@chrono-meta/fh-gate 1.4.89 → 1.4.90

package/plugins/fh-meta/skills/auto-decorrelation/SKILL.md

@@ -197,13 +197,54 @@ mode**, with an honest *same-family* note but **no "reduced value / degraded" fr
 this floor. `unset` → ask-once at first load-bearing need (accept → proceed; decline → record + this
 branch). Only proceed to the discovery ladder below when consent is `accepted`.
 
-1. frontier cross-family CLI present → recruit it (decorrelated, at-floor) — best.
-2. only local 4090 present → canary pre-screen + in-session opus governor (canary, not full decorrelation).
-3. nothing present → in-session same-family + **honest below-floor/same-family note** (residual named).
-
-Env non-determinism (CLI presence varies) → **silent degrade, never hard-fail**. Distinguish this
-**unavailable-but-wanted** case (consent given, panel down → degrade-with-note; for a *load-bearing corp*
-surface, fail-closed per `local_pmh_context.md`) from the **declined** case above (chosen floor, first-class).
+Every rung **emits a typed `crossfamily:` value into the Axes 2–3 marker** — the rung is not
+done until its verdict is recorded. The value is a closed enum, validated by `pre-commit`
+(`validate_marker_floor`, fixtures in `scripts/test_marker_crossfamily_lanes.sh`); free prose is
+rejected at commit time.
+
+| # | Panel state | Emit | Ack |
+|---|---|---|---|
+| 1 | frontier cross-family CLI present → recruit it (decorrelated, at-floor) — best | `panel(<families>)` | — |
+| 2 | only local 4090 → canary pre-screen + in-session opus governor (canary, not full decorrelation) | `panel(<families>)` **only if** a capable non-Claude model actually reviewed; otherwise rung 3 | — |
+| 3 | **probed and nothing capable reachable** → in-session same-family | `DEGRADED_SINGLE_FAMILY` | **required** |
+| — | **capable panel reachable, not recruited** (a choice, not a constraint) | `DEGRADED_PANEL_UNUSED` | **required** |
+| — | consent `declined` (branch above — chosen floor, not a degrade) | `declined` | — |
+| — | change is not load-bearing — decorrelation not required | `single-family` | — |
+| — | **panel never probed** | `UNKNOWN` | **required** |
+
+**The three degrade values are the load-bearing split**: *could not* (`DEGRADED_SINGLE_FAMILY`) ·
+*did not* (`DEGRADED_PANEL_UNUSED`) · *did not look* (`UNKNOWN`). Free prose merges all three, and
+each merge hides a different thing — an unrun probe renders as a zero finding
+(`[[feedback_not_found_is_not_zero_family]]`), and an unused panel renders as an unavailable one.
+The sibling-harness signal that motivated this field said it in its own words about itself:
+*"못 한 것이 아니라 안 한 것이다."* All three require an ack naming *what was probed and what it
+returned*. **`DEGRADED_PANEL_UNUSED` was added by dogfooding**: the first real marker written under
+this lane found the panel reachable (codex · agy · gemini) and no cross-family review run — a state
+the original five-value enum could not express without lying
+(`[[feedback_adversarial_review_not_substitute_for_first_use]]`).
+
+**Panel membership is capability-gated, and ineligibility is tested FIRST.** A runtime `/models`
+list is a **serving** list, not a generative one. Measured in a sibling harness (2026-08-08): 6 of
+14 served entries could not review anything (embedding · reranker · OCR · safeguard), and because
+the embeddings' ids matched no family prefix **each counted as its own family — satisfying the
+family-diversity check while the panel was incapable**. Order is the invariant, not the list:
+`GLM-OCR` matches both `ocr` and `glm`, `Qwen3-Embedding` matches both `embed` and `qwen`, so an
+eligibility-first test lets them through silently. If nothing capable survives the filter, that is
+rung 3 — **not** a smaller panel.
+
+**Attribution: `panel(...)` records the families *requested*, not confirmed.** At least one
+procurement path (an internal corp-gateway CLI) returns **no model attribution in its response**, so "3/3 responded"
+does not establish which model contributed. Record request-fact and response-fact separately; do not
+launder the former into the latter (`[[feedback_instrument_cannot_discriminate_hypotheses]]`).
+
+Env non-determinism (CLI presence varies) → **never hard-fail the run** — but never *silent* either.
+The two are different properties, and the prose this replaces conflated them: the degrade proceeds
+(a commit is a reversible surface) **and** lands in the verdict with an ack. That is how this rung
+and `CLAUDE.md` §Field-Harness gate ("never a silent same-family pass") are simultaneously true.
+Distinguish the **unavailable-but-wanted** case (consent given, panel down → `DEGRADED_SINGLE_FAMILY`
++ ack; for a *load-bearing corp* surface, fail-closed per `local_pmh_context.md` — note that file is
+**pmh-repo-local and unreadable from an FH session**, so on this side the typed value + ack is the
+enforceable layer) from the **declined** case above (chosen floor, first-class, no degrade framing).
 
 ## Step 7 — Output
 
@@ -221,7 +262,14 @@ at N per run (no loop).
 
 - Mechanical sidecar discovery returns the available panel. *[mandatory-pass]*
 - Family-diversity recruitment picks ≥1 cross-family verifier when present (family by model probe). *[mandatory-pass]*
-- Degrade ladder applied: local-only → canary+note · none → same-family note. *[mandatory-pass]*
+- Degrade ladder applied AND its verdict emitted as a typed `crossfamily:` value in the Axes 2–3
+  marker (`panel(<families>)` | `declined` | `DEGRADED_SINGLE_FAMILY` | `DEGRADED_PANEL_UNUSED` |
+  `UNKNOWN`); the three degrade values carry substantive grounds on the same line. `single-family`
+  is NOT accepted on a load-bearing change — that block only runs there, so "decorrelation not
+  required" is a contradiction, and as a no-ack pass it was a free bypass of the lane.
+  *[mandatory-pass — enforced by pre-commit, fixtures `scripts/test_marker_crossfamily_lanes.sh`]*
+- Panel members are review-capable: embedding/reranker/OCR/safeguard classes are excluded **before**
+  family-diversity is counted, never after. *[mandatory-pass — same fixtures, ordering anchor c4/c5]*
 - Paid recruit was per-run spend-gated (or `paid_auto` set); free local tier may auto-fire. *[mandatory-pass]*
 - Governor (CC) retains terminal verdict; every accepted sidecar finding is source-grounded. *[judged, pair: judge-robustness / phantom-quench back-trace]*
 - Marker records panel + families only with a captured sidecar transcript. *[mandatory-pass]*

package/plugins/fh-meta/skills/install-wizard/SKILL.md

@@ -170,6 +170,39 @@ Execution priority (behavioral):
 
 > **Detail**: See `SKILL_detail.md §Step3-Execution` — action preview example, FH plugin auto-install bash + error handling table + success format, agent-composer mapping update format — read when executing Step 3.
 
+### Step 3-D. Dispatch Standing Request — the one moment this is cheap to settle
+
+FH/PMH treat isolated delegation as part of what the harness is, so **parallel dispatch is the
+intended default for anyone running them**. It is not default *by assertion*: some runtimes ship a
+line making unprompted dispatch conditional on a user request, and `CLAUDE.md §Agent Dispatch
+Operation` will not read that condition as met unless a standing request is on disk. **A session with
+no such record asks before every dispatch** — which is the friction this step exists to remove, once,
+here, instead of in every future session.
+
+So ask, and write the answer down. Three parts, all required — a record missing one is not a record,
+and a session may never supply the missing part itself:
+
+```
+① the user's own words, quoted   — ask them to say it, then quote what they said
+② a lease                        — THE USER picks the length. Do not suggest a default and
+                                   do not fill it in. Renewal needs a fresh utterance later
+③ a scope                        — which prohibition line this covers. Granting one never
+                                   grants another (agents ≠ workflows ≠ deep-research):
+                                   name each one the user actually intends
+```
+
+Write it into `CLAUDE.local.md` (gitignored). **Declined is a valid, recorded answer** — write that
+down too, so later sessions stop re-asking rather than reading silence as an unanswered question.
+
+**Any mechanical settings change belongs here as well**, under the same consent: if enabling the
+intended default needs a `settings.json` edit, propose it in this step with the diff shown, and apply
+it only on approval. Do not change settings silently on the strength of the doctrine alone — the
+doctrine says dispatch is the default posture, not that the wizard may edit a user's config unasked.
+
+⚠️ **The lease is honoured by reading, not by machinery.** `scripts/consent_registry_check.sh`
+enforces leases for *registered consent classes*, and this grant is not one of those — say so when
+recording it rather than implying an expiry alarm exists.
+
 ### Step 4. Acceleration Baseline Setup
 
 After executing approved items, install the automatic maintenance structure: zshrc hook (idempotent, preview-then-confirm) + sentinel initialization (per-project) + weekly-audit cadence (no cron — zshrc hook + session-start detection are the durable mechanisms).

package/plugins/fh-meta/skills/install-wizard/SKILL_detail.md

@@ -526,31 +526,120 @@ fi
 # scripts/package_coverage_check.sh caught the omission — without it an npm-installed wizard hit
 # FileNotFoundError here and registered nothing while reporting success upstream).
 python3 - "$FH_DIR" <<'PY'
-import json, os, sys, collections
+import json, os, sys, glob, collections, re, shutil
 hub = sys.argv[1]
-snippet = os.path.join(hub, "templates", "settings.SessionStart.snippet.json")
 target = os.path.join(hub, ".claude", "settings.json")
-entry = json.load(open(snippet))["project_settings_json"]["hooks"]["SessionStart"]
+
+# DISCOVER every shipped snippet, do not name one. Hardcoding a single snippet path is why the
+# compaction hooks shipped unwired while their own README recited the shipping-is-not-wiring lesson
+# (high review, 2026-08-08 — and PreToolUse was already sitting in the same hole, so N=2).
+# A new templates/settings.*.snippet.json is picked up with zero edits here: generation, not detection.
+snippets = sorted(glob.glob(os.path.join(hub, "templates", "settings.*.snippet.json")))
+if not snippets:
+    # exit 1, NOT 0. The pre-rewrite code raised FileNotFoundError here, and that loud failure is what
+    # made a broken npm `files[]` detectable — the comment above records it happening for real once.
+    # The first rewrite replaced it with a quiet exit 0, i.e. it deleted the detector while keeping the
+    # bug (high re-review 2026-08-08 #1). Zero snippets means zero hooks registered; that is never a
+    # success, and every other zero-registration path below already exits 1.
+    print("NO SNIPPETS under templates/settings.*.snippet.json — zero hooks registered.")
+    print("  → package `files[]` may have dropped templates/, or this is not an FH hub. NOT a success.")
+    raise SystemExit(1)
+
 d = collections.OrderedDict()
 if os.path.exists(target):
     d = json.load(open(target), object_pairs_hook=collections.OrderedDict)
-    import shutil; shutil.copy2(target, target + ".prewizard")   # back up before rewriting
+    shutil.copy2(target, target + ".prewizard")          # back up before rewriting
 hooks = d.setdefault("hooks", collections.OrderedDict())
-# Merge at HOOK level, not group level. A group-level filter drops the whole group when a user's own
-# hook shares a group with the FH one — the common shape when someone hand-edits or appends to an
-# older wizard's output. (Cross-family review 2026-07-30 reproduced the loss: a group holding
-# [my_telemetry.sh, fh_session_load.sh] lost my_telemetry.sh entirely.)
-kept = []
-for g in hooks.get("SessionStart", []):
-    survivors = [h for h in g.get("hooks", []) if "fh_node_check" not in h.get("command", "")]
-    if survivors:
-        g = dict(g); g["hooks"] = survivors; kept.append(g)
-hooks["SessionStart"] = kept + entry
+
+def fh_keys(entry_groups):
+    """FH script basenames this snippet owns — the replace key is DERIVED from the snippet's own
+    commands, never hardcoded, so it cannot drift from what is actually being installed."""
+    # Key on the snippet's own PATH FORM (scripts/<name>.sh), not a bare basename. A bare basename
+    # made the survivor filter delete a user's own hook that merely shared a filename — e.g. their
+    # ~/tools/compaction_probe.sh — which is the exact loss the hook-level merge exists to prevent,
+    # reintroduced through key derivation (high re-review 2026-08-08 #2).
+    keys = set()
+    for g in entry_groups:
+        for h in g.get("hooks", []):
+            for m in re.findall(r'((?:[A-Za-z0-9_\-]+/)*scripts/[A-Za-z0-9_\-]+\.sh)', h.get("command", "")):
+                keys.add("scripts/" + m.rsplit("scripts/", 1)[1])
+    return keys
+
+registered, bad_schema, intended = [], [], {}
+for snip in snippets:
+    try:
+        blob = json.load(open(snip))
+    except Exception as e:
+        print("SKIP (unparsable):", os.path.basename(snip), e); bad_schema.append(snip); continue
+    proj = (blob.get("project_settings_json") or {}).get("hooks") or {}
+    if not proj:
+        # settings_local_json_MODE_D_ONLY entries carry private paths — never auto-written here.
+        print("SKIP (no project_settings_json):", os.path.basename(snip)); bad_schema.append(snip); continue
+    for event, entry in proj.items():
+        # Shape-validate before touching the user's file. A valid-JSON / invalid-SCHEMA snippet used
+        # to be written anyway and reported as success, then detonate on the NEXT run inside the
+        # survivor filter — far from the snippet that caused it (lanes BS-*, LT-*).
+        if not isinstance(entry, list) or not all(
+                isinstance(g, dict) and isinstance(g.get("hooks"), list) for g in entry):
+            print("SKIP (bad schema):", os.path.basename(snip), event); bad_schema.append(snip); continue
+        keys = fh_keys(entry)
+        if not keys:
+            print("SKIP (no FH script in commands):", os.path.basename(snip), event)
+            bad_schema.append(snip); continue
+        intended[event] = intended.get(event, set()) | keys
+        # Merge at HOOK level, not group level. A group-level filter drops the whole group when a
+        # user's own hook shares a group with the FH one (cross-family review 2026-07-30 reproduced
+        # the loss: [my_telemetry.sh, fh_session_load.sh] lost my_telemetry.sh entirely).
+        kept = []
+        for g in hooks.get(event, []):
+            survivors = [h for h in g.get("hooks", [])
+                         if not any(k in h.get("command", "") for k in keys)]
+            if survivors:
+                g = dict(g); g["hooks"] = survivors; kept.append(g)
+        hooks[event] = kept + entry
+        registered.append(f"{event}({','.join(sorted(keys)) or '?'})")
+
 os.makedirs(os.path.dirname(target), exist_ok=True)
 with open(target, "w") as fh:
     json.dump(d, fh, indent=2, ensure_ascii=False); fh.write("\n")
-print("node-check SessionStart hook registered ->", target)
+# RE-READ WHAT WE JUST WROTE. The success message used to be unconditional — it never checked the
+# serialized result, so a snippet that failed to register still printed "registered ->". Verify, then
+# claim (`[[feedback_gate_verification_must_execute]]`).
+written = json.load(open(target))
+missing = []
+for event, keys in intended.items():
+    blob = json.dumps(written.get("hooks", {}).get(event, []))
+    for k in sorted(keys):
+        if k not in blob:
+            missing.append(f"{event}:{k}")
+for r in registered: print("    hook registered ->", r)
+print("snippets scanned:", len(snippets), "· hook entries registered:", len(registered),
+      "· skipped:", len(bad_schema), "->", target)
+if missing:
+    print("FAILED to register:", ", ".join(missing)); raise SystemExit(1)
+# FAIL CLOSED on any skipped snippet. The good ones are already written (a malformed sibling must not
+# cost you the working hooks), but the RUN exits non-zero — an installer that skips a snippet and
+# reports success leaves hooks unwired, which is the exact defect this rewrite exists to close.
+# Lanes MG-N1..N4 caught this: the first draft skipped-and-exited-0 = fail-open.
+if bad_schema:
+    print("SKIPPED snippet(s):", ", ".join(sorted({os.path.basename(b) for b in bad_schema})))
+    print("  → non-zero exit on purpose: a skipped snippet is unregistered hooks, not a warning.")
+    raise SystemExit(1)
+if not registered:
+    print("no hook entries registered — nothing to claim"); raise SystemExit(1)
 PY
+# CONSUME the merge block's exit status. It raises SystemExit(1) on a skipped/failed registration,
+# and the surrounding bash has no `set -e` — so without this check the wizard sailed past a failed
+# registration and §Step5 still printed success, which is the exact "reports success while unwired"
+# shape the fail-closed direction was added to prevent (high re-review 2026-08-08 #6).
+# The failure is SURFACED, not swallowed: the operator sees which snippet did not register.
+_MERGE_RC=$?
+if [ "$_MERGE_RC" -ne 0 ]; then
+  echo "🟥 hook registration FAILED (exit $_MERGE_RC) — one or more snippets are UNREGISTERED."
+  echo "   Do not read the completion report below as 'hooks are wired'. Fix the snippet and re-run"
+  echo "   this step; the rest of the wizard continues so the remaining setup is not lost."
+  WIZARD_HOOK_REG_FAILED=1
+fi
 chmod +x "$FH_DIR/scripts/fh_node_check.sh" 2>/dev/null
 # VERIFY against a THROWAWAY state file (FH_NODE_STATE). Verifying against the real state would
 # consume the user's one-shot event report, so their actual first session goes quiet and the notice

package/scripts/chamber_run.sh

@@ -43,6 +43,25 @@ TODAY="$(date +%Y-%m-%d)"
 _status() { [ -f "$STATUS_F" ] && cat "$STATUS_F" || echo "step-0"; }
 _stamp()  { printf '%s\n' "$1" > "$STATUS_F"; }
 
+# ── 순서 증인 (ship_readiness_gate §② P1) ────────────────────────────────────
+# 워크스페이스는 `tracks/**` 라 gitignored 다. 그래서 게이트 아티팩트의 **해시만**
+# 추적되는 원장에 적어 커밋한다 — **본문** 유출 0(단 slug·파일명·시각·해시는 남는다),
+# 순서는 로컬 커밋 그래프가 증언(되쓰기 방지는 push 후 서버 ruleset 이 준다).
+# 기록 실패는 **런을 막지 않는다**(KILL 런까지 세우는 건 과차단이고, 과차단은
+# override 를 습관화시킨다). 대신 증인 부재를 **말한다** — 조용히 넘어가지 않는다.
+_WITNESS="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/chamber_witness.sh"
+_witness_record() { # $1 = artifact path
+  if [ ! -x "$_WITNESS" ] && [ ! -f "$_WITNESS" ]; then
+    echo "    ⚠️ 순서 증인 미기록 — chamber_witness.sh 부재 (이 런은 ② 승격 근거로 못 쓴다)"
+    return 0
+  fi
+  if bash "$_WITNESS" record "$SLUG" "$1" >/dev/null 2>&1; then
+    echo "    ↳ 순서 증인: $(basename "$1") 해시 기록됨 — **커밋해야** 증인이 된다"
+  else
+    echo "    ⚠️ 순서 증인 기록 실패: $(basename "$1") (증인 없음 — 미측정이지 0이 아니다)"
+  fi
+}
+
 if [ "$CMD" = "status" ]; then
   echo "chamber run '$SLUG' → STATUS: $(_status)"
   [ -d "$WS" ] && ls -1 "$WS" 2>/dev/null | sed 's/^/    /'
@@ -85,9 +104,18 @@ fi
 # gate (a) is "artifact exists WITH real content", not just "placeholder removed" (Axis-2 LOW-6): require
 # at least one non-empty numbered success condition so a gutted INTENT.md doesn't pass.
 if ! awk '/^## Success conditions/{f=1;next} /^## /{f=0} f && /^[0-9]+\.[[:space:]]*[^[:space:]]/{print; exit}' "$WS/INTENT.md" | grep -q .; then
-  echo "  ⛔ step 2 BLOCKED: $WS/INTENT.md has no filled success condition (need a numbered line with content), re-run."; exit 1
+  # 계약을 **에러 메시지가 가르친다.** 이 형식은 CHAMBER_RUN_SKELETON.md 에 한 글자도 없어서,
+  # 스켈레톤만 읽고 쓴 INTENT 가 반려됐다 — gate-locality(계약이 게이트 구현에만 산다).
+  # 같은 런에서 step 6 도 같은 이유로 막혔다(N=2). 문서는 드리프트하지만 에러는 코드와 같이 산다.
+  echo "  ⛔ step 2 BLOCKED: $WS/INTENT.md has no filled success condition."
+  echo "     Expected — an English heading, then NUMBERED lines with content:"
+  echo "       ## Success conditions"
+  echo "       1. <condition> · [measured|mandatory-pass|judged]"
+  echo "       2. ..."
+  echo "     A table alone does NOT satisfy this check. Re-run after adding it."; exit 1
 fi
 _stamp "step-2-done"; echo "  ✓ step 2: INTENT.md present"
+_witness_record "$WS/INTENT.md"
 
 # STEP 3 — budget-entry gate (G2). Cannot invoke goal-quench from bash; MECHANICALLY require a recorded
 # estimate before any (expensive) simulation runs. No ESTIMATE = no run — that IS the entry cap.
@@ -106,6 +134,7 @@ if grep -qE '^ESTIMATE:[[:space:]]*<' "$WS/BUDGET.md" || ! grep -qE '^ESTIMATE:[
   echo "  ⛔ step 3 BLOCKED: $WS/BUDGET.md ESTIMATE is empty/placeholder (G2 entry cap), then re-run."; exit 1
 fi
 _stamp "step-3-done"; echo "  ✓ step 3: budget ESTIMATE recorded (entry cap satisfied)"
+_witness_record "$WS/BUDGET.md"
 
 # STEP 4 — persona simulation (G1-forcing gate). Dispatch is human/Claude-side (bash can't spawn Agents);
 # gate on the ≥3 blind persona artifact. Isolation is the mechanism — the runner enforces the artifact, not the spawn.
@@ -126,6 +155,7 @@ if [ "$NPERS" -lt 3 ]; then
   echo "  ⛔ step 4 BLOCKED: SIM_NOTES.md has $NPERS/3 DISTINCT blind persona sections (need all of beginner + main-player + challenger)."; exit 1
 fi
 _stamp "step-4-done"; echo "  ✓ step 4: $NPERS blind persona sections present (isolation-gate satisfied)"
+_witness_record "$WS/SIM_NOTES.md"
 
 # STEP 5 — Emission Gate. Require a VERDICT: EMIT | PARTIAL-EMIT | KILL.
 if [ ! -f "$WS/EMISSION_VERDICT.md" ]; then
@@ -149,10 +179,36 @@ if [ -z "$VERDICT" ]; then
   echo "  ⛔ step 5 BLOCKED: no VERDICT (EMIT|PARTIAL-EMIT|KILL) found in $WS/EMISSION_VERDICT.md, re-run."; exit 1
 fi
 _stamp "step-5-done"; echo "  ✓ step 5: Emission Gate verdict = $VERDICT"
+_witness_record "$WS/EMISSION_VERDICT.md"
+# 순서 판정을 **여기서 인쇄한다.** verdict 가 나온 자리가 "게이트가 결과를 알기 전에
+# 돌았는가" 를 물어야 하는 유일한 자리다. 차단하지 않는 이유: KILL 런까지 막으면
+# 과차단이고, 과차단은 override 를 습관화시켜 게이트 전체를 무장해제한다.
+# 대신 **EMIT 일 때는 승격 사용 가부를 명시적으로 말한다** — 침묵이 곧 승인으로
+# 읽히는 것이 이 채널이 존재하는 이유다.
+if [ -f "$_WITNESS" ]; then
+  echo "  ── 순서 증인 판정 ──"
+  bash "$_WITNESS" verify "$SLUG" "$WS" 2>&1 | sed 's/^/    /'
+  _wrc="${PIPESTATUS[0]}"
+  if [ "$VERDICT" = "EMIT" ] || [ "$VERDICT" = "PARTIAL-EMIT" ]; then
+    if [ "${_wrc:-9}" = "0" ]; then
+      echo "    ✅ 이 EMIT 은 순서 증인을 가진다 — identity ② 승격 근거로 사용 가능"
+    else
+      echo "    🟥 이 EMIT 에는 순서 증인이 없다(rc=${_wrc:-?}) — identity ② 승격 근거로 쓰지 마라."
+      echo "       (원장 해시를 커밋한 뒤 재실행하면 증인이 성립한다)"
+      # ★ 출력만 하고 exit 0 으로 끝내면, stdout 을 안 읽는 호출자에게는 증인 없는 EMIT 도
+      # **성공**이다(cross-family F8). EMIT 은 승격 주장이므로 기계적으로 구분되어야 한다.
+      WITNESS_EMIT_FAIL=1
+    fi
+  fi
+fi
 
 # STEP 6 — actual cost / carry-forward record.
 if grep -qE '^ACTUAL:[[:space:]]*<' "$WS/BUDGET.md" || ! grep -qE '^ACTUAL:[[:space:]]*\S' "$WS/BUDGET.md"; then
-  echo "  ⛔ step 6 BLOCKED: record ACTUAL cost in $WS/BUDGET.md (actual-vs-estimate calibration), re-run."; exit 1
+  echo "  ⛔ step 6 BLOCKED: record ACTUAL cost in $WS/BUDGET.md (actual-vs-estimate calibration)."
+  echo "     Expected — a LINE PREFIX, not a heading:"
+  echo "       ACTUAL: <number/summary>        ← this form is checked"
+  echo "       ## ACTUAL                       ← a heading does NOT satisfy it"
+  echo "     Re-run after adding the line."; exit 1
 fi
 _stamp "step-6-done"; echo "  ✓ step 6: actual cost recorded"
 
@@ -181,4 +237,10 @@ case "$VERDICT" in
         echo "                 No emit. Workspace stays as the evidence record; seen-filter will skip re-listing it." ;;
 esac
 echo "chamber run '$SLUG' COMPLETE (STATUS: step-7-done, verdict $VERDICT)."
+# EMIT/PARTIAL-EMIT 인데 순서 증인이 없으면 **비영 종료**한다. KILL 은 영향 없다 —
+# KILL 까지 실패로 세우면 과차단이고, 과차단은 override 를 습관화시킨다.
+if [ "${WITNESS_EMIT_FAIL:-0}" = "1" ]; then
+  echo "⚠️ exit 3 — EMIT 이지만 순서 증인 미성립. 승격 주장에 쓰지 마라."
+  exit 3
+fi
 exit 0