@chrono-meta/fh-gate 1.4.96 → 1.4.97

package/scripts/selfcheck.sh

@@ -15,6 +15,78 @@ set -u
 cd "$(dirname "${BASH_SOURCE[0]}")/.."
 fail=0
 
+# Single source of "declared legitimately unshipped" — package_coverage_check.sh's ACCEPTED_ABSENT,
+# read once via its --list-accepted flag. Two blocks below (ref-path, SessionStart anchor pairs) used
+# to each re-derive "is this absence OK" from an environment predicate (`.git` presence) instead of
+# consulting this declaration — which reproduces the exact bug the declaration exists to prevent in
+# any git-TRACKED tree that vendors this package (a monorepo committing node_modules, or a consumer
+# who runs `git init` after install): `.git` is present there, so the environment predicate answered
+# "source checkout", ran the full check, and FAILed on paths the declaration had already said were
+# fine to omit. Cross-family review, 2026-08-12 (reship axis, card §🔱⑮ G). `--list-accepted` has no
+# git/package.json dependency itself, so this load is safe to attempt unconditionally.
+_PKG_ACCEPTED_ABSENT=""
+if [ -f scripts/package_coverage_check.sh ]; then
+  _PKG_ACCEPTED_ABSENT="$(bash scripts/package_coverage_check.sh --list-accepted 2>/dev/null)"
+fi
+_pkg_accepted_absent() { printf '%s\n' "$_PKG_ACCEPTED_ABSENT" | grep -qxF "$1"; }
+
+# Is this path DECLARED shipped by package.json files[]? The companion question to the one above:
+# ACCEPTED_ABSENT answers "is this absence legitimate", this answers "should this be here at all".
+# Together they turn a bare "file missing" into a routed verdict instead of a blanket SKIP.
+# Directory entries in files[] cover everything under them, which is how `templates/.git-hooks`
+# covers `templates/.git-hooks/pre-push` — a prefix test, not equality (getting this wrong is what
+# made a comment claim the hook does not ship while package.json:117 declared its whole directory).
+# NOTE ON WHAT THIS DOES *NOT* PROVE: files[] membership is a DECLARATION, not the tarball. This repo
+# has already measured the two diverging (card §🔱⑮ G/C: repo ✅ / files[] ❌). Here the direction is
+# safe — an over-declaration makes this check stricter, never more lenient — but do not reuse this
+# helper anywhere the answer needs to be "what the consumer actually received"; that needs
+# `npm pack --dry-run --json`.
+_ships_per_files() {
+  python3 - "$1" <<'SHIPPY' 2>/dev/null
+import json, sys
+p = sys.argv[1]
+try:
+    files = json.load(open('package.json'))['files']
+except Exception:
+    sys.exit(2)          # unreadable manifest: UNKNOWN, and the caller must not read that as "no"
+sys.exit(0 if any(p == f or p.startswith(f.rstrip('/') + '/') for f in files) else 1)
+SHIPPY
+}
+
+# ── The single verdict for "my subject is not here" ───────────────────────────────────────────
+# Measured 2026-08-12 (card §🔱⑮ A2): **18 blocks in this file** rendered a green SKIP when their
+# subject was absent, and **all 18 subjects are declared in package.json files[] and present in the
+# real tarball** (verified with `npm pack --dry-run --json`, 20/20 — so routing them to FAIL cannot
+# over-block a legitimate consumer). For a subject that always ships, "absent" cannot mean "package
+# mode"; the only ways to reach it are DELETION or a broken install, and both were reported green.
+# That is the fourth face of the axis the card names three of: 미측정→clean · 미측정→findings ·
+# 해당없음→FAIL · **삭제→SKIP** — and it is the quiet one, which is why it survived longest.
+#
+# Two of the eighteen are worth naming because they read as already-handled and were not:
+#   · the gate_pathspec block printed "— not-checked, NOT a pass" and then did not set fail. The
+#     LABEL was honest and the VERDICT was green; a reader greps the message and believes it.
+#   · the --self-test loop's comment says "never a silent pass" directly above the arm that was one.
+# A comment asserting a property is not the property. Both were hand-verified by eye, not inferred.
+#
+# THE UNKNOWN ARM IS NOT A SKIP. `_ships_per_files` exits 2 when package.json is unreadable, and an
+# unreadable manifest means we cannot tell deletion from package mode — `not found != 0`, so that
+# case must not silently take the lenient branch (this repo's whole §Instrument-Calibration rule).
+# Usage:  [ -f "$subj" ] || { _absent_subject_verdict "<label>" "$subj" || fail=1; }
+_absent_subject_verdict() {
+  local label="$1" subj="$2"
+  _ships_per_files "$subj"
+  case $? in
+    0) echo "FAIL  $label: $subj is DECLARED SHIPPED (package.json files[]) but absent — that is a"
+       echo "      deletion or a broken install, not package mode. The subject itself is missing."
+       return 1 ;;
+    1) echo "SKIP  $label (subject $subj not in package.json files[], and absent)"
+       return 0 ;;
+    *) echo "FAIL  $label: cannot read package.json, so '$subj absent' is UNDECIDABLE between a"
+       echo "      deletion and package mode — unmeasured, not clean."
+       return 1 ;;
+  esac
+}
+
 check() { # check <label> <cmd...>
   local label="$1"; shift
   if "$@" 2>/dev/null; then
@@ -152,12 +224,32 @@ fi
 # above the ref loop drains git's ref list → Destructive-Op gate silently allows a delete/force push).
 # Wired here, not left standalone: an unwired checker is the exact defect this session found in
 # session_close_check.sh — building the test and not running it repeats it one layer up.
-# Package-mode guard: neither the test nor its subject (templates/.git-hooks/pre-push) is in
-# package.json files[] — both are source-tree-only infra. Without this guard the SHIPPED selfcheck
-# fails for every consumer running `npm test` on the installed package. Caught pre-publish 2026-07-20
-# by reproducing package mode; mirrors the ref-path SKIP below.
+# ⚠️ CORRECTED 2026-08-12 (innovator Mode F scan → resolved by measurement). This comment used to
+# read: "neither the test nor its subject (templates/.git-hooks/pre-push) is in package.json files[]
+# — both are source-tree-only infra." **That was false**, and it had been false long enough to be
+# load-bearing. `npm pack --dry-run --json` on this tree returns 262 files including
+# templates/.git-hooks/pre-push, templates/.git-hooks/pre-commit AND
+# scripts/test_prepush_stdin_integrity.sh — subject and anchor both ship (package.json:117 declares
+# the whole `templates/.git-hooks` directory).
+# The consequence is what makes this worth fixing rather than just re-wording: if the subject always
+# ships, then "subject absent" can no longer mean "package mode" — the only way to reach that arm is
+# that **the hook was deleted**, and it was rendering that as a green SKIP. This is the fourth face
+# of the axis the card names three of at §🔱⑮ (미측정→clean · 미측정→findings · 해당없음→FAIL):
+# **삭제→SKIP**. A deleted Destructive-Op gate reporting green on every surface is the worst of the
+# four, because the other three are loud.
+# Kept as a three-valued check rather than a bare FAIL: a consumer's tree can legitimately lack the
+# directory if they installed with --ignore-scripts and pruned, so the *declaration* is what decides,
+# not the environment (same discipline as `_pkg_accepted_absent` above — consult what ships, do not
+# re-derive it from what happens to be on disk).
 if [ ! -f templates/.git-hooks/pre-push ]; then
-  echo "SKIP  pre-push stdin integrity (package mode: templates/.git-hooks absent)"
+  if _ships_per_files "templates/.git-hooks/pre-push"; then
+    echo "FAIL  pre-push stdin integrity: templates/.git-hooks/pre-push is DECLARED SHIPPED but absent"
+    echo "      — that is a deletion or a broken install, not package mode. The Destructive-Op gate"
+    echo "      this anchors is the thing that is missing."
+    fail=1
+  else
+    echo "SKIP  pre-push stdin integrity (not shipped per package.json files[], and absent)"
+  fi
 elif [ -f scripts/test_prepush_stdin_integrity.sh ]; then
   if ! bash scripts/test_prepush_stdin_integrity.sh; then
     fail=1
@@ -173,7 +265,7 @@ fi
 # (scripts/degrade_direction_scan.sh) and the anchor both ship, so this runs in package mode too;
 # only a missing SUBJECT is a legitimate skip.
 if [ ! -f scripts/degrade_direction_scan.sh ]; then
-  echo "SKIP  degrade-scan shell probes (subject scripts/degrade_direction_scan.sh absent)"
+  _absent_subject_verdict "degrade-scan shell probes" "scripts/degrade_direction_scan.sh" || fail=1
 elif [ -f scripts/test_degrade_scan_shell_probes.sh ]; then
   if ! bash scripts/test_degrade_scan_shell_probes.sh; then
     fail=1
@@ -189,7 +281,7 @@ fi
 # pair, a template that defeats the gate (a rendered newline turns the pattern into an OR search)
 # passes silently — measured 2026-08-12 on a stale README that the gate reported as PASS.
 if [ ! -f scripts/count_check.sh ]; then
-  echo "SKIP  count_check README-format lanes (subject scripts/count_check.sh absent)"
+  _absent_subject_verdict "count_check README-format lanes" "scripts/count_check.sh" || fail=1
 elif [ -f scripts/test_count_check_readme_format_lanes.sh ]; then
   if ! bash scripts/test_count_check_readme_format_lanes.sh; then
     fail=1
@@ -199,6 +291,22 @@ else
   fail=1
 fi
 
+# The public-surface scanner's SINGLE-FILE and MISUSE paths. Same subject-present/anchor-gone shape:
+# the scanner is a fail-closed gate on an irreversible surface, and its failure mode is a green that
+# was never earned — a misuse, an unloaded pattern set, or dead plumbing all used to render as clean.
+# Wired here on purpose (cross-family round 2): the lane file existed and was syntax-checked only, so
+# `npm test` and `prepublishOnly` never executed it. A checker nobody calls is prose.
+if [ ! -f scripts/psa_scan_lib.sh ]; then
+  _absent_subject_verdict "psa single-file lanes" "scripts/psa_scan_lib.sh" || fail=1
+elif [ -f scripts/test_psa_singlefile_lanes.sh ]; then
+  if ! bash scripts/test_psa_singlefile_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  psa single-file lanes: psa_scan_lib.sh present but its anchor is missing"
+  fail=1
+fi
+
 # package-coverage — a shipped doc must not point at a file the tarball omits. Distinct from the
 # ref-path check below: that one asks "does this path exist at all", this one asks "does the
 # CONSUMER get it". Measured 2026-07-28: 35 paths existed, were named by a shipped doc, and were
@@ -213,7 +321,7 @@ fi
 # to reason about CI. scripts/test_package_coverage_lanes.sh pins the predicate across all four
 # tree shapes plus a known pair.
 if [ ! -f scripts/package_coverage_check.sh ]; then
-  echo "SKIP  test_package_coverage_lanes.sh (subject scripts/package_coverage_check.sh absent)"
+  _absent_subject_verdict "test_package_coverage_lanes.sh" "scripts/package_coverage_check.sh" || fail=1
 elif [ -f scripts/test_package_coverage_lanes.sh ]; then
   if ! bash scripts/test_package_coverage_lanes.sh; then
     fail=1
@@ -226,6 +334,138 @@ else
   fail=1
 fi
 
+# lane-runner — sibling of package-coverage one level up: that one asks "does the CONSUMER get the
+# file a shipped doc names", this one asks "does ANYTHING execute the lane suite we wrote". Measured
+# 2026-08-12 (reship axis, card §🔱⑮ A): 12 of 43 suites under scripts/ had no runner in selfcheck,
+# the git hooks, or CI — including scripts/test_marker_crossfamily_lanes.sh, whose subject is a
+# marker field that hard-blocks commits, and scripts/test_marker_floor_lanes.sh, whose subject is
+# pre-commit's live validate_marker_floor(). Both gates ship; neither calibration had ever run.
+# The card recorded this as three specific repairs needing "one anchor each"; wiring three anchors
+# would have closed those three and stayed blind to the other nine and to the thirteenth. This runs
+# unconditionally when present because its own absence is the defect class it exists to detect —
+# there is no package-mode arm to skip into (a consumer running `npm test` should learn that a
+# shipped suite of theirs is dead code just as much as we should).
+# THREE-VALUED, and the third value exists because the two-valued version was this session's own
+# instance of the defect it detects. The first draft was `if [ -f … ]; then run; fi` — an absent
+# checker fell through to nothing, silently. That is "미측정을 0으로 렌더" reproduced by the commit
+# that closed it: a 1.4.96 consumer has no lane_runner_check.sh (it was added to files[] AFTER that
+# publish), so on their machine this block would have printed nothing at all and `npm test` would
+# have reported a clean run of a check that never existed there.
+# The three states are distinguished by the DECLARATION, not by the environment (same discipline as
+# the pre-push block above): present → run · absent-but-declared-shipped → FAIL (deletion or broken
+# install) · absent-and-not-declared → SKIP, saying so. For a 1.4.96 consumer the third arm is the
+# correct and honest answer, and it names itself rather than being silent.
+if [ -f scripts/lane_runner_check.sh ]; then
+  if ! bash scripts/lane_runner_check.sh; then
+    fail=1
+  fi
+elif _ships_per_files "scripts/lane_runner_check.sh"; then
+  echo "FAIL  lane-runner: scripts/lane_runner_check.sh is DECLARED SHIPPED but absent — deletion or"
+  echo "      broken install. The check that detects unrun lane suites is itself missing."
+  fail=1
+else
+  echo "SKIP  lane-runner (not in this package's files[] — predates the version that ships it)"
+fi
+
+# ── the twelve suites lane_runner_check.sh measured as having NO runner (2026-08-12) ───────────
+# The check directly above COUNTS them; this block is what makes the count go down. Until now the
+# repo shipped a checker that reported its own todo list every run and nothing that discharged it,
+# which is a decision surface only for as long as someone acts on it.
+#
+# What was actually measured before this wiring existed, because the size of the fact is the reason
+# the block is here: all twelve pass when run by hand (rc=0, ~40s total), and NINE OF THE TWELVE
+# ARE IN THE PUBLISHED TARBALL (`npm pack --dry-run --json`, 263 files). So a consumer running
+# `npm test` was shipping-and-carrying nine test suites that nothing on their machine ever called.
+# The two that hurt most: test_marker_crossfamily_lanes.sh calibrates the `crossfamily:` marker enum
+# that hard-blocks commits, and test_marker_floor_lanes.sh calibrates pre-commit's live
+# validate_marker_floor(). Both gates ship and block; neither calibration had ever executed.
+#
+# ONE loop, not twelve blocks, and that is deliberate: the four-value routing below would otherwise
+# be hand-copied twelve times, and this repo has already measured what that produces — two copies of
+# a normalizer drifting in leniency until one of them silently drops its input
+# ([[feedback_divergent_leniency_duplicate_normalizers]]). The pair table is data; the verdict logic
+# exists once. The existing SessionStart pair-loop below/above uses the same shape.
+#
+# FOUR values, and every arm is reachable on a real machine:
+#   subject absent        → _absent_subject_verdict (deletion vs package mode, decided by files[])
+#   anchor present        → run it. exit 10 is called out separately: several of these suites use it
+#                           for "I could not set myself up" (mktemp failure), which is not a lane
+#                           failure and must not be reported as one — it still sets fail, because a
+#                           harness that could not measure did not pass ([[not_found_is_not_zero]]).
+#   anchor absent+shipped → FAIL. Deletion or broken install, exactly like the block above.
+#   anchor absent+unshipped → SKIP, naming itself. Three anchors genuinely do not ship
+#                           (chamber_run · frontier_digest_retry · residency_closure), so for a
+#                           consumer this arm is the honest answer, not a dodge.
+#
+# Subject choice is the file whose behaviour the suite pins, so that deleting the subject routes to
+# "your install is broken" rather than to a green run of a test about nothing.
+# test_capability_entrypoint_shipping.sh pins two (degrade_probe_capability.sh and
+# psa_probe_capability.sh); degrade is named here as the sentinel — the suite itself checks both and
+# fails if either is gone, so nothing is lost by not listing both in this table.
+_LANE_TO=""; command -v timeout >/dev/null 2>&1 && _LANE_TO="timeout 300"
+for _pair in \
+  "scripts/degrade_probe_capability.sh|scripts/test_capability_entrypoint_shipping.sh" \
+  "scripts/chamber_run.sh|scripts/test_chamber_run_lanes.sh" \
+  "scripts/destructive_pre_gate.sh|scripts/test_destructive_pre_gate_lanes.sh" \
+  "scripts/env_purity_scan.sh|scripts/test_env_purity_lanes.sh" \
+  "scripts/frontier_digest_daily.sh|scripts/test_frontier_digest_retry.sh" \
+  "scripts/knowledge_seam_check.sh|scripts/test_knowledge_seam_lanes.sh" \
+  "templates/.git-hooks/pre-commit|scripts/test_marker_crossfamily_lanes.sh" \
+  "templates/.git-hooks/pre-commit|scripts/test_marker_floor_lanes.sh" \
+  "scripts/residency_closure_scan.py|scripts/test_residency_closure_lanes.sh" \
+  "scripts/reviewer_capability_corpus.tsv|scripts/test_reviewer_capability_conformance.sh"
+do
+  _subj="${_pair%%|*}"; _anc="${_pair##*|}"; _lbl="${_anc##*/}"
+  if [ ! -f "$_subj" ]; then
+    _absent_subject_verdict "$_lbl" "$_subj" || fail=1
+  elif [ -f "$_anc" ]; then
+    # `< /dev/null` and the timeout are not decoration: test_frontier_digest_retry.sh deliberately
+    # plants a `sleep 300` stub and asserts a 3s watchdog kills it. If that watchdog ever regresses
+    # — which is the single defect this suite exists to catch — an unguarded call does not go RED,
+    # it HANGS, and CI dies on a job timeout with the cause unattributable. The suite that detects
+    # a broken watchdog must not be able to inherit the hang. Same `command -v timeout` guard as the
+    # --self-test loop below, because `timeout` is GNU coreutils and stock macOS has neither it nor
+    # a substitute; without it `< /dev/null` is the whole defence and a suite that reads stdin ends
+    # immediately instead of waiting forever.
+    $_LANE_TO bash "$_anc" < /dev/null; _rc=$?
+    case "$_rc" in
+      0) ;;
+      # The suite could not MEASURE. Distinguished from "the lane failed" because the two send a
+      # reader to different places, and a bare fail=1 sends them to the wrong one. 10 = the suite's
+      # own setup failed (mktemp, used by several of these); 2 = its subject was missing when it
+      # looked (test_knowledge_seam_lanes.sh:7 FATALs this way); 126/127 = the anchor is not
+      # executable or not found at all, i.e. a broken install that reached this arm anyway.
+      # Every one of them still sets fail — a harness that could not measure did not pass — but it
+      # is LABELLED, so the next reader debugs the instrument instead of the lane.
+      # The first draft of this loop routed only 10 and let everything else fall into an unlabelled
+      # fail=1. That is the same "assumed impossible rather than routed" shape that the sibling
+      # commit in lane_runner_check.sh had just written a paragraph against; adversarial review
+      # caught the inconsistency between the two files.
+      10|2|126|127)
+        echo "HARNESS ERROR  $_lbl: the suite exited $_rc — it could not measure, so its verdicts"
+        echo "      prove nothing about $_subj. Not a lane failure, and not a pass either."
+        fail=1 ;;
+      *) fail=1 ;;
+    esac
+  elif _pkg_accepted_absent "$_anc"; then
+    # DECLARED legitimately unshipped — the single source for that answer, not a guess from the
+    # environment. The first draft printed "this package predates it", which is a WRONG DIAGNOSIS
+    # printed forever on every consumer machine: these anchors do not lag the package, they are
+    # deliberately not in it (their subjects do not ship either). A confident wrong reason in a
+    # verdict line is worse than no reason, because it is the line the next person greps.
+    echo "SKIP  $_lbl (declared legitimately unshipped — package_coverage_check.sh ACCEPTED_ABSENT)"
+  else
+    # Not present, and NOT declared absent — so either it should be here (deletion / broken
+    # install) or the declaration is stale. Routed through the same three-valued helper as the
+    # subject arm above, and for the identical reason: `elif _ships_per_files "$_anc"` was a
+    # BOOLEAN test over a THREE-valued function, so its exit 2 (package.json unreadable = UNKNOWN)
+    # fell through to a green SKIP. That is the lenient branch the helper's own comment forbids
+    # ("THE UNKNOWN ARM IS NOT A SKIP"), rebuilt twelve times in one loop, thirty lines under the
+    # helper that exists to prevent it. Found by adversarial review; I had written both.
+    _absent_subject_verdict "$_lbl (anchor)" "$_anc" || fail=1
+  fi
+done
+
 # embedded --self-test suites (compaction_probe · judgment_circuit_lint · novelty_claim_check).
 # These three carry their lanes INSIDE the script (`--self-test`) rather than in a sibling
 # test_*_lanes.sh, so the name-list wiring above skipped them silently: 48 lanes existed and ran
@@ -235,7 +475,7 @@ fi
 # but self-test missing → FAIL, never a silent pass.
 for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
   if [ ! -f "scripts/$_subj.sh" ]; then
-    echo "SKIP  $_subj --self-test (subject scripts/$_subj.sh absent)"
+    _absent_subject_verdict "$_subj --self-test" "scripts/$_subj.sh" || fail=1
   else
     # ⚠️ **문자열 존재로 판정하지 마라.** 초판은 `grep -q -- '--self-test'` 였는데, 그 문자열은
     # 헤더 주석과 usage echo 에도 있어서 **디스패처 한 줄만 지워도 여전히 매치**한다. 그리고
@@ -249,7 +489,16 @@ for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
     # 난다(실측: homebrew 없는 PATH 에서 3개 subject 전부). 소비자 머신에서 `npm test` 와
     # `prepublishOnly` 를 깨뜨리는 경로다. 정답 폼은 이미 레포에 있다(sync-from-be.sh:134).
     # 없으면 무한대기 방지를 잃는 대신 도는 쪽을 택한다 — `< /dev/null` 이 그 방어의 본체다.
-    local _to=""; command -v timeout >/dev/null 2>&1 && _to="timeout 120"
+    # `local` OUTSIDE A FUNCTION, which this loop is. bash prints
+    #   "selfcheck.sh: line N: local: can only be used in a function"
+    # on stderr, the assignment never happens, and `_to` stays empty — so the timeout this line
+    # exists to install was NEVER INSTALLED. The guard has been decoration since it was written;
+    # the comment above it describing what it protects against was true and unimplemented. Measured
+    # 2026-08-13: the error printed three times (once per subject) in a full run, and had been
+    # printing in every run before that, unread, because stderr scrolls past a 240-second check.
+    # ★ A guard that announces its own failure every single run is still a silent failure if
+    # nothing reads the announcement. Fixed by deleting one word.
+    _to=""; command -v timeout >/dev/null 2>&1 && _to="timeout 120"
     _st_out="$($_to bash "scripts/$_subj.sh" --self-test < /dev/null 2>&1)"; _st_rc=$?
     case "$_st_out" in
       *캘리브레이션*) : ;;
@@ -291,7 +540,7 @@ fi
 # anchor was written into tests/ with ZERO callers first — the same defect this file already
 # records twice above; wiring it here is the fix, not a note about the fix.
 if [ ! -f scripts/consent_registry_check.sh ]; then
-  echo "SKIP  test_consent_registry.sh (subject scripts/consent_registry_check.sh absent)"
+  _absent_subject_verdict "test_consent_registry.sh" "scripts/consent_registry_check.sh" || fail=1
 elif [ -f scripts/test_consent_registry.sh ]; then
   if ! bash scripts/test_consent_registry.sh; then
     fail=1
@@ -306,7 +555,7 @@ fi
 # cross-family verification. The anchor's first version shipped in tests/ with ZERO callers — the
 # same defect the comment above records for test_card_drift_probe.sh, repeated one file later.
 if [ ! -f scripts/sidecar_wait.sh ]; then
-  echo "SKIP  test_sidecar_wait_stdin.sh (subject scripts/sidecar_wait.sh absent)"
+  _absent_subject_verdict "test_sidecar_wait_stdin.sh" "scripts/sidecar_wait.sh" || fail=1
 elif [ -f scripts/test_sidecar_wait_stdin.sh ]; then
   if ! bash scripts/test_sidecar_wait_stdin.sh; then
     fail=1
@@ -325,7 +574,7 @@ fi
 # states that look identical from outside ("the sidecar ran" vs "the model I pinned answered",
 # "absent" vs "unmeasured"), and its lanes are hermetic stubs, so running them costs nothing.
 if [ ! -f scripts/sidecar_calibrate.sh ]; then
-  echo "SKIP  test_sidecar_calibrate_lanes.sh (subject scripts/sidecar_calibrate.sh absent)"
+  _absent_subject_verdict "test_sidecar_calibrate_lanes.sh" "scripts/sidecar_calibrate.sh" || fail=1
 elif [ -f scripts/test_sidecar_calibrate_lanes.sh ]; then
   if ! bash scripts/test_sidecar_calibrate_lanes.sh; then
     fail=1
@@ -422,7 +671,7 @@ _gps_missing=""
 [ -f templates/.git-hooks/pre-commit ] || _gps_missing="templates/.git-hooks/pre-commit"
 [ -f templates/regression_guard.sh ] || _gps_missing="${_gps_missing:+$_gps_missing, }templates/regression_guard.sh"
 if [ -n "$_gps_missing" ]; then
-  echo "SKIP  gate_pathspec_check.sh (subject absent: $_gps_missing) — not-checked, NOT a pass"
+  _absent_subject_verdict "gate_pathspec_check.sh" "$_gps_missing" || fail=1
 elif [ -f scripts/gate_pathspec_check.sh ]; then
   if ! bash scripts/gate_pathspec_check.sh; then
     fail=1
@@ -444,7 +693,7 @@ else
 fi
 
 if [ ! -f scripts/fh_node_check.sh ]; then
-  echo "SKIP  test_node_check_lanes.sh (subject scripts/fh_node_check.sh absent)"
+  _absent_subject_verdict "test_node_check_lanes.sh" "scripts/fh_node_check.sh" || fail=1
 elif [ -f scripts/test_node_check_lanes.sh ]; then
   if ! bash scripts/test_node_check_lanes.sh; then
     fail=1
@@ -457,7 +706,7 @@ fi
 # The infra-delta half of the same subject. Separate suite, same pairing rule: it exists only because
 # fh_node_check.sh does, so its absence beside a present subject is a FAIL, not a skip.
 if [ ! -f scripts/fh_node_check.sh ]; then
-  echo "SKIP  test_node_infra_delta_lanes.sh (subject scripts/fh_node_check.sh absent)"
+  _absent_subject_verdict "test_node_infra_delta_lanes.sh" "scripts/fh_node_check.sh" || fail=1
 elif [ -f scripts/test_node_infra_delta_lanes.sh ]; then
   if ! bash scripts/test_node_infra_delta_lanes.sh; then
     fail=1
@@ -468,14 +717,43 @@ else
 fi
 
 # SessionStart multi-hook + install-wizard snippet merge. Subject for both = the shipped settings
-# snippets; a clone without them is a legitimate SKIP, a clone with them and no anchor is not.
+# snippets; a clone without them is a legitimate SKIP, a clone with them and no anchor is not —
+# UNLESS the anchor itself is declared package-mode-optional. test_sessionstart_multihook_lanes.sh
+# is exactly that. Its ACCEPTED_ABSENT entry (package_coverage_check.sh) covers a DIFFERENT case than
+# this loop implements: that entry's "selfcheck reports it NOT EXERCISED (exit 2)" describes the
+# anchor RUNNING and finding no CLI (handled a few lines below, rc==2). It never claimed anything
+# about the anchor FILE being missing — a real consumer never gets to run it at all (the file is not
+# in files[]), and this loop had no branch for that at all, so every installed package hit
+# "FAIL … anchor is missing" (corrected 2026-08-12, cross-family review — an earlier revision of this
+# comment miscited the ACCEPTED_ABSENT entry as already covering the missing-file case). Fixed by
+# consulting the SAME declaration (`_pkg_accepted_absent`, loaded once near the top of this file) that
+# the ref-path block above uses — not an environment predicate — because `.git` presence answers "is
+# there a git repo here", not "was this anchor declared intentionally unshipped", and the two diverge
+# in a git-tracked vendored tree (a monorepo committing node_modules, `git init` after install): `.git`
+# exists there too, which would silently reproduce the original FAIL.
+# test_wizard_snippet_merge_lanes.sh is NOT in ACCEPTED_ABSENT (it does ship, per files[]) — routing
+# both anchors through the same declaration lookup, rather than hardcoding one as always-FAIL, means a
+# future person who genuinely needs to exempt it does so by editing ONE list, not by finding this loop.
 for _pair in \
-  "templates/settings.SessionStart.snippet.json|scripts/test_sessionstart_multihook_lanes.sh" \
-  "templates/settings.SessionStart.snippet.json|scripts/test_wizard_snippet_merge_lanes.sh"
+  "templates/settings.SessionStart.snippet.json|scripts/test_sessionstart_multihook_lanes.sh|package-optional" \
+  "templates/settings.SessionStart.snippet.json|scripts/test_wizard_snippet_merge_lanes.sh|always-shipped"
 do
-  _subj="${_pair%%|*}"; _anc="${_pair#*|}"
+  _subj="${_pair%%|*}"; _rest="${_pair#*|}"; _anc="${_rest%%|*}"; _mode="${_rest#*|}"
+  # This mode field is a gate-verdict policy value (does a missing anchor FAIL or SKIP), not free
+  # text — an unrecognized value must not silently fall through to whichever branch string-matching
+  # happens to miss. Cross-family review, 2026-08-12: the two known values were previously the only
+  # ones exercised, so a typo (e.g. "alway-shipped") landed in the `else` FAIL branch by accident of
+  # string mismatch rather than by a checked policy — fail-closed in practice, but undeclared.
+  case "$_mode" in
+    package-optional|always-shipped) ;;
+    *)
+      echo "FAIL  ${_anc##*/}: unrecognized pair mode '$_mode' (expected package-optional or always-shipped)"
+      fail=1
+      continue
+      ;;
+  esac
   if [ ! -f "$_subj" ]; then
-    echo "SKIP  ${_anc##*/} (subject $_subj absent)"
+    _absent_subject_verdict "${_anc##*/}" "$_subj" || fail=1
   elif [ -f "$_anc" ]; then
     # THREE-valued, like the session-close anchors above — and for a third reason they do not have.
     # test_sessionstart_multihook_lanes.sh measures what the LIVE `claude` CLI does with several
@@ -494,6 +772,8 @@ do
     elif [ "$_rc" -ne 0 ]; then
       fail=1
     fi
+  elif [ "$_mode" = "package-optional" ] && _pkg_accepted_absent "$_anc"; then
+    echo "SKIP  ${_anc##*/} (declared ACCEPTED_ABSENT — CLI/cost-gated, see package_coverage_check.sh)"
   else
     echo "FAIL  ${_anc##*/}: $_subj present but its anchor is missing"
     fail=1
@@ -504,7 +784,7 @@ done
 # 2026-07-31; the pipe-verdict lane shipped in PR #209 WITHOUT this wiring, which is itself the
 # half-fix class the second guard exists to catch — found by running that guard on this repo.
 if [ ! -f scripts/sidecar_calibrate.sh ]; then
-  echo "SKIP  test_ollama_panel_lanes.sh (subject scripts/sidecar_calibrate.sh absent)"
+  _absent_subject_verdict "test_ollama_panel_lanes.sh" "scripts/sidecar_calibrate.sh" || fail=1
 elif [ -f scripts/test_ollama_panel_lanes.sh ]; then
   if ! bash scripts/test_ollama_panel_lanes.sh; then
     fail=1
@@ -515,7 +795,7 @@ else
 fi
 
 if [ ! -f scripts/pipe_verdict_guard.sh ]; then
-  echo "SKIP  test_pipe_verdict_guard_lanes.sh (subject scripts/pipe_verdict_guard.sh absent)"
+  _absent_subject_verdict "test_pipe_verdict_guard_lanes.sh" "scripts/pipe_verdict_guard.sh" || fail=1
 elif [ -f scripts/test_pipe_verdict_guard_lanes.sh ]; then
   if ! bash scripts/test_pipe_verdict_guard_lanes.sh; then
     fail=1
@@ -526,7 +806,7 @@ else
 fi
 
 if [ ! -f scripts/halffix_propagation_scan.sh ]; then
-  echo "SKIP  test_halffix_lanes.sh (subject scripts/halffix_propagation_scan.sh absent)"
+  _absent_subject_verdict "test_halffix_lanes.sh" "scripts/halffix_propagation_scan.sh" || fail=1
 elif [ -f scripts/test_halffix_lanes.sh ]; then
   if ! bash scripts/test_halffix_lanes.sh; then
     fail=1
@@ -550,7 +830,7 @@ fi
 
 for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe.sh scripts/test_session_close_chain_lanes.sh; do
   if [ ! -f scripts/session_close_check.sh ]; then
-    echo "SKIP  ${_anchor##*/} (subject scripts/session_close_check.sh absent)"
+    _absent_subject_verdict "${_anchor##*/}" "scripts/session_close_check.sh" || fail=1
   elif [ -f "$_anchor" ]; then
     # Preserve the anchor's two failure CLASSES instead of flattening them into one `fail=1`.
     # An anchor exits 3 when a fixture's premise never obtained — "this run's verdicts prove
@@ -660,7 +940,7 @@ fi
 # tag reached the remote and a publish from the wrong tree was stopped only by npm's own collision
 # check, so an unrun anchor here would be the same luck-as-floor arrangement one layer up.
 if [ ! -f templates/.git-hooks/pre-push ]; then
-  echo "SKIP  test_tag_version_lanes.sh (subject templates/.git-hooks/pre-push absent)"
+  _absent_subject_verdict "test_tag_version_lanes.sh" "templates/.git-hooks/pre-push" || fail=1
 elif [ -f scripts/test_tag_version_lanes.sh ]; then
   # RUN-ONCE, CAPTURE (2026-08-05) — rationale in the sync_from_be_lanes block later in this file.
   if _out=$(bash scripts/test_tag_version_lanes.sh 2>&1); then
@@ -680,7 +960,7 @@ fi
 # per-plugin entries inside marketplace.json, which the tag lane never opens. Measured 2026-08-06:
 # a bump left the second marketplace entry behind and the tag lane passed 8/8 straight through it.
 if [ ! -f scripts/version_lockstep_check.sh ]; then
-  echo "SKIP  test_version_lockstep_lanes.sh (subject scripts/version_lockstep_check.sh absent)"
+  _absent_subject_verdict "test_version_lockstep_lanes.sh" "scripts/version_lockstep_check.sh" || fail=1
 elif [ -f scripts/test_version_lockstep_lanes.sh ]; then
   if _out=$(bash scripts/test_version_lockstep_lanes.sh 2>&1); then
     echo "PASS  test_version_lockstep_lanes.sh (drift blocks · aligned silent · unreadable = exit 2, not pass)"
@@ -766,7 +1046,28 @@ fi
 
 # Referenced-path existence is a source-tree check. The npm package intentionally
 # ships a narrower runtime surface, so package-mode selfcheck skips this section.
-if [ -d ".claude/rules" ]; then
+# ⚠️ The skip predicate used to be `[ -d ".claude/rules" ]`. That broke the moment the tarball
+# started shipping PART of that directory (`.claude/rules/fh_4axis_gate.md` etc. are in files[]) —
+# the directory then exists in BOTH source and package mode, so the check never skipped in package
+# mode at all. It ran, extracted refs from the shipped CLAUDE.md/.claude/rules/*.md (which still
+# name `.claude/regression/ablation_verdicts.md` and `scripts/probe_scope_check.sh` — both
+# deliberately unshipped, per package_coverage_check.sh's own ACCEPTED_ABSENT list), then tried
+# `git check-ignore` against a tree with no `.git` at all (a real `npm pack` tarball is not a git
+# repo) — that call errors rather than confirming "ignored", so the fallback `[ -f "$p" ]` ran and
+# correctly found nothing, and the check reported FAIL on two paths it had already been told, one
+# check over, were fine to omit. First fix (2026-08-12, reship axis, card §🔱⑮ G/D) swapped the skip
+# predicate for `[ -e .git ]`. Cross-family review then caught that `[ -e .git ]` answers a different
+# question than the one this check needs: a git-TRACKED vendor of this package (a monorepo that
+# commits node_modules, or a consumer who runs `git init` after installing) has `.git` and IS a
+# legitimate package consumer, yet the predicate would route it into the full extraction and
+# reproduce the exact original FAIL on these same two paths — the fix would have closed the bug only
+# in the one shape it was tested against. The general fix is not a better environment predicate; it
+# is not re-deriving "is this legitimately absent" from the environment at all when a DECLARED answer
+# already exists — `_pkg_accepted_absent()`, loaded once near the top of this file — this block now
+# consults it before FAILing, so the two paths render SKIP regardless of how `.git` happens to be
+# shaped in the consumer's tree. `[ -e .git ]` still gates whether the SCAN runs at all (an installed
+# package with no tracked-refs source to lint), which is a real and unrelated question.
+if [ -e ".git" ]; then
   # Backtick-quoted repo-relative file refs in the always-loaded governance surface
   # (CLAUDE.md + .claude/rules/*.md) must exist. Phantom-reference class recurred
   # N>=3 in the 2026-06-11 audit window — instrument-not-habit.
@@ -811,6 +1112,8 @@ REFPY
         echo "SKIP  ref-path (gitignored): $p"
       elif [ -f "$p" ]; then
         echo "PASS  ref-path: $p"
+      elif _pkg_accepted_absent "$p"; then
+        echo "SKIP  ref-path (declared ACCEPTED_ABSENT — see package_coverage_check.sh): $p"
       else
         echo "FAIL  ref-path: $p — referenced in CLAUDE.md/.claude/rules but missing"
         fail=1
@@ -820,7 +1123,7 @@ $_refs
 REFS
   fi
 else
-  echo "SKIP  ref-path (package mode: .claude/rules absent)"
+  echo "SKIP  ref-path (package mode: no .git at package root — source-tree-only check)"
 fi
 
 if [ "$fail" -ne 0 ]; then

package/scripts/test_consent_registry.sh

@@ -728,6 +728,60 @@ YAML
 lane "P-SPELL a grant WIDER than its class is still refused (the paired control)" 1 "R7"
 
 
+# ── PROV : every verdict states what it measured WITH, and it states the TRUTH ──────────────────
+# 2026-08-12. This gate rides selfcheck → prepublishOnly. A release shipped green from a session whose
+# `python3` resolved to an unrelated project's venv that had PyYAML, while the machine's own python3
+# did not. Nothing was bypassed — the PASS was simply not portable, and said nothing about what
+# produced it.
+#
+# 🟥 The first version of this lane compared two arms, one of them "PyYAML hidden" via
+# `env -i PATH=/usr/bin:/bin PYTHONNOUSERSITE=1`. It passed locally and FAILED IN CI — because
+# `PYTHONNOUSERSITE` suppresses only the USER site directory. On this author's machine PyYAML was a
+# `--user` install so it hid; on the CI runner it is a system `dist-packages` install so it did not,
+# both arms returned the same value, and the lane called its own subject decorative.
+# **The control worked only by accident of how the author happened to install a package** — which is
+# the exact defect class the subject under test exists to catch, reproduced inside its own lane.
+#
+# So the lane no longer manufactures an environment. It compares the reported value against an
+# INDEPENDENT ORACLE computed in the same run: whatever `find_spec` says here, the instrument line
+# must say the same thing. That catches removal, hard-coding, truncation, and drift — everywhere,
+# with no assumption about how PyYAML got installed.
+_prov_line=$(bash "$CHK" 2>&1 | grep -o 'instrument (consent-registry): .*' | head -1)
+_prov_oracle=$(python3 - <<'ORACLE' 2>/dev/null
+import importlib.util, sys
+s = importlib.util.find_spec("yaml")
+print((s.origin or "namespace-package") if s is not None else "ABSENT")
+ORACLE
+)
+if [ -z "$_prov_line" ]; then
+  echo "  ❌ PROV-1 no instrument line on the ordinary path"; fail=$((fail+1))
+elif [ -z "$_prov_oracle" ]; then
+  echo "  ❌ PROV-1 oracle produced nothing — NOT RUN (unmeasured, not a pass)"; fail=$((fail+1))
+elif ! printf '%s' "$_prov_line" | grep -q ': /'; then
+  echo "  ❌ PROV-1 line does not name an absolute interpreter path: [$_prov_line]"; fail=$((fail+1))
+elif ! printf '%s' "$_prov_line" | grep -qF "PyYAML $_prov_oracle"; then
+  echo "  ❌ PROV-1 line disagrees with the oracle — reported [$_prov_line] vs actual [$_prov_oracle]"; fail=$((fail+1))
+else
+  echo "  ✅ PROV-1 instrument line matches an independent resolution of PyYAML [$_prov_oracle]"; pass=$((pass+1))
+fi
+
+# PROV-2 — the ABSENT branch, exercised DETERMINISTICALLY rather than by hiding a package.
+# A `yaml.py` MODULE FILE placed first on PYTHONPATH wins by path order, so find_spec resolves to it
+# — a different, predictable answer that does not depend on how the real PyYAML was installed.
+# ⚠️ A `yaml/` DIRECTORY does NOT work and the first draft used one: a namespace package has LOWER
+# precedence than a regular package, so Python keeps scanning the whole path and still finds the real
+# one. Measured — the arm did not move, and the lane correctly called itself decorative.
+_prov_tmp=$(mktemp -d); printf '# shadow module for the PROV-2 arm\n' > "$_prov_tmp/yaml.py"
+_prov_shadow=$(PYTHONPATH="$_prov_tmp" bash "$CHK" 2>&1 | grep -o 'instrument (consent-registry): .*' | head -1)
+rm -rf "$_prov_tmp"
+if [ -z "$_prov_shadow" ]; then
+  echo "  ❌ PROV-2 no instrument line under a shadowed yaml"; fail=$((fail+1))
+elif [ "$_prov_shadow" = "$_prov_line" ]; then
+  echo "  ❌ PROV-2 line did not move when the resolution moved — decorative [$_prov_line]"; fail=$((fail+1))
+else
+  echo "  ✅ PROV-2 line tracks the resolution when it changes (shadowed → different value)"; pass=$((pass+1))
+fi
+
 echo "----"
 echo "consent-registry anchor: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_marker_crossfamily_lanes.sh

@@ -17,7 +17,16 @@
 # Usage: bash scripts/test_marker_crossfamily_lanes.sh   Exit: 0 = all behave; 1 = regression.
 
 set -uo pipefail
-REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+# Script-relative, NOT `git rev-parse --show-toplevel`. Measured 2026-08-13 in a vendored tree
+# (npm install, then `git init` at a level above — a monorepo committing node_modules is the
+# same shape): rev-parse answers with the OUTER repo's root, so this suite looked for the
+# package's own files inside somebody else's checkout, found nothing, and reported
+# HARNESS-ERROR. The consumer sees a red `npm test` caused entirely by where their .git is.
+# The subject of these lanes ships INSIDE this package, so the package root is the only root
+# that can be right. Same form as test_capability_entrypoint_shipping.sh:29.
+# The exposure is new: before these suites were wired into selfcheck.sh they ran nowhere, so
+# the wrong root never cost anything. Wiring a dead lane surfaces every assumption it made.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
 T=$(mktemp -d); trap 'rm -rf "$T"' EXIT