@chrono-meta/fh-gate 1.4.94 → 1.4.96

package/plugins/fh-meta/skills/install-wizard/SKILL.md

@@ -301,13 +301,32 @@ On Claude API / MCP failure → refer to [`references/fallback-guide.md`](../../
 ## Done When
 
 ```
-☐ Environment detection complete: shell, CC version, OS, project type identified
-☐ Gap diagnosis output: present vs missing items listed
-☐ User approval/decline recorded for each suggested item
-☐ All approved items installed with no failure state
-  (failed installs surfaced to user — not silently skipped)
-☐ Acceleration baseline confirmed: zshrc alias + sentinels active (or user declined)
-☐ Summary output: "N items installed, M items skipped — setup complete"
+☐ Environment detection complete: shell, CC version, OS, project type
+  identified — each field carries a value or the literal "unknown",
+  never blank                                                    (measured: 4 fields resolved)
+☐ Settings probe distinguished ABSENT / UNPARSEABLE / OK — an
+  unparseable config is never treated as absent                  (mandatory-pass)
+☐ Gap diagnosis output: present vs missing items listed          (measured: count of items
+                                                                  present + missing == items
+                                                                  scanned)
+☐ User approval/decline recorded for each suggested item —
+  a missing answer is a decline, never an assumed yes            (measured: recorded answers
+                                                                  == suggested items)
+☐ All approved items installed with no failure state; every
+  failure surfaced to the user, not silently skipped             (mandatory-pass)
+☐ Acceleration baseline: zshrc block either appended with
+  SUBSTITUTED values (no literal "{FH_DIR}" in the target file)
+  or explicitly declined and the decline recorded                (mandatory-pass)
+☐ Step 3-D dispatch consent recorded in the three-part form
+  (quoted words · dated lease · scope) or a recorded decline —
+  a two-part record is invalid and counts as absent              (mandatory-pass)
+☐ Summary output: "N items installed, M items skipped" where
+  N + M equals the number of items offered                       (measured: N + M == offered)
+☐ Nothing was overwritten that the user did not approve          (judged — adversarial pairing:
+                                                                  re-run the wizard on a
+                                                                  populated .claude/ and diff
+                                                                  the tree before/after; any
+                                                                  unapproved delta is a FAIL)
 ```
 
 `--dry-run` mode Done When: gap diagnosis report written, no installation executed.

package/plugins/fh-meta/skills/install-wizard/SKILL_detail.md

@@ -222,13 +222,23 @@ echo "CC_HUB_DIR=${CC_HUB_DIR:-not set}"
 basename "$(pwd)"
 ls .claude/ 2>/dev/null
 
-# CC settings (handle both dict and list for plugins)
-cat .claude/settings.json 2>/dev/null | python3 -c "
-import json,sys
-d=json.load(sys.stdin)
-p=d.get('plugins',{})
-print('plugins:', list(p.keys()) if isinstance(p,dict) else p)
-" 2>/dev/null || echo "settings.json not found"
+# CC settings (handle both dict and list for plugins).
+# Split existence from parseability FIRST. The old `cat file | python3 … || echo "not found"` read
+# $? from python, so a CORRUPT settings.json printed "settings.json not found" — the wizard would
+# then happily create a fresh one and silently clobber the user's real (broken) config.
+if [ ! -f .claude/settings.json ]; then
+  echo "settings.json: ABSENT"
+else
+  python3 - <<'PY' || echo "settings.json: UNPARSEABLE (present but unreadable — NOT the same as absent; do NOT overwrite, ask the user)"
+import json, sys
+try:
+    d = json.load(open('.claude/settings.json'))
+except Exception as e:
+    print(f'  parse error: {e}', file=sys.stderr); sys.exit(2)
+p = d.get('plugins', {})
+print('settings.json: OK — plugins:', list(p.keys()) if isinstance(p, dict) else p)
+PY
+fi
 
 # MCP plugin connection status
 python3 -c "import json,os; d=json.load(open(os.path.expanduser('~/.claude.json'))); print('MCP:', list(d.get('mcpServers',{}).keys()))" 2>/dev/null || echo "MCP config not found"
@@ -319,9 +329,18 @@ Reduction targets are only meta operation rules (PR procedures, commit guides, F
 **Detection bash:**
 
 ```bash
-# Detect existing harness scale
-CLAUDE_MD_LINES=$(wc -l < CLAUDE.md 2>/dev/null || echo 0)
-RULES_COUNT=$(ls .claude/rules/*.md 2>/dev/null | wc -l || echo 0)
+# Detect existing harness scale.
+# `| wc -l || echo 0` is a conditional disarm, not a harmless idiom: with `set -o pipefail` active
+# (which the caller's shell may well have) a failing upstream stage makes the pipeline exit non-zero
+# AFTER wc has already printed its count, so the fallback appends a SECOND line, the value becomes
+# "0\n0", and the `-ge 3` test below dies with "integer expression expected" — on stderr only —
+# leaving the guard silent. Measured both directions 2026-08-12: single line without pipefail,
+# two lines with it. Sanitize instead of falling back.
+CLAUDE_MD_LINES=$(wc -l < CLAUDE.md 2>/dev/null || true)
+RULES_COUNT=$(ls .claude/rules/*.md 2>/dev/null | wc -l || true)
+# head -n1 FIRST, then strip: `tr -dc '0-9'` alone would fuse a two-line "12\n0" into "120".
+CLAUDE_MD_LINES=$(printf '%s\n' "$CLAUDE_MD_LINES" | head -n1 | tr -dc '0-9'); CLAUDE_MD_LINES=${CLAUDE_MD_LINES:-0}
+RULES_COUNT=$(printf '%s\n' "$RULES_COUNT" | head -n1 | tr -dc '0-9');         RULES_COUNT=${RULES_COUNT:-0}
 
 echo "CLAUDE.md: ${CLAUDE_MD_LINES} lines"
 echo ".claude/rules/: ${RULES_COUNT} files"
@@ -493,6 +512,15 @@ propose adding rows to `agent-composer/SKILL.md` Step 1 mapping table in this fo
 | {skill name} related task | {skill name} (S) | — |
 ```
 
+> **Verify this block against a temp file, never against `~/.zshrc`.** Set `ZSHRC_TARGET` to a
+> scratch path and run the five arms: FH_DIR unset → rc=1, nothing written · CC_HUB_DIR unset →
+> rc=1, nothing written · `$FH_DIR` without the script → ABORT, nothing written · consent absent →
+> SKIPPED, nothing written · consent Y with both vars → block appended with values **substituted**
+> and `$HOME`/`$FH_DIR` left literal, then `zsh -c 'source <temp>'` exits 0. Re-running must not
+> duplicate the block. **Beware a contaminated control**: if your own shell already exports
+> `FH_DIR`, the "unset" arm is not actually negative — isolate with `env -u FH_DIR`. That mistake
+> made the first pass of this very verification report a false PASS.
+
 Output preview before execution:
 ```
 ▶ agent-composer mapping update
@@ -507,18 +535,37 @@ Output preview before execution:
 
 ```bash
 # zshrc hook — preview then confirm. The wizard is AI-mediated: SHOW the user the exact block
-# below and ask in-chat "Append this to ~/.zshrc? (Y/N)" BEFORE running the append. An earlier
-# revision's comment promised preview-then-confirm while the bash appended unconditionally —
-# the decline-integrity sim (2026-08-10) caught the mismatch; the gate is the instruction, the
-# bash below runs ONLY on Y.
-if ! grep -q "fh_audit_check.zsh" ~/.zshrc 2>/dev/null; then
-  # (run only after an explicit in-chat Y)
-  cat >> ~/.zshrc << 'EOF'
-export FH_DIR="{FH_DIR}"
-export CC_HUB_DIR="{CC_HUB_DIR}"
-export CC_SENTINELS_DIR="$HOME/.cc_sentinels"
-source "$FH_DIR/templates/fh_audit_check.zsh"
+# below and ask in-chat "Append this to ~/.zshrc? (Y/N)" BEFORE running the append.
+#
+# TWO defects were fixed here (2026-08-12), both of which corrupt every future shell:
+#  (1) The heredoc was QUOTED (<< 'EOF'), so the literal text `{FH_DIR}` was written to ~/.zshrc.
+#      The resulting `source "$FH_DIR/templates/fh_audit_check.zsh"` then resolved to
+#      `{FH_DIR}/templates/...` and every subsequent shell start failed with
+#      `no such file or directory` (rc=127, reproduced in a sandbox against a temp file).
+#      Fix: unquoted heredoc so FH_DIR/CC_HUB_DIR expand AT WRITE TIME, with `\$HOME` and
+#      `\$FH_DIR` escaped so THOSE stay literal and resolve at shell-start.
+#  (2) The consent gate was a COMMENT ("run only after an explicit in-chat Y"). A comment does
+#      not gate anything — pasted or scripted, the block appended unconditionally. It is now a
+#      real conditional on FH_WIZARD_ZSHRC_CONSENT, default N (fail-closed).
+#
+# Set FH_WIZARD_ZSHRC_CONSENT=Y only after the user answers Y in chat.
+ZSHRC="${ZSHRC_TARGET:-$HOME/.zshrc}"
+: "${FH_DIR:?FH_DIR is unset — refusing to write a broken source line into $ZSHRC}"
+: "${CC_HUB_DIR:?CC_HUB_DIR is unset — refusing to write an incomplete block into $ZSHRC}"
+if [ ! -f "$FH_DIR/templates/fh_audit_check.zsh" ]; then
+  echo "ABORT: \$FH_DIR/templates/fh_audit_check.zsh does not exist — would wire a dead source line"
+elif [ "${FH_WIZARD_ZSHRC_CONSENT:-N}" != "Y" ]; then
+  echo "zshrc hook: SKIPPED (no explicit Y) — nothing written"
+elif grep -q "fh_audit_check.zsh" "$ZSHRC" 2>/dev/null; then
+  echo "zshrc hook: already present — no change"
+else
+  cat >> "$ZSHRC" <<EOF
+export FH_DIR="$FH_DIR"
+export CC_HUB_DIR="$CC_HUB_DIR"
+export CC_SENTINELS_DIR="\$HOME/.cc_sentinels"
+source "\$FH_DIR/templates/fh_audit_check.zsh"
 EOF
+  echo "zshrc hook: appended"
 fi
 # On N: do NOT append; record the decline and state its consequence in one line —
 #   echo "zshrc_hook" >> "$HOME/.cc_sentinels/{project}_wizard_declined"

package/plugins/fh-meta/skills/marketplace-gate/SKILL.md

@@ -84,7 +84,7 @@ Result: **PASS** / **PARTIAL** / **FAIL**
 ### Check 3 — Maintenance Signals
 
 ```bash
-cd "$REPO_PATH" 2>/dev/null || cd "$(pwd)"
+cd "$REPO_PATH" 2>/dev/null || { echo "ABORT: cannot cd to $REPO_PATH — refusing to measure the current repo in its place"; exit 1; }
 git log -1 --format="Last commit: %ar (%ad)" --date=short 2>/dev/null
 ls CHANGELOG* 2>/dev/null && echo "CHANGELOG found" || echo "No CHANGELOG"
 git tag -l 2>/dev/null | tail -5
@@ -101,47 +101,66 @@ Result: **ACTIVE** / **STALE** (60–180 days) / **ABANDONED** (180+ days)
 ### Check 4 — Duplication / Conflict Detection
 
 ```bash
-# list skills in current repo (directory-based)
-find "$REPO_PATH" -name "SKILL.md" 2>/dev/null | xargs -I{} dirname {} | xargs -I{} basename {}
-# compare with existing FH skills (if FH_DIR is set)
-[ -n "$FH_DIR" ] && ls "$FH_DIR/plugins/fh-meta/skills/" 2>/dev/null
-# cross-check registered skills in plugin.json (SoT)
-[ -n "$FH_DIR" ] && python3 -c "
-import json, sys
-with open('$FH_DIR/plugins/fh-meta/.claude-plugin/plugin.json') as f:
-    d = json.load(f)
-skills = [s['name'] for s in d.get('skills', [])]
-print('plugin.json registered skills (' + str(len(skills)) + '):', ', '.join(skills))
-" 2>/dev/null || echo "plugin.json parse failed (FH_DIR not set or path error)"
+# list skills in target repo (directory-based — skills are directory-registered in this ecosystem;
+# plugin.json carries no skills array, so a manifest read is NOT a skill list. An earlier version
+# of this check read `plugin.json["skills"]`, a key that never exists, so it rendered every healthy
+# repo as STALE — a broken instrument, calibrated against this very repo.)
+find "$REPO_PATH" -name "SKILL.md" 2>/dev/null | xargs -I{} dirname {} | xargs -I{} basename {} | sort > /tmp/_mkt_target_skills.txt
+cat /tmp/_mkt_target_skills.txt
+# compare with hub skills — SKIPPED must be visible, never silent. The readability test matters:
+# FH_DIR set-but-wrong yields an empty ls through the pipe, which reads as "0 overlaps" — a silent
+# skip wearing a pass. Set-but-unreadable is its own labeled state.
+if [ -n "$FH_DIR" ] && [ -d "$FH_DIR/plugins" ]; then
+  ls "$FH_DIR"/plugins/*/skills/ 2>/dev/null | grep -v ':$' | grep -v '^$' | sort > /tmp/_mkt_hub_skills.txt
+  comm -12 /tmp/_mkt_target_skills.txt /tmp/_mkt_hub_skills.txt | sed 's/^/NAME-OVERLAP: /'
+elif [ -n "$FH_DIR" ]; then
+  echo "SKIPPED: FH_DIR set but $FH_DIR/plugins unreadable — hub cross-check NOT run (not a CLEAN signal)"
+else
+  echo "SKIPPED: FH_DIR unset — hub cross-check NOT run (this is not a CLEAN signal)"
+fi
 ```
 
-**Duplication verdict**: If directory-based list and plugin.json list don't match → **STALE** warning.
+**Duplication verdict**: name overlap with hub skills → **OVERLAP**/**CONFLICT** by role comparison.
+Hub cross-check skipped → report `CLEAN (target-internal only — hub cross-check SKIPPED)`, never bare CLEAN.
 
 | Criterion | Check |
 |---|---|
-| No name conflict with existing FH skills | name comparison |
+| No name conflict with existing FH skills | name comparison (or visible SKIPPED) |
 | No functional duplication | description keyword comparison |
-| plugin.json list matches directory list | cross-check (SoT consistency) |
 
 Result: **CLEAN** / **OVERLAP** (N candidates) / **CONFLICT** (direct conflict)
 
 ### Check 5 — Public Safety
 
+**Primary path (no-reinvention)**: when `public-surface-audit` is installed, run it against
+`$REPO_PATH` and map its verdict — `LEAK` → **BLOCKED** · `REVIEW` → **WARNING** · `CLEAN` → **SAFE**
+· `NOT_CONFIGURED` → **WARNING(NOT_CONFIGURED)** (pattern source absent — not a clean bill). That
+skill is the real token scanner; this check does not re-implement it. The `NOT_CONFIGURED` qualifier
+survives into the Step 2 aggregate — see the 🟢 rule there (an unmeasured public surface must not be
+absorbed into an ignorable ⚠️).
+
+**Fallback (screening-grade only)** — when public-surface-audit is not installed:
+
 ```bash
-# detect hardcoded internal domains
-grep -r "<your-ghe-url>\|internal-domain\|sandbox\|internal-api" \
+# placeholder-literal screening — catches template residue, NOT real internal hostnames or secrets
+grep -r "<your-ghe-url>\|internal-domain\|internal-api" \
   "$REPO_PATH" --include="*.md" --include="*.json" --include="*.yaml" -l 2>/dev/null | head -10
-# sensitive information exposure
-grep -r "API_KEY\s*=\|SECRET\s*=\|PASSWORD\s*=" \
-  "$REPO_PATH" --include="*.md" --include="*.json" -l 2>/dev/null | head -5
+# sensitive information exposure (assignment shapes only)
+grep -rE "API_KEY\s*=|SECRET\s*=|PASSWORD\s*=" \
+  "$REPO_PATH" --include="*.md" --include="*.json" --include="*.yaml" --include="*.yml" \
+  --include="*.sh" --include="*.env*" -l 2>/dev/null | head -5
 # license
 ls "$REPO_PATH"/LICENSE* 2>/dev/null && echo "LICENSE found" || echo "No LICENSE"
 ```
 
+Fallback results are always labeled `(screening-grade — placeholder patterns; not a hostname/secret
+scanner)`. A go-public action still owes the Pre-Publish Surface Gate's full chain regardless of a
+SAFE here — this check screens listing readiness, it does not clear publication.
+
 | Criterion | Check |
 |---|---|
-| No hardcoded internal domains (or clearly marked as internal-only) | grep |
-| No sensitive information exposed | grep |
+| No hardcoded internal domains (or clearly marked as internal-only) | public-surface-audit (or screening-grade grep, labeled) |
+| No sensitive information exposed | public-surface-audit (or screening-grade grep, labeled) |
 | LICENSE file exists | ls |
 
 Result: **SAFE** / **WARNING** (N items to review) / **BLOCKED** (sensitive info exposed)
@@ -161,10 +180,14 @@ marketplace-gate — Listing Suitability Verdict
   Check 4 Duplication detection: ✅ CLEAN / ⚠️ OVERLAP({N}) / ❌ CONFLICT
   Check 5 Public safety        : ✅ SAFE / ⚠️ WARNING({N}) / ❌ BLOCKED
 
-  Overall verdict:
-    🟢 Recommended for listing  — 0 FAIL + 0 BLOCKED
-    🟡 Conditional listing      — ≤1 FAIL + 0 BLOCKED
-    🔴 Listing on hold          — 2+ FAIL or 1+ BLOCKED
+  Overall verdict — counted over the ❌-class {FAIL, ABANDONED, CONFLICT, BLOCKED}
+  (each check has its own vocabulary; the aggregate counts the ❌ column, not the token "FAIL" —
+   an ABANDONED or CONFLICT is a failure even though its word differs):
+    🟢 Recommended for listing  — 0 ❌-class results, AND Check 5 does not carry the
+                                  NOT_CONFIGURED qualifier (an unmeasured surface caps
+                                  the verdict at 🟡 — unmeasured ≠ pass)
+    🟡 Conditional listing      — exactly 1 ❌-class result, and it is not BLOCKED
+    🔴 Listing on hold          — 2+ ❌-class results, or any BLOCKED
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 ```
 
@@ -182,12 +205,17 @@ marketplace-gate — Listing Suitability Verdict
 ## Done When
 
 ```
-All steps 0–2 completed
-+ Full 5-point check results output (Check 1–5 individual verdicts)
-+ Overall verdict output (🟢 Recommended / 🟡 Conditional / 🔴 On hold)
+All steps 0–2 completed                                        — mandatory-pass
++ Full 5-point check results output (Check 1–5 individual
+  verdicts, skipped legs rendered as visible SKIPPED)          — mandatory-pass
++ Overall verdict output (🟢/🟡/🔴) counted over the ❌-class    — measured (❌-class count)
++ Before any 🟢 Recommended verdict: phantom-quench ran over
+  the target's citations/URLs/path refs; phantom refs found
+  → verdict auto-downgrades to 🟡 Conditional                   — mandatory-pass
 ```
 
-**→ Mandatory before 🟢 Recommended verdict: `phantom-quench`** — forward axis check on all citations, external URLs, and file path references in the asset being reviewed. A 🟢 verdict without phantom-quench is incomplete. If phantom-quench finds phantom refs → verdict downgrades to 🟡 Conditional automatically.
+(The phantom-quench leg sits inside Done When on purpose — an earlier version stated it below the
+fence, so the fence alone could be satisfied without it.)
 
 > When `agent-composer` receives a "comprehensive marketplace listing audit" request,
 > recommend: Wave 0 `fact-checker` → Wave 1 `marketplace-gate` + `hub-persona-auditor` in parallel.

package/plugins/fh-meta/skills/memory-hygiene/SKILL.md

@@ -56,15 +56,31 @@ re-verification is possible).
 
 ### Step 1 — Scan memory/*.md
 
+Enumerate **every** root with a per-root state — an absent root and an empty root are different
+facts, and the Step-4 snapshot scope is bound to this enumeration:
+
 ```bash
-ls ~/.claude/projects/*/memory/*.md 2>/dev/null
-# or hub-local:
-ls memory/*.md 2>/dev/null
+for ROOT in "$HOME"/.claude/projects/*/memory "$PWD/memory"; do
+  if [ -d "$ROOT" ]; then
+    n=$(ls "$ROOT"/*.md 2>/dev/null | wc -l | tr -d ' ')
+    echo "EXISTS(n=$n) $ROOT"
+  else
+    echo "ABSENT       $ROOT"
+  fi
+done
 ```
 
+**`ABSENT` is never counted as 0 entries.** Swallowing both into `2>/dev/null` makes "this root does
+not exist here" indistinguishable from "this root is empty" — and the snapshot in Constraints below
+must cover every root reported `EXISTS`, so a root mis-rendered as empty silently narrows the
+snapshot scope.
+
 For each file, extract:
 - `metadata.type` from frontmatter
-- `date:` or any date-like field in frontmatter or body
+- **Age source, in this order** (measured over the live corpus, n=267): `metadata.modified`
+  (ISO8601, present on 77/267) → else the file's filesystem mtime → else **`AGE-UNKNOWN`**.
+  There is **no top-level `date:` field in this corpus** (measured 0/267) — do not look for one,
+  and never treat `AGE-UNKNOWN` as fresh.
 - Key factual claims (GitHub URLs, status strings, version numbers, dates)
 
 ### Step 2 — Classify by Staleness
@@ -89,7 +105,9 @@ For each stale entry, run the appropriate re-verification:
 **Reference type** (URLs, DOIs, GitHub):
 - Use `gh api` for GitHub resources
 - Use `WebFetch` for DOIs and arXiv records
-- Mark `verified_at: YYYY-MM-DD` in frontmatter if still valid
+- Mark `metadata.verified_at: YYYY-MM-DD` — **nested under `metadata:`**, the layer this corpus
+  actually uses (`metadata:` present on 265/267; a top-level `verified_at` measured 0/267 and would
+  be invisible to the Step-1 extractor)
 - Flag `⚠ DRIFTED` if content has changed materially
 
 **Project type** (status, milestones):
@@ -121,19 +139,47 @@ Apply updates? [y / N per item]
 
 ### Step 5 — Record Run
 
+Use `printf`, never `echo "…\n…"` — `echo` expands `\n` in zsh but writes it **literally** in bash
+(measured: 6 lines vs 1), which silently produces a one-line file with a broken frontmatter.
+
 ```bash
-# Create hygiene log
-echo "---\ndate: $(date +%Y-%m-%d)\nentries_checked: N\nupdated: N\ndrifted: N\n---" \
-  > tracks/_meta/memory_hygiene_$(date +%Y-%m-%d).md
+mkdir -p tracks/_meta
+printf '%s\n' \
+  '---' \
+  "date: $(date +%Y-%m-%d)" \
+  "entries_checked: ${ENTRIES_CHECKED}" \
+  "demoted_to_archive: ${DEMOTED}" \
+  "orphans_indexed: ${ORPHANS}" \
+  "merged: ${MERGED}" \
+  "drifted: ${DRIFTED}" \
+  "hard_deleted: ${HARD_DELETED}" \
+  '---' \
+  > "tracks/_meta/memory_hygiene_$(date +%Y-%m-%d).md"
 ```
 
+**Every count is a measured value from Steps 1–4.** A log still containing a literal `N` (or an
+unexpanded `${…}`) is **an invalid log** — treat that run as not-recorded, because the log's
+existence is what arms the 7-day cadence guard, so a placeholder log suppresses the *next* real run.
+
 ## Constraints
 
 - **No auto-deletion**: Archive candidates are proposed, not deleted. Human confirmation required.
 - **Snapshot before archive (Destructive-Op Gate for memory)**: before applying any confirmed
   archive/removal in Step 4, snapshot **every memory root the entry could live in** first — tar **all**
   roots Step 1 enumerated (`~/.claude/projects/*/memory/` AND hub-local `memory/`), not just one:
-  `tar czf tracks/_meta/memory_snapshot_$(date +%Y%m%d-%H%M%S).tgz <each Step-1 root that exists>` — so
+  the snapshot **must be gated on its own exit status** — an unwritable or missing `tracks/_meta`
+  makes `tar` exit 1 and produce no tarball (measured), and without a gate the irreversible archive
+  proceeds anyway:
+
+  ```bash
+  SNAP="tracks/_meta/memory_snapshot_$(date +%Y%m%d-%H%M%S).tgz"
+  mkdir -p tracks/_meta || { echo "SNAPSHOT FAILED (mkdir) — abort archive"; exit 1; }
+  tar czf "$SNAP" <each Step-1 root reported EXISTS> || { echo "SNAPSHOT FAILED (tar) — abort archive"; exit 1; }
+  [ -s "$SNAP" ] || { echo "SNAPSHOT FAILED (empty tarball) — abort archive"; exit 1; }
+  echo "SNAPSHOT OK: $SNAP"
+  ```
+
+  Only on `SNAPSHOT OK` may the archive proceed — so
   a wrong archive in any scanned root is one-command recoverable (a single-root snapshot can pass while
   the archived entry lived in the other root — bind the scope to the entry, not to "a tarball exists").
   Archive moves entries to a `.archive/` sibling, never hard-deletes (mirrors the Curator's
@@ -147,14 +193,15 @@ echo "---\ndate: $(date +%Y-%m-%d)\nentries_checked: N\nupdated: N\ndrifted: N\n
 
 ## Done When
 
-```
-Step 1~5 complete
-+ Staleness roster output (Step 2 = mechanical no-LLM pre-pass)
-+ Re-verification run for all STALE entries
-+ User gate presented and responded to (y/N per item)
-+ If any archive confirmed: snapshot covering the archived entry's root written before the move (tracks/_meta/memory_snapshot_*.tgz, spanning all existing Step-1 roots) — check class: mandatory-pass (snapshot covers the entry's dir, not merely "a tarball exists")
-+ Hygiene log written to tracks/_meta/memory_hygiene_{date}.md
-```
+| Condition | Check class |
+|---|---|
+| Step 1~5 complete, every memory root reported `EXISTS(n=…)` or `ABSENT` | **mandatory-pass** |
+| Staleness roster output (Step 2 = mechanical no-LLM pre-pass), with `AGE-UNKNOWN` entries listed separately and not as FRESH | **measured** (age from `metadata.modified` / mtime, not recall) |
+| Re-verification run for all STALE entries | **mandatory-pass** |
+| Each re-verified entry's verdict (VERIFIED / DRIFTED) is correct | **judged** — adversarial pairing: `fh-meta:fact-checker` re-greps the hub for the same claim; any disagreement downgrades the entry to DRIFTED (no judge-only PASS) |
+| User gate presented and responded to (y/N per item) | **mandatory-pass** |
+| If any archive confirmed: snapshot written **and its exit status checked** before the move (`tracks/_meta/memory_snapshot_*.tgz`, spanning every root reported `EXISTS`) | **mandatory-pass** — snapshot must cover the archived entry's dir; `SNAPSHOT OK` printed, not merely "a tarball exists" |
+| Hygiene log written to `tracks/_meta/memory_hygiene_{date}.md` with real counts (no literal `N`, no unexpanded `${…}`) | **measured** |
 
 ## References
 

package/plugins/fh-meta/skills/meta-prompt-builder/SKILL.md

@@ -153,11 +153,45 @@ Acceptable form examples:
 
 ## Done When
 
+This skill's own Done When must satisfy the 3-part completeness check it imposes on others
+(**measurement subject · measurement timing · version/baseline**). The previous version —
+`All steps 0–3 completed` — met 0 of 3 and matched its own `Unconditioned completion` WARN pattern.
+
 ```
-All steps 0–3 completed
-+ Per-agent prompt drafts output per Wave (Goal/Context/Constraints/Done When 4-field included)
-+ Step 3 quality self-validation complete ([WARN] items delegated to user if present)
-+ Generated prompts awaiting user review
+Measurement subject: this skill's own output — the prompt draft set
+                     produced in this invocation (not the dispatched
+                     agents' results, which this skill never sees)
+Measurement timing:  absolute, at end of this run — no comparison to a
+                     previous run is implied or required
+Version / baseline:  the Step 3 checklist and the WARN-trigger table in
+                     THIS file; note the SKILL.md revision used if the
+                     table has changed since the draft was written
+
+☐ Steps 0–3 each produced their named artifact — a step with no
+  artifact is incomplete, not "completed"                        (measured: 4 steps, 4 artifacts)
+☐ One prompt draft exists per agent named in the dispatch plan   (measured: drafts == agents
+                                                                  in plan)
+☐ Every draft carries all four fields (Goal / Context /
+  Constraints / Done When), none empty                           (measured: 4 fields × N drafts,
+                                                                  0 empty)
+☐ Each draft's own Done When was run through the 3-part
+  completeness check and the WARN-trigger table, with the
+  result recorded per draft                                      (mandatory-pass)
+☐ Every Goal was checked against the target agent's declared
+  allowed-tools by READING that agent's SKILL.md — not from
+  recall                                                          (mandatory-pass)
+☐ [WARN] items are surfaced to the user with the reason, and
+  the decision is the user's                                     (mandatory-pass)
+☐ Drafts are handed over for review, not dispatched              (mandatory-pass)
+☐ The drafts are usable by the target agent as written           (judged — adversarial pairing:
+                                                                  generator and validator are the
+                                                                  same model, so self-validation
+                                                                  repeats its own bias. Have the
+                                                                  target agent, or a different
+                                                                  model, read one draft cold and
+                                                                  state what it would do; a
+                                                                  divergence from the intended
+                                                                  task is a FAIL)
 ```
 
 ## Simplification Guard

package/plugins/fh-meta/skills/persona-roster-expander/SKILL.md

@@ -2,7 +2,7 @@
 name: persona-roster-expander
 description: Expands a named persona seed into a tiered, judgment-mapped cast — tiering each persona by a domain safety rule, mapping each to a decision-lens in the user's vocabulary, then proposing additional voices with sourced anchors.
 user-invocable: true
-allowed-tools: ["Read", "Grep", "WebSearch", "WebFetch"]
+allowed-tools: ["Read", "Grep", "WebSearch", "WebFetch", "Write", "Agent"]
 model: sonnet
 ---
 
@@ -15,7 +15,12 @@ caller-supplied safety rule so the expansion stays faithful to the domain's cons
 
 > Origin: harvested from the-bible (2026-06-20) — an operator persona seed (priest/nun/angel/devil/
 > God/Jesus/Holy-Spirit/apostles) tiered relay-vs-lens by a relay-safety rule and mapped to
-> engineering-judgment lenses, +4 sourced proposals. See
+> engineering-judgment lenses, +4 sourced proposals. **The grounds, inline, because the harvest
+> record does not ship**: an ungated persona cast drifts into inventing its own authority — a voice
+> given a lens will speak past what the domain lets it assert — so tiering by a *caller-supplied*
+> rule is what keeps the expansion faithful, and the lens mapping is what makes a named voice
+> usable as a decision instrument instead of flavor. Full harvest record — **hub-local, not
+> distributed in the npm package**:
 > `tracks/_contrib/field_harvest_2026-06-20_gate-locality-and-grounding-capabilities.md`.
 
 ## Triggers
@@ -41,14 +46,17 @@ caller-supplied safety rule so the expansion stays faithful to the domain's cons
 4. **Propose 2–4 additions** filling lenses the seed doesn't cover (delegate net-new *name*
    generation to the `persona-innovator` agent — this skill's distinct value is the tiering +
    lens-mapping, not naming). For the strongest 2–3, find a real anchor (a sourced
-   example/reference), not a shallow stub.
-5. **Emit the tiered, lens-mapped cast** (named + proposed) as a structured artifact the system can
-   load (e.g. `personas.json`).
+   example/reference); **any remaining proposal ships with a literal `stub:` prefix** — unanchored
+   and unlabeled is not an allowed output (see Done When).
+5. **Emit the tiered, lens-mapped cast** (named + proposed) by **writing it to a structured file**
+   the system can load (e.g. `personas.json`), then confirm the written file parses. Leaving the
+   cast in the response text only does not complete this step.
 
 ## Done When
 - **Every persona has a tier + lens label + invoke-condition.** *Check class: mandatory-pass (binary — all three fields present per persona).*
-- **Each net-new proposal names a real anchor** (not a stub). *Check class: judged, pair: an anchor-existence check (the cited source/reference resolves).*
-- **The tiering respects the caller's safety rule** (no persona exceeds its tier's allowed emission). *Check class: judged, pair: an adversarial read — find a persona whose mapping lets it act beyond its tier.*
+- **Every proposal is either anchored or explicitly labeled a stub.** An anchored proposal names a source/reference that resolves; a proposal without one is emitted with a literal `stub:` prefix and is **not counted as a candidate**. *Check class: mandatory-pass (binary — each proposal carries either a resolving anchor or a `stub:` label; an unanchored, unlabeled proposal is FAIL). Anchor resolution is checked mechanically (fetch/look up the cited reference), not by judgment.* (This is the Done-When floor; Step 4's "strongest 2–3" is the effort target that sits above it — a 4th proposal may ship as `stub:` without violating either.)
+- **The cast is materialized as a loadable artifact** (e.g. `personas.json`) that a consumer can parse — the file exists on disk and a parse of it succeeds against the declared schema (per persona: tier / lens / invoke-condition; per proposal additionally `anchor` or `stub:`). *Check class: mandatory-pass (binary — file exists and parses; a cast that exists only in the response text is UNMET).*
+- **The tiering respects the caller's safety rule** (no persona exceeds its tier's allowed emission). *Check class: judged, pair: dispatch `fh-meta:challenger` at the tier-escalation angle — "find a persona whose lens mapping lets it emit beyond its tier". The pairing is a **different-agent** read; the author's own re-read does not satisfy it. If that agent is unreachable, record `pair: unavailable (<reason>)` — the condition stays UNMET and is **reported as a named residual**, never self-scored closed. It does **not** block delivery: a roster is a reversible artifact, so the degrade direction here is declare-and-ship, not fail-closed (that direction is reserved for irreversible surfaces — publish, delete, history-rewrite). Shipping with an UNMET pairing is honest; silently marking it met is the defect.*
 
 ## Guards
 - **Caller-supplied safety rule is mandatory** — the skill tiers by the domain's rule, it does not

package/plugins/fh-meta/skills/pipeline-conductor/SKILL.md

@@ -94,7 +94,11 @@ The four constituent skills use heterogeneous scope models. Translate the pipeli
 
 ## Step 0.5. return-path-gate — Pre-flight Chain Audit
 
-> Skip if return-path-gate is not installed or scope is a single non-pipeline skill.
+> Skip only when scope is a single non-pipeline skill. **return-path-gate not installed is a recorded
+> degrade, never a free skip**: proceed, but record `degraded: return-path-gate (not installed)` in the
+> final report — and, symmetric with the user-override row below, the sweep **cannot reach
+> `CLEAN (--full)`**. A missing tool must not pass more cheaply than an explicit refusal (that
+> asymmetry trains uninstalling the gate).
 
 Run `/return-path-gate --skill [scope]`.
 
@@ -197,7 +201,8 @@ After all steps complete (or after chain halt), output the aggregated report (te
 
 | Condition | Overall |
 |---|---|
-| All steps PASS | `CLEAN ({mode})` |
+| All steps PASS, zero `degraded:` entries | `CLEAN ({mode})` |
+| All steps PASS but 1+ `degraded:` entries (skip/not-installed/override) | `CLEAN ({mode}, degraded: [list])` — and the mode may not render `--full` (the Step 0.5 "cannot reach CLEAN (--full)" rule binds HERE, in the aggregate, not only in prose) |
 | Any step CONDITIONAL_PASS or accepted ESCALATE; none FAIL | `PENDING` |
 | Any step FAIL or unresolved ESCALATE (option c) | `BLOCKED` |
 
@@ -263,7 +268,7 @@ complexity_routing:
 
 ```
 Step 0 scope confirmed and scope translation table applied
-+ Step 0.5 return-path-gate pre-flight: PASS / CONDITIONAL_PASS / FAIL (halts sweep) / explicitly skipped / degraded (user override)
++ Step 0.5 return-path-gate pre-flight: PASS / CONDITIONAL_PASS / FAIL (halts sweep) / explicitly skipped / degraded (user override | not installed)
 + All in-scope steps executed and verdicts emitted
 + Aggregated report output (Step 5 format)
 + Report saved to tracks/_meta/ (or skip warning issued)
@@ -273,6 +278,11 @@ Step 0 scope confirmed and scope translation table applied
 + If ESCALATE occurred: user presented three options; choice recorded in report
 ```
 
+**Check classes**: every fence row above is *mandatory-pass*, except the completion-claim discipline
+below, which is *measured* — its reconciliation (failed+skipped list length vs. in-scope − passed) is
+the mechanical anchor. No Done When row here is judged: verdict aggregation is per-step-typed, not
+discretionary.
+
 Verdict: PASS (all conditions met, sweep complete) | CONDITIONAL_PASS (sweep complete, pending items captured) | FAIL (chain halted, blocking items remain) | ESCALATE (chain paused, human decision required)
 
 A sweep is not done until the Step 5 report is output. Emitting per-step verdicts without the aggregated report is incomplete.