@chrono-meta/fh-gate 1.4.88 → 1.4.90

package/scripts/test_reviewer_capability_conformance.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+# test_reviewer_capability_conformance.sh — runs the SHARED corpus against THIS repo's
+# reviewer-capability implementation and reports every disagreement.
+#
+# THE CONTRACT, and why it is shaped this way. Three repos judge "can this model be an
+# adversarial reviewer?" in three languages (bash hook · shell probe · python backend).
+#
+# Be precise about WHY they do not share a library, because the first draft of this comment
+# overstated it and a cross-family review caught the inversion: residency blocks the
+# PRIVATE→PUBLIC direction (internal model ids must never reach a public repo). It does NOT
+# stop a private repo from vendoring a sanitized PUBLIC library. The actual reasons are
+# (a) three languages/runtimes, and (b) the classifier is two regexes — a shared library
+# would add more coupling than the thing it shares. Residency governs the CORPUS's contents,
+# not the decision to share data instead of code.
+#
+# What they share is `scripts/reviewer_capability_corpus.tsv`
+# — pure data, residency-safe. Each side keeps its own implementation and vendors this
+# script plus the corpus; drift then surfaces as a red test in whichever repo drifted,
+# instead of as a silent difference nobody measures.
+#
+# Measured before this existed: 19 ids, 10 disagreements between two implementations, 9 of
+# them the private side reading INCAPABLE as CAPABLE. That drift had shipped and was
+# invisible — nothing compared the two.
+#
+# ── PORTING THIS TO ANOTHER REPO (the adapter is the only thing you write) ──────
+# Copy this file + the corpus, then replace classify() with a call into your own code:
+#   shell :  classify(){ your_probe.sh --check-model "$1" >/dev/null 2>&1 && echo CAPABLE || echo INCAPABLE; }
+#   python:  classify(){ python3 -c 'import sys;from x import is_reviewer_capable;
+#                        print("CAPABLE" if is_reviewer_capable(sys.argv[1]) else "INCAPABLE")' "$1"; }
+# Everything else — corpus parsing, verdict comparison, the UNDECIDABLE rule — stays.
+#
+# ── THE UNDECIDABLE ROWS ARE THE POINT ─────────────────────────────────────────
+# An implementation with only a denylist answers CAPABLE for an unrecognised id. That is
+# fail-open: a denylist cannot know `voyage-3` is an embedding model. Such an implementation
+# FAILS these rows, and that failure is correct — it is telling you to add a default-deny
+# leg, not to edit the corpus. A repo that genuinely cannot express UNDECIDABLE may set
+# ALLOW_UNDECIDABLE_AS_INCAPABLE=1, which is strictly-safer and reported as a named
+# deviation rather than a silent pass.
+#
+# Usage: bash scripts/test_reviewer_capability_conformance.sh   Exit: 0 = conforms; 1 = drift.
+
+set -uo pipefail
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+CORPUS="${CORPUS:-$REPO_ROOT/scripts/reviewer_capability_corpus.tsv}"
+HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
+LENIENT="${ALLOW_UNDECIDABLE_AS_INCAPABLE:-0}"
+
+[ -f "$CORPUS" ] || { echo "🟥 HARNESS-ERROR: corpus not found at $CORPUS"; exit 10; }
+
+# ── Contract pin: am I reading THE corpus, or a drifted local copy? ─────────────
+# The single shared artifact lives in N repos as N copies, so the first failure mode is not
+# a wrong verdict — it is each side quietly grading itself against its own stale copy while
+# every instrument reports healthy. Verdict on mismatch is HARNESS_ERROR (exit 10), which is
+# neither PASS nor FAIL: nothing was measured against the contract.
+PINNED=$(grep -m1 '^#CORPUS-SHA256' "$CORPUS" | awk '{print $2}')
+ACTUAL=$(grep -E '^[^#[:space:]]' "$CORPUS" | shasum -a 256 2>/dev/null | cut -c1-16)
+[ -z "$ACTUAL" ] && ACTUAL=$(grep -E '^[^#[:space:]]' "$CORPUS" | sha256sum 2>/dev/null | cut -c1-16)
+if [ -z "$PINNED" ] || [ -z "$ACTUAL" ]; then
+  echo "🟥 HARNESS-ERROR: cannot verify the corpus pin (pinned='$PINNED' actual='$ACTUAL')."
+  echo "   An unverifiable pin is not a passing pin — refusing to grade against an unknown corpus."
+  exit 10
+fi
+if [ "$PINNED" != "$ACTUAL" ]; then
+  echo "🟥 HARNESS-ERROR: corpus drift — pinned=$PINNED actual=$ACTUAL"
+  echo "   This copy's data rows differ from the contract it names. Either re-sync from the"
+  echo "   canonical corpus, or bump #CORPUS-VERSION + #CORPUS-SHA256 in EVERY repo that"
+  echo "   vendors it. A local-only edit is how the shared contract silently stops being shared."
+  exit 10
+fi
+
+# ── Namespace declaration: what THIS consumer owns (OPA-bundle `roots` shape) ───
+# This consumer composes PANELS, so it judges sidecar/CLI names and model ids alike.
+# A consumer that only classifies model ids declares NS="model-id" and its skipped rows are
+# REPORTED below, never silently counted as passing.
+NS="${NS:-cli model-id}"
+
+# ── THIS repo's adapter: the two regexes inside validate_crossfamily_leg ────────
+# Sourced FROM the hook rather than restated, so this test cannot drift from the thing it
+# is testing. A restated copy would be a fourth implementation — the exact defect class
+# this file exists to measure.
+DENY=$(grep -m1 -oE "grep -qiE 'embed\|[^']*'" "$HOOK" | sed -E "s/^grep -qiE '//; s/'$//")
+ALLOW=$(grep -m1 -oE "grep -qiE 'codex\|[^']*'" "$HOOK" | sed -E "s/^grep -qiE '//; s/'$//")
+if [ -z "$DENY" ] || [ -z "$ALLOW" ]; then
+  echo "🟥 HARNESS-ERROR: could not extract the classifier from $HOOK"
+  echo "   (deny='$DENY' allow='$ALLOW') — refusing to measure against an empty pattern,"
+  echo "   which would report every row as agreeing."
+  exit 10
+fi
+
+classify() { # $1 = model id → CAPABLE | INCAPABLE | UNDECIDABLE
+  # Ineligible-first: the overlap rows depend on this order and exist to catch its inversion.
+  if printf '%s' "$1" | grep -qiE "$DENY"; then echo INCAPABLE
+  elif printf '%s' "$1" | grep -qiE "$ALLOW"; then echo CAPABLE
+  else echo UNDECIDABLE; fi
+}
+
+# ── Instrument calibration: prove the adapter separates a known pair BEFORE trusting it ──
+# The pair is DERIVED FROM THE CORPUS within this consumer's own namespace, never hardcoded.
+# A hardcoded pair is namespace-blind: the first draft pinned `codex`, and a consumer that
+# classifies model ids (and correctly has no opinion on CLI names) failed calibration for a
+# reason that had nothing to do with its classifier. A calibration that can fail for the
+# wrong reason cannot certify anything.
+kp_pos=$(sed 's/\t/|/g' "$CORPUS" | awk -F'|' -v ns="$NS" \
+  '$2=="CAPABLE" && $3 ~ /^ns:/ { split($3,a,"/"); n=substr(a[1],4); if (index(" " ns " ", " " n " ")) { print $1; exit } }')
+kp_neg=$(sed 's/\t/|/g' "$CORPUS" | awk -F'|' -v ns="$NS" \
+  '$2=="INCAPABLE" && $3 ~ /^ns:/ { split($3,a,"/"); n=substr(a[1],4); if (index(" " ns " ", " " n " ")) { print $1; exit } }')
+if [ -z "$kp_pos" ] || [ -z "$kp_neg" ]; then
+  echo "🟥 HARNESS-ERROR: corpus has no known pair inside namespace [$NS]"
+  echo "   (pos='$kp_pos' neg='$kp_neg'). Without a pair that this consumer OWNS, nothing"
+  echo "   below is calibrated — refusing to grade."
+  exit 10
+fi
+gp=$(classify "$kp_pos"); gn=$(classify "$kp_neg")
+# Separate "the instrument is broken" from "the instrument works and disagrees". Collapsing
+# them makes a real, gradeable divergence abort as HARNESS-ERROR and go unmeasured — the
+# finding disappears into the error channel. A classifier that says CAPABLE to a known
+# NEGATIVE is not discriminating at all → unmeasurable. One that is merely too strict on the
+# positive still separates, so grade it and report the strictness as drift.
+if [ "$gn" = CAPABLE ]; then
+  echo "🟥 HARNESS-ERROR: adapter does not discriminate — known NEGATIVE $kp_neg → CAPABLE."
+  echo "   It cannot separate a case whose answer is already known. Aborting, not reporting."
+  exit 10
+fi
+if [ "$gp" != CAPABLE ]; then
+  echo "⚠️  calibration: known POSITIVE $kp_pos → $gp (expected CAPABLE)."
+  echo "   The classifier discriminates (negative held) but is stricter than the contract."
+  echo "   Grading continues — this is drift to report, not an unmeasurable instrument."
+else
+  echo "calibrated on [$NS]: $kp_pos → $gp · $kp_neg → $gn"
+fi
+
+N=0; BAD=0; DEV=0; SKIP=0
+printf "%-32s %-12s %-12s %s\n" "id" "expected" "actual" ""
+# IFS=$'\t' collapses CONSECUTIVE tabs (POSIX: repeated whitespace-class IFS chars are one
+# delimiter), so an aligned row with an empty field shifts every later field left and the
+# verdict column silently reads someone else's value. Split on a sentinel instead.
+while IFS='|' read -r id want cls why; do
+  case "$id" in ''|'#'*|' '*|$'\t'*) continue ;; esac
+  # Verdict field must be one of the three tokens. A continuation line of a multi-line note
+  # otherwise parses as a row and reports a phantom disagreement — measured on this file's
+  # own first draft, which is exactly the "instrument, not target" failure it must not have.
+  case "${want:-}" in CAPABLE|INCAPABLE|UNDECIDABLE) : ;; *) continue ;; esac
+  row_ns=$(printf '%s' "${cls:-}" | sed -E 's|^ns:([^/]+)/.*|\1|')
+  case " $NS " in *" $row_ns "*) : ;; *) SKIP=$((SKIP+1)); continue ;; esac
+  N=$((N+1)); got=$(classify "$id")
+  if [ "$got" = "$want" ]; then
+    printf "%-32s %-12s %-12s ✅\n" "$id" "$want" "$got"
+  elif { [ "$want" = UNDECIDABLE ] && [ "$got" = INCAPABLE ]; } \
+    || { [ "$want" = INCAPABLE ] && [ "$got" = UNDECIDABLE ]; }; then
+    # Outcome-safety grading, not label identity. Both verdicts BLOCK under default-deny, so
+    # the operational result is identical and this is a reported deviation, never a failure.
+    # Failing it would punish a pattern classifier for an opaque id it cannot possibly read
+    # (`voyage-3`, `bge-m3`) and make DELETING THE ROW the rational maintenance move — the
+    # corpus would then shrink toward whatever the weakest implementation happens to catch.
+    printf "%-32s %-12s %-12s ⚠️  deviation — same outcome (both block)\n" "$id" "$want" "$got"
+    DEV=$((DEV+1))
+  else
+    printf "%-32s %-12s %-12s ❌ %s\n" "$id" "$want" "$got" "$cls"
+    # Name the direction: a permissive miss is the one that ships broken panels.
+    { [ "$want" = INCAPABLE ] || [ "$want" = UNDECIDABLE ]; } && [ "$got" = CAPABLE ] \
+      && echo "     ↑ PERMISSIVE drift — this id would be counted as a reviewer"
+    BAD=$((BAD+1))
+  fi
+done < <(sed 's/\t/|/g' "$CORPUS")
+
+echo
+echo "corpus pin: $PINNED · namespaces: [$NS]"
+echo "rows graded: $N · disagreements: $BAD · allowed deviations: $DEV · skipped (other namespace): $SKIP"
+if [ "$BAD" -eq 0 ]; then echo "✅ conforms to the shared corpus"; else
+  echo "❌ DRIFT — this repo's classifier disagrees with the shared corpus on $BAD row(s)."
+  echo "   Fix the implementation, or change the corpus in ALL repos that vendor it."
+fi
+exit $([ "$BAD" -eq 0 ] && echo 0 || echo 1)

package/scripts/test_selfcheck_state_lanes.sh

@@ -93,6 +93,109 @@ else
   echo "  ⏭️  package.json absent — premise unchecked (not a pass)"
 fi
 
+echo ""
+echo "── _show_failure: a FAILING suite's evidence must survive to the reader ──"
+# WHY THIS LANE EXISTS (2026-08-05): the four lane blocks in selfcheck.sh used to decide on a
+# discarded run (`>/dev/null`) and then RE-RUN to print. On a non-deterministic suite the re-run can
+# pass, so CI printed a FAIL verdict above a PASSING transcript and the real failure was destroyed —
+# measured in run 30955950695. The repair captures once; this lane is the mechanical anchor for the
+# half that actually makes a failure readable. Without it the repair is unverifiable: reverting to
+# `tail -20` leaves CI green, which is exactly [[feedback_built_but_not_wired]] / anchor-is-decorative.
+# LIFTED, not re-spelled — same reason as the discriminator above.
+FN=$(sed -n '/^_show_failure() {/,/^}$/p' "$SELFCHECK")
+if [ -z "$FN" ]; then
+  echo "FAIL  _show_failure is no longer defined in selfcheck.sh — this lane cannot verify what it claims."
+  echo "      If the helper was renamed or removed, update the lane WITH the subject."
+  exit 1
+fi
+eval "$FN"
+
+# Fixture: a long transcript whose ONLY failing line sits far above any tail window, plus a
+# summary banner at the end that still says something failed. This is the shape that fooled the
+# reader in the CI run above.
+_LONG=$(for i in $(seq 1 40); do echo "  ✅ lane L$i ok"; done; echo "  ❌ lane L41 tripped — THE EVIDENCE"; for i in $(seq 42 96); do echo "  ✅ lane L$i ok"; done; echo "════ lanes: 96 passed · 1 failed ════")
+
+_OUT=$(_show_failure "$_LONG")
+printf '%s' "$_OUT" | grep -q 'THE EVIDENCE'; chk $? "the failing line survives (it is 56 lines above the end)"
+printf '%s' "$_OUT" | grep -q '1 failed'    ; chk $? "the summary banner is still shown"
+
+# CONTROL — the old form must FAIL this same fixture. Without this, the lane could pass for a
+# reason unrelated to the repair (e.g. a fixture short enough that any tail window catches it).
+printf '%s\n' "$_LONG" | tail -20 | grep -q 'THE EVIDENCE'; [ $? -ne 0 ]
+chk $? "CONTROL: the pre-repair form (tail -20) does NOT surface it — the fixture discriminates"
+
+# Degenerate inputs: silence must not read as evidence, and a suite that dies before printing any
+# ❌ must say so rather than showing a blank.
+_OUT=$(_show_failure "")
+printf '%s' "$_OUT" | grep -q 'no output captured'; chk $? "empty output is named, not shown as a blank line"
+_OUT=$(_show_failure "some early crash text
+Traceback: boom")
+printf '%s' "$_OUT" | grep -q 'died early'; chk $? "output with no ❌/FAIL falls back and says why"
+
+# ── THE DEFECT ITSELF: decide-and-print must be ONE execution ────────────────
+# An earlier version of this lane block tested only the _show_failure HELPER, in isolation, via eval.
+# An adversarial round then reverted a lane block to the original run-twice form — decide on a
+# discarded run, re-run to capture — and this suite still returned PASS (16/16, measured). The anchor
+# was guarding the thing the repair BUILT and not the thing the repair FIXED. That is
+# [[feedback_anchor_can_be_decorative]] with the reversal actually applied, which is the only check
+# that distinguishes the two.
+# The invariant that discriminates: a suite must be EXECUTED EXACTLY ONCE per selfcheck run. The
+# run-twice form necessarily names its subject twice. Keying on the subject path (not on a variable
+# name or a pipe shape) also removes the earlier grep's escape hatch — renaming `_out` no longer
+# evades it, and adding a fifth lane block does not require editing a hardcoded count.
+for _subj in test_tag_version_lanes test_dispatch_log_lanes test_selfcheck_state_lanes sync_from_be_lanes; do
+  _n=$(grep -c "bash scripts/${_subj}\.sh" "$SELFCHECK" || true)
+  [ "$_n" -eq 1 ]
+  chk $? "${_subj}.sh is executed exactly once (found $_n) — 2 means the run-twice form is back"
+done
+
+# WIRING — every lane block must route its captured output through the helper. Secondary to the
+# once-only invariant above (this one IS evadable by renaming), kept because it names the intent.
+_CALLS=$(grep -c '_show_failure "\$_out"' "$SELFCHECK")
+[ "$_CALLS" -ge 4 ]; chk $? "every lane block routes failure output through _show_failure (found $_CALLS, expected ≥4)"
+_TAILS=$(grep -c '"\$_out" | tail -' "$SELFCHECK" || true)
+[ "$_TAILS" -eq 0 ]; chk $? "no lane block still truncates with a raw tail (found $_TAILS, expected 0)"
+
+# The one non-lane caller that also destroys its evidence at the CALL SITE (not inside check()).
+# `check "..." bash -c '... >/dev/null'` discards the subject's stdout, and fh-codex-doctor writes
+# 100% of its diagnostics to stdout (measured: 686 B stdout / 0 B stderr) — so a strict-mode failure
+# would print a bare FAIL line with zero diagnosis. Anchored here because the fix is one line at the
+# call site and does NOT require touching check() itself.
+_CD=$(grep -c "fh-codex-doctor.js --strict >/dev/null" "$SELFCHECK" || true)
+[ "$_CD" -eq 0 ]; chk $? "fh-codex-doctor's stdout is not discarded at the call site (found $_CD, expected 0)"
+
+# Byte-hostile input: a lane emitting invalid UTF-8 must not be reported as "no output". The
+# `tr -d '[:space:]'` form this guard originally used aborts on BSD with "Illegal byte sequence"
+# and emits nothing, so the emptiness check concluded empty while evidence was present.
+# NOTE ON THIS FIXTURE — it deliberately contains NO ❌. The first draft included one, which routed
+# the call into the failing-lines branch, so the emptiness guard (an `elif`) was never reached and the
+# lane passed against the very defect it was written for. Verified by applying the reversion and
+# confirming the diff landed: the lane went green anyway. A fixture that cannot reach the branch
+# under test measures nothing.
+_BAD=$(printf '  \xff\xfe garbage\n  crashed before any lane ran BYTE_EVIDENCE\n')
+_OUT=$(_show_failure "$_BAD")
+printf '%s' "$_OUT" | grep -q 'BYTE_EVIDENCE'; chk $? "invalid UTF-8 in the stream does not swallow the evidence"
+printf '%s' "$_OUT" | grep -qv 'no output captured'; chk $? "…and it is not mis-reported as empty output"
+
+# The banner must not be suppressed by a line the reader never saw (a failing line past the head cut
+# that merely quotes the banner text).
+_MANY=$(for i in $(seq 1 26); do echo "  ❌ f$i"; done; echo "  ❌ f27 quoting ════ lanes: 9 passed · 1 failed ════"; echo "════ lanes: 9 passed · 1 failed ════")
+_OUT=$(_show_failure "$_MANY")
+[ "$(printf '%s\n' "$_OUT" | grep -c '════ lanes: 9 passed')" -ge 1 ]
+chk $? "the summary banner still prints when a truncated-away line quotes it"
+
+# ── SCOPE OF THIS ANCHOR — stated so it is not over-trusted ───────────────────
+# These lanes catch REVERSION (the run-twice form coming back, the helper being gutted, the
+# call-site redirect returning). They do NOT catch deliberate EVASION: a cross-family round
+# demonstrated three forms that satisfy every check above while still destroying evidence —
+# `_out=$(bash suite >/dev/null 2>&1)` (executed once, captured nothing), a wrapper function
+# (`run_lane() { bash scripts/X.sh; }`, literal appears once, runs twice), and redirect spellings
+# the greps do not enumerate (`1>/dev/null`, a variable). Chasing those with more patterns is the
+# Grep-Collision Treadmill this repo has already logged as P10 — each added regex relocates the
+# evasion instead of closing it. It is bounded rather than escalated: an evading form still routes
+# through _show_failure, whose empty branch prints "(no output captured)" at runtime, so the failure
+# is loud rather than silent. Regression is anchored; evasion is a named residual, not a solved one.
+
 echo ""
 if [ "$FAILED" -ne 0 ]; then
   echo "SELFCHECK STATE LANES: FAIL — a discriminator would mis-route"

package/scripts/test_session_close_chain_lanes.sh

@@ -85,6 +85,18 @@ _repo() {  # $1=dirname ; makes a git repo with one commit dated $2 (default now
     else
       git commit -qm seed
     fi
+    # A real repo HAS an upstream. Without one the close check now (correctly) reports
+    # `① UNMEASURED — no upstream`, which is not the state any of these lanes means to express —
+    # a fixture with no upstream cannot assert "clean tree, nothing unpushed" because the second
+    # half of that sentence is genuinely unknown. Every lane below therefore runs on a pushed
+    # baseline; upstream ABSENCE is measured on purpose by its own lane (KP-2).
+    git init -q --bare "$TMPROOT/$1.git"
+    git remote add origin "$TMPROOT/$1.git"
+    # `-c core.hooksPath=` : a fixture push must never execute the HOST's git hooks. This repo sets
+    # core.hooksPath locally (so a temp repo does not inherit it) but a machine that sets it GLOBALLY
+    # would run FH's own pre-push Destructive-Op gate against a throwaway fixture — the suite's result
+    # would then depend on the operator's git config rather than on the code under test.
+    git -c core.hooksPath= push -q -u origin HEAD
   ) >/dev/null 2>&1
   mkdir -p "$T/tracks/_meta"
   printf '%s' "$T"
@@ -121,13 +133,10 @@ _line "①-N  uncommitted path → ⚠️ fires"           'uncommitted path'
 _line "①-N  uncommitted path → clean line absent"  '✅ ① working tree clean' 0 "$OUT"
 _rc   "①-N  uncommitted is ADVISORY, not blocking" "$RC" 0
 
-# unpushed: needs a real upstream, so build a bare remote
+# unpushed: _repo already pushed the seed, so one extra commit is exactly one unpushed commit
 T=$(_repo one_unpushed); _artifacts "$T"
 (
   cd "$T" || exit 1
-  git init -q --bare "$TMPROOT/one_unpushed.git" 2>/dev/null
-  git remote add origin "$TMPROOT/one_unpushed.git"
-  git push -q -u origin HEAD 2>/dev/null
   echo more > second.txt && git add -A && git commit -qm second
 ) >/dev/null 2>&1
 _run "$T"
@@ -141,6 +150,72 @@ _gap "①  non-repo reports CLEAN" "$_g" \
   "git is unavailable/not a repo → DIRTY=0, UNPUSHED=0 → the check reports '✅ working tree clean'. \
 An instrument that could not look is not a clean result (not found ≠ 0). Should say UNSCANNED."
 
+# ── ① not-found ≠ 0 : the five states where git CANNOT answer ────────────────────
+# Origin: the fix that introduced these five guards (2026-08-06) listed all six known pairs in its
+# COMMIT MESSAGE and shipped none of them as a lane — the code changed, the suite did not, and CI
+# went red on the two lanes the change broke rather than on the five it left unmeasured. Prose in a
+# commit message is not a regression anchor: nothing re-runs it. Each pair below is
+# known-positive (the instrument is blind) + a paired control (the clean line must NOT appear),
+# because "the warning fired" and "the warning fired INSTEAD of a false all-clear" are two claims.
+# KP-1 (the healthy case) is the ①-P lane at the top of this section.
+
+# KP-2 upstream absent — `@{u}..` fails, prints 0 lines, and `wc -l` counts that 0 as "nothing
+# unpushed". A commit that never left the machine reads as pushed. `--unset-upstream` (not
+# `remote remove`) keeps a remote present, so the all-branch scan still runs: this isolates the
+# upstream leg instead of quietly testing two things at once.
+T=$(_repo kp2_no_upstream); _artifacts "$T"
+git -C "$T" branch --unset-upstream >/dev/null 2>&1
+_run "$T"
+_line "KP-2 no upstream → UNMEASURED, not zero"    'unpushed count is UNKNOWN' 1 "$OUT"
+_line "KP-2 → clean line absent (paired)"          '✅ ① working tree clean'   0 "$OUT"
+_rc   "KP-2 → advisory, not blocking"              "$RC" 0
+
+# KP-3 git status itself fails — a corrupt index makes `status` exit non-zero with EMPTY output,
+# and `| wc -l` renders that emptiness as "0 dirty paths" = clean.
+T=$(_repo kp3_broken_index); _artifacts "$T"
+printf 'garbage' > "$T/.git/index"
+_run "$T"
+_line "KP-3 corrupt index → cleanliness UNKNOWN"   'cleanliness is UNKNOWN'    1 "$OUT"
+_line "KP-3 → clean line absent (paired)"          '✅ ① working tree clean'   0 "$OUT"
+# Measured while writing this lane: a corrupt index makes `ls-files -v` exit 128 too, so the
+# assume-unchanged probe (MASKED) silently reads 0 — the same not-found-≠-0 shape, one layer in.
+# It is NOT a false all-clear (DIRTY_KNOWN=0 already suppresses the clean line), so it is recorded
+# as a residual rather than patched here. `rev-parse @{u}` still exits 0 under a corrupt index,
+# which is what keeps this lane measuring cleanliness and not accidentally re-measuring KP-2.
+
+# KP-4 measured scope ≠ claimed scope — `@{u}..` reads the CURRENT branch only, while the message
+# says "nothing unpushed" about the repo. An unpushed commit parked on another local branch is
+# invisible. The current branch stays clean and pushed on purpose: only the other branch is dirty,
+# so a green here would be the exact false all-clear.
+T=$(_repo kp4_other_branch); _artifacts "$T"
+(
+  cd "$T" || exit 1
+  git checkout -q -b side
+  echo side > side.txt && git add -A && git commit -qm side
+  git checkout -q -
+) >/dev/null 2>&1
+_run "$T"
+_line "KP-4 unpushed on ANOTHER branch → ⚠️ fires" 'never pushed anywhere'     1 "$OUT"
+_line "KP-4 → clean line absent (paired)"          '✅ ① working tree clean'   0 "$OUT"
+
+# KP-5 `status.showUntrackedFiles=no` — git succeeds and stays SILENT (exit 0, empty output), so
+# the exit-code guard of KP-3 cannot catch this one. Only `--untracked-files=all` overrides it.
+T=$(_repo kp5_untracked_off); _artifacts "$T"
+git -C "$T" config status.showUntrackedFiles no
+echo hidden > "$T/hidden.txt"
+_run "$T"
+_line "KP-5 showUntrackedFiles=no → still counted"  'uncommitted path'         1 "$OUT"
+_line "KP-5 → clean line absent (paired)"           '✅ ① working tree clean'  0 "$OUT"
+
+# KP-6 assume-unchanged / skip-worktree — edits to a marked TRACKED file never reach porcelain at
+# all, so `-uall` does not help either. A separate instrument (`ls-files -v`) has to surface it.
+T=$(_repo kp6_assume_unchanged); _artifacts "$T"
+git -C "$T" update-index --assume-unchanged unrelated.txt
+echo edited >> "$T/unrelated.txt"
+_run "$T"
+_line "KP-6 assume-unchanged edit → surfaced"       'INVISIBLE here'           1 "$OUT"
+_line "KP-6 → clean line absent (paired)"           '✅ ① working tree clean'  0 "$OUT"
+
 echo
 echo "══ ①-b open-PR sweep ══"
 _ghstub() {  # $1=repo $2=stdout $3=exit

package/scripts/test_version_lockstep_lanes.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Known pairs for scripts/version_lockstep_check.sh.
+#
+# The lane this suite exists to prevent: on 2026-08-06 a 1.4.88 → 1.4.89 bump edited the FIRST
+# marketplace plugin entry and left the SECOND at the old version. `test_tag_version_lanes.sh`
+# reported 8/8 PASS through it — that lane compares the git tag to package.json and never opens
+# marketplace.json. The drift was caught by an ad-hoc `sort | uniq -c`. Luck is not a floor.
+#
+# Every lane runs against a THROWAWAY fixture tree, never against this repo, so the suite is
+# hermetic: a real bump in progress can neither turn it green nor turn it red.
+
+set -uo pipefail
+CHECK="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/version_lockstep_check.sh"
+TMPROOT=$(mktemp -d "${TMPDIR:-/tmp}/fh_lockstep.XXXXXX")
+trap 'rm -rf "$TMPROOT"' EXIT
+PASS=0; FAIL=0
+
+_fixture() {  # $1=name $2=pkg_ver $3=meta_ver $4=commons_ver $5=mk_entry0 $6=mk_entry1
+  local T="$TMPROOT/$1"
+  mkdir -p "$T/.claude-plugin" "$T/plugins/fh-meta/.claude-plugin" "$T/plugins/fh-commons/.claude-plugin"
+  printf '{"name":"fh","version":"%s"}\n' "$2" > "$T/package.json"
+  printf '{"name":"fh-meta","version":"%s"}\n' "$3" > "$T/plugins/fh-meta/.claude-plugin/plugin.json"
+  printf '{"name":"fh-commons","version":"%s"}\n' "$4" > "$T/plugins/fh-commons/.claude-plugin/plugin.json"
+  printf '{"plugins":[{"name":"fh-meta","version":"%s"},{"name":"fh-commons","version":"%s"}]}\n' \
+    "$5" "$6" > "$T/.claude-plugin/marketplace.json"
+  printf '%s' "$T"
+}
+
+_expect() {  # $1=label $2=expected_rc $3=repo ; also captures OUT
+  OUT=$(bash "$CHECK" "$3" 2>&1); local rc=$?
+  if [ "$rc" = "$2" ]; then echo "  ✅ $1 (rc=$rc)"; PASS=$((PASS+1))
+  else echo "  ❌ $1 — rc=$rc, expected=$2"; printf '%s\n' "$OUT" | sed 's/^/       │ /'; FAIL=$((FAIL+1)); fi
+}
+_says() {  # $1=label $2=pattern $3=expected_hit(1|0)
+  local h=0; printf '%s\n' "$OUT" | grep -q -- "$2" && h=1
+  if [ "$h" = "$3" ]; then echo "  ✅ $1"; PASS=$((PASS+1))
+  else echo "  ❌ $1 — hit=$h, expected=$3"; printf '%s\n' "$OUT" | sed 's/^/       │ /'; FAIL=$((FAIL+1)); fi
+}
+
+echo "══ version lockstep known pairs ══"
+
+# KN — everything aligned. The control: without it, a checker that always reported DRIFT would
+# still pass every positive lane below.
+_expect "KN  all five strings aligned → exit 0" 0 "$(_fixture kn 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89)"
+_says   "KN  → names the count it actually checked" "4 shipped version string" 1
+
+# KP-1 — the measured miss, byte for byte: second marketplace entry left behind.
+_expect "KP-1 second marketplace entry stale → exit 1" 1 "$(_fixture kp1 1.4.89 1.4.89 1.4.89 1.4.89 1.4.88)"
+_says   "KP-1 → names the offending entry by index+name" "plugins\[1\] fh-commons" 1
+_says   "KP-1 → reports both versions, not just 'mismatch'" "1.4.88  (package.json = 1.4.89)" 1
+
+# KP-2 — a plugin.json left behind. This is the shape the tag lane also cannot see.
+_expect "KP-2 plugin.json stale → exit 1" 1 "$(_fixture kp2 1.4.89 1.4.88 1.4.89 1.4.89 1.4.89)"
+_says   "KP-2 → names the file" "plugins/fh-meta/.claude-plugin/plugin.json" 1
+
+# KP-3 — the reverse direction: package.json bumped alone. Same defect, opposite author error.
+_expect "KP-3 only package.json bumped → exit 1" 1 "$(_fixture kp3 1.5.0 1.4.89 1.4.89 1.4.89 1.4.89)"
+_says   "KP-3 → all four downstream strings flagged" "4 of 4" 1
+
+# HARNESS-ERROR — an instrument that could not look has not looked. These must be a THIRD state,
+# never folded into PASS: this gate guards `npm publish`, an irreversible surface.
+T=$(_fixture he1 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); rm "$T/.claude-plugin/marketplace.json" "$T"/plugins/*/.claude-plugin/plugin.json
+_expect "HE-1 no manifests at all → exit 2, NOT 0" 2 "$T"
+_says   "HE-1 → says alignment is UNKNOWN, not aligned" "UNKNOWN, not aligned" 1
+
+T=$(_fixture he2 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); printf '{ broken' > "$T/.claude-plugin/marketplace.json"
+_expect "HE-2 unparseable manifest → exit 2, NOT 0" 2 "$T"
+
+T=$(_fixture he3 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); rm "$T/package.json"
+_expect "HE-3 missing package.json → exit 2, NOT 0" 2 "$T"
+
+# A manifest present but carrying no version at all is absence, not agreement.
+T=$(_fixture he4 1.4.89 1.4.89 1.4.89 1.4.89 1.4.89); printf '{"name":"fh-meta"}\n' > "$T/plugins/fh-meta/.claude-plugin/plugin.json"
+_expect "HE-4 manifest with no version → exit 2, NOT 0" 2 "$T"
+_says   "HE-4 → says which file carries none" "carries no version string" 1
+
+echo
+echo "──────────────────────────────────────────────"
+if [ "$FAIL" -gt 0 ]; then
+  echo "VERSION-LOCKSTEP LANES: FAIL ($PASS pass · $FAIL fail)"; exit 1
+fi
+echo "VERSION-LOCKSTEP LANES: PASS ($PASS/$PASS)"

package/scripts/test_wizard_snippet_merge_lanes.sh

@@ -129,6 +129,93 @@ _eq  "MG-T  → the user's file is left byte-identical" "$(cat "$H/.claude/setti
   || _pass "MG-T  → no misleading backup artifact left behind"
 
 echo
+# ══ MULTI-SNIPPET DISCOVERY (regression for the 2026-08-08 high review, finding #1) ══
+# The merge block used to hardcode settings.SessionStart.snippet.json, so every OTHER shipped snippet
+# was structurally unregisterable — the compaction hooks shipped with a README reciting the
+# shipping-is-not-wiring lesson while reproducing it, and PreToolUse was already in the same hole.
+# These lanes fail if anyone reintroduces a single-snippet path.
+echo "══ multi-snippet discovery ══"
+
+_hub2() {  # $1=name → hub with the shipped SessionStart snippet PLUS a second, unrelated snippet
+  local h="$TMPROOT/$1"; mkdir -p "$h/templates" "$h/.claude"
+  cp "$SNIPPET" "$h/templates/settings.SessionStart.snippet.json"
+  cat > "$h/templates/settings.Zzz.snippet.json" <<'EOF'
+{
+  "_README": ["fixture — a snippet the merge code has never heard of"],
+  "project_settings_json": {
+    "hooks": {
+      "PreCompact": [
+        { "matcher": "", "hooks": [ { "type": "command", "command": "bash \"$HUB/scripts/zzz_probe.sh\" seal" } ] }
+      ]
+    }
+  }
+}
+EOF
+  echo "$h"
+}
+
+H=$(_hub2 multi); _merge "$H"
+_rc "MS-1 merge with two snippets exits 0" "$RC" 0
+python3 -c "
+import json,sys
+d=json.load(open('$H/.claude/settings.json'))
+h=d.get('hooks',{})
+ss=json.dumps(h.get('SessionStart',[]))
+pc=json.dumps(h.get('PreCompact',[]))
+print('OK' if ('fh_node_check' in ss and 'zzz_probe' in pc) else 'MISS')
+" > "$TMPROOT/ms.out" 2>/dev/null
+_eq "MS-2 BOTH snippets registered (unknown snippet needs no code edit)" "$(cat "$TMPROOT/ms.out")" "OK"
+
+# The registered-event set must come from the snippets, not from a hardcoded list.
+_eq "MS-3 a non-SessionStart event is registered" \
+    "$(python3 -c "import json;print('YES' if json.load(open('$H/.claude/settings.json')).get('hooks',{}).get('PreCompact') else 'NO')" 2>/dev/null)" "YES"
+
+# Idempotence: re-running must not duplicate either snippet's hooks.
+_merge "$H"
+_eq "MS-4 re-run is idempotent (no duplicate zzz_probe entry)" \
+    "$(python3 -c "import json;print(json.dumps(json.load(open('$H/.claude/settings.json')).get('hooks',{}).get('PreCompact',[])).count('zzz_probe'))" 2>/dev/null)" "1"
+
+# A user's own hook in the same event must survive the merge (hook-level, not group-level).
+python3 - "$H" <<'PY2'
+import json,collections,os,sys
+t=sys.argv[1]+"/.claude/settings.json"
+d=json.load(open(t),object_pairs_hook=collections.OrderedDict)
+d["hooks"].setdefault("PreCompact",[]).append({"matcher":"","hooks":[{"type":"command","command":"bash my_own.sh"}]})
+json.dump(d,open(t,"w"),indent=2,ensure_ascii=False)
+PY2
+_merge "$H"
+_eq "MS-5 user's own hook in the same event survives" \
+    "$(python3 -c "import json;print('YES' if 'my_own.sh' in json.dumps(json.load(open('$H/.claude/settings.json')).get('hooks',{}).get('PreCompact',[])) else 'NO')" 2>/dev/null)" "YES"
+
+# ══ RE-REVIEW REPAIRS (2026-08-08 round 2) ══
+# 두 건 다 **직전 라운드의 수리가 만든 결함**이다. 레인 없이 고치면 같은 자리로 돌아온다.
+echo "══ re-review repairs ══"
+
+# ZS — 스니펫 0개는 조용한 성공이 아니라 시끄러운 실패여야 한다 (#1)
+ZH="$TMPROOT/zerosnip"; mkdir -p "$ZH/templates" "$ZH/.claude"   # templates/ 는 있고 스니펫만 없다
+_merge "$ZH"
+_rc "ZS-1 스니펫 0개 → non-zero (조용한 성공 금지)" "$RC" 1
+case "$OUT" in *"NO SNIPPETS"*) _pass "ZS-2 무엇이 없는지 이름을 말한다" ;; *) _fail "ZS-2 실패 사유가 불명" ;; esac
+
+# KC — 파생 키가 베이스네임이면 남의 훅을 지운다 (#2)
+KH=$(_hub2 keycollide)
+python3 - "$KH" <<'PY2'
+import json,collections,os,sys
+t=sys.argv[1]+"/.claude/settings.json"
+d=collections.OrderedDict()
+if os.path.exists(t): d=json.load(open(t),object_pairs_hook=collections.OrderedDict)
+h=d.setdefault("hooks",collections.OrderedDict())
+# 사용자 자기 훅 — 파일명은 겹치지만 **경로가 다르다**
+h.setdefault("PreCompact",[]).append({"matcher":"","hooks":[
+  {"type":"command","command":"bash ~/tools/zzz_probe.sh --mine"}]})
+json.dump(d,open(t,"w"),indent=2,ensure_ascii=False)
+PY2
+_merge "$KH"
+_eq "KC-1 파일명만 겹치는 사용자 훅은 살아남는다" \
+    "$(python3 -c "import json;print('YES' if 'tools/zzz_probe.sh' in json.dumps(json.load(open('$KH/.claude/settings.json')).get('hooks',{}).get('PreCompact',[])) else 'NO')" 2>/dev/null)" "YES"
+_eq "KC-2 FH 자기 훅은 여전히 교체된다 (중복 없음)" \
+    "$(python3 -c "import json;print(json.dumps(json.load(open('$KH/.claude/settings.json')).get('hooks',{}).get('PreCompact',[])).count('scripts/zzz_probe.sh'))" 2>/dev/null)" "1"
+
 echo "══ ⓘ GAP lanes ══"
 
 # GAP 1 — the ONLY validation is what `kept + entry` incidentally requires: that entry is a list.
@@ -148,23 +235,29 @@ for name in emptylist nocommand wrongscript juststring; do
     BADSCHEMA_HITS=$((BADSCHEMA_HITS+1)); DETAIL="$DETAIL $name"
   fi
 done
-_g=0; [ "$BADSCHEMA_HITS" -gt 0 ] && _g=1
-_gap "valid-JSON / invalid-SCHEMA snippet → written, reported as success, node hook absent" "$_g" \
-  "$BADSCHEMA_HITS of $BADSCHEMA_TOTAL cases:$DETAIL. exit 0 and 'node-check SessionStart hook \
-registered ->' are printed while fh_node_check is NOT in the file that was just written. The success \
-message is unconditional — it does not re-read what it wrote. One-line fix: after the write, assert \
-fh_node_check appears in the serialized result, else exit non-zero."
+# PROMOTED 2026-08-08 (was a GAP): the merge block now shape-validates before writing and re-reads
+# what it wrote, so a bad-schema snippet can no longer be written-and-reported-as-success.
+# NOTE the fixture nuance: the `wrongscript` case is NOT malformed — it is a valid snippet naming a
+# different script, which the discovery-based merge correctly registers. `_registered` only greps for
+# fh_node_check, so it reads as "not registered". Assert the property that actually matters instead:
+# a run that skips a snippet must not exit 0 (fail-closed), which is what makes the old GAP dead.
+_eq "BS-1 malformed snippet never yields a zero exit (fail-closed)" \
+    "$(H=$(_hub bs1 '{"project_settings_json":{"hooks":{"SessionStart":["not even an object"]}}}'); _merge "$H"; [ "$RC" != 0 ] && echo CLOSED || echo OPEN)" "CLOSED"
+# (GAP 1 retired — promoted to BS-1 above, 2026-08-08)
 
 # GAP 2 — the corruption from GAP 1 is LATENT: the bad value lands in the user's settings.json and
 # detonates on the NEXT wizard run, in the kept-loop, far from where it was introduced.
 H=$(_hub latent '{"project_settings_json":{"hooks":{"SessionStart":["not even an object"]}}}')
 _merge "$H"; FIRST_RC=$RC
 _merge "$H"; SECOND_RC=$RC
-_g=0; { [ "$FIRST_RC" = 0 ] && [ "$SECOND_RC" != 0 ]; } && _g=1
-_gap "the bad write detonates on the NEXT run, not the run that made it" "$_g" \
-  "run1 exit=$FIRST_RC (reported success), run2 exit=$SECOND_RC (AttributeError in the kept-loop: \
-g.get on a str). The user's settings.json is now un-mergeable and the traceback points at the \
-survivor filter, not at the snippet that caused it."
+# PROMOTED 2026-08-08 (was a GAP): a bad snippet is skipped with a visible SKIP line instead of
+# corrupting settings.json, so run 2 no longer detonates on run 1's write.
+# The old GAP was: run 1 reports success, run 2 detonates on run 1's write. The promoted property is
+# DETERMINISM — both runs must reach the same verdict, so a failure is attributable to the snippet
+# that caused it rather than surfacing later inside the survivor filter.
+_eq "LT-1 verdict is deterministic across runs (no latent detonation)" \
+    "$([ "$FIRST_RC" = "$SECOND_RC" ] && echo DETERMINISTIC || echo LATENT)" "DETERMINISTIC"
+# (GAP 2 retired — promoted to LT-1 above, 2026-08-08)
 
 # GAP 3 — INSTRUMENT COVERAGE, measured not asserted. Build the exact post-failure state (companion
 # hook registered, node hook absent) and run install-doctor's registration check on it. The