@chrono-meta/fh-gate 1.4.96 → 1.4.98

package/scripts/selfcheck.sh

@@ -15,6 +15,78 @@ set -u
 cd "$(dirname "${BASH_SOURCE[0]}")/.."
 fail=0
 
+# Single source of "declared legitimately unshipped" — package_coverage_check.sh's ACCEPTED_ABSENT,
+# read once via its --list-accepted flag. Two blocks below (ref-path, SessionStart anchor pairs) used
+# to each re-derive "is this absence OK" from an environment predicate (`.git` presence) instead of
+# consulting this declaration — which reproduces the exact bug the declaration exists to prevent in
+# any git-TRACKED tree that vendors this package (a monorepo committing node_modules, or a consumer
+# who runs `git init` after install): `.git` is present there, so the environment predicate answered
+# "source checkout", ran the full check, and FAILed on paths the declaration had already said were
+# fine to omit. Cross-family review, 2026-08-12 (reship axis, card §🔱⑮ G). `--list-accepted` has no
+# git/package.json dependency itself, so this load is safe to attempt unconditionally.
+_PKG_ACCEPTED_ABSENT=""
+if [ -f scripts/package_coverage_check.sh ]; then
+  _PKG_ACCEPTED_ABSENT="$(bash scripts/package_coverage_check.sh --list-accepted 2>/dev/null)"
+fi
+_pkg_accepted_absent() { printf '%s\n' "$_PKG_ACCEPTED_ABSENT" | grep -qxF "$1"; }
+
+# Is this path DECLARED shipped by package.json files[]? The companion question to the one above:
+# ACCEPTED_ABSENT answers "is this absence legitimate", this answers "should this be here at all".
+# Together they turn a bare "file missing" into a routed verdict instead of a blanket SKIP.
+# Directory entries in files[] cover everything under them, which is how `templates/.git-hooks`
+# covers `templates/.git-hooks/pre-push` — a prefix test, not equality (getting this wrong is what
+# made a comment claim the hook does not ship while package.json:117 declared its whole directory).
+# NOTE ON WHAT THIS DOES *NOT* PROVE: files[] membership is a DECLARATION, not the tarball. This repo
+# has already measured the two diverging (card §🔱⑮ G/C: repo ✅ / files[] ❌). Here the direction is
+# safe — an over-declaration makes this check stricter, never more lenient — but do not reuse this
+# helper anywhere the answer needs to be "what the consumer actually received"; that needs
+# `npm pack --dry-run --json`.
+_ships_per_files() {
+  python3 - "$1" <<'SHIPPY' 2>/dev/null
+import json, sys
+p = sys.argv[1]
+try:
+    files = json.load(open('package.json'))['files']
+except Exception:
+    sys.exit(2)          # unreadable manifest: UNKNOWN, and the caller must not read that as "no"
+sys.exit(0 if any(p == f or p.startswith(f.rstrip('/') + '/') for f in files) else 1)
+SHIPPY
+}
+
+# ── The single verdict for "my subject is not here" ───────────────────────────────────────────
+# Measured 2026-08-12 (card §🔱⑮ A2): **18 blocks in this file** rendered a green SKIP when their
+# subject was absent, and **all 18 subjects are declared in package.json files[] and present in the
+# real tarball** (verified with `npm pack --dry-run --json`, 20/20 — so routing them to FAIL cannot
+# over-block a legitimate consumer). For a subject that always ships, "absent" cannot mean "package
+# mode"; the only ways to reach it are DELETION or a broken install, and both were reported green.
+# That is the fourth face of the axis the card names three of: 미측정→clean · 미측정→findings ·
+# 해당없음→FAIL · **삭제→SKIP** — and it is the quiet one, which is why it survived longest.
+#
+# Two of the eighteen are worth naming because they read as already-handled and were not:
+#   · the gate_pathspec block printed "— not-checked, NOT a pass" and then did not set fail. The
+#     LABEL was honest and the VERDICT was green; a reader greps the message and believes it.
+#   · the --self-test loop's comment says "never a silent pass" directly above the arm that was one.
+# A comment asserting a property is not the property. Both were hand-verified by eye, not inferred.
+#
+# THE UNKNOWN ARM IS NOT A SKIP. `_ships_per_files` exits 2 when package.json is unreadable, and an
+# unreadable manifest means we cannot tell deletion from package mode — `not found != 0`, so that
+# case must not silently take the lenient branch (this repo's whole §Instrument-Calibration rule).
+# Usage:  [ -f "$subj" ] || { _absent_subject_verdict "<label>" "$subj" || fail=1; }
+_absent_subject_verdict() {
+  local label="$1" subj="$2"
+  _ships_per_files "$subj"
+  case $? in
+    0) echo "FAIL  $label: $subj is DECLARED SHIPPED (package.json files[]) but absent — that is a"
+       echo "      deletion or a broken install, not package mode. The subject itself is missing."
+       return 1 ;;
+    1) echo "SKIP  $label (subject $subj not in package.json files[], and absent)"
+       return 0 ;;
+    *) echo "FAIL  $label: cannot read package.json, so '$subj absent' is UNDECIDABLE between a"
+       echo "      deletion and package mode — unmeasured, not clean."
+       return 1 ;;
+  esac
+}
+
 check() { # check <label> <cmd...>
   local label="$1"; shift
   if "$@" 2>/dev/null; then
@@ -152,12 +224,32 @@ fi
 # above the ref loop drains git's ref list → Destructive-Op gate silently allows a delete/force push).
 # Wired here, not left standalone: an unwired checker is the exact defect this session found in
 # session_close_check.sh — building the test and not running it repeats it one layer up.
-# Package-mode guard: neither the test nor its subject (templates/.git-hooks/pre-push) is in
-# package.json files[] — both are source-tree-only infra. Without this guard the SHIPPED selfcheck
-# fails for every consumer running `npm test` on the installed package. Caught pre-publish 2026-07-20
-# by reproducing package mode; mirrors the ref-path SKIP below.
+# ⚠️ CORRECTED 2026-08-12 (innovator Mode F scan → resolved by measurement). This comment used to
+# read: "neither the test nor its subject (templates/.git-hooks/pre-push) is in package.json files[]
+# — both are source-tree-only infra." **That was false**, and it had been false long enough to be
+# load-bearing. `npm pack --dry-run --json` on this tree returns 262 files including
+# templates/.git-hooks/pre-push, templates/.git-hooks/pre-commit AND
+# scripts/test_prepush_stdin_integrity.sh — subject and anchor both ship (package.json:117 declares
+# the whole `templates/.git-hooks` directory).
+# The consequence is what makes this worth fixing rather than just re-wording: if the subject always
+# ships, then "subject absent" can no longer mean "package mode" — the only way to reach that arm is
+# that **the hook was deleted**, and it was rendering that as a green SKIP. This is the fourth face
+# of the axis the card names three of at §🔱⑮ (미측정→clean · 미측정→findings · 해당없음→FAIL):
+# **삭제→SKIP**. A deleted Destructive-Op gate reporting green on every surface is the worst of the
+# four, because the other three are loud.
+# Kept as a three-valued check rather than a bare FAIL: a consumer's tree can legitimately lack the
+# directory if they installed with --ignore-scripts and pruned, so the *declaration* is what decides,
+# not the environment (same discipline as `_pkg_accepted_absent` above — consult what ships, do not
+# re-derive it from what happens to be on disk).
 if [ ! -f templates/.git-hooks/pre-push ]; then
-  echo "SKIP  pre-push stdin integrity (package mode: templates/.git-hooks absent)"
+  if _ships_per_files "templates/.git-hooks/pre-push"; then
+    echo "FAIL  pre-push stdin integrity: templates/.git-hooks/pre-push is DECLARED SHIPPED but absent"
+    echo "      — that is a deletion or a broken install, not package mode. The Destructive-Op gate"
+    echo "      this anchors is the thing that is missing."
+    fail=1
+  else
+    echo "SKIP  pre-push stdin integrity (not shipped per package.json files[], and absent)"
+  fi
 elif [ -f scripts/test_prepush_stdin_integrity.sh ]; then
   if ! bash scripts/test_prepush_stdin_integrity.sh; then
     fail=1
@@ -173,7 +265,7 @@ fi
 # (scripts/degrade_direction_scan.sh) and the anchor both ship, so this runs in package mode too;
 # only a missing SUBJECT is a legitimate skip.
 if [ ! -f scripts/degrade_direction_scan.sh ]; then
-  echo "SKIP  degrade-scan shell probes (subject scripts/degrade_direction_scan.sh absent)"
+  _absent_subject_verdict "degrade-scan shell probes" "scripts/degrade_direction_scan.sh" || fail=1
 elif [ -f scripts/test_degrade_scan_shell_probes.sh ]; then
   if ! bash scripts/test_degrade_scan_shell_probes.sh; then
     fail=1
@@ -189,7 +281,7 @@ fi
 # pair, a template that defeats the gate (a rendered newline turns the pattern into an OR search)
 # passes silently — measured 2026-08-12 on a stale README that the gate reported as PASS.
 if [ ! -f scripts/count_check.sh ]; then
-  echo "SKIP  count_check README-format lanes (subject scripts/count_check.sh absent)"
+  _absent_subject_verdict "count_check README-format lanes" "scripts/count_check.sh" || fail=1
 elif [ -f scripts/test_count_check_readme_format_lanes.sh ]; then
   if ! bash scripts/test_count_check_readme_format_lanes.sh; then
     fail=1
@@ -199,6 +291,22 @@ else
   fail=1
 fi
 
+# The public-surface scanner's SINGLE-FILE and MISUSE paths. Same subject-present/anchor-gone shape:
+# the scanner is a fail-closed gate on an irreversible surface, and its failure mode is a green that
+# was never earned — a misuse, an unloaded pattern set, or dead plumbing all used to render as clean.
+# Wired here on purpose (cross-family round 2): the lane file existed and was syntax-checked only, so
+# `npm test` and `prepublishOnly` never executed it. A checker nobody calls is prose.
+if [ ! -f scripts/psa_scan_lib.sh ]; then
+  _absent_subject_verdict "psa single-file lanes" "scripts/psa_scan_lib.sh" || fail=1
+elif [ -f scripts/test_psa_singlefile_lanes.sh ]; then
+  if ! bash scripts/test_psa_singlefile_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  psa single-file lanes: psa_scan_lib.sh present but its anchor is missing"
+  fail=1
+fi
+
 # package-coverage — a shipped doc must not point at a file the tarball omits. Distinct from the
 # ref-path check below: that one asks "does this path exist at all", this one asks "does the
 # CONSUMER get it". Measured 2026-07-28: 35 paths existed, were named by a shipped doc, and were
@@ -213,7 +321,7 @@ fi
 # to reason about CI. scripts/test_package_coverage_lanes.sh pins the predicate across all four
 # tree shapes plus a known pair.
 if [ ! -f scripts/package_coverage_check.sh ]; then
-  echo "SKIP  test_package_coverage_lanes.sh (subject scripts/package_coverage_check.sh absent)"
+  _absent_subject_verdict "test_package_coverage_lanes.sh" "scripts/package_coverage_check.sh" || fail=1
 elif [ -f scripts/test_package_coverage_lanes.sh ]; then
   if ! bash scripts/test_package_coverage_lanes.sh; then
     fail=1
@@ -226,16 +334,160 @@ else
   fail=1
 fi
 
-# embedded --self-test suites (compaction_probe · judgment_circuit_lint · novelty_claim_check).
-# These three carry their lanes INSIDE the script (`--self-test`) rather than in a sibling
-# test_*_lanes.sh, so the name-list wiring above skipped them silently: 48 lanes existed and ran
+# lane-runner — sibling of package-coverage one level up: that one asks "does the CONSUMER get the
+# file a shipped doc names", this one asks "does ANYTHING execute the lane suite we wrote". Measured
+# 2026-08-12 (reship axis, card §🔱⑮ A): 12 of 43 suites under scripts/ had no runner in selfcheck,
+# the git hooks, or CI — including scripts/test_marker_crossfamily_lanes.sh, whose subject is a
+# marker field that hard-blocks commits, and scripts/test_marker_floor_lanes.sh, whose subject is
+# pre-commit's live validate_marker_floor(). Both gates ship; neither calibration had ever run.
+# The card recorded this as three specific repairs needing "one anchor each"; wiring three anchors
+# would have closed those three and stayed blind to the other nine and to the thirteenth. This runs
+# unconditionally when present because its own absence is the defect class it exists to detect —
+# there is no package-mode arm to skip into (a consumer running `npm test` should learn that a
+# shipped suite of theirs is dead code just as much as we should).
+# THREE-VALUED, and the third value exists because the two-valued version was this session's own
+# instance of the defect it detects. The first draft was `if [ -f … ]; then run; fi` — an absent
+# checker fell through to nothing, silently. That is "미측정을 0으로 렌더" reproduced by the commit
+# that closed it: a 1.4.96 consumer has no lane_runner_check.sh (it was added to files[] AFTER that
+# publish), so on their machine this block would have printed nothing at all and `npm test` would
+# have reported a clean run of a check that never existed there.
+# The three states are distinguished by the DECLARATION, not by the environment (same discipline as
+# the pre-push block above): present → run · absent-but-declared-shipped → FAIL (deletion or broken
+# install) · absent-and-not-declared → SKIP, saying so. For a 1.4.96 consumer the third arm is the
+# correct and honest answer, and it names itself rather than being silent.
+if [ -f scripts/lane_runner_check.sh ]; then
+  if ! bash scripts/lane_runner_check.sh; then
+    fail=1
+  fi
+elif _ships_per_files "scripts/lane_runner_check.sh"; then
+  echo "FAIL  lane-runner: scripts/lane_runner_check.sh is DECLARED SHIPPED but absent — deletion or"
+  echo "      broken install. The check that detects unrun lane suites is itself missing."
+  fail=1
+else
+  echo "SKIP  lane-runner (not in this package's files[] — predates the version that ships it)"
+fi
+
+# ── the twelve suites lane_runner_check.sh measured as having NO runner (2026-08-12) ───────────
+# The check directly above COUNTS them; this block is what makes the count go down. Until now the
+# repo shipped a checker that reported its own todo list every run and nothing that discharged it,
+# which is a decision surface only for as long as someone acts on it.
+#
+# What was actually measured before this wiring existed, because the size of the fact is the reason
+# the block is here: all twelve pass when run by hand (rc=0, ~40s total), and NINE OF THE TWELVE
+# ARE IN THE PUBLISHED TARBALL (`npm pack --dry-run --json`, 263 files). So a consumer running
+# `npm test` was shipping-and-carrying nine test suites that nothing on their machine ever called.
+# The two that hurt most: test_marker_crossfamily_lanes.sh calibrates the `crossfamily:` marker enum
+# that hard-blocks commits, and test_marker_floor_lanes.sh calibrates pre-commit's live
+# validate_marker_floor(). Both gates ship and block; neither calibration had ever executed.
+#
+# ONE loop, not twelve blocks, and that is deliberate: the four-value routing below would otherwise
+# be hand-copied twelve times, and this repo has already measured what that produces — two copies of
+# a normalizer drifting in leniency until one of them silently drops its input
+# ([[feedback_divergent_leniency_duplicate_normalizers]]). The pair table is data; the verdict logic
+# exists once. The existing SessionStart pair-loop below/above uses the same shape.
+#
+# FOUR values, and every arm is reachable on a real machine:
+#   subject absent        → _absent_subject_verdict (deletion vs package mode, decided by files[])
+#   anchor present        → run it. exit 10 is called out separately: several of these suites use it
+#                           for "I could not set myself up" (mktemp failure), which is not a lane
+#                           failure and must not be reported as one — it still sets fail, because a
+#                           harness that could not measure did not pass ([[not_found_is_not_zero]]).
+#   anchor absent+shipped → FAIL. Deletion or broken install, exactly like the block above.
+#   anchor absent+unshipped → SKIP, naming itself. Three anchors genuinely do not ship
+#                           (chamber_run · frontier_digest_retry · residency_closure), so for a
+#                           consumer this arm is the honest answer, not a dodge.
+#
+# Subject choice is the file whose behaviour the suite pins, so that deleting the subject routes to
+# "your install is broken" rather than to a green run of a test about nothing.
+# test_capability_entrypoint_shipping.sh pins two (degrade_probe_capability.sh and
+# psa_probe_capability.sh); degrade is named here as the sentinel — the suite itself checks both and
+# fails if either is gone, so nothing is lost by not listing both in this table.
+_LANE_TO=""; command -v timeout >/dev/null 2>&1 && _LANE_TO="timeout 300"
+for _pair in \
+  "scripts/degrade_probe_capability.sh|scripts/test_capability_entrypoint_shipping.sh" \
+  "scripts/chamber_run.sh|scripts/test_chamber_run_lanes.sh" \
+  "scripts/destructive_pre_gate.sh|scripts/test_destructive_pre_gate_lanes.sh" \
+  "scripts/env_purity_scan.sh|scripts/test_env_purity_lanes.sh" \
+  "scripts/frontier_digest_daily.sh|scripts/test_frontier_digest_retry.sh" \
+  "scripts/knowledge_seam_check.sh|scripts/test_knowledge_seam_lanes.sh" \
+  "templates/.git-hooks/pre-commit|scripts/test_marker_crossfamily_lanes.sh" \
+  "templates/.git-hooks/pre-commit|scripts/test_marker_floor_lanes.sh" \
+  "scripts/residency_closure_scan.py|scripts/test_residency_closure_lanes.sh" \
+  "scripts/reviewer_capability_corpus.tsv|scripts/test_reviewer_capability_conformance.sh" \
+  "scripts/field_canon_preload.sh|scripts/test_field_canon_lanes.sh" \
+  "scripts/stale_clone_guard.sh|scripts/test_stale_clone_guard_lanes.sh"
+do
+  _subj="${_pair%%|*}"; _anc="${_pair##*|}"; _lbl="${_anc##*/}"
+  if [ ! -f "$_subj" ]; then
+    _absent_subject_verdict "$_lbl" "$_subj" || fail=1
+  elif [ -f "$_anc" ]; then
+    # `< /dev/null` and the timeout are not decoration: test_frontier_digest_retry.sh deliberately
+    # plants a `sleep 300` stub and asserts a 3s watchdog kills it. If that watchdog ever regresses
+    # — which is the single defect this suite exists to catch — an unguarded call does not go RED,
+    # it HANGS, and CI dies on a job timeout with the cause unattributable. The suite that detects
+    # a broken watchdog must not be able to inherit the hang. Same `command -v timeout` guard as the
+    # --self-test loop below, because `timeout` is GNU coreutils and stock macOS has neither it nor
+    # a substitute; without it `< /dev/null` is the whole defence and a suite that reads stdin ends
+    # immediately instead of waiting forever.
+    $_LANE_TO bash "$_anc" < /dev/null; _rc=$?
+    case "$_rc" in
+      0) ;;
+      # The suite could not MEASURE. Distinguished from "the lane failed" because the two send a
+      # reader to different places, and a bare fail=1 sends them to the wrong one. 10 = the suite's
+      # own setup failed (mktemp, used by several of these); 2 = its subject was missing when it
+      # looked (test_knowledge_seam_lanes.sh:7 FATALs this way); 126/127 = the anchor is not
+      # executable or not found at all, i.e. a broken install that reached this arm anyway.
+      # Every one of them still sets fail — a harness that could not measure did not pass — but it
+      # is LABELLED, so the next reader debugs the instrument instead of the lane.
+      # The first draft of this loop routed only 10 and let everything else fall into an unlabelled
+      # fail=1. That is the same "assumed impossible rather than routed" shape that the sibling
+      # commit in lane_runner_check.sh had just written a paragraph against; adversarial review
+      # caught the inconsistency between the two files.
+      10|2|126|127)
+        echo "HARNESS ERROR  $_lbl: the suite exited $_rc — it could not measure, so its verdicts"
+        echo "      prove nothing about $_subj. Not a lane failure, and not a pass either."
+        fail=1 ;;
+      *) fail=1 ;;
+    esac
+  elif _pkg_accepted_absent "$_anc"; then
+    # DECLARED legitimately unshipped — the single source for that answer, not a guess from the
+    # environment. The first draft printed "this package predates it", which is a WRONG DIAGNOSIS
+    # printed forever on every consumer machine: these anchors do not lag the package, they are
+    # deliberately not in it (their subjects do not ship either). A confident wrong reason in a
+    # verdict line is worse than no reason, because it is the line the next person greps.
+    echo "SKIP  $_lbl (declared legitimately unshipped — package_coverage_check.sh ACCEPTED_ABSENT)"
+  else
+    # Not present, and NOT declared absent — so either it should be here (deletion / broken
+    # install) or the declaration is stale. Routed through the same three-valued helper as the
+    # subject arm above, and for the identical reason: `elif _ships_per_files "$_anc"` was a
+    # BOOLEAN test over a THREE-valued function, so its exit 2 (package.json unreadable = UNKNOWN)
+    # fell through to a green SKIP. That is the lenient branch the helper's own comment forbids
+    # ("THE UNKNOWN ARM IS NOT A SKIP"), rebuilt twelve times in one loop, thirty lines under the
+    # helper that exists to prevent it. Found by adversarial review; I had written both.
+    _absent_subject_verdict "$_lbl (anchor)" "$_anc" || fail=1
+  fi
+done
+
+# embedded --self-test suites (compaction_probe · judgment_circuit_lint · novelty_claim_check ·
+# chamber_witness · digest_landing_check).
+# These carry their lanes INSIDE the script (`--self-test`) rather than in a sibling
+# test_*_lanes.sh, so the name-list wiring above skipped them silently: lanes existed and ran
 # only when a human typed the command. That is built-but-not-wired applied to the anchors themselves
 # — a later edit that breaks a lane stays green everywhere the project actually checks
 # (high re-review 2026-08-08). Same shape as the block above: subject absent → SKIP, subject present
 # but self-test missing → FAIL, never a silent pass.
-for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
+# chamber_witness/digest_landing_check joined 2026-08-15 (DEBT closed — lane_runner_check.sh
+# flagged 4 undeclared self-test subjects; capability_registry_check and relay_channel are the
+# other two and do NOT join this loop, each for its own reason, see their own blocks below).
+# capability_registry_check was tried here first and reverted: its passing-run output never
+# contains 캘리브레이션 as a VERDICT — the only occurrence is inside a Korean *test-case title*
+# ("M4: 캘리브레이션 쌍 미선언", capability_registry_check.sh's own self-test), so a future rename
+# or trim of that one test name would flip a real PASS into "dispatcher missing?" here (cross-family
+# review caught this, 2026-08-15). chamber_witness/digest_landing_check both print a genuine
+# terminal "캘리브레이션 통과/실패" line, so they stay.
+for _subj in compaction_probe judgment_circuit_lint novelty_claim_check chamber_witness digest_landing_check; do
   if [ ! -f "scripts/$_subj.sh" ]; then
-    echo "SKIP  $_subj --self-test (subject scripts/$_subj.sh absent)"
+    _absent_subject_verdict "$_subj --self-test" "scripts/$_subj.sh" || fail=1
   else
     # ⚠️ **문자열 존재로 판정하지 마라.** 초판은 `grep -q -- '--self-test'` 였는데, 그 문자열은
     # 헤더 주석과 usage echo 에도 있어서 **디스패처 한 줄만 지워도 여전히 매치**한다. 그리고
@@ -249,8 +501,29 @@ for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
     # 난다(실측: homebrew 없는 PATH 에서 3개 subject 전부). 소비자 머신에서 `npm test` 와
     # `prepublishOnly` 를 깨뜨리는 경로다. 정답 폼은 이미 레포에 있다(sync-from-be.sh:134).
     # 없으면 무한대기 방지를 잃는 대신 도는 쪽을 택한다 — `< /dev/null` 이 그 방어의 본체다.
-    local _to=""; command -v timeout >/dev/null 2>&1 && _to="timeout 120"
+    # `local` OUTSIDE A FUNCTION, which this loop is. bash prints
+    #   "selfcheck.sh: line N: local: can only be used in a function"
+    # on stderr, the assignment never happens, and `_to` stays empty — so the timeout this line
+    # exists to install was NEVER INSTALLED. The guard has been decoration since it was written;
+    # the comment above it describing what it protects against was true and unimplemented. Measured
+    # 2026-08-13: the error printed three times (once per subject) in a full run, and had been
+    # printing in every run before that, unread, because stderr scrolls past a 240-second check.
+    # ★ A guard that announces its own failure every single run is still a silent failure if
+    # nothing reads the announcement. Fixed by deleting one word.
+    _to=""; command -v timeout >/dev/null 2>&1 && _to="timeout 120"
     _st_out="$($_to bash "scripts/$_subj.sh" --self-test < /dev/null 2>&1)"; _st_rc=$?
+    # rc=10 (or the sibling harness-error codes) means the subject could not even set up its own
+    # known-pair fixture (e.g. mktemp failed) — it never got to run a lane, so it never printed
+    # 캘리브레이션 either way. Falling through to the *)  arm below would report the confident but
+    # WRONG cause "dispatcher missing?" for an instrument that was never reached. chamber_witness.sh
+    # and digest_landing_check.sh both have real mktemp-failure → return 10 paths (cross-family
+    # review 2026-08-15); the two original loop members never did, so this arm is a no-op for them.
+    case "$_st_rc" in
+      10|2|126|127)
+        echo "HARNESS ERROR  $_subj --self-test: the suite exited $_st_rc — it could not measure,"
+        echo "      so its verdicts prove nothing about $_subj. Not a lane failure, not a pass either."
+        fail=1; continue ;;
+    esac
     case "$_st_out" in
       *캘리브레이션*) : ;;
       *) echo "FAIL  $_subj: --self-test produced no calibration verdict (dispatcher missing?)"
@@ -265,6 +538,50 @@ for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
   fi
 done
 
+# capability_registry_check — one of the 4 embedded --self-test subjects lane_runner_check.sh
+# flagged (2026-08-15), kept out of the loop above (see that loop's comment) because its own
+# terminal line is `통과 N · 실패 N`, never 캘리브레이션 — gate on exit code instead, same shape
+# as utterance_landing_check.sh below. Ships via package.json files[], so absence is FAIL, not SKIP.
+if [ ! -f scripts/capability_registry_check.sh ]; then
+  echo "FAIL  capability_registry_check.sh: missing — it ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+elif _out=$(bash scripts/capability_registry_check.sh --self-test < /dev/null 2>&1); then
+  echo "PASS  capability_registry_check.sh --self-test ($(printf '%s\n' "$_out" | grep -oE '통과 [0-9]+ · 실패 [0-9]+' | tail -1))"
+else
+  echo "FAIL  capability_registry_check.sh: --self-test failed"
+  _show_failure "$_out"
+  fail=1
+fi
+
+# relay_channel — the other embedded --self-test subject kept out of the loop above: its
+# `--self-test` just `exec`s the sibling scripts/test_relay_channel_lanes.sh, whose own exit code
+# is already disciplined (`[ "$fail" -eq 0 ] || exit 1`), so gating on exit code — same shape as
+# utterance_landing_check.sh below — is both sufficient and correct here; a 캘리브레이션 substring
+# check would be the wrong instrument for this subject's actual completion marker
+# ("N PASS / M FAIL"). Ships via package.json files[] (no ACCEPTED_ABSENT declaration), so absence
+# is FAIL, not SKIP — same reasoning as utterance_landing_check.sh's absence branch below.
+# Existence check covers BOTH files: relay_channel.sh --self-test just execs the sibling lanes
+# file, so a missing sibling alone produces an unrelated-looking `exec: No such file` (rc=127) that
+# the generic FAIL branch would misreport as "the lane broke" rather than "the anchor is gone"
+# (cross-family review 2026-08-15).
+# `_LANE_TO` (defined above, the pair-suite loop's own guard) is reused rather than a fresh
+# timeout var — this is, by lane count, the largest suite dispatched anywhere in this file
+# (test_relay_channel_lanes.sh runs 45+ lanes, each spawning relay_channel.sh, each spawning its
+# own node subprocess), and it was the one dispatch here with NO time bound at all; `< /dev/null`
+# only stops a stdin-wait hang, not a runaway child (cross-family review 2026-08-15 — this file's
+# own comment two loops up already names exactly this failure shape: an unguarded call does not go
+# red, it hangs, and CI dies on a job timeout with the cause unattributable).
+if [ ! -f scripts/relay_channel.sh ] || [ ! -f scripts/test_relay_channel_lanes.sh ]; then
+  echo "FAIL  relay_channel.sh: missing (relay_channel.sh or its sibling test_relay_channel_lanes.sh) — ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+elif _out=$($_LANE_TO bash scripts/relay_channel.sh --self-test < /dev/null 2>&1); then
+  echo "PASS  relay_channel.sh --self-test ($(printf '%s\n' "$_out" | grep -oE 'relay_channel lanes: [0-9]+ PASS / [0-9]+ FAIL' | tail -1))"
+else
+  echo "FAIL  relay_channel.sh: --self-test failed"
+  _show_failure "$_out"
+  fail=1
+fi
+
 # memory-link-check — the memory store is a GRAPH (memory_intent_recall.md: nodes=files,
 # edges=[[links]], recall walks one hop). Measured 2026-07-28: 50 of 872 edges pointed at a note
 # that existed under a different separator and 22 at nothing — a dead edge returns nothing and is
@@ -291,7 +608,7 @@ fi
 # anchor was written into tests/ with ZERO callers first — the same defect this file already
 # records twice above; wiring it here is the fix, not a note about the fix.
 if [ ! -f scripts/consent_registry_check.sh ]; then
-  echo "SKIP  test_consent_registry.sh (subject scripts/consent_registry_check.sh absent)"
+  _absent_subject_verdict "test_consent_registry.sh" "scripts/consent_registry_check.sh" || fail=1
 elif [ -f scripts/test_consent_registry.sh ]; then
   if ! bash scripts/test_consent_registry.sh; then
     fail=1
@@ -306,7 +623,7 @@ fi
 # cross-family verification. The anchor's first version shipped in tests/ with ZERO callers — the
 # same defect the comment above records for test_card_drift_probe.sh, repeated one file later.
 if [ ! -f scripts/sidecar_wait.sh ]; then
-  echo "SKIP  test_sidecar_wait_stdin.sh (subject scripts/sidecar_wait.sh absent)"
+  _absent_subject_verdict "test_sidecar_wait_stdin.sh" "scripts/sidecar_wait.sh" || fail=1
 elif [ -f scripts/test_sidecar_wait_stdin.sh ]; then
   if ! bash scripts/test_sidecar_wait_stdin.sh; then
     fail=1
@@ -325,7 +642,7 @@ fi
 # states that look identical from outside ("the sidecar ran" vs "the model I pinned answered",
 # "absent" vs "unmeasured"), and its lanes are hermetic stubs, so running them costs nothing.
 if [ ! -f scripts/sidecar_calibrate.sh ]; then
-  echo "SKIP  test_sidecar_calibrate_lanes.sh (subject scripts/sidecar_calibrate.sh absent)"
+  _absent_subject_verdict "test_sidecar_calibrate_lanes.sh" "scripts/sidecar_calibrate.sh" || fail=1
 elif [ -f scripts/test_sidecar_calibrate_lanes.sh ]; then
   if ! bash scripts/test_sidecar_calibrate_lanes.sh; then
     fail=1
@@ -422,7 +739,7 @@ _gps_missing=""
 [ -f templates/.git-hooks/pre-commit ] || _gps_missing="templates/.git-hooks/pre-commit"
 [ -f templates/regression_guard.sh ] || _gps_missing="${_gps_missing:+$_gps_missing, }templates/regression_guard.sh"
 if [ -n "$_gps_missing" ]; then
-  echo "SKIP  gate_pathspec_check.sh (subject absent: $_gps_missing) — not-checked, NOT a pass"
+  _absent_subject_verdict "gate_pathspec_check.sh" "$_gps_missing" || fail=1
 elif [ -f scripts/gate_pathspec_check.sh ]; then
   if ! bash scripts/gate_pathspec_check.sh; then
     fail=1
@@ -444,7 +761,7 @@ else
 fi
 
 if [ ! -f scripts/fh_node_check.sh ]; then
-  echo "SKIP  test_node_check_lanes.sh (subject scripts/fh_node_check.sh absent)"
+  _absent_subject_verdict "test_node_check_lanes.sh" "scripts/fh_node_check.sh" || fail=1
 elif [ -f scripts/test_node_check_lanes.sh ]; then
   if ! bash scripts/test_node_check_lanes.sh; then
     fail=1
@@ -457,7 +774,7 @@ fi
 # The infra-delta half of the same subject. Separate suite, same pairing rule: it exists only because
 # fh_node_check.sh does, so its absence beside a present subject is a FAIL, not a skip.
 if [ ! -f scripts/fh_node_check.sh ]; then
-  echo "SKIP  test_node_infra_delta_lanes.sh (subject scripts/fh_node_check.sh absent)"
+  _absent_subject_verdict "test_node_infra_delta_lanes.sh" "scripts/fh_node_check.sh" || fail=1
 elif [ -f scripts/test_node_infra_delta_lanes.sh ]; then
   if ! bash scripts/test_node_infra_delta_lanes.sh; then
     fail=1
@@ -468,14 +785,43 @@ else
 fi
 
 # SessionStart multi-hook + install-wizard snippet merge. Subject for both = the shipped settings
-# snippets; a clone without them is a legitimate SKIP, a clone with them and no anchor is not.
+# snippets; a clone without them is a legitimate SKIP, a clone with them and no anchor is not —
+# UNLESS the anchor itself is declared package-mode-optional. test_sessionstart_multihook_lanes.sh
+# is exactly that. Its ACCEPTED_ABSENT entry (package_coverage_check.sh) covers a DIFFERENT case than
+# this loop implements: that entry's "selfcheck reports it NOT EXERCISED (exit 2)" describes the
+# anchor RUNNING and finding no CLI (handled a few lines below, rc==2). It never claimed anything
+# about the anchor FILE being missing — a real consumer never gets to run it at all (the file is not
+# in files[]), and this loop had no branch for that at all, so every installed package hit
+# "FAIL … anchor is missing" (corrected 2026-08-12, cross-family review — an earlier revision of this
+# comment miscited the ACCEPTED_ABSENT entry as already covering the missing-file case). Fixed by
+# consulting the SAME declaration (`_pkg_accepted_absent`, loaded once near the top of this file) that
+# the ref-path block above uses — not an environment predicate — because `.git` presence answers "is
+# there a git repo here", not "was this anchor declared intentionally unshipped", and the two diverge
+# in a git-tracked vendored tree (a monorepo committing node_modules, `git init` after install): `.git`
+# exists there too, which would silently reproduce the original FAIL.
+# test_wizard_snippet_merge_lanes.sh is NOT in ACCEPTED_ABSENT (it does ship, per files[]) — routing
+# both anchors through the same declaration lookup, rather than hardcoding one as always-FAIL, means a
+# future person who genuinely needs to exempt it does so by editing ONE list, not by finding this loop.
 for _pair in \
-  "templates/settings.SessionStart.snippet.json|scripts/test_sessionstart_multihook_lanes.sh" \
-  "templates/settings.SessionStart.snippet.json|scripts/test_wizard_snippet_merge_lanes.sh"
+  "templates/settings.SessionStart.snippet.json|scripts/test_sessionstart_multihook_lanes.sh|package-optional" \
+  "templates/settings.SessionStart.snippet.json|scripts/test_wizard_snippet_merge_lanes.sh|always-shipped"
 do
-  _subj="${_pair%%|*}"; _anc="${_pair#*|}"
+  _subj="${_pair%%|*}"; _rest="${_pair#*|}"; _anc="${_rest%%|*}"; _mode="${_rest#*|}"
+  # This mode field is a gate-verdict policy value (does a missing anchor FAIL or SKIP), not free
+  # text — an unrecognized value must not silently fall through to whichever branch string-matching
+  # happens to miss. Cross-family review, 2026-08-12: the two known values were previously the only
+  # ones exercised, so a typo (e.g. "alway-shipped") landed in the `else` FAIL branch by accident of
+  # string mismatch rather than by a checked policy — fail-closed in practice, but undeclared.
+  case "$_mode" in
+    package-optional|always-shipped) ;;
+    *)
+      echo "FAIL  ${_anc##*/}: unrecognized pair mode '$_mode' (expected package-optional or always-shipped)"
+      fail=1
+      continue
+      ;;
+  esac
   if [ ! -f "$_subj" ]; then
-    echo "SKIP  ${_anc##*/} (subject $_subj absent)"
+    _absent_subject_verdict "${_anc##*/}" "$_subj" || fail=1
   elif [ -f "$_anc" ]; then
     # THREE-valued, like the session-close anchors above — and for a third reason they do not have.
     # test_sessionstart_multihook_lanes.sh measures what the LIVE `claude` CLI does with several
@@ -494,6 +840,8 @@ do
     elif [ "$_rc" -ne 0 ]; then
       fail=1
     fi
+  elif [ "$_mode" = "package-optional" ] && _pkg_accepted_absent "$_anc"; then
+    echo "SKIP  ${_anc##*/} (declared ACCEPTED_ABSENT — CLI/cost-gated, see package_coverage_check.sh)"
   else
     echo "FAIL  ${_anc##*/}: $_subj present but its anchor is missing"
     fail=1
@@ -504,7 +852,7 @@ done
 # 2026-07-31; the pipe-verdict lane shipped in PR #209 WITHOUT this wiring, which is itself the
 # half-fix class the second guard exists to catch — found by running that guard on this repo.
 if [ ! -f scripts/sidecar_calibrate.sh ]; then
-  echo "SKIP  test_ollama_panel_lanes.sh (subject scripts/sidecar_calibrate.sh absent)"
+  _absent_subject_verdict "test_ollama_panel_lanes.sh" "scripts/sidecar_calibrate.sh" || fail=1
 elif [ -f scripts/test_ollama_panel_lanes.sh ]; then
   if ! bash scripts/test_ollama_panel_lanes.sh; then
     fail=1
@@ -515,7 +863,7 @@ else
 fi
 
 if [ ! -f scripts/pipe_verdict_guard.sh ]; then
-  echo "SKIP  test_pipe_verdict_guard_lanes.sh (subject scripts/pipe_verdict_guard.sh absent)"
+  _absent_subject_verdict "test_pipe_verdict_guard_lanes.sh" "scripts/pipe_verdict_guard.sh" || fail=1
 elif [ -f scripts/test_pipe_verdict_guard_lanes.sh ]; then
   if ! bash scripts/test_pipe_verdict_guard_lanes.sh; then
     fail=1
@@ -526,7 +874,7 @@ else
 fi
 
 if [ ! -f scripts/halffix_propagation_scan.sh ]; then
-  echo "SKIP  test_halffix_lanes.sh (subject scripts/halffix_propagation_scan.sh absent)"
+  _absent_subject_verdict "test_halffix_lanes.sh" "scripts/halffix_propagation_scan.sh" || fail=1
 elif [ -f scripts/test_halffix_lanes.sh ]; then
   if ! bash scripts/test_halffix_lanes.sh; then
     fail=1
@@ -550,7 +898,7 @@ fi
 
 for _anchor in scripts/test_session_close_lanes.sh scripts/test_card_drift_probe.sh scripts/test_session_close_chain_lanes.sh; do
   if [ ! -f scripts/session_close_check.sh ]; then
-    echo "SKIP  ${_anchor##*/} (subject scripts/session_close_check.sh absent)"
+    _absent_subject_verdict "${_anchor##*/}" "scripts/session_close_check.sh" || fail=1
   elif [ -f "$_anchor" ]; then
     # Preserve the anchor's two failure CLASSES instead of flattening them into one `fail=1`.
     # An anchor exits 3 when a fixture's premise never obtained — "this run's verdicts prove
@@ -660,7 +1008,7 @@ fi
 # tag reached the remote and a publish from the wrong tree was stopped only by npm's own collision
 # check, so an unrun anchor here would be the same luck-as-floor arrangement one layer up.
 if [ ! -f templates/.git-hooks/pre-push ]; then
-  echo "SKIP  test_tag_version_lanes.sh (subject templates/.git-hooks/pre-push absent)"
+  _absent_subject_verdict "test_tag_version_lanes.sh" "templates/.git-hooks/pre-push" || fail=1
 elif [ -f scripts/test_tag_version_lanes.sh ]; then
   # RUN-ONCE, CAPTURE (2026-08-05) — rationale in the sync_from_be_lanes block later in this file.
   if _out=$(bash scripts/test_tag_version_lanes.sh 2>&1); then
@@ -680,7 +1028,7 @@ fi
 # per-plugin entries inside marketplace.json, which the tag lane never opens. Measured 2026-08-06:
 # a bump left the second marketplace entry behind and the tag lane passed 8/8 straight through it.
 if [ ! -f scripts/version_lockstep_check.sh ]; then
-  echo "SKIP  test_version_lockstep_lanes.sh (subject scripts/version_lockstep_check.sh absent)"
+  _absent_subject_verdict "test_version_lockstep_lanes.sh" "scripts/version_lockstep_check.sh" || fail=1
 elif [ -f scripts/test_version_lockstep_lanes.sh ]; then
   if _out=$(bash scripts/test_version_lockstep_lanes.sh 2>&1); then
     echo "PASS  test_version_lockstep_lanes.sh (drift blocks · aligned silent · unreadable = exit 2, not pass)"
@@ -721,6 +1069,23 @@ if [ -f scripts/test_selfcheck_state_lanes.sh ]; then
   fi
 fi
 
+# test_lane_runner_lanes.sh — the checker that finds unrun suites had no suite of its own until
+# 2026-08-13. It guarded its own WIRING (it fails when selfcheck stops calling it) and nothing
+# measured its BEHAVIOUR — the shape it exists to catch, one level up. Wired in the same change
+# that ships it, for the reason the block above states: a suite landed unwired is the defect.
+if [ -f scripts/test_lane_runner_lanes.sh ]; then
+  if _out=$(bash scripts/test_lane_runner_lanes.sh 2>&1); then
+    echo "PASS  test_lane_runner_lanes.sh (org seam: no-op · suppression · fail-closed · controls)"
+  else
+    echo "FAIL  test_lane_runner_lanes.sh: the unrun-suite detector's own verdicts have drifted"
+    _show_failure "$_out"
+    fail=1
+  fi
+elif _ships_per_files "scripts/test_lane_runner_lanes.sh"; then
+  echo "FAIL  test_lane_runner_lanes.sh is DECLARED SHIPPED but absent — deletion or broken install"
+  fail=1
+fi
+
 # sync_from_be_lanes.sh — the RETURN path's anchor. Wired in the same change that ships it: the
 # script had an operator-side caller (a SessionStart hook outside this repo) while its 70 lanes had
 # NO caller anywhere, which is the shape this repo keeps re-finding — a transport that writes into
@@ -764,9 +1129,51 @@ else
   fail=1
 fi
 
+# sync_to_be_lanes.sh — the FORWARD path's anchor (added 2026-08-14, pmh-dev#69). Same shape as the
+# return-path block above and wired in the same change that ships it, for the same reason: a
+# transport with real reported defects (a real add/add conflict, a real hard-abort risk) had no
+# suite exercising it at all before this. Same subject-presence idiom, same run-once-capture
+# discipline (a lane suite discarded to /dev/null on a non-deterministic run already burned two days
+# on this exact file's sibling).
+if [ ! -f scripts/sync-to-be.sh ]; then
+  echo "SKIP  sync_to_be_lanes.sh (subject scripts/sync-to-be.sh absent)"
+elif [ -f scripts/sync_to_be_lanes.sh ]; then
+  if _out=$(bash scripts/sync_to_be_lanes.sh 2>&1); then
+    echo "PASS  sync_to_be_lanes.sh (forward-path lanes)"
+  else
+    echo "FAIL  sync_to_be_lanes.sh: forward-path lanes failed"
+    _show_failure "$_out"
+    fail=1
+  fi
+else
+  echo "FAIL  sync_to_be_lanes.sh: sync-to-be.sh present but its anchor is missing"
+  fail=1
+fi
+
 # Referenced-path existence is a source-tree check. The npm package intentionally
 # ships a narrower runtime surface, so package-mode selfcheck skips this section.
-if [ -d ".claude/rules" ]; then
+# ⚠️ The skip predicate used to be `[ -d ".claude/rules" ]`. That broke the moment the tarball
+# started shipping PART of that directory (`.claude/rules/fh_4axis_gate.md` etc. are in files[]) —
+# the directory then exists in BOTH source and package mode, so the check never skipped in package
+# mode at all. It ran, extracted refs from the shipped CLAUDE.md/.claude/rules/*.md (which still
+# name `.claude/regression/ablation_verdicts.md` and `scripts/probe_scope_check.sh` — both
+# deliberately unshipped, per package_coverage_check.sh's own ACCEPTED_ABSENT list), then tried
+# `git check-ignore` against a tree with no `.git` at all (a real `npm pack` tarball is not a git
+# repo) — that call errors rather than confirming "ignored", so the fallback `[ -f "$p" ]` ran and
+# correctly found nothing, and the check reported FAIL on two paths it had already been told, one
+# check over, were fine to omit. First fix (2026-08-12, reship axis, card §🔱⑮ G/D) swapped the skip
+# predicate for `[ -e .git ]`. Cross-family review then caught that `[ -e .git ]` answers a different
+# question than the one this check needs: a git-TRACKED vendor of this package (a monorepo that
+# commits node_modules, or a consumer who runs `git init` after installing) has `.git` and IS a
+# legitimate package consumer, yet the predicate would route it into the full extraction and
+# reproduce the exact original FAIL on these same two paths — the fix would have closed the bug only
+# in the one shape it was tested against. The general fix is not a better environment predicate; it
+# is not re-deriving "is this legitimately absent" from the environment at all when a DECLARED answer
+# already exists — `_pkg_accepted_absent()`, loaded once near the top of this file — this block now
+# consults it before FAILing, so the two paths render SKIP regardless of how `.git` happens to be
+# shaped in the consumer's tree. `[ -e .git ]` still gates whether the SCAN runs at all (an installed
+# package with no tracked-refs source to lint), which is a real and unrelated question.
+if [ -e ".git" ]; then
   # Backtick-quoted repo-relative file refs in the always-loaded governance surface
   # (CLAUDE.md + .claude/rules/*.md) must exist. Phantom-reference class recurred
   # N>=3 in the 2026-06-11 audit window — instrument-not-habit.
@@ -811,6 +1218,8 @@ REFPY
         echo "SKIP  ref-path (gitignored): $p"
       elif [ -f "$p" ]; then
         echo "PASS  ref-path: $p"
+      elif _pkg_accepted_absent "$p"; then
+        echo "SKIP  ref-path (declared ACCEPTED_ABSENT — see package_coverage_check.sh): $p"
       else
         echo "FAIL  ref-path: $p — referenced in CLAUDE.md/.claude/rules but missing"
         fail=1
@@ -820,7 +1229,7 @@ $_refs
 REFS
   fi
 else
-  echo "SKIP  ref-path (package mode: .claude/rules absent)"
+  echo "SKIP  ref-path (package mode: no .git at package root — source-tree-only check)"
 fi
 
 if [ "$fail" -ne 0 ]; then