@chrono-meta/fh-gate 1.4.95 → 1.4.96

package/plugins/fh-meta/skills/steel-quench/SKILL.md

@@ -43,7 +43,7 @@ A designer's anxiety is most dangerous when vague. steel-quench breaks that anxi
 
 | Wave | Role | Termination |
 |---|---|---|
-| **Phase 0** (optional) | Counterexample calibration — extract patterns from external bad cases, merge into Wave 1 | No external case → skip |
+| **Phase 0** (optional) | Counterexample calibration — extract patterns from external bad cases, merge into Wave 1 (→ `SKILL_detail.md §Phase0`) | No external case → skip |
 | **Wave 1** | Challenger attack (quench-challenger) — surface critical flaws, no defense | — |
 | **Wave 2** | Defense — defend or state as residual risk | — |
 | **Wave 3+** | Convergence — repeat until a round is clean AND triggers no repair | Zero new S/A **and no repairs made in response, B included** (§Convergence Criteria) |
@@ -52,6 +52,8 @@ A designer's anxiety is most dangerous when vague. steel-quench breaks that anxi
 | **Wave 5** (optional) | Multi-Team Adversarial Panel — external CLIs or cross-session Claude | Wave 3+ criterion, cross-team |
 | **Wave-T** (after convergence) | Temper — measure complexity the quench *added*; flag over-hardening | τ-PASS or named τ-FAIL |
 
+> **Detail**: See `SKILL_detail.md §Phase0` — counterexample calibration full spec (pattern extraction from an external bad case, merge rules into Wave 1) — read when an external bad case is supplied.
+
 ---
 
 ## Step 0.3 — Artifact Vulnerability Profile

package/plugins/fh-meta/skills/verify-bidirectional/SKILL.md

@@ -107,13 +107,22 @@ First identify the list of affected assets. Actual file modification is performe
 
 | Affected Asset | Update Location | Notes |
 |---|---|---|
-| memory `feedback_bidirectional_self_validation.md` | Add cumulative count + new round table | Self-perpetuation of this rule |
+| This SKILL.md §Validation Ledger | Add cumulative count + new round entry | Self-perpetuation of this rule. (Was `memory feedback_bidirectional_self_validation.md` — **absent, verified 2026-08-12**; the rule body is this file.) |
 | memory `project_*.md` (if affected) | Add relevant section | When naming, identity, or roadmap changes |
 | `tracks/_audit/*.md` (if affected) | Add pre-design section | When this validation affects persistent assets |
 | `CATALOG.md` | Add this session entry | For major decisions |
 | `reference_next_session_starter.md` §1 | Merge this conclusion | Material for next session entry |
 
-**Markdown editing discipline** (`feedback_markdown_edit_discipline`): Use Edit for existing `.md`. Write prohibited. If unavoidable, verify immediately with `git diff`.
+**Markdown editing discipline** — this skill's own rule, stated here rather than delegated:
+
+> Use `Edit` for any `.md` that already exists. `Write` on an existing file replaces it whole and
+> silently discards content this session never read — that is the failure mode the rule exists for,
+> not a style preference. If a full rewrite is genuinely unavoidable, `Read` the file first, then
+> verify immediately with `git diff` and report what changed.
+
+(Previously cited as `feedback_markdown_edit_discipline` — that memory key is **absent, verified
+2026-08-12**. The rule is live; only the pointer was dead, so it is written out here. A prohibition
+that rests on a file nobody can open is not enforceable.)
 
 ### Step 4.5. Change `diff` Review (User Gate Required)
 
@@ -144,7 +153,9 @@ Skip this step if no compatibility enhancement found (no token-filler).
 
 ### Step 6. Update Trigger Count + Skill Update Review
 
-Update trigger count in `memory feedback_bidirectional_self_validation.md`:
+Update the trigger count in the **§Validation Ledger** at the bottom of this file. (It formerly
+pointed at `memory feedback_bidirectional_self_validation.md`, **absent, verified 2026-08-12** —
+so the count had nowhere to land and this step could not actually be performed.)
 
 - 5+ accumulated = Skill promotion review (already fulfilled by creating this skill ✅)
 - 8+ accumulated = skill update review (rule refinement + round table compression + update this skill)
@@ -209,8 +220,8 @@ Speak up **before** entering implementation if any of these apply:
 
 - **This skill = validation and recording automation. Core decisions belong to the user** — this harness AI has no independent decision authority
 - **This harness AI self-catch cannot be applied alone** — follow `fact-checker` rule (narrow 1 / broad N+1)
-- **Simplification guard compliance** (`feedback_simplification_evidence`) — when creating/modifying this skill, only update SKILL.md. Do not create additional auxiliary files
-- **Markdown editing discipline obligation** (`feedback_markdown_edit_discipline`) — prefer Edit. Write prohibited
+- **Simplification guard compliance** — when creating or modifying this skill, update SKILL.md only. Do not spawn auxiliary files; a change that needs a new file needs a reason stated in the same edit. (Formerly cited `feedback_simplification_evidence` — **absent, verified 2026-08-12**)
+- **Markdown editing discipline obligation** — `Edit` on existing `.md`; `Write` only after reading the file, and verified with `git diff` (full statement in Step 4 above). (Formerly cited `feedback_markdown_edit_discipline` — **absent, verified 2026-08-12**)
 
 ## External User Environment Adaptation
 
@@ -220,7 +231,7 @@ This skill's core essence = "channel for updating baseline when user refinement
 
 | Origin Environment Dependency | External User Environment Fallback |
 |---|---|
-| `memory feedback_bidirectional_self_validation.md` (rule body) | User environment's own `memory/` or `notes/` bidirectional validation rule / if absent, follow this skill's own rule baseline |
+| Rule body — **this SKILL.md itself** (the origin environment's `memory feedback_bidirectional_self_validation.md` is **absent, verified 2026-08-12**; there is no origin-side file to fall back from) | User environment's own `memory/` or `notes/` bidirectional validation rule / if absent, this skill's own rule baseline — which is now the only baseline in either environment |
 | `memory feedback_*.md` grep scope (Step 2 priority 1) | User environment's own `learnings/` · `docs/` · `CLAUDE.md` grep (user's own baseline) |
 | `tracks/*/learnings/feedback_*.md` (Step 2 priority 2) | User environment's own learnings area (auto-detect naming variations) |
 | `knowledge/shared/harness-core/*.md` (Step 2 priority 4) | User environment's own `docs/` or `knowledge/` grep |
@@ -245,17 +256,64 @@ This skill's core essence = "channel for updating baseline when user refinement
 ## Done When
 
 ```
-Steps 1~6 all executed
-+ fact-checker self-catch mark output
-+ Step 4.5 diff gate user confirmation complete (y/N response received)
-+ Update trigger count updated
-+ External validation path: harvest-loop's Critic isolation pass (SAGE automated critique) can independently judge based on above criteria (skill_quality_rubric.md verifiable criteria)
+☐ Steps 1~6 all executed — a step that produced no artifact is
+  not executed                                                  (measured: 6 steps, 6 artifacts)
+☐ Step 1 baseline update applied BEFORE Step 2 grep runs — the
+  order is the point of the skill, not a formality              (mandatory-pass)
+☐ Step 2 consistency grep ran across all 4 priority scopes, and
+  each scope reports hits or an explicit "0 hits, scope exists"
+  — a scope that does not exist reports MISSING, never 0        (measured: 4 scopes reported)
+☐ fact-checker self-catch mark output                           (mandatory-pass)
+☐ Step 4.5 diff gate: user confirmation received (y/N) before
+  any file was modified; no answer == N                         (mandatory-pass, HITL)
+☐ §Validation Ledger has one new row and the Count line matches
+  the row total                                                 (measured: rows == Count)
+☐ Every memory/asset key cited in the round was confirmed to
+  RESOLVE before being used as grounds                          (mandatory-pass — an absent key
+                                                                 is cited as absent, never as
+                                                                 support)
+☐ The counter-argument was actually re-examined rather than
+  conceded to                                                   (judged — adversarial pairing:
+                                                                 `fact-checker` (narrow 1 /
+                                                                 broad N+1) re-runs the grep
+                                                                 independently; agreement with
+                                                                 the user is not evidence the
+                                                                 user was right)
+☐ External validation path available: harvest-loop's Critic
+  isolation pass can independently judge on the above criteria  (judged — adversarial pairing:
+                                                                 Critic runs isolated, not in
+                                                                 this session's context)
 ```
 
+> **Why the last two are judged, and paired.** This skill fires when the user pushes back, which is
+> precisely the moment agreement is cheapest. A Done When that only counts steps is satisfied by a
+> run that folded immediately. The pairing is the whole check: an isolated re-grep, and an isolated
+> critic — neither of which has seen this session's reasoning.
+
 Verdict: PASS (Step 4.5 diff gate confirmed, baseline updated) | CONDITIONAL_PASS (update applied, external validation still pending) | FAIL (counter-argument confirmed — AI recommendation was wrong, baseline requires redesign) | ESCALATE (counter-argument ambiguous, human judgment required)
 
 ## References
 
-- Rule body: `memory feedback_bidirectional_self_validation.md`
-- Operating model text: `memory feedback_hub_cc_operating_model.md §2.5·§2.6` — Insight 5 meta dimension + refinement challenge 4 patterns
-- Consistency rules: `feedback_external_ai_github_recommendation_verification` · `feedback_reference_own_hub_assets_first` · `feedback_simplification_evidence` · `feedback_markdown_edit_discipline` · `feedback_impact_first_then_tune`
+> **All memory keys below were checked on 2026-08-12 and every one is absent** (same-run
+> known-positive control: `feedback_verify_before_downgrade.md` and `memory_intent_recall.md`
+> both resolve, so the check is not misreporting). A struck entry here is not a fix if the same
+> name is still load-bearing above — the rules those keys carried have been written into the body
+> of this skill (Step 4 markdown discipline, §Constraints, §Validation Ledger), which is why the
+> strikethroughs below are safe to leave as history.
+
+- ~~Rule body: `memory feedback_bidirectional_self_validation.md`~~ — **absent (verified 2026-08-12)**. The rule body is **this file**; the cumulative count lives in §Validation Ledger.
+- ~~Operating model text: `memory feedback_hub_cc_operating_model.md §2.5·§2.6`~~ — **absent (verified 2026-08-12)**. The live equivalent is `CLAUDE.md §Identity — 3-Layer Mission + Core Axis`; cite that, not this filename.
+- ~~Consistency rules: `feedback_external_ai_github_recommendation_verification` · `feedback_reference_own_hub_assets_first` · `feedback_simplification_evidence` · `feedback_markdown_edit_discipline` · `feedback_impact_first_then_tune`~~ — **absent (verified 2026-08-12)**. The two that this skill actually depends on are restated in §Constraints above.
+- Live, verified references (these resolve): `tracks/_meta/reference_next_session_starter.md` (session card, Step 4) · `CATALOG.md` · the `fact-checker` agent (Step 3).
+
+## Validation Ledger
+
+Cumulative trigger count for Step 6. Append one row per completed round; the count is the number of
+rows. This section is the landing site that the absent memory key used to be.
+
+| # | Date | Trigger (user's counter-argument, one line) | Verdict | Baseline change |
+|---|---|---|---|---|
+| — | — | (no rounds recorded in-file yet — prior rounds lived in the now-absent memory key and are not recoverable) | — | — |
+
+**Count**: 0 recorded rounds. Do not restate a remembered historical total here; an unrecoverable
+count is `unknown`, not a number carried over from a file nobody can open.

package/scripts/count_check.sh

@@ -91,7 +91,53 @@ count_check() { # count_check <label> <file> <expected-string>
 count_check "fh-meta plugin.json"      plugins/fh-meta/.claude-plugin/plugin.json    "${meta_sk} skills + ${meta_ag} agents"
 count_check "fh-commons plugin.json"   plugins/fh-commons/.claude-plugin/plugin.json "${com_sk} skills"
 count_check "marketplace.json fh-meta" .claude-plugin/marketplace.json               "${meta_sk} skills + ${meta_ag} agents"
-count_check "README header"            README.md                                     "${total_sk} skills · ${total_ag} agents"
+# ── README 렌더링만 per-repo override 를 받는다 ──────────────────────────────────────────────
+# 왜 이 한 줄만 다른가: plugin.json·marketplace.json 의 문자열은 **기계 결합**(영문 고정,
+# 소비처가 파싱한다)이지만 README 헤더는 **사람이 읽는 산문**이라 하류 하네스가 자기 언어로 쓴다.
+# 이 스크립트는 공유층이라 여기에 렌더링을 하드코딩하면 다음 sync 가 하류의 지역화를 덮고,
+# 그 레인은 **이식 이후 한 번도 통과 못 하는 검사**가 된다 — 통과 불가능한 게이트는 게이트가
+# 아니라 `--no-verify` 훈련기다(실측: pmh-dev #55 가 그 상태를 손으로 되돌려야 했고, 다음
+# sync 에 다시 깨질 예정이었다. 이슈 chronoloy-dev/pmh-dev#57).
+#
+# 규약: 소비 레포는 `.claude/rules/count_readme_format` 에 printf 템플릿 한 줄을 둔다
+#       (`%s` 두 개 = skills 수, agents 수). 그 파일을 **자기 sync 제외목록에 등재**해야 한다 —
+#       등재 안 하면 이 override 자체가 덮이므로, 그 등재가 이 규약의 전제다.
+# 부재 → 영문 기본값. 즉 FH 자신과 지역화 안 한 설치는 종전과 동일하다(fail-closed 아님:
+#       README 렌더링은 가역 표면이고, 없는 파일을 요구하면 새 설치가 전부 막힌다).
+README_FMT_FILE="${COUNT_README_FORMAT_FILE:-.claude/rules/count_readme_format}"
+if [ -r "$README_FMT_FILE" ]; then
+  README_FMT=$(head -1 "$README_FMT_FILE")
+  case "$README_FMT" in
+    *%s*%s*) : ;;   # %s 두 개 필수 — 하나뿐이면 두 번째 수치가 검사에서 빠진다(무음 축소)
+    *) echo "FAIL  count: README format override 가 %s 를 두 개 갖지 않는다: '$README_FMT' ($README_FMT_FILE)"; fail=1; README_FMT="" ;;
+  esac
+else
+  README_FMT='%s skills · %s agents'
+fi
+# 렌더 결과를 **검사한 뒤에** 패턴으로 쓴다. 렌더된 문자열이 그대로 `grep -qE` 패턴이 되므로:
+#   · 개행이 들어가면 grep -E 는 그것을 패턴 구분자로 읽어 **OR 검색**이 된다 — 실측: 템플릿
+#     `%s\n%s` 는 stale README(99/99)를 PASS 시켰다(뒷조각 `8` 이 "Node 18" 에 걸림).
+#   · printf 가 실패해도(잘못된 지시자) rc 를 안 봐서 **부분 렌더**가 패턴이 됐다.
+# 이건 mandatory-pass 게이트이고 selfcheck→prepublishOnly · pre-commit · CI 세 경계에 물려 있다.
+# 대상 독자가 하류 하네스 저자(한국어 템플릿 끝에 개행을 붙이는 건 자연스러운 실수)라 더 그렇다.
+# 기존 가드 `*%s*%s*` 는 "%s 가 둘인가" 만 보지 **렌더 결과**를 안 본다. (배포 직전 보안 패스 A-2)
+if [ -n "$README_FMT" ]; then
+  # shellcheck disable=SC2059  # 템플릿은 선언 파일에서 온다 — 그게 이 기능의 요점
+  README_STR=$(printf "$README_FMT" "$total_sk" "$total_ag") || {
+    echo "FAIL  count: README format override 를 렌더할 수 없다: '$README_FMT' ($README_FMT_FILE)"; fail=1; README_STR=""; }
+  case "$README_STR" in
+    *"
+"*) echo "FAIL  count: README format override 가 개행을 렌더한다 — grep -E 패턴이 쪼개져 OR 검색이 된다: '$README_FMT'"; fail=1; README_STR="" ;;
+  esac
+  # 두 수치가 실제로 렌더 결과에 들어갔는지(`%.0s` 류가 값을 삼키는 경우 차단)
+  if [ -n "$README_STR" ]; then
+    case "$README_STR" in *"$total_sk"*) : ;; *) echo "FAIL  count: 렌더 결과에 skills 수($total_sk)가 없다: '$README_STR'"; fail=1; README_STR="" ;; esac
+  fi
+  if [ -n "$README_STR" ]; then
+    case "$README_STR" in *"$total_ag"*) : ;; *) echo "FAIL  count: 렌더 결과에 agents 수($total_ag)가 없다: '$README_STR'"; fail=1; README_STR="" ;; esac
+  fi
+  [ -n "$README_STR" ] && count_check "README header" README.md "$README_STR"
+fi
 count_check "local_fh_context fh-meta" templates/local_fh_context.md                 "(fh-meta, ${meta_sk})"
 
 if [ "$fail" -ne 0 ]; then

package/scripts/degrade_direction_scan.sh

@@ -40,10 +40,159 @@ PASS='(True|"PASS"|'"'"'PASS'"'"'|"ALLOW"|'"'"'ALLOW'"'"'|"OK"|'"'"'OK'"'"'|"VAL
 # incl. this gate's own pre-push/pre-commit-hook trigger category — must not be invisibly dropped).
 # Anything else is tracked as UNSCANNABLE so a load-bearing surface in another language is reported
 # as "not covered", never silently folded into an "advisory clean" (M#2, steel-quench 2026-07-03).
-FILES=(); UNSCANNABLE=()
+FILES=(); UNSCANNABLE=(); MD_ORIGIN=(); UNMEASURED=(); DISCOVERY_ERR=()
+# UNSCANNABLE vs UNMEASURED — 한 통에 넣으면 S 가 살아난다(재검 2026-08-12 지목).
+#   UNSCANNABLE = 측정 대상이 아니다(펜스 없는 산문 md, py/sh 아닌 파일). 정상 상태.
+#   UNMEASURED  = 재려 했는데 **못 쟀다**(python3/cksum 부재로 추출 실패). 이건 절대 CLEAN 이 아니다.
+# 첫 수리는 둘을 UNSCANNABLE 하나에 담았고, 그 배열은 `FILES` 가 **완전히 빌 때만** exit 2 로
+# 승격된다 — 스캔 가능한 .sh 가 하나라도 섞이면 추출 실패가 note 한 줄로 강등되고 rc=0 이 나갔다.
+# 즉 「측정 못 함을 CLEAN 으로 렌더」가 지배 경로(디렉터리 스캔 → typed capability)에 그대로 남아
+# 있었다 — 이 릴리스가 고치겠다고 선언한 바로 그것이다.
+
+# ── Markdown fence extraction (2026-08-11) ────────────────────────────────────────────────────
+# The bash this harness actually EXECUTES largely does not live in .sh files — it lives in ```bash
+# fences inside SKILL.md / SKILL_detail.md, and the scanner could not see a single line of it.
+# Measured that day: one sweep batch extracted 61 fenced blocks across 12 skills and found the
+# S5 pipefail-fallback class alive in four of them (harness-doctor E3/E7/Step-11, install-doctor),
+# each rendering a dead check as a PASS. The scanner was not wrong before — it reported those files
+# as UNSCANNABLE (exit 2, "NOT scanned, NOT clean"), which is the honest degrade. But "honestly
+# unmeasured" on the surface where the code actually lives is a coverage hole, not a resolution.
+#
+# Method: for a markdown file, write a shadow .sh whose fenced-block lines sit at their ORIGINAL
+# line numbers and whose every other line is blank. Line numbers then map 1:1, so an emitted
+# finding points at the real file:line with no offset arithmetic to get wrong. A markdown file
+# with NO bash fence stays UNSCANNABLE — nothing was extracted, so nothing was measured.
+# python3 는 이 레포의 선언된 런타임이 아니다(`package.json engines` = node 만). 부재하면 추출이
+# 불가능하고, 그때 md 를 FILES 에도 UNSCANNABLE 에도 넣지 않으면 **요약에서 통째로 사라져**
+# "no smells in N scanned files / exit 0" 이 된다 — 이 릴리스가 고치는 바로 그 클래스를 수리가
+# 재생산한 것이다(배포 직전 보안 패스가 적발, 2026-08-12). 자매 스크립트들은 이미 옳게 한다:
+# validate_yaml → UNCALIBRATED + exit 2, package_coverage → exit 1. 여기도 같은 방향으로 맞춘다.
+_MD_OK=1
+# `cut` joined this list 2026-08-12 (cross-family, gpt-5.5): the uniqueness token is produced by
+# `cksum | cut`, and gating only `cksum` left the pipeline half-guarded — with `cut` missing the
+# token is EMPTY, which restores the A-1 shadow-name collision the cksum guard exists to prevent.
+# Guarding one stage of a pipeline is not guarding the pipeline.
+for _dep in python3 cksum cut; do command -v "$_dep" >/dev/null 2>&1 || _MD_OK=0; done
+# `find` is not optional and its absence is not a small result: EVERY target file — .sh, .py and
+# .md alike — is discovered through it, and the discovery calls redirect stderr. Without this gate
+# a missing/broken `find` yields an empty file list and the run prints "no scannable target files"
+# and exits 0 = clean, on a corpus it never looked at. Same class the fence work exists to close,
+# one layer further up (cross-family, gpt-5.5, 2026-08-12).
+if ! command -v find >/dev/null 2>&1; then
+  echo "degrade-scan: INSTRUMENT ERROR — \`find\` is unavailable, so NO file was discovered."
+  echo "This is not 'clean' and not 'no targets'; nothing was measured. Fix PATH and re-run."
+  exit 2
+fi
+# cksum 도 미선언 의존성이다 — 첫 수리는 python3 만 가드하고 cksum 은 rc 미검사로 도입했다.
+# 부재 시 유일성 토큰이 **빈 문자열**이 돼 shadow 이름 충돌(A-1)이 그대로 부활한다(실증).
+# mktemp 실패 시 예측 가능한 경로(/tmp/degradescan.$$)로 폴백하던 것을 제거했다: 그 경로를 mkdir
+# 하지 않아 정상 폴백은 100% 실패하고, 반대로 공격자가 그 이름에 심링크를 심어두면 **성공해서
+# 레포 밖에 쓴다**(실증됨). 즉 "공격받을 때만 동작하는 코드" 였다.
+_MD_TMP="$(mktemp -d 2>/dev/null)" || { _MD_TMP=""; _MD_OK=0; }
+trap '[ -n "$_MD_TMP" ] && rm -rf "$_MD_TMP"' EXIT
+# LANGUAGE-SPLIT shadows (2026-08-12). The first version extracted only ```bash-family fences, and
+# extending it to ```python by widening the same regex would have written python source into a `.sh`
+# shadow — where `is_sh` is decided by the extension, so the SHELL probes would run on python and the
+# python probes' own file-shape assumptions would be met by accident. That is precisely the
+# "collected but probed with the wrong family" false-clean this scanner already names (n+10 below).
+# So the extraction is per-language and each language gets its own shadow extension; one markdown
+# file can now yield up to two shadows, and `is_sh` keeps deciding correctly by extension.
+# WHY python at all: `except: pass` / `.get(k, True)` — the shapes probes A–E exist for — live in
+# ```python fences, not in .py files, in this corpus. install-doctor's S came from exactly there.
+_md_shadow() {   # $1 = markdown path; $2 = fence language class (sh|py)
+                 # echoes shadow path, or nothing when that language has no fence in the file
+  # 반환 규약(2026-08-12, cross-family 지적으로 분리): 0 = 추출됨 · **1 = 그 언어 펜스가 없다(정상)**
+  # · **2 = 추출을 시도했으나 실패했다(못 쟀다)**. 첫 판은 둘을 똑같이 1 로 접었고, 그래서 읽을 수
+  # 없는 SKILL.md 한 개가 「펜스 없음」= UNSCANNABLE 로 렌더돼 같은 디렉토리에 깨끗한 .sh 가 하나라도
+  # 있으면 전체가 exit 0 = clean 으로 나갔다. 이 파일이 존재하는 이유인 바로 그 클래스다.
+  local src="$1" lang="$2" out ext pat tok rc
+  [ "$_MD_OK" = 1 ] || return 2        # 추출 불가 → 호출부가 UNMEASURED 로 보낸다(드롭 금지)
+  case "$lang" in
+    sh) ext=sh; pat='bash|sh|shell|zsh' ;;
+    py) ext=py; pat='python|python3|py' ;;
+    *)  return 2 ;;                    # 알 수 없는 언어 클래스 = 추출 실패, 조용한 성공 금지
+  esac
+  # 경로 해시를 붙인다: `tr '/' '_'` 만 쓰면 a/b.md 와 a_b.md 가 **같은 shadow** 로 매핑돼
+  # 뒤엣것이 앞엣것을 덮고, 결함 파일이 통째로 사라진 채 카운트는 2로 찍힌다(실증됨).
+  # 확장자가 언어를 가르므로 같은 md 의 sh/py shadow 는 서로 안 덮는다.
+  tok=$(printf '%s' "$src" | cksum | cut -d' ' -f1)
+  # 토큰이 비면 유일성이 사라져 a/b.md 와 a_b.md 가 같은 shadow 로 접힌다. 빈 값을 그냥 쓰지 말고
+  # 「못 쟀다」로 나가라 — 조용히 충돌한 쪽이 항상 더 나쁘다.
+  case "$tok" in ''|*[!0-9]*) return 2 ;; esac
+  out="$_MD_TMP/$(echo "$src" | tr '/' '_')-$tok.$ext"
+  python3 - "$src" "$out" "$pat" <<'PYEOF'
+import sys, re
+src, out, pat = sys.argv[1], sys.argv[2], sys.argv[3]
+lines = open(src, encoding='utf-8', errors='replace').read().split('\n')
+shadow = [''] * len(lines)
+inside = False
+found = False
+for i, l in enumerate(lines):
+    s = l.strip()
+    if not inside and re.match(r'^```(' + pat + r')\s*$', s):
+        inside = True; continue
+    if inside and s == '```':
+        inside = False; continue
+    if inside:
+        shadow[i] = l; found = True
+open(out, 'w', encoding='utf-8').write('\n'.join(shadow))
+sys.exit(0 if found else 3)
+PYEOF
+  rc=$?
+  case $rc in
+    0) ;;             # 추출 성공
+    3) return 1 ;;    # 그 언어의 펜스가 이 파일에 없다 — 정상 상태
+    *) return 2 ;;    # 읽기 실패·인코딩·인터프리터 오류 — 못 쟀다. 「펜스 없음」과 같은 값 금지
+  esac
+  printf '%s' "$out"
+}
+# 한 md 에서 sh·py 두 shadow 를 모두 수집한다. 어느 쪽도 안 나오면 그때만 UNSCANNABLE/UNMEASURED.
+# 반환: 0 = 하나 이상 수집됨, 1 = 그 파일에 스캔 대상 펜스 없음, 2 = 추출 자체가 불가(못 쟀다)
+_md_collect() {
+  local src="$1" lang shp got=0 err=0 rc
+  for lang in sh py; do
+    shp=$(_md_shadow "$src" "$lang"); rc=$?
+    case $rc in
+      0) [ -n "$shp" ] && { FILES+=("$shp"); MD_ORIGIN+=("$shp=$src"); got=1; } ;;
+      1) ;;          # 이 언어 펜스 없음 — 정상
+      *) err=1 ;;    # 추출 실패 — 이 파일은 못 쟀다
+    esac
+  done
+  # 실패가 하나라도 있으면 «못 쟀다»가 이긴다. 다른 언어에서 뭔가 건졌다는 사실이
+  # 못 잰 언어를 덮으면 부분 커버리지가 완전 커버리지로 렌더된다.
+  [ "$err" = 1 ] && return 2
+  [ "$got" = 1 ] && return 0
+  return 1
+}
 for t in "${TARGETS[@]}"; do
+  # HYPHEN-LEADING TARGETS are normalized ONCE, here, for every branch (2026-08-12, round 6).
+  # The first fix did this inside the directory branch only, so a direct FILE target named
+  # `-bad.sh` was collected verbatim and every later `grep "$f"` parsed it as an option cluster —
+  # producing "no smells in 1 scanned file, exit 0" for a file carrying a known-positive. Fixing
+  # one branch of a two-branch dispatch is the half-fix shape this repo already has a scan for.
+  case "$t" in
+    -*) t="./$t" ;;
+  esac
   if [ -d "$t" ]; then
-    while IFS= read -r f; do FILES+=("$f"); done < <(find "$t" -type f \( -name '*.py' -o -name '*.sh' \) 2>/dev/null)
+    # SYMLINKED TARGET (2026-08-12, cross-family gpt-5.5): `[ -d ]` follows a symlink, `find` does
+    # not — `find /path/to/symlink -type f` enumerates NOTHING and the run printed "no scannable
+    # (py/sh) target files" and exited 0 for a directory full of known-positives. `-H` makes find
+    # follow the command-line argument only (not links found during the walk, which is what would
+    # invite cycles). Measured: symlink target → 0 files without it, 1 with it.
+    # (`$t` is already `./`-normalized above, so no per-branch hyphen handling is needed here.)
+    _T=(-H "$t")
+    # DISCOVERY ERRORS (2026-08-12, cross-family gpt-5.5): the `find` preflight above proves the
+    # BINARY exists; it says nothing about whether this particular traversal worked. Every discovery
+    # call below redirects stderr and reads its output through a process substitution, which throws
+    # the exit status away — so an unreadable target directory produced an empty file list and the
+    # run printed "no scannable (py/sh) target files" and exited 0 = CLEAN, having looked at nothing.
+    # Reproduced with a mode-000 directory containing a known-positive `bad.sh`.
+    # One extra traversal per target is the price; a silent zero is not an acceptable alternative.
+    _derr=$(find "${_T[@]}" -type f 2>&1 >/dev/null); _drc=$?
+    if [ "$_drc" -ne 0 ] || [ -n "$_derr" ]; then
+      DISCOVERY_ERR+=("$t — ${_derr:-find exited $_drc}")
+    fi
+    while IFS= read -r f; do FILES+=("$f"); done < <(find "${_T[@]}" -type f \( -name '*.py' -o -name '*.sh' \) 2>/dev/null)
     # Shebang pass — this is what makes git hooks visible at all. Measured 2026-07-28:
     # `templates/.git-hooks` (files named `pre-push`, no extension, under a dotted directory) —
     # FH's own mechanical floor — reported "no scannable (py/sh) target files", exit 0.
@@ -60,16 +209,48 @@ for t in "${TARGETS[@]}"; do
         *.md|*.json|*.yaml|*.yml|*.txt|*.lock|*.png|*.jpg|*.svg|*.pdf|*.zip) continue ;;
       esac
       head -n1 "$f" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b' && FILES+=("$f")
-    done < <(find "$t" -type f 2>/dev/null)
+    done < <(find "${_T[@]}" -type f 2>/dev/null)
+    while IFS= read -r f; do
+      _md_collect "$f"
+      case $? in
+        0) ;;                   # sh/py 펜스에서 하나 이상 수집됨
+        1) UNSCANNABLE+=("$f") ;;   # 펜스가 없다 — 측정 대상이 아님(정상)
+        *) UNMEASURED+=("$f") ;;    # 추출 자체가 불가 — 못 쟀다(CLEAN 으로 접히면 안 된다)
+      esac
+    done < <(find "${_T[@]}" -type f -name '*.md' 2>/dev/null)
   elif [ -f "$t" ]; then
     tb="${t##*/}"
     case "$tb" in
       *.py|*.sh) FILES+=("$t") ;;
+      *.md)
+        _md_collect "$t"
+        case $? in
+          0) ;;                    # at least one sh/py fence extracted
+          1) UNSCANNABLE+=("$t") ;;   # no scannable fence — not a measurement target
+          *) UNMEASURED+=("$t") ;;    # extraction impossible — could not measure
+        esac ;;
       *.*) UNSCANNABLE+=("$t") ;;
       *) if head -n1 "$t" 2>/dev/null | grep -qE '^#!.*\b(ba|z|k)?sh\b'; then FILES+=("$t"); else UNSCANNABLE+=("$t"); fi ;;
     esac
   fi
 done
+# 탐색 자체가 실패했으면 그 타깃은 **못 쟀다**. 파일 목록이 비어 나오는 것과 구분이 안 되므로
+# 여기서 명시적으로 비-clean 을 건다 — 이 블록이 없으면 「읽을 수 없는 디렉토리」가
+# 「스캔 대상 없음 · exit 0」으로 렌더된다(같은 파일이 고치는 그 클래스, 한 층 위).
+if [ ${#DISCOVERY_ERR[@]} -gt 0 ]; then
+  echo "degrade-scan: ${#DISCOVERY_ERR[@]} target(s) COULD NOT BE MEASURED (directory traversal failed):"
+  printf '  (discovery-error) %s\n' "${DISCOVERY_ERR[@]}"
+  echo "This is NOT 'clean' — part of the requested surface was never enumerated."
+  _FORCE_NONCLEAN=2
+fi
+# 못 잰 파일이 있으면 hits 와 무관하게 비-clean 이다. 이 블록이 FILES 비었을 때만 도는 구조가
+# S 의 정체였다 — 스캔 가능한 파일이 하나라도 있으면 「못 쟀다」가 note 로 강등되고 rc=0 이 나갔다.
+if [ ${#UNMEASURED[@]} -gt 0 ]; then
+  echo "degrade-scan: ${#UNMEASURED[@]} file(s) COULD NOT BE MEASURED (markdown fence extraction unavailable — python3/cksum missing):"
+  printf '  (unmeasured) %s\n' "${UNMEASURED[@]}"
+  echo "This is NOT 'clean' — the fence surface was not scanned at all. Install python3+cksum or scan those files elsewhere."
+  _FORCE_NONCLEAN=2
+fi
 if [ ${#FILES[@]} -eq 0 ]; then
   if [ ${#UNSCANNABLE[@]} -gt 0 ]; then
     echo "degrade-scan: ${#UNSCANNABLE[@]} changed file(s) are OUTSIDE the scannable set (py/sh) — NOT scanned, NOT 'clean':"
@@ -77,11 +258,28 @@ if [ ${#FILES[@]} -eq 0 ]; then
     echo "A load-bearing surface in another language must go straight to cross-family review."
     exit 2   # advisory non-clean — an orchestrator keying on exit code must not read this as clean
   fi
-  echo "degrade-scan: no scannable (py/sh) target files"; exit 0
+  echo "degrade-scan: no scannable (py/sh) target files"; exit "${_FORCE_NONCLEAN:-0}"
 fi
 
 hits=0
-emit() { printf '  %s:%s\n    [%s] %s\n' "$1" "$2" "$3" "$4"; hits=$((hits+1)); }
+# A markdown fence is scanned through a shadow .sh (see §Markdown fence extraction). The finding
+# must point at the file a human can open, so emit translates the shadow path back to its origin —
+# line numbers need no adjustment because the shadow preserves them by construction. A finding that
+# names a path under /tmp is unactionable, which would make the new coverage decorative.
+_origin() {
+  local sh="$1" pair lbl
+  # 라벨은 shadow 확장자에서 나온다 — 하드코딩하면 python 펜스 결함이 「bash fence」로 보고돼
+  # 사람이 그 줄을 열었을 때 안 맞는 코드를 보게 된다(리포트가 거짓말을 하는 형태).
+  case "$sh" in
+    *.py) lbl='```python fence' ;;
+    *)    lbl='```bash fence' ;;
+  esac
+  for pair in "${MD_ORIGIN[@]:-}"; do
+    [ "${pair%%=*}" = "$sh" ] && { printf '%s (%s)' "${pair#*=}" "$lbl"; return; }
+  done
+  printf '%s' "$sh"
+}
+emit() { printf '  %s:%s\n    [%s] %s\n' "$(_origin "$1")" "$2" "$3" "$4"; hits=$((hits+1)); }
 
 for f in "${FILES[@]}"; do
   # ---- Shell-shaped probes (S*) -------------------------------------------------------------
@@ -201,6 +399,78 @@ for f in "${FILES[@]}"; do
     done < <(grep -nE '(([^|]\|[[:space:]]*([a-z]+[[:space:]]+)*wc[^|]*)|(grep([[:space:]]+-[A-Za-z]*c[A-Za-z]*|[[:space:]]+--count)[^|]*))([^|]*\|[^|]*)*\|\|[[:space:]]*echo[[:space:]]+[\"'"'"']?0' "$f" 2>/dev/null \
              | grep -vE '^[0-9]+:[[:space:]]*#' \
              | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
+
+    # S6 — SHELL-DEPENDENT word split: `for x in $VAR` / `cmd -- $LIST` on an unquoted PARAMETER
+    #   expansion. bash splits it on IFS; **zsh does not** (SH_WORD_SPLIT is off by default), so the
+    #   loop body runs ONCE with the entire newline-joined blob as a single word. Every per-item test
+    #   inside then fails against a filename that does not exist — and the loop's counters stay 0,
+    #   which the surrounding code reports as "nothing found". Same family as the rest of this file:
+    #   an unmeasured surface rendered as a zero. The default macOS login shell is zsh, and this
+    #   corpus's bash lives in SKILL.md fences that a human may paste into that shell.
+    #
+    #   SCOPE, and the discriminator this probe would be wrong without: `for f in $(cmd)` is NOT
+    #   flagged. Command substitution DOES word-split in zsh — SH_WORD_SPLIT governs *parameter*
+    #   expansion only. Flagging `$(...)` would have made this probe fire on the idiomatic form that
+    #   behaves identically in both shells, i.e. pure noise. Verified in both shells before shipping.
+    #   `"$@"` / `${arr[@]}` are excluded for the same reason: those are array expansions, which
+    #   split by element in zsh too.
+    #
+    #   Measured N=3 (2026-08-11..12): a scan whose `grep` returned rc=2 read as "clean" until it was
+    #   re-measured; a repair session hit the same shape; and `harness-doctor` L5-A ships it live —
+    #   `for f in $recent_sessions` (SKILL_detail.md:201/207), where under zsh every skill in the
+    #   harness reports INACTIVE_90D. Hand-found, not scanner-found: that is what this probe closes.
+    #   APPLICABILITY — S6 only fires where the execution shell is NOT pinned to a splitting shell.
+    #   Measured 2026-08-12 on 28 hits, and the split is clean at 100%: all 7 hits inside markdown
+    #   fences were REAL, and all 21 hits in `.sh` files carrying a `#!…bash` shebang were FALSE —
+    #   bash runs those files, so the splitting is the intended semantics there, not a defect. A
+    #   probe that is 75% noise trains authors to dismiss it, which is how the one hit that matters
+    #   gets waved through (this file already paid that price once at 9/9 FP on S5).
+    #   So: markdown-fence shadows (a human may paste them into zsh — the macOS login shell) and
+    #   files whose shebang IS zsh. Nothing else.
+    #   The test is INVERTED (2026-08-12, round-4 cross-family): the first draft asked "is this a
+    #   markdown shadow or a zsh script?" and therefore excluded a `.sh` file with NO shebang —
+    #   which is not pinned to anything either, so the defect is live there too. Ask the question
+    #   that actually decides it: **does a shebang pin a splitting shell?** Unknown shell → the
+    #   probe applies, which is the fail-closed direction for a detector.
+    _s6_applies=1
+    # `ksh[0-9]*` — `#!/usr/bin/env ksh93` was classified as unpinned because `\bksh\b` cannot match
+    # inside `ksh93` (a digit is a word character). ksh93 splits `$VAR` like bash, so it IS pinned.
+    head -n1 "$f" 2>/dev/null | grep -qE '^#!.*\b(bash|ksh[0-9]*|dash|ash)\b|^#!.*[/ ]sh([[:space:]]|$)' && _s6_applies=""
+    if [ -n "$_s6_applies" ]; then
+    # PATTERN (widened 2026-08-12, round 5). The first form only matched a bare `$VAR` / `${VAR}`,
+    # so `for f in ${FILES:-}` — same defect, one operator away — was a FALSE NEGATIVE.
+    # The braced alternative now admits the expansion operators (`:-` `:=` `:?` `:+` `#` `%` `^` `,`)
+    # but **excludes `[` by construction** (`[^}[]*`). That exclusion is doing real work: widening
+    # the pattern is exactly what would make `${arr[@]}` match, and an array expansion splits by
+    # element in zsh too, so it is not this defect. Encoding it in the pattern rather than as a
+    # downstream `grep -v` is deliberate — the line-level filter version of this rule was deleted
+    # earlier today precisely because it killed whole lines, including real hits.
+    # `/` and `@` joined the operator class 2026-08-12 (round 6): `${FILES//old/new}` is a
+    # substitution whose RESULT still splits in bash and not in zsh — the same defect — and it was
+    # invisible because `/` was missing from the set. Measured on that construct: bash 2 words,
+    # zsh 1. `[` stays excluded so array expansions remain unmatched.
+    S6_PAT='(for[[:space:]]+[A-Za-z_][A-Za-z0-9_]*[[:space:]]+in|--)[[:space:]]+(\$[A-Za-z_][A-Za-z0-9_]*|\$\{[A-Za-z_][A-Za-z0-9_]*([:#%^,!/@][^}[]*)?\})([[:space:];]|$)'
+    while IFS= read -r m; do
+      emit "$f" "${m%%:*}" "S6:wordsplit-shell-dep(sh)" "unquoted parameter expansion in a word-split position (\`for x in \$VAR\` / \`-- \$LIST\`) — bash splits on IFS but zsh does NOT, so under zsh the loop runs once over the whole blob and per-item results silently come back empty; iterate explicitly instead: \`printf '%s\\n' \"\$VAR\" | while IFS= read -r x; do …\` (or use an array). Command substitution \`\$(cmd)\` splits in both shells and is NOT this defect"
+      # NO COMMENT STRIPPING, and no array-form exclusion — both were removed 2026-08-12 after two
+      # cross-family rounds, and the reasoning is worth keeping because the removal LOOKS like a
+      # weakening and is not:
+      #   · the `grep -vE '\[[@*]\]'` array exclusion was DEAD CODE. Measured against all six
+      #     spellings: `$S6_PAT` requires `$name` followed by space/;/EOL, so `${arr[@]}` and
+      #     `"${arr[@]}"` never match it in the first place. The filter excluded nothing real — but
+      #     it matched the whole LINE, so a genuine defect whose trailing comment mentioned the safe
+      #     form (`git add -- $FILES  # use "${arr[@]}" later`) was silently dropped. A dead filter
+      #     that only ever fires on false grounds is worse than no filter.
+      #   · the `sed 's/#.*$//'` that was added to work around it then introduced its own false
+      #     negative: it cannot tell a comment from a `#` inside a quoted string, so
+      #     `printf "#"; git add -- $FILES` lost its real hit.
+      # Accepted trade, stated rather than hidden: a match living ONLY in a trailing comment is now
+      # reported. Full-line comments are still excluded above. Recall over precision is the right
+      # direction for an advisory detector — a missed defect is silent, a noisy line is not.
+    done < <(grep -nE "$S6_PAT" "$f" 2>/dev/null \
+             | grep -vE '^[0-9]+:[[:space:]]*#' \
+             | grep -vE '#[[:space:]]*noqa[:[:space:]]*degrade')
+    fi
   fi
 
   # Probe A — except/else/finally block returning a permissive value within 2 lines.
@@ -266,4 +536,4 @@ fi
 # it does NOT assert the changed load-bearing surface is safe (other languages, non-code surfaces,
 # and the lint's own recall gaps are out of scope). The load-bearing check is the cross-family review.
 echo "degrade-scan: no default-toward-PASS smells in ${#FILES[@]} scanned py/sh file(s) — does NOT cover other languages / non-code surfaces / the cross-family check (advisory)."
-exit 0
+exit "${_FORCE_NONCLEAN:-0}"   # 못 잰 파일이 있으면 0 이 아니다 — "안 쟀다"는 "깨끗하다"가 아니다