@chrono-meta/fh-gate 1.4.97 → 1.4.98

package/scripts/selfcheck.sh

@@ -413,7 +413,9 @@ for _pair in \
   "templates/.git-hooks/pre-commit|scripts/test_marker_crossfamily_lanes.sh" \
   "templates/.git-hooks/pre-commit|scripts/test_marker_floor_lanes.sh" \
   "scripts/residency_closure_scan.py|scripts/test_residency_closure_lanes.sh" \
-  "scripts/reviewer_capability_corpus.tsv|scripts/test_reviewer_capability_conformance.sh"
+  "scripts/reviewer_capability_corpus.tsv|scripts/test_reviewer_capability_conformance.sh" \
+  "scripts/field_canon_preload.sh|scripts/test_field_canon_lanes.sh" \
+  "scripts/stale_clone_guard.sh|scripts/test_stale_clone_guard_lanes.sh"
 do
   _subj="${_pair%%|*}"; _anc="${_pair##*|}"; _lbl="${_anc##*/}"
   if [ ! -f "$_subj" ]; then
@@ -466,14 +468,24 @@ do
   fi
 done
 
-# embedded --self-test suites (compaction_probe · judgment_circuit_lint · novelty_claim_check).
-# These three carry their lanes INSIDE the script (`--self-test`) rather than in a sibling
-# test_*_lanes.sh, so the name-list wiring above skipped them silently: 48 lanes existed and ran
+# embedded --self-test suites (compaction_probe · judgment_circuit_lint · novelty_claim_check ·
+# chamber_witness · digest_landing_check).
+# These carry their lanes INSIDE the script (`--self-test`) rather than in a sibling
+# test_*_lanes.sh, so the name-list wiring above skipped them silently: lanes existed and ran
 # only when a human typed the command. That is built-but-not-wired applied to the anchors themselves
 # — a later edit that breaks a lane stays green everywhere the project actually checks
 # (high re-review 2026-08-08). Same shape as the block above: subject absent → SKIP, subject present
 # but self-test missing → FAIL, never a silent pass.
-for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
+# chamber_witness/digest_landing_check joined 2026-08-15 (DEBT closed — lane_runner_check.sh
+# flagged 4 undeclared self-test subjects; capability_registry_check and relay_channel are the
+# other two and do NOT join this loop, each for its own reason, see their own blocks below).
+# capability_registry_check was tried here first and reverted: its passing-run output never
+# contains 캘리브레이션 as a VERDICT — the only occurrence is inside a Korean *test-case title*
+# ("M4: 캘리브레이션 쌍 미선언", capability_registry_check.sh's own self-test), so a future rename
+# or trim of that one test name would flip a real PASS into "dispatcher missing?" here (cross-family
+# review caught this, 2026-08-15). chamber_witness/digest_landing_check both print a genuine
+# terminal "캘리브레이션 통과/실패" line, so they stay.
+for _subj in compaction_probe judgment_circuit_lint novelty_claim_check chamber_witness digest_landing_check; do
   if [ ! -f "scripts/$_subj.sh" ]; then
     _absent_subject_verdict "$_subj --self-test" "scripts/$_subj.sh" || fail=1
   else
@@ -500,6 +512,18 @@ for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
     # nothing reads the announcement. Fixed by deleting one word.
     _to=""; command -v timeout >/dev/null 2>&1 && _to="timeout 120"
     _st_out="$($_to bash "scripts/$_subj.sh" --self-test < /dev/null 2>&1)"; _st_rc=$?
+    # rc=10 (or the sibling harness-error codes) means the subject could not even set up its own
+    # known-pair fixture (e.g. mktemp failed) — it never got to run a lane, so it never printed
+    # 캘리브레이션 either way. Falling through to the *)  arm below would report the confident but
+    # WRONG cause "dispatcher missing?" for an instrument that was never reached. chamber_witness.sh
+    # and digest_landing_check.sh both have real mktemp-failure → return 10 paths (cross-family
+    # review 2026-08-15); the two original loop members never did, so this arm is a no-op for them.
+    case "$_st_rc" in
+      10|2|126|127)
+        echo "HARNESS ERROR  $_subj --self-test: the suite exited $_st_rc — it could not measure,"
+        echo "      so its verdicts prove nothing about $_subj. Not a lane failure, not a pass either."
+        fail=1; continue ;;
+    esac
     case "$_st_out" in
       *캘리브레이션*) : ;;
       *) echo "FAIL  $_subj: --self-test produced no calibration verdict (dispatcher missing?)"
@@ -514,6 +538,50 @@ for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
   fi
 done
 
+# capability_registry_check — one of the 4 embedded --self-test subjects lane_runner_check.sh
+# flagged (2026-08-15), kept out of the loop above (see that loop's comment) because its own
+# terminal line is `통과 N · 실패 N`, never 캘리브레이션 — gate on exit code instead, same shape
+# as utterance_landing_check.sh below. Ships via package.json files[], so absence is FAIL, not SKIP.
+if [ ! -f scripts/capability_registry_check.sh ]; then
+  echo "FAIL  capability_registry_check.sh: missing — it ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+elif _out=$(bash scripts/capability_registry_check.sh --self-test < /dev/null 2>&1); then
+  echo "PASS  capability_registry_check.sh --self-test ($(printf '%s\n' "$_out" | grep -oE '통과 [0-9]+ · 실패 [0-9]+' | tail -1))"
+else
+  echo "FAIL  capability_registry_check.sh: --self-test failed"
+  _show_failure "$_out"
+  fail=1
+fi
+
+# relay_channel — the other embedded --self-test subject kept out of the loop above: its
+# `--self-test` just `exec`s the sibling scripts/test_relay_channel_lanes.sh, whose own exit code
+# is already disciplined (`[ "$fail" -eq 0 ] || exit 1`), so gating on exit code — same shape as
+# utterance_landing_check.sh below — is both sufficient and correct here; a 캘리브레이션 substring
+# check would be the wrong instrument for this subject's actual completion marker
+# ("N PASS / M FAIL"). Ships via package.json files[] (no ACCEPTED_ABSENT declaration), so absence
+# is FAIL, not SKIP — same reasoning as utterance_landing_check.sh's absence branch below.
+# Existence check covers BOTH files: relay_channel.sh --self-test just execs the sibling lanes
+# file, so a missing sibling alone produces an unrelated-looking `exec: No such file` (rc=127) that
+# the generic FAIL branch would misreport as "the lane broke" rather than "the anchor is gone"
+# (cross-family review 2026-08-15).
+# `_LANE_TO` (defined above, the pair-suite loop's own guard) is reused rather than a fresh
+# timeout var — this is, by lane count, the largest suite dispatched anywhere in this file
+# (test_relay_channel_lanes.sh runs 45+ lanes, each spawning relay_channel.sh, each spawning its
+# own node subprocess), and it was the one dispatch here with NO time bound at all; `< /dev/null`
+# only stops a stdin-wait hang, not a runaway child (cross-family review 2026-08-15 — this file's
+# own comment two loops up already names exactly this failure shape: an unguarded call does not go
+# red, it hangs, and CI dies on a job timeout with the cause unattributable).
+if [ ! -f scripts/relay_channel.sh ] || [ ! -f scripts/test_relay_channel_lanes.sh ]; then
+  echo "FAIL  relay_channel.sh: missing (relay_channel.sh or its sibling test_relay_channel_lanes.sh) — ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+elif _out=$($_LANE_TO bash scripts/relay_channel.sh --self-test < /dev/null 2>&1); then
+  echo "PASS  relay_channel.sh --self-test ($(printf '%s\n' "$_out" | grep -oE 'relay_channel lanes: [0-9]+ PASS / [0-9]+ FAIL' | tail -1))"
+else
+  echo "FAIL  relay_channel.sh: --self-test failed"
+  _show_failure "$_out"
+  fail=1
+fi
+
 # memory-link-check — the memory store is a GRAPH (memory_intent_recall.md: nodes=files,
 # edges=[[links]], recall walks one hop). Measured 2026-07-28: 50 of 872 edges pointed at a note
 # that existed under a different separator and 22 at nothing — a dead edge returns nothing and is
@@ -1001,6 +1069,23 @@ if [ -f scripts/test_selfcheck_state_lanes.sh ]; then
   fi
 fi
 
+# test_lane_runner_lanes.sh — the checker that finds unrun suites had no suite of its own until
+# 2026-08-13. It guarded its own WIRING (it fails when selfcheck stops calling it) and nothing
+# measured its BEHAVIOUR — the shape it exists to catch, one level up. Wired in the same change
+# that ships it, for the reason the block above states: a suite landed unwired is the defect.
+if [ -f scripts/test_lane_runner_lanes.sh ]; then
+  if _out=$(bash scripts/test_lane_runner_lanes.sh 2>&1); then
+    echo "PASS  test_lane_runner_lanes.sh (org seam: no-op · suppression · fail-closed · controls)"
+  else
+    echo "FAIL  test_lane_runner_lanes.sh: the unrun-suite detector's own verdicts have drifted"
+    _show_failure "$_out"
+    fail=1
+  fi
+elif _ships_per_files "scripts/test_lane_runner_lanes.sh"; then
+  echo "FAIL  test_lane_runner_lanes.sh is DECLARED SHIPPED but absent — deletion or broken install"
+  fail=1
+fi
+
 # sync_from_be_lanes.sh — the RETURN path's anchor. Wired in the same change that ships it: the
 # script had an operator-side caller (a SessionStart hook outside this repo) while its 70 lanes had
 # NO caller anywhere, which is the shape this repo keeps re-finding — a transport that writes into
@@ -1044,6 +1129,27 @@ else
   fail=1
 fi
 
+# sync_to_be_lanes.sh — the FORWARD path's anchor (added 2026-08-14, pmh-dev#69). Same shape as the
+# return-path block above and wired in the same change that ships it, for the same reason: a
+# transport with real reported defects (a real add/add conflict, a real hard-abort risk) had no
+# suite exercising it at all before this. Same subject-presence idiom, same run-once-capture
+# discipline (a lane suite discarded to /dev/null on a non-deterministic run already burned two days
+# on this exact file's sibling).
+if [ ! -f scripts/sync-to-be.sh ]; then
+  echo "SKIP  sync_to_be_lanes.sh (subject scripts/sync-to-be.sh absent)"
+elif [ -f scripts/sync_to_be_lanes.sh ]; then
+  if _out=$(bash scripts/sync_to_be_lanes.sh 2>&1); then
+    echo "PASS  sync_to_be_lanes.sh (forward-path lanes)"
+  else
+    echo "FAIL  sync_to_be_lanes.sh: forward-path lanes failed"
+    _show_failure "$_out"
+    fail=1
+  fi
+else
+  echo "FAIL  sync_to_be_lanes.sh: sync-to-be.sh present but its anchor is missing"
+  fail=1
+fi
+
 # Referenced-path existence is a source-tree check. The npm package intentionally
 # ships a narrower runtime surface, so package-mode selfcheck skips this section.
 # ⚠️ The skip predicate used to be `[ -d ".claude/rules" ]`. That broke the moment the tarball

package/scripts/test_degrade_scan_shell_probes.sh

@@ -630,6 +630,81 @@ else
   bad "PY3 mixed-language markdown lost one language — shadows collide by name or the loop stops at the first hit"
 fi
 
+# ── SCOPE: the scanner must HONOR its arguments ────────────────────────────────────────────────
+# This is the contract templates/.git-hooks/pre-commit depends on since 2026-08-13. That hook used
+# to invoke this scanner with NO ARGUMENTS — walking the whole repository — and then discard almost
+# all of it through a `grep -Ff` over the staged load-bearing files it already had in hand.
+# Measured: whole-repo 42s / 260 lines vs one staged file 0s / 2 lines; a sibling harness measured
+# the same call at 2m07s inside a 7m54s–9m40s commit, one of which could not complete at all.
+# The lane exists because the FIX IS SILENTLY REVERSIBLE: if this scanner ever stops honoring its
+# arguments, the hook keeps working and simply becomes slow again — no verdict changes, nothing
+# goes red, and the only symptom is a commit people start bypassing with --no-verify. The same hook
+# carries the Destructive-Op gate, so a trained bypass disarms an irreversible-surface gate too.
+# BEHAVIOURAL, not shape: it asserts the OUTPUT is confined to the named file, which is the property
+# the hook relies on. A grep for "does the hook pass an argument" would pass on a scanner that
+# accepts arguments and ignores them.
+_scope_a="$TMP/scope_a.sh"; _scope_b="$TMP/scope_b.sh"
+printf '#!/usr/bin/env bash\ncheck() { probe || return 0; }\n' > "$_scope_a"
+printf '#!/usr/bin/env bash\nverify() { thing || exit 0; }\n' > "$_scope_b"
+out=$(bash "$SCAN" "$_scope_a" 2>&1)
+if printf '%s' "$out" | grep -q 'scope_a' && ! printf '%s' "$out" | grep -q 'scope_b'; then
+  ok "SCOPE1 a named target is scanned and a sibling file is NOT (the scanner honors argv)"
+else
+  bad "SCOPE1 scanner did not confine itself to the named target — the pre-commit scoping fix is void"
+fi
+# The negative arm: with no argument at all it must NOT confine itself to nothing. Without this,
+# a scanner that returned empty for every input would satisfy SCOPE1 and the lane would be theatre.
+out=$(bash "$SCAN" "$TMP" 2>&1)
+if printf '%s' "$out" | grep -q 'scope_a' && printf '%s' "$out" | grep -q 'scope_b'; then
+  ok "SCOPE2 control: given the containing directory it finds BOTH (it is not simply blind)"
+else
+  bad "SCOPE2 control failed — the scanner found neither file, so SCOPE1 proved nothing"
+fi
+
+# ── C2: bare X-in-Y substring boolean, with the ALL-CAPS exclusion (2026-08-14) ────────────────
+# Cross-family review found this exclusion shipped with zero fixtures anywhere in this repo —
+# deleting the exclusion left every existing lane green, which is exactly the "advisory noise
+# reduction with no anchor" class this repo's own 4-axis doctrine requires a mechanical test for.
+# Two arms: the probe's own headline example (paid⊂prepaid style substring check) must still
+# fire, and an ALL-CAPS collection-membership check — the shape the exclusion targets — must not.
+_c2_pos="$TMP/c2_pos.sh"; _c2_neg="$TMP/c2_neg.sh"
+printf 'if tok in text:\n    pass\n' > "$_c2_pos"
+printf 'if name in PLACEHOLDERS:\n    pass\n' > "$_c2_neg"
+out=$(bash "$SCAN" "$_c2_pos" 2>&1)
+if printf '%s' "$out" | grep -q 'C2:substring-boolean'; then
+  ok "C2-KP substring-boolean on a bare string var still fires"
+else
+  bad "C2-KP the probe's own headline shape (tok in text) no longer fires"
+fi
+out=$(bash "$SCAN" "$_c2_neg" 2>&1)
+if ! printf '%s' "$out" | grep -q 'C2:substring-boolean'; then
+  ok "C2-KN ALL-CAPS collection membership (name in PLACEHOLDERS) stays silent"
+else
+  bad "C2-KN the ALL-CAPS exclusion is not wired — a legitimate collection check still fires"
+fi
+# Revert probe, run inline rather than trusted by inspection: replace the exclusion clause's line
+# in a COPY of the scanner with a bare closing paren (deleting the line outright would strand the
+# preceding line's trailing backslash continuation and break the pipe chain) and confirm C2-KN
+# flips to a hit — proves the exclusion is load-bearing for this specific fixture, not just
+# present somewhere in the file.
+_scan_reverted="$TMP/scan_reverted.sh"
+_excl_line=$(grep -n "grep -vE 'in \[A-Z_\]" "$SCAN" | head -1 | cut -d: -f1)
+if [ -z "$_excl_line" ]; then
+  bad "C2-REVERT could not locate the exclusion line by its known text — fixture cannot run"
+else
+  sed "${_excl_line}s/.*/           )/" "$SCAN" > "$_scan_reverted"
+  chmod +x "$_scan_reverted"
+  # Captured, not piped directly — under `set -o pipefail` (this file's own top line) the scanner's
+  # own advisory exit code (non-zero on any finding) would override grep's match result in a direct
+  # pipe, reporting FAIL even when the fixture worked exactly as intended.
+  _revert_out=$(bash "$_scan_reverted" "$_c2_neg" 2>&1)
+  if printf '%s' "$_revert_out" | grep -q 'C2:substring-boolean'; then
+    ok "C2-REVERT removing the exclusion line makes C2-KN fire again (the exclusion is load-bearing)"
+  else
+    bad "C2-REVERT removing the exclusion line did not flip C2-KN — the fixture proves nothing"
+  fi
+fi
+
 echo "----"
 echo "degrade-scan shell probes: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_field_canon_lanes.sh

@@ -12,10 +12,32 @@ trap 'rm -rf "$TMP"' EXIT
 PASS=0; FAIL=0
 ok(){ PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
 no(){ FAIL=$((FAIL+1)); printf '  ❌ %s — %s\n' "$1" "$2"; }
+
+# ── DEBT fix (2026-08-14) — several lanes below depended on the OPERATOR'S REAL
+# `${HOME}/projects/qasp-dev` mapping to resolve a repo and emit anything at all. On a
+# machine/CI runner without that exact local layout, `repo` resolution in field_canon_preload.sh
+# silently fails (`continue`), `emitted` stays 0, and EVERY assertion that checks "is output
+# non-empty" trivially reads as the WRONG kind of empty — reproduced locally: PASS 12 / FAIL 7 with
+# HOME pointed at an empty dir, exactly the CI split. The fix reuses the fixture shape lane ⑭
+# already demonstrates below (a throwaway hub + a throwaway project root with a real `.git` and
+# README.md) instead of depending on the operator's real filesystem — `found→extend`, not a new
+# mechanism. This also turns ⑧'s prior "PASS" honest: before this fix it passed because repo
+# resolution ALWAYS failed (output always empty regardless of dedup), not because dedup worked
+# ([[feedback_anchor_can_be_decorative]]) — with a real resolvable repo, ⑧ now exercises the actual
+# same-session dedup path.
+FHUB="$TMP/fhub"; mkdir -p "$FHUB/tracks/qasp"
+FPROJ="$TMP/fproj"; mkdir -p "$FPROJ/qasp-dev/.git" "$FPROJ/qasp-dev/docs/governance"
+printf '# qasp fixture\n' > "$FPROJ/qasp-dev/README.md"
+printf 'x\n' > "$FPROJ/qasp-dev/docs/governance/g1.md"
+
 # ★`${3:+VAR=v}` 는 파라미터 확장이라 bash 가 **환경 할당으로 안 읽는다** — env 로 넘긴다.
 #   (이 파일 초판이 그렇게 써서 「레포 부재」 레인이 거짓 적색을 냈다. 계기 결함이었다.)
-run(){ local extra=""; [ -n "${3:-}" ] && extra="FIELD_CANON_PROJECT_ROOT=$3"
-  printf '%s' "$1" | env FIELD_CANON_SENTINEL_DIR="$2" $extra bash "$H" 2>&1; }
+# $3, when given, overrides FIELD_CANON_PROJECT_ROOT (the "레포 부재" control at line ~35 uses this
+# to deliberately point at /nonexistent — CLAUDE_PROJECT_DIR still resolves via the fixture so that
+# control lane is testing "repo absent", not accidentally "mapped name absent" too).
+run(){ local root="$FPROJ"; [ -n "${3:-}" ] && root="$3"
+  printf '%s' "$1" | env CLAUDE_PROJECT_DIR="$FHUB" FIELD_CANON_PROJECT_ROOT="$root" \
+    FIELD_CANON_SENTINEL_DIR="$2" bash "$H" 2>&1; }
 
 echo "== field-canon preload 레인 =="
 
@@ -47,12 +69,14 @@ printf '' | FIELD_CANON_SENTINEL_DIR="$TMP/6" bash "$H" >/dev/null 2>&1
 #    (`[[feedback_anchor_can_be_decorative]]` — 레인이 결함 지점을 비켜 가면 초록은 정보가 아니다.)
 # ⚠️ macOS 는 bash **3.2** 다. `set -u` 아래서 빈 배열 `"${a[@]}"` 는 unbound variable 로 죽는다
 #    — 초판 레인이 정확히 그렇게 죽어 ⑦⑨⑩ 이 **거짓 적색**을 냈다(대상이 아니라 계기의 사망).
-#    배열 없이 분기한다.
+#    배열 없이 분기한다. (FHUB/FPROJ fixture — see the DEBT-fix comment near the top of this file.)
 runD(){ # $1=payload  $2=TMPDIR  [$3=CLAUDE_SESSION_ID 를 환경에 심을지]
   if [ -n "${3:-}" ]; then
-    printf '%s' "$1" | env TMPDIR="$2" CLAUDE_SESSION_ID="$3" bash "$H" 2>&1
+    printf '%s' "$1" | env TMPDIR="$2" CLAUDE_PROJECT_DIR="$FHUB" FIELD_CANON_PROJECT_ROOT="$FPROJ" \
+      CLAUDE_SESSION_ID="$3" bash "$H" 2>&1
   else
-    printf '%s' "$1" | env TMPDIR="$2" bash "$H" 2>&1
+    printf '%s' "$1" | env TMPDIR="$2" CLAUDE_PROJECT_DIR="$FHUB" FIELD_CANON_PROJECT_ROOT="$FPROJ" \
+      bash "$H" 2>&1
   fi; }
 T7="$TMP/def"; mkdir -p "$T7"
 

package/scripts/test_lane_runner_lanes.sh

@@ -0,0 +1,221 @@
+#!/usr/bin/env bash
+# test_lane_runner_lanes.sh — behavioural lanes for scripts/lane_runner_check.sh
+#
+# Why this file exists at all: until 2026-08-13 the checker that detects unrun lane suites had
+# **no lane suite of its own**. It guarded its own WIRING (it fails if selfcheck.sh stops calling
+# it) but nothing measured its BEHAVIOUR. That is the same shape it exists to catch, one level up —
+# a check whose verdicts nobody exercises is prose with an exit code.
+#
+# The lanes below drive it against SYNTHETIC fixture trees, not against this repo. Driving it
+# against the live tree would make every lane depend on today's suite list, so a lane would go red
+# for reasons that have nothing to do with the predicate under test.
+#
+# Script-relative, NOT `git rev-parse --show-toplevel`: in a vendored tree rev-parse returns the
+# OUTER repo and this suite would then test someone else's checkout.
+set -uo pipefail
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CHECK="$REPO_ROOT/scripts/lane_runner_check.sh"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+pass=0; fail=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+
+# ── fixture: a tree with ONE unwired suite and a selfcheck.sh that calls the checker ──────────
+# The `bash scripts/lane_runner_check.sh` line is load-bearing: the checker refuses to run in a
+# tree whose selfcheck.sh does not invoke it (its self-reference guard).
+mkfixture() { # $1 = dir
+  local d="$1"
+  mkdir -p "$d/scripts"
+  cp "$CHECK" "$d/scripts/lane_runner_check.sh"
+  printf '#!/usr/bin/env bash\nbash scripts/lane_runner_check.sh\n' > "$d/scripts/selfcheck.sh"
+  printf '#!/usr/bin/env bash\n: orphan lane suite\n'  > "$d/scripts/test_orphan_lanes.sh"
+}
+run() { ( cd "$1" && bash scripts/lane_runner_check.sh 2>&1 ); }
+rcof() { ( cd "$1" && bash scripts/lane_runner_check.sh >/dev/null 2>&1; echo $? ); }
+
+# ── L1 known-POSITIVE: an undeclared orphan suite must FAIL ───────────────────────────────────
+# Without this arm every lane below proves nothing: a checker that passed unconditionally would
+# satisfy all the "declaration suppresses it" lanes.
+D="$T/l1"; mkfixture "$D"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "1" ] && printf '%s' "$out" | grep -q 'test_orphan_lanes.sh'; then
+  ok "L1 known-positive: undeclared orphan suite → rc=1 and it is named"
+else
+  bad "L1 known-positive did not fire (rc=$rc) — every lane below is meaningless without it"
+fi
+
+# ── L2 NO-OP: no declaration file → behaviour is exactly the L1 behaviour ─────────────────────
+# This is the arm that protects THIS repo, which ships no company/ directory.
+D="$T/l2"; mkfixture "$D"
+out=$(run "$D")
+if ! printf '%s' "$out" | grep -q 'lane_declarations'; then
+  ok "L2 no-op: absent declaration file is silent (no mention in output)"
+else
+  bad "L2 no-op: output mentions the declaration file when none exists"
+fi
+
+# ── L3 org EXEMPT suppresses the orphan ───────────────────────────────────────────────────────
+D="$T/l3"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh   # org-owned, runs in the org CI only\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q '1 exempt'; then
+  ok "L3 org exempt: declared suite no longer fails the check (rc=0, counted exempt)"
+else
+  bad "L3 org exempt did not suppress (rc=$rc) — out: $(printf '%s' "$out" | tail -1)"
+fi
+
+# ── L4 org DEBT suppresses AND is counted as debt ─────────────────────────────────────────────
+D="$T/l4"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'debt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'declared debt'; then
+  ok "L4 org debt: declared suite suppressed and reported as debt"
+else
+  bad "L4 org debt did not land (rc=$rc)"
+fi
+
+# ── L5 VISIBILITY: an org-declared list must never look like this repo's own zero ─────────────
+D="$T/l5"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'debt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D")
+if printf '%s' "$out" | grep -q 'org-declared'; then
+  ok "L5 visibility: output names the org file and its counts"
+else
+  bad "L5 visibility: org declarations are invisible in the output"
+fi
+
+# ── L6 FAIL-CLOSED on an unparseable file ─────────────────────────────────────────────────────
+# The load-bearing distinction. A malformed file must NOT read as "nothing declared" — that would
+# render UNMEASURED as ZERO, and it would do so on the arm where a fork is relying on the file.
+D="$T/l6"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  this line is not an entry\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "2" ] && printf '%s' "$out" | grep -q 'UNMEASURED'; then
+  ok "L6 fail-closed: unparseable declaration file → rc=2 and says UNMEASURED"
+else
+  bad "L6 fail-closed FAILED (rc=$rc) — a malformed file was read as 'no declarations'"
+fi
+
+# ── L6b control for L6: the SAME orphan tree with a WELL-FORMED file must not exit 2 ──────────
+# Without this, L6 would also pass on a checker that exits 2 for any declaration file at all.
+D="$T/l6b"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+if [ "$(rcof "$D")" != "2" ]; then
+  ok "L6b control: a well-formed file does NOT trip the fail-closed arm"
+else
+  bad "L6b control: every declaration file exits 2 — L6 proved nothing"
+fi
+
+# ── L7 unknown section is a parse failure, not a silent skip ──────────────────────────────────
+D="$T/l7"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'allowed:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D")
+if [ "$(rcof "$D")" = "2" ] && printf '%s' "$out" | grep -q "unknown section"; then
+  ok "L7 unknown section → rc=2 and names the section"
+else
+  bad "L7 unknown section was tolerated — a typo'd header would silently declare nothing"
+fi
+
+# ── L8 the same name in both sections is ambiguous, not last-wins ─────────────────────────────
+D="$T/l8"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh\ndebt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D")
+if [ "$(rcof "$D")" = "2" ] && printf '%s' "$out" | grep -q "both exempt and debt"; then
+  ok "L8 same suite in both sections → rc=2 (ambiguous, not silently resolved)"
+else
+  bad "L8 double declaration was silently resolved"
+fi
+
+# ── L9 a stale entry WARNS but does not block (same voice as upstream DEBT hygiene) ───────────
+# Deliberately advisory: making the downstream mirror stricter than the upstream rule it mirrors
+# would train forks to delete the file, which costs more than a stale line.
+D="$T/l9"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh\n  - test_deleted_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'test_deleted_lanes.sh'; then
+  ok "L9 stale entry: warns and names it, does not block (rc=0)"
+else
+  bad "L9 stale entry handling wrong (rc=$rc)"
+fi
+
+# ── L10 comments and blank lines are not entries ──────────────────────────────────────────────
+D="$T/l10"; mkfixture "$D"; mkdir -p "$D/company"
+printf '# org lane declarations\n\nexempt:\n\n  - test_orphan_lanes.sh   # reason lives here\n' > "$D/company/lane_declarations.yaml"
+if [ "$(rcof "$D")" = "0" ]; then
+  ok "L10 comments/blank lines tolerated (a file people can annotate)"
+else
+  bad "L10 a commented, spaced file failed to parse"
+fi
+
+# ── L11/L12 embedded --self-test subjects (found→extend, 2026-08-14) ──────────────────────────
+# A lane suite living INSIDE its subject as a `--self-test` flag has no `test_*.sh`/`*_lanes.sh`
+# filename, so the suites glob above cannot see it at all — measured on this repo's own
+# lane_runner_check.sh header before this feature existed: 4 such subjects had zero callers and
+# nothing here said so. mkfixture without the orphan file, so these lanes isolate the self-test
+# behaviour from L1's own blocking orphan.
+mkfixture_clean() { # $1 = dir
+  local d="$1"
+  mkdir -p "$d/scripts"
+  cp "$CHECK" "$d/scripts/lane_runner_check.sh"
+  # A wired ordinary suite so the `suites` set is non-empty — an empty tree fails EXTRACTOR_BROKE
+  # before the self-test report section runs at all, which would make L11/L12 pass vacuously.
+  printf '#!/usr/bin/env bash\n: wired lane suite\n' > "$d/scripts/test_ok_lanes.sh"
+  printf '#!/usr/bin/env bash\nbash scripts/lane_runner_check.sh\nbash scripts/test_ok_lanes.sh\n' > "$d/scripts/selfcheck.sh"
+}
+
+# L11 known-POSITIVE: an unwired --self-test subject is reported, advisory (rc stays 0).
+D="$T/l11"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L11 known-positive: unwired --self-test subject named, advisory (rc=0)"
+else
+  bad "L11 known-positive did not fire (rc=$rc) — self-test subject not reported"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L12 known-NEGATIVE: the SAME subject, wired through selfcheck.sh's _subj for-loop idiom, is
+# NOT reported — the exact shape scripts/selfcheck.sh:478 actually uses.
+D="$T/l12"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+cat > "$D/scripts/selfcheck.sh" <<'SC'
+#!/usr/bin/env bash
+bash scripts/lane_runner_check.sh
+bash scripts/test_ok_lanes.sh
+for _subj in orphan_probe; do
+  bash "scripts/$_subj.sh" --self-test
+done
+SC
+out=$(run "$D")
+if ! printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L12 known-negative: --self-test subject wired via _subj for-loop is not reported"
+else
+  bad "L12 known-negative: wired subject still reported as unwired"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L13 known-NEGATIVE: the SAME subject, wired through a DIRECT dispatch line — the shape
+# scripts/selfcheck.sh:898/933 actually use (`bash scripts/<name>.sh ... --self-test`), no
+# for-loop at all. Cross-family review 2026-08-14 caught the first draft shipping only the
+# for-loop branch, which meant probe_scope_check.sh and utterance_landing_check.sh — both wired
+# directly, both real — were reported UNDECLARED. This lane pins that class so it cannot silently
+# come back: without it, L11/L12 alone only ever exercise the for-loop shape.
+D="$T/l13"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+cat > "$D/scripts/selfcheck.sh" <<'SC'
+#!/usr/bin/env bash
+bash scripts/lane_runner_check.sh
+bash scripts/test_ok_lanes.sh
+bash scripts/orphan_probe.sh --self-test >/dev/null 2>&1
+SC
+out=$(run "$D")
+if ! printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L13 known-negative: --self-test subject wired via direct dispatch is not reported"
+else
+  bad "L13 known-negative: directly-wired subject still reported as unwired"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+echo "----"
+echo "lane-runner lanes: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/test_stale_clone_guard_lanes.sh

@@ -58,7 +58,7 @@ git clone -q "$WORK/origin.git" "$WORK/C" 2>/dev/null
 run "non-origin remote name still fires"  HIT   "$WORK/C/newfile.py"
 
 # Throttle: SAME marker dir, two calls — second must be silent.
-mdir=$(mktemp -d "$WORK/marker.throttle")
+mdir=$(mktemp -d "$WORK/marker.throttle.XXXXXX")
 o1=$(payload "$WORK/B/x.py" | FH_STALE_CLONE_NO_FETCH=1 FH_STALE_CLONE_MARKER_DIR="$mdir" bash "$G" 2>&1)
 o2=$(payload "$WORK/B/y.py" | FH_STALE_CLONE_NO_FETCH=1 FH_STALE_CLONE_MARKER_DIR="$mdir" bash "$G" 2>&1)
 if printf '%s' "$o1" | grep -q STALE-CLONE && [ -z "$o2" ]; then
@@ -68,7 +68,7 @@ else
 fi
 
 # Contract: HIT emits one JSON object with both channels and no permissionDecision.
-mdir=$(mktemp -d "$WORK/marker.json")
+mdir=$(mktemp -d "$WORK/marker.json.XXXXXX")
 jo=$(payload "$WORK/B/z.py" | FH_STALE_CLONE_NO_FETCH=1 FH_STALE_CLONE_MARKER_DIR="$mdir" bash "$G" 2>/dev/null)
 if printf '%s' "$jo" | python3 -c '
 import json,sys
@@ -114,25 +114,39 @@ run "slashed remote name still fires"     HIT   "$WORK/D/newfile.py"
 # budget, exit 0, arm the day-throttle — instead of letting the RUNNER's 20s timeout kill it
 # (which skipped the marker write and re-stalled every Write of the day). PATH shim makes `git
 # fetch` hang; budget is set to 0.5s; the real git serves every other subcommand.
+#
+# DEBT fix (2026-08-14): `elapsed -lt 10` was a bare wall-clock assertion on a mandatory path — a
+# loaded CI runner's fork/exec + scheduling overhead can push actual elapsed time past a fixed
+# small constant even when the guard's OWN 0.5s internal budget fired correctly (named and
+# predicted by an adversarial review of the original delta; CI then reproduced it, 2/17 lanes red
+# where local was 17/17). What this lane actually needs to prove is RELATIVE, not absolute: the
+# guard returned because its budget bounded it, not because the wedge itself woke up (30s) or an
+# external timeout killed the process. So: widen the wedge to 60s (cheap — the guard should never
+# come close to waiting it out) and assert elapsed is well under HALF of that, not a small fixed
+# number. This keeps strong discriminating power (a guard that stopped bounding itself would still
+# blow well past 30s) while absorbing CI-runner overhead that has nothing to do with the guard's
+# own logic.
+WEDGE_SLEEP=60
 SHIM="$WORK/shim"; mkdir -p "$SHIM"
 REALGIT=$(command -v git)
 cat > "$SHIM/git" <<EOF
 #!/bin/bash
-for a in "\$@"; do [ "\$a" = "fetch" ] && sleep 30; done
+for a in "\$@"; do [ "\$a" = "fetch" ] && sleep $WEDGE_SLEEP; done
 exec "$REALGIT" "\$@"
 EOF
 chmod +x "$SHIM/git"
-mdir=$(mktemp -d "$WORK/marker.wedge")
+mdir=$(mktemp -d "$WORK/marker.wedge.XXXXXX")
 t0=$(date +%s)
 w_out=$(payload "$WORK/B/wedge.py" | PATH="$SHIM:$PATH" FH_STALE_CLONE_FETCH_BUDGET_TENTHS=5 \
         FH_STALE_CLONE_MARKER_DIR="$mdir" bash "$G" 2>&1); w_rc=$?
 t1=$(date +%s)
 elapsed=$((t1 - t0))
+elapsed_cap=$((WEDGE_SLEEP / 2))
 marker_count=$(ls "$mdir" 2>/dev/null | wc -l | tr -d ' ')
-if [ "$w_rc" -eq 0 ] && [ -z "$w_out" ] && [ "$elapsed" -lt 10 ] && [ "$marker_count" -ge 1 ]; then
-  printf '  ✅ %-52s OK (%ss)\n' "wedged fetch: bounded, silent, throttle armed" "$elapsed"; pass=$((pass+1))
+if [ "$w_rc" -eq 0 ] && [ -z "$w_out" ] && [ "$elapsed" -lt "$elapsed_cap" ] && [ "$marker_count" -ge 1 ]; then
+  printf '  ✅ %-52s OK (%ss < %ss)\n' "wedged fetch: bounded, silent, throttle armed" "$elapsed" "$elapsed_cap"; pass=$((pass+1))
 else
-  printf '  ❌ %-52s rc=%s elapsed=%ss markers=%s out=%s\n' "wedged fetch: bounded, silent, throttle armed" "$w_rc" "$elapsed" "$marker_count" "$w_out"; fail=$((fail+1))
+  printf '  ❌ %-52s rc=%s elapsed=%ss(cap %ss) markers=%s out=%s\n' "wedged fetch: bounded, silent, throttle armed" "$w_rc" "$elapsed" "$elapsed_cap" "$marker_count" "$w_out"; fail=$((fail+1))
 fi
 
 # Budget cap (terra round 2): an all-digit literal wider than the shell's integer width made the