@chrono-meta/fh-gate 1.4.83 → 1.4.85

package/scripts/session_close_check.sh

@@ -33,7 +33,13 @@ UNPUSHED=$(git -C "$FH" log --oneline @{u}.. 2>/dev/null | wc -l | tr -d ' ')
 
 # ①-b open-PR sweep (surface-not-auto — requires gh; skip silently offline)
 if command -v gh >/dev/null 2>&1; then
-  PRS=$(gh pr list --author "@me" --state open --json number 2>/dev/null | grep -c '"number"' || true)
+  # `gh --json` emits COMPACT single-line JSON when piped, so counting LINES returned 1 for ANY
+  # non-zero number of open PRs — the sweep hid every PR after the first, in the exact step CLAUDE.md
+  # pairs with count consistency. Count OCCURRENCES instead. Measured 2026-08-02 with a known pair:
+  # `[{"number":227},{"number":226},{"number":225}]` → old 1, new 3; `[]` → 0 both ways — which is
+  # why an environment with zero open PRs can never surface this, and why the 0-case alone is not a
+  # calibration. Observed live the same day: 2 open PRs reported as 1.
+  PRS=$(gh pr list --author "@me" --state open --json number 2>/dev/null | grep -o '"number"' | wc -l | tr -d ' ' || true)
   [ "${PRS:-0}" -gt 0 ] && echo "⚠️  ①-b $PRS open PR(s) by you — classify: self-mergeable vs awaiting-external"
 fi
 
@@ -111,6 +117,57 @@ if [ -n "$LAST_TAG" ] && [ -f "$FH/package.json" ]; then
   fi
 fi
 
+# ④-e DISPATCH-LOG RECONCILIATION — mechanical, because prose failed completely.
+# CLAUDE.md makes an invocation-log entry MANDATORY immediately after any custom sub-agent
+# invocation (it feeds the 60/40 promotion gate and the UAP loop). Measured 2026-08-02: a single
+# session dispatched 20+ subagents and logged ZERO — not a marginal lapse, a total one, in the same
+# session that RECOVERED that very log file from a branch about to be deleted. An obligation that
+# loses 20 times out of 20 is not under-emphasised; it is unmechanized. Per this repo's own rule
+# (1-2 occurrences -> prose; N>=3 or a repeat on another surface -> mechanize), this is well past it.
+#
+# The check is a RECONCILIATION, not an auto-writer. A hook cannot fill `outcome` or `evidence`
+# without fabricating judgment, and a fabricated log entry is worse than a missing one — it would
+# poison the promotion gate with invented outcomes. So the hook only TALLIES (SubagentStop appends a
+# date line) and this step compares the tally against today's entries.
+#
+# It deliberately does NOT demand 1:1. Consolidating twenty challenger rounds into one entry with
+# measured counts is better bookkeeping than twenty stubs, and punishing it would train stub-spam.
+# What it catches is the failure that actually happened: dispatches occurred and NOTHING was written.
+# ABSENCE IS NOT ZERO. The tally comes from a SubagentStop hook configured in `.claude/settings.json`,
+# which is GITIGNORED by design (it also carries local permissions). So a fresh clone, another
+# machine, or a wiped settings file has no hook — and without this branch the check would read an
+# empty tally as "no dispatches today" and pass in silence. That is the exact fail-open this whole
+# step exists to close, re-created inside it; caught before commit by asking where the tally comes
+# from. Installable snippet: templates/subagent-tally-hook.json.
+TALLY="$FH/tracks/_meta/.subagent_dispatch_tally"
+LOG="$FH/knowledge/shared/learnings/subagent_invocations_log.yaml"
+HOOK_OK=0
+if [ -f "$FH/.claude/settings.json" ]; then
+  grep -q '"SubagentStop"' "$FH/.claude/settings.json" 2>/dev/null && HOOK_OK=1
+fi
+if [ "$HOOK_OK" -eq 0 ]; then
+  echo "⚠️  ④-e dispatch log NOT MEASURED — no SubagentStop tally hook in .claude/settings.json"
+  echo "     (that file is gitignored, so a fresh clone has none). An unmeasured dispatch count is"
+  echo "     NOT a count of zero. Install: templates/subagent-tally-hook.json → .claude/settings.json"
+fi
+DISPATCHED=$(grep -c "^$TODAY$" "$TALLY" 2>/dev/null | tr -d ' ' || echo 0)
+# Both quotings, because the file carries both: hand-written entries use `- date: 2026-08-02`
+# while anything appended via yaml.dump renders `- date: '"'"'2026-08-02'"'"'`. Matching one form counted
+# half the entries as absent — a divergent-normalizer miss inside the check that exists to catch
+# missing records. Known-pair calibrated below in test_dispatch_log_lanes.sh.
+LOGGED=$(grep -cE "^- date: *'?$TODAY'?" "$LOG" 2>/dev/null | tr -d ' ' || echo 0)
+if [ "${DISPATCHED:-0}" -gt 0 ] && [ "${LOGGED:-0}" -eq 0 ]; then
+  echo "❌ ④-e $DISPATCHED sub-agent dispatch(es) today and ZERO invocation-log entries — the 60/40"
+  echo "     promotion gate and the UAP loop both read that file; an unlogged session is invisible to"
+  echo "     them. Append to knowledge/shared/learnings/subagent_invocations_log.yaml (consolidated"
+  echo "     per class is fine — record counts and outcomes, not one stub per dispatch)."
+  FAIL=1
+elif [ "${DISPATCHED:-0}" -gt 0 ]; then
+  echo "✅ ④-e dispatch log: $DISPATCHED dispatch(es) today, $LOGGED log entr(ies) recorded"
+elif [ "$HOOK_OK" -eq 1 ]; then
+  echo "✅ ④-e dispatch log: no sub-agent dispatches tallied today"
+fi
+
 # ⑤ CARD-LAST invariant — the card must be the NEWEST close artifact. A card older than
 # fh_completed / signal files written this session = ⑤ ran before ①–④ finished (the bug class).
 if [ -f "$CARD" ]; then
@@ -134,6 +191,51 @@ if [ -f "$CARD" ]; then
   else
     echo "✅ ⑤ card is the newest close artifact (card-last holds)"
   fi
+
+  # ⑤ tie probe (ADVISORY — never changes the verdict, never blocks).
+  # `-newer` is a STRICT comparison, so an artifact whose mtime exactly equals the card's is invisible
+  # to the check above: ⑤ reports card-last holds when the ordering was never actually established.
+  # That is the same blind spot that made the ⑤-N *lane* flake in CI on 2026-08-02, one layer down —
+  # and the lane repair hardened the fixture, not this production path, which still runs against
+  # ordinary session writes with no deterministic separation.
+  # Why advisory and not a verdict: tightening ⑤ to treat a tie as a violation would BLOCK a healthy
+  # close whose two writes happened to land in one clock tick, and an over-blocking close gate trains
+  # the override reflex that disarms it (the same reasoning the ⑤-P lane already encodes). Whether
+  # real closes ever tie is UNMEASURED — so this line measures it instead of guessing at a fix.
+  # Diagnosis, not prevention; promote it to a verdict only on evidence that ties actually occur.
+  #
+  # COST, measured before shipping (this runs on every push via the pre-push hook, so an unbounded
+  # per-file cost is a live regression, not a design risk). `! -newer "$CARD"` does the only safe
+  # narrowing: strictly-newer files are already reported by ⑤ above, so the in-loop "is it newer?"
+  # check is redundant and dropped — one fork per candidate, not two.
+  # A `-mtime -1` bound was tried and REMOVED: it scopes the window to *now*, but the invariant is
+  # anchored to the *card*, and this script runs on every push — routinely against a card written
+  # days ago. Two artifacts tied with an old card then fall outside the window and ⑤ reports
+  # card-last holds on an ordering never established, with the probe scoped out of seeing it. Speed
+  # that hides the thing being measured is not speed. Measured cost of the correct form on the
+  # current corpus: 140 candidates, 0.57s. Linear in tracks/_meta; revisit if that reaches thousands.
+  #
+  # Both emitted lines start with the same literal `⚠️  ⑤ tie` on purpose — the pre-push hook greps
+  # for it, and when the two lines carried different prefixes the hook surfaced the warning while
+  # dropping the sentence that says what to do about it, leaving a reader with only "⑤'s strict
+  # comparison cannot see it" — precisely the misreading the summary line exists to prevent.
+  # Keep the shared prefix; test_session_close_lanes.sh ⑤-T asserts the hook's exact pattern.
+  TIES=0
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    [ -n "$(find "$CARD" -newer "$f" 2>/dev/null)" ] && continue      # strictly older → fine
+    TIES=$((TIES + 1))
+    echo "⚠️  ⑤ tie: ${f#"$FH"/} shares the card's exact mtime — ⑤'s strict comparison cannot see it"
+  done <<EOF
+$(find "$FH/tracks/_meta" -maxdepth 1 -type f \( -name "fh_completed_*.md" -o -name "fh_signal_*.md" \) ! -newer "$CARD" 2>/dev/null)
+EOF
+  # What a recurring tie would actually license (cross-family correction, 2026-08-02): NOT making ⑤'s
+  # comparison non-strict. Ties do not show the comparison is too strict — they show **mtime is not a
+  # reliable witness of close ordering on this machine**. A non-strict ⑤ would convert every same-tick
+  # healthy close into a false block, which is the failure mode ⑤-P exists to prevent. The fix that
+  # ties would justify is an explicit ordering record (the card writing a marker ①–④ can be compared
+  # against) or a deterministic close write sequence — not a looser comparison.
+  [ "$TIES" -gt 0 ] && echo "⚠️  ⑤ tie → $TIES artifact(s) ordering-ambiguous. If this recurs, mtime is not a sound ordering witness here; the fix is an explicit ordering record, NOT making ⑤ non-strict (that would false-block every healthy same-tick close)."
 else
   echo "❌ ⑤ session card missing: $CARD"
   FAIL=1

package/scripts/stale_clone_guard.sh

@@ -41,7 +41,7 @@ import json,sys
 try: d = json.load(sys.stdin)
 except Exception: sys.exit(0)
 if d.get("tool_name") != "Write": sys.exit(0)
-sys.stdout.write(d.get("tool_input", {}).get("file_path", "") or "")
+sys.stdout.buffer.write((d.get("tool_input", {}).get("file_path", "") or "").encode("utf-8"))
 ' 2>/dev/null) || FILE=""
 [ -n "$FILE" ] || exit 0
 
@@ -68,13 +68,55 @@ MARKER="$MARKER_DIR/$(printf '%s' "$ROOT" | cksum | cut -d' ' -f1)-$(date +%Y%m%
 [ -e "$MARKER" ] && exit 0
 
 UPSTREAM=$(git -C "$ROOT" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null) || exit 0
-REMOTE="${UPSTREAM%%/*}"   # fetch the remote @{u} actually tracks, not a hardcoded origin (GPT pass)
+# Remote name resolution (leg-C LOW, 2026-08-01): `${UPSTREAM%%/*}` truncates a remote whose NAME
+# carries `/` (git accepts them via config even though `git remote add` rejects them) — `a/b/main`
+# became remote `a`, the fetch failed, and the guard went silently inert on exactly that clone.
+# `%(upstream:remotename)` is git's own parse; the cut stays as fallback for git versions without it.
+_HEAD_REF=$(git -C "$ROOT" symbolic-ref -q HEAD 2>/dev/null) || _HEAD_REF=""
+REMOTE=""
+[ -n "$_HEAD_REF" ] && REMOTE=$(git -C "$ROOT" for-each-ref --format='%(upstream:remotename)' "$_HEAD_REF" 2>/dev/null | head -1)
+[ -n "$REMOTE" ] || REMOTE="${UPSTREAM%%/*}"   # fallback; never a hardcoded origin (GPT pass)
 [ -n "$REMOTE" ] || exit 0
 
 if [ "${FH_STALE_CLONE_NO_FETCH:-0}" != "1" ]; then
-  # Bounded fetch: GIT_TERMINAL_PROMPT=0 kills the credential-prompt hang class; the hook-level
-  # timeout is the hard bound for wedged transports (macOS ships no GNU timeout).
-  GIT_TERMINAL_PROMPT=0 git -C "$ROOT" fetch -q "$REMOTE" 2>/dev/null || exit 0
+  # Internally-bounded fetch (leg-C MED, 2026-08-01): the previous hard bound was the RUNNER's
+  # hook timeout (20s), which kills the whole guard — preempting the exit-0 contract AND skipping
+  # the marker write, so a wedged transport re-stalled EVERY Write for the rest of the day
+  # (20s × N calls, a session-killer). The guard now owns its bound: fetch in the background,
+  # poll, and on expiry kill the fetch, ARM the day-throttle, exit 0. Arming on timeout is a
+  # deliberate trade: one silent day on a broken-network machine (fail-open, the documented
+  # degrade direction) beats a stall on every file creation. This is NOT the attempt-marker the
+  # GPT pass rejected — that armed on every early exit; this arms only after a full budget spent
+  # against a wedged transport. GIT_TERMINAL_PROMPT=0 still kills the credential-prompt class.
+  # Budget: tenths of a second; default 150 (15s) stays under the snippet's 20s runner timeout.
+  # CAPPED at 150 (terra round, 2026-08-01): an env-supplied budget > the runner timeout would
+  # restore the exact runner-preemption this bound exists to remove. (No boundary lane on purpose
+  # — it would idle its full 15s by construction; the cap is these three lines.)
+  # LENGTH-first, then value (terra round 2, 2026-08-01): an all-digit literal wider than the
+  # shell's integer width makes `[ "$x" -gt 150 ]` itself an ERROR ("integer expression expected" /
+  # "number truncated"), so the numeric cap never ran and the value stayed unnormalized. Digits are
+  # capped at 3 (max 999) before any arithmetic touches the value — safe in bash 3.2 and zsh alike.
+  _BUDGET="${FH_STALE_CLONE_FETCH_BUDGET_TENTHS:-150}"
+  case "$_BUDGET" in ''|*[!0-9]*) _BUDGET=150 ;; esac
+  [ "${#_BUDGET}" -gt 3 ] && _BUDGET=150
+  [ "$_BUDGET" -gt 150 ] && _BUDGET=150
+  # stdout AND stderr to /dev/null: the child inherits this hook's stdout pipe, and a
+  # still-running child holding it open would stall the hook runner past our own exit.
+  GIT_TERMINAL_PROMPT=0 git -C "$ROOT" fetch -q "$REMOTE" >/dev/null 2>&1 &
+  _FPID=$!
+  _t=0
+  while kill -0 "$_FPID" 2>/dev/null && [ "$_t" -lt "$_BUDGET" ]; do
+    sleep 0.1; _t=$((_t+1))
+  done
+  if kill -0 "$_FPID" 2>/dev/null; then
+    # No wait after the kill: a shell-script transport defers TERM until its foreground child
+    # exits (measured: the lane's wedge shim held a wait for the full 30s hang). The child is
+    # reparented at our exit; TERM is best-effort cleanup, the BOUND is the contract.
+    kill "$_FPID" 2>/dev/null || true
+    : > "$MARKER" 2>/dev/null || true
+    exit 0
+  fi
+  wait "$_FPID" 2>/dev/null || exit 0
 fi
 
 BEHIND=$(git -C "$ROOT" rev-list --count 'HEAD..@{u}' 2>/dev/null) || exit 0
@@ -85,7 +127,8 @@ case "$BEHIND" in ''|*[!0-9]*) exit 0 ;; esac
 MSG="  ⚠️  STALE-CLONE $ROOT is behind $UPSTREAM by $BEHIND commit(s).
       Building on a stale clone manufactures duplicates of work that already exists upstream
       (measured: a 46-PR-behind clone rebuilt an existing lane, 2026-07-31).
-      Before creating new files here: git -C $ROOT pull --ff-only  (or rebase your branch).
+      Advisory timing: this notice arrives with the Write already evaluated — reconcile NOW,
+      before the next file: git -C '$ROOT' pull --ff-only  (or rebase your branch).
       found→extend applies at repo level too — check what upstream already has."
 
 if json_out=$(printf '%s' "$MSG" | PYTHONIOENCODING=utf-8 python3 -c '

package/scripts/substrate_jump_detector.sh

@@ -55,6 +55,27 @@ EOF
 echo "   → run the shed/advance pass: re-check capability-compensating scaffolding against the new"
 echo "     substrate (sonnet_floor_doctrine.md §durable-mechanization — shed what the model no longer"
 echo "     needs, advance what the new substrate enables). Removals go through the 4-axis gate."
+# Until 2026-08-02 the line above WAS the whole pass: an instruction with no instrument behind it, so
+# nothing measured whether a rule still earned its residency. It now hands off to something runnable.
+if [ ! -f "$FH/scripts/probe_scope_check.sh" ]; then
+  echo "   (probe-scope check NOT run — scripts/probe_scope_check.sh absent. Expected in the npm"
+  echo "    package, which ships neither the script nor its probe set; in a SOURCE checkout it is an"
+  echo "    instrument gap, not a skip — selfcheck fails on exactly that state.)"
+else
+  echo ""
+  echo "   ── probe Scope resolution (bash scripts/probe_scope_check.sh) ──"
+  # Capture, THEN branch on rc — a pipe here would report the pipe's status, and a `sed` window keyed
+  # on a line the tool no longer prints would swallow the whole result silently.
+  _ps_out=$(bash "$FH/scripts/probe_scope_check.sh" 2>&1); _ps_rc=$?
+  if [ "$_ps_rc" -ne 0 ]; then
+    echo "   ⚠️  probe-scope check FAILED (exit $_ps_rc) — a probe points at a section that is not there."
+    printf '%s\n' "$_ps_out" | sed 's/^/      /'
+  else
+    printf '%s\n' "$_ps_out" | grep -E 'control B|✅' | sed 's/^/   /'
+  fi
+  echo "   This says the probe set still points at real sections — NOT how much of the asset is"
+  echo "   defended. Coverage measurement is unsolved; do not read a green check as 'fully probed'."
+fi
 
 printf '%s\n' "$CURRENT" > "$STATE"
 exit 0