@chrono-meta/fh-gate 1.4.87 → 1.4.89

package/scripts/selfcheck.sh

@@ -25,6 +25,74 @@ check() { # check <label> <cmd...>
     fail=1
   fi
 }
+# ⚠️ KNOWN DEFECT, NOT FIXED HERE — `check()` above has the same evidence-discarding shape the
+# lane blocks below were repaired for (2026-08-05): it decides on `"$@" 2>/dev/null` (stderr of the
+# DECIDING run is destroyed) and then re-runs to print. It is left alone deliberately: `check()` is
+# called by every `node --check` / `bash -n` line in this file, so changing it changes the whole
+# surface at once, which is a different job from repairing the four lane blocks (CLAUDE.md
+# §Added-Scope Gate question 2). `scripts/probe_scope_check.sh`'s caller near the probe-scope block
+# carries the same shape. Both are tracked separately — do NOT read the lane-block repair below as
+# having cleared this file.
+
+# _show_failure <captured-output> — print a FAILING suite's evidence without truncating it away.
+# Single source for all four lane blocks (a second copy would drift; the divergent-normalizer class).
+# WHY NOT `tail -N`: measured 2026-08-05 on sync_from_be_lanes.sh — output is 98 lines and a planted
+# lane failure at line ~22 is INVISIBLE to `tail -20` (0 hits), while the summary banner still reads
+# "1 failed". The reader gets a FAIL verdict sitting on top of passing log lines — the exact shape
+# this whole repair exists to remove. The failing-line extraction finds it (1 hit, known pair).
+# All four suites mark failures with `❌` (`no()` in sync_from_be_lanes.sh:21, `chk()` in the other
+# three) or an early `FAIL ` line when a subject is missing; grep handles the multi-byte glyph
+# (known pair: 1 hit on a ❌ line, 0 on a ✅-only line — verified, not assumed).
+_show_failure() {
+  local out="$1" fails n banner shown nonblank
+  # Whitespace-only counts as empty: guarding with [ -z "$out" ] alone let a suite emitting "   "
+  # fall into the died-early branch and print indented blank lines — silence rendered as evidence.
+  # SHELL PATTERN, NOT `tr`: the obvious `tr -d '[:space:]'` is a measured defect on BSD. Given a
+  # line containing invalid UTF-8, macOS `tr` aborts with `tr: Illegal byte sequence` and emits
+  # NOTHING, so the guard concludes "empty" and reports "no output captured" while real evidence is
+  # sitting in $out — the exact mis-report this helper exists to prevent, reintroduced by the guard
+  # against it. (GNU tr passes the bytes through; the arms disagree, and the failing arm is the
+  # author's own machine.) Case-matching is a shell builtin: no subprocess, no charset decoding, so
+  # invalid bytes cannot make it lie. Known pair: invalid-byte→nonblank, spaces/tabs/newlines→blank,
+  # ""→blank, "hello"→nonblank (4/4), while the tr form returns 0 bytes on arm 1.
+  case "$out" in *[![:space:]]*) nonblank=1 ;; *) nonblank= ;; esac
+  # NO LOCALE PIN HERE, and its absence is a measured result — same disposition, and same reasoning,
+  # as the pin `.github/workflows/validate.yml` removed after refuting its own locale hypothesis.
+  # Two model families independently suspected that matching the multi-byte `❌` would break under a
+  # C/POSIX locale (one filed it as UNCALIBRATED for the GNU arm, the other as an unpinned-locale
+  # defect), so `LC_ALL=C` was added — then both arms were actually measured:
+  #   BSD grep (macOS)      : C, UTF-8              → 1 hit each
+  #   GNU grep 3.12 (Linux) : C, C.UTF-8, unset     → 1 hit each; and with invalid UTF-8 bytes mixed
+  #                                                   in, the ❌ line still extracts (no binary-file
+  #                                                   collapse, the specific feared mode)
+  # The hypothesis is REFUTED on both arms, so the pin demonstrated nothing and was removed rather
+  # than kept as insurance — a knob retained because it might help is indistinguishable from one
+  # that does, and the next reader would inherit it as evidence that the danger is real.
+  fails=$(printf '%s\n' "$out" | grep -E '❌|^FAIL ' || true)
+  banner=$(printf '%s\n' "$out" | grep -E '════' | tail -1 || true)
+  if [ -n "$fails" ]; then
+    shown=$(printf '%s\n' "$fails" | head -25)
+    printf '%s\n' "$shown" | sed 's/^/     /'
+    n=$(printf '%s\n' "$fails" | wc -l | tr -d ' ')
+    [ "$n" -gt 25 ] && echo "     … ($((n - 25)) more failing lines not shown)"
+  elif [ -z "$nonblank" ]; then
+    echo "     (no output captured — the suite produced nothing before failing)"
+  else
+    echo "     (no ❌/FAIL line found — suite likely died early; showing tail)"
+    printf '%s\n' "$out" | tail -12 | sed 's/^/     /'
+  fi
+  # Summary banner: matched by shape, not by position. A blind `tail -2` re-printed lines already
+  # shown above (measured: a ❌ within the last 2 lines appeared twice, and the "N more not shown"
+  # notice was immediately followed by one of the lines it had just declined to show), and on empty
+  # input it emitted a stray indented line. Print it only when it exists and is not already on screen.
+  # Dedupe against what was ACTUALLY PRINTED ($shown), not against the full $fails set. Searching
+  # $fails suppressed the banner whenever a failing line beyond the head -25 cut merely contained
+  # the banner text — i.e. it hid the banner precisely because a line the reader never saw mentioned
+  # it. $shown is empty in the non-fails branches, so the banner prints there as before.
+  if [ -n "$banner" ] && ! printf '%s\n' "${shown:-}" | grep -qF -- "$banner"; then
+    printf '     %s\n' "$banner"
+  fi
+}
 
 # Node executables (npm-shipped)
 for f in bin/*.js; do
@@ -34,7 +102,18 @@ done
 # Codex adapter drift: the thin Codex runtime must keep reading canonical FH
 # skill/agent surfaces without silently accepting Claude-native primitives as
 # Codex-native.
-check "fh-codex-doctor --strict" bash -c 'node bin/fh-codex-doctor.js --strict >/dev/null'
+# NOT via check(): that helper decides on a run whose stderr is discarded, and this call site used to
+# additionally discard the subject's STDOUT (`--strict >/dev/null`). fh-codex-doctor writes 100% of
+# its drift diagnostics to stdout (measured 2026-08-05: 686 B stdout / 0 B stderr), so a failure
+# printed a bare `FAIL` line carrying no diagnosis at all — worse than the truncation this session
+# repaired in the lane blocks. Fixed at the call site; check() itself is a separate job (see above).
+if _out=$(node bin/fh-codex-doctor.js --strict 2>&1); then
+  echo "PASS  fh-codex-doctor --strict"
+else
+  echo "FAIL  fh-codex-doctor --strict"
+  _show_failure "$_out"
+  fail=1
+fi
 
 # Bash surface: npm-shipped scripts + local bin wrappers + gate-chain infra
 for f in scripts/*.sh bin/fh-gate bin/fh-run bin/fh-goal \
@@ -224,6 +303,38 @@ else
   fail=1
 fi
 
+# gate-pathspec anchor — wired here 2026-08-04. It was reachable ONLY from templates/.git-hooks/
+# pre-commit, i.e. only in a clone where the operator had run `git config core.hooksPath`. Every
+# other clone, every CI run, and the npm package carried the anchor file and never executed it —
+# the built-but-not-wired shape, one layer up: the anchor for the gate had no anchor of its own.
+# That mattered the same day: PR #254 added five known-pairs to it, all of which would have been
+# unexecuted outside the author's machine.
+# Subject = the two implementations it reads (the hook's HEAVY term and the guard's GUARD_PATHSPEC).
+# Absent subject → package/partial surface → legitimate SKIP; present subject with the anchor gone
+# → FAIL, same shape as every block above.
+# NAMED RESIDUAL (cross-family, gpt-5.5, 2026-08-04): if a distribution that SHOULD be complete
+# accidentally drops one subject, this reports SKIP, not FAIL — silent non-coverage. Measured the
+# same day: removing `templates/.git-hooks` from package.json `files[]` and running
+# scripts/package_coverage_check.sh still PASSED, so no existing anchor catches that omission
+# either. Deliberately NOT patched with a stricter branch: the only discriminator available
+# ("templates/ exists but the hook does not") would be built on an UNMEASURED assumption about how
+# a narrower package is shaped, and this repo's rule is not to build before the constraint is
+# measured. What is cheap and honest is naming WHICH subject is missing, so a SKIP is diagnosable
+# instead of opaque. Revisit when a real partial distribution is observed.
+_gps_missing=""
+[ -f templates/.git-hooks/pre-commit ] || _gps_missing="templates/.git-hooks/pre-commit"
+[ -f templates/regression_guard.sh ] || _gps_missing="${_gps_missing:+$_gps_missing, }templates/regression_guard.sh"
+if [ -n "$_gps_missing" ]; then
+  echo "SKIP  gate_pathspec_check.sh (subject absent: $_gps_missing) — not-checked, NOT a pass"
+elif [ -f scripts/gate_pathspec_check.sh ]; then
+  if ! bash scripts/gate_pathspec_check.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  gate_pathspec_check.sh: the gate implementations are present but their coverage anchor is missing"
+  fail=1
+fi
+
 if [ ! -f scripts/ablation_calibrate.sh ]; then
   echo "SKIP  test_ablation_calibrate_lanes.sh (subject scripts/ablation_calibrate.sh absent)"
 elif [ -f scripts/test_ablation_calibrate_lanes.sh ]; then
@@ -415,28 +526,48 @@ fi
 if [ ! -f templates/.git-hooks/pre-push ]; then
   echo "SKIP  test_tag_version_lanes.sh (subject templates/.git-hooks/pre-push absent)"
 elif [ -f scripts/test_tag_version_lanes.sh ]; then
-  if ! bash scripts/test_tag_version_lanes.sh >/dev/null 2>&1; then
+  # RUN-ONCE, CAPTURE (2026-08-05) — rationale in the sync_from_be_lanes block later in this file.
+  if _out=$(bash scripts/test_tag_version_lanes.sh 2>&1); then
+    echo "PASS  test_tag_version_lanes.sh (mismatch blocks · match silent · scope · override)"
+  else
     echo "FAIL  test_tag_version_lanes.sh: the tag/version guard would mis-route"
-    bash scripts/test_tag_version_lanes.sh 2>&1 | tail -12
+    _show_failure "$_out"
     fail=1
-  else
-    echo "PASS  test_tag_version_lanes.sh (mismatch blocks · match silent · scope · override)"
   fi
 else
   echo "FAIL  test_tag_version_lanes.sh: pre-push present but its anchor is missing"
   fail=1
 fi
 
+# Shipped-manifest version lockstep. Distinct from the tag lane above: that one compares the git TAG
+# to package.json; this one compares package.json to every version string it SHIPS — including the
+# per-plugin entries inside marketplace.json, which the tag lane never opens. Measured 2026-08-06:
+# a bump left the second marketplace entry behind and the tag lane passed 8/8 straight through it.
+if [ ! -f scripts/version_lockstep_check.sh ]; then
+  echo "SKIP  test_version_lockstep_lanes.sh (subject scripts/version_lockstep_check.sh absent)"
+elif [ -f scripts/test_version_lockstep_lanes.sh ]; then
+  if _out=$(bash scripts/test_version_lockstep_lanes.sh 2>&1); then
+    echo "PASS  test_version_lockstep_lanes.sh (drift blocks · aligned silent · unreadable = exit 2, not pass)"
+  else
+    echo "FAIL  test_version_lockstep_lanes.sh: the shipped-manifest lockstep guard would mis-route"
+    _show_failure "$_out"
+    fail=1
+  fi
+else
+  echo "FAIL  test_version_lockstep_lanes.sh: version_lockstep_check.sh present but its anchor is missing"
+  fail=1
+fi
+
 # ④-e dispatch-log reconciliation + its tally hook. Wired in the same commit that ships them: the
 # obligation they mechanize lost 20/20 in a single session, so leaving the checker itself unrun
 # would be the same defect one layer up.
 if [ -f scripts/test_dispatch_log_lanes.sh ]; then
-  if ! bash scripts/test_dispatch_log_lanes.sh >/dev/null 2>&1; then
+  if _out=$(bash scripts/test_dispatch_log_lanes.sh 2>&1); then
+    echo "PASS  test_dispatch_log_lanes.sh (date-spelling + verdict + tally-hook lanes)"
+  else
     echo "FAIL  test_dispatch_log_lanes.sh: the dispatch-log reconciliation would mis-report"
-    bash scripts/test_dispatch_log_lanes.sh 2>&1 | tail -14
+    _show_failure "$_out"
     fail=1
-  else
-    echo "PASS  test_dispatch_log_lanes.sh (date-spelling + verdict + tally-hook lanes)"
   fi
 fi
 
@@ -445,12 +576,12 @@ fi
 # through in silence, then a package discriminator keyed on a file that actually ships. Both are
 # known-POSITIVEs in the suite, so neither can come back green.
 if [ -f scripts/test_selfcheck_state_lanes.sh ]; then
-  if ! bash scripts/test_selfcheck_state_lanes.sh >/dev/null 2>&1; then
+  if _out=$(bash scripts/test_selfcheck_state_lanes.sh 2>&1); then
+    echo "PASS  test_selfcheck_state_lanes.sh (four input states + both shipped mis-routings)"
+  else
     echo "FAIL  test_selfcheck_state_lanes.sh: a subject-presence discriminator would mis-route"
-    bash scripts/test_selfcheck_state_lanes.sh 2>&1 | tail -12
+    _show_failure "$_out"
     fail=1
-  else
-    echo "PASS  test_selfcheck_state_lanes.sh (four input states + both shipped mis-routings)"
   fi
 fi
 
@@ -463,12 +594,34 @@ fi
 if [ ! -f scripts/sync-from-be.sh ]; then
   echo "SKIP  sync_from_be_lanes.sh (subject scripts/sync-from-be.sh absent)"
 elif [ -f scripts/sync_from_be_lanes.sh ]; then
-  if ! bash scripts/sync_from_be_lanes.sh >/dev/null 2>&1; then
+  # ── RUN-ONCE, CAPTURE — canonical note for the four LANE BLOCKS (2026-08-05) ─────────────────
+  # SCOPE, stated precisely because the first draft of this note over-claimed: this covers the four
+  # lane blocks only (tag-version · dispatch-log · selfcheck-state · sync_from_be). The same
+  # evidence-discarding shape SURVIVES in `check()` at the top of this file and in the
+  # probe_scope_check caller — both named there, both deliberately out of scope, both still open.
+  # An adversarial round caught the original "all four sites in this file" wording as a false
+  # completion claim: it would have stopped the next reader from re-searching. Half a fix with a
+  # done-label on it is worse than half a fix.
+  # The old form ran the suite twice: once discarded to /dev/null to decide, once re-run to print.
+  # For a DETERMINISTIC suite that is merely wasteful. For a non-deterministic one it destroys the
+  # evidence: the failing run's output goes to /dev/null and the reader is shown the SECOND run,
+  # which may pass. Measured here 2026-08-04 (run 30955950695) — CI printed
+  #     FAIL  sync_from_be_lanes.sh: return-path lanes failed
+  #     ════ lanes: 70 passed · 0 failed ════
+  # i.e. a FAIL verdict over a PASSING transcript, and the actual failure was never recorded
+  # anywhere. That is why this lane sat "flaky, cause unknown" on the session card for two days:
+  # the instrument was discarding the only evidence that could close it. Reproduced as a known
+  # pair before this edit (arm A run-twice → evidence lost + self-contradiction; arm B run-once →
+  # evidence preserved), so the fix is anchored, not asserted.
+  # NOTE this does NOT make the suite deterministic — the underlying non-determinism is still
+  # UNDIAGNOSED and stays an open item. It makes the next occurrence diagnosable instead of
+  # self-erasing. Do not read a green CI after this change as the flake being fixed.
+  if _out=$(bash scripts/sync_from_be_lanes.sh 2>&1); then
+    echo "PASS  sync_from_be_lanes.sh (return-path lanes)"
+  else
     echo "FAIL  sync_from_be_lanes.sh: return-path lanes failed"
-    bash scripts/sync_from_be_lanes.sh 2>&1 | tail -20
+    _show_failure "$_out"
     fail=1
-  else
-    echo "PASS  sync_from_be_lanes.sh (return-path lanes)"
   fi
 else
   echo "FAIL  sync_from_be_lanes.sh: sync-from-be.sh present but its anchor is missing"

package/scripts/session_close_check.sh

@@ -15,6 +15,9 @@
 
 set -uo pipefail
 
+# 상속된 git 환경변수를 끊는다 — export 된 GIT_DIR 이 있으면 `git -C "$FH"` 가 인자로 받은
+# 레포가 아니라 그 레포를 잰다(Axis 2 at-floor LOW, 2026-08-06). READ-ONLY 체커라 부작용 없음.
+unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE
 FH="${1:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
 TODAY=$(date +%Y-%m-%d)
 CARD="$FH/tracks/_meta/reference_next_session_starter.md"
@@ -25,11 +28,58 @@ _mtime() { stat -c %Y "$1" 2>/dev/null || stat -f %m "$1" 2>/dev/null || echo 0;
 echo "── session close check: $FH ($TODAY) ──"
 
 # ① status snapshot — uncommitted / unpushed work must be known, not forgotten
-DIRTY=$(git -C "$FH" status --porcelain 2>/dev/null | wc -l | tr -d ' ')
-UNPUSHED=$(git -C "$FH" log --oneline @{u}.. 2>/dev/null | wc -l | tr -d ' ')
-[ "$DIRTY" -gt 0 ] && echo "⚠️  ① $DIRTY uncommitted path(s) — decide: commit or leave deliberately"
-[ "$UNPUSHED" -gt 0 ] && echo "⚠️  ① $UNPUSHED unpushed commit(s) — push before close or record why"
-[ "$DIRTY" -eq 0 ] && [ "$UNPUSHED" -eq 0 ] && echo "✅ ① working tree clean, nothing unpushed"
+# DIRTY 도 같은 형태였다 — `status --porcelain 2>/dev/null | wc -l` 은 git 이 죽어도 0 을 세어
+# "깨끗함"으로 승격된다(재현: `.git/index` 손상 → exit 128, 출력 0줄). 종료코드를 먼저 본다.
+# ⚠️ 이 줄은 **바로 아래 UNPUSHED 수리와 같은 결함**이었고, 처음엔 아래만 고쳤다 —
+# 반쪽 수리를 고치는 커밋에서 반쪽 수리를 할 뻔했다(Axis 2 챌린저가 잡음, 2026-08-06).
+# `--untracked-files=all` 은 `status.showUntrackedFiles=no` config 를 덮어쓴다. 그 config 아래에서는
+# git 이 **성공적으로 침묵**해(exit 0 · 빈 출력) 종료코드 가드로도 안 잡힌다 — 부재가 다시
+# "깨끗함"으로 렌더된다(Axis 2 at-floor MED, 재현: 미추적 파일 1건이 0 으로 보고됨).
+if _st=$(git -C "$FH" status --porcelain --untracked-files=all 2>/dev/null); then
+  DIRTY_KNOWN=1
+  DIRTY=$(printf '%s' "$_st" | grep -c . || true)
+else
+  DIRTY_KNOWN=0
+  DIRTY=0
+fi
+# upstream 유무를 **먼저 판정**한다. `@{u}..` 는 upstream 이 없으면 실패해 0줄을 내고, 그 0을
+# `wc -l` 이 0으로 세어 "nothing unpushed" 로 승격된다 — **한 번도 머신을 떠난 적 없는 커밋이
+# '푸시할 것 없음'으로 읽히는 fail-open**. 부재를 깨끗함으로 읽는 것이라 0 을 신뢰하면 안 된다.
+# (downstream fork's review lane caught it first; this file is the upstream original — 2026-08-06.)
+if git -C "$FH" rev-parse --abbrev-ref '@{u}' >/dev/null 2>&1; then
+  UPSTREAM_KNOWN=1
+  UNPUSHED=$(git -C "$FH" log --oneline @{u}.. 2>/dev/null | wc -l | tr -d ' ')
+else
+  UPSTREAM_KNOWN=0
+  UNPUSHED=0
+fi
+[ "$DIRTY_KNOWN" -eq 0 ] && echo "⚠️  ① UNMEASURED — git status failed; working-tree cleanliness is UNKNOWN, not clean"
+[ "$DIRTY_KNOWN" -eq 1 ] && [ "$DIRTY" -gt 0 ] && echo "⚠️  ① $DIRTY uncommitted path(s) — decide: commit or leave deliberately"
+[ "$UPSTREAM_KNOWN" -eq 0 ] && echo "⚠️  ① UNMEASURED — no upstream for this branch; unpushed count is UNKNOWN, not zero"
+[ "$UPSTREAM_KNOWN" -eq 1 ] && [ "$UNPUSHED" -gt 0 ] && echo "⚠️  ① $UNPUSHED unpushed commit(s) — push before close or record why"
+# "as of last fetch" — 원격을 조회하지 않는다. 로컬 remote-tracking ref 가 낡았으면 이 0 도 낡은 값이다
+# (Axis 2 챌린저 MED, 2026-08-06). fetch 를 넣지 않은 것은 마감 체커가 READ-ONLY·오프라인 안전이기 때문.
+# 추적 파일이 assume-unchanged/skip-worktree 로 마킹돼 있으면 그 수정은 porcelain 에 **안 뜬다** —
+# `-uall` 로도 안 잡히는 별개 계기다(Axis 2 at-floor MED, 재현 확인).
+MASKED=$(git -C "$FH" ls-files -v 2>/dev/null | grep -c '^[a-z]' || true)
+[ "${MASKED:-0}" -gt 0 ] \
+  && echo "⚠️  ① $MASKED file(s) assume-unchanged/skip-worktree — their edits are INVISIBLE here"
+
+# ★ 잰 범위 ≠ 주장 범위 (Axis 2 at-floor HIGH, 2026-08-06).
+# `@{u}..` 는 **현재 브랜치만** 잰다. 다른 로컬 브랜치에만 있는 미푸시 커밋은 통째로 안 보이는데
+# 화면 문구는 "nothing unpushed"(레포 전체)라고 말한다 — 이 파일의 존재 이유 정중앙이다.
+# 재현: 다른 브랜치에 미푸시 커밋 1건 → `✅ nothing unpushed` 가 그대로 떴다.
+# 원격이 하나도 없으면 이 값이 전 커밋 수로 부풀므로 원격 존재를 먼저 가드한다.
+OTHER_UNPUSHED=0
+if [ -n "$(git -C "$FH" remote 2>/dev/null)" ]; then
+  OTHER_UNPUSHED=$(git -C "$FH" log --branches --not --remotes --oneline 2>/dev/null | wc -l | tr -d ' ')
+fi
+[ "${OTHER_UNPUSHED:-0}" -gt 0 ] \
+  && echo "⚠️  ① $OTHER_UNPUSHED commit(s) on local branches never pushed anywhere (all-branch scan)"
+
+[ "$DIRTY_KNOWN" -eq 1 ] && [ "$DIRTY" -eq 0 ] && [ "$UPSTREAM_KNOWN" -eq 1 ] && [ "$UNPUSHED" -eq 0 ] \
+  && [ "${OTHER_UNPUSHED:-0}" -eq 0 ] && [ "${MASKED:-0}" -eq 0 ] \
+  && echo "✅ ① working tree clean, nothing unpushed anywhere (as of last fetch)"
 
 # ①-b open-PR sweep (surface-not-auto — requires gh; skip silently offline)
 if command -v gh >/dev/null 2>&1; then

package/scripts/test_degrade_scan_shell_probes.sh

@@ -163,6 +163,15 @@ cat > "$TMP/s5_positive.sh" <<'EOF'
 set -uo pipefail
 N=$(find /nope . -maxdepth 1 2>/dev/null | grep -c . || echo 0)
 M=$(git log --oneline 2>/dev/null | wc -l || echo 0)
+# WIDENED 2026-08-04. Every line below was INVISIBLE to the narrowed rule, and each was verified to
+# actually produce "0\n0" before being pinned here (line count measured, not assumed):
+P=$(cat /etc/hosts | grep -c . | tr -d ' ' || echo 0)   # transparent filter after the counter
+Q=$(grep -c "^nosuchline$" /etc/hosts 2>/dev/null | tr -d ' ' || echo 0)  # the PR #251 shape
+R=$(grep -Ec "^nosuchline$" /etc/hosts || echo 0)       # combined flag cluster -Ec
+S=$(grep --count "^nosuchline$" /etc/hosts || echo 0)   # long option
+T=$(grep -Fcx "nosuchline" /etc/hosts || echo 0)        # -Fcx
+U=$(false | grep -c . | cat || echo 0)                  # trailing stage that always emits
+V=$(false | grep -c . | grep -v nosuch || echo 0)       # trailing grep whose pattern misses the "0"
 EOF
 cat > "$TMP/s5_negative.sh" <<'EOF'
 #!/usr/bin/env bash
@@ -174,8 +183,8 @@ J=$(printf '%s' "$x" | jq -r '.a // 0' 2>/dev/null || echo 0)
 # A comment describing the defect must not be scored as the defect: cmd | grep -c . || echo 0
 EOF
 n=$(s_hits "$TMP/s5_positive.sh")
-[ "$n" -eq 2 ] && ok "S5 known-positive: counter-stage fallbacks (grep -c, wc) detected 2/2" \
-                || bad "S5 known-positive: expected 2 S-hits, got $n — the pipefail disarm is invisible"
+[ "$n" -eq 9 ] && ok "S5 known-positive: 9/9 — incl. -Ec/--count/-Fcx flag clusters, trailing \`| cat\`/\`| grep -v\`, and the no-upstream-pipe form" \
+                 || bad "S5 known-positive: expected 9 S-hits, got $n — 2 = the pre-2026-08-04 rule (pipe-presence anchor); 4 = the first widening, which still missed every combined flag cluster (\`-Ec\`, \`--count\`, \`-Fcx\`) and any trailing stage outside a hardcoded name list"
 
 n=$(s_hits "$TMP/s5_negative.sh")
 [ "$n" -eq 0 ] && ok "S5 known-negative: \`||\` chains, empty-on-failure pipelines and comments stay silent" \

package/scripts/test_dispatch_log_lanes.sh

@@ -75,7 +75,14 @@ PY
     [ "$ok" -eq 0 ] ; chk $? "hook ends in exit 0 — a non-zero hook exit discards its stdout SILENTLY"
     # run it against a scratch HUB and confirm it appends today's date
     CLAUDE_PROJECT_DIR="$T/hub" bash -c "$cmd" >/dev/null 2>&1
-    [ "$(grep -c "$(date +%Y-%m-%d)" "$T/hub/tracks/_meta/.subagent_dispatch_tally" 2>/dev/null || echo 0)" -ge 1 ]
+    # Split + sanitize, not `grep -c … || echo 0`: on no-match `grep -c` PRINTS "0" and exits 1, so
+    # the fallback appends a SECOND line and `[ -ge ]` dies with "integer expression expected".
+    # Here that error happens to land on the FAIL branch — honest scope: this was never a live
+    # fail-open, it was a verdict reached by a bash error instead of a comparison, one refactor
+    # away from flipping. Found by the S5 sweep after the rule was widened (2026-08-04).
+    _tally_n=$(grep -c "$(date +%Y-%m-%d)" "$T/hub/tracks/_meta/.subagent_dispatch_tally" 2>/dev/null); _tally_n=${_tally_n:-0}
+    case "$_tally_n" in (*[!0-9]*|'') _tally_n=0 ;; esac
+    [ "$_tally_n" -ge 1 ]
     chk $? "hook actually appends a dated line when run (not merely present)"
   fi
 else

package/scripts/test_selfcheck_state_lanes.sh

@@ -93,6 +93,109 @@ else
   echo "  ⏭️  package.json absent — premise unchecked (not a pass)"
 fi
 
+echo ""
+echo "── _show_failure: a FAILING suite's evidence must survive to the reader ──"
+# WHY THIS LANE EXISTS (2026-08-05): the four lane blocks in selfcheck.sh used to decide on a
+# discarded run (`>/dev/null`) and then RE-RUN to print. On a non-deterministic suite the re-run can
+# pass, so CI printed a FAIL verdict above a PASSING transcript and the real failure was destroyed —
+# measured in run 30955950695. The repair captures once; this lane is the mechanical anchor for the
+# half that actually makes a failure readable. Without it the repair is unverifiable: reverting to
+# `tail -20` leaves CI green, which is exactly [[feedback_built_but_not_wired]] / anchor-is-decorative.
+# LIFTED, not re-spelled — same reason as the discriminator above.
+FN=$(sed -n '/^_show_failure() {/,/^}$/p' "$SELFCHECK")
+if [ -z "$FN" ]; then
+  echo "FAIL  _show_failure is no longer defined in selfcheck.sh — this lane cannot verify what it claims."
+  echo "      If the helper was renamed or removed, update the lane WITH the subject."
+  exit 1
+fi
+eval "$FN"
+
+# Fixture: a long transcript whose ONLY failing line sits far above any tail window, plus a
+# summary banner at the end that still says something failed. This is the shape that fooled the
+# reader in the CI run above.
+_LONG=$(for i in $(seq 1 40); do echo "  ✅ lane L$i ok"; done; echo "  ❌ lane L41 tripped — THE EVIDENCE"; for i in $(seq 42 96); do echo "  ✅ lane L$i ok"; done; echo "════ lanes: 96 passed · 1 failed ════")
+
+_OUT=$(_show_failure "$_LONG")
+printf '%s' "$_OUT" | grep -q 'THE EVIDENCE'; chk $? "the failing line survives (it is 56 lines above the end)"
+printf '%s' "$_OUT" | grep -q '1 failed'    ; chk $? "the summary banner is still shown"
+
+# CONTROL — the old form must FAIL this same fixture. Without this, the lane could pass for a
+# reason unrelated to the repair (e.g. a fixture short enough that any tail window catches it).
+printf '%s\n' "$_LONG" | tail -20 | grep -q 'THE EVIDENCE'; [ $? -ne 0 ]
+chk $? "CONTROL: the pre-repair form (tail -20) does NOT surface it — the fixture discriminates"
+
+# Degenerate inputs: silence must not read as evidence, and a suite that dies before printing any
+# ❌ must say so rather than showing a blank.
+_OUT=$(_show_failure "")
+printf '%s' "$_OUT" | grep -q 'no output captured'; chk $? "empty output is named, not shown as a blank line"
+_OUT=$(_show_failure "some early crash text
+Traceback: boom")
+printf '%s' "$_OUT" | grep -q 'died early'; chk $? "output with no ❌/FAIL falls back and says why"
+
+# ── THE DEFECT ITSELF: decide-and-print must be ONE execution ────────────────
+# An earlier version of this lane block tested only the _show_failure HELPER, in isolation, via eval.
+# An adversarial round then reverted a lane block to the original run-twice form — decide on a
+# discarded run, re-run to capture — and this suite still returned PASS (16/16, measured). The anchor
+# was guarding the thing the repair BUILT and not the thing the repair FIXED. That is
+# [[feedback_anchor_can_be_decorative]] with the reversal actually applied, which is the only check
+# that distinguishes the two.
+# The invariant that discriminates: a suite must be EXECUTED EXACTLY ONCE per selfcheck run. The
+# run-twice form necessarily names its subject twice. Keying on the subject path (not on a variable
+# name or a pipe shape) also removes the earlier grep's escape hatch — renaming `_out` no longer
+# evades it, and adding a fifth lane block does not require editing a hardcoded count.
+for _subj in test_tag_version_lanes test_dispatch_log_lanes test_selfcheck_state_lanes sync_from_be_lanes; do
+  _n=$(grep -c "bash scripts/${_subj}\.sh" "$SELFCHECK" || true)
+  [ "$_n" -eq 1 ]
+  chk $? "${_subj}.sh is executed exactly once (found $_n) — 2 means the run-twice form is back"
+done
+
+# WIRING — every lane block must route its captured output through the helper. Secondary to the
+# once-only invariant above (this one IS evadable by renaming), kept because it names the intent.
+_CALLS=$(grep -c '_show_failure "\$_out"' "$SELFCHECK")
+[ "$_CALLS" -ge 4 ]; chk $? "every lane block routes failure output through _show_failure (found $_CALLS, expected ≥4)"
+_TAILS=$(grep -c '"\$_out" | tail -' "$SELFCHECK" || true)
+[ "$_TAILS" -eq 0 ]; chk $? "no lane block still truncates with a raw tail (found $_TAILS, expected 0)"
+
+# The one non-lane caller that also destroys its evidence at the CALL SITE (not inside check()).
+# `check "..." bash -c '... >/dev/null'` discards the subject's stdout, and fh-codex-doctor writes
+# 100% of its diagnostics to stdout (measured: 686 B stdout / 0 B stderr) — so a strict-mode failure
+# would print a bare FAIL line with zero diagnosis. Anchored here because the fix is one line at the
+# call site and does NOT require touching check() itself.
+_CD=$(grep -c "fh-codex-doctor.js --strict >/dev/null" "$SELFCHECK" || true)
+[ "$_CD" -eq 0 ]; chk $? "fh-codex-doctor's stdout is not discarded at the call site (found $_CD, expected 0)"
+
+# Byte-hostile input: a lane emitting invalid UTF-8 must not be reported as "no output". The
+# `tr -d '[:space:]'` form this guard originally used aborts on BSD with "Illegal byte sequence"
+# and emits nothing, so the emptiness check concluded empty while evidence was present.
+# NOTE ON THIS FIXTURE — it deliberately contains NO ❌. The first draft included one, which routed
+# the call into the failing-lines branch, so the emptiness guard (an `elif`) was never reached and the
+# lane passed against the very defect it was written for. Verified by applying the reversion and
+# confirming the diff landed: the lane went green anyway. A fixture that cannot reach the branch
+# under test measures nothing.
+_BAD=$(printf '  \xff\xfe garbage\n  crashed before any lane ran BYTE_EVIDENCE\n')
+_OUT=$(_show_failure "$_BAD")
+printf '%s' "$_OUT" | grep -q 'BYTE_EVIDENCE'; chk $? "invalid UTF-8 in the stream does not swallow the evidence"
+printf '%s' "$_OUT" | grep -qv 'no output captured'; chk $? "…and it is not mis-reported as empty output"
+
+# The banner must not be suppressed by a line the reader never saw (a failing line past the head cut
+# that merely quotes the banner text).
+_MANY=$(for i in $(seq 1 26); do echo "  ❌ f$i"; done; echo "  ❌ f27 quoting ════ lanes: 9 passed · 1 failed ════"; echo "════ lanes: 9 passed · 1 failed ════")
+_OUT=$(_show_failure "$_MANY")
+[ "$(printf '%s\n' "$_OUT" | grep -c '════ lanes: 9 passed')" -ge 1 ]
+chk $? "the summary banner still prints when a truncated-away line quotes it"
+
+# ── SCOPE OF THIS ANCHOR — stated so it is not over-trusted ───────────────────
+# These lanes catch REVERSION (the run-twice form coming back, the helper being gutted, the
+# call-site redirect returning). They do NOT catch deliberate EVASION: a cross-family round
+# demonstrated three forms that satisfy every check above while still destroying evidence —
+# `_out=$(bash suite >/dev/null 2>&1)` (executed once, captured nothing), a wrapper function
+# (`run_lane() { bash scripts/X.sh; }`, literal appears once, runs twice), and redirect spellings
+# the greps do not enumerate (`1>/dev/null`, a variable). Chasing those with more patterns is the
+# Grep-Collision Treadmill this repo has already logged as P10 — each added regex relocates the
+# evasion instead of closing it. It is bounded rather than escalated: an evading form still routes
+# through _show_failure, whose empty branch prints "(no output captured)" at runtime, so the failure
+# is loud rather than silent. Regression is anchored; evasion is a named residual, not a solved one.
+
 echo ""
 if [ "$FAILED" -ne 0 ]; then
   echo "SELFCHECK STATE LANES: FAIL — a discriminator would mis-route"

package/scripts/test_session_close_chain_lanes.sh

@@ -85,6 +85,18 @@ _repo() {  # $1=dirname ; makes a git repo with one commit dated $2 (default now
     else
       git commit -qm seed
     fi
+    # A real repo HAS an upstream. Without one the close check now (correctly) reports
+    # `① UNMEASURED — no upstream`, which is not the state any of these lanes means to express —
+    # a fixture with no upstream cannot assert "clean tree, nothing unpushed" because the second
+    # half of that sentence is genuinely unknown. Every lane below therefore runs on a pushed
+    # baseline; upstream ABSENCE is measured on purpose by its own lane (KP-2).
+    git init -q --bare "$TMPROOT/$1.git"
+    git remote add origin "$TMPROOT/$1.git"
+    # `-c core.hooksPath=` : a fixture push must never execute the HOST's git hooks. This repo sets
+    # core.hooksPath locally (so a temp repo does not inherit it) but a machine that sets it GLOBALLY
+    # would run FH's own pre-push Destructive-Op gate against a throwaway fixture — the suite's result
+    # would then depend on the operator's git config rather than on the code under test.
+    git -c core.hooksPath= push -q -u origin HEAD
   ) >/dev/null 2>&1
   mkdir -p "$T/tracks/_meta"
   printf '%s' "$T"
@@ -121,13 +133,10 @@ _line "①-N  uncommitted path → ⚠️ fires"           'uncommitted path'
 _line "①-N  uncommitted path → clean line absent"  '✅ ① working tree clean' 0 "$OUT"
 _rc   "①-N  uncommitted is ADVISORY, not blocking" "$RC" 0
 
-# unpushed: needs a real upstream, so build a bare remote
+# unpushed: _repo already pushed the seed, so one extra commit is exactly one unpushed commit
 T=$(_repo one_unpushed); _artifacts "$T"
 (
   cd "$T" || exit 1
-  git init -q --bare "$TMPROOT/one_unpushed.git" 2>/dev/null
-  git remote add origin "$TMPROOT/one_unpushed.git"
-  git push -q -u origin HEAD 2>/dev/null
   echo more > second.txt && git add -A && git commit -qm second
 ) >/dev/null 2>&1
 _run "$T"
@@ -141,6 +150,72 @@ _gap "①  non-repo reports CLEAN" "$_g" \
   "git is unavailable/not a repo → DIRTY=0, UNPUSHED=0 → the check reports '✅ working tree clean'. \
 An instrument that could not look is not a clean result (not found ≠ 0). Should say UNSCANNED."
 
+# ── ① not-found ≠ 0 : the five states where git CANNOT answer ────────────────────
+# Origin: the fix that introduced these five guards (2026-08-06) listed all six known pairs in its
+# COMMIT MESSAGE and shipped none of them as a lane — the code changed, the suite did not, and CI
+# went red on the two lanes the change broke rather than on the five it left unmeasured. Prose in a
+# commit message is not a regression anchor: nothing re-runs it. Each pair below is
+# known-positive (the instrument is blind) + a paired control (the clean line must NOT appear),
+# because "the warning fired" and "the warning fired INSTEAD of a false all-clear" are two claims.
+# KP-1 (the healthy case) is the ①-P lane at the top of this section.
+
+# KP-2 upstream absent — `@{u}..` fails, prints 0 lines, and `wc -l` counts that 0 as "nothing
+# unpushed". A commit that never left the machine reads as pushed. `--unset-upstream` (not
+# `remote remove`) keeps a remote present, so the all-branch scan still runs: this isolates the
+# upstream leg instead of quietly testing two things at once.
+T=$(_repo kp2_no_upstream); _artifacts "$T"
+git -C "$T" branch --unset-upstream >/dev/null 2>&1
+_run "$T"
+_line "KP-2 no upstream → UNMEASURED, not zero"    'unpushed count is UNKNOWN' 1 "$OUT"
+_line "KP-2 → clean line absent (paired)"          '✅ ① working tree clean'   0 "$OUT"
+_rc   "KP-2 → advisory, not blocking"              "$RC" 0
+
+# KP-3 git status itself fails — a corrupt index makes `status` exit non-zero with EMPTY output,
+# and `| wc -l` renders that emptiness as "0 dirty paths" = clean.
+T=$(_repo kp3_broken_index); _artifacts "$T"
+printf 'garbage' > "$T/.git/index"
+_run "$T"
+_line "KP-3 corrupt index → cleanliness UNKNOWN"   'cleanliness is UNKNOWN'    1 "$OUT"
+_line "KP-3 → clean line absent (paired)"          '✅ ① working tree clean'   0 "$OUT"
+# Measured while writing this lane: a corrupt index makes `ls-files -v` exit 128 too, so the
+# assume-unchanged probe (MASKED) silently reads 0 — the same not-found-≠-0 shape, one layer in.
+# It is NOT a false all-clear (DIRTY_KNOWN=0 already suppresses the clean line), so it is recorded
+# as a residual rather than patched here. `rev-parse @{u}` still exits 0 under a corrupt index,
+# which is what keeps this lane measuring cleanliness and not accidentally re-measuring KP-2.
+
+# KP-4 measured scope ≠ claimed scope — `@{u}..` reads the CURRENT branch only, while the message
+# says "nothing unpushed" about the repo. An unpushed commit parked on another local branch is
+# invisible. The current branch stays clean and pushed on purpose: only the other branch is dirty,
+# so a green here would be the exact false all-clear.
+T=$(_repo kp4_other_branch); _artifacts "$T"
+(
+  cd "$T" || exit 1
+  git checkout -q -b side
+  echo side > side.txt && git add -A && git commit -qm side
+  git checkout -q -
+) >/dev/null 2>&1
+_run "$T"
+_line "KP-4 unpushed on ANOTHER branch → ⚠️ fires" 'never pushed anywhere'     1 "$OUT"
+_line "KP-4 → clean line absent (paired)"          '✅ ① working tree clean'   0 "$OUT"
+
+# KP-5 `status.showUntrackedFiles=no` — git succeeds and stays SILENT (exit 0, empty output), so
+# the exit-code guard of KP-3 cannot catch this one. Only `--untracked-files=all` overrides it.
+T=$(_repo kp5_untracked_off); _artifacts "$T"
+git -C "$T" config status.showUntrackedFiles no
+echo hidden > "$T/hidden.txt"
+_run "$T"
+_line "KP-5 showUntrackedFiles=no → still counted"  'uncommitted path'         1 "$OUT"
+_line "KP-5 → clean line absent (paired)"           '✅ ① working tree clean'  0 "$OUT"
+
+# KP-6 assume-unchanged / skip-worktree — edits to a marked TRACKED file never reach porcelain at
+# all, so `-uall` does not help either. A separate instrument (`ls-files -v`) has to surface it.
+T=$(_repo kp6_assume_unchanged); _artifacts "$T"
+git -C "$T" update-index --assume-unchanged unrelated.txt
+echo edited >> "$T/unrelated.txt"
+_run "$T"
+_line "KP-6 assume-unchanged edit → surfaced"       'INVISIBLE here'           1 "$OUT"
+_line "KP-6 → clean line absent (paired)"           '✅ ① working tree clean'  0 "$OUT"
+
 echo
 echo "══ ①-b open-PR sweep ══"
 _ghstub() {  # $1=repo $2=stdout $3=exit