@chrono-meta/fh-gate 1.4.87 → 1.4.89

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.87",
+      "version": "1.4.89",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.87",
+      "version": "1.4.89",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/CLAUDE.md

@@ -602,6 +602,42 @@ Default operation is a **standard interactive session**. Agent dispatch (single
 
 **Why not Agent View by default**: Agent View introduces worktree isolation (blocks settings.json writes, Stop hook timing differs), session context gaps (session card stale content bug), and path friction — with no benefit unless the user is actively managing multiple agent sessions. Parallel agents via `Agent` tool work identically in a standard session.
 
+**Fourth reason — gate-integrity in a worktree, and the answer is CONDITIONAL on how `core.hooksPath`
+was set (measured 2026-08-05, both arms).** Do not carry a single verdict here; the two installs
+behave differently:
+
+| `core.hooksPath` | Which hook actually runs in a worktree | Consequence |
+|---|---|---|
+| **relative** — `templates/.git-hooks`, the form every FH doc installs (`CHEATSHEET.md`, `.claude/rules/fh_4axis_gate.md`, `install-wizard`, `self_evolution_routine.md`) | the **worktree's own copy** | Editing that copy *inside the worktree* disables the gate for that worktree — measured: neutralized hook → FH-asset commit with no marker succeeded (`rc=0`). The verifier becomes the verified, and the edit is invisible to `git status` in the main tree. |
+| **absolute** — a hand-set full path (this operator's machine; **not** what any doc tells you to run) | the **main tree's copy** | A worktree-local edit has no effect; a known-positive is blocked there exactly as in the main tree (`rc=1`). |
+
+An earlier draft of this section reported only the absolute-path arm and declared the
+"worktree bypasses the gates" hypothesis *refuted* — from **n=1 on a non-canonical setting**, with a
+do-not-revisit label attached. The relative-path arm, which is what everyone else runs, reproduces
+the bypass. Freezing a conclusion is a defect when the measurement did not cover the shipped
+configuration.
+
+Separately and in **both** arms, the **evidence side** breaks: `tracks/` is gitignored, so it does not
+follow into a worktree, so the Axis 2+3 marker and the Axis 4 `edit_manifest.yaml` are *structurally
+absent* — an FH-asset commit in a worktree fails on evidence it has no way to have. That degrades
+fail-closed (correct), but a gate that **cannot** be satisfied is what trains the bypass. Note the
+hook itself prints `mkdir -p …/tracks/_meta` on that failure, i.e. the actor's own error message
+teaches the marker-creation path — so "just don't fabricate it" is prose sitting under a machine
+instruction pointing the other way.
+
+**Therefore: do not commit FH assets from a worktree.** Not "carry the evidence in carefully" — a
+carried marker and a fabricated one are byte-identical, so *marker provenance* is unenforceable by
+construction. Land FH-asset changes from the standard session.
+
+**Do not let that unenforceability launder the enforceable part** (caught by an adversarial round on
+the paragraph above, which had used it to do exactly that): *being in a worktree* is trivially
+detectable — `git rev-parse --git-common-dir` differs from `--git-dir` there and matches in the main
+tree — and `templates/.git-hooks/pre-commit` currently has **zero** lines of worktree detection. A
+true statement about one thing (provenance) was standing in for an untested claim about another
+(location). It is left un-mechanized for a *scope* reason, not an impossibility one: measured
+recurrence is 1, below this repo's own N≥3 mechanization threshold. If it recurs, the check is a
+two-line hook addition, not a research problem.
+
 **Forbidden responses**: *"I can't do that — I'm not in that project's cwd"* — self-check Agent dispatch first.
 
 Mapped paths: check `auto_project_mapping.md` or `find ~/projects -maxdepth 1 -type d` for actuals.

package/knowledge/shared/harness-core/claude_md_gate_details.md

@@ -196,6 +196,13 @@ destroys live state without anyone noticing. This is why the loss class is calle
   plaintext only (encoded tokens out of scope); a line-split backstop catches a token wrapped across
   lines; `PUBLIC_SURFACE_OK=1` overrides and is logged to a gitignored audit trail for the weekly audit.
   Residuals (split-encoding, override-not-populated, override abuse) are documented, not silent.
+  **Verdict labelling (2026-08-06)**: with the override absent, a clean scan reports
+  `⚠️ PARTIAL — company/companion literals UNMEASURED`, **never `✅ PASS`**. The commit still
+  proceeds (reversible surface → advisory degrade), but a run whose operator-literal layer never
+  executed may not present the same verdict as one where it did — a missing measurement is not a
+  zero. Anchored in `universal_guard_check.sh` as a **pair**: absent override must say `PARTIAL`,
+  and the control (override present, no hit) must still say `✅ PASS`, so the label cannot drift
+  back to a bare PASS *or* become an unconditional warning.
 - **(c) `npm publish`** — mechanically gated by `scripts/public_surface_scan_files.sh`, wired into
   `prepublishOnly` (`npm run release` also runs it *outside* the lifecycle). Unlike (b) it scans the
   **full content of the exact npm-published file set** (`npm pack --dry-run`), *not* a commit diff — so a
@@ -204,6 +211,36 @@ destroys live state without anyone noticing. This is why the loss class is calle
   or the file set are unresolved, when the parse looks partial, **or when the gitignored operator override
   is absent** — defaults-only would otherwise green-PASS a HIGH company literal on a fresh clone or CI runner.
 
+**The git-push surface, and why it was the lenient one (2026-08-06).** (c) blocked on an absent
+override; the `git push` gate in `templates/.git-hooks/pre-push` only warned. Both make content
+public, so two irreversible surfaces were degrading in **opposite directions on the same state** —
+the actual defect, and `git push` (the one nobody publishes through deliberately) was the permissive
+side. The 2026-07-26 reasoning behind that warn was not wrong, it was **unscoped**: an absent
+override in a fresh clone / CI runner / worktree is a legitimate per-operator configuration gap (the
+file is gitignored, so it is absent there *by construction*), and blocking it trains
+`PUBLIC_SURFACE_OK` into a reflex — which disarms the same channel the publish gate depends on.
+
+So the warn is **scoped, not reverted**. `psa_detect_operator_context` (`scripts/psa_scan_lib.sh`)
+splits the state: in an **operator-configured checkout** an absent override is *evidence missing
+where evidence is expected* → BLOCK; everywhere else → WARN, exactly as before. The signal is
+`CLAUDE.local.md`, the operator's own gitignored binding file.
+
+**Calibration matters here more than the rule** — a second candidate signal, "`tracks/_meta` is
+non-empty", reads as the same test and is not: `tracks/_meta/.gitkeep` and one sibling are
+**tracked**, so a fresh clone satisfies it and would have been blocked, re-shipping the 07-26
+over-block under a new name. It was rejected by measuring it against a known pair, not by reasoning
+about it. **Named residual, deliberately in the under-blocking direction**: an operator who never
+created a `CLAUDE.local.md` stays in the WARN arm. **Second residual, and it is the sharper one**:
+deleting `CLAUDE.local.md` drops this checkout back into the WARN arm, and unlike `PUBLIC_SURFACE_OK=1`
+that bypass **writes no log line**. It is a conscious act on the operator's own file, so it is not a
+weak-model fail-open — but it is a quieter exit than the sanctioned one, which is the wrong ordering
+for a bypass. Not closed here: making it loud means the hook must distinguish "never had one" from
+"had one and lost it", and that needs state the hook does not currently keep. Named rather than
+mechanized, per this repo's own threshold — mechanize on the first measured recurrence.
+Anchored as a pair in `prepush_guard_check.sh`
+(6-a absent override → PASS · 6-b absent override + operator checkout → BLOCK); both arms are
+required, since 6-b passing alone would not distinguish a scoped block from a blanket one.
+
 **Named residuals for (c)** — it is a denylist **on the npm CLI path with scripts enabled**, not a
 universal secret-scanner:
 

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -944,3 +944,128 @@
     entry per the "counts and outcomes, not one stub per dispatch" rule.
     Instrument note: the invocation form matters — `| codex exec -` (stdin) as recorded in
     [[feedback_sidecar_liveness_not_passive_wait]]; the argv form hangs nondeterministically.
+
+- date: '2026-08-04'
+  agent: codex/gpt-5.5 (cross-family sidecar, auto-decorrelation)
+  context: >-
+    FH self-dev — two load-bearing gate changes (PR #253 degrade-scan S5 rule, PR #254/#255 Axis-1
+    pathspec parity + anchor wiring). Pre-push gate demanded a cross-family leg on both.
+  dispatches: '3 (2 completed, 1 killed on timeout and re-run)'
+  outcome: accepted
+  evidence: >-
+    Round 1 (PR #253): REFUTED the author's own fix. The first repair widened the S5 rule with a
+    NAMED filter list; codex produced reproduced counter-examples in BOTH directions — still-missed
+    real disarms (`grep -Ec`, `grep --count`, `grep -Fcx`, `| cat`) and a NEW false positive the
+    repair introduced (`| tail -n +2` yields one line, not a disarm). It also caught that a fixture
+    labelled known-NEGATIVE was in fact a positive, because its upstream succeeded and therefore
+    never exercised the failure path it claimed to pin. All four re-run locally before acceptance.
+    Round 2 (PR #255 wiring): no blocker; one residual raised ("a distribution that SHOULD be
+    complete but drops a subject reports SKIP, not FAIL"), which was then TESTED and confirmed
+    uncovered by any existing anchor. Recorded as a WEAK signal — the auditor stated it could not
+    trace F1-F3 because those implementations were not in the diff it was given, and that residual
+    was closed locally by measurement, not by the auditor.
+  note: >-
+    Third consecutive session where the cross-family leg produced net-new findings the same-family
+    round walked past. New this session: the two rounds differed in SIGNAL STRENGTH (refutation vs
+    nothing-found), and both markers record which one it was — recording them at equal weight would
+    launder a weak pass into a strong one.
+    Instrument note: the FIRST attempt derailed into its own sidecar-availability exploration and
+    timed out (exit 124, ~7 min). Re-running with an explicit "Do NOT run shell commands, do NOT use
+    tools, answer ONLY from the text below" preamble fixed it. Stdin form `codex exec -m gpt-5.5
+    --skip-git-repo-check -` as recorded in [[feedback_sidecar_liveness_not_passive_wait]].
+    These were CLI sidecars, not Agent-tool spawns, so the SubagentStop hook tallied ZERO — the
+    ④-e check passed on a true zero while three real dispatches had happened. Named gap: the tally
+    is blind to CLI-invoked sidecars.
+
+- date: '2026-08-05'
+  agent: (unattributed — SubagentStop tally only)
+  context: >-
+    Close chain of the 2026-08-04 session, which crossed midnight. The tally file recorded ONE
+    dispatch dated 2026-08-05; this session made no Agent-tool spawn that it is aware of.
+  dispatches: '1 (tallied, origin not attributable)'
+  outcome: sustained
+  evidence: >-
+    Recorded rather than guessed. The substantive sidecar work of this session is the 2026-08-04
+    entry above (3 codex CLI dispatches). MEASURED here, after the claim had already been written
+    into a commit message and the session card: a `codex exec` call does NOT increment the tally
+    (before=1, after=1 on `grep -c '^2026-08-05$'`), and the hook matcher is `SubagentStop`, i.e.
+    Agent-tool spawns only. So the CLI-blindness claim holds — but its evidence arrived AFTER
+    publication, which is the ordering CLAUDE.md §Instrument-Calibration forbids.
+  note: >-
+    What produced the 4 tallies dated 2026-08-04 and this 1 dated 2026-08-05 is UNKNOWN. Not
+    invented: a fabricated outcome would poison the 60/40 promotion gate worse than a missing one,
+    which is the stated reason the hook only tallies and never writes an entry. Open question for
+    the next session that touches the tally: which tool events actually fire SubagentStop here.
+
+- date: '2026-08-05'
+  agent: persona-innovator ×2 · quench-challenger ×3 · beginner ×5 (Agent tool) + codex gpt-5.5 ×2 (CLI)
+  context: >-
+    Innovator autopilot session. Two sister-asset absorption scans (innovator); steel-quench Wave 1
+    and Wave 3 on the selfcheck run-twice repair, plus one opus Axis-2 pass on the AGENTS.md change
+    (quench-challenger); five Sonnet-pinned cold-read sims on one AGENTS.md checklist item
+    (beginner); two cross-family audits (codex CLI, tool-use disabled — not counted by the tally
+    hook, which only fires on Agent-tool SubagentStop).
+  dispatches: '10 via Agent tool + 2 CLI sidecars (tally recorded 14 — the delta is unattributed,
+    see the 2026-08-05 entry above about unknown tally sources; not invented here either)'
+  outcome: accepted
+  evidence: >-
+    Every class changed the outcome, which is why this is `accepted` rather than `partial`.
+    quench-challenger: Wave 1 produced 2S/3A/4B and Wave 3 produced 2S/1A/3B on the REPAIR — one of
+    those overturned a judgment already reported to the operator (a "refuted" verdict measured on a
+    non-canonical absolute core.hooksPath; the documented relative-path install reproduces the
+    bypass). The opus Axis-2 pass produced 2S that caused a full revert of the AGENTS.md change.
+    beginner: 5 rounds, each blocking at a DIFFERENT point, each block introduced by the previous
+    round's repair; author self-catch across rounds 1-4 was ZERO. innovator: 4 external repos
+    verified by gh api with known-pair controls, 3 net-new items confirmed by in-repo greps with
+    live controls. codex: round 1 was fed a STALE diff (my error — the target was not frozen) so 2
+    of its findings were already closed and 1 was a misread; round 2 on a fingerprinted target found
+    the BSD `tr -d '[:space:]'` defect that both same-family rounds missed.
+  note: >-
+    Logged at close, after the session_close_check ④-e block caught the omission — the obligation
+    is prose in CLAUDE.md and I did not discharge it during the session despite dispatching 10+
+    agents. That is the same shape the ④-e check was built for. Consolidated per class with counts
+    rather than one stub per dispatch, which the check explicitly permits.
+
+- date: '2026-08-06'
+  agent: beginner ×5 (Sonnet-pinned cold read) · quench-challenger ×1 (opus Axis-2) — same session as 2026-08-05
+  context: >-
+    The innovator autopilot session crossed midnight; the tally records 14 dispatches under
+    2026-08-06 while the substantive description lives in the 2026-08-05 entry above. These are not
+    additional work — they are the same session's later half: the five cold-read rounds on the
+    AGENTS.md worktree item and the opus adversarial pass that ended it.
+  dispatches: '6 attributable here (tally: 14 under this date; the remainder shares the
+    unattributed-source question already recorded on 2026-08-05)'
+  outcome: accepted
+  evidence: >-
+    The opus Axis-2 pass returned 2S — a recipe that commits to the WRONG BRANCH (git forbids two
+    worktrees sharing a branch, so the main checkout and a worktree are always on different
+    branches, and the recipe never aligned them), and a hook that hands out a marker-fabrication
+    one-liner at the exact moment it blocks. Both were reproduced against the live repo, and the
+    change was REVERTED in full rather than patched. The five beginner rounds each blocked at a
+    different point with author self-catch of zero across rounds 1-4.
+  note: >-
+    Written after the close check refused the push a SECOND time: the first correction logged the
+    session under 2026-08-05 while the check counts today's date, so "logged" and "logged where the
+    check looks" came apart. Recorded rather than back-dated — the split is real (the tally itself
+    splits 34/14 across the boundary) and pretending otherwise would misstate when the work ran.
+
+- date: 2026-08-06
+  agent: general-purpose ×2 (블라인드 응시자), fh-commons:quench-challenger ×2 (Axis 2)
+  purpose: >-
+    qasp 풀체인 단련 — 출제자/응시자 분리 블라인드 실행 2회(2막 대조 · 3층 난이도)와,
+    FH 마감 체커 fail-open 수리에 대한 Axis 2 적대검증 2라운드(sonnet → at-floor opus).
+  model: sonnet ×3, opus ×1
+  outcome: accepted
+  evidence: >-
+    블라인드 2회가 계기 결함 2건을 직접 산출했다 — 1차는 두 런 차이를 "플레이키"로 오귀속해
+    리포트에 코드 상태 지문이 없음을 드러냈고(#84→PR #86), 2차는 counts 만 대조해 "변화 없음"이라
+    결론내 집계가 개별을 가리는 문제를 드러냈다(→PR #87). 두 오귀속 모두 **주어진 산출물만 보고는
+    그렇게 결론낼 수밖에 없었다** — 그래서 결함이 응시자가 아니라 계기 쪽임이 판별됐다.
+    챌린저 R1(sonnet)은 수리 대상 바로 윗줄에 같은 fail-open 이 남아 있음을 재현으로 잡았고,
+    게이트가 floor 미달로 거부해 R2(opus, at-floor)를 돌리자 R1 이 못 본 4건이 추가로 나왔다
+    (재발견 0건, 전부 실제 재현). known-pair 6/6.
+  note: >-
+    45 dispatch 대 1 로그 항목으로 ④-e 가 통과한 상태였다 — 이 항목이 그 간극을 메운다.
+    카운트가 큰 것은 Explore 등 내부 에이전트가 함께 집계되기 때문이고, 의미 있는 위임은 위 4건이다.
+    ★방법론 소득이 결함보다 크다: 출제자=응시자면 "잘 나온다"로 끝나고, 분리하면 매 라운드
+    계기 결함이 나온다. 그리고 floor 는 장식이 아니었다 — sonnet R1 이 놓친 HIGH 를 opus R2 가 잡았다.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.87",
+  "version": "1.4.89",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -26,7 +26,7 @@
   "scripts": {
     "prepare": "chmod +x bin/fh-gate.js bin/fh-run.js bin/fh-goal.js bin/fh-codex-doctor.js scripts/fh-gate.sh scripts/fh-run.sh scripts/fh-goal.sh",
     "test": "bash scripts/selfcheck.sh",
-    "prepublishOnly": "bash scripts/selfcheck.sh && bash scripts/public_surface_scan_files.sh",
+    "prepublishOnly": "bash scripts/version_lockstep_check.sh && bash scripts/selfcheck.sh && bash scripts/public_surface_scan_files.sh",
     "release": "bash scripts/public_surface_scan_files.sh && npm publish"
   },
   "engines": {
@@ -64,7 +64,9 @@
     "scripts/fh-goal.sh",
     "scripts/count_check.sh",
     "scripts/selfcheck.sh",
+    "scripts/version_lockstep_check.sh",
     "scripts/test_selfcheck_state_lanes.sh",
+    "scripts/test_version_lockstep_lanes.sh",
     "scripts/package_coverage_check.sh",
     "scripts/test_package_coverage_lanes.sh",
     "scripts/test_fh_gate_regressions.sh",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.87",
+  "version": "1.4.89",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.87",
+  "version": "1.4.89",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/scripts/degrade_direction_scan.sh

@@ -164,9 +164,41 @@ for f in "${FILES[@]}"; do
     # yields "9\n0" and the `-gt` guard goes silent. Verified as a known pair (both directions) in
     # scripts/test_degrade_scan_shell_probes.sh; narrowing without that anchor would just trade a
     # noisy probe for a blind one.
+    #
+    # WIDENED 2026-08-04 — the narrowing had gone one step too far, and the proof is that this
+    # probe was BLIND to the live instance that bit us the day before. PR #251 fixed
+    # `grep -c … | tr -d ' ' || echo 0` in session_close_check.sh ④-e; running this scanner over
+    # the pre-#251 file produced ZERO hits (re-measured: fixed rule = 2, old rule = 0).
+    #
+    # THE ANCHOR WAS ON THE WRONG PROPERTY. The old regex asked "is there an upstream pipe" and
+    # required the counter to be the LAST stage. Neither is the discriminator. The discriminator
+    # is: **does the failing side still EMIT?** `grep -c` prints "0" and exits 1 on no-match, so it
+    # disarms with no upstream pipe at all, and any trailing stage that passes that "0" through
+    # keeps the "0\n0" intact.
+    #
+    # A first fix widened to a NAMED filter list (tr|head|sed|…). Cross-family review (gpt-5.5,
+    # 2026-08-04) refuted it with reproduced counter-examples, and the refutation held on
+    # measurement in BOTH directions:
+    #   · still missed, all verified to yield "0\n0": `grep -Ec …`, `grep --count …`, `grep -Fcx …`
+    #     (combined/long flag forms the `-c` literal never matched) and `| cat`.
+    #   · newly over-matched: `| tail -n +2` after the counter yields ONE line — not a disarm.
+    # Name-based approximation produced under-match and over-match simultaneously. So the trailing
+    # chain is no longer enumerated: the rule keys on the COUNTER (grep with a `c` in any flag
+    # cluster or `--count`; or `wc` behind a real pipe) plus the `|| echo 0` fallback, and accepts
+    # any chain between them.
+    #
+    # PRESERVED from the 2026-07-28 narrowing, still pinned as known-negatives: (a) `a || b ||
+    # echo 0` has no pipeline, and (b) a stage that emits NOTHING on failure (`| jq -r … ||
+    # echo 0`) — there the fallback supplies the only line, as intended.
+    # KNOWN RESIDUAL, stated not hidden: a trailing stage that can swallow the counter's output
+    # (`| tail -n +2`, `| sed -n '/[1-9]/p'`) is now flagged though it is not a disarm. That is a
+    # deliberate recall-over-precision trade on an ADVISORY probe, taken because the measured cost
+    # of the other direction was a real defect shipping. Revisit if non-fixture FPs appear.
+    # Known pair: scripts/test_degrade_scan_shell_probes.sh (9 positives / negatives silent).
+    # Reverting this line turns the positive lane red — checked by applying the revert.
     while IFS= read -r m; do
-      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback on a pipeline ending in a counter (grep -c/wc) — that stage emits even when an upstream stage fails, so under \`set -o pipefail\` the value gains a SECOND line, the integer comparison errors out, and the guard passes silently; split the pipeline and sanitize to an integer"
-    done < <(grep -nE '[^|]\|[[:space:]]*([a-z]+[[:space:]]+)*(grep[^|]*-c|wc)[^|]*\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
+      emit "$f" "${m%%:*}" "S5:pipefail-fallback(sh)" "\`|| echo 0\` fallback after a COUNTER (grep with -c / --count, or wc) — the counter PRINTS \"0\" and exits non-zero on no-match, so the fallback appends a SECOND line, the value becomes \"0\\n0\", the integer test dies with 'integer expression expected' (stderr only) and the guard goes silent; split it and sanitize: n=\$(...); n=\${n:-0}; case \$n in *[!0-9]*) n=0;; esac. VERIFY the trailing stage can actually emit — if it swallows the count (| tail -n +2), this is a known false positive"
+    done < <(grep -nE '(([^|]\|[[:space:]]*([a-z]+[[:space:]]+)*wc[^|]*)|(grep([[:space:]]+-[A-Za-z]*c[A-Za-z]*|[[:space:]]+--count)[^|]*))([^|]*\|[^|]*)*\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
              | grep -vE '^[0-9]+:[[:space:]]*#' \
              | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
   fi

package/scripts/gate_pathspec_check.sh

@@ -107,7 +107,12 @@ spec_matches() {  # $1 = path
 for pair in \
   "plugins/fh-meta/skills/frontier-digest/SKILL_detail.md|tracks/_meta/x.md|PATHSPEC covers SKILL_detail.md" \
   "plugins/fh-meta/skills/frontier-digest/SKILL.md|README.md|PATHSPEC still covers SKILL.md" \
-  "CLAUDE.md|CLAUDE.local.md|PATHSPEC covers CLAUDE.md but not the local override"
+  "CLAUDE.md|CLAUDE.local.md|PATHSPEC covers CLAUDE.md but not the local override" \
+  "scripts/selfcheck.sh|README.md|PATHSPEC covers scripts/*.sh (seam #1 — the HEAVY term already gated it, this array did not)" \
+  "scripts/sub/nested.sh|package.json|PATHSPEC covers scripts/ recursively (git/bash globs cross '/')" \
+  "templates/regression_guard.sh|package-lock.json|PATHSPEC covers templates/*.sh — i.e. the guard can guard ITSELF" \
+  "templates/.git-hooks/pre-commit|.gitignore|PATHSPEC covers the git-hook floor (the hook that hard-blocks commits)" \
+  "plugins/fh-meta/agents/challenger.md|tracks/_meta/y.md|PATHSPEC covers agent definitions (seam #3)"
 do
   IFS='|' read -r pos neg label <<< "$pair"
   ok=1

package/scripts/prepush_guard_check.sh

@@ -166,6 +166,21 @@ check "operator override absent (per-operator) → PASS " "$R" pass \
       "refs/heads/f $(cd "$R" && git rev-parse HEAD) refs/heads/f $B"
 rm -rf "$R"
 
+# ── Pair 6-b (2026-08-06): the OTHER arm of the same state, which the 07-26 flag could not see.
+# Identical to 6-a except the checkout carries CLAUDE.local.md — the operator's gitignored binding
+# file, absent in every clone/CI/worktree by construction. There the missing override is not an
+# unset per-operator config, it is evidence missing where evidence is expected, on a surface that
+# publishes. This is what `npm publish` already blocked while `git push` waved through; the two
+# irreversible surfaces now degrade in the same direction.
+# The PAIR is what makes it a measurement: 6-a (no CLAUDE.local.md → PASS) is the known-negative and
+# must keep passing, or this is not a scoped block, it is the 07-26 over-block re-shipped. ──
+R=$(newrepo); B=$(cd "$R" && git rev-parse HEAD)
+( cd "$R" && echo ok > g2.md && git add g2.md && git commit -qm g2 >/dev/null \
+  && rm -f .claude/rules/.public-surface-patterns && printf '# operator binding\n' > CLAUDE.local.md )
+check "override absent + operator checkout    → BLOCK" "$R" block \
+      "refs/heads/f $(cd "$R" && git rev-parse HEAD) refs/heads/f $B"
+rm -rf "$R"
+
 R=$(newrepo); B=$(cd "$R" && git rev-parse HEAD)
 ( cd "$R" && echo ok > g.md && git add g.md && git commit -qm g >/dev/null \
   && : > .claude/rules/.public-surface-patterns.defaults )   # present but EMPTY = broken, not unconfigured

package/scripts/psa_scan_lib.sh

@@ -38,6 +38,9 @@
 #   PSA_DEFAULTS_OK       1 = committed defaults present, readable, non-empty
 #   PSA_OVERRIDE_PRESENT  1 = operator override present, readable, non-empty
 #   PSA_BAD_ROWS          count of rows dropped as unusable (uncompilable regex, or no TAB)
+# State set by psa_detect_operator_context (separate call — see that function):
+#   PSA_OPERATOR_CONTEXT  1 = an operator-configured checkout, where an absent override is missing
+#                             evidence rather than a legitimate fresh-clone absence
 # A caller that treats PSA_BAD_ROWS>0 or PSA_DEFAULTS_OK=0 as "clean" has a hole: those states mean
 # the instrument is incomplete, and an incomplete instrument cannot certify anything.
 
@@ -115,6 +118,39 @@ PSA_ROWS
   PSA_STREAM="$valid"
 }
 
+# psa_detect_operator_context <repo_root>   → sets PSA_OPERATOR_CONTEXT (0/1)
+#
+# Answers ONE question: is an absent operator override a *legitimate absence* (fresh clone, CI
+# runner, worktree — the file is gitignored, so it is absent there by construction) or *evidence
+# missing where evidence is expected* (a checkout the operator has configured, whose literals should
+# be there and are not)?
+#
+# 2026-07-26 changed pre-push from BLOCK to WARN on an absent override, and that change was right for
+# the first case: this repo's own selfcheck flagged the block as over-firing, and over-blocking trains
+# PUBLIC_SURFACE_OK into a reflex, which disarms the same channel the publish gate depends on. It was
+# wrong for the second case, which the flag could not distinguish. This function is that distinction —
+# it does not reopen the reverted block, it scopes it.
+#
+# Signal: CLAUDE.local.md — the operator's own gitignored binding file. Chosen because it is
+# gitignored (verified: `.gitignore:17`), so no clone, CI checkout or worktree carries it.
+#
+# CALIBRATED, and one candidate was REJECTED by that calibration: "tracks/_meta is non-empty" looks
+# like the same signal and is not — `tracks/_meta/.gitkeep` and one more file are TRACKED, so a fresh
+# clone satisfies it and would have been blocked. The discriminator was measured against a known
+# pair before it was trusted, not reasoned about.
+#
+# NAMED RESIDUAL (deliberate, and in the safe direction): an operator who never created a
+# CLAUDE.local.md stays in the WARN arm. This under-blocks rather than over-blocks — the failure mode
+# this scoping exists to avoid is the reflex, not the miss, and the push gate's content scan still
+# runs on the committed defaults in that arm.
+psa_detect_operator_context() {
+  local root="$1"
+  PSA_OPERATOR_CONTEXT=0
+  [ -n "$root" ] || return 0
+  [ -f "$root/CLAUDE.local.md" ] && PSA_OPERATOR_CONTEXT=1
+  return 0
+}
+
 # psa_scan_tagged  — reads "path<TAB>content" lines on stdin, prints one line per reportable hit.
 # Returns 0 = nothing reportable, 1 = at least one hit.
 #