c_rc" -eq 0 ] && [ -z "$c_out" ]; then
+  printf '  ✅ %-52s %s\n' "F2 block+malformed: fails OPEN (documented residual)" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s\n' "F2 block+malformed: fails OPEN (documented residual)" "$c_rc" "$c_out"; fail=$((fail+1))
+fi
+
+echo "-- opt-out --"
+expect "noqa suppresses"                           CLEAN 'git reset --hard origin/main  # noqa: destructive-op'
+
+echo "-- C: delivery channel (advisory must reach the model, not a discarded stream) --"
+HIT_CMD='git reset --hard origin/main'
+payload() { python3 -c 'import json,sys; print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]}}))' "$1"; }
+c_errf=$(mktemp)
+
+# C1 — advisory hit via full hook payload: stdout = one JSON object, additionalContext +
+#      systemMessage present, permissionDecision ABSENT, exit 0.
+c_out=$(payload "$HIT_CMD" | bash "$G" 2>"$c_errf"); c_rc=$?
+c_err=$(cat "$c_errf")
+if [ "$c_rc" -eq 0 ] && printf '%s' "$c_out" | python3 -c '
+import json, sys
+d = json.load(sys.stdin)
+h = d["hookSpecificOutput"]
+assert h["hookEventName"] == "PreToolUse"
+assert "DESTRUCTIVE-OP" in h["additionalContext"]
+assert "DESTRUCTIVE-OP" in d["systemMessage"]
+assert "permissionDecision" not in h and "permissionDecision" not in d
+' 2>/dev/null; then
+  printf '  ✅ %-52s %s\n' "C1 advisory: stdout JSON, no permissionDecision" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s err=%s\n' "C1 advisory: stdout JSON, no permissionDecision" "$c_rc" "$c_out" "$c_err"; fail=$((fail+1))
+fi
+
+# C2 — block mode: exit 2, reason on stderr, stdout empty.
+c_out=$(payload "$HIT_CMD" | FH_DESTRUCTIVE_BLOCK=1 bash "$G" 2>"$c_errf"); c_rc=$?
+c_err=$(cat "$c_errf")
+if [ "$c_rc" -eq 2 ] && printf '%s' "$c_err" | grep -q 'DESTRUCTIVE-OP' && [ -z "$c_out" ]; then
+  printf '  ✅ %-52s %s\n' "C2 block: exit 2, stderr carries the reason" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s err=%s\n' "C2 block: exit 2, stderr carries the reason" "$c_rc" "$c_out" "$c_err"; fail=$((fail+1))
+fi
+
+# C3 — clean command: NO emission at all (silence must stay silent).
+c_out=$(payload 'git status' | bash "$G" 2>"$c_errf"); c_rc=$?
+rm -f "$c_errf"
+if [ "$c_rc" -eq 0 ] && [ -z "$c_out" ]; then
+  printf '  ✅ %-52s %s\n' "C3 clean: no emission at all" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s\n' "C3 clean: no emission at all" "$c_rc" "$c_out"; fail=$((fail+1))
+fi
+
+# C4 — hostile inherited codec (⚠️ is non-ASCII): JSON must still deliver under
+#      PYTHONIOENCODING=ascii thanks to the guard's own utf-8 pin.
+c_out=$(payload "$HIT_CMD" | PYTHONIOENCODING=ascii bash "$G" 2>/dev/null); c_rc=$?
+if [ "$c_rc" -eq 0 ] && printf '%s' "$c_out" | python3 -c '
+import json, sys
+d = json.load(sys.stdin)
+assert "DESTRUCTIVE-OP" in d["hookSpecificOutput"]["additionalContext"]
+' 2>/dev/null; then
+  printf '  ✅ %-52s %s\n' "C4 ascii-codec env: JSON still delivered" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s\n' "C4 ascii-codec env: JSON still delivered" "$c_rc" "$c_out"; fail=$((fail+1))
+fi
+
+# C5 — non-Bash tool payload: guard must stay silent (matcher is Bash, but defense in depth).
+c_out=$(python3 -c 'import json;print(json.dumps({"tool_name":"Read","tool_input":{"file_path":"git reset --hard"}}))' | bash "$G" 2>/dev/null); c_rc=$?
+if [ "$c_rc" -eq 0 ] && [ -z "$c_out" ]; then
+  printf '  ✅ %-52s %s\n' "C5 non-Bash payload: silent" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s\n' "C5 non-Bash payload: silent" "$c_rc" "$c_out"; fail=$((fail+1))
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then
+  echo "[destructive-pre-gate] ✅ all $pass known pairs hold"; exit 0
+else
+  echo "[destructive-pre-gate] ❌ $fail/$((pass+fail)) lanes failed"; exit 1
+fi

package/scripts/test_pipe_verdict_guard_lanes.sh

@@ -88,6 +88,73 @@ expect "B braced form still caught"       HIT   'a | b; rc=${PIPESTATUS[0]}'
 echo "-- opt-out --"
 expect "noqa suppresses"                  CLEAN 'bash g.sh | tail; rc=$?  # noqa: pipe-verdict'
 
+echo "-- C: delivery channel (closes N=8 — detection without delivery is decoration) --"
+# These lanes assert the CHANNEL, not the detection: per the hook contract, on exit 0 only stdout
+# JSON reaches anyone (additionalContext → model, systemMessage → user); stderr is discarded.
+# A lane that only greps merged output would stay green while the warning goes nowhere — which is
+# exactly the hole the 2026-07-31 rewrite closed. Verdicts are exit codes, not free-form stdout.
+# NAMED RESIDUAL (cross-family LOW, accepted): $(…) capture strips NUL bytes, so a mutant emitting
+# NUL+JSON would pass C1. The producer's hits text is static ASCII+⚠️ with no NUL source, so the
+# lane does not pay for a byte-exact harness; revisit only if the producer ever emits dynamic bytes.
+HIT_CMD='bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'
+payload() { python3 -c 'import json,sys; print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]}}))' "$1"; }
+
+# All C lanes measure ONE invocation: stdout, stderr, and exit code from the same run (a pair of
+# runs can each satisfy half the contract while no single run satisfies it — cross-family finding).
+c_errf=$(mktemp)
+
+# C1 — advisory hit, full hook payload path: stdout must be one JSON object carrying
+#      additionalContext + systemMessage, with permissionDecision ABSENT (emitting "allow" would
+#      auto-approve the flagged command — the guard must never grant what it questions). exit 0.
+c_out=$(payload "$HIT_CMD" | bash "$G" 2>"$c_errf"); c_rc=$?
+c_err=$(cat "$c_errf")
+if [ "$c_rc" -eq 0 ] && printf '%s' "$c_out" | python3 -c '
+import json, sys
+d = json.load(sys.stdin)
+h = d["hookSpecificOutput"]
+assert h["hookEventName"] == "PreToolUse"
+assert "PIPE-VERDICT" in h["additionalContext"]
+assert "PIPE-VERDICT" in d["systemMessage"]
+assert "permissionDecision" not in h and "permissionDecision" not in d
+' 2>/dev/null; then
+  printf '  ✅ %-52s %s\n' "C1 advisory: stdout JSON, no permissionDecision" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s err=%s\n' "C1 advisory: stdout JSON, no permissionDecision" "$c_rc" "$c_out" "$c_err"; fail=$((fail+1))
+fi
+
+# C2 — block mode: exit 2, warning on stderr (stdout JSON is ignored by contract on exit 2).
+c_out=$(payload "$HIT_CMD" | FH_PIPE_VERDICT_BLOCK=1 bash "$G" 2>"$c_errf"); c_rc=$?
+c_err=$(cat "$c_errf")
+if [ "$c_rc" -eq 2 ] && printf '%s' "$c_err" | grep -q 'PIPE-VERDICT' && [ -z "$c_out" ]; then
+  printf '  ✅ %-52s %s\n' "C2 block: exit 2, stderr carries the reason" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s err=%s\n' "C2 block: exit 2, stderr carries the reason" "$c_rc" "$c_out" "$c_err"; fail=$((fail+1))
+fi
+
+# C3 — clean command through the full payload path: NO JSON at all (an empty advisory would still
+#      inject an empty reminder every Bash call — silence must stay silent). exit 0.
+c_out=$(payload 'echo hello' | bash "$G" 2>"$c_errf"); c_rc=$?
+rm -f "$c_errf"
+if [ "$c_rc" -eq 0 ] && [ -z "$c_out" ]; then
+  printf '  ✅ %-52s %s\n' "C3 clean: no emission at all" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s\n' "C3 clean: no emission at all" "$c_rc" "$c_out"; fail=$((fail+1))
+fi
+
+# C4 — hostile inherited codec: the hits text is non-ASCII (⚠️), and an environment-inherited
+#      PYTHONIOENCODING=ascii was measured (2026-07-31) to abort json.dumps and silently restore
+#      the pre-fix delivery loss. The guard pins PYTHONUTF8=1; this lane keeps that pin honest.
+c_out=$(payload "$HIT_CMD" | PYTHONIOENCODING=ascii bash "$G" 2>/dev/null); c_rc=$?
+if [ "$c_rc" -eq 0 ] && printf '%s' "$c_out" | python3 -c '
+import json, sys
+d = json.load(sys.stdin)
+assert "PIPE-VERDICT" in d["hookSpecificOutput"]["additionalContext"]
+' 2>/dev/null; then
+  printf '  ✅ %-52s %s\n' "C4 ascii-codec env: JSON still delivered" OK; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s\n' "C4 ascii-codec env: JSON still delivered" "$c_rc" "$c_out"; fail=$((fail+1))
+fi
+
 echo
 if [ "$fail" -eq 0 ]; then
   echo "[pipe-verdict-guard] ✅ all $pass known pairs hold"; exit 0

package/scripts/test_stale_clone_guard_lanes.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# test_stale_clone_guard_lanes.sh — known pairs for scripts/stale_clone_guard.sh
+#
+# Fixture: a bare origin + clone A (pushes 2 extra commits) + clone B (stays behind).
+# Lanes run with FH_STALE_CLONE_NO_FETCH=1 (remote state already local via clone-time fetch is
+# NOT enough — B must explicitly fetch to know it is behind, so the fixture fetches for it; the
+# no-fetch env only skips the guard's own network call) and a private marker dir per lane.
+
+set -u
+G="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/stale_clone_guard.sh"
+pass=0; fail=0
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+payload() { python3 -c 'import json,sys; print(json.dumps({"tool_name":"Write","tool_input":{"file_path":sys.argv[1]}}))' "$1"; }
+
+# run <label> <expect HIT|CLEAN> <file_path>
+run() {
+  local label="$1" want="$2" fpath="$3" got out
+  local mdir; mdir=$(mktemp -d "$WORK/marker.XXXXXX")
+  out=$(payload "$fpath" | FH_STALE_CLONE_NO_FETCH=1 FH_STALE_CLONE_MARKER_DIR="$mdir" bash "$G" 2>&1)
+  if printf '%s' "$out" | grep -q 'STALE-CLONE'; then got=HIT; else got=CLEAN; fi
+  if [ "$got" = "$want" ]; then
+    printf '  ✅ %-52s %s (expected %s)\n' "$label" "$got" "$want"; pass=$((pass+1))
+  else
+    printf '  ❌ %-52s %s (expected %s)\n     out: %s\n' "$label" "$got" "$want" "$out"; fail=$((fail+1))
+  fi
+}
+
+echo "[stale-clone-guard] fixture build"
+git init -q --bare "$WORK/origin.git"
+# Default-branch portability (GPT pass): pin the bare repo's HEAD to main BEFORE cloning B —
+# on master-default machines clone B otherwise has no checked-out branch and upstream setup fails.
+git --git-dir="$WORK/origin.git" symbolic-ref HEAD refs/heads/main
+git clone -q "$WORK/origin.git" "$WORK/A" 2>/dev/null
+( cd "$WORK/A" && git -c user.email=t@t -c user.name=t commit -q --allow-empty -m base \
+  && git push -q origin HEAD:main && git branch -q --set-upstream-to=origin/main ) 2>/dev/null
+git clone -q "$WORK/origin.git" "$WORK/B" 2>/dev/null
+( cd "$WORK/B" && git branch -q --set-upstream-to=origin/main ) 2>/dev/null
+( cd "$WORK/A" && git -c user.email=t@t -c user.name=t commit -q --allow-empty -m one \
+  && git -c user.email=t@t -c user.name=t commit -q --allow-empty -m two && git push -q origin HEAD:main ) 2>/dev/null
+( cd "$WORK/B" && git fetch -q origin ) 2>/dev/null   # B now KNOWS it is behind 2
+
+echo "[stale-clone-guard] known pairs"
+run "behind clone fires"                  HIT   "$WORK/B/newfile.py"
+run "up-to-date clone stays silent"       CLEAN "$WORK/A/newfile.py"
+run "non-repo path stays silent"          CLEAN "$WORK/newfile.py"
+run "new nested dir in behind clone"      HIT   "$WORK/B/sub/dir/newfile.py"
+
+# Creation-only scope: overwriting an EXISTING file must not fire (GPT pass).
+touch "$WORK/B/existing.py"
+run "overwrite of existing file is CLEAN" CLEAN "$WORK/B/existing.py"
+
+# Non-origin remote name: @{u}-derived remote, no hardcoded origin (GPT pass).
+git clone -q "$WORK/origin.git" "$WORK/C" 2>/dev/null
+( cd "$WORK/C" && git remote rename origin up && git fetch -q up \
+  && git branch -q --set-upstream-to=up/main && git reset -q --hard HEAD~2 ) 2>/dev/null  # noqa: destructive-op (fixture repo)
+run "non-origin remote name still fires"  HIT   "$WORK/C/newfile.py"
+
+# Throttle: SAME marker dir, two calls — second must be silent.
+mdir=$(mktemp -d "$WORK/marker.throttle")
+o1=$(payload "$WORK/B/x.py" | FH_STALE_CLONE_NO_FETCH=1 FH_STALE_CLONE_MARKER_DIR="$mdir" bash "$G" 2>&1)
+o2=$(payload "$WORK/B/y.py" | FH_STALE_CLONE_NO_FETCH=1 FH_STALE_CLONE_MARKER_DIR="$mdir" bash "$G" 2>&1)
+if printf '%s' "$o1" | grep -q STALE-CLONE && [ -z "$o2" ]; then
+  printf '  ✅ %-52s OK\n' "throttle: 2nd call same repo+day silent"; pass=$((pass+1))
+else
+  printf '  ❌ %-52s o1=%s o2=%s\n' "throttle: 2nd call same repo+day silent" "$o1" "$o2"; fail=$((fail+1))
+fi
+
+# Contract: HIT emits one JSON object with both channels and no permissionDecision.
+mdir=$(mktemp -d "$WORK/marker.json")
+jo=$(payload "$WORK/B/z.py" | FH_STALE_CLONE_NO_FETCH=1 FH_STALE_CLONE_MARKER_DIR="$mdir" bash "$G" 2>/dev/null)
+if printf '%s' "$jo" | python3 -c '
+import json,sys
+d=json.load(sys.stdin)
+h=d["hookSpecificOutput"]
+assert h["hookEventName"]=="PreToolUse"
+assert "STALE-CLONE" in h["additionalContext"] and "STALE-CLONE" in d["systemMessage"]
+assert "permissionDecision" not in h and "permissionDecision" not in d
+' 2>/dev/null; then
+  printf '  ✅ %-52s OK\n' "C1 JSON dual-channel, no permissionDecision"; pass=$((pass+1))
+else
+  printf '  ❌ %-52s out=%s\n' "C1 JSON dual-channel, no permissionDecision" "$jo"; fail=$((fail+1))
+fi
+
+# Fail-open lanes.
+o=$(printf '%s' 'not json' | bash "$G" 2>&1); rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$o" ]; then
+  printf '  ✅ %-52s OK\n' "malformed payload: silent exit 0"; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s\n' "malformed payload: silent exit 0" "$rc" "$o"; fail=$((fail+1))
+fi
+o=$(python3 -c 'import json;print(json.dumps({"tool_name":"Edit","tool_input":{"file_path":"/x"}}))' | bash "$G" 2>&1); rc=$?
+if [ "$rc" -eq 0 ] && [ -z "$o" ]; then
+  printf '  ✅ %-52s OK\n' "non-Write tool: silent"; pass=$((pass+1))
+else
+  printf '  ❌ %-52s rc=%s out=%s\n' "non-Write tool: silent" "$rc" "$o"; fail=$((fail+1))
+fi
+
+echo
+if [ "$fail" -eq 0 ]; then
+  echo "[stale-clone-guard] ✅ all $pass known pairs hold"; exit 0
+else
+  echo "[stale-clone-guard] ❌ $fail/$((pass+fail)) lanes failed"; exit 1
+fi

package/templates/settings.PreToolUse.snippet.json

@@ -28,7 +28,27 @@
     "Verify after wiring (known pair, both directions):",
     "  bash scripts/test_pipe_verdict_guard_lanes.sh          # 15 pairs, expect all hold",
     "  printf '%s' '{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"g.sh | tail; rc=$?\"}}' \\",
-    "    | bash scripts/pipe_verdict_guard.sh                 # expect a PIPE-VERDICT R2 warning"
+    "    | bash scripts/pipe_verdict_guard.sh                 # expect a PIPE-VERDICT R2 warning",
+    "",
+    "SECOND GUARD ON THE SAME SURFACE — destructive_pre_gate.sh (added 2026-08-01, field→meta",
+    "reverse propagation from pmh-dev): advisory warning when a Bash call carries a destructive",
+    "command (git reset --hard, clean -f, checkout ., force push, branch -D, stash drop/clear,",
+    "rm -rf on root/home/cwd). Origin: a below-floor sidecar self-justified `git reset --hard",
+    "origin/main` and ran it — the weaker the tier, the weaker the self-inhibition, so the",
+    "counterweight is mechanical. Net-new coverage is the LOCAL destructive ops no git hook sees;",
+    "the pre-push hook remains the hard floor for the push-time surface (role deconfliction in the",
+    "script header). Advisory by design, same contract as pipe_verdict_guard (additionalContext +",
+    "systemMessage, no permissionDecision); escalate with FH_DESTRUCTIVE_BLOCK=1. Opt out per",
+    "command with `# noqa: destructive-op`.",
+    "  bash scripts/test_destructive_pre_gate_lanes.sh        # 99 pairs, expect all hold",
+    "",
+    "THIRD GUARD, Write matcher — stale_clone_guard.sh (added 2026-08-01, fh_signal_2026-07-31):",
+    "advisory when a NEW file is created inside a git clone that is behind its upstream (fetch +",
+    "behind-count, once per repo per day, creation-only — overwrites never fire). Origin: a session",
+    "built on a 46-PR-behind clone and manufactured a duplicate of an upstream lane. found→extend",
+    "applies at repo level; this is its mechanical layer. Same advisory contract; fail-open on",
+    "every uncertainty (non-repo, no upstream, fetch failure).",
+    "  bash scripts/test_stale_clone_guard_lanes.sh           # 10 pairs, expect all hold"
   ],
   "project_settings_json": {
     "hooks": {
@@ -40,6 +60,21 @@
               "type": "command",
               "command": "bash \"$CLAUDE_PROJECT_DIR/scripts/pipe_verdict_guard.sh\"",
               "timeout": 5
+            },
+            {
+              "type": "command",
+              "command": "bash \"$CLAUDE_PROJECT_DIR/scripts/destructive_pre_gate.sh\"",
+              "timeout": 5
+            }
+          ]
+        },
+        {
+          "matcher": "Write",
+          "hooks": [
+            {
+              "type": "command",
+              "command": "bash \"$CLAUDE_PROJECT_DIR/scripts/stale_clone_guard.sh\"",
+              "timeout": 20
             }
           ]
         }