@chrono-meta/fh-gate 1.4.83 → 1.4.84

package/scripts/session_close_check.sh

@@ -33,7 +33,13 @@ UNPUSHED=$(git -C "$FH" log --oneline @{u}.. 2>/dev/null | wc -l | tr -d ' ')
 
 # ①-b open-PR sweep (surface-not-auto — requires gh; skip silently offline)
 if command -v gh >/dev/null 2>&1; then
-  PRS=$(gh pr list --author "@me" --state open --json number 2>/dev/null | grep -c '"number"' || true)
+  # `gh --json` emits COMPACT single-line JSON when piped, so counting LINES returned 1 for ANY
+  # non-zero number of open PRs — the sweep hid every PR after the first, in the exact step CLAUDE.md
+  # pairs with count consistency. Count OCCURRENCES instead. Measured 2026-08-02 with a known pair:
+  # `[{"number":227},{"number":226},{"number":225}]` → old 1, new 3; `[]` → 0 both ways — which is
+  # why an environment with zero open PRs can never surface this, and why the 0-case alone is not a
+  # calibration. Observed live the same day: 2 open PRs reported as 1.
+  PRS=$(gh pr list --author "@me" --state open --json number 2>/dev/null | grep -o '"number"' | wc -l | tr -d ' ' || true)
   [ "${PRS:-0}" -gt 0 ] && echo "⚠️  ①-b $PRS open PR(s) by you — classify: self-mergeable vs awaiting-external"
 fi
 
@@ -134,6 +140,51 @@ if [ -f "$CARD" ]; then
   else
     echo "✅ ⑤ card is the newest close artifact (card-last holds)"
   fi
+
+  # ⑤ tie probe (ADVISORY — never changes the verdict, never blocks).
+  # `-newer` is a STRICT comparison, so an artifact whose mtime exactly equals the card's is invisible
+  # to the check above: ⑤ reports card-last holds when the ordering was never actually established.
+  # That is the same blind spot that made the ⑤-N *lane* flake in CI on 2026-08-02, one layer down —
+  # and the lane repair hardened the fixture, not this production path, which still runs against
+  # ordinary session writes with no deterministic separation.
+  # Why advisory and not a verdict: tightening ⑤ to treat a tie as a violation would BLOCK a healthy
+  # close whose two writes happened to land in one clock tick, and an over-blocking close gate trains
+  # the override reflex that disarms it (the same reasoning the ⑤-P lane already encodes). Whether
+  # real closes ever tie is UNMEASURED — so this line measures it instead of guessing at a fix.
+  # Diagnosis, not prevention; promote it to a verdict only on evidence that ties actually occur.
+  #
+  # COST, measured before shipping (this runs on every push via the pre-push hook, so an unbounded
+  # per-file cost is a live regression, not a design risk). `! -newer "$CARD"` does the only safe
+  # narrowing: strictly-newer files are already reported by ⑤ above, so the in-loop "is it newer?"
+  # check is redundant and dropped — one fork per candidate, not two.
+  # A `-mtime -1` bound was tried and REMOVED: it scopes the window to *now*, but the invariant is
+  # anchored to the *card*, and this script runs on every push — routinely against a card written
+  # days ago. Two artifacts tied with an old card then fall outside the window and ⑤ reports
+  # card-last holds on an ordering never established, with the probe scoped out of seeing it. Speed
+  # that hides the thing being measured is not speed. Measured cost of the correct form on the
+  # current corpus: 140 candidates, 0.57s. Linear in tracks/_meta; revisit if that reaches thousands.
+  #
+  # Both emitted lines start with the same literal `⚠️  ⑤ tie` on purpose — the pre-push hook greps
+  # for it, and when the two lines carried different prefixes the hook surfaced the warning while
+  # dropping the sentence that says what to do about it, leaving a reader with only "⑤'s strict
+  # comparison cannot see it" — precisely the misreading the summary line exists to prevent.
+  # Keep the shared prefix; test_session_close_lanes.sh ⑤-T asserts the hook's exact pattern.
+  TIES=0
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    [ -n "$(find "$CARD" -newer "$f" 2>/dev/null)" ] && continue      # strictly older → fine
+    TIES=$((TIES + 1))
+    echo "⚠️  ⑤ tie: ${f#"$FH"/} shares the card's exact mtime — ⑤'s strict comparison cannot see it"
+  done <<EOF
+$(find "$FH/tracks/_meta" -maxdepth 1 -type f \( -name "fh_completed_*.md" -o -name "fh_signal_*.md" \) ! -newer "$CARD" 2>/dev/null)
+EOF
+  # What a recurring tie would actually license (cross-family correction, 2026-08-02): NOT making ⑤'s
+  # comparison non-strict. Ties do not show the comparison is too strict — they show **mtime is not a
+  # reliable witness of close ordering on this machine**. A non-strict ⑤ would convert every same-tick
+  # healthy close into a false block, which is the failure mode ⑤-P exists to prevent. The fix that
+  # ties would justify is an explicit ordering record (the card writing a marker ①–④ can be compared
+  # against) or a deterministic close write sequence — not a looser comparison.
+  [ "$TIES" -gt 0 ] && echo "⚠️  ⑤ tie → $TIES artifact(s) ordering-ambiguous. If this recurs, mtime is not a sound ordering witness here; the fix is an explicit ordering record, NOT making ⑤ non-strict (that would false-block every healthy same-tick close)."
 else
   echo "❌ ⑤ session card missing: $CARD"
   FAIL=1

package/scripts/stale_clone_guard.sh

@@ -41,7 +41,7 @@ import json,sys
 try: d = json.load(sys.stdin)
 except Exception: sys.exit(0)
 if d.get("tool_name") != "Write": sys.exit(0)
-sys.stdout.write(d.get("tool_input", {}).get("file_path", "") or "")
+sys.stdout.buffer.write((d.get("tool_input", {}).get("file_path", "") or "").encode("utf-8"))
 ' 2>/dev/null) || FILE=""
 [ -n "$FILE" ] || exit 0
 
@@ -68,13 +68,55 @@ MARKER="$MARKER_DIR/$(printf '%s' "$ROOT" | cksum | cut -d' ' -f1)-$(date +%Y%m%
 [ -e "$MARKER" ] && exit 0
 
 UPSTREAM=$(git -C "$ROOT" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null) || exit 0
-REMOTE="${UPSTREAM%%/*}"   # fetch the remote @{u} actually tracks, not a hardcoded origin (GPT pass)
+# Remote name resolution (leg-C LOW, 2026-08-01): `${UPSTREAM%%/*}` truncates a remote whose NAME
+# carries `/` (git accepts them via config even though `git remote add` rejects them) — `a/b/main`
+# became remote `a`, the fetch failed, and the guard went silently inert on exactly that clone.
+# `%(upstream:remotename)` is git's own parse; the cut stays as fallback for git versions without it.
+_HEAD_REF=$(git -C "$ROOT" symbolic-ref -q HEAD 2>/dev/null) || _HEAD_REF=""
+REMOTE=""
+[ -n "$_HEAD_REF" ] && REMOTE=$(git -C "$ROOT" for-each-ref --format='%(upstream:remotename)' "$_HEAD_REF" 2>/dev/null | head -1)
+[ -n "$REMOTE" ] || REMOTE="${UPSTREAM%%/*}"   # fallback; never a hardcoded origin (GPT pass)
 [ -n "$REMOTE" ] || exit 0
 
 if [ "${FH_STALE_CLONE_NO_FETCH:-0}" != "1" ]; then
-  # Bounded fetch: GIT_TERMINAL_PROMPT=0 kills the credential-prompt hang class; the hook-level
-  # timeout is the hard bound for wedged transports (macOS ships no GNU timeout).
-  GIT_TERMINAL_PROMPT=0 git -C "$ROOT" fetch -q "$REMOTE" 2>/dev/null || exit 0
+  # Internally-bounded fetch (leg-C MED, 2026-08-01): the previous hard bound was the RUNNER's
+  # hook timeout (20s), which kills the whole guard — preempting the exit-0 contract AND skipping
+  # the marker write, so a wedged transport re-stalled EVERY Write for the rest of the day
+  # (20s × N calls, a session-killer). The guard now owns its bound: fetch in the background,
+  # poll, and on expiry kill the fetch, ARM the day-throttle, exit 0. Arming on timeout is a
+  # deliberate trade: one silent day on a broken-network machine (fail-open, the documented
+  # degrade direction) beats a stall on every file creation. This is NOT the attempt-marker the
+  # GPT pass rejected — that armed on every early exit; this arms only after a full budget spent
+  # against a wedged transport. GIT_TERMINAL_PROMPT=0 still kills the credential-prompt class.
+  # Budget: tenths of a second; default 150 (15s) stays under the snippet's 20s runner timeout.
+  # CAPPED at 150 (terra round, 2026-08-01): an env-supplied budget > the runner timeout would
+  # restore the exact runner-preemption this bound exists to remove. (No boundary lane on purpose
+  # — it would idle its full 15s by construction; the cap is these three lines.)
+  # LENGTH-first, then value (terra round 2, 2026-08-01): an all-digit literal wider than the
+  # shell's integer width makes `[ "$x" -gt 150 ]` itself an ERROR ("integer expression expected" /
+  # "number truncated"), so the numeric cap never ran and the value stayed unnormalized. Digits are
+  # capped at 3 (max 999) before any arithmetic touches the value — safe in bash 3.2 and zsh alike.
+  _BUDGET="${FH_STALE_CLONE_FETCH_BUDGET_TENTHS:-150}"
+  case "$_BUDGET" in ''|*[!0-9]*) _BUDGET=150 ;; esac
+  [ "${#_BUDGET}" -gt 3 ] && _BUDGET=150
+  [ "$_BUDGET" -gt 150 ] && _BUDGET=150
+  # stdout AND stderr to /dev/null: the child inherits this hook's stdout pipe, and a
+  # still-running child holding it open would stall the hook runner past our own exit.
+  GIT_TERMINAL_PROMPT=0 git -C "$ROOT" fetch -q "$REMOTE" >/dev/null 2>&1 &
+  _FPID=$!
+  _t=0
+  while kill -0 "$_FPID" 2>/dev/null && [ "$_t" -lt "$_BUDGET" ]; do
+    sleep 0.1; _t=$((_t+1))
+  done
+  if kill -0 "$_FPID" 2>/dev/null; then
+    # No wait after the kill: a shell-script transport defers TERM until its foreground child
+    # exits (measured: the lane's wedge shim held a wait for the full 30s hang). The child is
+    # reparented at our exit; TERM is best-effort cleanup, the BOUND is the contract.
+    kill "$_FPID" 2>/dev/null || true
+    : > "$MARKER" 2>/dev/null || true
+    exit 0
+  fi
+  wait "$_FPID" 2>/dev/null || exit 0
 fi
 
 BEHIND=$(git -C "$ROOT" rev-list --count 'HEAD..@{u}' 2>/dev/null) || exit 0
@@ -85,7 +127,8 @@ case "$BEHIND" in ''|*[!0-9]*) exit 0 ;; esac
 MSG="  ⚠️  STALE-CLONE $ROOT is behind $UPSTREAM by $BEHIND commit(s).
       Building on a stale clone manufactures duplicates of work that already exists upstream
       (measured: a 46-PR-behind clone rebuilt an existing lane, 2026-07-31).
-      Before creating new files here: git -C $ROOT pull --ff-only  (or rebase your branch).
+      Advisory timing: this notice arrives with the Write already evaluated — reconcile NOW,
+      before the next file: git -C '$ROOT' pull --ff-only  (or rebase your branch).
       found→extend applies at repo level too — check what upstream already has."
 
 if json_out=$(printf '%s' "$MSG" | PYTHONIOENCODING=utf-8 python3 -c '

package/scripts/substrate_jump_detector.sh

@@ -55,6 +55,27 @@ EOF
 echo "   → run the shed/advance pass: re-check capability-compensating scaffolding against the new"
 echo "     substrate (sonnet_floor_doctrine.md §durable-mechanization — shed what the model no longer"
 echo "     needs, advance what the new substrate enables). Removals go through the 4-axis gate."
+# Until 2026-08-02 the line above WAS the whole pass: an instruction with no instrument behind it, so
+# nothing measured whether a rule still earned its residency. It now hands off to something runnable.
+if [ ! -f "$FH/scripts/probe_scope_check.sh" ]; then
+  echo "   (probe-scope check NOT run — scripts/probe_scope_check.sh absent. Expected in the npm"
+  echo "    package, which ships neither the script nor its probe set; in a SOURCE checkout it is an"
+  echo "    instrument gap, not a skip — selfcheck fails on exactly that state.)"
+else
+  echo ""
+  echo "   ── probe Scope resolution (bash scripts/probe_scope_check.sh) ──"
+  # Capture, THEN branch on rc — a pipe here would report the pipe's status, and a `sed` window keyed
+  # on a line the tool no longer prints would swallow the whole result silently.
+  _ps_out=$(bash "$FH/scripts/probe_scope_check.sh" 2>&1); _ps_rc=$?
+  if [ "$_ps_rc" -ne 0 ]; then
+    echo "   ⚠️  probe-scope check FAILED (exit $_ps_rc) — a probe points at a section that is not there."
+    printf '%s\n' "$_ps_out" | sed 's/^/      /'
+  else
+    printf '%s\n' "$_ps_out" | grep -E 'control B|✅' | sed 's/^/   /'
+  fi
+  echo "   This says the probe set still points at real sections — NOT how much of the asset is"
+  echo "   defended. Coverage measurement is unsolved; do not read a green check as 'fully probed'."
+fi
 
 printf '%s\n' "$CURRENT" > "$STATE"
 exit 0