@chrono-meta/fh-gate 1.4.84 → 1.4.86

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.84",
+      "version": "1.4.86",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.84",
+      "version": "1.4.86",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/CLAUDE.md

@@ -595,10 +595,18 @@ Default operation is a **standard interactive session**. Agent dispatch (single
 
 Mapped paths: check `auto_project_mapping.md` or `find ~/projects -maxdepth 1 -type d` for actuals.
 
-**Invocation log obligation (always-loaded — do not rely on recall)**: immediately after any custom
-sub-agent invocation, append to `knowledge/shared/learnings/subagent_invocations_log.yaml` (8 fields ·
-outcome: `accepted`/`partial`/`rejected`/`sustained` — `sustained` = decided NOT to invoke, also recorded).
-This feeds the 60/40 promotion gate + UAP loop; detail: `knowledge/shared/rules/operations.md`.
+**Invocation log obligation — now mechanically reconciled, not recall-dependent**: immediately after
+any custom sub-agent invocation, append to `knowledge/shared/learnings/subagent_invocations_log.yaml`
+(8 fields · outcome: `accepted`/`partial`/`rejected`/`sustained` — `sustained` = decided NOT to invoke,
+also recorded). This feeds the 60/40 promotion gate + UAP loop; detail:
+`knowledge/shared/rules/operations.md`.
+**Floor (2026-08-02)**: a `SubagentStop` hook tallies every dispatch and `session_close_check.sh` ④-e
+blocks a close push when dispatches happened and the day's entries are ZERO. Consolidating a class of
+dispatches into one entry with measured counts is fine and is not penalised — the check catches the
+total miss, not imperfect bookkeeping. **Why it needed a floor**: this line was prose-only and a single
+session dispatched 20+ subagents and logged none of them, in the same session that recovered this very
+log file from a branch queued for deletion. The hook only tallies; it never writes an entry, because a
+fabricated `outcome`/`evidence` would poison the promotion gate worse than a missing one.
 
 ### Context Card — Required Format for Dispatch
 ```

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -812,3 +812,59 @@
     whether an agent can locate it. Both arms independently cited the same residual (the paths: trigger is a READ,
     so a from-scratch Write never loads the detail rule), which is exactly the path the probe encodes. Method costs
     ~2 min/section and replaces the coverage number that was cut for being wrong four times.'
+
+- date: '2026-08-02'
+  agent: general-purpose x6 pinned to sonnet (ablation known pairs — 3 sections x 2 arms)
+  task: Ablation sweep — 3 sections x 2 arms (6 dispatches; the day's SubagentStop tally read 7, the extra being one earlier probe). Two largest MEASURABLE sections of CLAUDE.md — §Autonomous Initiative (12,224 chars,
+    8 probes) and §Session Wrap-up (8,398 chars, 2 probes) — plus the earlier §New Skill Creation Pre-Commit Gate
+  mode: paired arms per section (asset WITH vs WITHOUT the section), floor tier, all file access denied except the
+    one arm file
+  outcome: accepted
+  evidence: '3 sections ablated, 3 KEEP. §Autonomous Initiative: 5 routing behaviours GROUNDED in arm A and NOT
+    IN MY CONTEXT in arm B (context-doctor, harvest-loop, goal-quench, deep-clarify, the already-running Guard).
+    §Session Wrap-up: 4 of 6 close-chain answers fully absent without it (the ordered sequence, the absolute-last
+    rule and its reason, the late-finding re-run rule, the open-PR sweep). §New Skill gate: 3 of 3 absent.'
+  note: 'By-product worth more than the verdicts: the Pre-Publish row IN the initiative table is redundant — arm
+    B answered the full chain and the order invariant correctly from the gate''s own section (719 chars, ablatable).
+    And the headline: three measurements, three KEEPs. The ''CLAUDE.md is bloated'' premise is not surviving contact
+    — the earlier 46%-unmeasured framing measured probe coverage, which is not necessity.'
+
+- date: 2026-08-03
+  agent: general-purpose x5 pinned to sonnet (ablation arms + isolation control)
+  task: Re-run the ablation sweep on §Pre-Publish Surface Gate and §FH Improvement 4-Axis Auto-Gate;
+    then, when arm B quoted text that grep proved absent from its own arm file, one control agent given
+    NO file and forbidden every tool.
+  mode: paired arms per section, floor tier, "read only the one arm file" — i.e. the method recorded in
+    the 2026-08-02 entry above
+  outcome: rejected
+  evidence: 'The method does not work. The control agent, given no file and zero tool calls, reproduced
+    the ablated section verbatim and named its own source: "project instructions / CLAUDE.md included in
+    my system prompt". A Claude Code subagent inherits the project CLAUDE.md, so "all file access denied
+    except the one arm file" (the 2026-08-02 entry''s own mode line) never produced a blind arm. Behaviour
+    is non-deterministic: in the same run one arm answered from the injected copy while another reported
+    the section missing — so the method can return a false KEEP or a false CUT by luck.'
+  note: 'Consequence for the entry above: its 3 KEEPs are UNCALIBRATED, not disproved. Its by-product
+    claim — the Pre-Publish table row is "719 chars, ablatable" — was re-measured today on a repaired
+    instrument and REJECTED: the row is redundant on both retrievability and trigger-firing, but arm A
+    stopped for a second confirmation before publishing while arm B proceeded, and that direction is not
+    worth 719 bytes on an irreversible surface.'
+
+- date: 2026-08-03
+  agent: fh-commons:quench-challenger (isolated Agent, opus) + codex gpt-5.5 (cross-family, stdin form)
+  task: Axis 2 of the 4-axis gate on the repair itself — scripts/probe_scope_check.sh (ablation procedure
+    canon replacement + control C, which gates the script's exit code)
+  mode: isolated dispatch with a measured target fingerprint in Step 0; codex leg piped on stdin per the
+    recorded sidecar form
+  outcome: accepted
+  evidence: '19 findings (challenger 4S/4A/4B, codex 2S/4A/1B, overlapping roots). Both families
+    independently found the env kill switch (PROBE_SCOPE_FIXTURE ran a 2-row fixture instead of the real
+    corpus, silently skipped control C, printed the green line, exit 0 — reproduced). The challenger
+    produced a FALSE GREEN in control C using a nonexistent-asset fixture, and measured the second leak
+    channel: claude -p retains Bash/Read/Glob, and an arm run from a scratch dir recovered the ablated
+    section from the real CLAUDE.md and cited the file. codex reproduced a trap syntax break on a TMPDIR
+    containing an apostrophe. It also caught a regression I had just introduced: my new option parser
+    rejected --self-test, breaking scripts/selfcheck.sh:317.'
+  note: 'The value here is not the count — it is that the findings landed exactly where self-review had
+    just declared success. Adversarial review does not substitute for first use; today is the mirror:
+    self-repair does not substitute for adversarial review. Axis 2 shipped NOT CONVERGED with the open
+    leak channel declared in the header rather than closed by assertion.'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.84",
+  "version": "1.4.86",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -104,6 +104,7 @@
     "scripts/prepush_guard_check.sh",
     "scripts/psa_scan_lib.sh",
     "scripts/session_close_check.sh",
+    "scripts/test_dispatch_log_lanes.sh",
     "scripts/memory_link_check.py",
     "scripts/test_memory_link_check.sh",
     "scripts/memory_nearcheck.py",
@@ -145,6 +146,8 @@
     "templates/settings.PreToolUse.snippet.json",
     "scripts/halffix_propagation_scan.sh",
     "scripts/test_halffix_lanes.sh",
-    "scripts/test_ollama_panel_lanes.sh"
+    "scripts/test_ollama_panel_lanes.sh",
+    "scripts/test_tag_version_lanes.sh",
+    "templates/subagent-tally-hook.json"
   ]
 }

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.84",
+  "version": "1.4.86",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.84",
+  "version": "1.4.86",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/CHANGELOG.md

@@ -10,6 +10,31 @@ Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 
 ## Plugin Level
 
+### [1.4.86] — 2026-08-03
+
+**fix: 격리를 자칭하던 어블레이션 절차 + ambig 게이트 앵커 + 밀린 출하 자산 반영**
+
+- `scripts/probe_scope_check.sh` — 어블레이션 절차 정본을 교체했다. 서브에이전트에는 프로젝트
+  CLAUDE.md 가 **시스템 프롬프트로 주입**되므로 "다른 파일 읽기 금지"는 블라인드 arm 을 만들지
+  못한다(파일 0개·툴 0회 컨트롤이 잘린 절을 verbatim 재현하며 출처를 자백). 헤더는 이제
+  **"이 절차는 아직 검증되지 않았다"**로 시작한다 — 적대 검증이 두 번째 누출 채널(`claude -p`
+  가 Bash/Read/Glob 을 쥐고 있어 arm 이 진짜 CLAUDE.md 를 찾아 인용)을 실측했고, 툴 차단 처방은
+  known-pair 가 없다(`--tools ''` 는 양성 컨트롤 실패 = 전 구간 거짓 KEEP). 기존 판정은
+  UNCALIBRATED, 오늘 판정 2건은 PROVISIONAL, CUT 후보는 **DO NOT CUT**.
+- 같은 파일 — control B 의 `ambig` 항을 **control C**(픽스처 코퍼스 자기 재호출)로 앵커. 실 코퍼스는
+  건드리지 않는다. 게이트 항을 되돌리면 arm 이 빨개지는 것까지 검증.
+- 같은 파일 — 적대 검증이 잡은 자기결함 5건 봉합: env 킬스위치(`PROBE_SCOPE_FIXTURE` export 시
+  픽스처를 실 코퍼스 대신 검사하고 control C 를 무음으로 끄고도 초록 + exit 0) → argv 플래그로
+  교체 · 타입 없는 exit 3 을 증거로 받던 control C → 자식의 `ambiguous-basename` 카운트 동반 요구 ·
+  따옴표 불안전한 RETURN trap · mktemp 실패가 exit 3 으로 대상 코드를 무고하던 것 → exit 1 ·
+  새 옵션 파서가 `--self-test` 를 거부해 `selfcheck.sh` 를 깨뜨리던 자초 회귀.
+- `knowledge/shared/learnings/subagent_invocations_log.yaml` — 호출 로그 2건. 그중 하나가
+  전날 엔트리를 `rejected` 로 뒤집는다(그 엔트리의 mode 줄 "all file access denied except the one
+  arm file" 이 성립하지 않는다).
+- 밀려 있던 출하 자산 반영(#239, 어제): `scripts/selfcheck.sh` · `scripts/package_coverage_check.sh` ·
+  `templates/.git-hooks/pre-push` — 태그가 자기 버전을 가리키는지 검사하는 가드.
+
+
 ### [1.4.1] — 2026-06-08
 
 **docs: repo-root declutter + pre-commit gate hardening**

package/scripts/selfcheck.sh

@@ -330,6 +330,37 @@ else
   fail=1
 fi
 
+# tag/version consistency guard. Wired with the guard it anchors: the guard exists because a wrong
+# tag reached the remote and a publish from the wrong tree was stopped only by npm's own collision
+# check, so an unrun anchor here would be the same luck-as-floor arrangement one layer up.
+if [ ! -f templates/.git-hooks/pre-push ]; then
+  echo "SKIP  test_tag_version_lanes.sh (subject templates/.git-hooks/pre-push absent)"
+elif [ -f scripts/test_tag_version_lanes.sh ]; then
+  if ! bash scripts/test_tag_version_lanes.sh >/dev/null 2>&1; then
+    echo "FAIL  test_tag_version_lanes.sh: the tag/version guard would mis-route"
+    bash scripts/test_tag_version_lanes.sh 2>&1 | tail -12
+    fail=1
+  else
+    echo "PASS  test_tag_version_lanes.sh (mismatch blocks · match silent · scope · override)"
+  fi
+else
+  echo "FAIL  test_tag_version_lanes.sh: pre-push present but its anchor is missing"
+  fail=1
+fi
+
+# ④-e dispatch-log reconciliation + its tally hook. Wired in the same commit that ships them: the
+# obligation they mechanize lost 20/20 in a single session, so leaving the checker itself unrun
+# would be the same defect one layer up.
+if [ -f scripts/test_dispatch_log_lanes.sh ]; then
+  if ! bash scripts/test_dispatch_log_lanes.sh >/dev/null 2>&1; then
+    echo "FAIL  test_dispatch_log_lanes.sh: the dispatch-log reconciliation would mis-report"
+    bash scripts/test_dispatch_log_lanes.sh 2>&1 | tail -14
+    fail=1
+  else
+    echo "PASS  test_dispatch_log_lanes.sh (date-spelling + verdict + tally-hook lanes)"
+  fi
+fi
+
 # selfcheck's own subject-presence discriminators. Every other guard under scripts/ has a lane suite;
 # this decision had none, and it shipped two mis-routings in one session — a two-arm form that fell
 # through in silence, then a package discriminator keyed on a file that actually ships. Both are

package/scripts/session_close_check.sh

@@ -117,6 +117,57 @@ if [ -n "$LAST_TAG" ] && [ -f "$FH/package.json" ]; then
   fi
 fi
 
+# ④-e DISPATCH-LOG RECONCILIATION — mechanical, because prose failed completely.
+# CLAUDE.md makes an invocation-log entry MANDATORY immediately after any custom sub-agent
+# invocation (it feeds the 60/40 promotion gate and the UAP loop). Measured 2026-08-02: a single
+# session dispatched 20+ subagents and logged ZERO — not a marginal lapse, a total one, in the same
+# session that RECOVERED that very log file from a branch about to be deleted. An obligation that
+# loses 20 times out of 20 is not under-emphasised; it is unmechanized. Per this repo's own rule
+# (1-2 occurrences -> prose; N>=3 or a repeat on another surface -> mechanize), this is well past it.
+#
+# The check is a RECONCILIATION, not an auto-writer. A hook cannot fill `outcome` or `evidence`
+# without fabricating judgment, and a fabricated log entry is worse than a missing one — it would
+# poison the promotion gate with invented outcomes. So the hook only TALLIES (SubagentStop appends a
+# date line) and this step compares the tally against today's entries.
+#
+# It deliberately does NOT demand 1:1. Consolidating twenty challenger rounds into one entry with
+# measured counts is better bookkeeping than twenty stubs, and punishing it would train stub-spam.
+# What it catches is the failure that actually happened: dispatches occurred and NOTHING was written.
+# ABSENCE IS NOT ZERO. The tally comes from a SubagentStop hook configured in `.claude/settings.json`,
+# which is GITIGNORED by design (it also carries local permissions). So a fresh clone, another
+# machine, or a wiped settings file has no hook — and without this branch the check would read an
+# empty tally as "no dispatches today" and pass in silence. That is the exact fail-open this whole
+# step exists to close, re-created inside it; caught before commit by asking where the tally comes
+# from. Installable snippet: templates/subagent-tally-hook.json.
+TALLY="$FH/tracks/_meta/.subagent_dispatch_tally"
+LOG="$FH/knowledge/shared/learnings/subagent_invocations_log.yaml"
+HOOK_OK=0
+if [ -f "$FH/.claude/settings.json" ]; then
+  grep -q '"SubagentStop"' "$FH/.claude/settings.json" 2>/dev/null && HOOK_OK=1
+fi
+if [ "$HOOK_OK" -eq 0 ]; then
+  echo "⚠️  ④-e dispatch log NOT MEASURED — no SubagentStop tally hook in .claude/settings.json"
+  echo "     (that file is gitignored, so a fresh clone has none). An unmeasured dispatch count is"
+  echo "     NOT a count of zero. Install: templates/subagent-tally-hook.json → .claude/settings.json"
+fi
+DISPATCHED=$(grep -c "^$TODAY$" "$TALLY" 2>/dev/null | tr -d ' ' || echo 0)
+# Both quotings, because the file carries both: hand-written entries use `- date: 2026-08-02`
+# while anything appended via yaml.dump renders `- date: '"'"'2026-08-02'"'"'`. Matching one form counted
+# half the entries as absent — a divergent-normalizer miss inside the check that exists to catch
+# missing records. Known-pair calibrated below in test_dispatch_log_lanes.sh.
+LOGGED=$(grep -cE "^- date: *'?$TODAY'?" "$LOG" 2>/dev/null | tr -d ' ' || echo 0)
+if [ "${DISPATCHED:-0}" -gt 0 ] && [ "${LOGGED:-0}" -eq 0 ]; then
+  echo "❌ ④-e $DISPATCHED sub-agent dispatch(es) today and ZERO invocation-log entries — the 60/40"
+  echo "     promotion gate and the UAP loop both read that file; an unlogged session is invisible to"
+  echo "     them. Append to knowledge/shared/learnings/subagent_invocations_log.yaml (consolidated"
+  echo "     per class is fine — record counts and outcomes, not one stub per dispatch)."
+  FAIL=1
+elif [ "${DISPATCHED:-0}" -gt 0 ]; then
+  echo "✅ ④-e dispatch log: $DISPATCHED dispatch(es) today, $LOGGED log entr(ies) recorded"
+elif [ "$HOOK_OK" -eq 1 ]; then
+  echo "✅ ④-e dispatch log: no sub-agent dispatches tallied today"
+fi
+
 # ⑤ CARD-LAST invariant — the card must be the NEWEST close artifact. A card older than
 # fh_completed / signal files written this session = ⑤ ran before ①–④ finished (the bug class).
 if [ -f "$CARD" ]; then

package/scripts/test_dispatch_log_lanes.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# test_dispatch_log_lanes.sh — known-pair anchor for session_close_check.sh ④-e (dispatch-log
+# reconciliation) and for the SubagentStop tally hook that feeds it.
+#
+# WHY (2026-08-02): CLAUDE.md makes an invocation-log entry mandatory immediately after any custom
+# sub-agent invocation — it feeds the 60/40 promotion gate and the UAP loop. Measured: one session
+# dispatched 20+ subagents and logged ZERO, in the same session that recovered that very log file
+# from a branch queued for deletion. An obligation that loses 20/20 is not under-emphasised, it is
+# unmechanized, so ④-e now reconciles a hook-written tally against the day's entries.
+#
+# The reconciliation itself then shipped a defect this suite exists to prevent from returning: the
+# log carries TWO date spellings — `- date: 2026-08-02` for hand-written entries and
+# `- date: '2026-08-02'` for anything appended through yaml.dump — and the first matcher saw only
+# one, counting half the entries as absent. A missing-records check that itself miscounts records is
+# the worst possible shape, so both spellings are lanes below.
+#
+# Exit 0 = the reconciliation discriminates · 1 = it would mis-report.
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CHECK="$SCRIPT_DIR/session_close_check.sh"
+SETTINGS="$SCRIPT_DIR/../.claude/settings.json"
+FAILED=0; PASS=0
+chk() { if [ "$1" -eq 0 ]; then PASS=$((PASS+1)); echo "  ✅ $2"; else FAILED=1; echo "  ❌ $2"; fi; }
+
+[ -f "$CHECK" ] || { echo "FAIL  dispatch-log lanes: subject $CHECK missing"; exit 1; }
+
+# The matcher under test, lifted from the subject rather than re-spelled (a hand-copied predicate is
+# a divergent normalizer — which is exactly the bug being anchored). If it is gone, fail loudly.
+MATCHER=$(grep -oE "grep -cE \"\^- date: \*'\?\\\$TODAY'\?\"" "$CHECK" | head -1)
+if [ -z "$MATCHER" ]; then
+  echo "FAIL  the ④-e date matcher is no longer in session_close_check.sh in the expected form —"
+  echo "      this lane cannot verify what it claims to. Update the lane WITH the subject."
+  exit 1
+fi
+echo "── matcher located in the subject"
+
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+D=2026-08-02
+
+echo "── date-spelling lanes (the shipped miscount) ──"
+printf -- "- date: %s\n" "$D" > "$T/plain.yaml"
+printf -- "- date: '%s'\n" "$D" > "$T/quoted.yaml"
+printf -- "- date: %s\n- date: '%s'\n- date: 2020-01-01\n" "$D" "$D" > "$T/both.yaml"
+count() { grep -cE "^- date: *'?$D'?" "$1" 2>/dev/null | tr -d ' '; }
+[ "$(count "$T/plain.yaml")"  = 1 ] ; chk $? "unquoted date counted"
+[ "$(count "$T/quoted.yaml")" = 1 ] ; chk $? "yaml.dump-quoted date counted (the half the first matcher missed)"
+[ "$(count "$T/both.yaml")"   = 2 ] ; chk $? "mixed file counts both, and ignores another date"
+# known-POSITIVE for the bug itself: the reverted single-form matcher DOES undercount
+[ "$(grep -c "^- date: *$D" "$T/both.yaml")" = 1 ] ; chk $? "known-POSITIVE: the reverted matcher undercounts (1 of 2) — the defect is real"
+
+echo "── reconciliation verdict lanes ──"
+verdict() { # $1=dispatched $2=logged -> BLOCK | OK | NONE
+  if [ "$1" -gt 0 ] && [ "$2" -eq 0 ]; then echo BLOCK
+  elif [ "$1" -gt 0 ]; then echo OK
+  else echo NONE; fi
+}
+[ "$(verdict 20 0)" = BLOCK ] ; chk $? "dispatches with ZERO entries → BLOCK (this is the 2026-08-02 failure)"
+[ "$(verdict 20 4)" = OK ]    ; chk $? "consolidated logging (20 dispatches, 4 entries) → OK, not punished"
+[ "$(verdict 1 1)"  = OK ]    ; chk $? "1:1 logging → OK"
+[ "$(verdict 0 0)"  = NONE ]  ; chk $? "no dispatches → silent, not a failure"
+
+echo "── the tally hook that feeds it ──"
+if [ -f "$SETTINGS" ]; then
+  python3 - "$SETTINGS" <<'PY' >"$T/hookcmd" 2>/dev/null || true
+import json,sys
+d=json.load(open(sys.argv[1]))
+g=d.get("hooks",{}).get("SubagentStop",[])
+print(g[0]["hooks"][0]["command"] if g and g[0].get("hooks") else "")
+PY
+  cmd=$(cat "$T/hookcmd")
+  [ -n "$cmd" ] ; chk $? "SubagentStop hook is configured (an untallied dispatch is invisible to ④-e)"
+  if [ -n "$cmd" ]; then
+    case "$cmd" in *"exit 0"*) ok=0 ;; *) ok=1 ;; esac
+    [ "$ok" -eq 0 ] ; chk $? "hook ends in exit 0 — a non-zero hook exit discards its stdout SILENTLY"
+    # run it against a scratch HUB and confirm it appends today's date
+    CLAUDE_PROJECT_DIR="$T/hub" bash -c "$cmd" >/dev/null 2>&1
+    [ "$(grep -c "$(date +%Y-%m-%d)" "$T/hub/tracks/_meta/.subagent_dispatch_tally" 2>/dev/null || echo 0)" -ge 1 ]
+    chk $? "hook actually appends a dated line when run (not merely present)"
+  fi
+else
+  echo "  ⏭️  .claude/settings.json absent — hook lanes unchecked (not a pass)"
+fi
+
+echo "── absence-is-not-zero (the fail-open this fix nearly shipped) ──"
+# .claude/settings.json is GITIGNORED, so a fresh clone has no hook and an empty tally. Without an
+# explicit branch the reconciliation would read that as "no dispatches" and pass in silence.
+hookless_verdict() { # $1=hook_configured -> MEASURED | NOT-MEASURED
+  [ "$1" -eq 1 ] && echo MEASURED || echo NOT-MEASURED
+}
+[ "$(hookless_verdict 0)" = NOT-MEASURED ] ; chk $? "no hook → NOT MEASURED (an unmeasured count is not zero)"
+[ "$(hookless_verdict 1)" = MEASURED ]     ; chk $? "hook present → measured"
+grep -q "NOT MEASURED" "$CHECK" ; chk $? "the subject actually carries that branch (not just this lane)"
+[ -f "$SCRIPT_DIR/../templates/subagent-tally-hook.json" ] ; chk $? "installable snippet exists for a clone that has no settings.json"
+
+echo ""
+if [ "$FAILED" -ne 0 ]; then echo "DISPATCH-LOG LANES: FAIL"; exit 1; fi
+echo "DISPATCH-LOG LANES: PASS ($PASS/$PASS)"
+exit 0

package/scripts/test_tag_version_lanes.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# test_tag_version_lanes.sh — known-pair anchor for the pre-push tag/version consistency guard.
+#
+# WHY (measured 2026-08-02): a release tag was pushed onto the WRONG commit. `git pull --ff-only`
+# had failed with a diverging-branches error that went unread, so `main` was still the pre-release
+# tree; the tag landed there and `npm publish` was then attempted from that same tree. The ONLY
+# thing that stopped the publish was npm's own "cannot publish over 1.4.84" collision check.
+# Publishing does not un-happen — being saved by the registry's bookkeeping is luck, not a floor.
+#
+# Built at N=1 on purpose. This repo's escalation rule ("1-2 occurrences -> prose, N>=3 -> mechanize")
+# is scoped to REVERSIBLE surfaces; a wrong tag on a public repo plus a publish from the wrong tree
+# is the irreversible class, where the Surface-Class Degrade Invariant says fail-CLOSED immediately.
+#
+# The lanes drive the REAL hook through its real stdin contract (`<local_ref> <local_sha>
+# <remote_ref> <remote_sha>`), not a re-spelling of its predicate — a hand-copied condition is a
+# divergent normalizer and drifts lenient.
+#
+# Exit 0 = the guard discriminates · 1 = it would let a mismatched tag through, or block a good one.
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO="$(cd "$SCRIPT_DIR/.." && pwd)"
+HOOK="$REPO/templates/.git-hooks/pre-push"
+FAILED=0; PASS=0
+chk() { if [ "$1" -eq 0 ]; then PASS=$((PASS+1)); echo "  ✅ $2"; else FAILED=1; echo "  ❌ $2"; fi; }
+
+[ -f "$HOOK" ] || { echo "FAIL  tag-version lanes: subject $HOOK missing"; exit 1; }
+ZERO=0000000000000000000000000000000000000000
+
+# A throwaway repo so the lanes never depend on this repo's live history.
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+( cd "$T" && git init -q . && git config user.email a@b && git config user.name a
+  printf '{\n  "name": "x",\n  "version": "1.0.0"\n}\n' > package.json
+  git add -A && git commit -qm v100
+  printf '{\n  "name": "x",\n  "version": "1.1.0"\n}\n' > package.json
+  git add -A && git commit -qm v110
+  printf 'no manifest here\n' > README.md && rm -f package.json
+  git add -A && git commit -qm nomanifest ) >/dev/null 2>&1
+
+C_100=$(cd "$T" && git rev-parse HEAD~2)
+C_110=$(cd "$T" && git rev-parse HEAD~1)
+C_NONE=$(cd "$T" && git rev-parse HEAD)
+
+# Drive the hook exactly as git does. Run it INSIDE the scratch repo so its rev-parse/cat-file
+# resolve against that history. Only the tag verdict is under test here, so a non-zero exit from an
+# unrelated guard would be a false red — assert on the MESSAGE, and on rc only for the clean lane.
+run() { # $1=tag  $2=sha   -> prints hook output
+  printf '%s %s %s %s\n' "refs/tags/$1" "$2" "refs/tags/$1" "$ZERO" \
+    | ( cd "$T" && bash "$HOOK" origin 2>&1 )
+}
+says_mismatch() { printf '%s' "$1" | grep -q "TAG/VERSION MISMATCH"; }
+blocks()        { printf '%s' "$1" | grep -q "FH Tag/Version Consistency"; }
+
+echo "── the measured failure, reproduced ──"
+out=$(run v1.1.0 "$C_100")
+says_mismatch "$out" ; chk $? "known-POSITIVE: v1.1.0 on a commit whose package.json says 1.0.0 → MISMATCH"
+blocks "$out"        ; chk $? "…and it BLOCKS (detection wired to a blocker, not just printed)"
+
+echo "── the good case must not be blocked (over-blocking trains the override) ──"
+out=$(run v1.1.0 "$C_110")
+if says_mismatch "$out"; then chk 1 "known-NEGATIVE: matching tag/version is silent"; else chk 0 "known-NEGATIVE: matching tag/version is silent"; fi
+if blocks "$out"; then chk 1 "…and does not block"; else chk 0 "…and does not block"; fi
+
+echo "── scope: not every tag is a release tag ──"
+out=$(run v1.0.0 "$C_NONE")
+if says_mismatch "$out"; then chk 1 "no package.json at that commit → not applicable, not a block"; else chk 0 "no package.json at that commit → not applicable, not a block"; fi
+out=$(run sprint-42 "$C_100")
+if says_mismatch "$out"; then chk 1 "non-version tag name (sprint-42) is out of scope"; else chk 0 "non-version tag name (sprint-42) is out of scope"; fi
+
+echo "── the override channel exists and is explicit ──"
+grep -q 'TAG_VERSION_OK' "$HOOK" ; chk $? "TAG_VERSION_OK override present (mirrors MAIN_PUSH_OK / DESTRUCTIVE_OP_OK)"
+out=$(printf '%s %s %s %s\n' "refs/tags/v1.1.0" "$C_100" "refs/tags/v1.1.0" "$ZERO" \
+      | ( cd "$T" && TAG_VERSION_OK=1 bash "$HOOK" origin 2>&1 ))
+if blocks "$out"; then chk 1 "override actually lets the push through"; else chk 0 "override actually lets the push through"; fi
+
+echo ""
+if [ "$FAILED" -ne 0 ]; then echo "TAG-VERSION LANES: FAIL"; exit 1; fi
+echo "TAG-VERSION LANES: PASS ($PASS/$PASS)"
+exit 0

package/templates/.git-hooks/pre-push

@@ -54,6 +54,7 @@ DEL_OTHER=""      # refs/tags/* refs/notes/* etc. being deleted
 FORCED_REFS=""
 UNCLASSIFIED=""   # force-check impossible (remote tip not fetched)
 DIRECT_MAIN=""    # non-delete update pushed straight at the integration branch (PR-only policy)
+TAG_MISMATCH=""   # vX.Y.Z tag whose commit's package.json disagrees (irreversible-adjacent)
 SEP=$'\n'   # ranges are newline-separated and evaluated ONE REF AT A TIME: concatenating
             # them into one arg string let `--not` from ref A flip polarity for ref B, so a
             # multi-ref push could return an empty or wrong commit set (R6 audit 2026-07-26).
@@ -184,6 +185,40 @@ while read -r local_ref local_sha remote_ref remote_sha; do
         fi ;;
     esac
   fi
+  # TAG/VERSION CONSISTENCY — a `vX.Y.Z` tag must point at a commit whose package.json says X.Y.Z.
+  # WHY (measured 2026-08-02): a release tag was pushed onto the WRONG commit because `git pull`
+  # had failed with a diverging-branches error that went unread, so `main` was still the pre-release
+  # tree. `npm publish` was then attempted from that same tree — and the ONLY thing that stopped it
+  # was npm's own "cannot publish over 1.4.84" collision check. Publishing is irreversible; being
+  # saved by the registry's bookkeeping is luck, not a floor.
+  # This is N=1 and it is built anyway: the repetition rule ("1-2 occurrences -> prose") is scoped to
+  # REVERSIBLE surfaces. A wrong tag on a public repo plus a publish from the wrong tree is the
+  # irreversible class, where this repo's own Surface-Class Degrade Invariant says fail-CLOSED now.
+  # Scope is deliberately narrow: only a NEW `refs/tags/v<digits>` push, only when package.json
+  # exists at that commit. Absent package.json -> not applicable (a tag in a non-npm repo is fine);
+  # unreadable package.json at a commit that HAS one -> BLOCK (cannot decide != allowed).
+  if [ "$local_sha" != "$ZERO" ] && [ "${remote_sha:-$ZERO}" = "$ZERO" ]; then
+    case "$remote_ref" in
+      refs/tags/v[0-9]*)
+        _tv="${remote_ref#refs/tags/v}"
+        _commit=$(git rev-parse "${local_sha}^{commit}" 2>/dev/null)
+        if [ -z "$_commit" ]; then
+          echo "  ⛔ TAG/VERSION: $remote_ref does not resolve to a commit — cannot verify, refusing"
+          TAG_MISMATCH="$TAG_MISMATCH $remote_ref"
+        elif git cat-file -e "${_commit}:package.json" 2>/dev/null; then
+          _pv=$(git show "${_commit}:package.json" 2>/dev/null \
+                | sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
+          if [ -z "$_pv" ]; then
+            echo "  ⛔ TAG/VERSION: package.json exists at ${_commit} but its version is unreadable — refusing"
+            TAG_MISMATCH="$TAG_MISMATCH $remote_ref"
+          elif [ "$_pv" != "$_tv" ]; then
+            echo "  ⛔ TAG/VERSION MISMATCH: $remote_ref points at ${_commit}, whose package.json says $_pv"
+            TAG_MISMATCH="$TAG_MISMATCH $remote_ref"
+          fi
+        fi ;;
+    esac
+  fi
+
   # PR-only policy: a non-delete update aimed straight at the integration branch.
   # Detected INSIDE this loop because this is the only place git's ref list is readable.
   if [ "$local_sha" != "$ZERO" ]; then
@@ -403,6 +438,27 @@ fi
 # instead of a bare server rejection, and it keeps working if the server setting is ever relaxed.
 # It is deliberately NOT the hard floor — a client-side hook is bypassable by `--no-verify`.
 # Scope: blocks the PUSH, not the merge — `gh pr merge` operates server-side and is unaffected.
+if [ -n "$TAG_MISMATCH" ] && [ "${TAG_VERSION_OK:-0}" != "1" ]; then
+  echo ""
+  echo "══════════════════════════════════════════════"
+  echo " ⛔ FH Tag/Version Consistency (pre-push)"
+  echo "══════════════════════════════════════════════"
+  echo "  Tag(s) whose commit disagrees with package.json:$TAG_MISMATCH"
+  echo ""
+  echo "  A release tag is the thing a human and a script both trust to answer \"what shipped\"."
+  echo "  Measured 2026-08-02: a tag went onto the pre-release commit because a failed \`git pull\`"
+  echo "  went unread, and \`npm publish\` was then attempted from that same tree. Only npm's own"
+  echo "  version-collision check stopped it. Publishing does not un-happen; that was luck."
+  echo ""
+  echo "  Fix:  git fetch origin && git switch main && git pull --ff-only"
+  echo "        git tag -d <tag> && git push origin :refs/tags/<tag>   # if already pushed"
+  echo "        # then re-tag on the commit whose package.json really carries that version"
+  echo ""
+  echo "  Deliberate exception (explicit, logged — mirrors MAIN_PUSH_OK / DESTRUCTIVE_OP_OK):"
+  echo "      TAG_VERSION_OK=1 git push …"
+  exit 1
+fi
+
 if [ -n "$DIRECT_MAIN" ] && [ "${MAIN_PUSH_OK:-0}" != "1" ]; then
   echo ""
   echo "══════════════════════════════════════════════"

package/templates/subagent-tally-hook.json

@@ -0,0 +1,17 @@
+{
+  "_readme": "FH dispatch-tally hook. Merge the `hooks.SubagentStop` block below into your .claude/settings.json (that file is gitignored, which is why this template exists). It feeds session_close_check.sh ④-e, which blocks a close push when sub-agents were dispatched and the day's invocation-log entries are zero. The hook TALLIES ONLY — it never writes a log entry, because a fabricated outcome/evidence field would poison the 60/40 promotion gate worse than a missing one.",
+  "hooks": {
+    "SubagentStop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash -c 'HUB=\"${CLAUDE_PROJECT_DIR:-$HOME/projects/forge-harness}\"; T=\"$HUB/tracks/_meta/.subagent_dispatch_tally\"; mkdir -p \"$(dirname \"$T\")\" 2>/dev/null; printf \"%s\\n\" \"$(date +%Y-%m-%d)\" >> \"$T\" 2>/dev/null; exit 0'",
+            "timeout": 5
+          }
+        ]
+      }
+    ]
+  }
+}