@chrono-meta/fh-gate 1.4.89 → 1.4.90

package/knowledge/shared/harness-core/harness_incubator_doctrine.md

@@ -157,6 +157,106 @@ authored-case baseline (single-draw per case; reps waived per measurement-integr
 first draw matched expected — see the 2026-07-13 subagent-invocations log entry), not a calibrated
 accuracy estimate.
 
+### 3-a. What is born, and what it must be able to do on day one (operator-forged, 2026-08-09)
+
+**We are not raising a person. We are shipping a harness that does one thing well.** The founding
+image is a calf or a foal: it is born in a laboratory sense — brand new, thin, nowhere near an adult
+— but it **stands and walks in the place where it was born.** That is the incubator's bar, and it is
+much lower and much clearer than "finished."
+
+```
+depth / density   altricial  — like an infant. Filled in only by real use. Takes a long time.
+basic locomotion  precocial  — like a calf. Works from the moment it is set down.
+```
+
+The two axes are independent, and confusing them is what made this look far away. Aiming at an adult
+(a complete judgment circuit at birth) is **not merely slow — it is unreachable**, because density is
+supplied by usage that has not happened yet. Aiming at a calf is reachable today.
+
+**Operational form**: *born walking* = on the first run, with the user adding nothing, the thing
+produces something useful. This maps onto the existing rungs without inventing a scale —
+`🔵 RC` = it stood up in the lab; `🟢 REALIZED` = it walked outside.
+
+**The opposite of this doctrine has a name we already use: `built-but-not-wired`.** A harness that
+was born but does not walk is one whose parts exist and whose call sites do not — measured instances
+exist (a field harness with a judgment-circuit file and **zero callers**; a sibling meta-harness with
+none at all). So *"born walking"* is not a metaphor about vitality; it is the engineering claim that
+**wiring is part of the birth**, not a follow-up task. Being born and running are different events,
+and the incubator is answerable for the second.
+
+#### What the seed contains — a coordinate system, not a declaration
+
+The seed is **not** an identity sentence. `"You are a world-class QA expert"` is an artifact of the
+prompt-engineering era and is actively harmful here: the 105-run measurement scored a bare identity
+declaration as a **net loss on the weak tier** (removing it recovered +0.67), while a judgment
+circuit gained on the frontier tier. Told only *what it is*, a newborn harness still does not know
+what to do, and the gaps show up as arbitrary decisions.
+
+What a newborn actually needs is closer to *how to see, how to walk, how to speak*:
+
+| Layer | What it fixes | Note |
+|---|---|---|
+| **Seeing** | what counts as a signal at all | inputs — without this the circuit has nothing to run on |
+| **Judging** | success · which way to lean under uncertainty · out of scope · never | = the `judgment-circuit` definition |
+| **Speaking** | how it reports, what shape its output takes | outputs |
+| **Walking** | how it actually executes | wiring, call sites |
+
+Shipping the middle layer alone is the common failure: the circuit is present and has no input or
+output attached, which is exactly the zero-caller symptom above. **Form is machine-checkable today**
+(`scripts/judgment_circuit_lint.sh` — branch rules, self-sealing, conflict resolution, lean
+direction, mandated shape; FH's own `CLAUDE.md` measures `CIRCUIT 4/5`). Density is not, and should
+not be given a scale yet — see 3-a-2.
+
+#### 3-a-1. Field ⊥ meta — and meta is out of this incubator's scope
+
+The two kinds have **opposite profiles**, which is why one method cannot birth both:
+
+```
+field harness   hard to birth (design · seed · wiring)   │ walks on day one      precocial
+meta harness    easy to birth (a declaration starts one) │ needs endless tending  altricial
+```
+
+A meta-harness cannot clear a bar that reads *"walks on day one"* — not because it is worse, but
+because unbounded growth is its point. FH itself is the standing evidence: it is tended continuously,
+by design. **Therefore a meta-harness candidate is not a chamber candidate.**
+
+⚠️ **Retrospective observation, not a finding.** Re-reading the run ledger along this axis: of the
+KILLed candidates, those aimed at chamber-internal metering, hub-internal orchestration, cluster
+wizardry and org relay are all **meta**-shaped, while the single EMIT (`forge-wiki`) is **field**-shaped
+— a tool that does one thing. If that holds, several KILLs were not the chamber being strict but
+**the wrong kind of candidate entering it**. The classification was made *after the fact* by the same
+session that proposed the axis, over n=9; it is a hypothesis to pre-register and predict against, not
+a result. The way to test it is to fix the classification first and call the next run before its
+verdict — the ordering witness now makes that checkable.
+
+**Proposed consequence (not yet applied)**: give the chamber's entry reason a field/meta axis and
+retire meta candidates as **`NOT-APPLICABLE`** rather than `KILL`. Today both land in the same bucket,
+so when the ledger says *"the chamber screens"* it is summing two different events.
+
+#### 3-a-2. Density is measured by comparison, never by an absolute scale
+
+Density — how filled-in a circuit is — has no honest unit. Counting clauses, counting cases, or
+counting how often the circuit answers all measure different things, and picking one invites the
+failure where a metric scores presence instead of the relation it was meant to capture. The way
+around it is to **not define the unit**: clone versions (seed only / seed + some usage / seed + more)
+and run them against one task set **in parallel**, then read the *shape of the curve* rather than any
+version's score. **Where the curve flattens is the interesting point** — that plateau is the practical
+floor for "enough of a soul."
+
+Two conditions carry over from the decorrelation work: the clones must be **independent** (run
+sequentially in one context and the earlier one bleeds into the later), and the **scorer must be a
+different party than the forger**.
+
+🟥 **Named limit — synthesized history yields synthesized density.** Density is defined as accruing
+from *real* use; injecting simulated usage into a clone measures something else, and it can fill in a
+different direction than real use would. So the question this experiment can answer is narrowed on
+purpose: **not** "does the soul grow?" but **"if it grows, where does it plateau?"** That is enough
+for a minimum-condition verdict and does not overclaim.
+
+Internal version comparison gives a **growth curve**; comparison against an outside harness gives an
+**absolute position**. Both are relative, but their reference points differ — and they can share one
+task set, which lets a standing external dominance pre-registration ride along instead of waiting.
+
 ### 3-b. The nursery also verifies what it births
 
 The incubator's arc does not end at emission: FH **reviews, accelerates, and verifies** the harnesses

package/knowledge/shared/harness-core/onboarding_acceleration_autopilot.md

@@ -30,7 +30,9 @@ install plan, and gate every install.**
    But a **live one-command autonomous simulate→EMIT of a field harness is NOT yet a capability**:
    step-4 persona dispatch is human/Claude-driven (bash cannot spawn the isolated Agents — the
    honest muscle boundary), the EMIT terminus is HITL, and **EMIT has never fired — the ledger's
-   real runs are honest KILLs** (the chamber to date *screens*, it has not *birthed*). So today this
+   real runs are honest KILLs** (the chamber overwhelmingly *screens* — 9 full runs, 8 KILL, 1 EMIT, hand-counted 2026-08-08; it has
+   birthed once, but that run left no intent/budget/persona artifacts so the formal flow is not what
+   produced it, and the first end-to-end formal run KILLed). So today this
    branch = a one-line HITL recommendation to run the chamber (`chamber_run.sh`), then fall back to
    Full-Harness Mode §6 (`auto_project_mapping.md`) for the actual onboarding; the runner gates and
    records a human-driven run — it must **not** be presented as a push-button autonomous emit. The

package/knowledge/shared/harness-core/ship_readiness_gate.md

@@ -15,13 +15,32 @@ but zero real emits. So the gate scores **identities by evidence**, and the hone
 | Status | Meaning | Bar |
 |---|---|---|
 | 🟢 GREEN | **REALIZED** | a concrete track-record artifact proves the identity fired for real, n≥1 (a real gate block, a measured probe, a real orchestration record) — *not* a doc that describes it |
+| 🔵 RC | **RELEASE-CANDIDATE** | implemented **and** calibrated on a known pair **and** its own self-test green — but it has not yet fired in a real situation. All three legs, each with an evidence line; two out of three is 🟡 |
 | 🟡 YELLOW | **PARTIAL** | pieces work but no single closed track record (e.g. two half-pipelines that never connected end-to-end) |
 | 🔴 RED | **이상론 (ideal-only)** | documented aspiration, never actually run; or the source itself says "not built yet / named target" |
 
-**All-green rule**: ship + tag only when **every** identity is 🟢. A 🟡 or 🔴 blocks the tag — and names
+**All-green rule**: ship + tag only when **every** identity is 🟢. A 🔵, 🟡 or 🔴 blocks the tag — and names
 exactly what real run is missing. The remedy for RED is never to relabel it green; it is to **run it and
 leave the artifact** (the operator's standing rule: "이상론이면 실제로 돌려봐서 실적을 남겨야 한다").
 
+**🔵 RC is deliberately not green.** It is the rung for "we built it, we proved the instrument works, and
+our own tests pass" — a real and reportable milestone, and *still* short of the bar, because a self-test
+is authored by the same party it tests. The boundary is the one named in
+`[[feedback_adversarial_review_not_substitute_for_first_use]]`: **passing your own tests is not firing in
+the real situation**, and the first real use is repeatedly what invalidates the design. So RC never opens
+a `v1.0.0`; only REALIZED does.
+
+> The origin note (2026-08-08 session card) drew this ladder with RC and REALIZED **both** marked 🟢. That
+> shorthand is fine in a card and breaks here: this gate's rule reads literally as "every identity 🟢 →
+> ship", so a green RC would open the tag that the same note says RC must not open. Distinct symbol, same
+> intent.
+
+**RC is self-reported by construction — so it carries evidence, not a claim.** Each RC status names, on
+one line, *what ran and what came out* (the non-vacuity requirement borrowed from the 4-axis marker's
+`axis2-evidence`: a recorded verdict, count or fixture result — never "it works"). An RC without that line
+is 🟡. Where an instrument could not be calibrated against a real case, the leg ships labelled
+**`UNCALIBRATED`** rather than silently counted (`not found ≠ 0`).
+
 ## Dominance, not concession — the AlexNet bar
 A harness earns the right to say "we compose with other harnesses" **only from proven dominance**, never
 as a humble concession. The reference is AlexNet: on data it had never seen, it did not *participate* — it
@@ -102,26 +121,175 @@ notes claim more green than the audit shows is the defect the gate exists to pre
 the non-all-green status (③⑤ 🟢, ④ 🟡, ①② 🔴), elected to tag `v0.1.0` as this honest baseline; the
 decision is logged here and the tag's notes state the real status.
 
+## The four engines — what has to run for an identity to be reachable at all
+
+An identity is what a harness *claims*; an **engine** is a capability the harness must actually possess
+for that claim to be reachable. They are different axes, and scoring only identities hides *why* one is
+stuck: the failure shows up in the identity and the cause sits in the engine.
+
+| Engine | What it is | Why an identity needs it |
+|---|---|---|
+| **external-grounding** | Asking the world on its own initiative — reaching outside the repo before asserting novelty or settling a design, without being told to | Anything **new** has no known answer inside; asserting `net-new` from an internal grep alone is how a phantom is born |
+| **judgment-circuit** | A forged decision circuit: what counts as success, which way to lean under uncertainty, what is out of scope, what never happens | Anything **autonomous** has no direction without one; the harness fills the vacuum with volume instead |
+| **ship-gate** | Mechanical blocking before an irreversible surface — commit, publish, delete, rewrite | Anything that **ships** needs a last line that does not depend on remembering |
+| **context-continuity** | Not losing the thread mid-run — across compaction, sub-agents, machines and sessions | Anything **long** loses its own premises first, and the loss is silent |
+
+**Naming rule — do not translate `judgment-circuit` as "soul".** In Korean the operator's word is 영혼, but
+the English word reads as *persona*, and the single largest finding of the 105-run measurement behind this
+engine was precisely that **an identity declaration is not a judgment circuit** ("너는 ~이다" measured as a
+net loss; removing it recovered +0.67 on the weak tier). A one-word translation re-fuses exactly what the
+measurement separated.
+
+**Why engines gate the advertised capabilities**: the harness's most-advertised surfaces — incubating a new
+project, orchestrating a multi-harness cluster — are simultaneously *long, autonomous, novel and shipping*.
+They therefore load all four engines at once, which is why a harness with a mature ship-gate and little
+else appears to fail *at* those surfaces while the cause is underneath them.
+
+> ⚠️ **The identity↔engine mapping below was composed by the AI, not measured.** It is a structural
+> hypothesis, not established causality. The way to test it is to bring **one** engine up a rung and watch
+> whether the mapped identity moves; until then, read the column as a claim about *what to try*, not about
+> what is known. (The counterweight matters here: a mapping that looks tidy is the easiest thing to start
+> citing as a finding.)
+
 ## FH's own status (2026-07-14) — NOT yet all-green
 
-| # | Identity | Status | Evidence / what's missing |
+Engine column added 2026-08-08 (mapping is the unverified hypothesis flagged above; Status column is
+unchanged and keeps its own 2026-07-14 evidence).
+
+| # | Identity | Engines it loads | Status | Evidence / what's missing |
+|---|---|---|---|---|
+| ③ | 거버넌스 게이트 (governance) | ship-gate | 🟢 GREEN | pre-commit/pre-push physically block; moat measured 3–4 family blind (HITL 8/8 ABSENT); cross-family caught a real companion-store-name leak 2026-07-14 (fail-closed) |
+| ⑤ | 증폭자 (amplifier) | judgment-circuit | 🟢 GREEN | short-intent→literature-grounding→ultimate-doc real instances; rules-diet −18.2k measured; intent-routing probe 94% (below) |
+| ④ | 프런티어→조직 전파 (**🔵 RC, 2026-08-09**) | external-grounding | 🔵 RC | frontier-digest launchd auto + AX submission docs both real, but digest→org never closed as ONE pipeline. **2026-08-09**: the missing link was built — `scripts/digest_landing_check.sh` extracts the digest's candidate table into probes and reuses the existing landing checker (no second verifier). Self-test 8 lanes green. **🔵 RC (2026-08-09)**: the mtime defect that initially held it back is closed — the since-filter now splits two axes (git-tracked → commit time via `git log --since`; gitignored `tracks/**` → mtime, the only evidence that axis has; dirty-tracked → `UNMEASURED`), and **two lanes pin that split**: a file with only a fresh mtime is *not* counted, and a file with only a fresh commit *is* counted even when its mtime is stale. The second lane matters — without it the fix degenerates into "discard all tracked files so only negatives pass" (named by the cross-family reviewer). Self-test **10 lanes** green. **What remains is a named residual, not a calibration gap**: `file-change ≠ token-introduction` — a file committed after the digest may carry the token from before (closing it needs token-level diff, which does not fit the checker's interface). The instrument therefore prints, and this row states, that it is a **screener, not an adjudicator**: hits must be opened. Four real runs, four hand-verifications, four defects found |
+| ① | 멀티하네스 클러스터 (**🔵 RC, 2026-08-09**) | context-continuity | 🔵 RC | routing already ran for real (17 nodes, sidecar-orchestrator, Skill Bus). **The relay half is now built rather than specified**: `capability_composition_contract.md` (2026-08-02) was a complete spec with **zero implementing code** — the ① blocker was missing wiring, not missing design ([[feedback_built_but_not_wired]]). `scripts/relay_channel.sh` executes it (strictest-wins merge · typed invocation · checks 1/2/3 · short-circuit · causal binding), `scripts/test_relay_channel_lanes.sh` carries **64 lanes, BLOCK/PASS symmetric**, and three arms ran across **two real field harnesses** (pmh-dev · qasp-dev) on FH's own assets. ⭐ **The measured result is the divergence arm, and its mechanism is not what the first draft of this row said.** On `templates/.git-hooks`, `qasp` alone returns exit 0 — a single-node pass would have shipped it — and the composition returns `BLOCKED` because `pmh` returns `FINDINGS`. But `qasp`'s exit 0 is `degrade-scan: no scannable (py/sh) target files`: **zero files were scanned.** The qasp copy predates pmh's 2026-07-28 shebang pass, so extension-less hook files are invisible to it, and its exit 0 means *no target*, not *clean*. So the composition did not catch a substantive disagreement between two harnesses — it caught **a single node rendering an unmeasured surface as a pass**, which is `[[feedback_not_found_is_not_zero_family]]`, and structurally the spec's own §ⓑ.4 B1 ("the exit 0 that means I never started"). That is a *stronger* result than the first framing and a narrower one: it demonstrates the union catching a blind spot, not decorrelated judgment. **Correction also to the order claim**: both orders return `rc=2`, but in the pmh-first order the chain short-circuits at node 1 and qasp never runs — only the qasp-first order actually exercises the union. Non-decorative: reverting each wiring line reddens lanes and no reversion passes silently. **Why this is RC and not 🟢**: (a) the row's *other* half, external-harness recommend, is still parked; (b) the spec's own named gap `scripts/capability_registry_check.sh` (M1–M5 registration + M4 pair) still does not exist — only the call moment is closed; (c) the two nodes are **copies of one scanner at different staleness** (all three copies — pmh 237 ln, qasp 121 ln, FH 269 ln — share a byte-identical 12-line header; the clean arm's two `out_sha` were identical), so the run proves the channel turns and that composing unequal copies has value, not that two independent judgments were decorrelated. Artifact: `tracks/_meta/identity_audit_2026-08-09_relay_channel.md` |
+| ② | 프로젝트 인큐베이터 (**🔵 RC, 2026-08-09**) | context-continuity + judgment-circuit | 🔵 RC | **RC 세 다리가 섰다** — (a) 구현: `chamber_run.sh` 6단계 게이트 (b) known-pair: 러너 게이트 **18 레인**(`test_chamber_run_lanes.sh`, BLOCK/PASS 대칭 — PASS arm 이 있어야 "전부 막는 게이트"도 걸린다) + 순서 증인 **16 레인**(`chamber_witness.sh`) (c) self-test 초록. **실상황 발화 대기 = formal chamber EMIT 아직 0** — 그것이 RC 가 🟢 이 아닌 이유이자 RC 정의 그 자체다. ⚠️ **그 0 의 해석이 2026-08-09 에 바뀌었다**: 지금까지 *"챔버가 엄격해서"* 로 읽었으나, KILL 된 후보 다수가 **메타-형** 이고 유일한 EMIT(`forge-wiki`)만 **필드-형** 이다 — 즉 *낳을 수 없었던* 게 아니라 **애초에 대상이 아닌 후보가 들어왔을** 가능성이 있다. 필드 ⊥ 메타 프로파일과 씨앗(precocial) 기준 정의: `harness_incubator_doctrine.md §3-a`. ⚠️ 그 분류는 **사후에 이뤄졌고 n=9** 라 가설이다 — 사전 등록 후 다음 런을 예측해야 결과가 된다. 아래 옛 판정 줄은 이력으로 남긴다 |
+| ②-old | (이력) 프로젝트 인큐베이터 | context-continuity + judgment-circuit | 🟡 PARTIAL | incubation is running — **stockbattle is being incubated now** (S1 built, mid-flight) + qasp/pmh spin-out precedent + scaffold-emit shipped (doctrine: "emit shipped today as scaffold+approval; the chamber flow is the named target"). **Corrected 2026-08-08** (the old text read "6 runs, 6 KILL … 0/6", which was stale on both counts, and the ledger itself was missing a run): hand-counted from `tracks/_chamber/INDEX.md` — **9 full runs (#2–#10), 8 KILL, 1 EMIT** (#1 is a trigger probe, not a full run). Runs #5–#6 *measured* the emit-worthiness criterion (net-new ∧ artifact-shaped ∧ real-data-precision-adequate ∧ hub-state-independent); run #6 confirmed the graduation-order principle — hub-internal proof before standalone extraction, never the reverse. **The 🟡 is now held for a different reason than before.** The old reason ("no closed emit-via-incubation yet") is false: run #9 `forge-wiki` emitted and shipped publicly under operator approval with the Pre-Publish gate passed. What is *not* proven is that the **formal chamber flow** produced it — that run's workspace holds only an `EMISSION_VERDICT.md`, with no `INTENT.md`, `BUDGET.md` or `SIM_NOTES.md`, so the intent/budget/blind-persona gates have no artifact and the verdict was written after the fact. The first run to complete the formal flow end-to-end is #10 (2026-08-08, 3 blind isolated personas) and it KILLed. So: **the identity has fired once, the mechanism has not yet been shown to be what fired it**, and the dominance result every 🟢 owes is still outstanding → 🟡 |
+
+### ② promotion criteria — and what the criteria themselves turned out not to be able to check
+
+②'s 🟡 has been re-argued on different grounds each round, every round re-deriving the bar from scratch.
+This section exists so the next round starts from a stated condition. **A first draft of it was refuted by
+cross-family review before it was committed**, and the refutation is more useful than the draft was, so
+both are recorded.
+
+**What the draft got wrong.** It scored run #9 `forge-wiki` as **P1 FAIL** on the grounds that its
+workspace holds only `EMISSION_VERDICT.md` — no `INTENT.md`, `BUDGET.md`, `SIM_NOTES.md`. But that
+verdict file *contains* the substance those files would hold: the net-new determination (two survey
+generations, 15+ systems / 6 standards cross-checked), the artifact-shaped determination, and the
+real-code precision leg with a raw-data anchor (`forge-wiki/tests/sim_data_2026-07-18/`, N=50 concurrent
+writers, A/B/C design contrast, reps=3, contaminated reps voided and re-run). Absent **files** were read
+as an absent **gate** — `[[feedback_not_found_is_not_zero_family]]`, committed by the very section citing
+the rule it broke. The honest score for #9 is **UNKNOWN**, not FAIL.
+
+**What actually holds ② at 🟡, once the formalism is stripped out.** Not the missing filenames — the
+missing **ordering witness**. The claim that would promote ② is *the mechanism screened this, and then it
+emitted*; what #9 can show is *it emitted, and a verdict describes screening*. Nothing distinguishes a
+gate that ran before the outcome from a record written after it.
+
+**And that witness cannot currently be produced.** `tracks/**` is gitignored (`.gitignore:40` — verified
+per file with `git check-ignore -v`), so no chamber artifact is under version control, and mtimes are the
+only ordering evidence there is. Mtimes are trivially forgeable. So the draft's own check — "written
+*before* the verdict, compare mtimes" — **cannot be satisfied by any run, honest or not**. It was an
+unreachable condition, which is the shape that trains people to delete the thing being counted
+(`[[feedback_unreachable_done_when_trains_evasion]]`).
+
+**So the promotion condition is one thing, and it is a build, not a check:**
+
+| | Condition | Check class | Status |
 |---|---|---|---|
-| ③ | 거버넌스 게이트 (governance) | 🟢 GREEN | pre-commit/pre-push physically block; moat measured 3–4 family blind (HITL 8/8 ABSENT); cross-family caught a real companion-store-name leak 2026-07-14 (fail-closed) |
-| ⑤ | 증폭자 (amplifier) | 🟢 GREEN | short-intent→literature-grounding→ultimate-doc real instances; rules-diet −18.2k measured; intent-routing probe 94% (below) |
-| ④ | 프런티어→조직 전파 | 🟡 YELLOW | frontier-digest launchd auto + AX submission docs both real, but digest→org never closed as ONE pipeline |
-| ① | 멀티하네스 클러스터 | 🟡 PARTIAL | routing runs for real — 17 nodes mapped, sidecar-orchestrator, Skill Bus routing qasp/dashboard/stockbattle (so NOT 🔴 ideal-only). Missing: continuous 2-node relay channel + external-harness recommend (cluster-wizard parked) → 🟡 not 🟢 |
-| ② | 프로젝트 인큐베이터 | 🟡 PARTIAL | incubation is running — **stockbattle is being incubated now** (S1 built, mid-flight) + qasp/pmh spin-out precedent + scaffold-emit shipped (doctrine: "emit shipped today as scaffold+approval; the chamber flow is the named target"). What's still 0 is the **formal chamber simulate-then-emit** mechanism (6 runs, 6 KILL — runs #5–#6 *measured* the emit-worthiness criterion: net-new ∧ artifact-shaped ∧ real-data-precision-adequate ∧ hub-state-independent, 0/6 cleared all four; run #6 also confirmed the graduation-order principle — hub-internal proof before standalone extraction, never the reverse). That mechanism is ONE path of ②, not the whole identity → 🔴 was too narrow; incubation runs but no closed emit-via-incubation yet → 🟡 |
+| **P1** | An EMIT run leaves an ordering record that does not depend on trusting the author — the intent/budget/sim record committed, hashed, or otherwise witnessed **outside** the gitignored workspace, before the verdict | mandatory-pass | **channel now exists (2026-08-08)** — `scripts/chamber_witness.sh`, wired into `chamber_run.sh` steps 2–5. **Still unsatisfied**: no run holds a witness yet |
+
+**P1's channel was built, and that is not the same as P1 passing.** The row above said *not buildable
+today*; that is no longer true, and the reason it was true is worth keeping because it names the shape of
+the fix. The blocker was never "we lack a checker" — it was that `tracks/**` is gitignored, so the only
+ordering evidence was mtime, which is trivially forgeable. The channel takes the **second form P1's own
+sentence already permitted — `hashed`**: the artifacts stay in the private workspace and only their
+SHA-256 goes into a tracked ledger (`knowledge/shared/learnings/chamber_ordering_witness.yaml`). Content
+disclosure is zero, and the commit graph carries the ordering.
+
+**What makes the witness bind here specifically**: `main` runs a `non_fast_forward` ruleset, so pushed
+history cannot be rewritten — the commit order is not something the author can retroactively change. That
+is a *precondition*, not a property of the script: if the ruleset is ever relaxed, this witness weakens
+with it, and that dependency is recorded in the script header rather than assumed.
+
+**What it does NOT prove — stated because the failure to state it is the defect this section exists for.**
+A commitment proves *this content was fixed at this time*. It does not prove *the author was honest*: one
+can still decide the outcome first and write an INTENT to match before committing. The attack it closes is
+**retroactive rewriting** — producing a verdict and then editing INTENT to claim it was screened — and
+`verify` returns `TAMPERED` for exactly that (calibrated lane, not a claim).
+
+**Known-pair calibrated, 16 lanes**: correct order → `WITNESSED(0)` · verdict-committed-first →
+`UNORDERED(1)` · post-hoc rewrite → `TAMPERED(1)` · unrecorded run → `UNWITNESSED(2)` · recorded but
+uncommitted → `PENDING(2)` · missing artifact / bad slug charset / ledger-write failure → `rc=10` ·
+verdict hash absent → `INCOMPLETE(2)` · gates and verdict in the **same commit** → `UNORDERED(1)` ·
+only *some* gate artifacts before the verdict → not a pass · a duplicate hash from another run →
+does not hide `PENDING` · single-arg call → survives · control → still 0.
+**`2` is not a pass** — `not found ≠ 0` is enforced in the exit code itself, so a caller cannot read
+"no record" as "no problem".
+
+**Seven of those lanes exist because a cross-family audit found the first version fail-open**, and the
+finding rate is the point: the author's own review produced **zero** of them. codex (gpt-5.5) returned 11
+defects with source lines and **reproduced four of them by execution** — a ledger write to an invalid path
+still printed `witnessed` and returned 0; gates and verdict in one commit passed; `INTENT` alone before the
+verdict passed while `BUDGET`/`SIM_NOTES` landed after it; and a hash reused from another run masked an
+uncommitted entry. Worst of all, **a run with no verdict hash at all returned `0`, which the runner rendered
+as "usable as identity ② promotion evidence"** — the witness channel issuing a green with no witness, which
+is the exact failure it was built to prevent. Each fix carries a lane, and two were proven non-decorative by
+revert (reverting either reddens exactly one lane, 1/16).
+
+**The nine historical runs stay `UNWITNESSED`, and are not back-filled.** Hashing them now would record
+the artifacts as they are *today*, after their verdicts — a record written after the outcome, which is
+precisely the thing the witness exists to distinguish. Back-filling would produce a ledger that looks
+witnessed and proves nothing. So run #9 `forge-wiki` remains **UNKNOWN** on ordering, as the section above
+already concluded, and P1 is first satisfiable by the **next** chamber run.
+
+**P2 (dominance) is deliberately NOT listed**, and the reason is a finding about the gate rather than
+about ②. The draft required it, citing §"Gate consequence". Checked against the table: ③ does carry a
+dominance result (moat measured 3–4 family blind, HITL 8/8 ABSENT), but **⑤ is 🟢 on `intent-routing
+probe 94%` — a self-measurement, not a head-to-head**. Requiring dominance of ② while ⑤ holds 🟢 without
+it is a bar invented for one row. The inconsistency is real and it is **the gate's, not ②'s**: either
+§Gate-consequence binds every 🟢 and ⑤ is over-scored, or it is advisory and ② must not be held to it.
+Resolving that is a separate change to the status definitions — flagged here, not silently settled by
+scoring ② against a rule the table does not apply uniformly.
+
+**Recurrence count, stated precisely because the draft muddled it.** The 🟡 has been re-argued **three**
+times; "promotion attempted without stated criteria" has been *recognized as a problem* **once** (today).
+Those count different things, and the draft cited N=1 while asserting three re-arguments in the same
+paragraph. Neither number licenses a checker right now — P1 is not implementable at all until the
+ordering channel exists, so there is nothing to mechanize yet.
 
 **Cross-cutting measured (intent-based autonomous completion)**: blind floor-tier Sonnet trigger-accuracy
 probe (n=10, 2026-07-14): **should-fire 7.5/8 (94%), false-fire 0/2**. One weak trigger (simulate-first /
 incubator entry absorbed into deep-clarify) — the identity-② weakness surfaces in routing too.
 
-**Verdict (2026-07-14, ①② corrected)**: FH is tagged **`v0.1.0` = honest baseline**, not all-green. ③⑤ are
-🟢, ①②④ 🟡, **none 🔴** — the `v0.1.0` notes state this and make no all-green claim (per the refined 0.x↔1.0
-mapping above). **`v1.0.0` remains the all-green target.** What blocks v1.0 is **closing the 🟡s**: ①'s
-continuous 2-node relay channel, ②'s first closed emit-via-incubation (formal chamber first EMIT — criterion
-measured in run #5 — or a chamber-incubated spin-out closing), ④'s closed digest→org pipeline. Each remedy
-is a run that leaves an artifact, tracked in `tracks/_meta/identity_audit_*.md`.
+> **이 표가 다루는 것은 3층 중 한 층이다.** 5대 정체성이 무엇을 받치고(4대 엔진) 무엇으로
+> 벼려지는지(3단 공정)는 `fh_three_layer_canon.md` 가 정본이다. **이 표의 `engine` 열이 곧
+> 4대 엔진**이며(judgment-circuit=영혼 · ship-gate=품질게이트 · context-continuity=맥락유지 ·
+> external-grounding=질문하기), 그 대응은 새로 만든 것이 아니라 이 표에 이미 있던 것이다.
+
+**Verdict (2026-08-09 — supersedes the 2026-07-14 line)**: FH is tagged **`v0.1.0` = honest baseline**,
+not all-green. ③⑤ are 🟢, **①②④ are 🔵 RC**, **none 🔴** — the `v0.1.0` notes state this and make no
+all-green claim (per the refined 0.x↔1.0 mapping above). **`v1.0.0` remains the all-green target.**
+
+> *Why this paragraph is being rewritten rather than edited in place*: it read **"①②④ 🟡"** for three
+> sessions **after** the rows above had moved — ② to RC on 2026-08-09 (PR #281), ④ on 2026-08-09
+> (PR #283), ① in this run. Each session corrected its own row and left the summary alone, which is
+> `[[feedback_half_fix_propagation_boundary]]` inside a single file: the propagation boundary is not
+> only "other files", it is **every place in this file that restates the same fact**. A summary that
+> contradicts its own table is worse than no summary, because it is the line a reader quotes.
+
+What now blocks `v1.0` is **closing the 🔵s** — RC means the mechanism stands in the lab, 🟢 means it
+walked outside:
+
+```
+①  external-harness recommend (cluster-wizard, still parked) · capability_registry_check.sh
+   (registration-moment M1–M5, named by the spec, still absent) · a run across two genuinely
+   different capabilities rather than two forks of one scanner
+②  a formal chamber EMIT — the mechanism firing in a real situation, not a retrofitted verdict
+④  file-change ≠ token-introduction — the instrument is a screener, not an adjudicator
+```
+
+Each remedy is a run that leaves an artifact, tracked in `tracks/_meta/identity_audit_*.md`.
 
 > **①② correction (2026-07-14)**: an earlier pass marked ①② 🔴 by collapsing each identity onto its most
 > advanced *single mechanism* — ② onto the formal chamber EMIT (0/5), ① onto the continuous-relay channel.