@chrono-meta/fh-gate 1.4.97 → 1.4.99

package/scripts/test_lane_runner_lanes.sh

@@ -0,0 +1,295 @@
+#!/usr/bin/env bash
+# test_lane_runner_lanes.sh — behavioural lanes for scripts/lane_runner_check.sh
+#
+# Why this file exists at all: until 2026-08-13 the checker that detects unrun lane suites had
+# **no lane suite of its own**. It guarded its own WIRING (it fails if selfcheck.sh stops calling
+# it) but nothing measured its BEHAVIOUR. That is the same shape it exists to catch, one level up —
+# a check whose verdicts nobody exercises is prose with an exit code.
+#
+# The lanes below drive it against SYNTHETIC fixture trees, not against this repo. Driving it
+# against the live tree would make every lane depend on today's suite list, so a lane would go red
+# for reasons that have nothing to do with the predicate under test.
+#
+# Script-relative, NOT `git rev-parse --show-toplevel`: in a vendored tree rev-parse returns the
+# OUTER repo and this suite would then test someone else's checkout.
+set -uo pipefail
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CHECK="$REPO_ROOT/scripts/lane_runner_check.sh"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+pass=0; fail=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+
+# ── fixture: a tree with ONE unwired suite and a selfcheck.sh that calls the checker ──────────
+# The `bash scripts/lane_runner_check.sh` line is load-bearing: the checker refuses to run in a
+# tree whose selfcheck.sh does not invoke it (its self-reference guard).
+mkfixture() { # $1 = dir
+  local d="$1"
+  mkdir -p "$d/scripts"
+  cp "$CHECK" "$d/scripts/lane_runner_check.sh"
+  printf '#!/usr/bin/env bash\nbash scripts/lane_runner_check.sh\n' > "$d/scripts/selfcheck.sh"
+  printf '#!/usr/bin/env bash\n: orphan lane suite\n'  > "$d/scripts/test_orphan_lanes.sh"
+}
+run() { ( cd "$1" && bash scripts/lane_runner_check.sh 2>&1 ); }
+rcof() { ( cd "$1" && bash scripts/lane_runner_check.sh >/dev/null 2>&1; echo $? ); }
+
+# ── L1 known-POSITIVE: an undeclared orphan suite must FAIL ───────────────────────────────────
+# Without this arm every lane below proves nothing: a checker that passed unconditionally would
+# satisfy all the "declaration suppresses it" lanes.
+D="$T/l1"; mkfixture "$D"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "1" ] && printf '%s' "$out" | grep -q 'test_orphan_lanes.sh'; then
+  ok "L1 known-positive: undeclared orphan suite → rc=1 and it is named"
+else
+  bad "L1 known-positive did not fire (rc=$rc) — every lane below is meaningless without it"
+fi
+
+# ── L2 NO-OP: no declaration file → behaviour is exactly the L1 behaviour ─────────────────────
+# This is the arm that protects THIS repo, which ships no company/ directory.
+D="$T/l2"; mkfixture "$D"
+out=$(run "$D")
+if ! printf '%s' "$out" | grep -q 'lane_declarations'; then
+  ok "L2 no-op: absent declaration file is silent (no mention in output)"
+else
+  bad "L2 no-op: output mentions the declaration file when none exists"
+fi
+
+# ── L3 org EXEMPT suppresses the orphan ───────────────────────────────────────────────────────
+D="$T/l3"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh   # org-owned, runs in the org CI only\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q '1 exempt'; then
+  ok "L3 org exempt: declared suite no longer fails the check (rc=0, counted exempt)"
+else
+  bad "L3 org exempt did not suppress (rc=$rc) — out: $(printf '%s' "$out" | tail -1)"
+fi
+
+# ── L4 org DEBT suppresses AND is counted as debt ─────────────────────────────────────────────
+D="$T/l4"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'debt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'declared debt'; then
+  ok "L4 org debt: declared suite suppressed and reported as debt"
+else
+  bad "L4 org debt did not land (rc=$rc)"
+fi
+
+# ── L5 VISIBILITY: an org-declared list must never look like this repo's own zero ─────────────
+D="$T/l5"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'debt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D")
+if printf '%s' "$out" | grep -q 'org-declared'; then
+  ok "L5 visibility: output names the org file and its counts"
+else
+  bad "L5 visibility: org declarations are invisible in the output"
+fi
+
+# ── L6 FAIL-CLOSED on an unparseable file ─────────────────────────────────────────────────────
+# The load-bearing distinction. A malformed file must NOT read as "nothing declared" — that would
+# render UNMEASURED as ZERO, and it would do so on the arm where a fork is relying on the file.
+D="$T/l6"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  this line is not an entry\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "2" ] && printf '%s' "$out" | grep -q 'UNMEASURED'; then
+  ok "L6 fail-closed: unparseable declaration file → rc=2 and says UNMEASURED"
+else
+  bad "L6 fail-closed FAILED (rc=$rc) — a malformed file was read as 'no declarations'"
+fi
+
+# ── L6b control for L6: the SAME orphan tree with a WELL-FORMED file must not exit 2 ──────────
+# Without this, L6 would also pass on a checker that exits 2 for any declaration file at all.
+D="$T/l6b"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+if [ "$(rcof "$D")" != "2" ]; then
+  ok "L6b control: a well-formed file does NOT trip the fail-closed arm"
+else
+  bad "L6b control: every declaration file exits 2 — L6 proved nothing"
+fi
+
+# ── L7 unknown section is a parse failure, not a silent skip ──────────────────────────────────
+D="$T/l7"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'allowed:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D")
+if [ "$(rcof "$D")" = "2" ] && printf '%s' "$out" | grep -q "unknown section"; then
+  ok "L7 unknown section → rc=2 and names the section"
+else
+  bad "L7 unknown section was tolerated — a typo'd header would silently declare nothing"
+fi
+
+# ── L8 the same name in both sections is ambiguous, not last-wins ─────────────────────────────
+D="$T/l8"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh\ndebt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D")
+if [ "$(rcof "$D")" = "2" ] && printf '%s' "$out" | grep -q "both exempt and debt"; then
+  ok "L8 same suite in both sections → rc=2 (ambiguous, not silently resolved)"
+else
+  bad "L8 double declaration was silently resolved"
+fi
+
+# ── L9 a stale entry WARNS but does not block (same voice as upstream DEBT hygiene) ───────────
+# Deliberately advisory: making the downstream mirror stricter than the upstream rule it mirrors
+# would train forks to delete the file, which costs more than a stale line.
+D="$T/l9"; mkfixture "$D"; mkdir -p "$D/company"
+printf 'exempt:\n  - test_orphan_lanes.sh\n  - test_deleted_lanes.sh\n' > "$D/company/lane_declarations.yaml"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'test_deleted_lanes.sh'; then
+  ok "L9 stale entry: warns and names it, does not block (rc=0)"
+else
+  bad "L9 stale entry handling wrong (rc=$rc)"
+fi
+
+# ── L10 comments and blank lines are not entries ──────────────────────────────────────────────
+D="$T/l10"; mkfixture "$D"; mkdir -p "$D/company"
+printf '# org lane declarations\n\nexempt:\n\n  - test_orphan_lanes.sh   # reason lives here\n' > "$D/company/lane_declarations.yaml"
+if [ "$(rcof "$D")" = "0" ]; then
+  ok "L10 comments/blank lines tolerated (a file people can annotate)"
+else
+  bad "L10 a commented, spaced file failed to parse"
+fi
+
+# ── L11/L12 embedded --self-test subjects (found→extend, 2026-08-14) ──────────────────────────
+# A lane suite living INSIDE its subject as a `--self-test` flag has no `test_*.sh`/`*_lanes.sh`
+# filename, so the suites glob above cannot see it at all — measured on this repo's own
+# lane_runner_check.sh header before this feature existed: 4 such subjects had zero callers and
+# nothing here said so. mkfixture without the orphan file, so these lanes isolate the self-test
+# behaviour from L1's own blocking orphan.
+mkfixture_clean() { # $1 = dir
+  local d="$1"
+  mkdir -p "$d/scripts"
+  cp "$CHECK" "$d/scripts/lane_runner_check.sh"
+  # A wired ordinary suite so the `suites` set is non-empty — an empty tree fails EXTRACTOR_BROKE
+  # before the self-test report section runs at all, which would make L11/L12 pass vacuously.
+  printf '#!/usr/bin/env bash\n: wired lane suite\n' > "$d/scripts/test_ok_lanes.sh"
+  printf '#!/usr/bin/env bash\nbash scripts/lane_runner_check.sh\nbash scripts/test_ok_lanes.sh\n' > "$d/scripts/selfcheck.sh"
+}
+
+# L11 known-POSITIVE: an unwired --self-test subject is reported, advisory (rc stays 0).
+D="$T/l11"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L11 known-positive: unwired --self-test subject named, advisory (rc=0)"
+else
+  bad "L11 known-positive did not fire (rc=$rc) — self-test subject not reported"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L12 known-NEGATIVE: the SAME subject, wired through selfcheck.sh's _subj for-loop idiom, is
+# NOT reported — the exact shape scripts/selfcheck.sh:478 actually uses.
+D="$T/l12"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+cat > "$D/scripts/selfcheck.sh" <<'SC'
+#!/usr/bin/env bash
+bash scripts/lane_runner_check.sh
+bash scripts/test_ok_lanes.sh
+for _subj in orphan_probe; do
+  bash "scripts/$_subj.sh" --self-test
+done
+SC
+out=$(run "$D")
+if ! printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L12 known-negative: --self-test subject wired via _subj for-loop is not reported"
+else
+  bad "L12 known-negative: wired subject still reported as unwired"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L13 known-NEGATIVE: the SAME subject, wired through a DIRECT dispatch line — the shape
+# scripts/selfcheck.sh:898/933 actually use (`bash scripts/<name>.sh ... --self-test`), no
+# for-loop at all. Cross-family review 2026-08-14 caught the first draft shipping only the
+# for-loop branch, which meant probe_scope_check.sh and utterance_landing_check.sh — both wired
+# directly, both real — were reported UNDECLARED. This lane pins that class so it cannot silently
+# come back: without it, L11/L12 alone only ever exercise the for-loop shape.
+D="$T/l13"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+cat > "$D/scripts/selfcheck.sh" <<'SC'
+#!/usr/bin/env bash
+bash scripts/lane_runner_check.sh
+bash scripts/test_ok_lanes.sh
+bash scripts/orphan_probe.sh --self-test >/dev/null 2>&1
+SC
+out=$(run "$D")
+if ! printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L13 known-negative: --self-test subject wired via direct dispatch is not reported"
+else
+  bad "L13 known-negative: directly-wired subject still reported as unwired"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# ── L14/L15 the SUBJECT'S OWN documentation is not a caller (2026-08-15) ──────────────────────
+# Measured on this repo: `self-test: 10/10 wired` while directional_diff_gate.sh had ZERO callers
+# (`grep -rn directional_diff_gate scripts/*.sh templates/.git-hooks/* .github/workflows/*.yml`,
+# excluding the checker and the subject itself → nothing). The subject's own usage comment
+# (`#   bash scripts/directional_diff_gate.sh --self-test`) matched the direct-dispatch regex, so
+# the checker read the file's documentation of itself as evidence that something ran it.
+#
+# This is the SAME class the checker already closes one level up and, until now, only there:
+# `runners` drops lane_runner_check.sh so the tool cannot certify its own DEBT list as done, and
+# has_runner() skips a suite's own file, and runner_dispatches() skips comment lines. None of the
+# three guards reached the --self-test branch — has_selftest_runner() scanned every runner
+# including the subject, over raw text including comments. A guard that exists in one predicate
+# and not in its sibling is not a guard, it is a coincidence.
+#
+# Two lanes because the two halves fail independently: self-exclusion alone still lets a COMMENT
+# in a third file certify a subject, and comment-skipping alone still lets a subject's own
+# non-comment self-reference do it.
+
+# L14 known-POSITIVE: the subject's OWN usage comment must not count as a caller.
+D="$T/l14"; mkfixture_clean "$D"
+cat > "$D/scripts/orphan_probe.sh" <<'SUBJ'
+#!/usr/bin/env bash
+# Usage:
+#   bash scripts/orphan_probe.sh --self-test        # known-pair calibration
+[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }
+SUBJ
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L14 known-positive: subject's own usage comment is not a caller — still reported unwired"
+else
+  bad "L14 known-positive did not fire (rc=$rc) — self-referential comment read as a dispatcher"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L15 known-POSITIVE: a comment in a DIFFERENT file must not count either. Same discipline
+# runner_dispatches() already applies to ordinary suites ("a mention is not an invocation").
+D="$T/l15"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+cat > "$D/scripts/selfcheck.sh" <<'SC'
+#!/usr/bin/env bash
+bash scripts/lane_runner_check.sh
+bash scripts/test_ok_lanes.sh
+# historical note: we used to run `bash scripts/orphan_probe.sh --self-test` here, removed 2026-01-01
+SC
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L15 known-positive: a commented-out dispatch in another file is not a caller"
+else
+  bad "L15 known-positive did not fire (rc=$rc) — a comment read as a live dispatcher"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L16 known-POSITIVE: a subject that names its own dispatch on a NON-comment line. This is the only
+# lane that actually pins the self-exclusion guard, and it exists because a cross-family round
+# (2026-08-15) showed L14/L15 do not: both of their fixtures put the self-reference in a `#` line,
+# so comment-stripping alone already satisfies them and the guard could be deleted with all lanes
+# still green — a repair with no control, which is the exact failure this file was written to name.
+# The shape is a usage helper, because that is how a real subject names its own flag in live code
+# rather than in a header comment.
+D="$T/l16"; mkfixture_clean "$D"
+cat > "$D/scripts/orphan_probe.sh" <<'SUBJ'
+#!/usr/bin/env bash
+usage() { echo "run: bash scripts/orphan_probe.sh --self-test"; }
+[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }
+usage
+SUBJ
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L16 known-positive: a subject's own NON-comment self-reference is not a caller"
+else
+  bad "L16 known-positive did not fire (rc=$rc) — self-exclusion guard is unanchored"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+echo "----"
+echo "lane-runner lanes: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/test_node_check_lanes.sh

@@ -174,6 +174,223 @@ for h in "$FH_REPO"/templates/.git-hooks/pre-commit "$FH_REPO"/templates/.git-ho
   else bad "lane9 sentinel does NOT match shipped $(basename "$h") — every FH machine would report 'not FH gate'" "$(head -3 "$h")"; fi
 done
 
+# ── lane10 — consent-gated auto-pull: the APPLY arm and every REFUSE arm ─────────────────────
+# Added 2026-08-15 with the feature. These lanes exist because the feature's whole safety claim is
+# about what it does NOT do, and "does not" is exactly what a green run cannot demonstrate by
+# itself — every refuse arm below is paired against an apply arm in the same fixture, so a lane
+# that goes silently inert fails the CONTROL rather than passing everything.
+# 🟥 The load-bearing one is lane10-b: in a shared checkout a branch switch yanks the ground out
+# from under a peer session (measured 2026-08-09, two sessions/one worktree). If this feature ever
+# switches branches, that lane is what says so.
+_ap_root="$(mktemp -d)"
+(
+  cd "$_ap_root" || exit 1
+  # Pin the branch name: `git init` uses init.defaultBranch, which is main on this
+  # operator's machine and master on a stock Ubuntu (CI). Hardcoding "main" in the
+  # assertions below made lane10-b pass VACUOUSLY there (`rev-parse "$_DEF"` returned
+  # empty, and empty==empty compared true) while CONTROL's reset silently no-op'd.
+  git -c init.defaultBranch=main init -q up && cd up
+  git config user.email t@t; git config user.name t; git config commit.gpgsign false
+  mkdir -p scripts tracks/_meta
+  cp "$FH_REPO/scripts/fh_node_check.sh" "$FH_REPO/scripts/consent_registry_check.sh" scripts/
+  # Build the consent fixture from the SHIPPED TEMPLATE, never from the operator's local
+  # tracks/_meta/ — those are gitignored, so on CI (and on any fresh clone) they do not exist and
+  # the lanes would report a red FAIL for a file whose absence is correct by design. Measured on
+  # CI 2026-08-15: exactly that, "registry/UAP absent — lanes not run". Sourcing the template
+  # instead is strictly better than degrading to SKIP: the lanes then actually run everywhere, and
+  # they validate the very block a consumer is told to copy.
+  cp "$FH_REPO/templates/consent_classes.yaml.example" tracks/_meta/consent_classes.yaml
+  # The grant side has no shipped template (a UAP is per-operator by nature), so synthesize the
+  # minimum the registry check requires: the full R6 fingerprint, far-future expiry so the fixture
+  # never rots into a false refusal, joined to the template's own class name.
+  # Dates are computed at fixture-build time, not hardcoded, for two reasons that pull opposite
+  # ways: a fixed past date rots into a false REFUSE, and a far-future one is refused outright —
+  # R5 caps a lease at 365 days ("an unbounded expiry is a transfer, not a lease"), and the first
+  # version of this fixture used 2099-01-01 and was correctly rejected by the very floor the
+  # feature depends on. GNU-first with validation, same discipline as every _mtime helper here:
+  # `date -d` is GNU, `date -v` is BSD, and neither failing silently is acceptable.
+  _g="$(date +%Y-%m-%d)"
+  _e="$(date -d '+300 days' +%Y-%m-%d 2>/dev/null || date -v+300d +%Y-%m-%d 2>/dev/null || echo '')"
+  case "$_e" in
+    [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) : ;;
+    *) bad "lane10 fixture: could not compute a lease expiry (neither GNU nor BSD date worked)" "$_e"; _e="$_g" ;;
+  esac
+  cat > tracks/_meta/user_adaptation_profile.md <<UAPEOF
+---
+standing_consent:
+  repo-freshness-autopull:
+    granted: $_g
+    expires: $_e
+    owner: scripts/fh_node_check.sh
+    mode: ff-only-merge-on-default-branch
+    target: this repo's own default branch, in the local clone, when it is already checked out
+    effects: [network, repo-mutation]
+    sinks: []
+---
+lane fixture — not a real profile
+UAPEOF
+  echo base > f.txt; git add -A >/dev/null; git commit -qm base
+  cd ..; git clone -q up dn; cd up; echo newer > f.txt; git commit -qam ahead
+) >/dev/null 2>&1
+_dn="$_ap_root/dn"
+if [ ! -d "$_dn/.git" ] || [ ! -f "$_dn/tracks/_meta/consent_classes.yaml" ]; then
+  bad "lane10 fixture: could not build the consent fixture (registry/UAP absent — lanes not run)" "$_ap_root"
+else
+  git -C "$_dn" config user.email t@t >/dev/null 2>&1; git -C "$_dn" config user.name t >/dev/null 2>&1
+  # Derive rather than assume — belt-and-braces over the pin above, so a future git
+  # whose init behaviour changes again cannot make these lanes vacuous a second time.
+  _DEF="$(git -C "$_dn" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')"
+  [ -n "$_DEF" ] || _DEF=main
+  if ! git -C "$_dn" show-ref --verify --quiet "refs/heads/$_DEF"; then
+    bad "lane10 fixture: default branch '$_DEF' has no local ref — assertions below would be vacuous" "$(git -C "$_dn" branch -a)"
+  fi
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  _h0="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_a" >/dev/null 2>&1
+  if [ "$(git -C "$_dn" rev-parse HEAD)" != "$_h0" ]; then
+    ok "lane10-a APPLY: consented + on default branch → fast-forwarded"
+  else
+    bad "lane10-a APPLY: consented + on default branch did NOT fast-forward (feature inert — every refuse lane below is then vacuous)" "$_h0"
+  fi
+
+  # b — the envelope. Never applies off the default branch, and NEVER switches branches.
+  (cd "$_ap_root/up" && echo newer2 > f.txt && git commit -qam ahead2) >/dev/null 2>&1
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  git -C "$_dn" switch -c feat-x -q >/dev/null 2>&1
+  _m0="$(git -C "$_dn" rev-parse "$_DEF")"
+  # ⚠️ CHECKING main AND THE BRANCH NAME IS NOT ENOUGH — measured by a revert probe 2026-08-15.
+  # With the envelope deliberately broken, `merge --ff-only origin/main` fast-forwards THE BRANCH
+  # YOU ARE ON, so feat-x moved while `main` sat still and the branch name never changed. The first
+  # version of this lane asserted only those two and stayed green against a defeated envelope —
+  # decorative. The tip that must not move is the CURRENT branch's own.
+  _f0="$(git -C "$_dn" rev-parse feat-x)"
+  run "$_dn" "$_ap_root/s_b" >/dev/null 2>&1
+  if [ "$(git -C "$_dn" rev-parse "$_DEF")" = "$_m0" ] \
+     && [ "$(git -C "$_dn" rev-parse feat-x)" = "$_f0" ] \
+     && [ "$(git -C "$_dn" branch --show-current)" = "feat-x" ]; then
+    ok "lane10-b ENVELOPE: off default branch → no apply on EITHER branch, no switch"
+  else
+    bad "lane10-b ENVELOPE: a branch tip moved off the default branch — the shared-checkout hazard" "main=$_m0->$(git -C "$_dn" rev-parse "$_DEF") feat-x=$_f0->$(git -C "$_dn" rev-parse feat-x) branch=$(git -C "$_dn" branch --show-current)"
+  fi
+  git -C "$_dn" switch -q "$_DEF" >/dev/null 2>&1
+
+  # c — no grant. absent ≠ granted.
+  cp "$_dn/tracks/_meta/user_adaptation_profile.md" "$_ap_root/uap.bak"
+  python3 - "$_dn/tracks/_meta/user_adaptation_profile.md" <<'PYX'
+import re,sys
+p=sys.argv[1]; s=open(p,encoding='utf-8').read()
+open(p,'w',encoding='utf-8').write(re.sub(r'\nstanding_consent:\n(?:  .*\n|    .*\n)*', '\n', s, count=1))
+PYX
+  _h1="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_c" >/dev/null 2>&1
+  [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h1" ] \
+    && ok "lane10-c NO-GRANT: absent standing_consent → no apply" \
+    || bad "lane10-c NO-GRANT: applied without a grant" "$_h1"
+
+  # d — expired lease. A lease nobody enforces is not a lease.
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+  sed -i.bak2 's/expires: [0-9-]*/expires: 2020-01-01/' "$_dn/tracks/_meta/user_adaptation_profile.md"
+  _h2="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_d" >/dev/null 2>&1
+  [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h2" ] \
+    && ok "lane10-d EXPIRED: past-dated lease → no apply" \
+    || bad "lane10-d EXPIRED: applied under an expired lease" "$_h2"
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+
+  # e — divergence. --ff-only must refuse rather than absorb, and local work must survive.
+  (cd "$_dn" && echo local-only > mine.txt && git add -A && git commit -qm diverge) >/dev/null 2>&1
+  _h3="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_e" >/dev/null 2>&1
+  if [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h3" ] && [ -f "$_dn/mine.txt" ]; then
+    ok "lane10-e DIVERGED: ff refused, local commit survives"
+  else
+    bad "lane10-e DIVERGED: local history was moved or lost" "$_h3 -> $(git -C "$_dn" rev-parse HEAD)"
+  fi
+
+  # f — WRONG CLASS. The refusal that the other three arms structurally cannot produce.
+  # Arms c/d/e all refuse by breaking the FILE-WIDE verdict (grant block deleted → exit 3; lease
+  # past-dated → exit 1; divergence → git itself refuses). None of them touches the question "is
+  # THIS class granted", so a caller keyed on the file-wide 0 passed them all — measured 2026-08-15
+  # by a pre-publish security pass, with a live control: one unrelated class validly granted plus
+  # the target class named only in prose, and the merge ran while the banner claimed a standing
+  # consent that never existed. The revoke path was the broken one.
+  # The second assertion below is the load-bearing half: this arm must refuse WHILE the bare
+  # file-wide check still returns 0. Without it the lane would pass for the same reason lane10-c
+  # does, and the axis would go unexercised again.
+  # ORDER MATTERS, and getting it wrong is silent: the UAP is a TRACKED file in this fixture, so
+  # `git reset --hard` reverts any edit made to it. The first draft transformed the UAP and then
+  # reset — restoring the original grant, so the apply fired legitimately and the lane failed for a
+  # reason that looked like the defect. Reset and advance origin FIRST, edit the UAP AFTER.
+  git -C "$_dn" reset -q --hard "origin/$_DEF" >/dev/null 2>&1   # noqa: destructive-op (throwaway fixture)
+  (cd "$_ap_root/up" && echo newer-f > f.txt && git commit -qam ahead-f) >/dev/null 2>&1
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+  python3 - "$_dn/tracks/_meta/user_adaptation_profile.md" <<'PYX'
+import sys, re as _re
+p = sys.argv[1]; s = open(p, encoding='utf-8').read()
+old = "  repo-freshness-autopull:"
+assert old in s, "lane10-f fixture: grant key not found"
+# Reuse the lease dates the fixture already computed, so this arm cannot fail for a date reason and
+# be mistaken for a class-join refusal. (First draft omitted them: R5 fired, the file-wide verdict
+# went to 1, and the arm's own vacuity guard caught it — which is what that guard is for.)
+_g = _re.search(r"granted: (\S+)", s).group(1)
+_e = _re.search(r"expires: (\S+)", s).group(1)
+# A VALID grant for a different registered, promotion_eligible class, scope-matched to its
+# registration so R6/R7 pass — the point is a file that is entirely well-formed.
+other = ("  dispatch-readonly-sim-local-artifact:\n"
+         f"    granted: {_g}\n"
+         f"    expires: {_e}\n"
+         "    owner: fh-meta:sim-conductor\n"
+         "    mode: blind-target-tier-sim\n"
+         "    target: a single local file under the current repo\n"
+         "    effects: [read, dispatch]\n"
+         "    sinks: []\n")
+s = s.replace(old, "  __TARGET_GRANT__:", 1)
+head, sep, tail = s.partition("standing_consent:\n")
+s = head + sep + other + tail
+# the target class survives ONLY as prose — the shape the old raw grep could not tell from a grant
+s = s.replace("lane fixture — not a real profile",
+              "lane fixture — not a real profile\n\n  repo-freshness-autopull: 철회함 (revoked)")
+import re
+s = re.sub(r"  __TARGET_GRANT__:\n(?:    .*\n)*", "", s, count=1)
+open(p, 'w', encoding='utf-8').write(s)
+PYX
+  # PRECONDITION, asserted rather than assumed. lane10-e leaves the clone DIVERGED, and a diverged
+  # clone refuses the fast-forward for a reason that has nothing to do with consent — so without the
+  # reset above the arm passes whether the class join works or not. Measured: a revert probe against
+  # the repaired fh_node_check.sh left this lane green, i.e. it was decorative. Same shape as the
+  # self-exclusion lane earlier the same day; the probe is what separates the two cases.
+  _h5="$(git -C "$_dn" rev-parse HEAD)"
+  if [ "$_h5" = "$(git -C "$_dn" rev-parse "origin/$_DEF")" ]; then
+    bad "lane10-f VACUOUS: clone is not behind origin, so 'no apply' proves nothing" "$_h5"
+  fi
+  run "$_dn" "$_ap_root/s_f" >/dev/null 2>&1
+  _filewide=0
+  bash "$FH_REPO/scripts/consent_registry_check.sh" \
+       "$_dn/tracks/_meta/consent_classes.yaml" \
+       "$_dn/tracks/_meta/user_adaptation_profile.md" >/dev/null 2>&1 || _filewide=$?
+  if [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h5" ] && [ "$_filewide" = "0" ]; then
+    ok "lane10-f WRONG-CLASS: another class granted, this one only in prose → no apply (file-wide check still 0)"
+  elif [ "$_filewide" != "0" ]; then
+    bad "lane10-f VACUOUS: the fixture broke the file-wide verdict (rc=$_filewide), so it re-tests lane10-c's axis, not the class join" "rebuild the fixture so the bare check returns 0"
+  else
+    bad "lane10-f WRONG-CLASS: applied on a class that was never granted" "$_h5 -> $(git -C "$_dn" rev-parse HEAD)"
+  fi
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+
+  # CONTROL — after all the refuse arms, prove the apply arm still fires. Without this, a lane
+  # suite where the feature has gone inert reports 4 clean refusals and looks perfect.
+  git -C "$_dn" reset -q --hard "origin/$_DEF" >/dev/null 2>&1   # noqa: destructive-op (throwaway fixture)
+  (cd "$_ap_root/up" && echo newer3 > f.txt && git commit -qam ahead3) >/dev/null 2>&1
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  _h4="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_f" >/dev/null 2>&1
+  [ "$(git -C "$_dn" rev-parse HEAD)" != "$_h4" ] \
+    && ok "lane10-CONTROL: apply arm still fires after the refuse arms (instrument alive)" \
+    || bad "lane10-CONTROL: apply arm went inert — the refuse lanes above prove nothing" "$_h4"
+fi
+rm -rf "$_ap_root"
+
 printf '\nnode-check lanes: %d passed, %d failed\n' "$PASS" "$FAIL"
 [ "$FAIL" -eq 0 ] || exit 1
 exit 0

package/scripts/test_selfcheck_state_lanes.sh

@@ -357,6 +357,67 @@ CTLPY
 [ "$_BARE_CTL" = FIRED ]
 chk $? "CONTROL: that detector fires on a planted declared-shipped subject (got $_BARE_CTL)"
 
+echo ""
+echo "── directional_diff_gate verdict arm: exit 0 is not a pass ──"
+# WHY THIS LANE EXISTS (2026-08-15): the block wiring directional_diff_gate.sh --self-test gates on
+# the subject's terminal verdict, not on rc=0 alone, and both halves of that were put there by a
+# cross-family round rather than by the author. Its first draft gated on rc=0 plus a SUBSTRING of
+# the verdict, and two reachable inputs satisfied it while nothing ran:
+#   · `✅ calibration passed (0 pairs)` — the subject's own verdict line is
+#     `[ "$f" -eq 0 ] && echo "✅ calibration passed ($n pairs)"`, so deleting every lane prints a
+#     PASS with n=0. Deletion read as a pass is the quietest face of the not-found-is-not-zero class.
+#   · `usage: calibration passed (28 pairs)` — a prose/usage line carrying the words.
+# Without this lane both repairs are reversible to green, which is anchor-is-decorative.
+# LIFTED from selfcheck.sh, not re-spelled — a lane that restates the condition stops seeing edits
+# to it, which is the failure the two lanes above were written to avoid.
+DD_ARM=$(sed -n '/^      _dd_verdict=\$(printf/,/^      fi ;;$/p' "$SELFCHECK" | sed 's/ ;;$//')
+if [ -z "$DD_ARM" ]; then
+  echo "FAIL  the directional_diff_gate verdict arm is no longer where this lane lifts it from."
+  echo "      If the block was moved or renamed, update the lane WITH the subject."
+  exit 1
+fi
+# An empty lift is not the only bad lift. If the END anchor stops matching — re-indent the arm, or
+# move it out of the `case` — the START anchor still matches and the range runs to EOF, which is
+# non-empty and therefore passes the guard above. What saves it today is luck, not design: the
+# `;;`-stripping applies to every line in the range, so downstream case arms lose their terminators
+# and `eval` dies of a syntax error. A downstream span that happened to be self-contained would
+# instead `eval` several hundred lines of selfcheck.sh, once per fixture, at the repo root. Bound
+# the lift by size so the failure is a lane message rather than an accident. Cross-family, 2026-08-15.
+if [ "$(printf '%s\n' "$DD_ARM" | wc -l)" -gt 15 ]; then
+  echo "FAIL  the lifted verdict arm is $(printf '%s\n' "$DD_ARM" | wc -l) lines — the sed END anchor"
+  echo "      stopped matching and the range ran past the block. Fix the anchor, do not widen this bound."
+  exit 1
+fi
+dd_arm_says() { # $1 = the subject's stdout; echoes PASS or FAIL
+  ( _out="$1"; fail=0; _show_failure() { :; }
+    eval "$DD_ARM" ) | grep -oE '^(PASS|FAIL)' | head -1
+}
+
+[ "$(dd_arm_says '✅ calibration passed (28 pairs)')" = PASS ]
+chk $? "a real verdict with a non-zero pair count passes"
+
+[ "$(dd_arm_says '✅ calibration passed (0 pairs)')" = FAIL ]
+chk $? "every lane deleted (0 pairs, exit 0) is caught, not certified"
+
+[ "$(dd_arm_says 'usage: calibration passed (28 pairs)')" = FAIL ]
+chk $? "a usage/prose line carrying the words does not satisfy the gate"
+
+# CONTROL — the pre-repair form (bare substring, no pair-count floor) must ACCEPT both bad
+# fixtures. Without it these lanes could pass because the fixtures are wrong rather than because
+# the repair works.
+_pre() { printf '%s\n' "$1" | grep -oE 'calibration passed \([0-9]+ pairs\)' | tail -1; }
+[ -n "$(_pre '✅ calibration passed (0 pairs)')" ] && [ -n "$(_pre 'usage: calibration passed (28 pairs)')" ]
+chk $? "CONTROL: the pre-repair substring form accepts both — the fixtures discriminate"
+
+# SCOPE of these four lanes, stated because the inherited §SCOPE block below is about a different
+# anchor and does not cover them. The lift is the `0)` arm's BODY only, so these lanes see a change
+# to the verdict predicate and are blind to the routing around it: widening `case ... in 0)` to
+# `0|1)`, dropping `< /dev/null`, dropping the `$_LANE_TO` wrapper, or deleting the rc=124
+# HARNESS-ERROR arm all leave every lane here green. Those are guarded by review, not by this file.
+# The `_pre` control is also a RE-SPELLING of the pre-repair form rather than a lift of it — it has
+# to be, since that form no longer exists in the subject to lift, but it means the control asserts
+# what the old code did from memory. Both limits found by cross-family review, 2026-08-15.
+
 # ── SCOPE OF THIS ANCHOR — stated so it is not over-trusted ───────────────────
 # These lanes catch REVERSION (the run-twice form coming back, the helper being gutted, the
 # call-site redirect returning). They do NOT catch deliberate EVASION: a cross-family round