@chrono-meta/fh-gate 1.4.97 → 1.4.99

package/scripts/lane_runner_check.sh

@@ -121,30 +121,37 @@ EXEMPT=(
 # 11 not 12), and test_marker_floor_lanes.sh calibrates pre-commit's live validate_marker_floor().
 # Both are wired now.
 #
-# 🟥 THE TWO BELOW WERE WIRED, MEASURED RED IN CI, AND DELIBERATELY MOVED BACK. Making them green
-# was available and is the wrong move: their failures are TRUE — the suites really do depend on
-# things a CI runner does not have — so forcing a pass would be routing a real failure to green in
-# the same delta that spent nine repairs closing exactly that. A suite whose preconditions are
-# undeclared belongs in the todo list, not in the mandatory path.
-DEBT=(
-  # PASS 19 · FAIL 0 locally; PASS 12 · FAIL 7 in CI. Reproduced locally by pointing HOME at an
-  # empty directory — 12/7, the same split — so the dependency is exact and not a guess:
-  # field_canon_preload.sh resolves `${HOME}/projects` and seven lanes assume the operator's
-  # mapped-project layout is there. Nothing in the suite declares that precondition, so on a
-  # machine without it the suite reports a REGRESSION rather than "not exercised here".
-  # Fix before re-wiring: the suite must detect the missing layout and exit NOT-EXERCISED (the
-  # shape test_sessionstart_multihook_lanes.sh already uses for its CLI dependency), or build its
-  # own fixture HOME for those seven the way it already does for the no-HOME lane.
-  "test_field_canon_lanes.sh"
-  # 17/17 locally; 2/17 in CI. And this one was PREDICTED: the adversarial review of this very
-  # delta flagged `elapsed < 10` as a wall-clock assertion that would go falsely red on a loaded CI
-  # runner, naming this file and that line. It was filed as a low-severity residual and not acted
-  # on; CI then produced exactly it. ★ The finding named a MECHANISM (a wall-clock assertion is now
-  # on a mandatory path), and a mechanism does not become less true for being labelled R.
-  # Fix before re-wiring: give the timing assertions headroom or gate them behind an explicit
-  # opt-in, so the default run measures logic and not the runner's load.
-  "test_stale_clone_guard_lanes.sh"
-)
+# 🟢 THE TWO THAT WERE HERE ARE RE-WIRED (2026-08-14) — DEBT 2 → 0. Both entries below are
+# HISTORICAL: they record why the suites were pulled out and what the fix had to be, kept because
+# the reasoning (and the exact CI-reproduction numbers) are load-bearing evidence for the next
+# person who touches either suite, not because either is still debt.
+#
+# test_field_canon_lanes.sh — was: PASS 19 · FAIL 0 locally; PASS 12 · FAIL 7 in CI. Reproduced
+# locally by pointing HOME at an empty directory — 12/7, the same split — so the dependency was
+# exact and not a guess: field_canon_preload.sh resolves `${HOME}/projects` and seven lanes assumed
+# the operator's mapped-project layout was there. Nothing in the suite declared that precondition,
+# so on a machine without it the suite reported a REGRESSION rather than "not exercised here". Fix
+# (built the second option this entry named, not the first): the suite now carries its own fixture
+# hub+project-root (mirroring the shape lane ⑭ already used) instead of depending on the operator's
+# real filesystem — `run()`/`runD()` inject `CLAUDE_PROJECT_DIR`/`FIELD_CANON_PROJECT_ROOT` at a
+# fixed fixture path. Verified both directions: PASS 19/19 under an empty HOME (the exact CI
+# reproduction) AND a known-negative check — breaking the `-dev`-suffix repo-resolution fallback in
+# field_canon_preload.sh reproduces the identical PASS 12 / FAIL 7 split, so the fixture measures
+# real behavior, not a vacuously-green rewrite.
+#
+# test_stale_clone_guard_lanes.sh — was: 17/17 locally; 2/17 in CI. Predicted by an adversarial
+# review of the delta that introduced `elapsed < 10` as a wall-clock assertion on a mandatory path;
+# CI then produced exactly it. Fix (the first option this entry named): the wedge sleep widened
+# 30s→60s and the assertion changed from a fixed `elapsed < 10` to a relative `elapsed <
+# (wedge/2)=30s` — proving the guard's internal 0.5s budget bounded it (60x headroom) rather than an
+# absolute constant tuned to one machine's speed. Known-negative check: neutering the budget's kill
+# condition in stale_clone_guard.sh (so it waits out the full wedge instead of self-bounding)
+# correctly fails exactly this one lane, confirming the widened threshold still discriminates.
+#
+# Re-wired into scripts/selfcheck.sh's pair-loop alongside the other ten (found→extend, same shape:
+# "scripts/field_canon_preload.sh|scripts/test_field_canon_lanes.sh" and
+# "scripts/stale_clone_guard.sh|scripts/test_stale_clone_guard_lanes.sh").
+DEBT=()
 
 if [ "${1:-}" = "--list-debt" ]; then
   # Same bash-3.2 empty-array guard as the scan call below. This site was MISSED when that one was
@@ -169,6 +176,96 @@ if [ -f scripts/selfcheck.sh ] && ! grep -qE '^[[:space:]]*(if !? ?)?bash script
   exit 1
 fi
 
+# ── ORG SEAM — a downstream org declares ITS OWN suites in ITS OWN file ───────────────────────
+# Why this exists (requested 2026-08-13 by a downstream org fork of this harness, with evidence):
+# EXEMPT and DEBT above are hardcoded arrays in a SHARED-LAYER file. A downstream fork carries
+# suites this repo has never heard of (`test_rest_push_lanes.sh`, `test_company_delta_lanes.sh` …),
+# and all three remedies this check offers land in files that fork does not own:
+#     wire into selfcheck.sh   → shared layer   · EXEMPT array → this file, shared layer
+#     DEBT array               → this file, shared layer
+# So the fork's only choices were "violate the sync boundary" or "live at rc=1 forever". Measured:
+# 5 such suites on their first run of this check. That is not a preference — a permanently red
+# check stops being read, and one of those five suites had just caught a real regression when it
+# was run by hand.
+#
+# Shape: OPTIONAL file, absent by default. This repo ships none, so the no-op arm is the arm that
+# runs here — verified by the known-pair in scripts/test_lane_runner_lanes.sh.
+#
+# 🟥 A MALFORMED FILE IS FAIL-CLOSED, a stale entry is advisory. Those are different failures:
+#   · cannot parse   → the instrument did not look. Reporting "no declarations" would render
+#                      UNMEASURED as ZERO, which is the exact family this repo keeps closing.
+#   · names a suite that no longer exists → hygiene, same as a stale DEBT entry above, so it warns
+#                      with the same voice. Making the downstream rule STRICTER than the upstream
+#                      one it mirrors would just train people to delete the file.
+ORG_DECL="company/lane_declarations.yaml"
+ORG_EXEMPT=(); ORG_DEBT=()
+if [ -f "$ORG_DECL" ]; then
+  _org_out=$(python3 - "$ORG_DECL" <<'ORGPY'
+import re, sys
+path = sys.argv[1]
+try:
+    txt = open(path, encoding='utf-8').read()
+except OSError as e:
+    print(f"ERR\tcannot read {path}: {e}"); sys.exit(0)
+sect = None; seen = {}
+for i, ln in enumerate(txt.splitlines(), 1):
+    s = ln.split('#', 1)[0].rstrip()
+    if not s.strip():
+        continue
+    m = re.match(r'^([A-Za-z_]+):\s*$', s)
+    if m:
+        sect = m.group(1)
+        if sect not in ('exempt', 'debt'):
+            print(f"ERR\t{path}:{i}: unknown section '{sect}' (expected 'exempt' or 'debt')")
+            sys.exit(0)
+        continue
+    m = re.match(r'^\s+-\s+(\S+)\s*$', s)
+    if m:
+        if sect is None:
+            print(f"ERR\t{path}:{i}: entry before any section header"); sys.exit(0)
+        name = m.group(1)
+        if name in seen and seen[name] != sect:
+            print(f"ERR\t{path}:{i}: '{name}' declared both exempt and debt — ambiguous")
+            sys.exit(0)
+        seen[name] = sect
+        print(f"{sect}\t{name}")
+        continue
+    print(f"ERR\t{path}:{i}: unparseable line: {s.strip()[:60]}")
+    sys.exit(0)
+ORGPY
+)
+  # `grep -q '^ERR'` — NOT `'^ERR\t'`. In a POSIX BRE, GNU grep reads `\t` as a literal `t`
+  # (so the pattern becomes `^ERRt` and matches nothing) while BSD grep on macOS takes it as a tab.
+  # Measured 2026-08-13: this exact line passed all 11 lanes locally and failed L6/L7/L8 in CI —
+  # the fail-closed arm was silently dead on Linux, which is the platform that gates merges.
+  # Same family as the `"$DDSCAN" "` anchor divergence a sibling harness measured the same day:
+  # a regex that means different things on the two greps is an instrument, and an instrument that
+  # answers differently per platform has not measured anything.
+  if printf '%s' "$_org_out" | grep -q '^ERR'; then
+    echo "FAIL  lane-runner: $ORG_DECL exists but could not be read as declarations —"
+    printf '%s' "$_org_out" | sed 's/^ERR[[:space:]]*/        /'
+    echo "      An unreadable declaration file is UNMEASURED, not empty. Fix the file or delete it."
+    exit 2
+  fi
+  while IFS=$'\t' read -r _k _v; do
+    [ -z "${_v:-}" ] && continue
+    case "$_k" in
+      exempt) ORG_EXEMPT+=("$_v") ;;
+      debt)   ORG_DEBT+=("$_v") ;;
+    esac
+  done <<< "$_org_out"
+  # Stale-entry warning, same voice as the DEBT hygiene warnings below.
+  for _n in "${ORG_EXEMPT[@]+"${ORG_EXEMPT[@]}"}" "${ORG_DEBT[@]+"${ORG_DEBT[@]}"}"; do
+    [ -f "scripts/$_n" ] || echo "⚠️  lane-runner: $ORG_DECL declares '$_n' but scripts/$_n does not exist (renamed/deleted?)"
+  done
+  # Visibility: an org-declared suite must never be indistinguishable from an upstream one. A
+  # reader who sees "0 debt" has to be able to tell whether that is this repo's zero or a fork's
+  # declaration absorbing its own list.
+  echo "      lane-runner: $ORG_DECL — ${#ORG_EXEMPT[@]} exempt · ${#ORG_DEBT[@]} debt (org-declared)"
+  EXEMPT+=("${ORG_EXEMPT[@]+"${ORG_EXEMPT[@]}"}")
+  DEBT+=("${ORG_DEBT[@]+"${ORG_DEBT[@]}"}")
+fi
+
 # `"${ARR[@]+"${ARR[@]}"}"` and not the plain `"${ARR[@]}"`: on bash 3.2 (stock macOS) `set -u`
 # treats an EMPTY array's expansion as an unbound variable and aborts. DEBT is now empty by design,
 # which is exactly the state the plain form cannot survive — measured here 2026-08-13, and it
@@ -256,11 +353,150 @@ def runner_dispatches(suite, txt):
 
 wired = {s for s in suites if has_runner(s)}
 
+# ── Embedded --self-test dispatchers — a class the name-pattern `suites` glob cannot see ──────
+# Measured 2026-08-13, the header of this file, §WHAT DEBT:0 DOES NOT MEAN: a lane suite that
+# lives INSIDE its subject as a `--self-test` flag — not a separate `test_*.sh`/`*_lanes.sh` file
+# — is structurally invisible to the glob above. When this block was written, 4 such scripts were
+# known and none showed up as WIRED or UNWIRED anywhere in this report.
+# ⚠️ Do not read that 4 as a current figure, and do not re-list the names here. The set is
+# DISCOVERED at run time by `_st_candidates` below and the live figure is printed in this file's
+# own SELFTEST_COUNTS line, so a hand-maintained example list beside a self-discovering scan is a
+# second source of truth that goes stale in silence. That is not hypothetical: the previous
+# version of this comment named a 4th example the code no longer agreed with, and the session that
+# noticed had to trace the discrepancy to ground by hand.
+# The wiring line for the subjects that ARE wired,
+# the `for _subj in ...` loop in scripts/selfcheck.sh, could be deleted and nothing here would
+# go red. found→extend, not a new file: same idiom as `suites`/`has_runner` above — discover
+# subjects, detect dispatch, report undeclared — new predicates for the shape this pattern uses.
+#
+# 🟥 A PARENTHESIS TRAP LIVES IN THIS SPECIFIC HEREDOC, READ BEFORE ADDING A LINE HERE.
+# Measured 2026-08-14: a single heredoc-body line whose own paren count was unbalanced — one more
+# close-paren than open-paren, from a regex needing a literal close-paren character — broke bash's
+# parse of every line after it, on THIS file only. The reason is that the heredoc below sits inside
+# a command-substitution wrapper, and that wrapper's own close-paren-matching scan turned out not
+# to be fully heredoc-blind in the bash build this repo has tested. `bash -n` then failed dozens of
+# lines later with an unrelated-looking error, because by then the parser believed the heredoc had
+# already closed. Reproduced in isolation: a bare regex assignment needing a literal close-paren,
+# spliced into this file at this exact position, alone, with nothing else added. The fix is
+# structural, not "be careful" — every line added inside this heredoc must carry a matched
+# open-paren and close-paren count on that same line, and a matched pair spanning two lines is
+# exactly the shape that tripped this the first time. Collapse it back to one line, or spell the
+# literal paren out as an escape sequence instead of a bare character, rather than splitting it
+# across lines.
+# A bare substring match on --self-test would also catch prose that only DISCUSSES the flag
+# (measured: scripts/selfcheck.sh's `_subj` loop carries a comment naming it as what NOT to grep
+# for, which is exactly the false positive this narrower check exists to avoid). Require one of
+# the two real dispatcher shapes instead: `"--self-test"` in a quoted comparison, or `--self-test)`
+# as a bare case-pattern. The close-paren is built via chr — see the paren-trap note above; a
+# literal `)` character on this line, however it is spelled, throws this file's parser off.
+_CP = chr(41)
+SELFTEST_DISPATCH_FORMS = ('"--self-test"', '--self-test' + _CP)
+
+def _read(path):
+    try:
+        return open(path, encoding='utf-8', errors='replace').read()
+    except OSError:
+        return ''
+
+# 🟥 NAMED RESIDUALS in the self-test branch — two asymmetries the 2026-08-15 repair did NOT close,
+# written here because this file names its other residuals and silence would read as coverage.
+#   1. Comment-stripping is LINE-PREFIX only. A dispatch line living inside a heredoc body or
+#      inside an echoed string is not a comment and still counts as a live caller. Symmetric with
+#      runner_dispatches, which has the same limit — so "symmetry restored" is true, and the shared
+#      blind spot survives in both. In-tree example of the shape: the heredoc fixtures in
+#      scripts/test_lane_runner_lanes.sh. Harmless today only because those name a fixture subject.
+#   2. Subject DISCOVERY below still reads comments. `_st_names` matches the raw dispatcher forms
+#      anywhere in the file, so a comment that merely mentions the flag can enrol a script as a
+#      self-test subject. Real case: chamber_witness.sh carries the flag inside a usage comment.
+#      Harmless today because that file also has a real dispatcher — but it means "a mention is not
+#      a declaration" is enforced on the RUNNER side and not on the SUBJECT side.
+# Neither is mechanized: closing them means parsing shell rather than scanning lines, which is the
+# Grep-Collision Treadmill this repo has already logged. Fix on the first case that actually bites.
+#
+# One line on purpose — see the paren-trap note above the SELFTEST_PAT definition.
+_st_candidates = [f for f in glob.glob('scripts/*.sh') if os.path.basename(f) not in suites and os.path.basename(f) != 'lane_runner_check.sh']
+_st_names = [os.path.basename(f)[:-3] for f in _st_candidates if any(_form in _read(f) for _form in SELFTEST_DISPATCH_FORMS)]
+selftest_subjects = sorted(set(_st_names))
+
+def selftest_dispatched(bare_name, txt):
+    """Two shapes, both real in this repo. Cross-family review (2026-08-14) caught the first draft
+    shipping only the second — it read scripts/selfcheck.sh's `_subj` for-loop but missed that
+    file's direct `bash scripts/probe_scope_check.sh --self-test` / `bash scripts/
+    utterance_landing_check.sh --self-test`, so those two subjects were reported UNDECLARED while
+    selfcheck.sh runs them every time. This is the exact failure the header above names by cite —
+    a reader trusting the count over the source would have been told a false thing with confidence.
+
+    Shape 1 (direct): `bash scripts/<name>.sh ... --self-test` on one line — mirrors
+    runner_dispatches' direct branch, structurally simpler than the indirect case below.
+    Shape 2 (indirect): bare_name sits in a `for VAR in ... bare_name ...; do` loop whose body
+    dispatches $VAR with --self-test — mirrors the indirect-branch reasoning of runner_dispatches:
+    the literal name is in a list construct, the invocation runs through the loop variable, so a
+    direct-dispatch grep alone structurally cannot see it (selfcheck.sh's `for _subj in ...` loop).
+
+    Comment lines are dropped first, exactly as runner_dispatches does for ordinary suites: "a
+    mention is not an invocation" applies identically here, and until 2026-08-15 it was enforced in
+    only one of the two predicates. Measured: a `#   bash scripts/x.sh --self-test` usage line
+    matched the direct regex and certified a subject nothing ran."""
+    _body = '\n'.join(_l for _l in txt.split('\n') if not _l.strip().startswith('#'))
+    if re.search(rf'\bbash\s+scripts/{re.escape(bare_name)}\.sh\b[^\n]*--self-test', _body):
+        return True
+    in_loop = False; loop_var = None; has_name = False
+    for ln in _body.split('\n'):
+        s = ln.strip()
+        m = re.match(r'for\s+(\w+)\s+in\b(.*)', s)
+        if m:
+            loop_var = m.group(1)
+            has_name = bool(re.search(rf'\b{re.escape(bare_name)}\b', m.group(2)))
+            in_loop = True
+            continue
+        if in_loop:
+            if has_name and '--self-test' in ln and re.search(rf'\${{?{re.escape(loop_var)}\b', ln):
+                return True
+            if s == 'done':
+                in_loop = False; loop_var = None; has_name = False
+    return False
+
+def has_selftest_runner(bare_name):
+    # A subject does not wire itself. has_runner() has skipped a suite's own file since this file
+    # was written; this branch did not, and the asymmetry was invisible because nothing exercised
+    # it — the only in-file control drove selftest_dispatched with synthetic text, never the
+    # runner set.
+    # ⚠️ Attribution, kept precise because a cross-family round caught it being loose: the 2026-08-15
+    # incident — directional_diff_gate.sh dispatched by nothing while the report said 10/10 — was
+    # caused by the COMMENT half, and comment-stripping alone closes it. Every self-reference in
+    # this tree at that date was a `#` line; a non-comment one existed nowhere. So this guard is
+    # SYMMETRY, not a repair of an observed case: it covers the shape where a subject names its own
+    # dispatch in live code, such as a usage helper. That shape is pinned by lane L16, which was
+    # added at the same time and for the same reason — without it this line is a repair no control
+    # drives, which is the failure mode this file exists to name.
+    _own = bare_name + '.sh'
+    return any(selftest_dispatched(bare_name, _read(r)) for r in runners if os.path.basename(r) != _own)
+
+selftest_wired = {s for s in selftest_subjects if has_selftest_runner(s)}
+selftest_undeclared = sorted(s for s in selftest_subjects if s not in selftest_wired)
+
+# Minimal known-pair — proportionate to the size of this addition, not the full CTL apparatus
+# below, but a dead predicate must still be caught rather than trusted on read-through alone.
+_ST_POS_FIXTURE = 'for _subj in alpha beta; do\n  bash "scripts/$_subj.sh" --self-test\ndone\n'
+_ST_NEG_FIXTURE = 'for _subj in alpha beta; do\n  bash "scripts/$_subj.sh" --normal-run\ndone\n'
+if not selftest_dispatched('alpha', _ST_POS_FIXTURE):
+    print("CONTROL_FAILED\tself-test known-positive fixture read as undispatched — detector is blind")
+    raise SystemExit(2)
+if selftest_dispatched('alpha', _ST_NEG_FIXTURE):
+    print("CONTROL_FAILED\tself-test known-negative fixture with no --self-test flag read as dispatched")
+    raise SystemExit(2)
+# Second known-negative, added 2026-08-15 with the comment-skip repair. Without it the repair is a
+# line of code no control drives — the failure mode this whole file exists to name.
+_ST_CMT_FIXTURE = '#   bash scripts/alpha.sh --self-test   # usage example, not a caller\n'
+if selftest_dispatched('alpha', _ST_CMT_FIXTURE):
+    print("CONTROL_FAILED\tself-test commented usage line read as a live dispatcher")
+    raise SystemExit(2)
+
 # ── CONTROL: the instrument must be able to see a suite known to be wired, and must NOT see one
 # known to be dead. Without both arms a broken detector reports "all clean" or "all broken" and
 # either reads as a verdict. [[feedback_absence_measurement_needs_control]]
 CTL_POS  = 'test_selfcheck_state_lanes.sh'    # selfcheck.sh invokes this DIRECTLY
-CTL_POS2 = 'test_session_close_lanes.sh'      # selfcheck.sh:613 for-list + `bash "$_anchor"` — the
+CTL_POS2 = 'test_session_close_lanes.sh'      # selfcheck.sh's `_anchor` for-list + `bash "$_anchor"` — the
                                               # INDIRECT arm. Pins the second detection branch: the
                                               # strict detector called this UNWIRED and a hand-check
                                               # showed it runs. Without this control that branch
@@ -360,6 +596,9 @@ for s in resolved:
     print(f"RESOLVED\t{s}")
 for s in gone:
     print(f"GONE\t{s}")
+print(f"SELFTEST_COUNTS\t{len(selftest_subjects)}\t{len(selftest_wired)}")
+for s in selftest_undeclared:
+    print(f"SELFTEST_UNDECLARED\t{s}")
 PY
 )
 rc=$?
@@ -421,5 +660,34 @@ if [ "$N_DEBT" -gt 0 ]; then
   echo "    only go down; a new one fails the check rather than joining the list silently."
 fi
 
-echo "PASS  lane-runner: ${TOTAL} suites — ${WIRED} wired · ${N_EXEMPT} exempt · ${N_DEBT} declared debt"
+SELFTEST_COUNTS=$(printf '%s\n' "$out" | awk -F'\t' '$1=="SELFTEST_COUNTS"{print $2" "$3}')
+set -- $SELFTEST_COUNTS
+ST_TOTAL="${1:-0}"; ST_WIRED="${2:-0}"
+SELFTEST_UNDECLARED=$(printf '%s\n' "$out" | awk -F'\t' '$1=="SELFTEST_UNDECLARED"{print $2}')
+ST_UNDECLARED_N=0
+if [ -n "$SELFTEST_UNDECLARED" ]; then
+  ST_UNDECLARED_N=$(printf '%s\n' "$SELFTEST_UNDECLARED" | wc -l | tr -d ' ')
+  # Advisory, not blocking — these are pre-existing (measured 2026-08-13, before this check saw
+  # them at all), not something introduced by whatever change is running this check right now.
+  # Same DEBT philosophy as above: loudly counted, never silent, must only go down from here.
+  echo "⚠️  lane-runner: ${ST_UNDECLARED_N} embedded --self-test subject(s) with no --self-test"
+  echo "    dispatcher anywhere (self-test code exists, nothing calls it — see this file's own"
+  echo "    §Embedded --self-test comment for why the suites glob above cannot see this class):"
+  printf '%s\n' "$SELFTEST_UNDECLARED" | sed 's/^/        /'
+  echo "    Fix by wiring \`bash scripts/<name>.sh --self-test\` into scripts/selfcheck.sh, by"
+  echo "    ONE of its two shapes — and the choice is decided by the subject's own output, not"
+  echo "    by which is shorter. The \`for _subj in ...\` loop gates on the substring 캘리브레이션;"
+  echo "    a subject whose terminal verdict is worded any other way goes red there for a reason"
+  echo "    that has nothing to do with its lanes — capability_registry_check was added to that"
+  echo "    loop and reverted for exactly this. Such a subject takes the second shape: its own"
+  echo "    direct-dispatch block, as capability_registry_check.sh and relay_channel.sh do there."
+  echo "    🟥 In that second shape do NOT gate on the exit code alone. Measured 2026-08-15 on"
+  echo "    directional_diff_gate: a suite whose lanes were all deleted still printed a PASS"
+  echo "    verdict and exited 0, and a usage banner carrying the same words satisfied a"
+  echo "    substring match. Require the terminal verdict AS A WHOLE LINE, with a non-zero count"
+  echo "    in it, or exit 0 will certify a suite that ran nothing."
+fi
+
+echo "PASS  lane-runner: ${TOTAL} suites — ${WIRED} wired · ${N_EXEMPT} exempt · ${N_DEBT} declared debt" \
+     "· self-test: ${ST_WIRED}/${ST_TOTAL} wired"
 exit 0

package/scripts/package_coverage_check.sh

@@ -36,6 +36,8 @@ cd "$REPO_ROOT" || exit 1
 #        a file of that name to exercise the LOW allowlist — not a pointer to this file at all.)
 #   scripts/sync_guard_check.sh             — anchor for that same operator-private mirror sync;
 #       no shipped hook invokes it.
+#   scripts/sync_to_be_lanes.sh             — forward-path lane suite for sync-to-be.sh, itself
+#       ACCEPTED_ABSENT above; added 2026-08-14, pmh-dev#69.
 ACCEPTED_ABSENT=(
   ".claude/registry/LOCAL_SKILL_REGISTRY.md"
   # An INSTALL DESTINATION the user creates (`cp templates/local_fh_context.md
@@ -57,6 +59,21 @@ ACCEPTED_ABSENT=(
   # anchor but guards on the subject's presence, so package mode SKIPs rather than falling through.
   "scripts/sync-from-be.sh"
   "scripts/sync_from_be_lanes.sh"
+  # Forward path's own lane suite (added 2026-08-14, pmh-dev#69). Same reason as its return-path
+  # sibling directly above: it exercises scripts/sync-to-be.sh, itself ACCEPTED_ABSENT — a lane
+  # suite for a script that never ships has nothing to verify on a consumer's machine either.
+  "scripts/sync_to_be_lanes.sh"
+  # Shared identity resolver for the two transports directly above (added to files[] by #368,
+  # REMOVED from it 2026-08-15). It was the odd one out: its own callers — sync-to-be.sh and
+  # sync-from-be.sh — are ACCEPTED_ABSENT here for a reason that applies to it verbatim (the
+  # namespacing it computes only means anything on a machine that HAS the operator's companion
+  # store), yet it alone was listed for shipping. The pre-publish confidentiality scan is what
+  # surfaced the misclassification: it carries the companion store's own directory vocabulary,
+  # which would have reached the registry for the first time in 1.4.98. The one shipped caller,
+  # fh_session_load.sh, sources it behind `[ -f ]` and documents its own degrade ("an unresolved
+  # identity degrades to the historical unsuffixed tracks-meta rather than erroring — that is the
+  # pre-fix behavior, not a new failure mode"), so a consumer loses nothing that consumer ever had.
+  "scripts/fh_hub_identity.sh"
   # ── The three lane suites selfcheck.sh's DEBT-12 pair-loop names but does not ship ────────────
   # Added 2026-08-13, and the way they got here is the point: this check CAUGHT them. Before that
   # loop existed, these names lived in lane_runner_check.sh's DEBT array as bare basenames

package/scripts/postinstall_notice.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+'use strict';
+// postinstall_notice.js — one-line, stderr-only, CI-silent install notice.
+//
+// WHY: 16k+ npm downloads (measured live, 2026-08-15) vs 7 GitHub stars on the same day —
+// people are using fh-gate and have no reason to ever see the GitHub repo, since `npx
+// @chrono-meta/fh-gate` never surfaces it. This closes that gap at the one moment every
+// installer passes through, without touching fh-gate.js's own stdout (that IS the CI
+// contract per its own header comment — this notice must never risk polluting it).
+//
+// WHY stderr, not stdout: npm's own install-time output already goes to stderr by
+// convention (npm's progress/warnings), and more importantly this keeps it structurally
+// impossible for the notice to ever be mistaken for gate output — a script piping
+// `npx @chrono-meta/fh-gate`'s stdout for FH_GATE_VERDICT: parsing never sees this line,
+// even if this file were somehow invoked in the same process (it isn't — separate
+// lifecycle script, separate process).
+//
+// WHY CI-silent: postinstall banners are a known source of npm-ecosystem noise complaints,
+// and this package explicitly markets itself for CI use (CHEATSHEET.md §9.5). A line that
+// reprints on every CI run install is exactly the annoyance that gets a package reported,
+// not starred. Skip whenever a CI environment is plausible OR the operator opts out.
+if (process.env.CI || process.env.FH_NO_BANNER || process.env.CONTINUOUS_INTEGRATION) {
+  process.exit(0);
+}
+try {
+  process.stderr.write(
+    '\n⭐ forge-harness (fh-gate) — if this is useful, a star helps others find it:\n' +
+    '   https://github.com/chrono-meta/forge-harness\n' +
+    '   (set FH_NO_BANNER=1 to silence this message)\n\n'
+  );
+} catch (_) {
+  // Never fail an install over a courtesy message.
+}
+process.exit(0);