@chrono-meta/fh-gate 1.4.96 → 1.4.98

package/scripts/test_consent_registry.sh

@@ -728,6 +728,60 @@ YAML
 lane "P-SPELL a grant WIDER than its class is still refused (the paired control)" 1 "R7"
 
 
+# ── PROV : every verdict states what it measured WITH, and it states the TRUTH ──────────────────
+# 2026-08-12. This gate rides selfcheck → prepublishOnly. A release shipped green from a session whose
+# `python3` resolved to an unrelated project's venv that had PyYAML, while the machine's own python3
+# did not. Nothing was bypassed — the PASS was simply not portable, and said nothing about what
+# produced it.
+#
+# 🟥 The first version of this lane compared two arms, one of them "PyYAML hidden" via
+# `env -i PATH=/usr/bin:/bin PYTHONNOUSERSITE=1`. It passed locally and FAILED IN CI — because
+# `PYTHONNOUSERSITE` suppresses only the USER site directory. On this author's machine PyYAML was a
+# `--user` install so it hid; on the CI runner it is a system `dist-packages` install so it did not,
+# both arms returned the same value, and the lane called its own subject decorative.
+# **The control worked only by accident of how the author happened to install a package** — which is
+# the exact defect class the subject under test exists to catch, reproduced inside its own lane.
+#
+# So the lane no longer manufactures an environment. It compares the reported value against an
+# INDEPENDENT ORACLE computed in the same run: whatever `find_spec` says here, the instrument line
+# must say the same thing. That catches removal, hard-coding, truncation, and drift — everywhere,
+# with no assumption about how PyYAML got installed.
+_prov_line=$(bash "$CHK" 2>&1 | grep -o 'instrument (consent-registry): .*' | head -1)
+_prov_oracle=$(python3 - <<'ORACLE' 2>/dev/null
+import importlib.util, sys
+s = importlib.util.find_spec("yaml")
+print((s.origin or "namespace-package") if s is not None else "ABSENT")
+ORACLE
+)
+if [ -z "$_prov_line" ]; then
+  echo "  ❌ PROV-1 no instrument line on the ordinary path"; fail=$((fail+1))
+elif [ -z "$_prov_oracle" ]; then
+  echo "  ❌ PROV-1 oracle produced nothing — NOT RUN (unmeasured, not a pass)"; fail=$((fail+1))
+elif ! printf '%s' "$_prov_line" | grep -q ': /'; then
+  echo "  ❌ PROV-1 line does not name an absolute interpreter path: [$_prov_line]"; fail=$((fail+1))
+elif ! printf '%s' "$_prov_line" | grep -qF "PyYAML $_prov_oracle"; then
+  echo "  ❌ PROV-1 line disagrees with the oracle — reported [$_prov_line] vs actual [$_prov_oracle]"; fail=$((fail+1))
+else
+  echo "  ✅ PROV-1 instrument line matches an independent resolution of PyYAML [$_prov_oracle]"; pass=$((pass+1))
+fi
+
+# PROV-2 — the ABSENT branch, exercised DETERMINISTICALLY rather than by hiding a package.
+# A `yaml.py` MODULE FILE placed first on PYTHONPATH wins by path order, so find_spec resolves to it
+# — a different, predictable answer that does not depend on how the real PyYAML was installed.
+# ⚠️ A `yaml/` DIRECTORY does NOT work and the first draft used one: a namespace package has LOWER
+# precedence than a regular package, so Python keeps scanning the whole path and still finds the real
+# one. Measured — the arm did not move, and the lane correctly called itself decorative.
+_prov_tmp=$(mktemp -d); printf '# shadow module for the PROV-2 arm\n' > "$_prov_tmp/yaml.py"
+_prov_shadow=$(PYTHONPATH="$_prov_tmp" bash "$CHK" 2>&1 | grep -o 'instrument (consent-registry): .*' | head -1)
+rm -rf "$_prov_tmp"
+if [ -z "$_prov_shadow" ]; then
+  echo "  ❌ PROV-2 no instrument line under a shadowed yaml"; fail=$((fail+1))
+elif [ "$_prov_shadow" = "$_prov_line" ]; then
+  echo "  ❌ PROV-2 line did not move when the resolution moved — decorative [$_prov_line]"; fail=$((fail+1))
+else
+  echo "  ✅ PROV-2 line tracks the resolution when it changes (shadowed → different value)"; pass=$((pass+1))
+fi
+
 echo "----"
 echo "consent-registry anchor: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_degrade_scan_shell_probes.sh

@@ -630,6 +630,81 @@ else
   bad "PY3 mixed-language markdown lost one language — shadows collide by name or the loop stops at the first hit"
 fi
 
+# ── SCOPE: the scanner must HONOR its arguments ────────────────────────────────────────────────
+# This is the contract templates/.git-hooks/pre-commit depends on since 2026-08-13. That hook used
+# to invoke this scanner with NO ARGUMENTS — walking the whole repository — and then discard almost
+# all of it through a `grep -Ff` over the staged load-bearing files it already had in hand.
+# Measured: whole-repo 42s / 260 lines vs one staged file 0s / 2 lines; a sibling harness measured
+# the same call at 2m07s inside a 7m54s–9m40s commit, one of which could not complete at all.
+# The lane exists because the FIX IS SILENTLY REVERSIBLE: if this scanner ever stops honoring its
+# arguments, the hook keeps working and simply becomes slow again — no verdict changes, nothing
+# goes red, and the only symptom is a commit people start bypassing with --no-verify. The same hook
+# carries the Destructive-Op gate, so a trained bypass disarms an irreversible-surface gate too.
+# BEHAVIOURAL, not shape: it asserts the OUTPUT is confined to the named file, which is the property
+# the hook relies on. A grep for "does the hook pass an argument" would pass on a scanner that
+# accepts arguments and ignores them.
+_scope_a="$TMP/scope_a.sh"; _scope_b="$TMP/scope_b.sh"
+printf '#!/usr/bin/env bash\ncheck() { probe || return 0; }\n' > "$_scope_a"
+printf '#!/usr/bin/env bash\nverify() { thing || exit 0; }\n' > "$_scope_b"
+out=$(bash "$SCAN" "$_scope_a" 2>&1)
+if printf '%s' "$out" | grep -q 'scope_a' && ! printf '%s' "$out" | grep -q 'scope_b'; then
+  ok "SCOPE1 a named target is scanned and a sibling file is NOT (the scanner honors argv)"
+else
+  bad "SCOPE1 scanner did not confine itself to the named target — the pre-commit scoping fix is void"
+fi
+# The negative arm: with no argument at all it must NOT confine itself to nothing. Without this,
+# a scanner that returned empty for every input would satisfy SCOPE1 and the lane would be theatre.
+out=$(bash "$SCAN" "$TMP" 2>&1)
+if printf '%s' "$out" | grep -q 'scope_a' && printf '%s' "$out" | grep -q 'scope_b'; then
+  ok "SCOPE2 control: given the containing directory it finds BOTH (it is not simply blind)"
+else
+  bad "SCOPE2 control failed — the scanner found neither file, so SCOPE1 proved nothing"
+fi
+
+# ── C2: bare X-in-Y substring boolean, with the ALL-CAPS exclusion (2026-08-14) ────────────────
+# Cross-family review found this exclusion shipped with zero fixtures anywhere in this repo —
+# deleting the exclusion left every existing lane green, which is exactly the "advisory noise
+# reduction with no anchor" class this repo's own 4-axis doctrine requires a mechanical test for.
+# Two arms: the probe's own headline example (paid⊂prepaid style substring check) must still
+# fire, and an ALL-CAPS collection-membership check — the shape the exclusion targets — must not.
+_c2_pos="$TMP/c2_pos.sh"; _c2_neg="$TMP/c2_neg.sh"
+printf 'if tok in text:\n    pass\n' > "$_c2_pos"
+printf 'if name in PLACEHOLDERS:\n    pass\n' > "$_c2_neg"
+out=$(bash "$SCAN" "$_c2_pos" 2>&1)
+if printf '%s' "$out" | grep -q 'C2:substring-boolean'; then
+  ok "C2-KP substring-boolean on a bare string var still fires"
+else
+  bad "C2-KP the probe's own headline shape (tok in text) no longer fires"
+fi
+out=$(bash "$SCAN" "$_c2_neg" 2>&1)
+if ! printf '%s' "$out" | grep -q 'C2:substring-boolean'; then
+  ok "C2-KN ALL-CAPS collection membership (name in PLACEHOLDERS) stays silent"
+else
+  bad "C2-KN the ALL-CAPS exclusion is not wired — a legitimate collection check still fires"
+fi
+# Revert probe, run inline rather than trusted by inspection: replace the exclusion clause's line
+# in a COPY of the scanner with a bare closing paren (deleting the line outright would strand the
+# preceding line's trailing backslash continuation and break the pipe chain) and confirm C2-KN
+# flips to a hit — proves the exclusion is load-bearing for this specific fixture, not just
+# present somewhere in the file.
+_scan_reverted="$TMP/scan_reverted.sh"
+_excl_line=$(grep -n "grep -vE 'in \[A-Z_\]" "$SCAN" | head -1 | cut -d: -f1)
+if [ -z "$_excl_line" ]; then
+  bad "C2-REVERT could not locate the exclusion line by its known text — fixture cannot run"
+else
+  sed "${_excl_line}s/.*/           )/" "$SCAN" > "$_scan_reverted"
+  chmod +x "$_scan_reverted"
+  # Captured, not piped directly — under `set -o pipefail` (this file's own top line) the scanner's
+  # own advisory exit code (non-zero on any finding) would override grep's match result in a direct
+  # pipe, reporting FAIL even when the fixture worked exactly as intended.
+  _revert_out=$(bash "$_scan_reverted" "$_c2_neg" 2>&1)
+  if printf '%s' "$_revert_out" | grep -q 'C2:substring-boolean'; then
+    ok "C2-REVERT removing the exclusion line makes C2-KN fire again (the exclusion is load-bearing)"
+  else
+    bad "C2-REVERT removing the exclusion line did not flip C2-KN — the fixture proves nothing"
+  fi
+fi
+
 echo "----"
 echo "degrade-scan shell probes: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_field_canon_lanes.sh

@@ -12,10 +12,32 @@ trap 'rm -rf "$TMP"' EXIT
 PASS=0; FAIL=0
 ok(){ PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
 no(){ FAIL=$((FAIL+1)); printf '  ❌ %s — %s\n' "$1" "$2"; }
+
+# ── DEBT fix (2026-08-14) — several lanes below depended on the OPERATOR'S REAL
+# `${HOME}/projects/qasp-dev` mapping to resolve a repo and emit anything at all. On a
+# machine/CI runner without that exact local layout, `repo` resolution in field_canon_preload.sh
+# silently fails (`continue`), `emitted` stays 0, and EVERY assertion that checks "is output
+# non-empty" trivially reads as the WRONG kind of empty — reproduced locally: PASS 12 / FAIL 7 with
+# HOME pointed at an empty dir, exactly the CI split. The fix reuses the fixture shape lane ⑭
+# already demonstrates below (a throwaway hub + a throwaway project root with a real `.git` and
+# README.md) instead of depending on the operator's real filesystem — `found→extend`, not a new
+# mechanism. This also turns ⑧'s prior "PASS" honest: before this fix it passed because repo
+# resolution ALWAYS failed (output always empty regardless of dedup), not because dedup worked
+# ([[feedback_anchor_can_be_decorative]]) — with a real resolvable repo, ⑧ now exercises the actual
+# same-session dedup path.
+FHUB="$TMP/fhub"; mkdir -p "$FHUB/tracks/qasp"
+FPROJ="$TMP/fproj"; mkdir -p "$FPROJ/qasp-dev/.git" "$FPROJ/qasp-dev/docs/governance"
+printf '# qasp fixture\n' > "$FPROJ/qasp-dev/README.md"
+printf 'x\n' > "$FPROJ/qasp-dev/docs/governance/g1.md"
+
 # ★`${3:+VAR=v}` 는 파라미터 확장이라 bash 가 **환경 할당으로 안 읽는다** — env 로 넘긴다.
 #   (이 파일 초판이 그렇게 써서 「레포 부재」 레인이 거짓 적색을 냈다. 계기 결함이었다.)
-run(){ local extra=""; [ -n "${3:-}" ] && extra="FIELD_CANON_PROJECT_ROOT=$3"
-  printf '%s' "$1" | env FIELD_CANON_SENTINEL_DIR="$2" $extra bash "$H" 2>&1; }
+# $3, when given, overrides FIELD_CANON_PROJECT_ROOT (the "레포 부재" control at line ~35 uses this
+# to deliberately point at /nonexistent — CLAUDE_PROJECT_DIR still resolves via the fixture so that
+# control lane is testing "repo absent", not accidentally "mapped name absent" too).
+run(){ local root="$FPROJ"; [ -n "${3:-}" ] && root="$3"
+  printf '%s' "$1" | env CLAUDE_PROJECT_DIR="$FHUB" FIELD_CANON_PROJECT_ROOT="$root" \
+    FIELD_CANON_SENTINEL_DIR="$2" bash "$H" 2>&1; }
 
 echo "== field-canon preload 레인 =="
 
@@ -47,12 +69,14 @@ printf '' | FIELD_CANON_SENTINEL_DIR="$TMP/6" bash "$H" >/dev/null 2>&1
 #    (`[[feedback_anchor_can_be_decorative]]` — 레인이 결함 지점을 비켜 가면 초록은 정보가 아니다.)
 # ⚠️ macOS 는 bash **3.2** 다. `set -u` 아래서 빈 배열 `"${a[@]}"` 는 unbound variable 로 죽는다
 #    — 초판 레인이 정확히 그렇게 죽어 ⑦⑨⑩ 이 **거짓 적색**을 냈다(대상이 아니라 계기의 사망).
-#    배열 없이 분기한다.
+#    배열 없이 분기한다. (FHUB/FPROJ fixture — see the DEBT-fix comment near the top of this file.)
 runD(){ # $1=payload  $2=TMPDIR  [$3=CLAUDE_SESSION_ID 를 환경에 심을지]
   if [ -n "${3:-}" ]; then
-    printf '%s' "$1" | env TMPDIR="$2" CLAUDE_SESSION_ID="$3" bash "$H" 2>&1
+    printf '%s' "$1" | env TMPDIR="$2" CLAUDE_PROJECT_DIR="$FHUB" FIELD_CANON_PROJECT_ROOT="$FPROJ" \
+      CLAUDE_SESSION_ID="$3" bash "$H" 2>&1
   else
-    printf '%s' "$1" | env TMPDIR="$2" bash "$H" 2>&1
+    printf '%s' "$1" | env TMPDIR="$2" CLAUDE_PROJECT_DIR="$FHUB" FIELD_CANON_PROJECT_ROOT="$FPROJ" \
+      bash "$H" 2>&1
   fi; }
 T7="$TMP/def"; mkdir -p "$T7"
 

package/scripts/test_lane_runner_lanes.sh

@@ -0,0 +1,221 @@
+#!/usr/bin/env bash
+# test_lane_runner_lanes.sh — behavioural lanes for scripts/lane_runner_check.sh
+#
+# Why this file exists at all: until 2026-08-13 the checker that detects unrun lane suites had
+# **no lane suite of its own**. It guarded its own WIRING (it fails if selfcheck.sh stops calling
+# it) but nothing measured its BEHAVIOUR. That is the same shape it exists to catch, one level up —
+# a check whose verdicts nobody exercises is prose with an exit code.
+#
+# The lanes below drive it against SYNTHETIC fixture trees, not against this repo. Driving it
+# against the live tree would make every lane depend on today's suite list, so a lane would go red
+# for reasons that have nothing to do with the predicate under test.
+#
+# Script-relative, NOT `git rev-parse --show-toplevel`: in a vendored tree rev-parse returns the
+# OUTER repo and this suite would then test someone else's checkout.
+set -uo pipefail
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CHECK="$REPO_ROOT/scripts/lane_runner_check.sh"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+pass=0; fail=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+
+# ── fixture: a tree with ONE unwired suite and a selfcheck.sh that calls the checker ──────────
+# The `bash scripts/lane_runner_check.sh` line is load-bearing: the checker refuses to run in a
+# tree whose selfcheck.sh does not invoke it (its self-reference guard).
+mkfixture() { # $1 = dir
+  local d="$1"
+  mkdir -p "$d/scripts"
+  cp "$CHECK" "$d/scripts/lane_runner_check.sh"
+  printf '#!/usr/bin/env bash\nbash scripts/lane_runner_check.sh\n' > "$d/scripts/selfcheck.sh"
+  printf '#!/usr/bin/env bash\n: orphan lane suite\n'  > "$d/scripts/test_orphan_lanes.sh"
+}
+run() { ( cd "$1" && bash scripts/lane_runner_check.sh 2>&1 ); }
+rcof() { ( cd "$1" && bash scripts/lane_runner_check.sh >/dev/null 2>&1; echo $? ); }
+
+# ── L1 known-POSITIVE: an undeclared orphan suite must FAIL ───────────────────────────────────
+# Without this arm every lane below proves nothing: a checker that passed unconditionally would
+# satisfy all the "declaration suppresses it" lanes.
+D="$T/l1"; mkfixture "$D"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "1" ] && printf '%s' "$out" | grep -q 'test_orphan_lanes.sh'; then
+  ok "L1 known-positive: undeclared orphan suite → rc=1 and it is named"
+else
+  bad "L1 known-positive did not fire (rc=$rc) — every lane below is meaningless without it"
+fi
+
+# ── L2 NO-OP: no declaration file → behaviour is exactly the L1 behaviour ─────────────────────
+# This is the arm that protects THIS repo, which ships no company/ directory.
+D="$T/l2"; mkfixture "$D"
+out=$(run "$D")
+if ! printf '%s' "$out" | grep -q 'lane_declarations'; then
+  ok "L2 no-op: absent declaration file is silent (no mention in output)"
+else
+  bad "L2 no-op: output mentions the declaration file when none exists"
+fi
+
+# ── L3 org EXEMPT suppresses the orphan ───────────────────────────────────────────────────────
+D="$T/l3"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh   # org-owned, runs in the org CI only\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q '1 exempt'; then
+  ok "L3 org exempt: declared suite no longer fails the check (rc=0, counted exempt)"
+else
+  bad "L3 org exempt did not suppress (rc=$rc) — out: $(printf '%s' "$out" | tail -1)"
+fi
+
+# ── L4 org DEBT suppresses AND is counted as debt ─────────────────────────────────────────────
+D="$T/l4"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'debt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'declared debt'; then
+  ok "L4 org debt: declared suite suppressed and reported as debt"
+else
+  bad "L4 org debt did not land (rc=$rc)"
+fi
+
+# ── L5 VISIBILITY: an org-declared list must never look like this repo's own zero ─────────────
+D="$T/l5"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'debt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D")
+if printf '%s' "$out" | grep -q 'org-declared'; then
+  ok "L5 visibility: output names the org file and its counts"
+else
+  bad "L5 visibility: org declarations are invisible in the output"
+fi
+
+# ── L6 FAIL-CLOSED on an unparseable file ─────────────────────────────────────────────────────
+# The load-bearing distinction. A malformed file must NOT read as "nothing declared" — that would
+# render UNMEASURED as ZERO, and it would do so on the arm where a fork is relying on the file.
+D="$T/l6"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  this line is not an entry\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "2" ] && printf '%s' "$out" | grep -q 'UNMEASURED'; then
+  ok "L6 fail-closed: unparseable declaration file → rc=2 and says UNMEASURED"
+else
+  bad "L6 fail-closed FAILED (rc=$rc) — a malformed file was read as 'no declarations'"
+fi
+
+# ── L6b control for L6: the SAME orphan tree with a WELL-FORMED file must not exit 2 ──────────
+# Without this, L6 would also pass on a checker that exits 2 for any declaration file at all.
+D="$T/l6b"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+if [ "$(rcof "$D")" != "2" ]; then
+  ok "L6b control: a well-formed file does NOT trip the fail-closed arm"
+else
+  bad "L6b control: every declaration file exits 2 — L6 proved nothing"
+fi
+
+# ── L7 unknown section is a parse failure, not a silent skip ──────────────────────────────────
+D="$T/l7"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'allowed:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D")
+if [ "$(rcof "$D")" = "2" ] && printf '%s' "$out" | grep -q "unknown section"; then
+  ok "L7 unknown section → rc=2 and names the section"
+else
+  bad "L7 unknown section was tolerated — a typo'd header would silently declare nothing"
+fi
+
+# ── L8 the same name in both sections is ambiguous, not last-wins ─────────────────────────────
+D="$T/l8"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh\ndebt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D")
+if [ "$(rcof "$D")" = "2" ] && printf '%s' "$out" | grep -q "both exempt and debt"; then
+  ok "L8 same suite in both sections → rc=2 (ambiguous, not silently resolved)"
+else
+  bad "L8 double declaration was silently resolved"
+fi
+
+# ── L9 a stale entry WARNS but does not block (same voice as upstream DEBT hygiene) ───────────
+# Deliberately advisory: making the downstream mirror stricter than the upstream rule it mirrors
+# would train forks to delete the file, which costs more than a stale line.
+D="$T/l9"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh\n  - test_deleted_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'test_deleted_lanes.sh'; then
+  ok "L9 stale entry: warns and names it, does not block (rc=0)"
+else
+  bad "L9 stale entry handling wrong (rc=$rc)"
+fi
+
+# ── L10 comments and blank lines are not entries ──────────────────────────────────────────────
+D="$T/l10"; mkfixture "$D"; mkdir -p "$D/company"
+printf '# org lane declarations\n\nexempt:\n\n  - test_orphan_lanes.sh   # reason lives here\n' > "$D/company/lane_declarations.yaml"
+if [ "$(rcof "$D")" = "0" ]; then
+  ok "L10 comments/blank lines tolerated (a file people can annotate)"
+else
+  bad "L10 a commented, spaced file failed to parse"
+fi
+
+# ── L11/L12 embedded --self-test subjects (found→extend, 2026-08-14) ──────────────────────────
+# A lane suite living INSIDE its subject as a `--self-test` flag has no `test_*.sh`/`*_lanes.sh`
+# filename, so the suites glob above cannot see it at all — measured on this repo's own
+# lane_runner_check.sh header before this feature existed: 4 such subjects had zero callers and
+# nothing here said so. mkfixture without the orphan file, so these lanes isolate the self-test
+# behaviour from L1's own blocking orphan.
+mkfixture_clean() { # $1 = dir
+  local d="$1"
+  mkdir -p "$d/scripts"
+  cp "$CHECK" "$d/scripts/lane_runner_check.sh"
+  # A wired ordinary suite so the `suites` set is non-empty — an empty tree fails EXTRACTOR_BROKE
+  # before the self-test report section runs at all, which would make L11/L12 pass vacuously.
+  printf '#!/usr/bin/env bash\n: wired lane suite\n' > "$d/scripts/test_ok_lanes.sh"
+  printf '#!/usr/bin/env bash\nbash scripts/lane_runner_check.sh\nbash scripts/test_ok_lanes.sh\n' > "$d/scripts/selfcheck.sh"
+}
+
+# L11 known-POSITIVE: an unwired --self-test subject is reported, advisory (rc stays 0).
+D="$T/l11"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L11 known-positive: unwired --self-test subject named, advisory (rc=0)"
+else
+  bad "L11 known-positive did not fire (rc=$rc) — self-test subject not reported"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L12 known-NEGATIVE: the SAME subject, wired through selfcheck.sh's _subj for-loop idiom, is
+# NOT reported — the exact shape scripts/selfcheck.sh:478 actually uses.
+D="$T/l12"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+cat > "$D/scripts/selfcheck.sh" <<'SC'
+#!/usr/bin/env bash
+bash scripts/lane_runner_check.sh
+bash scripts/test_ok_lanes.sh
+for _subj in orphan_probe; do
+  bash "scripts/$_subj.sh" --self-test
+done
+SC
+out=$(run "$D")
+if ! printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L12 known-negative: --self-test subject wired via _subj for-loop is not reported"
+else
+  bad "L12 known-negative: wired subject still reported as unwired"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L13 known-NEGATIVE: the SAME subject, wired through a DIRECT dispatch line — the shape
+# scripts/selfcheck.sh:898/933 actually use (`bash scripts/<name>.sh ... --self-test`), no
+# for-loop at all. Cross-family review 2026-08-14 caught the first draft shipping only the
+# for-loop branch, which meant probe_scope_check.sh and utterance_landing_check.sh — both wired
+# directly, both real — were reported UNDECLARED. This lane pins that class so it cannot silently
+# come back: without it, L11/L12 alone only ever exercise the for-loop shape.
+D="$T/l13"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+cat > "$D/scripts/selfcheck.sh" <<'SC'
+#!/usr/bin/env bash
+bash scripts/lane_runner_check.sh
+bash scripts/test_ok_lanes.sh
+bash scripts/orphan_probe.sh --self-test >/dev/null 2>&1
+SC
+out=$(run "$D")
+if ! printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L13 known-negative: --self-test subject wired via direct dispatch is not reported"
+else
+  bad "L13 known-negative: directly-wired subject still reported as unwired"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+echo "----"
+echo "lane-runner lanes: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/test_marker_crossfamily_lanes.sh

@@ -17,7 +17,16 @@
 # Usage: bash scripts/test_marker_crossfamily_lanes.sh   Exit: 0 = all behave; 1 = regression.
 
 set -uo pipefail
-REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+# Script-relative, NOT `git rev-parse --show-toplevel`. Measured 2026-08-13 in a vendored tree
+# (npm install, then `git init` at a level above — a monorepo committing node_modules is the
+# same shape): rev-parse answers with the OUTER repo's root, so this suite looked for the
+# package's own files inside somebody else's checkout, found nothing, and reported
+# HARNESS-ERROR. The consumer sees a red `npm test` caused entirely by where their .git is.
+# The subject of these lanes ships INSIDE this package, so the package root is the only root
+# that can be right. Same form as test_capability_entrypoint_shipping.sh:29.
+# The exposure is new: before these suites were wired into selfcheck.sh they ran nowhere, so
+# the wrong root never cost anything. Wiring a dead lane surfaces every assumption it made.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
 T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
 

package/scripts/test_marker_floor_lanes.sh

@@ -9,12 +9,36 @@
 # Usage: bash scripts/test_marker_floor_lanes.sh   Exit: 0 = all fixtures behave; 1 = regression.
 
 set -uo pipefail
-REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+# Script-relative, NOT `git rev-parse --show-toplevel`. Measured 2026-08-13 in a vendored tree
+# (npm install, then `git init` at a level above — a monorepo committing node_modules is the
+# same shape): rev-parse answers with the OUTER repo's root, so this suite looked for the
+# package's own files inside somebody else's checkout, found nothing, and reported
+# HARNESS-ERROR. The consumer sees a red `npm test` caused entirely by where their .git is.
+# The subject of these lanes ships INSIDE this package, so the package root is the only root
+# that can be right. Same form as test_capability_entrypoint_shipping.sh:29.
+# The exposure is new: before these suites were wired into selfcheck.sh they ran nowhere, so
+# the wrong root never cost anything. Wiring a dead lane surfaces every assumption it made.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
 T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
 
 sed -n '/^marker_recreate_hint()/,/^}/p;/^validate_marker_floor()/,/^}/p' "$HOOK" > "$T/fn.sh"
 
+# EXTRACTION CALIBRATION — the sibling suite (test_marker_crossfamily_lanes.sh) has had this and
+# this file did not. Without it, ANY failure to extract renders as a REGRESSION rather than as a
+# broken instrument: an empty fn.sh means `run()` sources nothing, validate_marker_floor is
+# undefined, `bash -c` exits non-zero, every fixture reads as BLOCK, and the three lanes that
+# expect PASS "fail" — a red suite pointing at a gate that is perfectly fine. Measured 2026-08-13
+# in a vendored git tree, where the old `git rev-parse` root sent $HOOK into another repo entirely.
+# The root is fixed above; this guard is what makes the NEXT extraction failure legible instead of
+# a false accusation, whatever causes it (a renamed function, a reformatted hook, a truncated file).
+# exit 10, matching the harness-error contract selfcheck.sh's pair-loop routes to HARNESS ERROR.
+if ! grep -q '^validate_marker_floor()' "$T/fn.sh"; then
+  echo "🟥 HARNESS-ERROR: validate_marker_floor() did not extract from $HOOK"
+  echo "   (this suite measured NOTHING — it is not a regression verdict)"
+  exit 10
+fi
+
 run() { bash -c "source '$T/fn.sh'; validate_marker_floor '$1'" >/dev/null 2>&1; }
 
 FAIL=0