@chrono-meta/fh-gate 1.4.86 → 1.4.87

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -868,3 +868,79 @@
     just declared success. Adversarial review does not substitute for first use; today is the mirror:
     self-repair does not substitute for adversarial review. Axis 2 shipped NOT CONVERGED with the open
     leak channel declared in the header rather than closed by assertion.'
+
+- date: 2026-08-03
+  agent: codex gpt-5.5 (cross-family, stdin form) + fh-meta:challenger (isolated Agent) + one headless
+    Sonnet blind sim (claude -p, tools stripped, repo-external cwd)
+  task: Axis 2 + target-tier sim for the ablation known-pair calibration — scripts/ablation_calibrate.sh
+    (new), scripts/probe_scope_check.sh header, .claude/regression/probes.md rows G-GATE-08/09
+  mode: two families dispatched on the same diff; consolidated here as one entry with measured counts
+  outcome: accepted
+  evidence: 'Codex 4 critical / 4 high / 3 medium; challenger 2S / 7A / 2B. The two families found
+    DIFFERENT classes and only partly overlapped. Codex: stderr merged into the scored stream, so a
+    single input echo passes P, N and T at once (every control token lives in the input); no runner
+    exit-status check; unanchored grep -q 47 accepting 470/1147; baseline gated on a shared fail flag.
+    Challenger (executed against the shipped script, not reasoned): control T conflated "could not read"
+    with "read it and the answer was not there" and certified a fully tool-enabled runner as calibrated;
+    the two arms shared one cwd so the negative arm could read the answer off its neighbour; probes.md
+    Count line shipped stale INSIDE this diff (30/mp25 vs actual 32); G-GATE-09 typed mandatory-pass
+    while being mechanically unobservable; the public script cited gitignored tracks/** records four
+    times as its evidence. All reproduced before acting. Sonnet blind sim of the repaired header: PASS —
+    recovered calibrate-first, pre-registration, reps>=3, the allowlist form, and answered "no" to
+    "one rep, arm B answered, can you record CUT?".'
+  note: 'Second time in one day that the miss landed where self-repair had just declared success. New
+    this round: the ANCHOR ITSELF was decorative on first try — reverting three fixes left the lane file
+    15/15 green. Two different causes: two lanes did not carry an input that exposes the defect (they
+    went red for an unrelated reason and read as coverage), and one revert silently did not apply. A
+    revert is an instrument too; measure that it took effect before believing the anchor.'
+
+- date: 2026-08-03
+  agent: fh-meta:challenger (isolated Agent) ×6 across three branches + codex gpt-5.5 (cross-family)
+    ×1 + headless Sonnet target-tier sims ×6 (claude -p, tools stripped, repo-external cwd)
+  task: session 2 — Axis 2 for the CLAUDE.md gate-scope pointer fix (4R), the templates/ domain-scoped
+    sections fix (1R), the probe_scope_check carryovers (1R), plus the cross-family leg on the
+    load-bearing pointer change and the before/after known-pair sims for each salience change
+  mode: consolidated entry with measured counts, per the log's own allowance
+  outcome: accepted
+  evidence: 'Pointer branch 0S3A → 1S5A → 1S6A → 1S2A; template branch 0S/3A; probe-scope branch
+    0S/3A/5B. The cross-family leg found in ONE pass what four same-family rounds had walked past —
+    the record asserted "REDUCED, not withdrawn" in one place and "withdrawn" in three others, 40
+    lines apart — and named the mechanism: the file performs visible self-correction in a persuasive
+    narrative voice, which makes an internal contradiction easy to wave through. Three separate
+    rounds independently pushed toward REDUCTION rather than tightening, and all three reductions
+    held: a second tool control, a prose/mechanism parity check, and a `[ -r ]` guard were each
+    measured inert or finding-generating and removed.'
+  note: 'The dominant new-defect class this session was MY OWN ANCHORS BEING DECORATIVE — four
+    instances, four different causes (a lane carrying no input that exposes the defect; a revert that
+    silently did not apply; a needle matching unrelated prose; a stub short-circuiting the layer the
+    guard lives in). None was self-caught. Harvested to [[feedback_anchor_can_be_decorative]].'
+
+- date: 2026-08-04
+  agent: codex (gpt-5.5) — cross-family adversarial sidecar
+  invoked_by: FH self-dev session (card carry-over autopilot)
+  task: >-
+    Two separate adversarial audits. (1) A pre-commit hook trigger split plus a new known-pair
+    section in scripts/gate_pathspec_check.sh. (2) The §ⓐ restriction-union merge spec in
+    knowledge/shared/harness-core/capability_composition_contract.md.
+  outcome: accepted
+  evidence: >-
+    Audit (1): 3 defects, same-family inline pass found 0. The load-bearing one was a worktree-vs-
+    staged FAIL-OPEN — the checker read the worktree copy of CLAUDE.md, so staging a broken asset
+    line and then repairing the worktree WITHOUT staging passed the gate; reproduced before fixing
+    (index 0 occurrences / worktree 1 / anchor exit 0) and re-measured closed after (exit 1 both
+    directions). The other two: an `agents/` needle that passed on a partial class drop, and a stale
+    comment instructing the next maintainer to restore the exact coupling the change removed.
+    Codex explicitly CLEARED the LOADBEARING separation and the bash-3.2 quoting — a negative result
+    recorded because "found nothing here" is also evidence.
+    Audit (2): 5 defects, inline pass found 4 of them independently. The one net-new finding was the
+    worst of the set — §ⓐ.3 check 2 was written `merged ⊒ l` while §ⓐ.1 defined `a ⊑ b` as "a is at
+    least as strict as b", i.e. the spec's only mechanical direction check asserted the INVERSE of
+    its own invariant. Fixed by removing the glyph and writing every strictness claim as a
+    `permits(...) ⊆` relation.
+  note: >-
+    Second consecutive session where the cross-family leg produced net-new findings that same-family
+    rounds walked past, and where the net-new finding was the most severe one. Counted 5 dispatches
+    in the SubagentStop tally (2 codex audits plus 3 harness-side spawns); consolidated into this one
+    entry per the "counts and outcomes, not one stub per dispatch" rule.
+    Instrument note: the invocation form matters — `| codex exec -` (stdin) as recorded in
+    [[feedback_sidecar_liveness_not_passive_wait]]; the argv form hangs nondeterministically.

package/knowledge/shared/rules/auto_project_mapping.md

@@ -91,12 +91,75 @@ governance depth to condition 4 (mechanical-anchor / 4-axis gate) — the litmus
 
 | # | Item | Source → target | Effect |
 |---|---|---|---|
-| 1 | Session rules | `templates/.claude/rules/session.md` → `{project}/.claude/rules/session.md` | Session-start auto-read, backup, rule hierarchy |
+| 1 | Session rules | `templates/.claude/rules/session.md` → `{project}/.claude/rules/session.md` **→ then §6-b prune + substitute (the copy is not the install)** | Session-start auto-read, backup, rule hierarchy |
 | 2 | Context filter | `templates/.claudeignore` → `{project}/.claudeignore` | Token footprint control |
 | 3 | Env card | `templates/fh_env_context.jsonc` → `{project}/.claude/rules/fh_env_context.jsonc` | Environment context for sessions |
 | 4 | **MCP tool gating** (conditional — offered only when the project mounts an external MCP server: `.mcp.json`/`mcp.json` present, or the user is adding one) | `templates/.claude/rules/mcp_tool_gating.md` → `{project}/.claude/rules/mcp_tool_gating.md` | Name-keyed ask/allow tiers for external MCP tools — server annotations are unreliable (measured 2026-06-11: a live server shipped all-None hints incl. its irreversible send tool); §3 table filled at mount time |
 | 5 | **Official-plugin scan** (recommend list only — **never auto-install**) | plugin-recommender Tier 0/1 pass on the project's stack | No-reinvention acceleration: matching `*-lsp` for the project's language + workflow plugins (code-review · commit-commands · feature-dev …) from `claude-plugins-official` — see `knowledge/shared/plugin-catalog/recommended_plugins.md` §Category 0.5. Each install user-approved |
 
+### 6-b. Prune + substitute — the step that was missing, and the measurement that says so
+
+**A copy is not an install.** Item 1 above used to end at the copy, and the field result was measured
+on 2026-08-04 across every repo that inherited this template:
+
+| Repo | `{FH_ROOT}` raw | `[CUSTOMIZE]` raw |
+|---|---|---|
+| A (bash/python wiki engine) | 1 | 3 |
+| B | 2 | 6 |
+| C (a *template* repo — identical is correct here) | 2 | 6 |
+| D | **0** | **0** — the one that was customized by hand |
+
+Three of four shipped with the hub-path placeholder unresolved. The earlier repair went to the
+*template* (marking domain-scoped sections for deletion, 2026-08-04) and measured a real gain — but
+only *when someone asked*. The field failure is that **there was no moment of asking**. This is that
+moment; it is a step, not a better sentence.
+
+Run immediately after each `templates/` copy, in the target repo:
+
+```bash
+TGT={project}/.claude/rules/session.md
+# 1. SUBSTITUTE — the hub path this project should point at
+FH_ROOT_ABS=${FH_ROOT_ABS:-$HOME/projects/forge-harness}   # adjust if the hub lives elsewhere on this machine
+sed -i.bak "s|{FH_ROOT}|$FH_ROOT_ABS|g" "$TGT" && rm -f "$TGT.bak"   # -i.bak = the form BSD requires and GNU accepts
+
+# 2. PRUNE — one ask per SECTION-HEADING marker, then delete the whole section (not just the marker)
+grep -n '<!-- \[CUSTOMIZE\] DOMAIN-SCOPED' "$TGT"
+
+# 3. VERIFY — Done-When. BOTH must print 0.
+grep -c '{FH_ROOT}' "$TGT"
+grep -c '<!-- \[CUSTOMIZE\] DOMAIN-SCOPED' "$TGT"
+```
+
+**Step 3 is the Done-When** *[mandatory-pass]* — and the two counts are deliberately narrow.
+
+- **Why `{FH_ROOT}`**: an unresolved substitution token. It is the exact thing three of four inherited
+  repos shipped raw.
+- **Why only the `<!-- ... -->` form of `DOMAIN-SCOPED`**: those three markers head a deletable
+  section. The template also *mentions* the phrase in prose ("TWO are DOMAIN-SCOPED and belong only
+  to…"), which is documentation and must survive — counting every occurrence would make the target
+  unreachable.
+- **Why `[CUSTOMIZE]` is NOT counted**: the template's own instruction line reads "Change sections
+  marked with [CUSTOMIZE] comments to match your project". A zero target for that string can never be
+  met while the file explains itself, and an unreachable Done-When trains exactly one behaviour —
+  **deleting the marker instead of doing the work** — which is the defect this step exists to prevent.
+  `[CUSTOMIZE]` stays an editing hint, judged by the installer, not a counted gate.
+
+> That distinction is not theory. The first draft of this step counted all three strings and demanded
+> zero; running it on a fresh copy of the template returned **2 after a full prune** — both from lines
+> that must stay. The instrument was checked against a known pair before this step shipped, which is
+> the only reason the unreachable target did not become the rule (`§Instrument-Calibration`).
+
+Do **not** silence a count by deleting the marker alone: the markers are attached to sections, and a
+marker removed from a section that stayed is the same defect with its evidence erased.
+
+**Do not split the template into core+domain modules.** The 2026-08-04 measurement pointed at the
+*install step*, not at the file's shape, and this repo's own history says a new mechanism introduced
+speculatively generates its own defects. The markers plus this step are the fix.
+
+**Residency**: run this inside the target repo only. One of the counted repos is company-adjacent —
+it was counted and left untouched, and its contents are not reproduced here or anywhere outside its
+own environment.
+
 **Field-asset scaffold (on-demand — NOT a `templates/` install)**: harness-ification surfaces field-specific skills/agents *as needed* — the field's domain work produces them. FH accelerates their *creation*: not the domain content (the field team authors that), but the **gate-compliant structure**. When a skill-worthy recurring pattern appears (3+ reps → `#skill-candidate` tag · `field-harvest` signal · a repeated manual workflow), offer to scaffold a skeleton:
 
 - **Skill skeleton** — the frontmatter field set (`name`/`description`/`user-invocable`/`allowed-tools`) that is universal across active FH skills (regen: `grep -L user-invocable plugins/*/skills/*/SKILL.md` returns none; `model:` is deliberately NOT universal since 2026-07-10 — hard pins retired per `sonnet_floor_doctrine.md`, skills session-inherit and express depth as dispatch) + **four stubs, all mandatory in the skeleton**: ① Trigger stub (≥3 phrases — initiate) ② Done-When stub (with check-class — complete) ③ halt stub (budget/convergence guard) ④ persist stub (what state reaches the next run) + Step skeleton — the 5-question loop discipline by construction (`loop_engineering.md`; validate=#3 is the check-class declaration in ②). **Parameterizes** `contention-layer` Step 4's skeleton template (per its need-driven note — `origin: field-scaffold`, `contention-parents`→source-pattern pointer).

package/knowledge/shared/rules/operations.md

@@ -41,6 +41,32 @@ The hub audits and improves itself weekly.
 
 ---
 
+## Flaky-lane triage — re-running erases the evidence you need
+
+**Before you re-run a red CI job, pull the failing lane name out of its log.** A re-run overwrites the
+run's `conclusion`, and GitHub's summary then shows the whole history as green — including the run
+that failed. The failure is not hidden behind a filter; it no longer exists as a queryable state.
+
+Measured 2026-08-03: a `sync_from_be_lanes.sh` flake was recorded and, when someone went looking the
+next day, **all 14 runs that day reported `success`**. The re-runs had rewritten the conclusions and
+the failing job's lane name had never been captured anywhere. There was nothing left to diagnose, so
+nothing was diagnosed — a guessed diagnosis was correctly refused rather than written down.
+
+Order, on the next occurrence:
+
+```bash
+gh run list --workflow <wf> --limit 30 --json databaseId,conclusion,headSha   # find the red run FIRST
+gh run view <id> --log-failed | grep -E '❌|FAIL|not ok' | head -20           # capture the lane NAME
+# only now consider re-running
+```
+
+Record the lane name in the session log even if the re-run goes green — **a flake that cannot be named
+cannot be fixed**, and the second occurrence is the one that gets fixed only if the first was named.
+
+This is prose on purpose. N=1: one flake, one lost diagnosis. The mechanization threshold in this repo
+is N≥3 or the same class recurring on another surface; a scheduled log-capture job built on a single
+occurrence would be the speculative build the evidence-threshold rule forbids.
+
 ## 3-Phase Maturity Roadmap
 
 The hub's long-term evolution path is managed as a 3-stage model: **Phase I (entering maturity) → Phase II (frontier following) → Phase III (frontier leading)**. Phase transition gates have the simplification principle ("A good harness gets simpler over time") as a common condition.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.86",
+  "version": "1.4.87",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -51,6 +51,7 @@
     "CHEATSHEET.md",
     "CLAUDE.md",
     ".claude/registry/agent_cards.json",
+    ".claude/registry/README.md",
     "docs/CONTRIBUTING.md",
     "bin/fh-codex-doctor.js",
     "bin/fh-gate.js",
@@ -148,6 +149,9 @@
     "scripts/test_halffix_lanes.sh",
     "scripts/test_ollama_panel_lanes.sh",
     "scripts/test_tag_version_lanes.sh",
-    "templates/subagent-tally-hook.json"
+    "templates/subagent-tally-hook.json",
+    "scripts/test_session_close_chain_lanes.sh",
+    "scripts/test_node_infra_delta_lanes.sh",
+    "scripts/test_wizard_snippet_merge_lanes.sh"
   ]
 }

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.86",
+  "version": "1.4.87",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.86",
+  "version": "1.4.87",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/skills/prompt-regression/SKILL.md

@@ -58,7 +58,7 @@ ls .claude/regression/probes.md 2>/dev/null || echo "NO_CUSTOM_PROBES"
 ```
 
 **If custom probes exist**: load and use them. The hub repo ships its golden probe set
-(known-answer offline eval, 28 probes with check classes) at exactly this path — when
+(known-answer offline eval, 32 probes with check classes) at exactly this path — when
 present it is canonical and supersedes the default matrix below.
 
 **If no custom probes** (e.g. Mode C install without the hub repo): use the default

package/scripts/gate_pathspec_check.sh

@@ -155,6 +155,91 @@ else
   fail=$((fail + 1))
 fi
 
+# ── 5. CLAUDE.md asset-list parity — the FIXED per-class needle table ─────────
+# WHY A TABLE, AND WHY FIXED. A parity check was attempted for this on 2026-08-03 and CUT the same
+# day: it guessed its needles per run, produced four findings in one adversarial round, and — the
+# decisive part — never fired on `CLAUDE.md` at all, because `CLAUDE\.md` was not in the hook's
+# GATE_IMPL trigger. Both defects are addressed here and neither is optional: the needles below are
+# FIXED (a literal table, reviewed as data), and the hook gained a SEPARATE trigger
+# (`ASSETLIST_IMPL`) so this anchor actually runs when the list it guards is edited. The trigger is
+# deliberately NOT `GATE_IMPL`: that variable also feeds `$LOADBEARING`, and enrolling every
+# CLAUDE.md prose edit into cross-family review is a different job. Retrying without both the
+# fixed table AND a trigger repeats the cut.
+#
+# WHAT IT GUARDS. `CLAUDE.md` §FH Improvement 4-Axis Auto-Gate carries a canonical asset list, and
+# `.claude/rules/fh_4axis_gate.md` carries another. When a class is added to the hook but not to a
+# prose list (or dropped from one list only), the divergence is silent — the gate still blocks, so
+# nothing goes red, while the resident text tells readers a class is not covered. That is the exact
+# shape measured on 2026-08-03, when two classes were added to both lists with no anchor behind them.
+#
+# SCOPE, deliberately narrow: this asserts the asset-list SENTENCE names each class. It does not
+# assert the hook and the sentence are equal sets — that stronger claim needs a parse of the regex
+# into classes, which is the guessing this table replaces. Narrow and mechanical beats broad and
+# self-generating; the enumeration sweep in §4 is where breadth lives.
+CLAUDE_MD="$REPO_ROOT/CLAUDE.md"
+# Read the STAGED blob as well as the worktree, and require BOTH to declare the class.
+# Cross-family review (2026-08-04, codex/gpt-5.5) reproduced the fail-open: reading only the worktree
+# lets a commit stage a broken asset line, repair the worktree WITHOUT staging, and pass — the hook
+# sees CLAUDE.md in $STAGED, runs this anchor, and validates content that is not what is being
+# committed. Measured before the fix: index 0 occurrences / worktree 1 / anchor exit 0.
+# Checking only the index would invert the same hole (a broken UNSTAGED edit would pass a manual
+# run), so both are required. `git show :CLAUDE.md` fails outside a repo or with nothing in the
+# index; that is a skip of the staged leg, never a pass of it.
+_asset_line_of() {  # $1 = file-or-'-' content source label; reads stdin
+  grep -m1 '^\*\*FH 자산을 수정하면\*\*' || true
+}
+ASSET_LINE=$(_asset_line_of < "$CLAUDE_MD" 2>/dev/null || true)
+# Distinguish "not in the index" (a real skip) from "git failed" (an instrument error). The advisory
+# degrade lint flagged the first draft here, and correctly: a bare `|| true` let the staged leg
+# silently abstain on ANY git failure, which half-reopens the fail-open this section was just fixed
+# for. Tracked files always have an index entry, so for this repo the abstain branch is unreachable
+# in normal operation — it exists for a clone where CLAUDE.md is untracked.
+if git -C "$REPO_ROOT" ls-files --error-unmatch CLAUDE.md >/dev/null 2>&1; then
+  ASSET_LINE_STAGED=$(git -C "$REPO_ROOT" show :CLAUDE.md 2>/dev/null | _asset_line_of)
+  if [ -z "$ASSET_LINE_STAGED" ]; then
+    echo "  ❌ CLAUDE.md is tracked but its staged blob yielded no declaration line —"
+    echo "     instrument error (or the staged content dropped the line entirely), NOT a pass."
+    fail=$((fail + 1))
+  fi
+else
+  ASSET_LINE_STAGED=""   # untracked clone — worktree leg is the only measurable one
+fi
+if [ -z "$ASSET_LINE" ]; then
+  echo "  ❌ CLAUDE.md asset-list declaration line not found — instrument error, NOT a pass"
+  echo "     (looked for a line starting '**FH 자산을 수정하면**' in $CLAUDE_MD)"
+  fail=$((fail + 1))
+else
+  # label|needle (ERE, matched against the declaration line only)
+  for entry in \
+    'SKILL.md|SKILL\.md' \
+    'SKILL_detail.md|SKILL_detail\.md' \
+    '.claude/rules|\.claude/rules/' \
+    'knowledge/shared/rules|knowledge/shared/rules/' \
+    'templates/|templates/' \
+    'CLAUDE.md|CLAUDE\.md' \
+    'AGENTS.md|AGENTS\.md' \
+    'scripts/**/*.sh|scripts/\*\*/\*\.sh' \
+    'agent definitions (plugins/*/agents)|plugins/\*/agents/' \
+    'agent definitions (.claude/agents)|\.claude/agents/'
+  do
+    lbl="${entry%%|*}"; needle="${entry#*|}"
+    _hit=1
+    printf '%s' "$ASSET_LINE" | grep -qE "$needle" || _hit=0
+    # The staged leg only votes when it exists — an empty index blob is "not measured", not "absent".
+    if [ -n "$ASSET_LINE_STAGED" ]; then
+      printf '%s' "$ASSET_LINE_STAGED" | grep -qE "$needle" || _hit=0
+    fi
+    if [ "$_hit" -eq 1 ]; then
+      echo "  ✅ CLAUDE.md asset list declares: $lbl"; pass=$((pass + 1))
+    else
+      echo "  ❌ CLAUDE.md asset list no longer declares: $lbl"
+      echo "     The hook still gates it, so nothing goes red — the resident text now tells readers"
+      echo "     a gated class is not covered. Re-add it, or retire the class from the hook too."
+      fail=$((fail + 1))
+    fi
+  done
+fi
+
 echo
 if [ "$fail" -eq 0 ]; then
   echo "gate_pathspec_check: PASS ($pass pairs)"

package/scripts/package_coverage_check.sh

@@ -65,6 +65,12 @@ ACCEPTED_ABSENT=(
   # user's own cross-context wiring — the template it is copied FROM is what ships.
   ".claude/rules/local_fh_context.md"
   ".claude/regression/probes.md"
+  # Its sibling, and absent for the same reason one layer up: this file records which sections of
+  # THIS repo's resident CLAUDE.md were measured load-bearing. A consumer's CLAUDE.md is their
+  # own text, so our verdicts are not merely useless to them — cited from a shipped doc they would
+  # read as claims about THEIR file. The shipped docs name it as the place verdicts live in the
+  # harness repo, which is a pointer for contributors, not a promise of a shipped artifact.
+  ".claude/regression/ablation_verdicts.md"
   "scripts/sync-to-be.sh"
   "scripts/sync_guard_check.sh"
   # Return path (companion store → hub) and its anchor. Same reason as the forward path above: the
@@ -77,6 +83,27 @@ ACCEPTED_ABSENT=(
   # regression run must not compare against this harness's probe set). Shipping the reader without
   # its corpus would put a script in the package that can only ever report "instrument error".
   "scripts/probe_scope_check.sh"
+  # The known-pair precondition for `probe_scope_check.sh`'s ablation procedure. Absent for the same
+  # reason as its subject — the procedure ablates THIS repo's resident CLAUDE.md, so a consumer has
+  # nothing to point it at — plus one of its own: every run spends API calls against the consumer's
+  # account. Shipping a script whose only effect on a consumer's machine is a bill is worse than
+  # omitting it.
+  "scripts/ablation_calibrate.sh"
+  # Its anchor. Absent for exactly one reason — its SUBJECT is absent — and that pairing is the whole
+  # rule: shipping an anchor whose subject is not in the package is the defect that put a red
+  # selfcheck in front of every 1.4.85/1.4.86 consumer. selfcheck's block SKIPs when the subject is
+  # missing, so the package stays green without pretending the lanes ran.
+  "scripts/test_ablation_calibrate_lanes.sh"
+  # Anchor for probe_scope_check.sh, which is ACCEPTED_ABSENT above for want of its corpus. Same
+  # pairing rule: an anchor whose subject does not ship must not ship either, or the consumer's
+  # selfcheck goes red on a subject they do not have.
+  "scripts/test_probe_scope_lanes.sh"
+  # Measures what the LIVE `claude` CLI does with several SessionStart hooks on one matcher —
+  # so every run needs the CLI, auth, and spends tokens on the consumer's account. Same reason
+  # `ablation_calibrate.sh` is absent: shipping a script whose only effect on a consumer's
+  # machine is a bill is worse than omitting it. selfcheck reports it NOT EXERCISED (exit 2)
+  # where the CLI is missing, so the package stays green without pretending the lanes ran.
+  "scripts/test_sessionstart_multihook_lanes.sh"
 )
 
 out=$(python3 - "${ACCEPTED_ABSENT[@]}" <<'PY'

package/scripts/selfcheck.sh

@@ -202,6 +202,39 @@ else
   fail=1
 fi
 
+# And the ablation calibrator, for the third instance of the same reason. Its whole job is telling
+# apart states that look identical from outside — "the arm could not answer" vs "the runner is dead"
+# vs "the runner read the answer off disk" — and round 2 of its own adversarial review found that
+# three of its round-1 fixes had no discriminating lane at all. Unwired lanes are green on one
+# machine and nowhere else, which is the case this file exists to prevent. Stub runners, no API
+# spend, so running them here costs nothing. Not hermetic w.r.t. the filesystem: two isolation lanes
+# create and remove an empty, per-PID, git-invisible directory in the worktree.
+# probe-scope lanes — the subject had 15 sibling checkers with an anchor and none of its own, so
+# three repairs shipped on 2026-08-03 that could each be reverted with nothing turning red. Same
+# SKIP/FAIL shape as the blocks above: a missing SUBJECT is a legitimate skip, a present subject with
+# a missing anchor is a real failure.
+if [ ! -f scripts/probe_scope_check.sh ]; then
+  echo "SKIP  test_probe_scope_lanes.sh (subject scripts/probe_scope_check.sh absent)"
+elif [ -f scripts/test_probe_scope_lanes.sh ]; then
+  if ! bash scripts/test_probe_scope_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_probe_scope_lanes.sh: probe_scope_check.sh present but its anchor is missing"
+  fail=1
+fi
+
+if [ ! -f scripts/ablation_calibrate.sh ]; then
+  echo "SKIP  test_ablation_calibrate_lanes.sh (subject scripts/ablation_calibrate.sh absent)"
+elif [ -f scripts/test_ablation_calibrate_lanes.sh ]; then
+  if ! bash scripts/test_ablation_calibrate_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_ablation_calibrate_lanes.sh: ablation_calibrate.sh present but its anchor is missing"
+  fail=1
+fi
+
 if [ ! -f scripts/fh_node_check.sh ]; then
   echo "SKIP  test_node_check_lanes.sh (subject scripts/fh_node_check.sh absent)"
 elif [ -f scripts/test_node_check_lanes.sh ]; then
@@ -213,6 +246,52 @@ else
   fail=1
 fi
 
+# The infra-delta half of the same subject. Separate suite, same pairing rule: it exists only because
+# fh_node_check.sh does, so its absence beside a present subject is a FAIL, not a skip.
+if [ ! -f scripts/fh_node_check.sh ]; then
+  echo "SKIP  test_node_infra_delta_lanes.sh (subject scripts/fh_node_check.sh absent)"
+elif [ -f scripts/test_node_infra_delta_lanes.sh ]; then
+  if ! bash scripts/test_node_infra_delta_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_node_infra_delta_lanes.sh: fh_node_check.sh present but its anchor is missing"
+  fail=1
+fi
+
+# SessionStart multi-hook + install-wizard snippet merge. Subject for both = the shipped settings
+# snippets; a clone without them is a legitimate SKIP, a clone with them and no anchor is not.
+for _pair in \
+  "templates/settings.SessionStart.snippet.json|scripts/test_sessionstart_multihook_lanes.sh" \
+  "templates/settings.SessionStart.snippet.json|scripts/test_wizard_snippet_merge_lanes.sh"
+do
+  _subj="${_pair%%|*}"; _anc="${_pair#*|}"
+  if [ ! -f "$_subj" ]; then
+    echo "SKIP  ${_anc##*/} (subject $_subj absent)"
+  elif [ -f "$_anc" ]; then
+    # THREE-valued, like the session-close anchors above — and for a third reason they do not have.
+    # test_sessionstart_multihook_lanes.sh measures what the LIVE `claude` CLI does with several
+    # SessionStart hooks on one matcher. It declares exit 2 = NOT EXERCISED (no CLI / no auth /
+    # opt-out). A CI runner structurally cannot have that CLI, so collapsing 2 into fail=1 makes
+    # every Linux run red forever — over-blocking, which is how a red CI stops being read at all
+    # (the same reasoning that keeps the session-close check advisory on ordinary pushes).
+    # 2 does NOT set fail, and it prints a line that cannot be misread as a pass. On a machine that
+    # DOES have the CLI the suite runs in full and a real failure still exits 1.
+    # Measured 2026-08-04: the first draft of this wiring flattened 2 into fail=1 and turned CI red
+    # while the suite had correctly reported "NOT EXERCISED — the `claude` CLI is not on PATH" —
+    # i.e. it rebuilt, ten lines below the comment warning against it, the exact flattening defect.
+    bash "$_anc"; _rc=$?
+    if [ "$_rc" -eq 2 ]; then
+      echo "NOT EXERCISED  ${_anc##*/}: this environment cannot run the measurement (exit 2 — never a pass)"
+    elif [ "$_rc" -ne 0 ]; then
+      fail=1
+    fi
+  else
+    echo "FAIL  ${_anc##*/}: $_subj present but its anchor is missing"
+    fail=1
+  fi
+done
+
 # Two guards that read the AUTHOR's own actions rather than the repo's files. Both were added
 # 2026-07-31; the pipe-verdict lane shipped in PR #209 WITHOUT this wiring, which is itself the
 # half-fix class the second guard exists to catch — found by running that guard on this repo.
@@ -249,7 +328,7 @@ else
   fail=1
 fi
 
-for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe.sh; do
+for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe.sh scripts/test_session_close_chain_lanes.sh; do
   if [ ! -f scripts/session_close_check.sh ]; then
     echo "SKIP  ${_anchor##*/} (subject scripts/session_close_check.sh absent)"
   elif [ -f "$_anchor" ]; then

package/scripts/session_close_check.sh

@@ -39,6 +39,7 @@ if command -v gh >/dev/null 2>&1; then
   # `[{"number":227},{"number":226},{"number":225}]` → old 1, new 3; `[]` → 0 both ways — which is
   # why an environment with zero open PRs can never surface this, and why the 0-case alone is not a
   # calibration. Observed live the same day: 2 open PRs reported as 1.
+  # Anchored by scripts/test_session_close_chain_lanes.sh lane ①-b-P3.
   PRS=$(gh pr list --author "@me" --state open --json number 2>/dev/null | grep -o '"number"' | wc -l | tr -d ' ' || true)
   [ "${PRS:-0}" -gt 0 ] && echo "⚠️  ①-b $PRS open PR(s) by you — classify: self-mergeable vs awaiting-external"
 fi
@@ -72,11 +73,16 @@ if [ "${FH_CHANGED:-0}" -gt 0 ]; then
   fi
 fi
 
-# ④ real-time completion log — required whenever any commit landed today
+# ④-log real-time completion log — required whenever any commit landed today.
+# NAMING: this block does NOT implement CLAUDE.md's ④ (memory hygiene). It implements the
+# "Real-time completion tracking" paragraph that sits above the chain. Labelling it ④ meant a green
+# "④" told a reader memory hygiene had been verified when nothing had checked it — false coverage,
+# the same class as a summary line that prints PASS while the exit code refuses. The label now says
+# what it checks. (Numbering mismatch found 2026-08-02 by the lane-writing pass.)
 COMMITS_TODAY=$(git -C "$FH" log --since="today 00:00" --oneline 2>/dev/null | wc -l | tr -d ' ')
 FC="$FH/tracks/_meta/fh_completed_${TODAY}.md"
 if [ "$COMMITS_TODAY" -gt 0 ] && [ ! -f "$FC" ]; then
-  echo "❌ ④ commits landed today but tracks/_meta/fh_completed_${TODAY}.md is missing"
+  echo "❌ ④-log commits landed today but tracks/_meta/fh_completed_${TODAY}.md is missing"
   FAIL=1
 fi
 
@@ -150,12 +156,20 @@ if [ "$HOOK_OK" -eq 0 ]; then
   echo "     (that file is gitignored, so a fresh clone has none). An unmeasured dispatch count is"
   echo "     NOT a count of zero. Install: templates/subagent-tally-hook.json → .claude/settings.json"
 fi
-DISPATCHED=$(grep -c "^$TODAY$" "$TALLY" 2>/dev/null | tr -d ' ' || echo 0)
+# `grep -c` PRINTS 0 and EXITS 1 when the count is zero. Under `set -o pipefail` (line 16) that
+# makes the pipeline fail, `|| echo 0` appends a SECOND line, and the value becomes "0\n0" — which
+# `[ -eq ]` rejects as a bash error, so the branch it guards is skipped. The guard was therefore
+# disarmed in EXACTLY the case it exists for (zero log entries). Measured 2026-08-04 during a close:
+# the check printed ✅ while `[: 0\n0: integer expression expected` went to stderr.
+# Fix = no `|| echo`, plus integer sanitation. This is the documented prescription for this class
+# ([[feedback_pipefail_fallback_disarms_guard]]) applied to the checker that cited it.
+_int() { case "${1:-}" in (''|*[!0-9]*) echo 0 ;; (*) echo "$1" ;; esac; }
+DISPATCHED=$(_int "$(grep -c "^$TODAY$" "$TALLY" 2>/dev/null | tr -d ' ' || true)")
 # Both quotings, because the file carries both: hand-written entries use `- date: 2026-08-02`
 # while anything appended via yaml.dump renders `- date: '"'"'2026-08-02'"'"'`. Matching one form counted
 # half the entries as absent — a divergent-normalizer miss inside the check that exists to catch
 # missing records. Known-pair calibrated below in test_dispatch_log_lanes.sh.
-LOGGED=$(grep -cE "^- date: *'?$TODAY'?" "$LOG" 2>/dev/null | tr -d ' ' || echo 0)
+LOGGED=$(_int "$(grep -cE "^- date: *'?$TODAY'?" "$LOG" 2>/dev/null | tr -d ' ' || true)")
 if [ "${DISPATCHED:-0}" -gt 0 ] && [ "${LOGGED:-0}" -eq 0 ]; then
   echo "❌ ④-e $DISPATCHED sub-agent dispatch(es) today and ZERO invocation-log entries — the 60/40"
   echo "     promotion gate and the UAP loop both read that file; an unlogged session is invisible to"

package/scripts/test_dispatch_log_lanes.sh

@@ -93,6 +93,39 @@ hookless_verdict() { # $1=hook_configured -> MEASURED | NOT-MEASURED
 grep -q "NOT MEASURED" "$CHECK" ; chk $? "the subject actually carries that branch (not just this lane)"
 [ -f "$SCRIPT_DIR/../templates/subagent-tally-hook.json" ] ; chk $? "installable snippet exists for a clone that has no settings.json"
 
+echo "── pipefail disarm (the guard was dead in EXACTLY its target case) ──"
+# `grep -c` PRINTS 0 and EXITS 1 on a zero count. Under `set -o pipefail` the old
+# `grep -c … | tr -d ' ' || echo 0` therefore produced "0\n0", `[ -eq ]` threw, and the ❌ branch
+# was skipped — so ④-e reported ✅ whenever the log had ZERO entries, which is the one situation it
+# exists to block. Measured live 2026-08-04 during a session close.
+# Lane 1: reproduce the OLD form and assert it is broken (a control — if this ever passes, the
+# premise changed and the fix below is measuring nothing).
+old_form=$(bash -c 'set -uo pipefail; grep -c "^NOSUCHDATE$" '"$CHECK"' 2>/dev/null | tr -d " " || echo 0')
+[ "$(printf %s "$old_form" | grep -c "")" -eq 2 ] ; chk $? "control: the old \`|| echo 0\` form really does yield TWO lines under pipefail"
+# Lane 2: the shipped form yields a single sanitised integer.
+new_form=$(bash -c 'set -uo pipefail; _int() { case "${1:-}" in (""|*[!0-9]*) echo 0 ;; (*) echo "$1" ;; esac; }; _int "$(grep -c "^NOSUCHDATE$" '"$CHECK"' 2>/dev/null | tr -d " " || true)"')
+[ "$new_form" = "0" ] ; chk $? "shipped form yields a single sanitised 0"
+( set -uo pipefail; [ "$new_form" -eq 0 ] ) 2>/dev/null ; chk $? "and \`[ -eq ]\` accepts it (the old form threw here)"
+# Lane 3-5: BEHAVIOUR, not spelling. The first draft of these lanes string-matched the old form and
+# went GREEN on a revert — the needle did not match `tr -d ' '` (quotes), so the anchor was
+# decorative in the way this repo already named ([[feedback_anchor_can_be_decorative]], cause:
+# "needle matching unrelated text"). Extract the subject's OWN assignment lines and evaluate them.
+_eval_subject_assign() {  # $1 = variable name; echoes what the SUBJECT computes for a zero match
+  local var="$1" line
+  line=$(grep -E "^${var}=" "$CHECK" | head -1)
+  [ -n "$line" ] || { echo "NOLINE"; return; }
+  bash -c "set -uo pipefail
+    _int() { case \"\${1:-}\" in (''|*[!0-9]*) echo 0 ;; (*) echo \"\$1\" ;; esac; }
+    TODAY=NOSUCHDATE; TALLY='$CHECK'; LOG='$CHECK'
+    $line
+    printf %s \"\$$var\"" 2>/dev/null
+}
+for _v in DISPATCHED LOGGED; do
+  _got=$(_eval_subject_assign "$_v")
+  [ "$(printf %s "$_got" | grep -c '')" -le 1 ] ; chk $? "subject's \$$_v is ONE line on a zero match (was two: the disarm)"
+  ( set -uo pipefail; [ "${_got:-x}" -eq 0 ] ) 2>/dev/null ; chk $? "subject's \$$_v survives \`[ -eq 0 ]\` (the disarm threw here)"
+done
+
 echo ""
 if [ "$FAILED" -ne 0 ]; then echo "DISPATCH-LOG LANES: FAIL"; exit 1; fi
 echo "DISPATCH-LOG LANES: PASS ($PASS/$PASS)"