@chrono-meta/fh-gate 1.4.97 → 1.4.99

package/scripts/selfcheck.sh

@@ -413,7 +413,9 @@ for _pair in \
   "templates/.git-hooks/pre-commit|scripts/test_marker_crossfamily_lanes.sh" \
   "templates/.git-hooks/pre-commit|scripts/test_marker_floor_lanes.sh" \
   "scripts/residency_closure_scan.py|scripts/test_residency_closure_lanes.sh" \
-  "scripts/reviewer_capability_corpus.tsv|scripts/test_reviewer_capability_conformance.sh"
+  "scripts/reviewer_capability_corpus.tsv|scripts/test_reviewer_capability_conformance.sh" \
+  "scripts/field_canon_preload.sh|scripts/test_field_canon_lanes.sh" \
+  "scripts/stale_clone_guard.sh|scripts/test_stale_clone_guard_lanes.sh"
 do
   _subj="${_pair%%|*}"; _anc="${_pair##*|}"; _lbl="${_anc##*/}"
   if [ ! -f "$_subj" ]; then
@@ -466,14 +468,24 @@ do
   fi
 done
 
-# embedded --self-test suites (compaction_probe · judgment_circuit_lint · novelty_claim_check).
-# These three carry their lanes INSIDE the script (`--self-test`) rather than in a sibling
-# test_*_lanes.sh, so the name-list wiring above skipped them silently: 48 lanes existed and ran
+# embedded --self-test suites (compaction_probe · judgment_circuit_lint · novelty_claim_check ·
+# chamber_witness · digest_landing_check).
+# These carry their lanes INSIDE the script (`--self-test`) rather than in a sibling
+# test_*_lanes.sh, so the name-list wiring above skipped them silently: lanes existed and ran
 # only when a human typed the command. That is built-but-not-wired applied to the anchors themselves
 # — a later edit that breaks a lane stays green everywhere the project actually checks
 # (high re-review 2026-08-08). Same shape as the block above: subject absent → SKIP, subject present
 # but self-test missing → FAIL, never a silent pass.
-for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
+# chamber_witness/digest_landing_check joined 2026-08-15 (DEBT closed — lane_runner_check.sh
+# flagged 4 undeclared self-test subjects; capability_registry_check and relay_channel are the
+# other two and do NOT join this loop, each for its own reason, see their own blocks below).
+# capability_registry_check was tried here first and reverted: its passing-run output never
+# contains 캘리브레이션 as a VERDICT — the only occurrence is inside a Korean *test-case title*
+# ("M4: 캘리브레이션 쌍 미선언", capability_registry_check.sh's own self-test), so a future rename
+# or trim of that one test name would flip a real PASS into "dispatcher missing?" here (cross-family
+# review caught this, 2026-08-15). chamber_witness/digest_landing_check both print a genuine
+# terminal "캘리브레이션 통과/실패" line, so they stay.
+for _subj in compaction_probe judgment_circuit_lint novelty_claim_check chamber_witness digest_landing_check; do
   if [ ! -f "scripts/$_subj.sh" ]; then
     _absent_subject_verdict "$_subj --self-test" "scripts/$_subj.sh" || fail=1
   else
@@ -500,6 +512,18 @@ for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
     # nothing reads the announcement. Fixed by deleting one word.
     _to=""; command -v timeout >/dev/null 2>&1 && _to="timeout 120"
     _st_out="$($_to bash "scripts/$_subj.sh" --self-test < /dev/null 2>&1)"; _st_rc=$?
+    # rc=10 (or the sibling harness-error codes) means the subject could not even set up its own
+    # known-pair fixture (e.g. mktemp failed) — it never got to run a lane, so it never printed
+    # 캘리브레이션 either way. Falling through to the *)  arm below would report the confident but
+    # WRONG cause "dispatcher missing?" for an instrument that was never reached. chamber_witness.sh
+    # and digest_landing_check.sh both have real mktemp-failure → return 10 paths (cross-family
+    # review 2026-08-15); the two original loop members never did, so this arm is a no-op for them.
+    case "$_st_rc" in
+      10|2|126|127)
+        echo "HARNESS ERROR  $_subj --self-test: the suite exited $_st_rc — it could not measure,"
+        echo "      so its verdicts prove nothing about $_subj. Not a lane failure, not a pass either."
+        fail=1; continue ;;
+    esac
     case "$_st_out" in
       *캘리브레이션*) : ;;
       *) echo "FAIL  $_subj: --self-test produced no calibration verdict (dispatcher missing?)"
@@ -514,6 +538,122 @@ for _subj in compaction_probe judgment_circuit_lint novelty_claim_check; do
   fi
 done
 
+# capability_registry_check — one of the 4 embedded --self-test subjects lane_runner_check.sh
+# flagged (2026-08-15), kept out of the loop above (see that loop's comment) because its own
+# terminal line is `통과 N · 실패 N`, never 캘리브레이션 — gate on exit code instead, same shape
+# as utterance_landing_check.sh below. Ships via package.json files[], so absence is FAIL, not SKIP.
+if [ ! -f scripts/capability_registry_check.sh ]; then
+  echo "FAIL  capability_registry_check.sh: missing — it ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+elif _out=$(bash scripts/capability_registry_check.sh --self-test < /dev/null 2>&1); then
+  echo "PASS  capability_registry_check.sh --self-test ($(printf '%s\n' "$_out" | grep -oE '통과 [0-9]+ · 실패 [0-9]+' | tail -1))"
+else
+  echo "FAIL  capability_registry_check.sh: --self-test failed"
+  _show_failure "$_out"
+  fail=1
+fi
+
+# relay_channel — the other embedded --self-test subject kept out of the loop above: its
+# `--self-test` just `exec`s the sibling scripts/test_relay_channel_lanes.sh, whose own exit code
+# is already disciplined (`[ "$fail" -eq 0 ] || exit 1`), so gating on exit code — same shape as
+# utterance_landing_check.sh below — is both sufficient and correct here; a 캘리브레이션 substring
+# check would be the wrong instrument for this subject's actual completion marker
+# ("N PASS / M FAIL"). Ships via package.json files[] (no ACCEPTED_ABSENT declaration), so absence
+# is FAIL, not SKIP — same reasoning as utterance_landing_check.sh's absence branch below.
+# Existence check covers BOTH files: relay_channel.sh --self-test just execs the sibling lanes
+# file, so a missing sibling alone produces an unrelated-looking `exec: No such file` (rc=127) that
+# the generic FAIL branch would misreport as "the lane broke" rather than "the anchor is gone"
+# (cross-family review 2026-08-15).
+# `_LANE_TO` (defined above, the pair-suite loop's own guard) is reused rather than a fresh
+# timeout var — this is, by lane count, the largest suite dispatched anywhere in this file
+# (test_relay_channel_lanes.sh runs 45+ lanes, each spawning relay_channel.sh, each spawning its
+# own node subprocess), and it was the one dispatch here with NO time bound at all; `< /dev/null`
+# only stops a stdin-wait hang, not a runaway child (cross-family review 2026-08-15 — this file's
+# own comment two loops up already names exactly this failure shape: an unguarded call does not go
+# red, it hangs, and CI dies on a job timeout with the cause unattributable).
+if [ ! -f scripts/relay_channel.sh ] || [ ! -f scripts/test_relay_channel_lanes.sh ]; then
+  echo "FAIL  relay_channel.sh: missing (relay_channel.sh or its sibling test_relay_channel_lanes.sh) — ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+elif _out=$($_LANE_TO bash scripts/relay_channel.sh --self-test < /dev/null 2>&1); then
+  echo "PASS  relay_channel.sh --self-test ($(printf '%s\n' "$_out" | grep -oE 'relay_channel lanes: [0-9]+ PASS / [0-9]+ FAIL' | tail -1))"
+else
+  echo "FAIL  relay_channel.sh: --self-test failed"
+  _show_failure "$_out"
+  fail=1
+fi
+
+# directional_diff_gate — the LAST embedded --self-test subject with no caller, and it stayed
+# invisible for a reason worth keeping written down: lane_runner_check.sh reported it WIRED off the
+# subject's OWN usage comment (`#   bash scripts/directional_diff_gate.sh --self-test`), so the
+# report read `self-test: 10/10 wired` while `grep -rn directional_diff_gate` across every runner
+# surface returned zero real callers. The detector was repaired in the same delta as this wiring
+# (has_selftest_runner now skips the subject's own file, selftest_dispatched now drops comment
+# lines — the two guards has_runner/runner_dispatches always had), which is why the two halves ship
+# together: fixing the detector alone would have left a real debt item newly VISIBLE and still
+# unrun, and wiring alone would have left the detector able to certify the next such subject.
+# ⚠️ The cost of shipping both halves at once, named rather than left for the next reader to
+# discover: the report reads `10/10` before the change and `10/10` after it, so the detector repair
+# is NOT observable from this repo's own run — reverting the repair alone leaves the count
+# unchanged, because the wiring that now exists is real. Its only evidence is the fixture lanes
+# L14–L16 in scripts/test_lane_runner_lanes.sh, which is why L16 in particular is load-bearing:
+# delete it and the self-exclusion guard has nothing anywhere that would go red.
+#
+# NOT in the `for _subj in ...` loop above, and that is the same call made for
+# capability_registry_check: that loop gates on the substring 캘리브레이션, and this subject's
+# terminal verdict is English ("✅ calibration passed (N pairs)"). Adding it there would produce
+# "dispatcher missing?" — a confident and wrong cause — for a suite that passes. Gate on exit code
+# instead, same shape as the two blocks above. It carries genuine HARNESS-ERROR paths (`exit 10` on
+# mktemp failure, `return 10` on unreadable input), so a setup failure must not read as a lane
+# failure. Ships via package.json files[] with no ACCEPTED_ABSENT declaration, so absence is
+# deletion, not package mode. `< /dev/null` for the same stdin-wait reason the loop above documents.
+if [ ! -f scripts/directional_diff_gate.sh ]; then
+  echo "FAIL  directional_diff_gate.sh: missing — it ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+else
+  _out=$($_LANE_TO bash scripts/directional_diff_gate.sh --self-test < /dev/null 2>&1); _dd_rc=$?
+  case "$_dd_rc" in
+    10|2|124|126|127)
+      # 124 is `timeout`'s own kill code, so it belongs in this arm rather than the generic FAIL
+      # one below: a suite that was killed did not measure, and calling that "the lane failed"
+      # sends the reader to the wrong file. Reachable only because this dispatch is wrapped in
+      # `$_LANE_TO` — which is REUSED from the pair-suite loop above, not installed here, so do
+      # not delete it from this line believing the timeout is local to this block.
+      echo "HARNESS ERROR  directional_diff_gate.sh --self-test: exited $_dd_rc — it could not measure,"
+      echo "      so its verdicts prove nothing. Not a lane failure, and not a pass either."
+      fail=1 ;;
+    0)
+      # rc=0 is NOT sufficient, and this is not a hypothetical: the `for _subj in ...` loop above
+      # records the measured case where a subject fell into an unrecognized mode, printed its usage
+      # banner and exited 0, and the checker read that as a pass while 25 lanes had vanished. This
+      # subject happens to exit 10 from that path TODAY — a revert probe (2026-08-15: dispatcher
+      # line deleted) confirmed the HARNESS ERROR arm fires — but that is incidental to how its
+      # usage function is written, not a property this block should depend on. Require the
+      # terminal verdict itself, so a future subject that exits 0 without running anything goes red
+      # here rather than certifying an empty run.
+      # Whole-LINE match, not a substring, and the pair count must be non-zero. Both halves were
+      # named by cross-family review (2026-08-15) and both are reachable in the real subject, not
+      # hypothetical: directional_diff_gate.sh's verdict line is
+      # `[ "$f" -eq 0 ] && echo "✅ calibration passed ($n pairs)"` — delete every `t` lane and it
+      # prints `calibration passed (0 pairs)` and exits 0, i.e. a suite with nothing left in it
+      # certifies itself. That is the quietest face of [[feedback_not_found_is_not_zero_family]]
+      # (deletion read as a pass), and a substring match would also let a usage banner or a prose
+      # line carrying the same words satisfy the gate.
+      _dd_verdict=$(printf '%s\n' "$_out" | grep -oE '^✅ calibration passed \([0-9]+ pairs\)$' | tail -1)
+      _dd_pairs=$(printf '%s' "$_dd_verdict" | grep -oE '[0-9]+' | tail -1)
+      if [ -n "$_dd_verdict" ] && [ "${_dd_pairs:-0}" -gt 0 ]; then
+        echo "PASS  directional_diff_gate.sh --self-test ($_dd_verdict)"
+      else
+        echo "FAIL  directional_diff_gate.sh: --self-test exited 0 without a non-zero calibration verdict (dispatcher missing, or every lane deleted?)"
+        _show_failure "$_out"
+        fail=1
+      fi ;;
+    *)
+      echo "FAIL  directional_diff_gate.sh: --self-test failed (exit $_dd_rc)"
+      _show_failure "$_out"
+      fail=1 ;;
+  esac
+fi
+
 # memory-link-check — the memory store is a GRAPH (memory_intent_recall.md: nodes=files,
 # edges=[[links]], recall walks one hop). Measured 2026-07-28: 50 of 872 edges pointed at a note
 # that existed under a different separator and 22 at nothing — a dead edge returns nothing and is
@@ -1001,6 +1141,23 @@ if [ -f scripts/test_selfcheck_state_lanes.sh ]; then
   fi
 fi
 
+# test_lane_runner_lanes.sh — the checker that finds unrun suites had no suite of its own until
+# 2026-08-13. It guarded its own WIRING (it fails when selfcheck stops calling it) and nothing
+# measured its BEHAVIOUR — the shape it exists to catch, one level up. Wired in the same change
+# that ships it, for the reason the block above states: a suite landed unwired is the defect.
+if [ -f scripts/test_lane_runner_lanes.sh ]; then
+  if _out=$(bash scripts/test_lane_runner_lanes.sh 2>&1); then
+    echo "PASS  test_lane_runner_lanes.sh (org seam: no-op · suppression · fail-closed · controls)"
+  else
+    echo "FAIL  test_lane_runner_lanes.sh: the unrun-suite detector's own verdicts have drifted"
+    _show_failure "$_out"
+    fail=1
+  fi
+elif _ships_per_files "scripts/test_lane_runner_lanes.sh"; then
+  echo "FAIL  test_lane_runner_lanes.sh is DECLARED SHIPPED but absent — deletion or broken install"
+  fail=1
+fi
+
 # sync_from_be_lanes.sh — the RETURN path's anchor. Wired in the same change that ships it: the
 # script had an operator-side caller (a SessionStart hook outside this repo) while its 70 lanes had
 # NO caller anywhere, which is the shape this repo keeps re-finding — a transport that writes into
@@ -1044,6 +1201,27 @@ else
   fail=1
 fi
 
+# sync_to_be_lanes.sh — the FORWARD path's anchor (added 2026-08-14, pmh-dev#69). Same shape as the
+# return-path block above and wired in the same change that ships it, for the same reason: a
+# transport with real reported defects (a real add/add conflict, a real hard-abort risk) had no
+# suite exercising it at all before this. Same subject-presence idiom, same run-once-capture
+# discipline (a lane suite discarded to /dev/null on a non-deterministic run already burned two days
+# on this exact file's sibling).
+if [ ! -f scripts/sync-to-be.sh ]; then
+  echo "SKIP  sync_to_be_lanes.sh (subject scripts/sync-to-be.sh absent)"
+elif [ -f scripts/sync_to_be_lanes.sh ]; then
+  if _out=$(bash scripts/sync_to_be_lanes.sh 2>&1); then
+    echo "PASS  sync_to_be_lanes.sh (forward-path lanes)"
+  else
+    echo "FAIL  sync_to_be_lanes.sh: forward-path lanes failed"
+    _show_failure "$_out"
+    fail=1
+  fi
+else
+  echo "FAIL  sync_to_be_lanes.sh: sync-to-be.sh present but its anchor is missing"
+  fail=1
+fi
+
 # Referenced-path existence is a source-tree check. The npm package intentionally
 # ships a narrower runtime surface, so package-mode selfcheck skips this section.
 # ⚠️ The skip predicate used to be `[ -d ".claude/rules" ]`. That broke the moment the tarball

package/scripts/test_consent_registry.sh

@@ -782,6 +782,105 @@ else
   echo "  ✅ PROV-2 line tracks the resolution when it changes (shadowed → different value)"; pass=$((pass+1))
 fi
 
+# ---- RC: --require-class — narrowing the verdict from the FILE to ONE CLASS ---------
+# Added 2026-08-16 after a pre-publish security pass found the caller side broken: fh_node_check.sh
+# gated a consumer-machine `git merge --ff-only` on this script's FILE-WIDE 0 plus a raw grep for
+# the class name anywhere in the UAP. One unrelated validly-granted class, plus the target class
+# appearing only in a prose line saying it was REVOKED, satisfied both — the merge ran and the
+# banner reported a standing consent that did not exist.
+# Every lane below is a REFUSAL that leaves the file-wide verdict at 0. That property is asserted,
+# not assumed: without it these lanes would pass for the same reason the existing "nothing granted"
+# lanes do, and the class-join axis would go unexercised a second time.
+lane_args() {  # desc want_rc [args...] — same as lane() but the flag order is the point
+  local desc="$1" want_rc="$2"; shift 2
+  bash "$CHK" "$@" >"$TD/o" 2>&1
+  local rc=$?
+  if [ "$rc" -ne "$want_rc" ]; then
+    bad "$desc — exit $rc, expected $want_rc"; sed 's/^/     /' "$TD/o"; return
+  fi
+  ok "$desc"
+}
+
+TWOCLASS="$OKCLASS
+  - {name: other, owner: o2, mode: m2, target: t2, capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}"
+
+# a) the class IS granted → 0
+mkreg "$TWOCLASS"
+mkuap 'standing_consent:
+  ok: {owner: o, mode: m, sinks: [], granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane_args "RC-a --require-class on a class that IS granted → 0" 0 --require-class ok "$TD/r.yaml" "$TD/u.md"
+
+# b) a DIFFERENT class is granted, the target appears only as prose → 3, file-wide still 0
+mkreg "$TWOCLASS"
+printf -- '---\nstanding_consent:\n  other: {owner: o2, mode: m2, sinks: [], granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t2}\n---\n\n# UAP (fixture)\n\n  ok: 안 쓰기로 했다 (revoked)\n' > "$TD/u.md"
+bash "$CHK" "$TD/r.yaml" "$TD/u.md" >/dev/null 2>&1; _fw=$?
+lane_args "RC-b another class granted, target only in prose → 3" 3 --require-class ok "$TD/r.yaml" "$TD/u.md"
+[ "$_fw" -eq 0 ] \
+  && ok "RC-b DISCRIMINATION: the file-wide verdict is still 0, so RC-b refused on the class join" \
+  || bad "RC-b VACUOUS: file-wide verdict was $_fw — this lane re-tests an existing axis, not the class join"
+
+# c) the ON switch must not be silently OFF. A whitespace-only name passed a `-z` test in the first
+#    draft and then strip()ed to empty, disabling the narrowing and returning the file-wide 0.
+lane_args "RC-c whitespace-only class name → 1 (fail-closed, never a silent fall-back)" 1 --require-class "   " "$TD/r.yaml" "$TD/u.md"
+lane_args "RC-d --require-class= empty form → 1" 1 --require-class= "$TD/r.yaml" "$TD/u.md"
+
+# e) flag position. The first draft read argv[1] only, so a caller appending the flag got the old
+#    file-wide 0 with no warning — the failure mode is silence, which is why this is a lane.
+lane_args "RC-e flag AFTER the paths is still honoured → 3" 3 "$TD/r.yaml" "$TD/u.md" --require-class ok
+lane_args "RC-f --require-class=NAME form is honoured → 3" 3 --require-class=ok "$TD/r.yaml" "$TD/u.md"
+
+# g) an unknown option must not be swallowed as a path
+lane_args "RC-g unknown option → 1, not consumed as a path" 1 --bogus "$TD/r.yaml" "$TD/u.md"
+
+# h) the human summary must agree with the typed exit — this file's own rule, applied to the new path
+bash "$CHK" --require-class ok "$TD/r.yaml" "$TD/u.md" >"$TD/o" 2>&1
+if grep -qE '^consent-registry: UNMEASURED for class `ok`' "$TD/o" && ! grep -qE '^consent-registry: PASS$' "$TD/o"; then
+  ok "RC-h summary agrees with the typed exit (no bare PASS above an exit-3 verdict)"
+else
+  bad "RC-h summary contradicts the verdict"; sed 's/^/     /' "$TD/o"
+fi
+
+# i) no flag → behaviour unchanged. Backward compatibility is a claim, so it gets a lane.
+lane_args "RC-i no flag → file-wide verdict unchanged (0)" 0 "$TD/r.yaml" "$TD/u.md"
+
+# j) IDENTITY IS NOT NORMALISED FOR THE CALLER. A third adversarial round measured the first repair
+#    squeezing ALL whitespace out of the name, so `--require-class 'o k'` was answered with the
+#    verdict for class `ok` — a different question, silently answered. Asking about a name that is
+#    not a name is refused, never repaired.
+mkreg "$TWOCLASS"
+mkuap 'standing_consent:
+  ok: {owner: o, mode: m, sinks: [], granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane_args "RC-j interior whitespace in the class name → 1, never folded onto a real class" 1 --require-class "o k" "$TD/r.yaml" "$TD/u.md"
+lane_args "RC-k surrounding whitespace IS trimmed → 0 (trim, not squeeze)" 0 --require-class "  ok  " "$TD/r.yaml" "$TD/u.md"
+
+# l) argv preservation. The first repair rebuilt "$@" through a newline-delimited string, which split
+#    a path containing a newline and DROPPED an empty positional — the drop promoted the UAP path
+#    into the registry slot, i.e. the tool silently measured a different pair of files than it was
+#    handed. Both are exotic inputs; both are silent, which is why they are lanes.
+_nlreg="$TD/reg
+two.yaml"
+cp "$TD/r.yaml" "$_nlreg" 2>/dev/null && lane_args "RC-l a registry path containing a newline is one argument" 0 --require-class ok "$_nlreg" "$TD/u.md" \
+  || ok "RC-l SKIPPED — this filesystem rejected a newline in a filename (not a defect)"
+# RC-m asserts on WHICH registry path the tool reports, not on a success marker. The first version
+# grepped for `R1/R2`, which only appears when the DEFAULT registry parses — and that default is
+# `tracks/_meta/consent_classes.yaml`, which is **gitignored**, so it exists on the author's machine
+# and not in CI. It passed locally and went red on the first CI run: a lane that measured the
+# author's filesystem rather than the behaviour. This form works in both.
+# Calibrated: the control proves the reported path tracks argv[1] at all, so the assertion below is
+# a discrimination result and not a grep that could never match.
+bash "$CHK" "/nonexistent-registry-probe.yaml" "$TD/u.md" >"$TD/oc" 2>&1
+if grep -q "nonexistent-registry-probe.yaml" "$TD/oc"; then
+  ok "RC-m CONTROL: the reported registry path tracks argv[1]"
+else
+  bad "RC-m CONTROL dead: the tool did not name the registry it was given — the assertion below proves nothing"; sed 's/^/     /' "$TD/oc"
+fi
+bash "$CHK" "" "$TD/u.md" >"$TD/o" 2>&1
+if grep -qE "registry (at|unparseable).*$(basename "$TD")/u\.md" "$TD/o"; then
+  bad "RC-m empty positional shifted the argument list — the UAP was read as the registry"; sed 's/^/     /' "$TD/o"
+else
+  ok "RC-m an empty first positional does not promote the UAP into the registry slot"
+fi
+
 echo "----"
 echo "consent-registry anchor: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_degrade_scan_shell_probes.sh

@@ -630,6 +630,81 @@ else
   bad "PY3 mixed-language markdown lost one language — shadows collide by name or the loop stops at the first hit"
 fi
 
+# ── SCOPE: the scanner must HONOR its arguments ────────────────────────────────────────────────
+# This is the contract templates/.git-hooks/pre-commit depends on since 2026-08-13. That hook used
+# to invoke this scanner with NO ARGUMENTS — walking the whole repository — and then discard almost
+# all of it through a `grep -Ff` over the staged load-bearing files it already had in hand.
+# Measured: whole-repo 42s / 260 lines vs one staged file 0s / 2 lines; a sibling harness measured
+# the same call at 2m07s inside a 7m54s–9m40s commit, one of which could not complete at all.
+# The lane exists because the FIX IS SILENTLY REVERSIBLE: if this scanner ever stops honoring its
+# arguments, the hook keeps working and simply becomes slow again — no verdict changes, nothing
+# goes red, and the only symptom is a commit people start bypassing with --no-verify. The same hook
+# carries the Destructive-Op gate, so a trained bypass disarms an irreversible-surface gate too.
+# BEHAVIOURAL, not shape: it asserts the OUTPUT is confined to the named file, which is the property
+# the hook relies on. A grep for "does the hook pass an argument" would pass on a scanner that
+# accepts arguments and ignores them.
+_scope_a="$TMP/scope_a.sh"; _scope_b="$TMP/scope_b.sh"
+printf '#!/usr/bin/env bash\ncheck() { probe || return 0; }\n' > "$_scope_a"
+printf '#!/usr/bin/env bash\nverify() { thing || exit 0; }\n' > "$_scope_b"
+out=$(bash "$SCAN" "$_scope_a" 2>&1)
+if printf '%s' "$out" | grep -q 'scope_a' && ! printf '%s' "$out" | grep -q 'scope_b'; then
+  ok "SCOPE1 a named target is scanned and a sibling file is NOT (the scanner honors argv)"
+else
+  bad "SCOPE1 scanner did not confine itself to the named target — the pre-commit scoping fix is void"
+fi
+# The negative arm: with no argument at all it must NOT confine itself to nothing. Without this,
+# a scanner that returned empty for every input would satisfy SCOPE1 and the lane would be theatre.
+out=$(bash "$SCAN" "$TMP" 2>&1)
+if printf '%s' "$out" | grep -q 'scope_a' && printf '%s' "$out" | grep -q 'scope_b'; then
+  ok "SCOPE2 control: given the containing directory it finds BOTH (it is not simply blind)"
+else
+  bad "SCOPE2 control failed — the scanner found neither file, so SCOPE1 proved nothing"
+fi
+
+# ── C2: bare X-in-Y substring boolean, with the ALL-CAPS exclusion (2026-08-14) ────────────────
+# Cross-family review found this exclusion shipped with zero fixtures anywhere in this repo —
+# deleting the exclusion left every existing lane green, which is exactly the "advisory noise
+# reduction with no anchor" class this repo's own 4-axis doctrine requires a mechanical test for.
+# Two arms: the probe's own headline example (paid⊂prepaid style substring check) must still
+# fire, and an ALL-CAPS collection-membership check — the shape the exclusion targets — must not.
+_c2_pos="$TMP/c2_pos.sh"; _c2_neg="$TMP/c2_neg.sh"
+printf 'if tok in text:\n    pass\n' > "$_c2_pos"
+printf 'if name in PLACEHOLDERS:\n    pass\n' > "$_c2_neg"
+out=$(bash "$SCAN" "$_c2_pos" 2>&1)
+if printf '%s' "$out" | grep -q 'C2:substring-boolean'; then
+  ok "C2-KP substring-boolean on a bare string var still fires"
+else
+  bad "C2-KP the probe's own headline shape (tok in text) no longer fires"
+fi
+out=$(bash "$SCAN" "$_c2_neg" 2>&1)
+if ! printf '%s' "$out" | grep -q 'C2:substring-boolean'; then
+  ok "C2-KN ALL-CAPS collection membership (name in PLACEHOLDERS) stays silent"
+else
+  bad "C2-KN the ALL-CAPS exclusion is not wired — a legitimate collection check still fires"
+fi
+# Revert probe, run inline rather than trusted by inspection: replace the exclusion clause's line
+# in a COPY of the scanner with a bare closing paren (deleting the line outright would strand the
+# preceding line's trailing backslash continuation and break the pipe chain) and confirm C2-KN
+# flips to a hit — proves the exclusion is load-bearing for this specific fixture, not just
+# present somewhere in the file.
+_scan_reverted="$TMP/scan_reverted.sh"
+_excl_line=$(grep -n "grep -vE 'in \[A-Z_\]" "$SCAN" | head -1 | cut -d: -f1)
+if [ -z "$_excl_line" ]; then
+  bad "C2-REVERT could not locate the exclusion line by its known text — fixture cannot run"
+else
+  sed "${_excl_line}s/.*/           )/" "$SCAN" > "$_scan_reverted"
+  chmod +x "$_scan_reverted"
+  # Captured, not piped directly — under `set -o pipefail` (this file's own top line) the scanner's
+  # own advisory exit code (non-zero on any finding) would override grep's match result in a direct
+  # pipe, reporting FAIL even when the fixture worked exactly as intended.
+  _revert_out=$(bash "$_scan_reverted" "$_c2_neg" 2>&1)
+  if printf '%s' "$_revert_out" | grep -q 'C2:substring-boolean'; then
+    ok "C2-REVERT removing the exclusion line makes C2-KN fire again (the exclusion is load-bearing)"
+  else
+    bad "C2-REVERT removing the exclusion line did not flip C2-KN — the fixture proves nothing"
+  fi
+fi
+
 echo "----"
 echo "degrade-scan shell probes: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_field_canon_lanes.sh

@@ -12,10 +12,32 @@ trap 'rm -rf "$TMP"' EXIT
 PASS=0; FAIL=0
 ok(){ PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
 no(){ FAIL=$((FAIL+1)); printf '  ❌ %s — %s\n' "$1" "$2"; }
+
+# ── DEBT fix (2026-08-14) — several lanes below depended on the OPERATOR'S REAL
+# `${HOME}/projects/qasp-dev` mapping to resolve a repo and emit anything at all. On a
+# machine/CI runner without that exact local layout, `repo` resolution in field_canon_preload.sh
+# silently fails (`continue`), `emitted` stays 0, and EVERY assertion that checks "is output
+# non-empty" trivially reads as the WRONG kind of empty — reproduced locally: PASS 12 / FAIL 7 with
+# HOME pointed at an empty dir, exactly the CI split. The fix reuses the fixture shape lane ⑭
+# already demonstrates below (a throwaway hub + a throwaway project root with a real `.git` and
+# README.md) instead of depending on the operator's real filesystem — `found→extend`, not a new
+# mechanism. This also turns ⑧'s prior "PASS" honest: before this fix it passed because repo
+# resolution ALWAYS failed (output always empty regardless of dedup), not because dedup worked
+# ([[feedback_anchor_can_be_decorative]]) — with a real resolvable repo, ⑧ now exercises the actual
+# same-session dedup path.
+FHUB="$TMP/fhub"; mkdir -p "$FHUB/tracks/qasp"
+FPROJ="$TMP/fproj"; mkdir -p "$FPROJ/qasp-dev/.git" "$FPROJ/qasp-dev/docs/governance"
+printf '# qasp fixture\n' > "$FPROJ/qasp-dev/README.md"
+printf 'x\n' > "$FPROJ/qasp-dev/docs/governance/g1.md"
+
 # ★`${3:+VAR=v}` 는 파라미터 확장이라 bash 가 **환경 할당으로 안 읽는다** — env 로 넘긴다.
 #   (이 파일 초판이 그렇게 써서 「레포 부재」 레인이 거짓 적색을 냈다. 계기 결함이었다.)
-run(){ local extra=""; [ -n "${3:-}" ] && extra="FIELD_CANON_PROJECT_ROOT=$3"
-  printf '%s' "$1" | env FIELD_CANON_SENTINEL_DIR="$2" $extra bash "$H" 2>&1; }
+# $3, when given, overrides FIELD_CANON_PROJECT_ROOT (the "레포 부재" control at line ~35 uses this
+# to deliberately point at /nonexistent — CLAUDE_PROJECT_DIR still resolves via the fixture so that
+# control lane is testing "repo absent", not accidentally "mapped name absent" too).
+run(){ local root="$FPROJ"; [ -n "${3:-}" ] && root="$3"
+  printf '%s' "$1" | env CLAUDE_PROJECT_DIR="$FHUB" FIELD_CANON_PROJECT_ROOT="$root" \
+    FIELD_CANON_SENTINEL_DIR="$2" bash "$H" 2>&1; }
 
 echo "== field-canon preload 레인 =="
 
@@ -47,12 +69,14 @@ printf '' | FIELD_CANON_SENTINEL_DIR="$TMP/6" bash "$H" >/dev/null 2>&1
 #    (`[[feedback_anchor_can_be_decorative]]` — 레인이 결함 지점을 비켜 가면 초록은 정보가 아니다.)
 # ⚠️ macOS 는 bash **3.2** 다. `set -u` 아래서 빈 배열 `"${a[@]}"` 는 unbound variable 로 죽는다
 #    — 초판 레인이 정확히 그렇게 죽어 ⑦⑨⑩ 이 **거짓 적색**을 냈다(대상이 아니라 계기의 사망).
-#    배열 없이 분기한다.
+#    배열 없이 분기한다. (FHUB/FPROJ fixture — see the DEBT-fix comment near the top of this file.)
 runD(){ # $1=payload  $2=TMPDIR  [$3=CLAUDE_SESSION_ID 를 환경에 심을지]
   if [ -n "${3:-}" ]; then
-    printf '%s' "$1" | env TMPDIR="$2" CLAUDE_SESSION_ID="$3" bash "$H" 2>&1
+    printf '%s' "$1" | env TMPDIR="$2" CLAUDE_PROJECT_DIR="$FHUB" FIELD_CANON_PROJECT_ROOT="$FPROJ" \
+      CLAUDE_SESSION_ID="$3" bash "$H" 2>&1
   else
-    printf '%s' "$1" | env TMPDIR="$2" bash "$H" 2>&1
+    printf '%s' "$1" | env TMPDIR="$2" CLAUDE_PROJECT_DIR="$FHUB" FIELD_CANON_PROJECT_ROOT="$FPROJ" \
+      bash "$H" 2>&1
   fi; }
 T7="$TMP/def"; mkdir -p "$T7"