@chrono-meta/fh-gate 1.4.85 → 1.4.87

package/scripts/test_dispatch_log_lanes.sh

@@ -93,6 +93,39 @@ hookless_verdict() { # $1=hook_configured -> MEASURED | NOT-MEASURED
 grep -q "NOT MEASURED" "$CHECK" ; chk $? "the subject actually carries that branch (not just this lane)"
 [ -f "$SCRIPT_DIR/../templates/subagent-tally-hook.json" ] ; chk $? "installable snippet exists for a clone that has no settings.json"
 
+echo "── pipefail disarm (the guard was dead in EXACTLY its target case) ──"
+# `grep -c` PRINTS 0 and EXITS 1 on a zero count. Under `set -o pipefail` the old
+# `grep -c … | tr -d ' ' || echo 0` therefore produced "0\n0", `[ -eq ]` threw, and the ❌ branch
+# was skipped — so ④-e reported ✅ whenever the log had ZERO entries, which is the one situation it
+# exists to block. Measured live 2026-08-04 during a session close.
+# Lane 1: reproduce the OLD form and assert it is broken (a control — if this ever passes, the
+# premise changed and the fix below is measuring nothing).
+old_form=$(bash -c 'set -uo pipefail; grep -c "^NOSUCHDATE$" '"$CHECK"' 2>/dev/null | tr -d " " || echo 0')
+[ "$(printf %s "$old_form" | grep -c "")" -eq 2 ] ; chk $? "control: the old \`|| echo 0\` form really does yield TWO lines under pipefail"
+# Lane 2: the shipped form yields a single sanitised integer.
+new_form=$(bash -c 'set -uo pipefail; _int() { case "${1:-}" in (""|*[!0-9]*) echo 0 ;; (*) echo "$1" ;; esac; }; _int "$(grep -c "^NOSUCHDATE$" '"$CHECK"' 2>/dev/null | tr -d " " || true)"')
+[ "$new_form" = "0" ] ; chk $? "shipped form yields a single sanitised 0"
+( set -uo pipefail; [ "$new_form" -eq 0 ] ) 2>/dev/null ; chk $? "and \`[ -eq ]\` accepts it (the old form threw here)"
+# Lane 3-5: BEHAVIOUR, not spelling. The first draft of these lanes string-matched the old form and
+# went GREEN on a revert — the needle did not match `tr -d ' '` (quotes), so the anchor was
+# decorative in the way this repo already named ([[feedback_anchor_can_be_decorative]], cause:
+# "needle matching unrelated text"). Extract the subject's OWN assignment lines and evaluate them.
+_eval_subject_assign() {  # $1 = variable name; echoes what the SUBJECT computes for a zero match
+  local var="$1" line
+  line=$(grep -E "^${var}=" "$CHECK" | head -1)
+  [ -n "$line" ] || { echo "NOLINE"; return; }
+  bash -c "set -uo pipefail
+    _int() { case \"\${1:-}\" in (''|*[!0-9]*) echo 0 ;; (*) echo \"\$1\" ;; esac; }
+    TODAY=NOSUCHDATE; TALLY='$CHECK'; LOG='$CHECK'
+    $line
+    printf %s \"\$$var\"" 2>/dev/null
+}
+for _v in DISPATCHED LOGGED; do
+  _got=$(_eval_subject_assign "$_v")
+  [ "$(printf %s "$_got" | grep -c '')" -le 1 ] ; chk $? "subject's \$$_v is ONE line on a zero match (was two: the disarm)"
+  ( set -uo pipefail; [ "${_got:-x}" -eq 0 ] ) 2>/dev/null ; chk $? "subject's \$$_v survives \`[ -eq 0 ]\` (the disarm threw here)"
+done
+
 echo ""
 if [ "$FAILED" -ne 0 ]; then echo "DISPATCH-LOG LANES: FAIL"; exit 1; fi
 echo "DISPATCH-LOG LANES: PASS ($PASS/$PASS)"

package/scripts/test_node_infra_delta_lanes.sh

@@ -0,0 +1,211 @@
+#!/usr/bin/env bash
+# test_node_infra_delta_lanes.sh — lanes for the INFRA-DELTA branch of scripts/fh_node_check.sh.
+#
+# WHY A SEPARATE FILE FROM test_node_check_lanes.sh: that suite covers the floor probes (git hooks,
+# Mode D companion detection, emission model) and never enters the infra-delta branch — every one of
+# its fixtures runs against a state file whose PREV_HEAD is either empty (first session) or equal to
+# HEAD. The branch that reacts to `git pull` moving install-relevant files was unexercised, which is
+# how the four items below survived. Keeping it separate also keeps the two suites' fixture families
+# from colliding: this one must CHANGE HEAD between runs, which breaks the "event once then silent"
+# lane in the other file.
+#
+# CALIBRATION RULE OBSERVED THROUGHOUT: every lane asserting an ABSENCE names its known-positive in
+# the lane title and builds it from the SAME fixture family in the SAME run. Exit codes are read
+# DIRECTLY off the subject, never through a pipe.
+#
+# ⓘ GAP lanes pin behaviour believed WRONG without failing the suite; if the behaviour changes they
+# announce "GAP CLOSED" so the lane gets promoted instead of silently rotting.
+#
+# Exit 0 = every asserting lane calibrated · 1 = the instrument is wrong.
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CHECK="$SCRIPT_DIR/fh_node_check.sh"
+[ -f "$CHECK" ] || { echo "FAIL  subject missing: $CHECK"; exit 1; }
+
+TMPROOT=$(mktemp -d "${TMPDIR:-/tmp}/fh_infra_lanes.XXXXXX")
+trap 'rm -rf "$TMPROOT"' EXIT
+FAILED=0; PASSED=0; GAPS=0
+
+_pass() { echo "✅ $1"; PASSED=$((PASSED+1)); }
+_fail() { echo "❌ $1"; FAILED=1; }
+_line() {  # $1=name $2=pattern $3=expect(0/1) $4=output
+  local hit=0
+  printf '%s\n' "$4" | grep -q -- "$2" && hit=1
+  if [ "$hit" = "$3" ]; then _pass "$1 (hit=$hit, expected=$3)"
+  else _fail "$1 — hit=$hit, expected=$3"; printf '%s\n' "$4" | sed 's/^/       │ /'; fi
+}
+_rc() { if [ "$2" = "$3" ]; then _pass "$1 (exit=$2, expected=$3)"; else _fail "$1 — exit=$2, expected=$3"; fi; }
+_gap() {  # $1=name $2=observed(1=still open) $3=note
+  if [ "$2" = "1" ]; then echo "ⓘ GAP (still open) $1"; echo "       ↳ $3"; GAPS=$((GAPS+1))
+  else echo "🎉 GAP CLOSED — $1 : behaviour changed, promote this lane to an asserting one"; fi
+}
+
+# ── fixtures ────────────────────────────────────────────────────────────────────
+# A hub with FH's own gate sentinel in both hooks, so MISS is empty and any output is attributable
+# to the infra-delta branch alone (instrument-discrimination: a lane that cannot tell which leg
+# fired is not measuring that leg).
+_hub() {  # $1=name → echoes path
+  local d="$TMPROOT/$1"
+  mkdir -p "$d/.git" || true
+  git -C "$d" init -q 2>/dev/null || { mkdir -p "$d"; git -C "$d" init -q; }
+  git -C "$d" config user.email anchor@local; git -C "$d" config user.name anchor
+  mkdir -p "$d/.git/hooks"
+  printf '#!/bin/sh\n# FH 4-Axis Gate\nexit 0\n' > "$d/.git/hooks/pre-commit"
+  cp "$d/.git/hooks/pre-commit" "$d/.git/hooks/pre-push"
+  chmod +x "$d/.git/hooks/pre-commit" "$d/.git/hooks/pre-push"
+  echo seed > "$d/seed.txt"
+  git -C "$d" add -A >/dev/null 2>&1
+  git -C "$d" -c commit.gpgsign=false commit -qm seed >/dev/null 2>&1
+  printf '%s' "$d"
+}
+_commit() {  # $1=hub $2..=paths to create
+  local d="$1" p; shift
+  for p in "$@"; do mkdir -p "$d/$(dirname "$p")"; echo changed >> "$d/$p"; done
+  git -C "$d" add -A >/dev/null 2>&1
+  git -C "$d" -c commit.gpgsign=false commit -qm change >/dev/null 2>&1
+}
+_run() {  # $1=hub $2=statefile ; sets OUT/RC (RC read directly, no pipe)
+  OUT=$(HUB_DIR="$1" FH_NODE_STATE="$2" FH_MACHINE_ID=lanebox bash "$CHECK" 2>&1); RC=$?
+}
+# seed the state so PREV_HEAD is the pre-change commit (this is the ONLY way into the branch)
+_seed_state() { _run "$1" "$2" >/dev/null 2>&1; }
+
+NEW='🆕 Install-relevant assets changed'
+HDR='🖥️  \[node\]'
+
+echo "══ infra delta: fires on an install-relevant change, silent otherwise ══"
+H=$(_hub p_pos); _seed_state "$H" "$TMPROOT/st_pos"
+_commit "$H" scripts/fh_env_delta_scan.sh
+_run "$H" "$TMPROOT/st_pos"
+_line "ID-P  install-relevant file changed → 🆕 block fires" "$NEW" 1 "$OUT"
+_line "ID-P  → names the changed path"  'scripts/fh_env_delta_scan.sh' 1 "$OUT"
+_line "ID-P  → routes to the wizard"    'Re-run /install-wizard'       1 "$OUT"
+_rc   "ID-P  detector never gates (exit 0)" "$RC" 0
+
+# CONTROL for ID-P, same fixture family, same run-shape: HEAD advances by exactly one commit, but
+# the changed path is outside the install surface. Silence here is only meaningful BECAUSE ID-P
+# above spoke on an otherwise identical fixture.
+H=$(_hub p_ctl); _seed_state "$H" "$TMPROOT/st_ctl"
+_commit "$H" README.md
+_run "$H" "$TMPROOT/st_ctl"
+_line "ID-C  non-install path changed → no 🆕 block (over-fire ctl for ID-P)" "$NEW" 0 "$OUT"
+_rc   "ID-C  → exit 0" "$RC" 0
+
+echo
+echo "══ one fixture PER regex alternative (an untested alternative is an untested branch) ══"
+# Deliberately one path per alternative: a single fixture touching several at once would let any
+# alternative be deleted with the suite staying green — the lane4c lesson from test_node_check_lanes.
+i=0
+for p in "templates/.git-hooks/pre-push" \
+         "templates/settings.SessionStart.snippet.json" \
+         "scripts/fh_session_load.sh" \
+         "plugins/fh-meta/skills/install-wizard/SKILL.md" \
+         "plugins/fh-meta/skills/install-doctor/SKILL.md"; do
+  i=$((i+1))
+  H=$(_hub "alt$i"); _seed_state "$H" "$TMPROOT/st_alt$i"
+  _commit "$H" "$p"
+  _run "$H" "$TMPROOT/st_alt$i"
+  _line "ID-R$i alternative covered: $p" "$NEW" 1 "$OUT"
+done
+
+# NEGATIVE for the regex: install-adjacent-LOOKING paths that the pattern deliberately does not
+# cover. Without this leg "the regex matches everything" would also pass ID-R1..5.
+H=$(_hub alt_neg); _seed_state "$H" "$TMPROOT/st_altneg"
+_commit "$H" "plugins/fh-meta/skills/harvest-loop/SKILL.md"
+_run "$H" "$TMPROOT/st_altneg"
+_line "ID-Rn non-install skill path → not treated as infra (paired with ID-R4/5)" "$NEW" 0 "$OUT"
+
+echo
+echo "══ unreachable PREV_HEAD: UNMEASURED, not silence ══"
+H=$(_hub p_unreach); _commit "$H" scripts/fh_env_delta_scan.sh
+printf 'lanebox|1700000000|deadbee' > "$TMPROOT/st_unreach"
+_run "$H" "$TMPROOT/st_unreach"
+_line "ID-U  gc/rebase/shallow → UNMEASURED is stated" 'UNMEASURED'  1 "$OUT"
+_line "ID-U  → does NOT claim the 🆕 delta (not found ≠ 0)" "$NEW"   0 "$OUT"
+_rc   "ID-U  → exit 0" "$RC" 0
+
+echo
+echo "══ co-reporting: a missing floor does not suppress the infra delta ══"
+H=$(_hub p_both); _seed_state "$H" "$TMPROOT/st_both"
+rm -f "$H/.git/hooks/pre-commit"
+_commit "$H" scripts/fh_node_check.sh
+_run "$H" "$TMPROOT/st_both"
+_line "ID-B  missing floor reported"            'Missing mechanical floor' 1 "$OUT"
+_line "ID-B  AND infra delta reported (paired)" "$NEW"                     1 "$OUT"
+
+echo
+echo "══ ⓘ GAP lanes — believed-wrong behaviour, pinned not asserted ══"
+
+# GAP 1 — attribution. Every other emission path prints the 🖥️ [node] header; the infra-only and
+# UNMEASURED-only paths print 4-space-indented CONTINUATION lines under a header that was never
+# printed. This is not cosmetic in situ: SessionStart hooks on one matcher have their outputs
+# delivered as separate, unordered, unlabelled blocks (measured in
+# scripts/test_sessionstart_multihook_lanes.sh), so an unattributed indented block genuinely cannot
+# be traced to the hook that emitted it.
+H=$(_hub g_hdr); _seed_state "$H" "$TMPROOT/st_hdr"
+_commit "$H" scripts/fh_env_delta_scan.sh
+_run "$H" "$TMPROOT/st_hdr"
+_g=0
+{ printf '%s\n' "$OUT" | grep -q "$NEW"; } && ! printf '%s\n' "$OUT" | grep -q "$HDR" && _g=1
+_gap "infra-only emission has NO 🖥️ [node] header" "$_g" \
+  "Output is 4-space-indented continuation lines with no parent line. MISS and IDENTITY both print a \
+header; the infra and UNMEASURED paths do not, because they hang off an if/elif that both fail."
+
+# GAP 2 — silent truncation. `head -6` with no count. The script's own header argues 'not found ≠ 0'
+# and 'distinguish no-change from could-not-measure'; an omitted-3-of-9 list is the same class of
+# hidden omission, one layer in.
+H=$(_hub g_trunc); _seed_state "$H" "$TMPROOT/st_trunc"
+_commit "$H" scripts/fh_a.sh scripts/fh_b.sh scripts/fh_c.sh scripts/fh_d.sh \
+             scripts/fh_e.sh scripts/fh_f.sh scripts/fh_g.sh scripts/fh_h.sh scripts/fh_i.sh
+_run "$H" "$TMPROOT/st_trunc"
+LISTED=$(printf '%s\n' "$OUT" | grep -c '^       - ')
+_g=0; { [ "$LISTED" = "6" ] && ! printf '%s\n' "$OUT" | grep -qiE 'more|[0-9]+ of [0-9]+|truncat'; } && _g=1
+_gap "9 install-relevant files changed → 6 listed, 3 dropped with no count" "$_g" \
+  "listed=$LISTED, and no '…and N more'. A big pull (exactly when re-running the wizard matters most) \
+silently hides the tail. Cheap fix: append the residual count."
+
+# GAP 3 — the one-shot consumes an UNRESOLVED unknown. State is written UNCONDITIONALLY to HEAD_NOW,
+# including on the run that could not compute the delta. Next session PREV_HEAD == HEAD, so the
+# delta across that pull is never attempted again and never mentioned again. The script's header
+# says events report once and CONDITIONS report until they stop being true — an un-computed delta is
+# an unresolved condition, and it is being treated as a discharged event.
+H=$(_hub g_once); _commit "$H" scripts/fh_env_delta_scan.sh
+printf 'lanebox|1700000000|deadbee' > "$TMPROOT/st_once"
+SPOKE=0
+for _i in 1 2 3; do
+  _run "$H" "$TMPROOT/st_once"
+  printf '%s\n' "$OUT" | grep -q 'UNMEASURED' && SPOKE=$((SPOKE+1))
+done
+_g=0; [ "$SPOKE" = "1" ] && _g=1
+_gap "UNMEASURED spoken once, then permanently forgotten (state advanced anyway)" "$_g" \
+  "spoke on $SPOKE of 3 consecutive runs. Same shape as the failure the state-based design was \
+introduced to fix ('a broken machine reported once then went quiet forever') — the fix reached MISS \
+but not the infra branch. CODE-vs-DOC: fh_node_check.sh's own header claims it distinguishes \
+'no change' from 'could not measure', yet after run 1 the two are indistinguishable forever."
+
+# GAP 4 — the event is consumed even when nobody saw it. State advances before/independently of
+# whether the emission reached anyone. Pairs directly with the F11 measurement: a SessionStart hook
+# whose sibling ordering, delivery, or exit handling drops its output loses the notice permanently.
+H=$(_hub g_unseen); _seed_state "$H" "$TMPROOT/st_unseen"
+_commit "$H" scripts/fh_env_delta_scan.sh
+HUB_DIR="$H" FH_NODE_STATE="$TMPROOT/st_unseen" FH_MACHINE_ID=lanebox bash "$CHECK" >/dev/null 2>&1
+_run "$H" "$TMPROOT/st_unseen"
+_g=0; printf '%s\n' "$OUT" | grep -q "$NEW" || _g=1
+_gap "infra event is consumed by a run whose output nobody received" "$_g" \
+  "One discarded-stdout run and the notice is gone for good. The write is deliberately unconditional \
+(so the timestamp does not mean 'last time it spoke'), but that argument covers the TIMESTAMP, not \
+the HEAD field. Recording HEAD only when the delta was successfully computed AND emitted would keep \
+the timestamp honest and stop discharging unseen events."
+
+echo
+echo "──────────────────────────────────────────────"
+if [ "$FAILED" -ne 0 ]; then
+  echo "NODE INFRA-DELTA LANES: FAIL — instrument miscalibrated (do not trust its verdict)"
+  echo "  asserting lanes passed: $PASSED · open gaps: $GAPS"
+  exit 1
+fi
+echo "NODE INFRA-DELTA LANES: PASS ($PASSED asserting lanes) · $GAPS KNOWN GAP(S) open (see ⓘ above)"
+echo "  Green covers: fires/does-not-fire, per-alternative regex coverage, UNMEASURED, co-reporting."
+echo "  Green does NOT cover the four gaps above."
+exit 0

package/scripts/test_session_close_chain_lanes.sh

@@ -0,0 +1,349 @@
+#!/usr/bin/env bash
+# test_session_close_chain_lanes.sh — known-pair anchors for the close-chain steps that had NO
+# mechanical lane: ① (status snapshot) · ①-b (open-PR sweep) · ④-log (real-time completion log, the
+# only exit-1 FAIL path besides ⑤) · ④-b (npm freshness + BIDIRECTIONAL entry-point drift) ·
+# and the pre-push SURFACE MATCHING (ordinary push advises · FH_SESSION_CLOSE=1 push blocks).
+#
+# Already anchored elsewhere, deliberately NOT duplicated here:
+#   ②, ⑤ card-last          → scripts/test_session_close_lanes.sh
+#   ⑤-b card-drift probe    → scripts/test_card_drift_probe.sh (incl. the locale-divergence leg)
+#   pre-push stdin/ordering → scripts/test_prepush_stdin_integrity.sh
+#
+# CALIBRATION RULE OBSERVED THROUGHOUT: every lane that asserts an ABSENCE is paired with a
+# known-POSITIVE built from the SAME fixture family, so "passed because the guard worked" is
+# distinguishable from "passed because nothing ran". Exit codes are read DIRECTLY off the
+# subject (never through a pipe — `cmd | tail; echo $?` reads tail's status and has produced
+# false green in this repo four times).
+#
+# ⓘ GAP lanes: places where the subject's CURRENT behaviour is believed WRONG (fail-open, or a
+# spec/code disagreement). They pin the observed behaviour but never fail the suite; if the
+# behaviour changes they announce "GAP CLOSED" so the lane gets promoted instead of silently
+# rotting. They are counted and printed separately — a green summary here does NOT mean the
+# chain is fully guarded.
+#
+# Exit 0 = every asserting lane calibrated · exit 1 = the gate's instrument is wrong.
+
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+CHECK="$SCRIPT_DIR/session_close_check.sh"
+HOOK="$ROOT/templates/.git-hooks/pre-push"
+TODAY=$(date +%Y-%m-%d)
+FAILED=0
+PASSED=0
+GAPS=0
+
+[ -f "$CHECK" ] || { echo "FAIL  subject missing: $CHECK"; exit 1; }
+[ -f "$HOOK" ]  || { echo "FAIL  subject missing: $HOOK";  exit 1; }
+
+TMPROOT=$(mktemp -d "${TMPDIR:-/tmp}/fh_close_lanes.XXXXXX")
+trap 'rm -rf "$TMPROOT"' EXIT
+
+_pass() { echo "✅ $1"; PASSED=$((PASSED+1)); }
+_fail() { echo "❌ $1"; FAILED=1; }
+
+# assert a line IS / IS NOT present in captured output
+_line() {  # $1=name $2=pattern $3=expect(0/1) $4=output
+  local hit=0
+  printf '%s\n' "$4" | grep -q -- "$2" && hit=1
+  if [ "$hit" = "$3" ]; then _pass "$1 (hit=$hit, expected=$3)"
+  else _fail "$1 — hit=$hit, expected=$3"; printf '%s\n' "$4" | sed 's/^/       │ /'; fi
+}
+
+_rc() {  # $1=name $2=actual $3=expected
+  if [ "$2" = "$3" ]; then _pass "$1 (exit=$2, expected=$3)"
+  else _fail "$1 — exit=$2, expected=$3"; fi
+}
+
+# GAP lane: pins believed-wrong behaviour without failing the suite.
+_gap() {  # $1=name $2=observed-condition-result(0/1 as evaluated by caller) $3=note
+  if [ "$2" = "1" ]; then
+    echo "ⓘ GAP (still open) $1"
+    echo "       ↳ $3"
+    GAPS=$((GAPS+1))
+  else
+    echo "🎉 GAP CLOSED — $1 : behaviour changed, promote this lane to an asserting one"
+  fi
+}
+
+# ── fixture builders ─────────────────────────────────────────────────────────────
+_repo() {  # $1=dirname ; makes a git repo with one commit dated $2 (default now)
+  local T="$TMPROOT/$1" when="${2:-}"
+  mkdir -p "$T"
+  (
+    cd "$T" || exit 1
+    git init -q . 2>/dev/null
+    git config user.email anchor@local
+    git config user.name anchor
+    echo seed > unrelated.txt
+    # tracks/ is gitignored in the real repo too — without this the fixture's own card+log show up
+    # as untracked paths and ①'s "clean tree" lane can never be built (self-inflicted dirt).
+    printf 'tracks/\nbin/\n' > .gitignore
+    git add -A
+    if [ -n "$when" ]; then
+      GIT_AUTHOR_DATE="$when" GIT_COMMITTER_DATE="$when" git commit -qm seed
+    else
+      git commit -qm seed
+    fi
+  ) >/dev/null 2>&1
+  mkdir -p "$T/tracks/_meta"
+  printf '%s' "$T"
+}
+
+_card() { printf '# card\n' > "$1/tracks/_meta/reference_next_session_starter.md"; }
+# ④ + ⑤ satisfied: completion log first, card LAST (card-last ordering) — so any exit 1 in the
+# ① / ①-b lanes is attributable to the leg under test, not to ambient ④/⑤ noise.
+_artifacts() { printf -- '- ✅ x\n' > "$1/tracks/_meta/fh_completed_${TODAY}.md"; _card "$1"; }
+
+_run() {  # $1=repo ; sets OUT and RC (RC read directly, no pipe)
+  # HERMETIC: stub `gh` to "no open PRs" for every lane that is not specifically testing ①-b.
+  # Without this the ambient environment leaked in — the ①-P lane passed only while this operator
+  # happened to have zero open PRs, and went red the moment a PR was opened mid-session. A lane
+  # that depends on the day's PR count is measuring the environment, not the code.
+  mkdir -p "$1/bin"
+  { printf '#!/usr/bin/env bash\necho "[]"\nexit 0\n'; } > "$1/bin/gh"
+  chmod +x "$1/bin/gh"
+  OUT=$(PATH="$1/bin:$PATH" bash "$CHECK" "$1" 2>/dev/null); RC=$?
+}
+
+echo "══ ① status snapshot ══"
+T=$(_repo one_clean); _artifacts "$T"
+_run "$T"
+_line "①-P  clean tree → ✅ clean line"            '✅ ① working tree clean' 1 "$OUT"
+# Pattern must not match `⚠️  ①-b` — a loose `⚠️  ①` conflated two different steps and made
+# this absence assertion answer a question about the OPEN-PR sweep instead of the status snapshot.
+_line "①-P  clean tree → no ⚠️ ① line (paired)"   '⚠️  ① '                  0 "$OUT"
+_rc   "①-P  clean tree → exit 0" "$RC" 0
+
+T=$(_repo one_dirty); _artifacts "$T"; echo scratch > "$T/uncommitted.txt"
+_run "$T"
+_line "①-N  uncommitted path → ⚠️ fires"           'uncommitted path'        1 "$OUT"
+_line "①-N  uncommitted path → clean line absent"  '✅ ① working tree clean' 0 "$OUT"
+_rc   "①-N  uncommitted is ADVISORY, not blocking" "$RC" 0
+
+# unpushed: needs a real upstream, so build a bare remote
+T=$(_repo one_unpushed); _artifacts "$T"
+(
+  cd "$T" || exit 1
+  git init -q --bare "$TMPROOT/one_unpushed.git" 2>/dev/null
+  git remote add origin "$TMPROOT/one_unpushed.git"
+  git push -q -u origin HEAD 2>/dev/null
+  echo more > second.txt && git add -A && git commit -qm second
+) >/dev/null 2>&1
+_run "$T"
+_line "①-N  unpushed commit → ⚠️ fires"            'unpushed commit'         1 "$OUT"
+_line "①-N  unpushed → clean line absent (paired)" '✅ ① working tree clean' 0 "$OUT"
+
+T="$TMPROOT/one_notrepo"; mkdir -p "$T/tracks/_meta"; _artifacts "$T"
+_run "$T"
+_g=0; printf '%s\n' "$OUT" | grep -q '✅ ① working tree clean' && _g=1
+_gap "①  non-repo reports CLEAN" "$_g" \
+  "git is unavailable/not a repo → DIRTY=0, UNPUSHED=0 → the check reports '✅ working tree clean'. \
+An instrument that could not look is not a clean result (not found ≠ 0). Should say UNSCANNED."
+
+echo
+echo "══ ①-b open-PR sweep ══"
+_ghstub() {  # $1=repo $2=stdout $3=exit
+  mkdir -p "$1/bin"
+  { printf '#!/usr/bin/env bash\ncat <<'"'"'GHEOF'"'"'\n%s\nGHEOF\nexit %s\n' "$2" "$3"; } > "$1/bin/gh"
+  chmod +x "$1/bin/gh"
+}
+_run_with_gh() {  # $1=repo
+  OUT=$(PATH="$1/bin:$PATH" bash "$CHECK" "$1" 2>/dev/null); RC=$?
+}
+
+T=$(_repo b_zero); _artifacts "$T"; _ghstub "$T" '[]' 0
+_run_with_gh "$T"
+_line "①-b-C  no open PRs → no ①-b line (over-fire control)" '①-b' 0 "$OUT"
+
+T=$(_repo b_one); _artifacts "$T"; _ghstub "$T" '[{"number":227}]' 0
+_run_with_gh "$T"
+_line "①-b-P1 one open PR → sweep line fires"    '①-b 1 open PR' 1 "$OUT"
+
+# COUNT CONSISTENCY. gh emits compact single-line JSON when piped (measured 2026-08-02:
+# `[{"number":227},{"number":226},{"number":225}]` on ONE line), so a line-counting `grep -c`
+# reports 1 for any non-zero number of PRs. CLAUDE.md ①-b's own origin note pairs this step with
+# count-consistency, so a sweep that says "1 open PR" while three are open is a real defect, not
+# a cosmetic one — the operator classifies what the sweep names.
+T=$(_repo b_three); _artifacts "$T"
+_ghstub "$T" '[{"number":227},{"number":226},{"number":225}]' 0
+_run_with_gh "$T"
+_line "①-b-P3 three open PRs → sweep says 3"     '①-b 3 open PR' 1 "$OUT"
+
+T=$(_repo b_err); _artifacts "$T"; _ghstub "$T" '' 4
+_run_with_gh "$T"
+_g=0; printf '%s\n' "$OUT" | grep -q '①-b' || _g=1
+_gap "①-b gh ERROR is silent (indistinguishable from zero PRs)" "$_g" \
+  "gh present but failing (auth/offline, exit 4) → stderr discarded, count 0, NO line printed. \
+The sweep 'not run' and the sweep 'found nothing' look identical. Advisory surface, so not \
+fail-closed — but it should print 'sweep UNAVAILABLE' rather than nothing."
+
+echo
+echo "══ ④-log real-time completion log (the exit-1 FAIL path) ══"
+# NOTE the label: this is NOT CLAUDE.md's ④ (memory hygiene, deliberately unmechanized — see
+# CLAUDE.md §Session Wrap-up). The block was renamed 2026-08-02 because a green "④" implied memory
+# hygiene had been verified when nothing checked it. These lanes follow the renamed label; if they
+# ever go green against the OLD string again, the grep has stopped matching and the pair below is
+# passing vacuously.
+# The card is present and NEWEST in both ④ lanes on purpose: otherwise an exit 1 could be ⑤'s,
+# and the lane would not discriminate which invariant fired (instrument-discrimination rule).
+T=$(_repo four_missing); _card "$T"          # commit today, fh_completed absent
+_run "$T"
+_line "④-N  commits today + no fh_completed → ❌ fires" "❌ ④-log commits landed today" 1 "$OUT"
+_line "④-N  ⑤ still holds (failure attributable to ④)" '✅ ⑤ card is the newest'    1 "$OUT"
+_rc   "④-N  → exit 1 (BLOCKS a close push)" "$RC" 1
+
+T=$(_repo four_present)
+printf -- '- ✅ something — done\n' > "$T/tracks/_meta/fh_completed_${TODAY}.md"
+_card "$T"                                    # card written LAST → card-last holds
+_run "$T"
+_line "④-P  fh_completed present → no ❌ ④-log" '❌ ④-log'              0 "$OUT"
+_line "④-P  ⑤ ✅ present (known-positive)"    '✅ ⑤ card is the newest' 1 "$OUT"
+_rc   "④-P  → exit 0" "$RC" 0
+
+T=$(_repo four_old "3 days ago"); _card "$T"  # no commits today, no fh_completed
+_run "$T"
+_line "④-C  no commits today → no ④ line at all (over-fire control)" '④-log' 0 "$OUT"
+_rc   "④-C  → exit 0" "$RC" 0
+
+T="$TMPROOT/four_notrepo"; mkdir -p "$T/tracks/_meta"; _card "$T"
+_run "$T"
+_g=0; { printf '%s\n' "$OUT" | grep -q '❌ ④' || true; } ; printf '%s\n' "$OUT" | grep -q '❌ ④' || _g=1
+_gap "④  instrument-down degrades to PASS on a BLOCKING leg" "$_g" \
+  "No git → COMMITS_TODAY=0 → the ④ requirement silently evaporates and the check exits 0. \
+④ is one of only two legs that can block a close push; its trigger failing open means the block \
+is only as reliable as git being readable. Should distinguish 'no commits' from 'could not count'."
+
+echo
+echo "══ ④-b npm freshness + BIDIRECTIONAL entry-point drift ══"
+_tagged() {  # $1=name  $2..=paths to change AFTER the tag
+  local name="$1"; shift
+  local T="$TMPROOT/$name" p
+  mkdir -p "$T"
+  (
+    cd "$T" || exit 1
+    git init -q . 2>/dev/null
+    git config user.email anchor@local && git config user.name anchor
+    echo '{"name":"fx","version":"1.0.0"}' > package.json
+    echo base > CLAUDE.md; echo base > AGENTS.md
+    mkdir -p docs knowledge/shared/harness-core knowledge/shared/learnings
+    echo base > docs/codex-compat.md
+    echo base > knowledge/shared/harness-core/x.md
+    echo base > knowledge/shared/learnings/log.yaml
+    git add -A && git commit -qm base && git tag v1.0.0
+    for p in "$@"; do mkdir -p "$(dirname "$p")"; echo changed >> "$p"; done
+    git add -A && git commit -qm change
+  ) >/dev/null 2>&1
+  mkdir -p "$T/tracks/_meta"
+  printf -- '- ✅ x\n' > "$T/tracks/_meta/fh_completed_${TODAY}.md"
+  _card "$T"
+  printf '%s' "$T"
+}
+SHIP='④-b npm-shipped assets changed'
+DRIFT_CC='drift candidate (CC→Codex)'
+DRIFT_CX='drift candidate (Codex→CC)'
+
+T=$(_tagged bb_cc CLAUDE.md); _run "$T"
+_line "④-b-1 CLAUDE.md changed → republish reminder" "$SHIP"      1 "$OUT"
+_line "④-b-1 → CC→Codex drift fires"                 "$DRIFT_CC"  1 "$OUT"
+_line "④-b-1 → Codex→CC does NOT fire (paired)"      "$DRIFT_CX"  0 "$OUT"
+_rc   "④-b-1 drift is ADVISORY (exit 0)" "$RC" 0
+
+T=$(_tagged bb_cx AGENTS.md); _run "$T"
+_line "④-b-2 AGENTS.md changed → republish reminder" "$SHIP"      1 "$OUT"
+_line "④-b-2 → Codex→CC drift fires (the 07-19 miss)" "$DRIFT_CX" 1 "$OUT"
+_line "④-b-2 → CC→Codex does NOT fire (paired)"      "$DRIFT_CC"  0 "$OUT"
+
+T=$(_tagged bb_cx2 docs/codex-compat.md); _run "$T"
+_line "④-b-3 docs/codex-compat.md → Codex→CC fires" "$DRIFT_CX"   1 "$OUT"
+_line "④-b-3 → CC→Codex does NOT fire (paired)"     "$DRIFT_CC"   0 "$OUT"
+
+T=$(_tagged bb_kn knowledge/shared/harness-core/x.md); _run "$T"
+_line "④-b-4 shipped knowledge/ counts as a CC entry point" "$DRIFT_CC" 1 "$OUT"
+
+T=$(_tagged bb_both CLAUDE.md AGENTS.md); _run "$T"
+_line "④-b-5 both sides changed → republish reminder still"  "$SHIP"     1 "$OUT"
+_line "④-b-5 both sides → CC→Codex silent (over-fire ctrl)"  "$DRIFT_CC" 0 "$OUT"
+_line "④-b-5 both sides → Codex→CC silent (over-fire ctrl)"  "$DRIFT_CX" 0 "$OUT"
+
+T=$(_tagged bb_unshipped knowledge/shared/learnings/log.yaml); _run "$T"
+_line "④-b-6 UNshipped path → no republish reminder" "$SHIP"     0 "$OUT"
+_line "④-b-6 UNshipped path → no drift candidate"    "$DRIFT_CC" 0 "$OUT"
+_line "④-b-6 UNshipped path → ④-b is not silent-broken (control below)" '④-b' 0 "$OUT"
+
+# no-tag fixture: identical CLAUDE.md change, but no version tag exists
+T="$TMPROOT/bb_notag"; mkdir -p "$T"
+(
+  cd "$T" || exit 1
+  git init -q . 2>/dev/null
+  git config user.email anchor@local && git config user.name anchor
+  echo '{"name":"fx","version":"1.0.0"}' > package.json
+  echo base > CLAUDE.md && git add -A && git commit -qm base
+  echo changed >> CLAUDE.md && git add -A && git commit -qm change
+) >/dev/null 2>&1
+mkdir -p "$T/tracks/_meta"; printf -- '- ✅ x\n' > "$T/tracks/_meta/fh_completed_${TODAY}.md"; _card "$T"
+_run "$T"
+_g=0; printf '%s\n' "$OUT" | grep -q '④-b' || _g=1
+_gap "④-b whole step vanishes when no version tag is reachable" "$_g" \
+  "LAST_TAG empty → the republish reminder AND both drift candidates are skipped silently. \
+CLAUDE.md ④-b conditions the drift check on 'npm-shipped assets changed', not on a tag existing; \
+a shallow/tagless clone or a pre-first-release state therefore runs a close with the entry-point \
+drift check simply absent, and nothing says so."
+
+echo
+echo "══ pre-push SURFACE MATCHING (advise vs block) ══"
+# A stubbed session_close_check lets these lanes control _SC_RC exactly, which is the variable
+# under test. The real script's verdict logic is anchored above; what is anchored HERE is that
+# the hook routes verdict → advisory or block by surface, and nothing else.
+_hookfx() {  # $1=name $2=stub exit code  → echoes repo path
+  local T="$TMPROOT/$1"
+  mkdir -p "$T/scripts"
+  (
+    cd "$T" || exit 1
+    git init -q . 2>/dev/null
+    git config user.email anchor@local && git config user.name anchor
+    printf '#!/usr/bin/env bash\necho "❌ ⑤ card-last violated — synthetic"\nexit %s\n' "$2" \
+      > scripts/session_close_check.sh
+    chmod +x scripts/session_close_check.sh
+    git add -A && git commit -qm seed
+  ) >/dev/null 2>&1
+  cp "$HOOK" "$T/pre-push-under-test"
+  printf '%s' "$T"
+}
+_hookrun() {  # $1=repo $2=FH_SESSION_CLOSE value ("" = unset)
+  local T="$1" v="$2" sha
+  sha=$(git -C "$T" rev-parse HEAD)
+  # ordinary NEW-BRANCH push: local_sha real, remote_sha zero → not a delete, not a force,
+  # not the integration branch → the hook must fall through to exit 0 unless a leg blocks.
+  OUT=$(cd "$T" && printf 'refs/heads/feat/x %s refs/heads/feat/x %s\n' "$sha" "0000000000000000000000000000000000000000" \
+        | env ${v:+FH_SESSION_CLOSE=$v} bash ./pre-push-under-test origin https://example.invalid/x.git 2>&1)
+  RC=$?   # command substitution: this is the pipeline's status under pipefail, i.e. the HOOK's
+}
+
+T=$(_hookfx hook_adv 1); _hookrun "$T" ""
+_rc   "PP-1 ordinary push + violation → exit 0 (ADVISORY)" "$RC" 0
+_line "PP-1 → the ❌ line is surfaced, not swallowed"  '❌ ⑤ card-last violated' 1 "$OUT"
+_line "PP-1 → says it is advisory + names the enforcing form" 'FH_SESSION_CLOSE=1' 1 "$OUT"
+
+T=$(_hookfx hook_block 1); _hookrun "$T" 1
+_rc   "PP-2 close push + violation → exit 1 (BLOCKS)" "$RC" 1
+_line "PP-2 → prints the enforcing banner" '⛔ FH Session-Close Check' 1 "$OUT"
+
+T=$(_hookfx hook_ok 0); _hookrun "$T" 1
+_rc   "PP-3 close push + CLEAN → exit 0 (blocks on the VERDICT, not on the flag)" "$RC" 0
+_line "PP-3 → prints the consistent line" '✅ FH Session-Close Check' 1 "$OUT"
+
+T=$(_hookfx hook_ok2 0); _hookrun "$T" ""
+_rc   "PP-4 ordinary push + CLEAN → exit 0" "$RC" 0
+_line "PP-4 → no advisory noise on a healthy push" 'close invariant(s) violated' 0 "$OUT"
+
+echo
+echo "──────────────────────────────────────────────"
+if [ "$FAILED" -ne 0 ]; then
+  echo "CLOSE-CHAIN LANES: FAIL — the close-chain instrument is miscalibrated (do not trust its verdict)"
+  echo "  asserting lanes passed: $PASSED · open gaps: $GAPS"
+  exit 1
+fi
+echo "CLOSE-CHAIN LANES: PASS ($PASSED asserting lanes) · $GAPS KNOWN GAP(S) still open (see ⓘ above)"
+echo "  A green line here covers ① ①-b ④ ④-b and the pre-push advise/block split — NOT the gaps."
+exit 0