@chrono-meta/fh-gate 1.4.88 → 1.4.89

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "1.4.88",
+      "version": "1.4.89",
       "description": "Hub meta-operations toolkit — 35 skills + 7 agents. New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "1.4.88",
+      "version": "1.4.89",
       "description": "Project-agnostic utility skills — 4 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/CLAUDE.md

@@ -602,6 +602,42 @@ Default operation is a **standard interactive session**. Agent dispatch (single
 
 **Why not Agent View by default**: Agent View introduces worktree isolation (blocks settings.json writes, Stop hook timing differs), session context gaps (session card stale content bug), and path friction — with no benefit unless the user is actively managing multiple agent sessions. Parallel agents via `Agent` tool work identically in a standard session.
 
+**Fourth reason — gate-integrity in a worktree, and the answer is CONDITIONAL on how `core.hooksPath`
+was set (measured 2026-08-05, both arms).** Do not carry a single verdict here; the two installs
+behave differently:
+
+| `core.hooksPath` | Which hook actually runs in a worktree | Consequence |
+|---|---|---|
+| **relative** — `templates/.git-hooks`, the form every FH doc installs (`CHEATSHEET.md`, `.claude/rules/fh_4axis_gate.md`, `install-wizard`, `self_evolution_routine.md`) | the **worktree's own copy** | Editing that copy *inside the worktree* disables the gate for that worktree — measured: neutralized hook → FH-asset commit with no marker succeeded (`rc=0`). The verifier becomes the verified, and the edit is invisible to `git status` in the main tree. |
+| **absolute** — a hand-set full path (this operator's machine; **not** what any doc tells you to run) | the **main tree's copy** | A worktree-local edit has no effect; a known-positive is blocked there exactly as in the main tree (`rc=1`). |
+
+An earlier draft of this section reported only the absolute-path arm and declared the
+"worktree bypasses the gates" hypothesis *refuted* — from **n=1 on a non-canonical setting**, with a
+do-not-revisit label attached. The relative-path arm, which is what everyone else runs, reproduces
+the bypass. Freezing a conclusion is a defect when the measurement did not cover the shipped
+configuration.
+
+Separately and in **both** arms, the **evidence side** breaks: `tracks/` is gitignored, so it does not
+follow into a worktree, so the Axis 2+3 marker and the Axis 4 `edit_manifest.yaml` are *structurally
+absent* — an FH-asset commit in a worktree fails on evidence it has no way to have. That degrades
+fail-closed (correct), but a gate that **cannot** be satisfied is what trains the bypass. Note the
+hook itself prints `mkdir -p …/tracks/_meta` on that failure, i.e. the actor's own error message
+teaches the marker-creation path — so "just don't fabricate it" is prose sitting under a machine
+instruction pointing the other way.
+
+**Therefore: do not commit FH assets from a worktree.** Not "carry the evidence in carefully" — a
+carried marker and a fabricated one are byte-identical, so *marker provenance* is unenforceable by
+construction. Land FH-asset changes from the standard session.
+
+**Do not let that unenforceability launder the enforceable part** (caught by an adversarial round on
+the paragraph above, which had used it to do exactly that): *being in a worktree* is trivially
+detectable — `git rev-parse --git-common-dir` differs from `--git-dir` there and matches in the main
+tree — and `templates/.git-hooks/pre-commit` currently has **zero** lines of worktree detection. A
+true statement about one thing (provenance) was standing in for an untested claim about another
+(location). It is left un-mechanized for a *scope* reason, not an impossibility one: measured
+recurrence is 1, below this repo's own N≥3 mechanization threshold. If it recurs, the check is a
+two-line hook addition, not a research problem.
+
 **Forbidden responses**: *"I can't do that — I'm not in that project's cwd"* — self-check Agent dispatch first.
 
 Mapped paths: check `auto_project_mapping.md` or `find ~/projects -maxdepth 1 -type d` for actuals.

package/knowledge/shared/harness-core/claude_md_gate_details.md

@@ -196,6 +196,13 @@ destroys live state without anyone noticing. This is why the loss class is calle
   plaintext only (encoded tokens out of scope); a line-split backstop catches a token wrapped across
   lines; `PUBLIC_SURFACE_OK=1` overrides and is logged to a gitignored audit trail for the weekly audit.
   Residuals (split-encoding, override-not-populated, override abuse) are documented, not silent.
+  **Verdict labelling (2026-08-06)**: with the override absent, a clean scan reports
+  `⚠️ PARTIAL — company/companion literals UNMEASURED`, **never `✅ PASS`**. The commit still
+  proceeds (reversible surface → advisory degrade), but a run whose operator-literal layer never
+  executed may not present the same verdict as one where it did — a missing measurement is not a
+  zero. Anchored in `universal_guard_check.sh` as a **pair**: absent override must say `PARTIAL`,
+  and the control (override present, no hit) must still say `✅ PASS`, so the label cannot drift
+  back to a bare PASS *or* become an unconditional warning.
 - **(c) `npm publish`** — mechanically gated by `scripts/public_surface_scan_files.sh`, wired into
   `prepublishOnly` (`npm run release` also runs it *outside* the lifecycle). Unlike (b) it scans the
   **full content of the exact npm-published file set** (`npm pack --dry-run`), *not* a commit diff — so a
@@ -204,6 +211,36 @@ destroys live state without anyone noticing. This is why the loss class is calle
   or the file set are unresolved, when the parse looks partial, **or when the gitignored operator override
   is absent** — defaults-only would otherwise green-PASS a HIGH company literal on a fresh clone or CI runner.
 
+**The git-push surface, and why it was the lenient one (2026-08-06).** (c) blocked on an absent
+override; the `git push` gate in `templates/.git-hooks/pre-push` only warned. Both make content
+public, so two irreversible surfaces were degrading in **opposite directions on the same state** —
+the actual defect, and `git push` (the one nobody publishes through deliberately) was the permissive
+side. The 2026-07-26 reasoning behind that warn was not wrong, it was **unscoped**: an absent
+override in a fresh clone / CI runner / worktree is a legitimate per-operator configuration gap (the
+file is gitignored, so it is absent there *by construction*), and blocking it trains
+`PUBLIC_SURFACE_OK` into a reflex — which disarms the same channel the publish gate depends on.
+
+So the warn is **scoped, not reverted**. `psa_detect_operator_context` (`scripts/psa_scan_lib.sh`)
+splits the state: in an **operator-configured checkout** an absent override is *evidence missing
+where evidence is expected* → BLOCK; everywhere else → WARN, exactly as before. The signal is
+`CLAUDE.local.md`, the operator's own gitignored binding file.
+
+**Calibration matters here more than the rule** — a second candidate signal, "`tracks/_meta` is
+non-empty", reads as the same test and is not: `tracks/_meta/.gitkeep` and one sibling are
+**tracked**, so a fresh clone satisfies it and would have been blocked, re-shipping the 07-26
+over-block under a new name. It was rejected by measuring it against a known pair, not by reasoning
+about it. **Named residual, deliberately in the under-blocking direction**: an operator who never
+created a `CLAUDE.local.md` stays in the WARN arm. **Second residual, and it is the sharper one**:
+deleting `CLAUDE.local.md` drops this checkout back into the WARN arm, and unlike `PUBLIC_SURFACE_OK=1`
+that bypass **writes no log line**. It is a conscious act on the operator's own file, so it is not a
+weak-model fail-open — but it is a quieter exit than the sanctioned one, which is the wrong ordering
+for a bypass. Not closed here: making it loud means the hook must distinguish "never had one" from
+"had one and lost it", and that needs state the hook does not currently keep. Named rather than
+mechanized, per this repo's own threshold — mechanize on the first measured recurrence.
+Anchored as a pair in `prepush_guard_check.sh`
+(6-a absent override → PASS · 6-b absent override + operator checkout → BLOCK); both arms are
+required, since 6-b passing alone would not distinguish a scoped block from a blanket one.
+
 **Named residuals for (c)** — it is a denylist **on the npm CLI path with scripts enabled**, not a
 universal secret-scanner:
 

package/knowledge/shared/learnings/subagent_invocations_log.yaml

@@ -996,3 +996,76 @@
     invented: a fabricated outcome would poison the 60/40 promotion gate worse than a missing one,
     which is the stated reason the hook only tallies and never writes an entry. Open question for
     the next session that touches the tally: which tool events actually fire SubagentStop here.
+
+- date: '2026-08-05'
+  agent: persona-innovator ×2 · quench-challenger ×3 · beginner ×5 (Agent tool) + codex gpt-5.5 ×2 (CLI)
+  context: >-
+    Innovator autopilot session. Two sister-asset absorption scans (innovator); steel-quench Wave 1
+    and Wave 3 on the selfcheck run-twice repair, plus one opus Axis-2 pass on the AGENTS.md change
+    (quench-challenger); five Sonnet-pinned cold-read sims on one AGENTS.md checklist item
+    (beginner); two cross-family audits (codex CLI, tool-use disabled — not counted by the tally
+    hook, which only fires on Agent-tool SubagentStop).
+  dispatches: '10 via Agent tool + 2 CLI sidecars (tally recorded 14 — the delta is unattributed,
+    see the 2026-08-05 entry above about unknown tally sources; not invented here either)'
+  outcome: accepted
+  evidence: >-
+    Every class changed the outcome, which is why this is `accepted` rather than `partial`.
+    quench-challenger: Wave 1 produced 2S/3A/4B and Wave 3 produced 2S/1A/3B on the REPAIR — one of
+    those overturned a judgment already reported to the operator (a "refuted" verdict measured on a
+    non-canonical absolute core.hooksPath; the documented relative-path install reproduces the
+    bypass). The opus Axis-2 pass produced 2S that caused a full revert of the AGENTS.md change.
+    beginner: 5 rounds, each blocking at a DIFFERENT point, each block introduced by the previous
+    round's repair; author self-catch across rounds 1-4 was ZERO. innovator: 4 external repos
+    verified by gh api with known-pair controls, 3 net-new items confirmed by in-repo greps with
+    live controls. codex: round 1 was fed a STALE diff (my error — the target was not frozen) so 2
+    of its findings were already closed and 1 was a misread; round 2 on a fingerprinted target found
+    the BSD `tr -d '[:space:]'` defect that both same-family rounds missed.
+  note: >-
+    Logged at close, after the session_close_check ④-e block caught the omission — the obligation
+    is prose in CLAUDE.md and I did not discharge it during the session despite dispatching 10+
+    agents. That is the same shape the ④-e check was built for. Consolidated per class with counts
+    rather than one stub per dispatch, which the check explicitly permits.
+
+- date: '2026-08-06'
+  agent: beginner ×5 (Sonnet-pinned cold read) · quench-challenger ×1 (opus Axis-2) — same session as 2026-08-05
+  context: >-
+    The innovator autopilot session crossed midnight; the tally records 14 dispatches under
+    2026-08-06 while the substantive description lives in the 2026-08-05 entry above. These are not
+    additional work — they are the same session's later half: the five cold-read rounds on the
+    AGENTS.md worktree item and the opus adversarial pass that ended it.
+  dispatches: '6 attributable here (tally: 14 under this date; the remainder shares the
+    unattributed-source question already recorded on 2026-08-05)'
+  outcome: accepted
+  evidence: >-
+    The opus Axis-2 pass returned 2S — a recipe that commits to the WRONG BRANCH (git forbids two
+    worktrees sharing a branch, so the main checkout and a worktree are always on different
+    branches, and the recipe never aligned them), and a hook that hands out a marker-fabrication
+    one-liner at the exact moment it blocks. Both were reproduced against the live repo, and the
+    change was REVERTED in full rather than patched. The five beginner rounds each blocked at a
+    different point with author self-catch of zero across rounds 1-4.
+  note: >-
+    Written after the close check refused the push a SECOND time: the first correction logged the
+    session under 2026-08-05 while the check counts today's date, so "logged" and "logged where the
+    check looks" came apart. Recorded rather than back-dated — the split is real (the tally itself
+    splits 34/14 across the boundary) and pretending otherwise would misstate when the work ran.
+
+- date: 2026-08-06
+  agent: general-purpose ×2 (블라인드 응시자), fh-commons:quench-challenger ×2 (Axis 2)
+  purpose: >-
+    qasp 풀체인 단련 — 출제자/응시자 분리 블라인드 실행 2회(2막 대조 · 3층 난이도)와,
+    FH 마감 체커 fail-open 수리에 대한 Axis 2 적대검증 2라운드(sonnet → at-floor opus).
+  model: sonnet ×3, opus ×1
+  outcome: accepted
+  evidence: >-
+    블라인드 2회가 계기 결함 2건을 직접 산출했다 — 1차는 두 런 차이를 "플레이키"로 오귀속해
+    리포트에 코드 상태 지문이 없음을 드러냈고(#84→PR #86), 2차는 counts 만 대조해 "변화 없음"이라
+    결론내 집계가 개별을 가리는 문제를 드러냈다(→PR #87). 두 오귀속 모두 **주어진 산출물만 보고는
+    그렇게 결론낼 수밖에 없었다** — 그래서 결함이 응시자가 아니라 계기 쪽임이 판별됐다.
+    챌린저 R1(sonnet)은 수리 대상 바로 윗줄에 같은 fail-open 이 남아 있음을 재현으로 잡았고,
+    게이트가 floor 미달로 거부해 R2(opus, at-floor)를 돌리자 R1 이 못 본 4건이 추가로 나왔다
+    (재발견 0건, 전부 실제 재현). known-pair 6/6.
+  note: >-
+    45 dispatch 대 1 로그 항목으로 ④-e 가 통과한 상태였다 — 이 항목이 그 간극을 메운다.
+    카운트가 큰 것은 Explore 등 내부 에이전트가 함께 집계되기 때문이고, 의미 있는 위임은 위 4건이다.
+    ★방법론 소득이 결함보다 크다: 출제자=응시자면 "잘 나온다"로 끝나고, 분리하면 매 라운드
+    계기 결함이 나온다. 그리고 floor 는 장식이 아니었다 — sonnet R1 이 놓친 HIGH 를 opus R2 가 잡았다.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrono-meta/fh-gate",
-  "version": "1.4.88",
+  "version": "1.4.89",
   "description": "FH runtime adapters — run FH governance, skills, and agents via Claude or Codex with machine-parseable gates.",
   "license": "MIT",
   "keywords": [
@@ -26,7 +26,7 @@
   "scripts": {
     "prepare": "chmod +x bin/fh-gate.js bin/fh-run.js bin/fh-goal.js bin/fh-codex-doctor.js scripts/fh-gate.sh scripts/fh-run.sh scripts/fh-goal.sh",
     "test": "bash scripts/selfcheck.sh",
-    "prepublishOnly": "bash scripts/selfcheck.sh && bash scripts/public_surface_scan_files.sh",
+    "prepublishOnly": "bash scripts/version_lockstep_check.sh && bash scripts/selfcheck.sh && bash scripts/public_surface_scan_files.sh",
     "release": "bash scripts/public_surface_scan_files.sh && npm publish"
   },
   "engines": {
@@ -64,7 +64,9 @@
     "scripts/fh-goal.sh",
     "scripts/count_check.sh",
     "scripts/selfcheck.sh",
+    "scripts/version_lockstep_check.sh",
     "scripts/test_selfcheck_state_lanes.sh",
+    "scripts/test_version_lockstep_lanes.sh",
     "scripts/package_coverage_check.sh",
     "scripts/test_package_coverage_lanes.sh",
     "scripts/test_fh_gate_regressions.sh",

package/plugins/fh-commons/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-commons",
-  "version": "1.4.88",
+  "version": "1.4.89",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/plugins/fh-meta/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "fh-meta",
-  "version": "1.4.88",
+  "version": "1.4.89",
   "engines": {
     "claudeCode": ">=1.0.0"
   },

package/scripts/prepush_guard_check.sh

@@ -166,6 +166,21 @@ check "operator override absent (per-operator) → PASS " "$R" pass \
       "refs/heads/f $(cd "$R" && git rev-parse HEAD) refs/heads/f $B"
 rm -rf "$R"
 
+# ── Pair 6-b (2026-08-06): the OTHER arm of the same state, which the 07-26 flag could not see.
+# Identical to 6-a except the checkout carries CLAUDE.local.md — the operator's gitignored binding
+# file, absent in every clone/CI/worktree by construction. There the missing override is not an
+# unset per-operator config, it is evidence missing where evidence is expected, on a surface that
+# publishes. This is what `npm publish` already blocked while `git push` waved through; the two
+# irreversible surfaces now degrade in the same direction.
+# The PAIR is what makes it a measurement: 6-a (no CLAUDE.local.md → PASS) is the known-negative and
+# must keep passing, or this is not a scoped block, it is the 07-26 over-block re-shipped. ──
+R=$(newrepo); B=$(cd "$R" && git rev-parse HEAD)
+( cd "$R" && echo ok > g2.md && git add g2.md && git commit -qm g2 >/dev/null \
+  && rm -f .claude/rules/.public-surface-patterns && printf '# operator binding\n' > CLAUDE.local.md )
+check "override absent + operator checkout    → BLOCK" "$R" block \
+      "refs/heads/f $(cd "$R" && git rev-parse HEAD) refs/heads/f $B"
+rm -rf "$R"
+
 R=$(newrepo); B=$(cd "$R" && git rev-parse HEAD)
 ( cd "$R" && echo ok > g.md && git add g.md && git commit -qm g >/dev/null \
   && : > .claude/rules/.public-surface-patterns.defaults )   # present but EMPTY = broken, not unconfigured

package/scripts/psa_scan_lib.sh

@@ -38,6 +38,9 @@
 #   PSA_DEFAULTS_OK       1 = committed defaults present, readable, non-empty
 #   PSA_OVERRIDE_PRESENT  1 = operator override present, readable, non-empty
 #   PSA_BAD_ROWS          count of rows dropped as unusable (uncompilable regex, or no TAB)
+# State set by psa_detect_operator_context (separate call — see that function):
+#   PSA_OPERATOR_CONTEXT  1 = an operator-configured checkout, where an absent override is missing
+#                             evidence rather than a legitimate fresh-clone absence
 # A caller that treats PSA_BAD_ROWS>0 or PSA_DEFAULTS_OK=0 as "clean" has a hole: those states mean
 # the instrument is incomplete, and an incomplete instrument cannot certify anything.
 
@@ -115,6 +118,39 @@ PSA_ROWS
   PSA_STREAM="$valid"
 }
 
+# psa_detect_operator_context <repo_root>   → sets PSA_OPERATOR_CONTEXT (0/1)
+#
+# Answers ONE question: is an absent operator override a *legitimate absence* (fresh clone, CI
+# runner, worktree — the file is gitignored, so it is absent there by construction) or *evidence
+# missing where evidence is expected* (a checkout the operator has configured, whose literals should
+# be there and are not)?
+#
+# 2026-07-26 changed pre-push from BLOCK to WARN on an absent override, and that change was right for
+# the first case: this repo's own selfcheck flagged the block as over-firing, and over-blocking trains
+# PUBLIC_SURFACE_OK into a reflex, which disarms the same channel the publish gate depends on. It was
+# wrong for the second case, which the flag could not distinguish. This function is that distinction —
+# it does not reopen the reverted block, it scopes it.
+#
+# Signal: CLAUDE.local.md — the operator's own gitignored binding file. Chosen because it is
+# gitignored (verified: `.gitignore:17`), so no clone, CI checkout or worktree carries it.
+#
+# CALIBRATED, and one candidate was REJECTED by that calibration: "tracks/_meta is non-empty" looks
+# like the same signal and is not — `tracks/_meta/.gitkeep` and one more file are TRACKED, so a fresh
+# clone satisfies it and would have been blocked. The discriminator was measured against a known
+# pair before it was trusted, not reasoned about.
+#
+# NAMED RESIDUAL (deliberate, and in the safe direction): an operator who never created a
+# CLAUDE.local.md stays in the WARN arm. This under-blocks rather than over-blocks — the failure mode
+# this scoping exists to avoid is the reflex, not the miss, and the push gate's content scan still
+# runs on the committed defaults in that arm.
+psa_detect_operator_context() {
+  local root="$1"
+  PSA_OPERATOR_CONTEXT=0
+  [ -n "$root" ] || return 0
+  [ -f "$root/CLAUDE.local.md" ] && PSA_OPERATOR_CONTEXT=1
+  return 0
+}
+
 # psa_scan_tagged  — reads "path<TAB>content" lines on stdin, prints one line per reportable hit.
 # Returns 0 = nothing reportable, 1 = at least one hit.
 #

package/scripts/selfcheck.sh

@@ -25,6 +25,74 @@ check() { # check <label> <cmd...>
     fail=1
   fi
 }
+# ⚠️ KNOWN DEFECT, NOT FIXED HERE — `check()` above has the same evidence-discarding shape the
+# lane blocks below were repaired for (2026-08-05): it decides on `"$@" 2>/dev/null` (stderr of the
+# DECIDING run is destroyed) and then re-runs to print. It is left alone deliberately: `check()` is
+# called by every `node --check` / `bash -n` line in this file, so changing it changes the whole
+# surface at once, which is a different job from repairing the four lane blocks (CLAUDE.md
+# §Added-Scope Gate question 2). `scripts/probe_scope_check.sh`'s caller near the probe-scope block
+# carries the same shape. Both are tracked separately — do NOT read the lane-block repair below as
+# having cleared this file.
+
+# _show_failure <captured-output> — print a FAILING suite's evidence without truncating it away.
+# Single source for all four lane blocks (a second copy would drift; the divergent-normalizer class).
+# WHY NOT `tail -N`: measured 2026-08-05 on sync_from_be_lanes.sh — output is 98 lines and a planted
+# lane failure at line ~22 is INVISIBLE to `tail -20` (0 hits), while the summary banner still reads
+# "1 failed". The reader gets a FAIL verdict sitting on top of passing log lines — the exact shape
+# this whole repair exists to remove. The failing-line extraction finds it (1 hit, known pair).
+# All four suites mark failures with `❌` (`no()` in sync_from_be_lanes.sh:21, `chk()` in the other
+# three) or an early `FAIL ` line when a subject is missing; grep handles the multi-byte glyph
+# (known pair: 1 hit on a ❌ line, 0 on a ✅-only line — verified, not assumed).
+_show_failure() {
+  local out="$1" fails n banner shown nonblank
+  # Whitespace-only counts as empty: guarding with [ -z "$out" ] alone let a suite emitting "   "
+  # fall into the died-early branch and print indented blank lines — silence rendered as evidence.
+  # SHELL PATTERN, NOT `tr`: the obvious `tr -d '[:space:]'` is a measured defect on BSD. Given a
+  # line containing invalid UTF-8, macOS `tr` aborts with `tr: Illegal byte sequence` and emits
+  # NOTHING, so the guard concludes "empty" and reports "no output captured" while real evidence is
+  # sitting in $out — the exact mis-report this helper exists to prevent, reintroduced by the guard
+  # against it. (GNU tr passes the bytes through; the arms disagree, and the failing arm is the
+  # author's own machine.) Case-matching is a shell builtin: no subprocess, no charset decoding, so
+  # invalid bytes cannot make it lie. Known pair: invalid-byte→nonblank, spaces/tabs/newlines→blank,
+  # ""→blank, "hello"→nonblank (4/4), while the tr form returns 0 bytes on arm 1.
+  case "$out" in *[![:space:]]*) nonblank=1 ;; *) nonblank= ;; esac
+  # NO LOCALE PIN HERE, and its absence is a measured result — same disposition, and same reasoning,
+  # as the pin `.github/workflows/validate.yml` removed after refuting its own locale hypothesis.
+  # Two model families independently suspected that matching the multi-byte `❌` would break under a
+  # C/POSIX locale (one filed it as UNCALIBRATED for the GNU arm, the other as an unpinned-locale
+  # defect), so `LC_ALL=C` was added — then both arms were actually measured:
+  #   BSD grep (macOS)      : C, UTF-8              → 1 hit each
+  #   GNU grep 3.12 (Linux) : C, C.UTF-8, unset     → 1 hit each; and with invalid UTF-8 bytes mixed
+  #                                                   in, the ❌ line still extracts (no binary-file
+  #                                                   collapse, the specific feared mode)
+  # The hypothesis is REFUTED on both arms, so the pin demonstrated nothing and was removed rather
+  # than kept as insurance — a knob retained because it might help is indistinguishable from one
+  # that does, and the next reader would inherit it as evidence that the danger is real.
+  fails=$(printf '%s\n' "$out" | grep -E '❌|^FAIL ' || true)
+  banner=$(printf '%s\n' "$out" | grep -E '════' | tail -1 || true)
+  if [ -n "$fails" ]; then
+    shown=$(printf '%s\n' "$fails" | head -25)
+    printf '%s\n' "$shown" | sed 's/^/     /'
+    n=$(printf '%s\n' "$fails" | wc -l | tr -d ' ')
+    [ "$n" -gt 25 ] && echo "     … ($((n - 25)) more failing lines not shown)"
+  elif [ -z "$nonblank" ]; then
+    echo "     (no output captured — the suite produced nothing before failing)"
+  else
+    echo "     (no ❌/FAIL line found — suite likely died early; showing tail)"
+    printf '%s\n' "$out" | tail -12 | sed 's/^/     /'
+  fi
+  # Summary banner: matched by shape, not by position. A blind `tail -2` re-printed lines already
+  # shown above (measured: a ❌ within the last 2 lines appeared twice, and the "N more not shown"
+  # notice was immediately followed by one of the lines it had just declined to show), and on empty
+  # input it emitted a stray indented line. Print it only when it exists and is not already on screen.
+  # Dedupe against what was ACTUALLY PRINTED ($shown), not against the full $fails set. Searching
+  # $fails suppressed the banner whenever a failing line beyond the head -25 cut merely contained
+  # the banner text — i.e. it hid the banner precisely because a line the reader never saw mentioned
+  # it. $shown is empty in the non-fails branches, so the banner prints there as before.
+  if [ -n "$banner" ] && ! printf '%s\n' "${shown:-}" | grep -qF -- "$banner"; then
+    printf '     %s\n' "$banner"
+  fi
+}
 
 # Node executables (npm-shipped)
 for f in bin/*.js; do
@@ -34,7 +102,18 @@ done
 # Codex adapter drift: the thin Codex runtime must keep reading canonical FH
 # skill/agent surfaces without silently accepting Claude-native primitives as
 # Codex-native.
-check "fh-codex-doctor --strict" bash -c 'node bin/fh-codex-doctor.js --strict >/dev/null'
+# NOT via check(): that helper decides on a run whose stderr is discarded, and this call site used to
+# additionally discard the subject's STDOUT (`--strict >/dev/null`). fh-codex-doctor writes 100% of
+# its drift diagnostics to stdout (measured 2026-08-05: 686 B stdout / 0 B stderr), so a failure
+# printed a bare `FAIL` line carrying no diagnosis at all — worse than the truncation this session
+# repaired in the lane blocks. Fixed at the call site; check() itself is a separate job (see above).
+if _out=$(node bin/fh-codex-doctor.js --strict 2>&1); then
+  echo "PASS  fh-codex-doctor --strict"
+else
+  echo "FAIL  fh-codex-doctor --strict"
+  _show_failure "$_out"
+  fail=1
+fi
 
 # Bash surface: npm-shipped scripts + local bin wrappers + gate-chain infra
 for f in scripts/*.sh bin/fh-gate bin/fh-run bin/fh-goal \
@@ -447,28 +526,48 @@ fi
 if [ ! -f templates/.git-hooks/pre-push ]; then
   echo "SKIP  test_tag_version_lanes.sh (subject templates/.git-hooks/pre-push absent)"
 elif [ -f scripts/test_tag_version_lanes.sh ]; then
-  if ! bash scripts/test_tag_version_lanes.sh >/dev/null 2>&1; then
+  # RUN-ONCE, CAPTURE (2026-08-05) — rationale in the sync_from_be_lanes block later in this file.
+  if _out=$(bash scripts/test_tag_version_lanes.sh 2>&1); then
+    echo "PASS  test_tag_version_lanes.sh (mismatch blocks · match silent · scope · override)"
+  else
     echo "FAIL  test_tag_version_lanes.sh: the tag/version guard would mis-route"
-    bash scripts/test_tag_version_lanes.sh 2>&1 | tail -12
+    _show_failure "$_out"
     fail=1
-  else
-    echo "PASS  test_tag_version_lanes.sh (mismatch blocks · match silent · scope · override)"
   fi
 else
   echo "FAIL  test_tag_version_lanes.sh: pre-push present but its anchor is missing"
   fail=1
 fi
 
+# Shipped-manifest version lockstep. Distinct from the tag lane above: that one compares the git TAG
+# to package.json; this one compares package.json to every version string it SHIPS — including the
+# per-plugin entries inside marketplace.json, which the tag lane never opens. Measured 2026-08-06:
+# a bump left the second marketplace entry behind and the tag lane passed 8/8 straight through it.
+if [ ! -f scripts/version_lockstep_check.sh ]; then
+  echo "SKIP  test_version_lockstep_lanes.sh (subject scripts/version_lockstep_check.sh absent)"
+elif [ -f scripts/test_version_lockstep_lanes.sh ]; then
+  if _out=$(bash scripts/test_version_lockstep_lanes.sh 2>&1); then
+    echo "PASS  test_version_lockstep_lanes.sh (drift blocks · aligned silent · unreadable = exit 2, not pass)"
+  else
+    echo "FAIL  test_version_lockstep_lanes.sh: the shipped-manifest lockstep guard would mis-route"
+    _show_failure "$_out"
+    fail=1
+  fi
+else
+  echo "FAIL  test_version_lockstep_lanes.sh: version_lockstep_check.sh present but its anchor is missing"
+  fail=1
+fi
+
 # ④-e dispatch-log reconciliation + its tally hook. Wired in the same commit that ships them: the
 # obligation they mechanize lost 20/20 in a single session, so leaving the checker itself unrun
 # would be the same defect one layer up.
 if [ -f scripts/test_dispatch_log_lanes.sh ]; then
-  if ! bash scripts/test_dispatch_log_lanes.sh >/dev/null 2>&1; then
+  if _out=$(bash scripts/test_dispatch_log_lanes.sh 2>&1); then
+    echo "PASS  test_dispatch_log_lanes.sh (date-spelling + verdict + tally-hook lanes)"
+  else
     echo "FAIL  test_dispatch_log_lanes.sh: the dispatch-log reconciliation would mis-report"
-    bash scripts/test_dispatch_log_lanes.sh 2>&1 | tail -14
+    _show_failure "$_out"
     fail=1
-  else
-    echo "PASS  test_dispatch_log_lanes.sh (date-spelling + verdict + tally-hook lanes)"
   fi
 fi
 
@@ -477,12 +576,12 @@ fi
 # through in silence, then a package discriminator keyed on a file that actually ships. Both are
 # known-POSITIVEs in the suite, so neither can come back green.
 if [ -f scripts/test_selfcheck_state_lanes.sh ]; then
-  if ! bash scripts/test_selfcheck_state_lanes.sh >/dev/null 2>&1; then
+  if _out=$(bash scripts/test_selfcheck_state_lanes.sh 2>&1); then
+    echo "PASS  test_selfcheck_state_lanes.sh (four input states + both shipped mis-routings)"
+  else
     echo "FAIL  test_selfcheck_state_lanes.sh: a subject-presence discriminator would mis-route"
-    bash scripts/test_selfcheck_state_lanes.sh 2>&1 | tail -12
+    _show_failure "$_out"
     fail=1
-  else
-    echo "PASS  test_selfcheck_state_lanes.sh (four input states + both shipped mis-routings)"
   fi
 fi
 
@@ -495,12 +594,34 @@ fi
 if [ ! -f scripts/sync-from-be.sh ]; then
   echo "SKIP  sync_from_be_lanes.sh (subject scripts/sync-from-be.sh absent)"
 elif [ -f scripts/sync_from_be_lanes.sh ]; then
-  if ! bash scripts/sync_from_be_lanes.sh >/dev/null 2>&1; then
+  # ── RUN-ONCE, CAPTURE — canonical note for the four LANE BLOCKS (2026-08-05) ─────────────────
+  # SCOPE, stated precisely because the first draft of this note over-claimed: this covers the four
+  # lane blocks only (tag-version · dispatch-log · selfcheck-state · sync_from_be). The same
+  # evidence-discarding shape SURVIVES in `check()` at the top of this file and in the
+  # probe_scope_check caller — both named there, both deliberately out of scope, both still open.
+  # An adversarial round caught the original "all four sites in this file" wording as a false
+  # completion claim: it would have stopped the next reader from re-searching. Half a fix with a
+  # done-label on it is worse than half a fix.
+  # The old form ran the suite twice: once discarded to /dev/null to decide, once re-run to print.
+  # For a DETERMINISTIC suite that is merely wasteful. For a non-deterministic one it destroys the
+  # evidence: the failing run's output goes to /dev/null and the reader is shown the SECOND run,
+  # which may pass. Measured here 2026-08-04 (run 30955950695) — CI printed
+  #     FAIL  sync_from_be_lanes.sh: return-path lanes failed
+  #     ════ lanes: 70 passed · 0 failed ════
+  # i.e. a FAIL verdict over a PASSING transcript, and the actual failure was never recorded
+  # anywhere. That is why this lane sat "flaky, cause unknown" on the session card for two days:
+  # the instrument was discarding the only evidence that could close it. Reproduced as a known
+  # pair before this edit (arm A run-twice → evidence lost + self-contradiction; arm B run-once →
+  # evidence preserved), so the fix is anchored, not asserted.
+  # NOTE this does NOT make the suite deterministic — the underlying non-determinism is still
+  # UNDIAGNOSED and stays an open item. It makes the next occurrence diagnosable instead of
+  # self-erasing. Do not read a green CI after this change as the flake being fixed.
+  if _out=$(bash scripts/sync_from_be_lanes.sh 2>&1); then
+    echo "PASS  sync_from_be_lanes.sh (return-path lanes)"
+  else
     echo "FAIL  sync_from_be_lanes.sh: return-path lanes failed"
-    bash scripts/sync_from_be_lanes.sh 2>&1 | tail -20
+    _show_failure "$_out"
     fail=1
-  else
-    echo "PASS  sync_from_be_lanes.sh (return-path lanes)"
   fi
 else
   echo "FAIL  sync_from_be_lanes.sh: sync-from-be.sh present but its anchor is missing"

package/scripts/session_close_check.sh

@@ -15,6 +15,9 @@
 
 set -uo pipefail
 
+# 상속된 git 환경변수를 끊는다 — export 된 GIT_DIR 이 있으면 `git -C "$FH"` 가 인자로 받은
+# 레포가 아니라 그 레포를 잰다(Axis 2 at-floor LOW, 2026-08-06). READ-ONLY 체커라 부작용 없음.
+unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE
 FH="${1:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
 TODAY=$(date +%Y-%m-%d)
 CARD="$FH/tracks/_meta/reference_next_session_starter.md"
@@ -25,11 +28,58 @@ _mtime() { stat -c %Y "$1" 2>/dev/null || stat -f %m "$1" 2>/dev/null || echo 0;
 echo "── session close check: $FH ($TODAY) ──"
 
 # ① status snapshot — uncommitted / unpushed work must be known, not forgotten
-DIRTY=$(git -C "$FH" status --porcelain 2>/dev/null | wc -l | tr -d ' ')
-UNPUSHED=$(git -C "$FH" log --oneline @{u}.. 2>/dev/null | wc -l | tr -d ' ')
-[ "$DIRTY" -gt 0 ] && echo "⚠️  ① $DIRTY uncommitted path(s) — decide: commit or leave deliberately"
-[ "$UNPUSHED" -gt 0 ] && echo "⚠️  ① $UNPUSHED unpushed commit(s) — push before close or record why"
-[ "$DIRTY" -eq 0 ] && [ "$UNPUSHED" -eq 0 ] && echo "✅ ① working tree clean, nothing unpushed"
+# DIRTY 도 같은 형태였다 — `status --porcelain 2>/dev/null | wc -l` 은 git 이 죽어도 0 을 세어
+# "깨끗함"으로 승격된다(재현: `.git/index` 손상 → exit 128, 출력 0줄). 종료코드를 먼저 본다.
+# ⚠️ 이 줄은 **바로 아래 UNPUSHED 수리와 같은 결함**이었고, 처음엔 아래만 고쳤다 —
+# 반쪽 수리를 고치는 커밋에서 반쪽 수리를 할 뻔했다(Axis 2 챌린저가 잡음, 2026-08-06).
+# `--untracked-files=all` 은 `status.showUntrackedFiles=no` config 를 덮어쓴다. 그 config 아래에서는
+# git 이 **성공적으로 침묵**해(exit 0 · 빈 출력) 종료코드 가드로도 안 잡힌다 — 부재가 다시
+# "깨끗함"으로 렌더된다(Axis 2 at-floor MED, 재현: 미추적 파일 1건이 0 으로 보고됨).
+if _st=$(git -C "$FH" status --porcelain --untracked-files=all 2>/dev/null); then
+  DIRTY_KNOWN=1
+  DIRTY=$(printf '%s' "$_st" | grep -c . || true)
+else
+  DIRTY_KNOWN=0
+  DIRTY=0
+fi
+# upstream 유무를 **먼저 판정**한다. `@{u}..` 는 upstream 이 없으면 실패해 0줄을 내고, 그 0을
+# `wc -l` 이 0으로 세어 "nothing unpushed" 로 승격된다 — **한 번도 머신을 떠난 적 없는 커밋이
+# '푸시할 것 없음'으로 읽히는 fail-open**. 부재를 깨끗함으로 읽는 것이라 0 을 신뢰하면 안 된다.
+# (downstream fork's review lane caught it first; this file is the upstream original — 2026-08-06.)
+if git -C "$FH" rev-parse --abbrev-ref '@{u}' >/dev/null 2>&1; then
+  UPSTREAM_KNOWN=1
+  UNPUSHED=$(git -C "$FH" log --oneline @{u}.. 2>/dev/null | wc -l | tr -d ' ')
+else
+  UPSTREAM_KNOWN=0
+  UNPUSHED=0
+fi
+[ "$DIRTY_KNOWN" -eq 0 ] && echo "⚠️  ① UNMEASURED — git status failed; working-tree cleanliness is UNKNOWN, not clean"
+[ "$DIRTY_KNOWN" -eq 1 ] && [ "$DIRTY" -gt 0 ] && echo "⚠️  ① $DIRTY uncommitted path(s) — decide: commit or leave deliberately"
+[ "$UPSTREAM_KNOWN" -eq 0 ] && echo "⚠️  ① UNMEASURED — no upstream for this branch; unpushed count is UNKNOWN, not zero"
+[ "$UPSTREAM_KNOWN" -eq 1 ] && [ "$UNPUSHED" -gt 0 ] && echo "⚠️  ① $UNPUSHED unpushed commit(s) — push before close or record why"
+# "as of last fetch" — 원격을 조회하지 않는다. 로컬 remote-tracking ref 가 낡았으면 이 0 도 낡은 값이다
+# (Axis 2 챌린저 MED, 2026-08-06). fetch 를 넣지 않은 것은 마감 체커가 READ-ONLY·오프라인 안전이기 때문.
+# 추적 파일이 assume-unchanged/skip-worktree 로 마킹돼 있으면 그 수정은 porcelain 에 **안 뜬다** —
+# `-uall` 로도 안 잡히는 별개 계기다(Axis 2 at-floor MED, 재현 확인).
+MASKED=$(git -C "$FH" ls-files -v 2>/dev/null | grep -c '^[a-z]' || true)
+[ "${MASKED:-0}" -gt 0 ] \
+  && echo "⚠️  ① $MASKED file(s) assume-unchanged/skip-worktree — their edits are INVISIBLE here"
+
+# ★ 잰 범위 ≠ 주장 범위 (Axis 2 at-floor HIGH, 2026-08-06).
+# `@{u}..` 는 **현재 브랜치만** 잰다. 다른 로컬 브랜치에만 있는 미푸시 커밋은 통째로 안 보이는데
+# 화면 문구는 "nothing unpushed"(레포 전체)라고 말한다 — 이 파일의 존재 이유 정중앙이다.
+# 재현: 다른 브랜치에 미푸시 커밋 1건 → `✅ nothing unpushed` 가 그대로 떴다.
+# 원격이 하나도 없으면 이 값이 전 커밋 수로 부풀므로 원격 존재를 먼저 가드한다.
+OTHER_UNPUSHED=0
+if [ -n "$(git -C "$FH" remote 2>/dev/null)" ]; then
+  OTHER_UNPUSHED=$(git -C "$FH" log --branches --not --remotes --oneline 2>/dev/null | wc -l | tr -d ' ')
+fi
+[ "${OTHER_UNPUSHED:-0}" -gt 0 ] \
+  && echo "⚠️  ① $OTHER_UNPUSHED commit(s) on local branches never pushed anywhere (all-branch scan)"
+
+[ "$DIRTY_KNOWN" -eq 1 ] && [ "$DIRTY" -eq 0 ] && [ "$UPSTREAM_KNOWN" -eq 1 ] && [ "$UNPUSHED" -eq 0 ] \
+  && [ "${OTHER_UNPUSHED:-0}" -eq 0 ] && [ "${MASKED:-0}" -eq 0 ] \
+  && echo "✅ ① working tree clean, nothing unpushed anywhere (as of last fetch)"
 
 # ①-b open-PR sweep (surface-not-auto — requires gh; skip silently offline)
 if command -v gh >/dev/null 2>&1; then

package/scripts/test_selfcheck_state_lanes.sh

@@ -93,6 +93,109 @@ else
   echo "  ⏭️  package.json absent — premise unchecked (not a pass)"
 fi
 
+echo ""
+echo "── _show_failure: a FAILING suite's evidence must survive to the reader ──"
+# WHY THIS LANE EXISTS (2026-08-05): the four lane blocks in selfcheck.sh used to decide on a
+# discarded run (`>/dev/null`) and then RE-RUN to print. On a non-deterministic suite the re-run can
+# pass, so CI printed a FAIL verdict above a PASSING transcript and the real failure was destroyed —
+# measured in run 30955950695. The repair captures once; this lane is the mechanical anchor for the
+# half that actually makes a failure readable. Without it the repair is unverifiable: reverting to
+# `tail -20` leaves CI green, which is exactly [[feedback_built_but_not_wired]] / anchor-is-decorative.
+# LIFTED, not re-spelled — same reason as the discriminator above.
+FN=$(sed -n '/^_show_failure() {/,/^}$/p' "$SELFCHECK")
+if [ -z "$FN" ]; then
+  echo "FAIL  _show_failure is no longer defined in selfcheck.sh — this lane cannot verify what it claims."
+  echo "      If the helper was renamed or removed, update the lane WITH the subject."
+  exit 1
+fi
+eval "$FN"
+
+# Fixture: a long transcript whose ONLY failing line sits far above any tail window, plus a
+# summary banner at the end that still says something failed. This is the shape that fooled the
+# reader in the CI run above.
+_LONG=$(for i in $(seq 1 40); do echo "  ✅ lane L$i ok"; done; echo "  ❌ lane L41 tripped — THE EVIDENCE"; for i in $(seq 42 96); do echo "  ✅ lane L$i ok"; done; echo "════ lanes: 96 passed · 1 failed ════")
+
+_OUT=$(_show_failure "$_LONG")
+printf '%s' "$_OUT" | grep -q 'THE EVIDENCE'; chk $? "the failing line survives (it is 56 lines above the end)"
+printf '%s' "$_OUT" | grep -q '1 failed'    ; chk $? "the summary banner is still shown"
+
+# CONTROL — the old form must FAIL this same fixture. Without this, the lane could pass for a
+# reason unrelated to the repair (e.g. a fixture short enough that any tail window catches it).
+printf '%s\n' "$_LONG" | tail -20 | grep -q 'THE EVIDENCE'; [ $? -ne 0 ]
+chk $? "CONTROL: the pre-repair form (tail -20) does NOT surface it — the fixture discriminates"
+
+# Degenerate inputs: silence must not read as evidence, and a suite that dies before printing any
+# ❌ must say so rather than showing a blank.
+_OUT=$(_show_failure "")
+printf '%s' "$_OUT" | grep -q 'no output captured'; chk $? "empty output is named, not shown as a blank line"
+_OUT=$(_show_failure "some early crash text
+Traceback: boom")
+printf '%s' "$_OUT" | grep -q 'died early'; chk $? "output with no ❌/FAIL falls back and says why"
+
+# ── THE DEFECT ITSELF: decide-and-print must be ONE execution ────────────────
+# An earlier version of this lane block tested only the _show_failure HELPER, in isolation, via eval.
+# An adversarial round then reverted a lane block to the original run-twice form — decide on a
+# discarded run, re-run to capture — and this suite still returned PASS (16/16, measured). The anchor
+# was guarding the thing the repair BUILT and not the thing the repair FIXED. That is
+# [[feedback_anchor_can_be_decorative]] with the reversal actually applied, which is the only check
+# that distinguishes the two.
+# The invariant that discriminates: a suite must be EXECUTED EXACTLY ONCE per selfcheck run. The
+# run-twice form necessarily names its subject twice. Keying on the subject path (not on a variable
+# name or a pipe shape) also removes the earlier grep's escape hatch — renaming `_out` no longer
+# evades it, and adding a fifth lane block does not require editing a hardcoded count.
+for _subj in test_tag_version_lanes test_dispatch_log_lanes test_selfcheck_state_lanes sync_from_be_lanes; do
+  _n=$(grep -c "bash scripts/${_subj}\.sh" "$SELFCHECK" || true)
+  [ "$_n" -eq 1 ]
+  chk $? "${_subj}.sh is executed exactly once (found $_n) — 2 means the run-twice form is back"
+done
+
+# WIRING — every lane block must route its captured output through the helper. Secondary to the
+# once-only invariant above (this one IS evadable by renaming), kept because it names the intent.
+_CALLS=$(grep -c '_show_failure "\$_out"' "$SELFCHECK")
+[ "$_CALLS" -ge 4 ]; chk $? "every lane block routes failure output through _show_failure (found $_CALLS, expected ≥4)"
+_TAILS=$(grep -c '"\$_out" | tail -' "$SELFCHECK" || true)
+[ "$_TAILS" -eq 0 ]; chk $? "no lane block still truncates with a raw tail (found $_TAILS, expected 0)"
+
+# The one non-lane caller that also destroys its evidence at the CALL SITE (not inside check()).
+# `check "..." bash -c '... >/dev/null'` discards the subject's stdout, and fh-codex-doctor writes
+# 100% of its diagnostics to stdout (measured: 686 B stdout / 0 B stderr) — so a strict-mode failure
+# would print a bare FAIL line with zero diagnosis. Anchored here because the fix is one line at the
+# call site and does NOT require touching check() itself.
+_CD=$(grep -c "fh-codex-doctor.js --strict >/dev/null" "$SELFCHECK" || true)
+[ "$_CD" -eq 0 ]; chk $? "fh-codex-doctor's stdout is not discarded at the call site (found $_CD, expected 0)"
+
+# Byte-hostile input: a lane emitting invalid UTF-8 must not be reported as "no output". The
+# `tr -d '[:space:]'` form this guard originally used aborts on BSD with "Illegal byte sequence"
+# and emits nothing, so the emptiness check concluded empty while evidence was present.
+# NOTE ON THIS FIXTURE — it deliberately contains NO ❌. The first draft included one, which routed
+# the call into the failing-lines branch, so the emptiness guard (an `elif`) was never reached and the
+# lane passed against the very defect it was written for. Verified by applying the reversion and
+# confirming the diff landed: the lane went green anyway. A fixture that cannot reach the branch
+# under test measures nothing.
+_BAD=$(printf '  \xff\xfe garbage\n  crashed before any lane ran BYTE_EVIDENCE\n')
+_OUT=$(_show_failure "$_BAD")
+printf '%s' "$_OUT" | grep -q 'BYTE_EVIDENCE'; chk $? "invalid UTF-8 in the stream does not swallow the evidence"
+printf '%s' "$_OUT" | grep -qv 'no output captured'; chk $? "…and it is not mis-reported as empty output"
+
+# The banner must not be suppressed by a line the reader never saw (a failing line past the head cut
+# that merely quotes the banner text).
+_MANY=$(for i in $(seq 1 26); do echo "  ❌ f$i"; done; echo "  ❌ f27 quoting ════ lanes: 9 passed · 1 failed ════"; echo "════ lanes: 9 passed · 1 failed ════")
+_OUT=$(_show_failure "$_MANY")
+[ "$(printf '%s\n' "$_OUT" | grep -c '════ lanes: 9 passed')" -ge 1 ]
+chk $? "the summary banner still prints when a truncated-away line quotes it"
+
+# ── SCOPE OF THIS ANCHOR — stated so it is not over-trusted ───────────────────
+# These lanes catch REVERSION (the run-twice form coming back, the helper being gutted, the
+# call-site redirect returning). They do NOT catch deliberate EVASION: a cross-family round
+# demonstrated three forms that satisfy every check above while still destroying evidence —
+# `_out=$(bash suite >/dev/null 2>&1)` (executed once, captured nothing), a wrapper function
+# (`run_lane() { bash scripts/X.sh; }`, literal appears once, runs twice), and redirect spellings
+# the greps do not enumerate (`1>/dev/null`, a variable). Chasing those with more patterns is the
+# Grep-Collision Treadmill this repo has already logged as P10 — each added regex relocates the
+# evasion instead of closing it. It is bounded rather than escalated: an evading form still routes
+# through _show_failure, whose empty branch prints "(no output captured)" at runtime, so the failure
+# is loud rather than silent. Regression is anchored; evasion is a named residual, not a solved one.
+
 echo ""
 if [ "$FAILED" -ne 0 ]; then
   echo "SELFCHECK STATE LANES: FAIL — a discriminator would mis-route"

package/scripts/test_session_close_chain_lanes.sh

@@ -85,6 +85,18 @@ _repo() {  # $1=dirname ; makes a git repo with one commit dated $2 (default now
     else
       git commit -qm seed
     fi
+    # A real repo HAS an upstream. Without one the close check now (correctly) reports
+    # `① UNMEASURED — no upstream`, which is not the state any of these lanes means to express —
+    # a fixture with no upstream cannot assert "clean tree, nothing unpushed" because the second
+    # half of that sentence is genuinely unknown. Every lane below therefore runs on a pushed
+    # baseline; upstream ABSENCE is measured on purpose by its own lane (KP-2).
+    git init -q --bare "$TMPROOT/$1.git"
+    git remote add origin "$TMPROOT/$1.git"
+    # `-c core.hooksPath=` : a fixture push must never execute the HOST's git hooks. This repo sets
+    # core.hooksPath locally (so a temp repo does not inherit it) but a machine that sets it GLOBALLY
+    # would run FH's own pre-push Destructive-Op gate against a throwaway fixture — the suite's result
+    # would then depend on the operator's git config rather than on the code under test.
+    git -c core.hooksPath= push -q -u origin HEAD
   ) >/dev/null 2>&1
   mkdir -p "$T/tracks/_meta"
   printf '%s' "$T"
@@ -121,13 +133,10 @@ _line "①-N  uncommitted path → ⚠️ fires"           'uncommitted path'
 _line "①-N  uncommitted path → clean line absent"  '✅ ① working tree clean' 0 "$OUT"
 _rc   "①-N  uncommitted is ADVISORY, not blocking" "$RC" 0
 
-# unpushed: needs a real upstream, so build a bare remote
+# unpushed: _repo already pushed the seed, so one extra commit is exactly one unpushed commit
 T=$(_repo one_unpushed); _artifacts "$T"
 (
   cd "$T" || exit 1
-  git init -q --bare "$TMPROOT/one_unpushed.git" 2>/dev/null
-  git remote add origin "$TMPROOT/one_unpushed.git"
-  git push -q -u origin HEAD 2>/dev/null
   echo more > second.txt && git add -A && git commit -qm second
 ) >/dev/null 2>&1
 _run "$T"
@@ -141,6 +150,72 @@ _gap "①  non-repo reports CLEAN" "$_g" \
   "git is unavailable/not a repo → DIRTY=0, UNPUSHED=0 → the check reports '✅ working tree clean'. \
 An instrument that could not look is not a clean result (not found ≠ 0). Should say UNSCANNED."
 
+# ── ① not-found ≠ 0 : the five states where git CANNOT answer ────────────────────
+# Origin: the fix that introduced these five guards (2026-08-06) listed all six known pairs in its
+# COMMIT MESSAGE and shipped none of them as a lane — the code changed, the suite did not, and CI
+# went red on the two lanes the change broke rather than on the five it left unmeasured. Prose in a
+# commit message is not a regression anchor: nothing re-runs it. Each pair below is
+# known-positive (the instrument is blind) + a paired control (the clean line must NOT appear),
+# because "the warning fired" and "the warning fired INSTEAD of a false all-clear" are two claims.
+# KP-1 (the healthy case) is the ①-P lane at the top of this section.
+
+# KP-2 upstream absent — `@{u}..` fails, prints 0 lines, and `wc -l` counts that 0 as "nothing
+# unpushed". A commit that never left the machine reads as pushed. `--unset-upstream` (not
+# `remote remove`) keeps a remote present, so the all-branch scan still runs: this isolates the
+# upstream leg instead of quietly testing two things at once.
+T=$(_repo kp2_no_upstream); _artifacts "$T"
+git -C "$T" branch --unset-upstream >/dev/null 2>&1
+_run "$T"
+_line "KP-2 no upstream → UNMEASURED, not zero"    'unpushed count is UNKNOWN' 1 "$OUT"
+_line "KP-2 → clean line absent (paired)"          '✅ ① working tree clean'   0 "$OUT"
+_rc   "KP-2 → advisory, not blocking"              "$RC" 0
+
+# KP-3 git status itself fails — a corrupt index makes `status` exit non-zero with EMPTY output,
+# and `| wc -l` renders that emptiness as "0 dirty paths" = clean.
+T=$(_repo kp3_broken_index); _artifacts "$T"
+printf 'garbage' > "$T/.git/index"
+_run "$T"
+_line "KP-3 corrupt index → cleanliness UNKNOWN"   'cleanliness is UNKNOWN'    1 "$OUT"
+_line "KP-3 → clean line absent (paired)"          '✅ ① working tree clean'   0 "$OUT"
+# Measured while writing this lane: a corrupt index makes `ls-files -v` exit 128 too, so the
+# assume-unchanged probe (MASKED) silently reads 0 — the same not-found-≠-0 shape, one layer in.
+# It is NOT a false all-clear (DIRTY_KNOWN=0 already suppresses the clean line), so it is recorded
+# as a residual rather than patched here. `rev-parse @{u}` still exits 0 under a corrupt index,
+# which is what keeps this lane measuring cleanliness and not accidentally re-measuring KP-2.
+
+# KP-4 measured scope ≠ claimed scope — `@{u}..` reads the CURRENT branch only, while the message
+# says "nothing unpushed" about the repo. An unpushed commit parked on another local branch is
+# invisible. The current branch stays clean and pushed on purpose: only the other branch is dirty,
+# so a green here would be the exact false all-clear.
+T=$(_repo kp4_other_branch); _artifacts "$T"
+(
+  cd "$T" || exit 1
+  git checkout -q -b side
+  echo side > side.txt && git add -A && git commit -qm side
+  git checkout -q -
+) >/dev/null 2>&1
+_run "$T"
+_line "KP-4 unpushed on ANOTHER branch → ⚠️ fires" 'never pushed anywhere'     1 "$OUT"
+_line "KP-4 → clean line absent (paired)"          '✅ ① working tree clean'   0 "$OUT"
+
+# KP-5 `status.showUntrackedFiles=no` — git succeeds and stays SILENT (exit 0, empty output), so
+# the exit-code guard of KP-3 cannot catch this one. Only `--untracked-files=all` overrides it.
+T=$(_repo kp5_untracked_off); _artifacts "$T"
+git -C "$T" config status.showUntrackedFiles no
+echo hidden > "$T/hidden.txt"
+_run "$T"
+_line "KP-5 showUntrackedFiles=no → still counted"  'uncommitted path'         1 "$OUT"
+_line "KP-5 → clean line absent (paired)"           '✅ ① working tree clean'  0 "$OUT"
+
+# KP-6 assume-unchanged / skip-worktree — edits to a marked TRACKED file never reach porcelain at
+# all, so `-uall` does not help either. A separate instrument (`ls-files -v`) has to surface it.
+T=$(_repo kp6_assume_unchanged); _artifacts "$T"
+git -C "$T" update-index --assume-unchanged unrelated.txt
+echo edited >> "$T/unrelated.txt"
+_run "$T"
+_line "KP-6 assume-unchanged edit → surfaced"       'INVISIBLE here'           1 "$OUT"
+_line "KP-6 → clean line absent (paired)"           '✅ ① working tree clean'  0 "$OUT"
+
 echo
 echo "══ ①-b open-PR sweep ══"
 _ghstub() {  # $1=repo $2=stdout $3=exit

package/scripts/test_version_lockstep_lanes.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Known pairs for scripts/version_lockstep_check.sh.
+#
+# The lane this suite exists to prevent: on 2026-08-06 a 1.4.88 → 1.4.89 bump edited the FIRST
+# marketplace plugin entry and left the SECOND at the old version. `test_tag_version_lanes.sh`
+# reported 8/8 PASS through it — that lane compares the git tag to package.json and never opens
+# marketplace.json. The drift was caught by an ad-hoc `sort | uniq -c`. Luck is not a floor.
+#
+# Every lane runs against a THROWAWAY fixture tree, never against this repo, so the suite is
+# hermetic: a real bump in progress can neither turn it green nor turn it red.
+
+set -uo pipefail
+CHECK="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/version_lockstep_check.sh"
+TMPROOT=$(mktemp -d "${TMPDIR:-/tmp}/fh_lockstep.XXXXXX")
+trap 'rm -rf "$TMPROOT"' EXIT
+PASS=0; FAIL=0
+
+_fixture() {  # $1=name $2=pkg_ver $3=meta_ver $4=commons_ver $5=mk_entry0 $6=mk_entry1
+  local T="$TMPROOT/$1"
+  mkdir -p "$T/.claude-plugin" "$T/plugins/fh-meta/.claude-plugin" "$T/plugins/fh-commons/.claude-plugin"
+  printf '{"name":"fh","version":"%s"}\n' "$2" > "$T/package.json"
+  printf '{"name":"fh-meta","version":"%s"}\n' "$3" > "$T/plugins/fh-meta/.claude-plugin/plugin.json"
+  printf '{"name":"fh-commons","version":"%s"}\n' "$4" > "$T/plugins/fh-commons/.claude-plugin/plugin.json"
+  printf '{"plugins":[{"name":"fh-meta","version":"%s"},{"name":"fh-commons","version":"%s"}]}\n' \
+    "$5" "$6" > "$T/.claude-plugin/marketplace.json"
+  printf '%s' "$T"
+}
+
+_expect() {  # $1=label $2=expected_rc $3=repo ; also captures OUT
+  OUT=$(bash "$CHECK" "$3" 2>&1); local rc=$?
+  if [ "$rc" = "$2" ]; then echo "  ✅ $1 (rc=$rc)"; PASS=$((PASS+1))
+  else echo "  ❌ $1 — rc=$rc, expected=$2"; printf '%s\n' "$OUT" | sed 's/^/       │ /'; FAIL=$((FAIL+1)); fi
+}
+_says() {  # $1=label $2=pattern $3=expected_hit(1|0)
+  local h=0; printf '%s\n' "$OUT" | grep -q -- "$2" && h=1
+  if [ "$h" = "$3" ]; then echo "  ✅ $1"; PASS=$((PASS+1))
+  else echo "  ❌ $1 — hit=$h, expected=$3"; printf '%s\n' "$OUT" | sed 's/^/       │ /'; FAIL=$((FAIL+1)); fi
+}
+
+echo "══ version lockstep known pairs ══"
+
+# KN — everything aligned. The control: without it, a checker that always reported DRIFT would
+# still pass every positive lane below.
+_expect "KN  all five strings aligned → exit 0" 0 "$(_fixture kn 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89)"
+_says   "KN  → names the count it actually checked" "4 shipped version string" 1
+
+# KP-1 — the measured miss, byte for byte: second marketplace entry left behind.
+_expect "KP-1 second marketplace entry stale → exit 1" 1 "$(_fixture kp1 1.4.89 1.4.89 1.4.89 1.4.89 1.4.88)"
+_says   "KP-1 → names the offending entry by index+name" "plugins\[1\] fh-commons" 1
+_says   "KP-1 → reports both versions, not just 'mismatch'" "1.4.88  (package.json = 1.4.89)" 1
+
+# KP-2 — a plugin.json left behind. This is the shape the tag lane also cannot see.
+_expect "KP-2 plugin.json stale → exit 1" 1 "$(_fixture kp2 1.4.89 1.4.88 1.4.89 1.4.89 1.4.89)"
+_says   "KP-2 → names the file" "plugins/fh-meta/.claude-plugin/plugin.json" 1
+
+# KP-3 — the reverse direction: package.json bumped alone. Same defect, opposite author error.
+_expect "KP-3 only package.json bumped → exit 1" 1 "$(_fixture kp3 1.5.0 1.4.89 1.4.89 1.4.89 1.4.89)"
+_says   "KP-3 → all four downstream strings flagged" "4 of 4" 1
+
+# HARNESS-ERROR — an instrument that could not look has not looked. These must be a THIRD state,
+# never folded into PASS: this gate guards `npm publish`, an irreversible surface.
+T=$(_fixture he1 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); rm "$T/.claude-plugin/marketplace.json" "$T"/plugins/*/.claude-plugin/plugin.json
+_expect "HE-1 no manifests at all → exit 2, NOT 0" 2 "$T"
+_says   "HE-1 → says alignment is UNKNOWN, not aligned" "UNKNOWN, not aligned" 1
+
+T=$(_fixture he2 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); printf '{ broken' > "$T/.claude-plugin/marketplace.json"
+_expect "HE-2 unparseable manifest → exit 2, NOT 0" 2 "$T"
+
+T=$(_fixture he3 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); rm "$T/package.json"
+_expect "HE-3 missing package.json → exit 2, NOT 0" 2 "$T"
+
+# A manifest present but carrying no version at all is absence, not agreement.
+T=$(_fixture he4 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); printf '{"name":"fh-meta"}\n' > "$T/plugins/fh-meta/.claude-plugin/plugin.json"
+_expect "HE-4 manifest with no version → exit 2, NOT 0" 2 "$T"
+_says   "HE-4 → says which file carries none" "carries no version string" 1
+
+echo
+echo "──────────────────────────────────────────────"
+if [ "$FAIL" -gt 0 ]; then
+  echo "VERSION-LOCKSTEP LANES: FAIL ($PASS pass · $FAIL fail)"; exit 1
+fi
+echo "VERSION-LOCKSTEP LANES: PASS ($PASS/$PASS)"

package/scripts/universal_guard_check.sh

@@ -196,8 +196,12 @@ run_case "placeholder BEFORE real, one line → BLOCK" \
 # Each of these previously passed at commit time while BLOCKING at publish time — the two copies
 # of this logic had diverged in leniency. run_state_case swaps the pattern source rather than the
 # staged content, so it needs its own runner.
-run_state_case() {  # <name> <override-content|__NONE__> <defaults:keep|drop> <expect-exit: block|pass>
-  local name="$1" ovc="$2" defmode="$3" expect="$4" out rc got
+run_state_case() {  # <name> <override-content|__NONE__> <defaults:keep|drop> <expect-exit: block|pass> [expect-verdict-substring]
+  # The 5th arg exists because exit code alone cannot see this defect class: a scan whose
+  # operator-literal layer never ran exits 0 and used to print the same `✅ PASS` as a scan where
+  # every layer ran. Identical verdicts for different amounts of measurement is the fail-open —
+  # so the anchor has to read the verdict LINE, not just the status.
+  local name="$1" ovc="$2" defmode="$3" expect="$4" want="${5:-}" out rc got
   printf 'operator literal zzsynthoperator\n' > "$SANDBOX/README.md"
   git -C "$SANDBOX" add -- README.md >/dev/null 2>&1
   local ov="$SANDBOX/.psa_state_override"
@@ -208,17 +212,26 @@ run_state_case() {  # <name> <override-content|__NONE__> <defaults:keep|drop> <e
   if [ "$defmode" = drop ]; then mv "$defbak" "$SANDBOX/.claude/rules/.public-surface-patterns.defaults" 2>/dev/null; fi
   git -C "$SANDBOX" rm -q --cached -- README.md >/dev/null 2>&1; rm -f "$SANDBOX/README.md" "$ov"
   if [ "$rc" -ne 0 ]; then got=block; else got=pass; fi
-  if [ "$got" = "$expect" ]; then
-    echo "  ✅ $name (expected $expect)"
-  else
+  if [ "$got" != "$expect" ]; then
     echo "  ❌ $name — expected $expect, got $got (exit $rc)"
     printf '%s\n' "$out" | sed 's/^/       | /' | head -10
     FAILED=1
+  elif [ -n "$want" ] && ! printf '%s' "$out" | grep -qF "$want"; then
+    echo "  ❌ $name — exit was $got but the verdict line did not say: $want"
+    printf '%s\n' "$out" | grep -E 'PASS|PARTIAL|Confidentiality' | sed 's/^/       | /' | head -5
+    FAILED=1
+  else
+    echo "  ✅ $name (expected $expect${want:+, verdict names \"$want\"})"
   fi
 }
 run_state_case "no patterns at all (instrument down) → BLOCK" "__NONE__" drop  block
 run_state_case "malformed regex in override          → BLOCK" "HIGH	zzsynth[" keep block
-run_state_case "empty override + defaults present    → PASS " ""              keep pass
+# 2026-08-06 — this state still PASSES (a commit is reversible; blocking every fresh clone's first
+# commit is what trains the override into a reflex), but it may no longer CLAIM a clean scan. Pinned
+# as a pair so the label cannot drift back to a bare PASS, and so an unconditional PARTIAL — which
+# would be just as wrong — is caught by the control below it.
+run_state_case "empty override + defaults present    → PASS " ""              keep pass "PARTIAL"
+run_state_case "control: override PRESENT, no hit    → PASS " "HIGH	zzunrelatedliteral" keep pass "✅ PASS"
 
 # ── Pair 7: pattern-ROW malformations that are not invalid regex. Each of these used to be skipped
 # in silence, i.e. a detector the author believed in that never existed, and a scan that certified

package/scripts/version_lockstep_check.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# version_lockstep_check.sh — every shipped manifest must carry package.json's version.
+#
+# Why this exists (measured 2026-08-06, while republishing 1.4.88 → 1.4.89):
+# CLAUDE.md §④-b says to bump "package.json + every .claude-plugin/plugin.json + marketplace.json".
+# That instruction reads as four files, but `.claude-plugin/marketplace.json` carries **one version
+# per plugin entry** — five strings across four files. A bump that edited the first entry left the
+# second at the old version, and `test_tag_version_lanes.sh` passed 8/8 anyway: that lane compares
+# the git TAG to package.json and never opens marketplace.json. The stale entry was caught by an
+# ad-hoc `sort | uniq -c`, i.e. by luck, not by an instrument.
+#
+# Codex caches plugins on the plugin.json version, so a stale entry ships a plugin that the other
+# runtime believes it already has — the drift is silent on exactly the surface that cannot report it.
+#
+# Exit 0 = all aligned · exit 1 = drift (names every offending file:line) · exit 2 = harness error
+# (a manifest is missing or unparseable — NOT a pass; an instrument that could not look has not
+# looked, and this gate guards an irreversible surface).
+
+set -uo pipefail
+ROOT="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+
+command -v python3 >/dev/null 2>&1 || { echo "LOCKSTEP: HARNESS-ERROR — python3 unavailable"; exit 2; }
+
+python3 - "$ROOT" <<'PY'
+import json, sys, glob, os
+root = sys.argv[1]
+pkg_path = os.path.join(root, 'package.json')
+try:
+    want = json.load(open(pkg_path))['version']
+except Exception as e:
+    print(f"LOCKSTEP: HARNESS-ERROR — cannot read {pkg_path}: {e}")
+    sys.exit(2)
+
+# (path, list-of-(label, version)) — every manifest that ships a version string.
+targets = []
+for p in sorted(glob.glob(os.path.join(root, 'plugins', '*', '.claude-plugin', 'plugin.json'))):
+    targets.append(p)
+mk = os.path.join(root, '.claude-plugin', 'marketplace.json')
+if os.path.exists(mk):
+    targets.append(mk)
+
+if not targets:
+    # Absence is not alignment. If the manifests vanished, say so rather than reporting a clean run.
+    print("LOCKSTEP: HARNESS-ERROR — no plugin/marketplace manifest found; alignment is UNKNOWN, not aligned")
+    sys.exit(2)
+
+drift, checked = [], 0
+for p in targets:
+    try:
+        d = json.load(open(p))
+    except Exception as e:
+        print(f"LOCKSTEP: HARNESS-ERROR — cannot parse {p}: {e}")
+        sys.exit(2)
+    rel = os.path.relpath(p, root)
+    # A manifest carries a version either at the top level (plugin.json) or once per plugin entry
+    # (marketplace.json). Walk both shapes so a new entry cannot be silently uncovered.
+    found = []
+    if isinstance(d.get('version'), str):
+        found.append(('(top-level)', d['version']))
+    for key in ('plugins', 'entries'):
+        for i, ent in enumerate(d.get(key) or []):
+            if isinstance(ent, dict) and isinstance(ent.get('version'), str):
+                found.append((f"{key}[{i}] {ent.get('name', '?')}", ent['version']))
+    if not found:
+        print(f"LOCKSTEP: HARNESS-ERROR — {rel} carries no version string; expected at least one")
+        sys.exit(2)
+    for label, got in found:
+        checked += 1
+        if got != want:
+            drift.append(f"  {rel} :: {label} = {got}  (package.json = {want})")
+
+if drift:
+    print(f"LOCKSTEP: DRIFT — {len(drift)} of {checked} shipped version string(s) do not match package.json")
+    print("\n".join(drift))
+    print("Bump every string above in the same commit — Codex caches plugins on this version,")
+    print("so a stale entry ships as 'already installed' on the runtime that cannot report it.")
+    sys.exit(1)
+
+print(f"LOCKSTEP: PASS — {checked} shipped version string(s) all at {want}")
+PY

package/templates/.git-hooks/pre-commit

@@ -303,6 +303,14 @@ else
         echo "  → '~' or '{project}'), or PUBLIC_SURFACE_OK=1 git commit … for a reviewed mention."
         FAILED=1
       fi
+    elif [ "$PSA_OVERRIDE_PRESENT" -eq 0 ]; then
+      # NOT `✅ PASS`. The scan found nothing, but one whole layer of it — the operator/company
+      # literals — never ran. A missing measurement is not a zero (CLAUDE.md §Instrument
+      # Calibration), and a verdict that reads identically whether a layer ran or not is the
+      # fail-open this repo names. The commit is still allowed: a commit is reversible, so the
+      # degrade here is advisory by the Surface-Class Degrade Invariant. Push and publish, which
+      # are the acts that make content public, block this same state.
+      echo "  ⚠️  PARTIAL — no hit in the committed defaults; company/companion literals UNMEASURED."
     else
       echo "  ✅ PASS"
     fi

package/templates/.git-hooks/pre-push

@@ -298,9 +298,21 @@ else
   _pp_why=""
   [ "$_PP_APPLICABLE" -eq 1 ] && [ "$PSA_DEFAULTS_OK" -eq 0 ] && _pp_why="committed pattern defaults unreadable/empty"
   [ "$_PP_APPLICABLE" -eq 1 ] && [ "$PSA_BAD_ROWS" -gt 0 ]    && _pp_why="${_pp_why:+$_pp_why; }$PSA_BAD_ROWS unusable pattern row(s)"
+  # 2026-08-06 — the 07-26 warn stays for the case it was right about, and is SCOPED, not reverted.
+  # An absent override is a legitimate configuration gap in a fresh clone / CI runner / worktree (the
+  # file is gitignored, so it is absent there by construction) → WARN, exactly as 07-26 concluded.
+  # In an operator-configured checkout the same state is missing evidence, not a missing config, and
+  # this is an irreversible surface → BLOCK, matching what `public_surface_scan_files.sh` already does
+  # at `npm publish`. Two irreversible surfaces degrading in opposite directions on the same state was
+  # the actual defect; git push was the lenient one.
+  psa_detect_operator_context "$REPO_ROOT"
   if [ "$_PP_APPLICABLE" -eq 1 ] && [ "$PSA_OVERRIDE_PRESENT" -eq 0 ]; then
-    echo "  ⚠️  operator-literal override absent — only the committed defaults (home paths + credential"
-    echo "     shapes) are active. Populate .claude/rules/.public-surface-patterns for company literals."
+    if [ "$PSA_OPERATOR_CONTEXT" -eq 1 ]; then
+      _pp_why="${_pp_why:+$_pp_why; }operator-literal override absent in an operator-configured checkout (company/companion literals NOT scanned)"
+    else
+      echo "  ⚠️  operator-literal override absent — only the committed defaults (home paths + credential"
+      echo "     shapes) are active. Populate .claude/rules/.public-surface-patterns for company literals."
+    fi
   fi
   if [ -n "$_pp_why" ]; then
     if [ "${PUBLIC_SURFACE_OK:-0}" = "1" ]; then