@chrono-meta/fh-gate 1.4.98 → 1.4.99

package/scripts/selfcheck.sh

@@ -582,6 +582,78 @@ else
   fail=1
 fi
 
+# directional_diff_gate — the LAST embedded --self-test subject with no caller, and it stayed
+# invisible for a reason worth keeping written down: lane_runner_check.sh reported it WIRED off the
+# subject's OWN usage comment (`#   bash scripts/directional_diff_gate.sh --self-test`), so the
+# report read `self-test: 10/10 wired` while `grep -rn directional_diff_gate` across every runner
+# surface returned zero real callers. The detector was repaired in the same delta as this wiring
+# (has_selftest_runner now skips the subject's own file, selftest_dispatched now drops comment
+# lines — the two guards has_runner/runner_dispatches always had), which is why the two halves ship
+# together: fixing the detector alone would have left a real debt item newly VISIBLE and still
+# unrun, and wiring alone would have left the detector able to certify the next such subject.
+# ⚠️ The cost of shipping both halves at once, named rather than left for the next reader to
+# discover: the report reads `10/10` before the change and `10/10` after it, so the detector repair
+# is NOT observable from this repo's own run — reverting the repair alone leaves the count
+# unchanged, because the wiring that now exists is real. Its only evidence is the fixture lanes
+# L14–L16 in scripts/test_lane_runner_lanes.sh, which is why L16 in particular is load-bearing:
+# delete it and the self-exclusion guard has nothing anywhere that would go red.
+#
+# NOT in the `for _subj in ...` loop above, and that is the same call made for
+# capability_registry_check: that loop gates on the substring 캘리브레이션, and this subject's
+# terminal verdict is English ("✅ calibration passed (N pairs)"). Adding it there would produce
+# "dispatcher missing?" — a confident and wrong cause — for a suite that passes. Gate on exit code
+# instead, same shape as the two blocks above. It carries genuine HARNESS-ERROR paths (`exit 10` on
+# mktemp failure, `return 10` on unreadable input), so a setup failure must not read as a lane
+# failure. Ships via package.json files[] with no ACCEPTED_ABSENT declaration, so absence is
+# deletion, not package mode. `< /dev/null` for the same stdin-wait reason the loop above documents.
+if [ ! -f scripts/directional_diff_gate.sh ]; then
+  echo "FAIL  directional_diff_gate.sh: missing — it ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+else
+  _out=$($_LANE_TO bash scripts/directional_diff_gate.sh --self-test < /dev/null 2>&1); _dd_rc=$?
+  case "$_dd_rc" in
+    10|2|124|126|127)
+      # 124 is `timeout`'s own kill code, so it belongs in this arm rather than the generic FAIL
+      # one below: a suite that was killed did not measure, and calling that "the lane failed"
+      # sends the reader to the wrong file. Reachable only because this dispatch is wrapped in
+      # `$_LANE_TO` — which is REUSED from the pair-suite loop above, not installed here, so do
+      # not delete it from this line believing the timeout is local to this block.
+      echo "HARNESS ERROR  directional_diff_gate.sh --self-test: exited $_dd_rc — it could not measure,"
+      echo "      so its verdicts prove nothing. Not a lane failure, and not a pass either."
+      fail=1 ;;
+    0)
+      # rc=0 is NOT sufficient, and this is not a hypothetical: the `for _subj in ...` loop above
+      # records the measured case where a subject fell into an unrecognized mode, printed its usage
+      # banner and exited 0, and the checker read that as a pass while 25 lanes had vanished. This
+      # subject happens to exit 10 from that path TODAY — a revert probe (2026-08-15: dispatcher
+      # line deleted) confirmed the HARNESS ERROR arm fires — but that is incidental to how its
+      # usage function is written, not a property this block should depend on. Require the
+      # terminal verdict itself, so a future subject that exits 0 without running anything goes red
+      # here rather than certifying an empty run.
+      # Whole-LINE match, not a substring, and the pair count must be non-zero. Both halves were
+      # named by cross-family review (2026-08-15) and both are reachable in the real subject, not
+      # hypothetical: directional_diff_gate.sh's verdict line is
+      # `[ "$f" -eq 0 ] && echo "✅ calibration passed ($n pairs)"` — delete every `t` lane and it
+      # prints `calibration passed (0 pairs)` and exits 0, i.e. a suite with nothing left in it
+      # certifies itself. That is the quietest face of [[feedback_not_found_is_not_zero_family]]
+      # (deletion read as a pass), and a substring match would also let a usage banner or a prose
+      # line carrying the same words satisfy the gate.
+      _dd_verdict=$(printf '%s\n' "$_out" | grep -oE '^✅ calibration passed \([0-9]+ pairs\)$' | tail -1)
+      _dd_pairs=$(printf '%s' "$_dd_verdict" | grep -oE '[0-9]+' | tail -1)
+      if [ -n "$_dd_verdict" ] && [ "${_dd_pairs:-0}" -gt 0 ]; then
+        echo "PASS  directional_diff_gate.sh --self-test ($_dd_verdict)"
+      else
+        echo "FAIL  directional_diff_gate.sh: --self-test exited 0 without a non-zero calibration verdict (dispatcher missing, or every lane deleted?)"
+        _show_failure "$_out"
+        fail=1
+      fi ;;
+    *)
+      echo "FAIL  directional_diff_gate.sh: --self-test failed (exit $_dd_rc)"
+      _show_failure "$_out"
+      fail=1 ;;
+  esac
+fi
+
 # memory-link-check — the memory store is a GRAPH (memory_intent_recall.md: nodes=files,
 # edges=[[links]], recall walks one hop). Measured 2026-07-28: 50 of 872 edges pointed at a note
 # that existed under a different separator and 22 at nothing — a dead edge returns nothing and is

package/scripts/test_consent_registry.sh

@@ -782,6 +782,105 @@ else
   echo "  ✅ PROV-2 line tracks the resolution when it changes (shadowed → different value)"; pass=$((pass+1))
 fi
 
+# ---- RC: --require-class — narrowing the verdict from the FILE to ONE CLASS ---------
+# Added 2026-08-16 after a pre-publish security pass found the caller side broken: fh_node_check.sh
+# gated a consumer-machine `git merge --ff-only` on this script's FILE-WIDE 0 plus a raw grep for
+# the class name anywhere in the UAP. One unrelated validly-granted class, plus the target class
+# appearing only in a prose line saying it was REVOKED, satisfied both — the merge ran and the
+# banner reported a standing consent that did not exist.
+# Every lane below is a REFUSAL that leaves the file-wide verdict at 0. That property is asserted,
+# not assumed: without it these lanes would pass for the same reason the existing "nothing granted"
+# lanes do, and the class-join axis would go unexercised a second time.
+lane_args() {  # desc want_rc [args...] — same as lane() but the flag order is the point
+  local desc="$1" want_rc="$2"; shift 2
+  bash "$CHK" "$@" >"$TD/o" 2>&1
+  local rc=$?
+  if [ "$rc" -ne "$want_rc" ]; then
+    bad "$desc — exit $rc, expected $want_rc"; sed 's/^/     /' "$TD/o"; return
+  fi
+  ok "$desc"
+}
+
+TWOCLASS="$OKCLASS
+  - {name: other, owner: o2, mode: m2, target: t2, capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}"
+
+# a) the class IS granted → 0
+mkreg "$TWOCLASS"
+mkuap 'standing_consent:
+  ok: {owner: o, mode: m, sinks: [], granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane_args "RC-a --require-class on a class that IS granted → 0" 0 --require-class ok "$TD/r.yaml" "$TD/u.md"
+
+# b) a DIFFERENT class is granted, the target appears only as prose → 3, file-wide still 0
+mkreg "$TWOCLASS"
+printf -- '---\nstanding_consent:\n  other: {owner: o2, mode: m2, sinks: [], granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t2}\n---\n\n# UAP (fixture)\n\n  ok: 안 쓰기로 했다 (revoked)\n' > "$TD/u.md"
+bash "$CHK" "$TD/r.yaml" "$TD/u.md" >/dev/null 2>&1; _fw=$?
+lane_args "RC-b another class granted, target only in prose → 3" 3 --require-class ok "$TD/r.yaml" "$TD/u.md"
+[ "$_fw" -eq 0 ] \
+  && ok "RC-b DISCRIMINATION: the file-wide verdict is still 0, so RC-b refused on the class join" \
+  || bad "RC-b VACUOUS: file-wide verdict was $_fw — this lane re-tests an existing axis, not the class join"
+
+# c) the ON switch must not be silently OFF. A whitespace-only name passed a `-z` test in the first
+#    draft and then strip()ed to empty, disabling the narrowing and returning the file-wide 0.
+lane_args "RC-c whitespace-only class name → 1 (fail-closed, never a silent fall-back)" 1 --require-class "   " "$TD/r.yaml" "$TD/u.md"
+lane_args "RC-d --require-class= empty form → 1" 1 --require-class= "$TD/r.yaml" "$TD/u.md"
+
+# e) flag position. The first draft read argv[1] only, so a caller appending the flag got the old
+#    file-wide 0 with no warning — the failure mode is silence, which is why this is a lane.
+lane_args "RC-e flag AFTER the paths is still honoured → 3" 3 "$TD/r.yaml" "$TD/u.md" --require-class ok
+lane_args "RC-f --require-class=NAME form is honoured → 3" 3 --require-class=ok "$TD/r.yaml" "$TD/u.md"
+
+# g) an unknown option must not be swallowed as a path
+lane_args "RC-g unknown option → 1, not consumed as a path" 1 --bogus "$TD/r.yaml" "$TD/u.md"
+
+# h) the human summary must agree with the typed exit — this file's own rule, applied to the new path
+bash "$CHK" --require-class ok "$TD/r.yaml" "$TD/u.md" >"$TD/o" 2>&1
+if grep -qE '^consent-registry: UNMEASURED for class `ok`' "$TD/o" && ! grep -qE '^consent-registry: PASS$' "$TD/o"; then
+  ok "RC-h summary agrees with the typed exit (no bare PASS above an exit-3 verdict)"
+else
+  bad "RC-h summary contradicts the verdict"; sed 's/^/     /' "$TD/o"
+fi
+
+# i) no flag → behaviour unchanged. Backward compatibility is a claim, so it gets a lane.
+lane_args "RC-i no flag → file-wide verdict unchanged (0)" 0 "$TD/r.yaml" "$TD/u.md"
+
+# j) IDENTITY IS NOT NORMALISED FOR THE CALLER. A third adversarial round measured the first repair
+#    squeezing ALL whitespace out of the name, so `--require-class 'o k'` was answered with the
+#    verdict for class `ok` — a different question, silently answered. Asking about a name that is
+#    not a name is refused, never repaired.
+mkreg "$TWOCLASS"
+mkuap 'standing_consent:
+  ok: {owner: o, mode: m, sinks: [], granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane_args "RC-j interior whitespace in the class name → 1, never folded onto a real class" 1 --require-class "o k" "$TD/r.yaml" "$TD/u.md"
+lane_args "RC-k surrounding whitespace IS trimmed → 0 (trim, not squeeze)" 0 --require-class "  ok  " "$TD/r.yaml" "$TD/u.md"
+
+# l) argv preservation. The first repair rebuilt "$@" through a newline-delimited string, which split
+#    a path containing a newline and DROPPED an empty positional — the drop promoted the UAP path
+#    into the registry slot, i.e. the tool silently measured a different pair of files than it was
+#    handed. Both are exotic inputs; both are silent, which is why they are lanes.
+_nlreg="$TD/reg
+two.yaml"
+cp "$TD/r.yaml" "$_nlreg" 2>/dev/null && lane_args "RC-l a registry path containing a newline is one argument" 0 --require-class ok "$_nlreg" "$TD/u.md" \
+  || ok "RC-l SKIPPED — this filesystem rejected a newline in a filename (not a defect)"
+# RC-m asserts on WHICH registry path the tool reports, not on a success marker. The first version
+# grepped for `R1/R2`, which only appears when the DEFAULT registry parses — and that default is
+# `tracks/_meta/consent_classes.yaml`, which is **gitignored**, so it exists on the author's machine
+# and not in CI. It passed locally and went red on the first CI run: a lane that measured the
+# author's filesystem rather than the behaviour. This form works in both.
+# Calibrated: the control proves the reported path tracks argv[1] at all, so the assertion below is
+# a discrimination result and not a grep that could never match.
+bash "$CHK" "/nonexistent-registry-probe.yaml" "$TD/u.md" >"$TD/oc" 2>&1
+if grep -q "nonexistent-registry-probe.yaml" "$TD/oc"; then
+  ok "RC-m CONTROL: the reported registry path tracks argv[1]"
+else
+  bad "RC-m CONTROL dead: the tool did not name the registry it was given — the assertion below proves nothing"; sed 's/^/     /' "$TD/oc"
+fi
+bash "$CHK" "" "$TD/u.md" >"$TD/o" 2>&1
+if grep -qE "registry (at|unparseable).*$(basename "$TD")/u\.md" "$TD/o"; then
+  bad "RC-m empty positional shifted the argument list — the UAP was read as the registry"; sed 's/^/     /' "$TD/o"
+else
+  ok "RC-m an empty first positional does not promote the UAP into the registry slot"
+fi
+
 echo "----"
 echo "consent-registry anchor: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_lane_runner_lanes.sh

@@ -216,6 +216,80 @@ else
   printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
+# ── L14/L15 the SUBJECT'S OWN documentation is not a caller (2026-08-15) ──────────────────────
+# Measured on this repo: `self-test: 10/10 wired` while directional_diff_gate.sh had ZERO callers
+# (`grep -rn directional_diff_gate scripts/*.sh templates/.git-hooks/* .github/workflows/*.yml`,
+# excluding the checker and the subject itself → nothing). The subject's own usage comment
+# (`#   bash scripts/directional_diff_gate.sh --self-test`) matched the direct-dispatch regex, so
+# the checker read the file's documentation of itself as evidence that something ran it.
+#
+# This is the SAME class the checker already closes one level up and, until now, only there:
+# `runners` drops lane_runner_check.sh so the tool cannot certify its own DEBT list as done, and
+# has_runner() skips a suite's own file, and runner_dispatches() skips comment lines. None of the
+# three guards reached the --self-test branch — has_selftest_runner() scanned every runner
+# including the subject, over raw text including comments. A guard that exists in one predicate
+# and not in its sibling is not a guard, it is a coincidence.
+#
+# Two lanes because the two halves fail independently: self-exclusion alone still lets a COMMENT
+# in a third file certify a subject, and comment-skipping alone still lets a subject's own
+# non-comment self-reference do it.
+
+# L14 known-POSITIVE: the subject's OWN usage comment must not count as a caller.
+D="$T/l14"; mkfixture_clean "$D"
+cat > "$D/scripts/orphan_probe.sh" <<'SUBJ'
+#!/usr/bin/env bash
+# Usage:
+#   bash scripts/orphan_probe.sh --self-test        # known-pair calibration
+[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }
+SUBJ
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L14 known-positive: subject's own usage comment is not a caller — still reported unwired"
+else
+  bad "L14 known-positive did not fire (rc=$rc) — self-referential comment read as a dispatcher"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L15 known-POSITIVE: a comment in a DIFFERENT file must not count either. Same discipline
+# runner_dispatches() already applies to ordinary suites ("a mention is not an invocation").
+D="$T/l15"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+cat > "$D/scripts/selfcheck.sh" <<'SC'
+#!/usr/bin/env bash
+bash scripts/lane_runner_check.sh
+bash scripts/test_ok_lanes.sh
+# historical note: we used to run `bash scripts/orphan_probe.sh --self-test` here, removed 2026-01-01
+SC
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L15 known-positive: a commented-out dispatch in another file is not a caller"
+else
+  bad "L15 known-positive did not fire (rc=$rc) — a comment read as a live dispatcher"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L16 known-POSITIVE: a subject that names its own dispatch on a NON-comment line. This is the only
+# lane that actually pins the self-exclusion guard, and it exists because a cross-family round
+# (2026-08-15) showed L14/L15 do not: both of their fixtures put the self-reference in a `#` line,
+# so comment-stripping alone already satisfies them and the guard could be deleted with all lanes
+# still green — a repair with no control, which is the exact failure this file was written to name.
+# The shape is a usage helper, because that is how a real subject names its own flag in live code
+# rather than in a header comment.
+D="$T/l16"; mkfixture_clean "$D"
+cat > "$D/scripts/orphan_probe.sh" <<'SUBJ'
+#!/usr/bin/env bash
+usage() { echo "run: bash scripts/orphan_probe.sh --self-test"; }
+[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }
+usage
+SUBJ
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L16 known-positive: a subject's own NON-comment self-reference is not a caller"
+else
+  bad "L16 known-positive did not fire (rc=$rc) — self-exclusion guard is unanchored"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
 echo "----"
 echo "lane-runner lanes: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_node_check_lanes.sh

@@ -174,6 +174,223 @@ for h in "$FH_REPO"/templates/.git-hooks/pre-commit "$FH_REPO"/templates/.git-ho
   else bad "lane9 sentinel does NOT match shipped $(basename "$h") — every FH machine would report 'not FH gate'" "$(head -3 "$h")"; fi
 done
 
+# ── lane10 — consent-gated auto-pull: the APPLY arm and every REFUSE arm ─────────────────────
+# Added 2026-08-15 with the feature. These lanes exist because the feature's whole safety claim is
+# about what it does NOT do, and "does not" is exactly what a green run cannot demonstrate by
+# itself — every refuse arm below is paired against an apply arm in the same fixture, so a lane
+# that goes silently inert fails the CONTROL rather than passing everything.
+# 🟥 The load-bearing one is lane10-b: in a shared checkout a branch switch yanks the ground out
+# from under a peer session (measured 2026-08-09, two sessions/one worktree). If this feature ever
+# switches branches, that lane is what says so.
+_ap_root="$(mktemp -d)"
+(
+  cd "$_ap_root" || exit 1
+  # Pin the branch name: `git init` uses init.defaultBranch, which is main on this
+  # operator's machine and master on a stock Ubuntu (CI). Hardcoding "main" in the
+  # assertions below made lane10-b pass VACUOUSLY there (`rev-parse "$_DEF"` returned
+  # empty, and empty==empty compared true) while CONTROL's reset silently no-op'd.
+  git -c init.defaultBranch=main init -q up && cd up
+  git config user.email t@t; git config user.name t; git config commit.gpgsign false
+  mkdir -p scripts tracks/_meta
+  cp "$FH_REPO/scripts/fh_node_check.sh" "$FH_REPO/scripts/consent_registry_check.sh" scripts/
+  # Build the consent fixture from the SHIPPED TEMPLATE, never from the operator's local
+  # tracks/_meta/ — those are gitignored, so on CI (and on any fresh clone) they do not exist and
+  # the lanes would report a red FAIL for a file whose absence is correct by design. Measured on
+  # CI 2026-08-15: exactly that, "registry/UAP absent — lanes not run". Sourcing the template
+  # instead is strictly better than degrading to SKIP: the lanes then actually run everywhere, and
+  # they validate the very block a consumer is told to copy.
+  cp "$FH_REPO/templates/consent_classes.yaml.example" tracks/_meta/consent_classes.yaml
+  # The grant side has no shipped template (a UAP is per-operator by nature), so synthesize the
+  # minimum the registry check requires: the full R6 fingerprint, far-future expiry so the fixture
+  # never rots into a false refusal, joined to the template's own class name.
+  # Dates are computed at fixture-build time, not hardcoded, for two reasons that pull opposite
+  # ways: a fixed past date rots into a false REFUSE, and a far-future one is refused outright —
+  # R5 caps a lease at 365 days ("an unbounded expiry is a transfer, not a lease"), and the first
+  # version of this fixture used 2099-01-01 and was correctly rejected by the very floor the
+  # feature depends on. GNU-first with validation, same discipline as every _mtime helper here:
+  # `date -d` is GNU, `date -v` is BSD, and neither failing silently is acceptable.
+  _g="$(date +%Y-%m-%d)"
+  _e="$(date -d '+300 days' +%Y-%m-%d 2>/dev/null || date -v+300d +%Y-%m-%d 2>/dev/null || echo '')"
+  case "$_e" in
+    [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) : ;;
+    *) bad "lane10 fixture: could not compute a lease expiry (neither GNU nor BSD date worked)" "$_e"; _e="$_g" ;;
+  esac
+  cat > tracks/_meta/user_adaptation_profile.md <<UAPEOF
+---
+standing_consent:
+  repo-freshness-autopull:
+    granted: $_g
+    expires: $_e
+    owner: scripts/fh_node_check.sh
+    mode: ff-only-merge-on-default-branch
+    target: this repo's own default branch, in the local clone, when it is already checked out
+    effects: [network, repo-mutation]
+    sinks: []
+---
+lane fixture — not a real profile
+UAPEOF
+  echo base > f.txt; git add -A >/dev/null; git commit -qm base
+  cd ..; git clone -q up dn; cd up; echo newer > f.txt; git commit -qam ahead
+) >/dev/null 2>&1
+_dn="$_ap_root/dn"
+if [ ! -d "$_dn/.git" ] || [ ! -f "$_dn/tracks/_meta/consent_classes.yaml" ]; then
+  bad "lane10 fixture: could not build the consent fixture (registry/UAP absent — lanes not run)" "$_ap_root"
+else
+  git -C "$_dn" config user.email t@t >/dev/null 2>&1; git -C "$_dn" config user.name t >/dev/null 2>&1
+  # Derive rather than assume — belt-and-braces over the pin above, so a future git
+  # whose init behaviour changes again cannot make these lanes vacuous a second time.
+  _DEF="$(git -C "$_dn" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')"
+  [ -n "$_DEF" ] || _DEF=main
+  if ! git -C "$_dn" show-ref --verify --quiet "refs/heads/$_DEF"; then
+    bad "lane10 fixture: default branch '$_DEF' has no local ref — assertions below would be vacuous" "$(git -C "$_dn" branch -a)"
+  fi
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  _h0="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_a" >/dev/null 2>&1
+  if [ "$(git -C "$_dn" rev-parse HEAD)" != "$_h0" ]; then
+    ok "lane10-a APPLY: consented + on default branch → fast-forwarded"
+  else
+    bad "lane10-a APPLY: consented + on default branch did NOT fast-forward (feature inert — every refuse lane below is then vacuous)" "$_h0"
+  fi
+
+  # b — the envelope. Never applies off the default branch, and NEVER switches branches.
+  (cd "$_ap_root/up" && echo newer2 > f.txt && git commit -qam ahead2) >/dev/null 2>&1
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  git -C "$_dn" switch -c feat-x -q >/dev/null 2>&1
+  _m0="$(git -C "$_dn" rev-parse "$_DEF")"
+  # ⚠️ CHECKING main AND THE BRANCH NAME IS NOT ENOUGH — measured by a revert probe 2026-08-15.
+  # With the envelope deliberately broken, `merge --ff-only origin/main` fast-forwards THE BRANCH
+  # YOU ARE ON, so feat-x moved while `main` sat still and the branch name never changed. The first
+  # version of this lane asserted only those two and stayed green against a defeated envelope —
+  # decorative. The tip that must not move is the CURRENT branch's own.
+  _f0="$(git -C "$_dn" rev-parse feat-x)"
+  run "$_dn" "$_ap_root/s_b" >/dev/null 2>&1
+  if [ "$(git -C "$_dn" rev-parse "$_DEF")" = "$_m0" ] \
+     && [ "$(git -C "$_dn" rev-parse feat-x)" = "$_f0" ] \
+     && [ "$(git -C "$_dn" branch --show-current)" = "feat-x" ]; then
+    ok "lane10-b ENVELOPE: off default branch → no apply on EITHER branch, no switch"
+  else
+    bad "lane10-b ENVELOPE: a branch tip moved off the default branch — the shared-checkout hazard" "main=$_m0->$(git -C "$_dn" rev-parse "$_DEF") feat-x=$_f0->$(git -C "$_dn" rev-parse feat-x) branch=$(git -C "$_dn" branch --show-current)"
+  fi
+  git -C "$_dn" switch -q "$_DEF" >/dev/null 2>&1
+
+  # c — no grant. absent ≠ granted.
+  cp "$_dn/tracks/_meta/user_adaptation_profile.md" "$_ap_root/uap.bak"
+  python3 - "$_dn/tracks/_meta/user_adaptation_profile.md" <<'PYX'
+import re,sys
+p=sys.argv[1]; s=open(p,encoding='utf-8').read()
+open(p,'w',encoding='utf-8').write(re.sub(r'\nstanding_consent:\n(?:  .*\n|    .*\n)*', '\n', s, count=1))
+PYX
+  _h1="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_c" >/dev/null 2>&1
+  [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h1" ] \
+    && ok "lane10-c NO-GRANT: absent standing_consent → no apply" \
+    || bad "lane10-c NO-GRANT: applied without a grant" "$_h1"
+
+  # d — expired lease. A lease nobody enforces is not a lease.
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+  sed -i.bak2 's/expires: [0-9-]*/expires: 2020-01-01/' "$_dn/tracks/_meta/user_adaptation_profile.md"
+  _h2="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_d" >/dev/null 2>&1
+  [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h2" ] \
+    && ok "lane10-d EXPIRED: past-dated lease → no apply" \
+    || bad "lane10-d EXPIRED: applied under an expired lease" "$_h2"
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+
+  # e — divergence. --ff-only must refuse rather than absorb, and local work must survive.
+  (cd "$_dn" && echo local-only > mine.txt && git add -A && git commit -qm diverge) >/dev/null 2>&1
+  _h3="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_e" >/dev/null 2>&1
+  if [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h3" ] && [ -f "$_dn/mine.txt" ]; then
+    ok "lane10-e DIVERGED: ff refused, local commit survives"
+  else
+    bad "lane10-e DIVERGED: local history was moved or lost" "$_h3 -> $(git -C "$_dn" rev-parse HEAD)"
+  fi
+
+  # f — WRONG CLASS. The refusal that the other three arms structurally cannot produce.
+  # Arms c/d/e all refuse by breaking the FILE-WIDE verdict (grant block deleted → exit 3; lease
+  # past-dated → exit 1; divergence → git itself refuses). None of them touches the question "is
+  # THIS class granted", so a caller keyed on the file-wide 0 passed them all — measured 2026-08-15
+  # by a pre-publish security pass, with a live control: one unrelated class validly granted plus
+  # the target class named only in prose, and the merge ran while the banner claimed a standing
+  # consent that never existed. The revoke path was the broken one.
+  # The second assertion below is the load-bearing half: this arm must refuse WHILE the bare
+  # file-wide check still returns 0. Without it the lane would pass for the same reason lane10-c
+  # does, and the axis would go unexercised again.
+  # ORDER MATTERS, and getting it wrong is silent: the UAP is a TRACKED file in this fixture, so
+  # `git reset --hard` reverts any edit made to it. The first draft transformed the UAP and then
+  # reset — restoring the original grant, so the apply fired legitimately and the lane failed for a
+  # reason that looked like the defect. Reset and advance origin FIRST, edit the UAP AFTER.
+  git -C "$_dn" reset -q --hard "origin/$_DEF" >/dev/null 2>&1   # noqa: destructive-op (throwaway fixture)
+  (cd "$_ap_root/up" && echo newer-f > f.txt && git commit -qam ahead-f) >/dev/null 2>&1
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+  python3 - "$_dn/tracks/_meta/user_adaptation_profile.md" <<'PYX'
+import sys, re as _re
+p = sys.argv[1]; s = open(p, encoding='utf-8').read()
+old = "  repo-freshness-autopull:"
+assert old in s, "lane10-f fixture: grant key not found"
+# Reuse the lease dates the fixture already computed, so this arm cannot fail for a date reason and
+# be mistaken for a class-join refusal. (First draft omitted them: R5 fired, the file-wide verdict
+# went to 1, and the arm's own vacuity guard caught it — which is what that guard is for.)
+_g = _re.search(r"granted: (\S+)", s).group(1)
+_e = _re.search(r"expires: (\S+)", s).group(1)
+# A VALID grant for a different registered, promotion_eligible class, scope-matched to its
+# registration so R6/R7 pass — the point is a file that is entirely well-formed.
+other = ("  dispatch-readonly-sim-local-artifact:\n"
+         f"    granted: {_g}\n"
+         f"    expires: {_e}\n"
+         "    owner: fh-meta:sim-conductor\n"
+         "    mode: blind-target-tier-sim\n"
+         "    target: a single local file under the current repo\n"
+         "    effects: [read, dispatch]\n"
+         "    sinks: []\n")
+s = s.replace(old, "  __TARGET_GRANT__:", 1)
+head, sep, tail = s.partition("standing_consent:\n")
+s = head + sep + other + tail
+# the target class survives ONLY as prose — the shape the old raw grep could not tell from a grant
+s = s.replace("lane fixture — not a real profile",
+              "lane fixture — not a real profile\n\n  repo-freshness-autopull: 철회함 (revoked)")
+import re
+s = re.sub(r"  __TARGET_GRANT__:\n(?:    .*\n)*", "", s, count=1)
+open(p, 'w', encoding='utf-8').write(s)
+PYX
+  # PRECONDITION, asserted rather than assumed. lane10-e leaves the clone DIVERGED, and a diverged
+  # clone refuses the fast-forward for a reason that has nothing to do with consent — so without the
+  # reset above the arm passes whether the class join works or not. Measured: a revert probe against
+  # the repaired fh_node_check.sh left this lane green, i.e. it was decorative. Same shape as the
+  # self-exclusion lane earlier the same day; the probe is what separates the two cases.
+  _h5="$(git -C "$_dn" rev-parse HEAD)"
+  if [ "$_h5" = "$(git -C "$_dn" rev-parse "origin/$_DEF")" ]; then
+    bad "lane10-f VACUOUS: clone is not behind origin, so 'no apply' proves nothing" "$_h5"
+  fi
+  run "$_dn" "$_ap_root/s_f" >/dev/null 2>&1
+  _filewide=0
+  bash "$FH_REPO/scripts/consent_registry_check.sh" \
+       "$_dn/tracks/_meta/consent_classes.yaml" \
+       "$_dn/tracks/_meta/user_adaptation_profile.md" >/dev/null 2>&1 || _filewide=$?
+  if [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h5" ] && [ "$_filewide" = "0" ]; then
+    ok "lane10-f WRONG-CLASS: another class granted, this one only in prose → no apply (file-wide check still 0)"
+  elif [ "$_filewide" != "0" ]; then
+    bad "lane10-f VACUOUS: the fixture broke the file-wide verdict (rc=$_filewide), so it re-tests lane10-c's axis, not the class join" "rebuild the fixture so the bare check returns 0"
+  else
+    bad "lane10-f WRONG-CLASS: applied on a class that was never granted" "$_h5 -> $(git -C "$_dn" rev-parse HEAD)"
+  fi
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+
+  # CONTROL — after all the refuse arms, prove the apply arm still fires. Without this, a lane
+  # suite where the feature has gone inert reports 4 clean refusals and looks perfect.
+  git -C "$_dn" reset -q --hard "origin/$_DEF" >/dev/null 2>&1   # noqa: destructive-op (throwaway fixture)
+  (cd "$_ap_root/up" && echo newer3 > f.txt && git commit -qam ahead3) >/dev/null 2>&1
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  _h4="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_f" >/dev/null 2>&1
+  [ "$(git -C "$_dn" rev-parse HEAD)" != "$_h4" ] \
+    && ok "lane10-CONTROL: apply arm still fires after the refuse arms (instrument alive)" \
+    || bad "lane10-CONTROL: apply arm went inert — the refuse lanes above prove nothing" "$_h4"
+fi
+rm -rf "$_ap_root"
+
 printf '\nnode-check lanes: %d passed, %d failed\n' "$PASS" "$FAIL"
 [ "$FAIL" -eq 0 ] || exit 1
 exit 0

package/scripts/test_selfcheck_state_lanes.sh

@@ -357,6 +357,67 @@ CTLPY
 [ "$_BARE_CTL" = FIRED ]
 chk $? "CONTROL: that detector fires on a planted declared-shipped subject (got $_BARE_CTL)"
 
+echo ""
+echo "── directional_diff_gate verdict arm: exit 0 is not a pass ──"
+# WHY THIS LANE EXISTS (2026-08-15): the block wiring directional_diff_gate.sh --self-test gates on
+# the subject's terminal verdict, not on rc=0 alone, and both halves of that were put there by a
+# cross-family round rather than by the author. Its first draft gated on rc=0 plus a SUBSTRING of
+# the verdict, and two reachable inputs satisfied it while nothing ran:
+#   · `✅ calibration passed (0 pairs)` — the subject's own verdict line is
+#     `[ "$f" -eq 0 ] && echo "✅ calibration passed ($n pairs)"`, so deleting every lane prints a
+#     PASS with n=0. Deletion read as a pass is the quietest face of the not-found-is-not-zero class.
+#   · `usage: calibration passed (28 pairs)` — a prose/usage line carrying the words.
+# Without this lane both repairs are reversible to green, which is anchor-is-decorative.
+# LIFTED from selfcheck.sh, not re-spelled — a lane that restates the condition stops seeing edits
+# to it, which is the failure the two lanes above were written to avoid.
+DD_ARM=$(sed -n '/^      _dd_verdict=\$(printf/,/^      fi ;;$/p' "$SELFCHECK" | sed 's/ ;;$//')
+if [ -z "$DD_ARM" ]; then
+  echo "FAIL  the directional_diff_gate verdict arm is no longer where this lane lifts it from."
+  echo "      If the block was moved or renamed, update the lane WITH the subject."
+  exit 1
+fi
+# An empty lift is not the only bad lift. If the END anchor stops matching — re-indent the arm, or
+# move it out of the `case` — the START anchor still matches and the range runs to EOF, which is
+# non-empty and therefore passes the guard above. What saves it today is luck, not design: the
+# `;;`-stripping applies to every line in the range, so downstream case arms lose their terminators
+# and `eval` dies of a syntax error. A downstream span that happened to be self-contained would
+# instead `eval` several hundred lines of selfcheck.sh, once per fixture, at the repo root. Bound
+# the lift by size so the failure is a lane message rather than an accident. Cross-family, 2026-08-15.
+if [ "$(printf '%s\n' "$DD_ARM" | wc -l)" -gt 15 ]; then
+  echo "FAIL  the lifted verdict arm is $(printf '%s\n' "$DD_ARM" | wc -l) lines — the sed END anchor"
+  echo "      stopped matching and the range ran past the block. Fix the anchor, do not widen this bound."
+  exit 1
+fi
+dd_arm_says() { # $1 = the subject's stdout; echoes PASS or FAIL
+  ( _out="$1"; fail=0; _show_failure() { :; }
+    eval "$DD_ARM" ) | grep -oE '^(PASS|FAIL)' | head -1
+}
+
+[ "$(dd_arm_says '✅ calibration passed (28 pairs)')" = PASS ]
+chk $? "a real verdict with a non-zero pair count passes"
+
+[ "$(dd_arm_says '✅ calibration passed (0 pairs)')" = FAIL ]
+chk $? "every lane deleted (0 pairs, exit 0) is caught, not certified"
+
+[ "$(dd_arm_says 'usage: calibration passed (28 pairs)')" = FAIL ]
+chk $? "a usage/prose line carrying the words does not satisfy the gate"
+
+# CONTROL — the pre-repair form (bare substring, no pair-count floor) must ACCEPT both bad
+# fixtures. Without it these lanes could pass because the fixtures are wrong rather than because
+# the repair works.
+_pre() { printf '%s\n' "$1" | grep -oE 'calibration passed \([0-9]+ pairs\)' | tail -1; }
+[ -n "$(_pre '✅ calibration passed (0 pairs)')" ] && [ -n "$(_pre 'usage: calibration passed (28 pairs)')" ]
+chk $? "CONTROL: the pre-repair substring form accepts both — the fixtures discriminate"
+
+# SCOPE of these four lanes, stated because the inherited §SCOPE block below is about a different
+# anchor and does not cover them. The lift is the `0)` arm's BODY only, so these lanes see a change
+# to the verdict predicate and are blind to the routing around it: widening `case ... in 0)` to
+# `0|1)`, dropping `< /dev/null`, dropping the `$_LANE_TO` wrapper, or deleting the rc=124
+# HARNESS-ERROR arm all leave every lane here green. Those are guarded by review, not by this file.
+# The `_pre` control is also a RE-SPELLING of the pre-repair form rather than a lift of it — it has
+# to be, since that form no longer exists in the subject to lift, but it means the control asserts
+# what the old code did from memory. Both limits found by cross-family review, 2026-08-15.
+
 # ── SCOPE OF THIS ANCHOR — stated so it is not over-trusted ───────────────────
 # These lanes catch REVERSION (the run-twice form coming back, the helper being gutted, the
 # call-site redirect returning). They do NOT catch deliberate EVASION: a cross-family round

package/templates/consent_classes.yaml.example

@@ -44,6 +44,36 @@
 #   Re-point the class's `owner` or `mode` after the grant and the join fails: that is the point.
 
 classes:
+  # ---- REAL, ADOPTABLE class (not illustrative) -------------------------------------
+  # Ships with fh_node_check.sh's consent-gated auto-pull. Copy this block verbatim into your
+  # own tracks/_meta/consent_classes.yaml, then grant it in your UAP frontmatter to enable the
+  # apply arm. Without both, the check surfaces "N commits behind" and never touches the repo —
+  # absent is not granted.
+  #
+  # Read the reason before adopting: this class takes a DIFFERENT verdict from the `local-commit`
+  # example further down, on a deliberately narrow ground. If your integration branch is not
+  # PR-only/protected, that ground does not hold for you and you should not adopt it.
+  - name: repo-freshness-autopull
+    owner: scripts/fh_node_check.sh
+    mode: ff-only-merge-on-default-branch
+    target: this repo's own default branch, in the local clone, when it is already checked out
+    capabilities: [network, repo-mutation]
+    sinks: []
+    feeds: []
+    promotion_eligible: true
+    lease_days: 92
+    reason: >
+      A fast-forward pull introduces nothing new: every commit it brings down is already on the
+      integration branch, which is PR-only and server-side protected, so all of it has passed the
+      gates. `local-commit` below is classified feeds:[go-public] because it CREATES ungated
+      content that publish can then ship; this makes the tree MATCH canon instead. Publish packs
+      the working tree, so a tree matching origin is strictly safer to publish from than a stale
+      one. Blast radius also excludes personal state by construction — a pull touches tracked
+      files only, and session/memory/companion state is gitignored or outside the repo.
+      Envelope (enforced in code, not prose): applies ONLY when the default branch is already
+      checked out, never switches branches, and --ff-only refuses a divergence rather than
+      absorbing it. Lanes: scripts/test_node_check_lanes.sh lane10-a..e + CONTROL.
+
   # ---- promotion-eligible example -------------------------------------------------
   - name: dispatch-readonly-sim-local-artifact
     owner: fh-meta:sim-conductor          # the gate/skill that does the asking