@chrono-meta/fh-gate 1.4.83 → 1.4.85

package/scripts/consent_registry_check.sh

@@ -16,8 +16,11 @@
 #   R3  join     — every standing_consent key resolves to a registered class
 #   R4  floor    — every standing_consent key resolves to a promotion_eligible class
 #   R5  lease    — every grant carries `expires` and is not past it
-#   R6  scope    — every grant records `effects` AND `target`, so the subset check has something to
+#   R6  scope    — every grant records the FULL fingerprint the rule binds consent to — `owner`,
+#                  `mode`, `effects`, `target`, `sinks` — so the subset check has something to
 #                  compare against (a grant whose scope was never recorded cannot be re-validated)
+#   R7  drift    — the recorded fingerprint still matches the registry: effects ⊆ capabilities,
+#                  target/owner/mode identical, and the class's current `sinks` ⊆ the granted ones
 #
 # WHAT IT DOES *NOT* CHECK (named, so the prose above it cannot over-claim)
 #   - the effect-SUBSET comparison itself. R6 proves a baseline was recorded; it does not compare a
@@ -70,7 +73,7 @@ REG="${1:-$ROOT/tracks/_meta/consent_classes.yaml}"
 UAP="${2:-$ROOT/tracks/_meta/user_adaptation_profile.md}"
 
 python3 - "$REG" "$UAP" <<'PY'
-import sys, os, re, datetime
+import sys, os, re, datetime, unicodedata
 reg_path, uap_path = sys.argv[1], sys.argv[2]
 
 def out(sym, msg): print(f"  {sym} {msg}")
@@ -98,9 +101,19 @@ def _no_dup(loader, node, deep=False):
     # a merge key exited 1 as an unregistered class). Over-blocking is not a safety win — it trains
     # the override reflex and turns the gate into decoration, so it counts as a defect like any
     # fail-open.
-    loader.flatten_mapping(node)
+    # ORDER MATTERS. Duplicates are detected over the node's OWN keys, BEFORE merge resolution —
+    # then the merge is resolved. Running flatten_mapping first put the anchor's keys and the
+    # explicit keys into one list, so a canonical YAML override (`<<: *d` then `target: t`) looked
+    # like a duplicate and a legitimate grant was refused. YAML merge semantics are explicit that
+    # the explicit key WINS; refusing it is us disagreeing with the format, not catching a defect.
+    # This is a reorder plus skipping the `<<` key itself — NOT the full-file parser rewrite that
+    # regressed 16 of 41 lanes and was reverted. A literal duplicate in one mapping still fails.
+    # (Pinned as K1 over-block for two rounds; closed 2026-08-02 once the lane count made the change
+    # verifiable — 85 lanes, both directions mutation-checked.)
     seen = set()
     for k, _ in node.value:
+        if getattr(k, "tag", "") == "tag:yaml.org,2002:merge":
+            continue                      # the `<<` key is a directive, not a data key
         key = loader.construct_object(k, deep=deep)
         try:
             if key in seen:
@@ -108,6 +121,7 @@ def _no_dup(loader, node, deep=False):
         except TypeError:
             pass
         seen.add(key)
+    loader.flatten_mapping(node)
     return yaml.SafeLoader.construct_mapping(loader, node, deep)
 
 NoDupLoader.add_constructor(yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, _no_dup)
@@ -126,6 +140,17 @@ reg = load(open(reg_path), "registry")
 REQUIRED = ["name", "owner", "mode", "target", "capabilities", "sinks", "feeds", "promotion_eligible"]
 STR_FIELDS = ["name", "owner", "mode", "target"]
 IRREVERSIBLE = {"go-public", "publish", "delete", "history-rewrite", "unknown"}
+# The closed vocabulary. Anything outside it is UNKNOWN, and unknown is not reversible (the floor's
+# own words). Kept next to IRREVERSIBLE so the two cannot drift apart. All entries are pre-normalised
+# (lower-case) because _norm case-folds both sides.
+# READ FROM THE SOURCE, not invented: templates/consent_classes.yaml.example line 52 and
+# operational_adaptation.md line 51 both enumerate capabilities as
+# `read · local-write · network · dispatch · repo-mutation`. The irreversible names are unioned in
+# because they may legally APPEAR in a capabilities list — that is exactly what R2-b exists to catch,
+# so they must be recognised rather than flagged as unknown.
+# (First draft of this set was guessed and broke 61 of 76 lanes: it invented `write`/`publish` as
+# capabilities and omitted `repo-mutation`. The vocabulary lives in two files; read them.)
+KNOWN_EFFECTS = {"read", "local-write", "network", "dispatch", "repo-mutation"} | IRREVERSIBLE
 NON_GRANT = {"declined", "unset", "revoked"}
 MAX_LEASE_DAYS = 365
 
@@ -133,8 +158,35 @@ MAX_LEASE_DAYS = 365
 # an identifier, not prose) and whitespace-insensitive; the point is that one function decides, so
 # the two sides of a comparison can never drift apart.
 def _norm(s):
+    # IDENTITY / SCOPE comparison. Strip surrounding whitespace and NOTHING ELSE. Case, width and
+    # invisible characters are all REAL DIFFERENCES here: `OwnerOne` is not `ownerone`, and a target
+    # carrying a zero-width space is not the target without it. A difference the comparison cannot
+    # see is a re-ask that never fires.
+    #
+    # WHY THIS IS BACK TO STRIP-ONLY (2026-08-02): a previous session left a residual — "_norm does
+    # not case-fold, so `History-Rewrite` evades the irreversible floor" — and explicitly warned that
+    # case-folding would change R7's semantics and needed its own change. A cross-family round proved
+    # the fail-open was real, so I case-folded _norm — and the very next round measured the predicted
+    # consequence: owner/mode/target drift stopped being detected. The evidence was right and the
+    # warning was right; what was wrong was using ONE normalizer for two different questions.
     return str(s).strip()
 
+
+def _norm_vocab(s):
+    # VOCABULARY matching only — is this token one of the known / irreversible effect classes? Here
+    # case, width and invisible characters are NOISE, not signal: `History-Rewrite`, `history-rewrite`
+    # and a zero-width-suffixed variant all name the same irreversible surface, and treating them as
+    # distinct is what let a history-rewrite class declare itself promotable.
+    #
+    # TWO NORMALIZERS IS THE POINT, NOT A SLIP. The known trap is two normalizers for the SAME
+    # question drifting apart in leniency (one accepts what the other silently drops). These answer
+    # DIFFERENT questions — "are these the same identity?" vs "is this token in this closed set?" —
+    # and each is used for exactly one of them. Keep it that way: if a third call site appears, decide
+    # which question it is asking before picking.
+    t = unicodedata.normalize("NFKC", str(s))
+    t = "".join(ch for ch in t if unicodedata.category(ch) not in ("Cf", "Cc"))
+    return t.strip().casefold()
+
 # H1 FALSY CONTAINERS. `reg or {}` / `classes or []` laundered `false`, `0`, `[]` and a bare
 # `classes:` into a valid-empty registry that exited 0 — the same falsy-collapse defect already
 # fixed on the GRANT side, left unfixed here. Half a fix propagated is a hole. Sentinel, then type,
@@ -151,9 +203,13 @@ if classes is None:
 if not isinstance(classes, list):
     print(f"consent-registry: FAIL — `classes` is {type(classes).__name__}, not a list; fail-closed")
     sys.exit(1)
-if not classes:
-    print("consent-registry: N/A — registry declares zero classes; promotion DISABLED (not a PASS)")
-    sys.exit(3)   # UNMEASURED, not verified — see EXIT CONTRACT
+ZERO_CLASSES = not classes
+# The zero-class verdict is DEFERRED, not decided here. Deciding it early required peeking at the
+# profile with a second, weaker parser (a bespoke frontmatter regex, a bare non-empty-dict test), and
+# two parsers for one file disagree by construction — measured: `--- # metadata` and
+# `standing_consent: []` and a declined-only profile each got the wrong code. One parser, one answer.
+# The main body below reads the profile properly; the verdict is taken at the end with everything
+# else. (cross-family round 2, 2026-08-02 — same lesson as collapsing three write paths into one.)
 
 by_name = {}
 for i, c in enumerate(classes):
@@ -219,7 +275,16 @@ for i, c in enumerate(classes):
     # floor into decoration. Residual, named rather than fixed here: _norm strips whitespace but
     # does NOT case-fold, so `History-Rewrite` still evades BOTH R2-b and R7 — case-folding would
     # change R7's semantics too and belongs in its own change with its own lanes.
-    cap_bad = {_norm(x) for x in (c["capabilities"] or [])} & IRREVERSIBLE
+    caps_n = {_norm_vocab(x) for x in (c["capabilities"] or [])}
+    cap_bad = caps_n & IRREVERSIBLE
+    # CLOSED vocabulary. An effect class nobody enumerated cannot be judged reversible, and the floor
+    # already says unknown is not reversible — so an unrecognised capability is treated as one.
+    # Without this, a typo (`local-wrtie`) or a novel string silently classified itself as safe.
+    unknown_caps = caps_n - KNOWN_EFFECTS
+    if c["promotion_eligible"] and unknown_caps:
+        out("❌", f"R2-c `{nm}` promotion_eligible:true with capabilities outside the declared "
+                  f"vocabulary {sorted(unknown_caps)} — unknown is not reversible")
+        fails += 1
     if c["promotion_eligible"] and bad:
         out("❌", f"R2 `{nm}` claims promotion_eligible:true but sinks/feeds include {sorted(bad)}")
         fails += 1
@@ -345,10 +410,23 @@ else:
                 out("❌", f"R3 standing_consent is not a mapping ({type(grants).__name__}); fail-closed")
                 fails += 1; grants = None
 
+no_active_grant = False
 if grants is None:
     pass
 elif not grants:
-    out("✅", "R3-R6 no standing consent recorded (nothing to validate)")
+    # F4-b (2026-07-31, same round, same principle, a path F4's fix did not reach). F4 gave
+    # "nothing to join" its own exit code for a MISSING registry, ZERO classes and a MISSING UAP —
+    # and left a present UAP holding ZERO grants returning 0. That is the identical state judged by
+    # two different codes: lane D1-d already asserts in its own name that "no grants is not a
+    # verified pass", and the EXIT CONTRACT at the top of this file already defines 3 as "there was
+    # nothing to join". The code disagreed with both. A caller writing the conventional
+    #     if scripts/consent_registry_check.sh; then run_unprompted; fi
+    # therefore ran unprompted against a UAP that had granted it nothing at all — the exact
+    # conversion of "keep asking" into "success" that F4 exists to stop, one branch over.
+    # Not a failure and not painted red: N/A, exit 3, keep asking.
+    print("consent-registry: N/A — registry is well-formed but NO standing consent is recorded; "
+          "nothing granted, keep asking (not a PASS)")
+    no_active_grant = True
 else:
     today = datetime.date.today()
     validated = 0
@@ -428,10 +506,71 @@ else:
         # caught (measured with that control, cross-family round 7). Half a fix propagated is a hole:
         # a baseline that is not a list-of-effects and a real target string cannot be compared against
         # anything later, which is the entire purpose of recording it.
+        # R6-c FINGERPRINT COMPLETENESS (cross-family round 9, finding F3, 2026-07-31).
+        # The rule says consent binds to the action's SHAPE and enumerates that shape:
+        #   "a grant records ... the owning gate/skill, and the set of effect classes ... plus the
+        #    `target` scope and the `sinks` fingerprint"  (operational_adaptation.md §Consent binds
+        #   to the action's SHAPE), and the offer quoted to the user is `<mode · target ·
+        #   capabilities · sinks>`.
+        # The baseline recorded here was `effects` + `target` ONLY. So a class could keep its name,
+        # target, capabilities and empty sinks while its `owner` (which gate/skill does the acting)
+        # or its `mode` (what it does when it acts) was swapped underneath the grant — R6 found its
+        # two fields present and R7 found the effects still a subset, and the checker returned 0.
+        # "The name is exactly what does not change when the danger does" — and so, it turned out,
+        # were the only two fields the floor was reading. A fingerprint missing the fields the rule
+        # names is not a fingerprint; it is a partial hash that collides on the dangerous case.
+        # Sentinel-then-type, never `or`: `sinks: []` is a REAL fingerprint ("crossed nothing at
+        # grant time") and must not be laundered into "not recorded" by a falsy test — the same
+        # falsy-collapse defect fixed twice above.
+        FP_STR = ("owner", "mode", "target")
+        missing_fp = [f for f in ("owner", "mode", "target", "effects", "sinks") if g.get(f) is None]
+        if missing_fp:
+            out("❌", f"R6 `{name}` grant records no {'+'.join(missing_fp)} — consent binds to the "
+                      f"action's SHAPE (owner·mode·target·effects·sinks), and a fingerprint missing "
+                      f"a field cannot detect drift in that field")
+            fails += 1
         eff, tgt = g.get("effects"), g.get("target")
-        if eff is None or tgt is None:
-            out("❌", f"R6 `{name}` grant records no `effects`+`target` — the subset check has no baseline")
+        for fld in FP_STR:
+            v = g.get(fld)
+            if v is not None and (not isinstance(v, str) or not v.strip()):
+                out("❌", f"R6 `{name}` `{fld}` must be a non-blank string, got "
+                          f"{type(v).__name__} {v!r} — an unreadable baseline is no baseline")
+                fails += 1
+        gs = g.get("sinks")
+        if gs is not None and (not isinstance(gs, list)
+                               or not all(isinstance(x, str) and x.strip() for x in gs)):
+            out("❌", f"R6 `{name}` `sinks` must be a list of non-blank strings, got "
+                      f"{type(gs).__name__} {gs!r} — an unreadable sink is an UNDECLARED sink")
             fails += 1
+        else:
+            # R7-c SINK WIDENING. Rule: "on any later run whose fingerprint is not a subset of the
+            # granted one, standing consent reverts to unset and asks again ... widening is the
+            # trigger; narrowing is not." The class's CURRENT sinks are the later fingerprint.
+            # HONEST SCOPE — this comparison is defence-in-depth, not an independent catch today:
+            # R2 already refuses `promotion_eligible: true` on ANY non-empty sinks/feeds, so on an
+            # eligible class this branch is unreachable and no lane can discriminate it. It is kept
+            # because it survives an R2 relaxation and because it is the half that makes the RECORD
+            # meaningful; the lane that pins F3 pins the R6 *presence* requirement above, which is
+            # reachable. Do not read a PASS here as "sink drift was independently checked".
+            if isinstance(gs, list):
+                widened = sorted({_norm(x) for x in c["sinks"]} - {_norm(x) for x in gs})
+                if widened:
+                    out("❌", f"R7 `{name}` class now declares sink(s) {widened} that were not in the "
+                              f"granted fingerprint {gs!r} — widening reverts consent to unset")
+                    fails += 1
+        # Identity fields: equality, not subset. `owner`/`mode` name WHO acts and HOW; there is no
+        # "narrower owner". _norm (the single normalizer) on both sides, so the two spellings of one
+        # value can never be judged by two different rules — the divergent-normalizer class this
+        # file has already been bitten by three times.
+        for fld in ("owner", "mode"):
+            gv = g.get(fld)
+            if isinstance(gv, str) and gv.strip() and _norm(gv) != _norm(str(c[fld])):
+                out("❌", f"R7 `{name}` grant {fld} {gv!r} does not match the registered {fld} "
+                          f"{c[fld]!r} — the class was re-pointed under a live grant; consent binds "
+                          f"to the action's shape, not its name")
+                fails += 1
+        if eff is None or tgt is None:
+            pass   # already reported by R6 above; nothing left to compare
         else:
             if not isinstance(eff, list) or not eff or not all(isinstance(e, str) and e.strip() for e in eff):
                 out("❌", f"R6 `{name}` `effects` must be a non-empty list of strings, got "
@@ -451,7 +590,14 @@ else:
                 # registry side was not, so `[" read "]` matched while `[READ]` did not — whitespace
                 # forgiving, case strict, for no stated reason. Divergent normalizers on the two
                 # sides of a comparison is the same defect class this file already fixed twice.
-                over = sorted({_norm(e) for e in eff} - {_norm(x) for x in c["capabilities"]})
+                # VOCABULARY, not identity. `effects` and `capabilities` are both drawn from the
+                # closed effect vocabulary, so `READ` and `read` name the same class — comparing them
+                # with the identity normalizer refused a schema-conformant grant. Over-blocking is a
+                # defect of equal rank here: a gate that refuses correct input teaches the operator
+                # to bypass it. The sink-WIDENING comparison a few lines above stays on `_norm`,
+                # because that one asks fingerprint identity, not vocabulary. Per-site judgment, not
+                # a blanket swap. (cross-family round 3, 2026-08-02.)
+                over = sorted({_norm_vocab(e) for e in eff} - {_norm_vocab(x) for x in c["capabilities"]})
                 if over:
                     out("❌", f"R7 `{name}` grant claims effect(s) {over} outside its registered "
                               f"capabilities {c['capabilities']} — the grant is wider than the class")
@@ -460,13 +606,39 @@ else:
                 out("❌", f"R7 `{name}` grant target {tgt!r} does not match the registered target "
                           f"{c['target']!r} — scope drift between grant and class")
                 fails += 1
-    if fails == 0:
-        skipped = len(grants) - validated
+    skipped = len(grants) - validated
+    if validated == 0:
+        # Same state as the empty-grants branch above, reached differently: every key present was
+        # `declined`/`unset`/`revoked`. A file that records only refusals has granted nothing, and a
+        # refusal must never be the reason a prompt is skipped. UNMEASURED, not verified.
+        print(f"consent-registry: N/A — {skipped} recorded state(s), NONE of them an active grant; "
+              f"nothing granted, keep asking (not a PASS)")
+        no_active_grant = True
+    elif fails == 0:
         note = f" ({skipped} non-grant state(s) skipped)" if skipped else ""
         out("✅", f"R3-R6 all {validated} active grant(s) registered, eligible, unexpired, "
                   f"scope-recorded{note}")
 
 print("----")
-print(f"consent-registry: {'PASS' if fails == 0 else f'{fails} violation(s)'}")
-sys.exit(0 if fails == 0 else 1)
+# The human-facing summary must agree with the typed exit. It previously printed PASS on a run whose
+# own line above said "nothing granted, keep asking (not a PASS)" and whose exit code was 3 — so an
+# operator reading the tail saw an approval that the machine channel was refusing. "Do not grep the
+# prose" binds machines; people read the prose, and a summary that contradicts the verdict is a
+# false green with extra steps. (Caught by hand 2026-08-02 while verifying the exit-3 fix.)
+if fails:
+    print(f"consent-registry: {fails} violation(s)")
+elif no_active_grant:
+    print("consent-registry: UNMEASURED — nothing granted, keep asking (exit 3)")
+else:
+    print("consent-registry: PASS")
+# BROKEN outranks UNMEASURED: a violation is a decided negative, "nothing granted" is merely nothing
+# to join. Both outrank VERIFIED, which stays reachable ONLY by a real join against a real grant.
+if ZERO_CLASSES and not fails:
+    # A live grant against a registry that declares zero classes is an UNREGISTERED grant — R3's own
+    # verdict — which is BROKEN, not "nothing to join". No grant → genuinely nothing to join.
+    if not no_active_grant:
+        print("consent-registry: FAIL — a standing grant exists but the registry declares zero "
+              "classes; every such grant is UNREGISTERED (R3), which is BROKEN, not unmeasured")
+        sys.exit(1)
+sys.exit(1 if fails else (3 if no_active_grant else 0))
 PY

package/scripts/destructive_pre_gate.sh

@@ -41,6 +41,13 @@
 #     payload with a destructive line 1 and a `# noqa: destructive-op` on line 2 exempts both.
 #     Accepted: noqa is self-grantable by design on this advisory surface (same trust channel as
 #     the DESTRUCTIVE_OP_OK env ack) — the hard floor for the irreversible half stays pre-push.
+#   - `git -c alias.<name>='!<shell>' <name>` — the normalizer CONSUMES `-c k=v` (it must: that is
+#     how `git -c core.x=y reset --hard` is caught), and the alias name that follows is not a
+#     destructive row, so arbitrary shell runs CLEAN. Concrete realization of the indirection class
+#     above, named separately because the normalizer is what makes it reachable (terra round 2,
+#     2026-08-01). Not fixed: closing it means interpreting alias payloads, i.e. parsing shell —
+#     over-build for an advisory layer, and squarely inside the deliberate-obfuscation threat model
+#     this guard excludes. It counters SELF-JUSTIFICATION, not evasion.
 #   - Shell-escape reconstruction (`\g\i\t reset --hard`, `$'git' reset`) and quoted-space git -C
 #     paths (`git -C "/tmp/my repo" reset --hard`) — regex-with-normalization cannot dequote like
 #     a shell; a Bash-compatible tokenizer would be over-build for an advisory layer (GPT-round,
@@ -75,7 +82,7 @@ import json,sys
 try: d = json.load(sys.stdin)
 except Exception: sys.exit(0)
 if d.get("tool_name") != "Bash": sys.exit(0)
-sys.stdout.write(d.get("tool_input", {}).get("command", "") or "")
+sys.stdout.buffer.write((d.get("tool_input", {}).get("command", "") or "").encode("utf-8"))
 ' 2>/dev/null) || CMD=""
 fi
 [ -n "$CMD" ] || exit 0
@@ -110,7 +117,13 @@ FLAT=" $(printf '%s' "$JOINED" | tr -d '\r' | tr '\n' ';' | sed 's/;/; /g' \
 # TRAINS that shape ("cwd resets between calls, use absolute paths / git -C"), so the origin
 # defect (a self-justifying model) would most naturally emit exactly it. GPT-round extended the
 # consumed set: --no-pager, -c k=v, -p/-P, and the space-separated --git-dir/--work-tree forms.
-FLAT=$(printf '%s' "$FLAT" | sed -E 's/git( +(-C +[^ ;]+|--git-dir[= ][^ ;]+|--work-tree[= ][^ ;]+|-c +[^ ;]+|--no-pager|-[pP]))+/git/g')
+# Leg-C MED round (2026-08-01) completed the allowlist against `git --help`'s global-option table:
+# the valueless pathspec/behavior toggles (--literal/--glob/--noglob/--icase-pathspecs,
+# --no-optional-locks, --no-replace-objects, --no-lazy-fetch, --no-advice, --bare, --paginate) and
+# the value-carrying --namespace/--super-prefix/--config-env/--exec-path= — any one of which let
+# `git <opt> reset --hard` sail past every git row. --exec-path WITHOUT `=` is deliberately not
+# consumed: bare --exec-path prints and exits, so nothing destructive follows it.
+FLAT=$(printf '%s' "$FLAT" | sed -E 's/git( +(-C +[^ ;]+|--git-dir[= ][^ ;]+|--work-tree[= ][^ ;]+|-c +[^ ;]+|--namespace[= ][^ ;]+|--super-prefix[= ][^ ;]+|--config-env[= ][^ ;]+|--exec-path=[^ ;]+|--no-pager|--no-optional-locks|--no-replace-objects|--no-lazy-fetch|--no-advice|--literal-pathspecs|--glob-pathspecs|--noglob-pathspecs|--icase-pathspecs|--bare|--paginate|-[pP]))+/git/g')
 
 # Dry-run neutralizer: `git clean -fdn` / `--dry-run` is non-destructive; rewrite it to a token no
 # row matches, so the clean row cannot FP on a dry run (Axis-2 #6 — an FP here violates the very
@@ -124,6 +137,16 @@ FLAT=$(printf '%s' "$FLAT" | sed -E 's/git clean( +--?[a-zA-Z][a-zA-Z=-]*)* +(-[
 # alternation sees the canonical spelling (GPT-round; brace-expansion globs stay a residual).
 FLAT=$(printf '%s' "$FLAT" | sed -E 's/(\.\/)+/.\//g')
 
+# Staged-only restore neutralizer (GPT leg-C round, 2026-08-01): `git restore --staged .` only
+# unstages (worktree untouched, re-addable) — the broadened restore-dot row below would FP on it.
+# Neutralize ONLY when --staged is present AND no worktree flag is (staged+worktree IS destructive
+# and the -W/--worktree row catches it). Whole-payload rewrite: a compound payload mixing a
+# staged-only restore with a plain destructive restore is a named residual (rare shape).
+if printf '%s' "$FLAT" | LC_ALL=C grep -qE 'git restore [^|;&]*--staged' \
+   && ! printf '%s' "$FLAT" | LC_ALL=C grep -qE 'git restore [^|;&]*(--worktree|-[a-zA-Z]*W)'; then
+  FLAT=$(printf '%s' "$FLAT" | sed -E 's/git restore /git restore_stagedonly /g')
+fi
+
 # ── Destructive pattern table: regex@@description ─────────────────────────────────────────────
 # Delimiter is @@ because the regexes themselves carry `|` (alternation) — a `|` delimiter
 # truncated every alternation-bearing pattern at split time (caught by the known-pair lanes on
@@ -138,9 +161,9 @@ FLAT=$(printf '%s' "$FLAT" | sed -E 's/(\.\/)+/.\//g')
 PATTERNS=(
   '[ (/]git reset ([^|;&]* )?--hard[ ;]@@git reset --hard discards ALL uncommitted changes irreversibly'
   '[ (/]git clean ([^|;&]* )?(--force[ ;]|-[a-zA-Z]*[fxX][a-zA-Z]*[ ;])@@git clean -f/-x permanently deletes untracked files'
-  '[ (/]git checkout ([^|;&]*-- )?\.\/? @@git checkout . reverts every local modification'
+  '[ (/]git checkout ([^|;&]* )?\.\/? @@git checkout . reverts every local modification'
   '[ (/]git restore ([^|;&]* )?(--worktree|-[a-zA-Z]*W[a-zA-Z]*[ ;])@@git restore --worktree reverts working-tree changes'
-  '[ (/]git restore \.\/? @@git restore . reverts every local modification'
+  '[ (/]git restore ([^|;&]* )?\.\/? @@git restore . reverts every local modification'
   '[ (/]git push ([^|;&]* )?(--force(-with-lease(=[^ ;]+)?)?[ ;]|-[a-zA-Z]*f[a-zA-Z]*[ ;]|\+[^ ;]+[ ;])@@force push rewrites remote history (pre-push hook will also gate this — enumerate first)'
   '[ (/]git branch ([^|;&]* )?(-[a-zA-Z]*D[ ;]|--delete( [^|;&]*)? --force[ ;]|--force( [^|;&]*)? --delete[ ;])@@git branch -D force-deletes a branch without merge check'
   '[ (/]git stash (drop|clear)[ ;]@@git stash drop/clear permanently discards stashed work'
@@ -162,7 +185,11 @@ for entry in "${PATTERNS[@]}"; do
 done
 [ -n "$hits" ] || exit 0
 
-hits="${hits}      Before running: is uncommitted/stashed state enumerated (git status / predelete_check.sh)?
+hits="${hits}      Advisory timing: this context reaches the model on the NEXT turn — the call may have
+      already run (pre-action blocking = FH_DESTRUCTIVE_BLOCK=1). If it ran un-enumerated,
+      recover FIRST: git status / git stash list / git reflog /
+      \`bash templates/predelete_check.sh <repo> [base]\` (repo-root relative — leg-C MED: an
+      uncited healing path is a dead pointer to the session that needs it mid-incident).
       Destructive-Op Gate order: enumerate → recover → destroy — never destroy-then-check.
       Intentional and reviewed → re-run with trailing \`# noqa: destructive-op\`."
 

package/scripts/package_coverage_check.sh

@@ -67,6 +67,16 @@ ACCEPTED_ABSENT=(
   ".claude/regression/probes.md"
   "scripts/sync-to-be.sh"
   "scripts/sync_guard_check.sh"
+  # Return path (companion store → hub) and its anchor. Same reason as the forward path above: the
+  # transport only means anything on a machine that HAS the operator's companion store, and shipping
+  # it would hand every consumer a script that resolves `$BE` to nothing. selfcheck references the
+  # anchor but guards on the subject's presence, so package mode SKIPs rather than falling through.
+  "scripts/sync-from-be.sh"
+  "scripts/sync_from_be_lanes.sh"
+  # Its only input is `.claude/regression/probes.md`, itself ACCEPTED_ABSENT above (a consumer's
+  # regression run must not compare against this harness's probe set). Shipping the reader without
+  # its corpus would put a script in the package that can only ever report "instrument error".
+  "scripts/probe_scope_check.sh"
 )
 
 out=$(python3 - "${ACCEPTED_ABSENT[@]}" <<'PY'

package/scripts/pipe_verdict_guard.sh

@@ -42,6 +42,12 @@
 #   auto-approve the flagged command past the permission system — the guard must never grant what
 #   it exists to question. Block mode keeps the exit-2 path (stderr → fed to Claude, call blocked);
 #   on exit 2 stdout/JSON is ignored by contract, so stderr is the correct channel there.
+#   NAMED RESIDUAL (terra round 3, 2026-08-01) — a shell COMMENT inside a wrapper group hides the
+#   closer from R2's required-closer branch, so `| (tail -5; # note<newline>); rc=$?` MISSES.
+#   Accepted, not fixed, and the reason is the trade direction: stripping `#…` in the flatten is
+#   quote-blind, so `curl "https://x/a#frag" | tail -3; rc=$?` — which HITs today, measured — would
+#   become a miss. That swaps a contrived miss for a realistic one. Recall loss on a shape that does
+#   not occur in interactively-composed commands is the cheaper side; lane-pinned as a known miss.
 #   NAMED RESIDUAL (cross-family, 2026-07-31): with python3 broken/absent, payload extraction
 #   yields CMD="" and the guard exits 0 even under FH_PIPE_VERDICT_BLOCK=1 — block mode fails
 #   open on a dead interpreter. Accepted, not fixed: the Bash-call surface is re-runnable
@@ -67,7 +73,7 @@ import json,sys
 try: d = json.load(sys.stdin)
 except Exception: sys.exit(0)
 if d.get("tool_name") != "Bash": sys.exit(0)
-sys.stdout.write(d.get("tool_input", {}).get("command", "") or "")
+sys.stdout.buffer.write((d.get("tool_input", {}).get("command", "") or "").encode("utf-8"))
 ' 2>/dev/null) || CMD=""
 fi
 [ -n "$CMD" ] || exit 0
@@ -84,7 +90,25 @@ add() { hits="${hits}  ⚠️  PIPE-VERDICT $1
 # every multi-line command missed — which is the worse half, because the invocations that actually
 # recur here are multi-line. A newline is a statement separator, so `; ` is the faithful substitute.
 # (Found by the Axis-2 adversarial pass on this guard, 2026-07-31; lanes A* pin it.)
-FLAT=$(printf '%s' "$CMD" | tr '\n' ';' | sed 's/;/; /g')
+# EXCEPT where the shell itself continues the statement (GPT leg-C MED, 2026-08-01): a newline
+# after `|`/`&&`/`||` or a backslash-newline is a CONTINUATION, not a separator — the blanket
+# `\n → ;` rewrite turned `cmd |\n tail; echo $?` into `cmd | ; tail…`, un-matching R2 on the
+# exact multi-line shape the flatten exists to catch. Join those first (backslash-newline joins
+# with the EMPTY string, matching shell semantics — the destructive_pre_gate R4 lesson), then
+# separate the remaining newlines. \001 is the newline sentinel (never occurs in command text).
+# terra round (2026-08-01): `|&` continuation and newline-after-`(`/`{` join too — both continue
+# the statement in the shells this guard serves. KNOWN FP INHERITED: the join cannot see quotes,
+# so a QUOTED multi-line string containing `false |\ntail; echo $?` now reads as a live pipeline
+# (mention-as-data — same advisory-tolerated class destructive_pre_gate documents; a
+# quote-aware parser is over-build for an advisory layer). Lane-pinned as expected-HIT.
+NL=$'\001'
+FLAT=$(printf '%s' "$CMD" | tr '\n' "$NL" | sed \
+  -e "s/\\\\${NL}[[:space:]]*//g" \
+  -e "s/|&[[:space:]]*${NL}[[:space:]]*/|\& /g" \
+  -e "s/|[[:space:]]*${NL}[[:space:]]*/| /g" \
+  -e "s/&&[[:space:]]*${NL}[[:space:]]*/\&\& /g" \
+  -e "s/\([({]\)[[:space:]]*${NL}[[:space:]]*/\1 /g" \
+  -e "s/${NL}/;/g" -e 's/;/; /g')
 
 # ── R1 — PIPESTATUS under zsh: the value is empty, so the verdict is absent. ──────────────────
 # Brace-optional: zsh accepts `$PIPESTATUS[0]` as well, and the brace-anchored form missed it (lane B*).
@@ -99,8 +123,24 @@ fi
 # `set -o pipefail` in the same command makes `$?` after a pipeline correct — not a finding.
 NORM=$(printf '%s' "$FLAT" | sed 's/||/__OR__/g')
 if ! printf '%s' "$NORM" | grep -qE 'set -o pipefail|set -[a-zA-Z]*o[a-zA-Z]* pipefail'; then
+  # `[({]?` — a subshell/group wrapper around the filter (`| (tail -5); echo $?`) is the same
+  # verdict mistake one paren deeper; without it the wrapper bypassed R2 (GPT leg-C MED, 2026-08-01).
+  # The closing paren rides in the arg class (`)` ∈ [^|;&]) or the explicit `[)}]?` for the no-arg form.
+  # `&?` after the pipe — `|&` (stderr-merged pipeline, zsh/bash4) is the same verdict mistake
+  # with a merged stream; it evaded the whitespace-anchored matcher (terra round, 2026-08-01).
+  # TWO BRANCHES, and the wrapped one REQUIRES A CLOSER (terra round 2, 2026-08-01): with the
+  # closer optional, `| (tail -5; test -n "$x"); echo $?` matched on the `;` INSIDE the group —
+  # but there `$?` is `test`'s status, which is exactly right, so the warning was a false positive
+  # the pre-wrapper matcher never produced. The filter must be the wrapper's FINAL command:
+  #   (a) bare filter, then a statement separator
+  #   (b) wrapper open · optional earlier statements ending in `;` · filter · args (no `;`, no
+  #       closer chars) · optional `;` · REQUIRED `)`/`}`
+  # Branch (b)'s optional `([^|&]*;)?` prefix keeps `| (sort; tail -5); echo $?` caught — the
+  # filter need not be the group's FIRST command, only its LAST — while the `;` requirement keeps
+  # the filter at a statement start, so `| (echo cat); rc=$?` does not match through a bare word.
+  _F='(tail|head|cat|less|more)'
   if printf '%s' "$NORM" \
-     | grep -qE '\|[[:space:]]*(tail|head|cat|less|more)([[:space:]][^|;&]*)?[[:space:]]*[;&].*\$\?'; then
+     | grep -qE "\|&?[[:space:]]*(${_F}([[:space:]][^|;&]*)?|[({]([^|&]*;)?[[:space:]]*${_F}([[:space:]][^|;&()}]*)?[[:space:]]*;?[[:space:]]*[)}])[[:space:]]*[;&].*\\\$\?"; then
     add "R2 \$? after a display filter" \
         "\$? holds the filter's status (tail/head/cat almost always succeed), not the command's — a FAILED check reads as 0. Capture first: \`out=\$(cmd 2>&1); rc=\$?\` then print \"\$out\" | tail."
   fi

package/scripts/selfcheck.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # selfcheck.sh — mandatory-pass (deterministic) checks on FH's own executable surface.
-# Class: mandatory-pass (harness_6axis_framework.md §Axis 5 check classes) — blocks on fail.
+# Class: mandatory-pass (harness_6axis_framework.md §Check classes) — blocks on fail.
 # Scope: executables shipped via npm files[] + the bash infra driving the FH gate chain.
 # NOT syntax-only any more, and this line used to say it was. Syntax checks (node --check / bash -n)
 # are only the first section; behavioural lane suites follow and they DO have side effects and
@@ -253,7 +253,19 @@ for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe
   if [ ! -f scripts/session_close_check.sh ]; then
     echo "SKIP  ${_anchor##*/} (subject scripts/session_close_check.sh absent)"
   elif [ -f "$_anchor" ]; then
-    if ! bash "$_anchor"; then
+    # Preserve the anchor's two failure CLASSES instead of flattening them into one `fail=1`.
+    # An anchor exits 3 when a fixture's premise never obtained — "this run's verdicts prove
+    # nothing" — which is a different instruction to whoever reads the CI summary than exit 1's
+    # "the gate is broken". Collapsing them here would rebuild, at the only wired caller, the
+    # triage ambiguity the anchors' own exit codes exist to remove (Wave-3, 2026-08-02).
+    # 3 and not 2: bash itself returns 2 on a syntax error, so a rotted anchor must not be able to
+    # impersonate a fixture premise failure. Both classes still set fail=1 — a fixture error is a
+    # failed run, it is just a differently-diagnosed one.
+    bash "$_anchor"; _rc=$?
+    if [ "$_rc" -eq 3 ]; then
+      echo "FIXTURE ERROR  ${_anchor##*/}: a lane premise never obtained — its verdicts prove nothing (exit 3, not a gate failure)"
+      fail=1
+    elif [ "$_rc" -ne 0 ]; then
       fail=1
     fi
   else
@@ -263,6 +275,109 @@ for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe
   fi
 done
 
+# sync_guard_check.sh — same anchor contract, wired here for the first time (2026-08-02). It had NO
+# automated caller at all: a known-pair anchor for the destination-newer guard that only ever ran
+# when a human remembered to type it. "A guard nobody re-tests degrades into a comment" is that
+# file's own opening argument, and it applied to the anchor itself. Guarded on its subject's
+# presence because the npm package ships a narrower surface than the source tree.
+if [ ! -f scripts/sync-to-be.sh ]; then
+  echo "SKIP  sync_guard_check.sh (subject scripts/sync-to-be.sh absent)"
+elif [ -f scripts/sync_guard_check.sh ]; then
+  bash scripts/sync_guard_check.sh; _rc=$?
+  if [ "$_rc" -eq 3 ]; then
+    echo "FIXTURE ERROR  sync_guard_check.sh: a lane premise never obtained — its verdicts prove nothing (exit 3, not a guard failure)"
+    fail=1
+  elif [ "$_rc" -ne 0 ]; then
+    fail=1
+  fi
+else
+  echo "FAIL  sync_guard_check.sh: sync-to-be.sh present but its anchor is missing"
+  fail=1
+fi
+
+# probe_scope_check.sh — its known-pair controls. Wired here because the probe set is hand-maintained and
+# nothing else enforces its own anti-stale rule: a heading-direction
+# bug scored a 7-probe section as UNMEASURED (98% vs the true 51%), then a narrow anchor regex reported
+# 7 live probe scopes as stale. Control B now walks EVERY scope in probes.md and fails closed (exit 3,
+# number withheld) when one no longer resolves — which is also the anti-stale rule probes.md already
+# states for itself, finally given a checker.
+# Package mode is decided by the SUBJECT's own absence. The first draft used `.claude/rules` as the
+# discriminator on the belief that it does not ship — measured false: package.json files[] carries
+# `.claude/rules/fh_4axis_gate.md`, so in an installed package `.claude/rules` EXISTS while the probe
+# corpus does not. That made the SKIP arm unreachable and every consumer's `npm test` hard-fail with a
+# message misdiagnosing the package as a source tree. Avoiding a silent pass is not a licence to
+# over-block the normal case. `scripts/probe_scope_check.sh` is ACCEPTED_ABSENT and genuinely never
+# ships, so its absence is the one honest package signal here.
+if [ ! -f scripts/probe_scope_check.sh ] && [ ! -f .claude/regression/probes.md ]; then
+  echo "SKIP  probe_scope_check.sh (package mode: neither the instrument nor its corpus ships)"
+elif [ ! -f .claude/regression/probes.md ]; then
+  echo "FAIL  probe_scope_check.sh: source tree but .claude/regression/probes.md is missing — the check cannot run — UNVERIFIED, not clean"
+  fail=1
+elif [ -f scripts/probe_scope_check.sh ]; then
+  bash scripts/probe_scope_check.sh --self-test >/dev/null 2>&1; _rc=$?
+  if [ "$_rc" -eq 3 ]; then
+    echo "FAIL  probe_scope_check.sh: CONTROL FAILED — a probe Scope no longer resolves to a section (the probe set no longer says what it defends)"
+    bash scripts/probe_scope_check.sh --self-test 2>&1 | grep -E "STALE|NOFILE|control" | head -12
+    fail=1
+  elif [ "$_rc" -ne 0 ]; then
+    echo "FAIL  probe_scope_check.sh: self-test exited $_rc"
+    fail=1
+  else
+    echo "PASS  probe_scope_check.sh (known-pair + scope-resolution controls hold)"
+  fi
+else
+  echo "FAIL  probe_scope_check.sh: probe set present but the scope checker is missing"
+  fail=1
+fi
+
+# ④-e dispatch-log reconciliation + its tally hook. Wired in the same commit that ships them: the
+# obligation they mechanize lost 20/20 in a single session, so leaving the checker itself unrun
+# would be the same defect one layer up.
+if [ -f scripts/test_dispatch_log_lanes.sh ]; then
+  if ! bash scripts/test_dispatch_log_lanes.sh >/dev/null 2>&1; then
+    echo "FAIL  test_dispatch_log_lanes.sh: the dispatch-log reconciliation would mis-report"
+    bash scripts/test_dispatch_log_lanes.sh 2>&1 | tail -14
+    fail=1
+  else
+    echo "PASS  test_dispatch_log_lanes.sh (date-spelling + verdict + tally-hook lanes)"
+  fi
+fi
+
+# selfcheck's own subject-presence discriminators. Every other guard under scripts/ has a lane suite;
+# this decision had none, and it shipped two mis-routings in one session — a two-arm form that fell
+# through in silence, then a package discriminator keyed on a file that actually ships. Both are
+# known-POSITIVEs in the suite, so neither can come back green.
+if [ -f scripts/test_selfcheck_state_lanes.sh ]; then
+  if ! bash scripts/test_selfcheck_state_lanes.sh >/dev/null 2>&1; then
+    echo "FAIL  test_selfcheck_state_lanes.sh: a subject-presence discriminator would mis-route"
+    bash scripts/test_selfcheck_state_lanes.sh 2>&1 | tail -12
+    fail=1
+  else
+    echo "PASS  test_selfcheck_state_lanes.sh (four input states + both shipped mis-routings)"
+  fi
+fi
+
+# sync_from_be_lanes.sh — the RETURN path's anchor. Wired in the same change that ships it: the
+# script had an operator-side caller (a SessionStart hook outside this repo) while its 70 lanes had
+# NO caller anywhere, which is the shape this repo keeps re-finding — a transport that writes into
+# the hub, guarded by a suite nothing runs. Same subject-presence idiom as the block above: the
+# subject is operator-private and does not ship, so package mode legitimately skips; subject present
+# with the anchor gone is a deleted calibration, not a skip.
+if [ ! -f scripts/sync-from-be.sh ]; then
+  echo "SKIP  sync_from_be_lanes.sh (subject scripts/sync-from-be.sh absent)"
+elif [ -f scripts/sync_from_be_lanes.sh ]; then
+  if ! bash scripts/sync_from_be_lanes.sh >/dev/null 2>&1; then
+    echo "FAIL  sync_from_be_lanes.sh: return-path lanes failed"
+    bash scripts/sync_from_be_lanes.sh 2>&1 | tail -20
+    fail=1
+  else
+    echo "PASS  sync_from_be_lanes.sh (return-path lanes)"
+  fi
+else
+  echo "FAIL  sync_from_be_lanes.sh: sync-from-be.sh present but its anchor is missing"
+  fail=1
+fi
+
 # Referenced-path existence is a source-tree check. The npm package intentionally
 # ships a narrower runtime surface, so package-mode selfcheck skips this section.
 if [ -d ".claude/rules" ]; then