@chrono-meta/fh-gate 1.4.98 → 2.0.0

package/scripts/selfcheck.sh

@@ -485,7 +485,11 @@ done
 # or trim of that one test name would flip a real PASS into "dispatcher missing?" here (cross-family
 # review caught this, 2026-08-15). chamber_witness/digest_landing_check both print a genuine
 # terminal "캘리브레이션 통과/실패" line, so they stay.
-for _subj in compaction_probe judgment_circuit_lint novelty_claim_check chamber_witness digest_landing_check; do
+# publish_freshness_check joined 2026-08-16. It qualifies for the same reason chamber_witness does
+# and capability_registry_check does not: its terminal line is a genuine VERDICT
+# ("publish_freshness 캘리브레이션 통과/실패"), not a Korean test-case title, so a future rename of
+# any single lane cannot flip a real PASS into a false "dispatcher missing?" here.
+for _subj in compaction_probe judgment_circuit_lint novelty_claim_check chamber_witness digest_landing_check publish_freshness_check; do
   if [ ! -f "scripts/$_subj.sh" ]; then
     _absent_subject_verdict "$_subj --self-test" "scripts/$_subj.sh" || fail=1
   else
@@ -553,6 +557,30 @@ else
   fail=1
 fi
 
+# capability_effect_probe — wired 2026-08-16. `lane_runner_check.sh` had been flagging it as an
+# embedded --self-test subject with ZERO dispatchers, and that warning was load-bearing: the same
+# day, two SECURITY regression anchors were added to this suite (L8 args injection · L9 the git
+# metadata channel that let a `read-only` declaration plant a persistent `core.pager` hook in the
+# real repo while the probe printed VERIFIED). Unwired, those anchors would never have run anywhere
+# but on the author's machine — the exact "built but not wired" shape this repo keeps reproducing.
+# Not in the `_subj` loop above: its terminal line is `N PASS / M FAIL`, never 캘리브레이션, so that
+# loop's substring gate would go red for a reason unrelated to its lanes (capability_registry_check
+# was added there and reverted for precisely this). Direct dispatch instead.
+# 🟥 Exit code ALONE is not enough — a suite whose lanes were all deleted still exits 0 (measured
+# 2026-08-15 on directional_diff_gate). Require the terminal verdict AS A WHOLE LINE with a
+# non-zero PASS count, so an emptied suite cannot certify itself.
+if [ ! -f scripts/capability_effect_probe.sh ]; then
+  echo "FAIL  capability_effect_probe.sh: missing — it ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+elif _out=$(bash scripts/capability_effect_probe.sh --self-test < /dev/null 2>&1) \
+     && printf '%s\n' "$_out" | grep -qE '^── capability_effect_probe lanes: [1-9][0-9]* PASS / 0 FAIL ──$'; then
+  echo "PASS  capability_effect_probe.sh --self-test ($(printf '%s\n' "$_out" | grep -oE '[0-9]+ PASS / [0-9]+ FAIL' | tail -1))"
+else
+  echo "FAIL  capability_effect_probe.sh: --self-test failed or produced no terminal verdict line"
+  _show_failure "$_out"
+  fail=1
+fi
+
 # relay_channel — the other embedded --self-test subject kept out of the loop above: its
 # `--self-test` just `exec`s the sibling scripts/test_relay_channel_lanes.sh, whose own exit code
 # is already disciplined (`[ "$fail" -eq 0 ] || exit 1`), so gating on exit code — same shape as
@@ -582,6 +610,78 @@ else
   fail=1
 fi
 
+# directional_diff_gate — the LAST embedded --self-test subject with no caller, and it stayed
+# invisible for a reason worth keeping written down: lane_runner_check.sh reported it WIRED off the
+# subject's OWN usage comment (`#   bash scripts/directional_diff_gate.sh --self-test`), so the
+# report read `self-test: 10/10 wired` while `grep -rn directional_diff_gate` across every runner
+# surface returned zero real callers. The detector was repaired in the same delta as this wiring
+# (has_selftest_runner now skips the subject's own file, selftest_dispatched now drops comment
+# lines — the two guards has_runner/runner_dispatches always had), which is why the two halves ship
+# together: fixing the detector alone would have left a real debt item newly VISIBLE and still
+# unrun, and wiring alone would have left the detector able to certify the next such subject.
+# ⚠️ The cost of shipping both halves at once, named rather than left for the next reader to
+# discover: the report reads `10/10` before the change and `10/10` after it, so the detector repair
+# is NOT observable from this repo's own run — reverting the repair alone leaves the count
+# unchanged, because the wiring that now exists is real. Its only evidence is the fixture lanes
+# L14–L16 in scripts/test_lane_runner_lanes.sh, which is why L16 in particular is load-bearing:
+# delete it and the self-exclusion guard has nothing anywhere that would go red.
+#
+# NOT in the `for _subj in ...` loop above, and that is the same call made for
+# capability_registry_check: that loop gates on the substring 캘리브레이션, and this subject's
+# terminal verdict is English ("✅ calibration passed (N pairs)"). Adding it there would produce
+# "dispatcher missing?" — a confident and wrong cause — for a suite that passes. Gate on exit code
+# instead, same shape as the two blocks above. It carries genuine HARNESS-ERROR paths (`exit 10` on
+# mktemp failure, `return 10` on unreadable input), so a setup failure must not read as a lane
+# failure. Ships via package.json files[] with no ACCEPTED_ABSENT declaration, so absence is
+# deletion, not package mode. `< /dev/null` for the same stdin-wait reason the loop above documents.
+if [ ! -f scripts/directional_diff_gate.sh ]; then
+  echo "FAIL  directional_diff_gate.sh: missing — it ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+else
+  _out=$($_LANE_TO bash scripts/directional_diff_gate.sh --self-test < /dev/null 2>&1); _dd_rc=$?
+  case "$_dd_rc" in
+    10|2|124|126|127)
+      # 124 is `timeout`'s own kill code, so it belongs in this arm rather than the generic FAIL
+      # one below: a suite that was killed did not measure, and calling that "the lane failed"
+      # sends the reader to the wrong file. Reachable only because this dispatch is wrapped in
+      # `$_LANE_TO` — which is REUSED from the pair-suite loop above, not installed here, so do
+      # not delete it from this line believing the timeout is local to this block.
+      echo "HARNESS ERROR  directional_diff_gate.sh --self-test: exited $_dd_rc — it could not measure,"
+      echo "      so its verdicts prove nothing. Not a lane failure, and not a pass either."
+      fail=1 ;;
+    0)
+      # rc=0 is NOT sufficient, and this is not a hypothetical: the `for _subj in ...` loop above
+      # records the measured case where a subject fell into an unrecognized mode, printed its usage
+      # banner and exited 0, and the checker read that as a pass while 25 lanes had vanished. This
+      # subject happens to exit 10 from that path TODAY — a revert probe (2026-08-15: dispatcher
+      # line deleted) confirmed the HARNESS ERROR arm fires — but that is incidental to how its
+      # usage function is written, not a property this block should depend on. Require the
+      # terminal verdict itself, so a future subject that exits 0 without running anything goes red
+      # here rather than certifying an empty run.
+      # Whole-LINE match, not a substring, and the pair count must be non-zero. Both halves were
+      # named by cross-family review (2026-08-15) and both are reachable in the real subject, not
+      # hypothetical: directional_diff_gate.sh's verdict line is
+      # `[ "$f" -eq 0 ] && echo "✅ calibration passed ($n pairs)"` — delete every `t` lane and it
+      # prints `calibration passed (0 pairs)` and exits 0, i.e. a suite with nothing left in it
+      # certifies itself. That is the quietest face of [[feedback_not_found_is_not_zero_family]]
+      # (deletion read as a pass), and a substring match would also let a usage banner or a prose
+      # line carrying the same words satisfy the gate.
+      _dd_verdict=$(printf '%s\n' "$_out" | grep -oE '^✅ calibration passed \([0-9]+ pairs\)$' | tail -1)
+      _dd_pairs=$(printf '%s' "$_dd_verdict" | grep -oE '[0-9]+' | tail -1)
+      if [ -n "$_dd_verdict" ] && [ "${_dd_pairs:-0}" -gt 0 ]; then
+        echo "PASS  directional_diff_gate.sh --self-test ($_dd_verdict)"
+      else
+        echo "FAIL  directional_diff_gate.sh: --self-test exited 0 without a non-zero calibration verdict (dispatcher missing, or every lane deleted?)"
+        _show_failure "$_out"
+        fail=1
+      fi ;;
+    *)
+      echo "FAIL  directional_diff_gate.sh: --self-test failed (exit $_dd_rc)"
+      _show_failure "$_out"
+      fail=1 ;;
+  esac
+fi
+
 # memory-link-check — the memory store is a GRAPH (memory_intent_recall.md: nodes=files,
 # edges=[[links]], recall walks one hop). Measured 2026-07-28: 50 of 872 edges pointed at a note
 # that existed under a different separator and 22 at nothing — a dead edge returns nothing and is

package/scripts/test_capability_entrypoint_shipping.sh

@@ -53,6 +53,16 @@ fi
 FILES_JSON=$(node -e 'process.stdout.write(JSON.stringify(require("./package.json").files||[]))' 2>/dev/null) || {
   echo "  INSTRUMENT ERROR: could not read package.json files[]"; exit 1; }
 
+# ★`mktemp` — 초판은 `${TMPDIR:-/tmp}/cap_entry_$$.txt` 였다. TMPDIR 없는 환경(리눅스 CI·
+# 컨테이너가 흔하다)에서 공용 `/tmp` + PID 기반 **예측 가능한 이름**이라, 미리 심어둔 심링크를
+# `>` 리다이렉트가 따라가 대상 파일을 덮어쓴다(CWE-377, 보안 패스 [B]). 이 파일은 selfcheck 에
+# 배선돼 **소비자 머신에서 `npm test` 로 돈다**.
+# ⚠️ `mktemp -t <prefix>` 는 **BSD 전용**이다 — GNU 는 템플릿에 X 를 요구하고
+# `mktemp: too few X's in template` 로 죽는다(2026-08-16 CI 실측: 로컬 macOS 초록 · ubuntu 적색).
+# 이 레포가 이미 기록한 `stat -f` BSD-first 와 같은 얼굴이다. 양쪽에서 도는 형태는
+# **명시 템플릿 + X 다수**뿐이다. (계기가 fail-closed 로 막아 준 덕에 조용히 안 지나갔다.)
+_CAP_TMP=$(mktemp "${TMPDIR:-/tmp}/cap_entry.XXXXXXXX") || { echo "  INSTRUMENT ERROR: mktemp 실패"; exit 1; }
+trap 'rm -f "$_CAP_TMP"' EXIT INT TERM
 printf '%s\n' "$ENTRIES" | while IFS= read -r e; do
   [ -n "$e" ] || continue
   if node -e 'const f=JSON.parse(process.argv[1]);process.exit(f.includes(process.argv[2])?0:1)' "$FILES_JSON" "$e"; then
@@ -60,14 +70,14 @@ printf '%s\n' "$ENTRIES" | while IFS= read -r e; do
   else
     echo "  MISSING $e"
   fi
-done > "${TMPDIR:-/tmp}/cap_entry_$$.txt"
+done > "$_CAP_TMP"
 
-missing=$(grep -c '^  MISSING ' "${TMPDIR:-/tmp}/cap_entry_$$.txt" || true)
+missing=$(grep -c '^  MISSING ' "$_CAP_TMP" || true)
 missing=$(( ${missing:-0} + 0 ))
-shipped=$(grep -c '^  ok ' "${TMPDIR:-/tmp}/cap_entry_$$.txt" || true)
+shipped=$(grep -c '^  ok ' "$_CAP_TMP" || true)
 shipped=$(( ${shipped:-0} + 0 ))
-cat "${TMPDIR:-/tmp}/cap_entry_$$.txt"
-rm -f "${TMPDIR:-/tmp}/cap_entry_$$.txt"
+cat "$_CAP_TMP"
+rm -f "$_CAP_TMP"
 
 if [ "$missing" -eq 0 ]; then
   ok "all $shipped capability entry point(s) are in package.json files[]"
@@ -118,6 +128,66 @@ else
   bad "$dangling declared capability entry point(s) missing from disk — npm would ship a broken files[] and the disk-side check alone stays green"
 fi
 
+# SIBLING DEPENDENCIES (added 2026-08-16 — occurrence #4 of the class this file's header names).
+# The two directions above both key on the ENTRY-POINT convention (`*_capability.sh`). That is
+# structurally blind to the failure that actually happened this time: a shipped script called a
+# NON-entry-point sibling that did not ship. `capability_registry_check.sh` shipped, its new M6 axis
+# ran `${0%/*}/capability_effect_probe.sh`, and that probe was absent from files[] — so on a consumer
+# install M6 would hit its fail-closed branch and reject every registration, blaming a "missing probe"
+# that exists in the repo.
+#
+# WHY `package_coverage_check.sh` IS BLIND TO IT — and why the fix belongs here, not there: that
+# checker's extraction regex requires a reference to START with a shipped top-level directory
+# (`scripts|templates|bin|docs|knowledge|plugins|.claude`). A script naming its own sibling writes
+# `${0%/*}/name.sh` or `$(dirname "$0")/name.sh` — the path is BUILT AT RUNTIME and no literal
+# `scripts/` appears. The reference-follower cannot see a path that does not textually exist.
+#
+# Scope kept narrow on purpose: only SELF-DIRECTORY forms. `$REPO_ROOT/scripts/x.sh` already contains
+# the literal `scripts/x.sh` and is caught upstream; widening past that would duplicate that checker.
+SIB_PAT='(\$\{0%/\*\}|\$\(dirname [^)]*\)|\$\{BASH_SOURCE[^}]*%/\*\})/[A-Za-z0-9_.-]+\.(sh|py|js)'
+SHIPPED_SH=$(node -e '
+  const f=JSON.parse(process.argv[1]);
+  process.stdout.write(f.filter(p=>/^scripts\/.*\.sh$/.test(p)).join("\n"));
+' "$FILES_JSON")
+
+sib_refs=0; sib_missing=0
+if [ -n "$SHIPPED_SH" ]; then
+  while IFS= read -r s; do
+    [ -n "$s" ] && [ -f "$s" ] || continue
+    # `grep -o` yields the whole matched expression; the sibling NAME is its last path segment.
+    # COMMENT LINES ARE STRIPPED FIRST, and that is not cosmetic: the finding's text asserts the
+    # callee is "called at runtime". A file whose PROSE names a sibling (this file's own header does)
+    # would be reported under a claim that is false about it — the right defect attributed to the
+    # wrong caller. Caught during this lane's own known-pair calibration, where the positive arm
+    # named two callers and only one of them actually calls anything.
+    for ref in $(sed 's/^[[:space:]]*#.*//' "$s" | grep -oE "$SIB_PAT" 2>/dev/null | sed 's|.*/||' | sort -u); do
+      sib_refs=$((sib_refs+1))
+      # Only assert on siblings that EXIST in the repo. A reference to a name that is absent from
+      # disk too is a different defect (a dead call), and it belongs to the dangling check above —
+      # claiming it here would report one defect as two.
+      [ -f "scripts/$ref" ] || continue
+      if node -e 'const f=JSON.parse(process.argv[1]);process.exit(f.includes(process.argv[2])?0:1)' \
+           "$FILES_JSON" "scripts/$ref"; then :; else
+        echo "  SIBLING-MISSING scripts/$ref (called by $s at runtime, absent from files[])"
+        sib_missing=$((sib_missing+1))
+      fi
+    done
+  done <<EOF
+$SHIPPED_SH
+EOF
+fi
+
+# Discovery-zero is an instrument failure here for the same reason as above: this repo is KNOWN to
+# contain at least one self-directory sibling call (that is why this block exists). Zero means the
+# pattern stopped matching — a silent scanner, not a clean repo.
+if [ "$sib_refs" -eq 0 ]; then
+  bad "INSTRUMENT DEAD — zero self-directory sibling references found across $(printf '%s\n' "$SHIPPED_SH" | grep -c .) shipped scripts; the pattern is no longer matching anything"
+elif [ "$sib_missing" -eq 0 ]; then
+  ok "all $sib_refs runtime sibling dependenc(ies) of shipped scripts are themselves in files[]"
+else
+  bad "$sib_missing runtime sibling dependenc(ies) absent from files[] — the consumer gets a caller whose callee is missing"
+fi
+
 # CONTROL — the check must be able to say NO. A checker that only ever prints ok is indistinguishable
 # from a checker that is not looking; assert the negative arm on a name that cannot be in files[].
 if node -e 'const f=JSON.parse(process.argv[1]);process.exit(f.includes(process.argv[2])?0:1)' \

package/scripts/test_consent_registry.sh

@@ -782,6 +782,105 @@ else
   echo "  ✅ PROV-2 line tracks the resolution when it changes (shadowed → different value)"; pass=$((pass+1))
 fi
 
+# ---- RC: --require-class — narrowing the verdict from the FILE to ONE CLASS ---------
+# Added 2026-08-16 after a pre-publish security pass found the caller side broken: fh_node_check.sh
+# gated a consumer-machine `git merge --ff-only` on this script's FILE-WIDE 0 plus a raw grep for
+# the class name anywhere in the UAP. One unrelated validly-granted class, plus the target class
+# appearing only in a prose line saying it was REVOKED, satisfied both — the merge ran and the
+# banner reported a standing consent that did not exist.
+# Every lane below is a REFUSAL that leaves the file-wide verdict at 0. That property is asserted,
+# not assumed: without it these lanes would pass for the same reason the existing "nothing granted"
+# lanes do, and the class-join axis would go unexercised a second time.
+lane_args() {  # desc want_rc [args...] — same as lane() but the flag order is the point
+  local desc="$1" want_rc="$2"; shift 2
+  bash "$CHK" "$@" >"$TD/o" 2>&1
+  local rc=$?
+  if [ "$rc" -ne "$want_rc" ]; then
+    bad "$desc — exit $rc, expected $want_rc"; sed 's/^/     /' "$TD/o"; return
+  fi
+  ok "$desc"
+}
+
+TWOCLASS="$OKCLASS
+  - {name: other, owner: o2, mode: m2, target: t2, capabilities: [read], sinks: [], feeds: [], promotion_eligible: true}"
+
+# a) the class IS granted → 0
+mkreg "$TWOCLASS"
+mkuap 'standing_consent:
+  ok: {owner: o, mode: m, sinks: [], granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane_args "RC-a --require-class on a class that IS granted → 0" 0 --require-class ok "$TD/r.yaml" "$TD/u.md"
+
+# b) a DIFFERENT class is granted, the target appears only as prose → 3, file-wide still 0
+mkreg "$TWOCLASS"
+printf -- '---\nstanding_consent:\n  other: {owner: o2, mode: m2, sinks: [], granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t2}\n---\n\n# UAP (fixture)\n\n  ok: 안 쓰기로 했다 (revoked)\n' > "$TD/u.md"
+bash "$CHK" "$TD/r.yaml" "$TD/u.md" >/dev/null 2>&1; _fw=$?
+lane_args "RC-b another class granted, target only in prose → 3" 3 --require-class ok "$TD/r.yaml" "$TD/u.md"
+[ "$_fw" -eq 0 ] \
+  && ok "RC-b DISCRIMINATION: the file-wide verdict is still 0, so RC-b refused on the class join" \
+  || bad "RC-b VACUOUS: file-wide verdict was $_fw — this lane re-tests an existing axis, not the class join"
+
+# c) the ON switch must not be silently OFF. A whitespace-only name passed a `-z` test in the first
+#    draft and then strip()ed to empty, disabling the narrowing and returning the file-wide 0.
+lane_args "RC-c whitespace-only class name → 1 (fail-closed, never a silent fall-back)" 1 --require-class "   " "$TD/r.yaml" "$TD/u.md"
+lane_args "RC-d --require-class= empty form → 1" 1 --require-class= "$TD/r.yaml" "$TD/u.md"
+
+# e) flag position. The first draft read argv[1] only, so a caller appending the flag got the old
+#    file-wide 0 with no warning — the failure mode is silence, which is why this is a lane.
+lane_args "RC-e flag AFTER the paths is still honoured → 3" 3 "$TD/r.yaml" "$TD/u.md" --require-class ok
+lane_args "RC-f --require-class=NAME form is honoured → 3" 3 --require-class=ok "$TD/r.yaml" "$TD/u.md"
+
+# g) an unknown option must not be swallowed as a path
+lane_args "RC-g unknown option → 1, not consumed as a path" 1 --bogus "$TD/r.yaml" "$TD/u.md"
+
+# h) the human summary must agree with the typed exit — this file's own rule, applied to the new path
+bash "$CHK" --require-class ok "$TD/r.yaml" "$TD/u.md" >"$TD/o" 2>&1
+if grep -qE '^consent-registry: UNMEASURED for class `ok`' "$TD/o" && ! grep -qE '^consent-registry: PASS$' "$TD/o"; then
+  ok "RC-h summary agrees with the typed exit (no bare PASS above an exit-3 verdict)"
+else
+  bad "RC-h summary contradicts the verdict"; sed 's/^/     /' "$TD/o"
+fi
+
+# i) no flag → behaviour unchanged. Backward compatibility is a claim, so it gets a lane.
+lane_args "RC-i no flag → file-wide verdict unchanged (0)" 0 "$TD/r.yaml" "$TD/u.md"
+
+# j) IDENTITY IS NOT NORMALISED FOR THE CALLER. A third adversarial round measured the first repair
+#    squeezing ALL whitespace out of the name, so `--require-class 'o k'` was answered with the
+#    verdict for class `ok` — a different question, silently answered. Asking about a name that is
+#    not a name is refused, never repaired.
+mkreg "$TWOCLASS"
+mkuap 'standing_consent:
+  ok: {owner: o, mode: m, sinks: [], granted: 2026-07-29, expires: 2026-12-31, effects: [read], target: t}'
+lane_args "RC-j interior whitespace in the class name → 1, never folded onto a real class" 1 --require-class "o k" "$TD/r.yaml" "$TD/u.md"
+lane_args "RC-k surrounding whitespace IS trimmed → 0 (trim, not squeeze)" 0 --require-class "  ok  " "$TD/r.yaml" "$TD/u.md"
+
+# l) argv preservation. The first repair rebuilt "$@" through a newline-delimited string, which split
+#    a path containing a newline and DROPPED an empty positional — the drop promoted the UAP path
+#    into the registry slot, i.e. the tool silently measured a different pair of files than it was
+#    handed. Both are exotic inputs; both are silent, which is why they are lanes.
+_nlreg="$TD/reg
+two.yaml"
+cp "$TD/r.yaml" "$_nlreg" 2>/dev/null && lane_args "RC-l a registry path containing a newline is one argument" 0 --require-class ok "$_nlreg" "$TD/u.md" \
+  || ok "RC-l SKIPPED — this filesystem rejected a newline in a filename (not a defect)"
+# RC-m asserts on WHICH registry path the tool reports, not on a success marker. The first version
+# grepped for `R1/R2`, which only appears when the DEFAULT registry parses — and that default is
+# `tracks/_meta/consent_classes.yaml`, which is **gitignored**, so it exists on the author's machine
+# and not in CI. It passed locally and went red on the first CI run: a lane that measured the
+# author's filesystem rather than the behaviour. This form works in both.
+# Calibrated: the control proves the reported path tracks argv[1] at all, so the assertion below is
+# a discrimination result and not a grep that could never match.
+bash "$CHK" "/nonexistent-registry-probe.yaml" "$TD/u.md" >"$TD/oc" 2>&1
+if grep -q "nonexistent-registry-probe.yaml" "$TD/oc"; then
+  ok "RC-m CONTROL: the reported registry path tracks argv[1]"
+else
+  bad "RC-m CONTROL dead: the tool did not name the registry it was given — the assertion below proves nothing"; sed 's/^/     /' "$TD/oc"
+fi
+bash "$CHK" "" "$TD/u.md" >"$TD/o" 2>&1
+if grep -qE "registry (at|unparseable).*$(basename "$TD")/u\.md" "$TD/o"; then
+  bad "RC-m empty positional shifted the argument list — the UAP was read as the registry"; sed 's/^/     /' "$TD/o"
+else
+  ok "RC-m an empty first positional does not promote the UAP into the registry slot"
+fi
+
 echo "----"
 echo "consent-registry anchor: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_lane_runner_lanes.sh

@@ -216,6 +216,80 @@ else
   printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
+# ── L14/L15 the SUBJECT'S OWN documentation is not a caller (2026-08-15) ──────────────────────
+# Measured on this repo: `self-test: 10/10 wired` while directional_diff_gate.sh had ZERO callers
+# (`grep -rn directional_diff_gate scripts/*.sh templates/.git-hooks/* .github/workflows/*.yml`,
+# excluding the checker and the subject itself → nothing). The subject's own usage comment
+# (`#   bash scripts/directional_diff_gate.sh --self-test`) matched the direct-dispatch regex, so
+# the checker read the file's documentation of itself as evidence that something ran it.
+#
+# This is the SAME class the checker already closes one level up and, until now, only there:
+# `runners` drops lane_runner_check.sh so the tool cannot certify its own DEBT list as done, and
+# has_runner() skips a suite's own file, and runner_dispatches() skips comment lines. None of the
+# three guards reached the --self-test branch — has_selftest_runner() scanned every runner
+# including the subject, over raw text including comments. A guard that exists in one predicate
+# and not in its sibling is not a guard, it is a coincidence.
+#
+# Two lanes because the two halves fail independently: self-exclusion alone still lets a COMMENT
+# in a third file certify a subject, and comment-skipping alone still lets a subject's own
+# non-comment self-reference do it.
+
+# L14 known-POSITIVE: the subject's OWN usage comment must not count as a caller.
+D="$T/l14"; mkfixture_clean "$D"
+cat > "$D/scripts/orphan_probe.sh" <<'SUBJ'
+#!/usr/bin/env bash
+# Usage:
+#   bash scripts/orphan_probe.sh --self-test        # known-pair calibration
+[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }
+SUBJ
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L14 known-positive: subject's own usage comment is not a caller — still reported unwired"
+else
+  bad "L14 known-positive did not fire (rc=$rc) — self-referential comment read as a dispatcher"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L15 known-POSITIVE: a comment in a DIFFERENT file must not count either. Same discipline
+# runner_dispatches() already applies to ordinary suites ("a mention is not an invocation").
+D="$T/l15"; mkfixture_clean "$D"
+printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
+cat > "$D/scripts/selfcheck.sh" <<'SC'
+#!/usr/bin/env bash
+bash scripts/lane_runner_check.sh
+bash scripts/test_ok_lanes.sh
+# historical note: we used to run `bash scripts/orphan_probe.sh --self-test` here, removed 2026-01-01
+SC
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L15 known-positive: a commented-out dispatch in another file is not a caller"
+else
+  bad "L15 known-positive did not fire (rc=$rc) — a comment read as a live dispatcher"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
+# L16 known-POSITIVE: a subject that names its own dispatch on a NON-comment line. This is the only
+# lane that actually pins the self-exclusion guard, and it exists because a cross-family round
+# (2026-08-15) showed L14/L15 do not: both of their fixtures put the self-reference in a `#` line,
+# so comment-stripping alone already satisfies them and the guard could be deleted with all lanes
+# still green — a repair with no control, which is the exact failure this file was written to name.
+# The shape is a usage helper, because that is how a real subject names its own flag in live code
+# rather than in a header comment.
+D="$T/l16"; mkfixture_clean "$D"
+cat > "$D/scripts/orphan_probe.sh" <<'SUBJ'
+#!/usr/bin/env bash
+usage() { echo "run: bash scripts/orphan_probe.sh --self-test"; }
+[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }
+usage
+SUBJ
+out=$(run "$D"); rc=$(rcof "$D")
+if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
+  ok "L16 known-positive: a subject's own NON-comment self-reference is not a caller"
+else
+  bad "L16 known-positive did not fire (rc=$rc) — self-exclusion guard is unanchored"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
+fi
+
 echo "----"
 echo "lane-runner lanes: $pass passed, $fail failed"
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_node_check_lanes.sh

@@ -174,6 +174,223 @@ for h in "$FH_REPO"/templates/.git-hooks/pre-commit "$FH_REPO"/templates/.git-ho
   else bad "lane9 sentinel does NOT match shipped $(basename "$h") — every FH machine would report 'not FH gate'" "$(head -3 "$h")"; fi
 done
 
+# ── lane10 — consent-gated auto-pull: the APPLY arm and every REFUSE arm ─────────────────────
+# Added 2026-08-15 with the feature. These lanes exist because the feature's whole safety claim is
+# about what it does NOT do, and "does not" is exactly what a green run cannot demonstrate by
+# itself — every refuse arm below is paired against an apply arm in the same fixture, so a lane
+# that goes silently inert fails the CONTROL rather than passing everything.
+# 🟥 The load-bearing one is lane10-b: in a shared checkout a branch switch yanks the ground out
+# from under a peer session (measured 2026-08-09, two sessions/one worktree). If this feature ever
+# switches branches, that lane is what says so.
+_ap_root="$(mktemp -d)"
+(
+  cd "$_ap_root" || exit 1
+  # Pin the branch name: `git init` uses init.defaultBranch, which is main on this
+  # operator's machine and master on a stock Ubuntu (CI). Hardcoding "main" in the
+  # assertions below made lane10-b pass VACUOUSLY there (`rev-parse "$_DEF"` returned
+  # empty, and empty==empty compared true) while CONTROL's reset silently no-op'd.
+  git -c init.defaultBranch=main init -q up && cd up
+  git config user.email t@t; git config user.name t; git config commit.gpgsign false
+  mkdir -p scripts tracks/_meta
+  cp "$FH_REPO/scripts/fh_node_check.sh" "$FH_REPO/scripts/consent_registry_check.sh" scripts/
+  # Build the consent fixture from the SHIPPED TEMPLATE, never from the operator's local
+  # tracks/_meta/ — those are gitignored, so on CI (and on any fresh clone) they do not exist and
+  # the lanes would report a red FAIL for a file whose absence is correct by design. Measured on
+  # CI 2026-08-15: exactly that, "registry/UAP absent — lanes not run". Sourcing the template
+  # instead is strictly better than degrading to SKIP: the lanes then actually run everywhere, and
+  # they validate the very block a consumer is told to copy.
+  cp "$FH_REPO/templates/consent_classes.yaml.example" tracks/_meta/consent_classes.yaml
+  # The grant side has no shipped template (a UAP is per-operator by nature), so synthesize the
+  # minimum the registry check requires: the full R6 fingerprint, far-future expiry so the fixture
+  # never rots into a false refusal, joined to the template's own class name.
+  # Dates are computed at fixture-build time, not hardcoded, for two reasons that pull opposite
+  # ways: a fixed past date rots into a false REFUSE, and a far-future one is refused outright —
+  # R5 caps a lease at 365 days ("an unbounded expiry is a transfer, not a lease"), and the first
+  # version of this fixture used 2099-01-01 and was correctly rejected by the very floor the
+  # feature depends on. GNU-first with validation, same discipline as every _mtime helper here:
+  # `date -d` is GNU, `date -v` is BSD, and neither failing silently is acceptable.
+  _g="$(date +%Y-%m-%d)"
+  _e="$(date -d '+300 days' +%Y-%m-%d 2>/dev/null || date -v+300d +%Y-%m-%d 2>/dev/null || echo '')"
+  case "$_e" in
+    [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]) : ;;
+    *) bad "lane10 fixture: could not compute a lease expiry (neither GNU nor BSD date worked)" "$_e"; _e="$_g" ;;
+  esac
+  cat > tracks/_meta/user_adaptation_profile.md <<UAPEOF
+---
+standing_consent:
+  repo-freshness-autopull:
+    granted: $_g
+    expires: $_e
+    owner: scripts/fh_node_check.sh
+    mode: ff-only-merge-on-default-branch
+    target: this repo's own default branch, in the local clone, when it is already checked out
+    effects: [network, repo-mutation]
+    sinks: []
+---
+lane fixture — not a real profile
+UAPEOF
+  echo base > f.txt; git add -A >/dev/null; git commit -qm base
+  cd ..; git clone -q up dn; cd up; echo newer > f.txt; git commit -qam ahead
+) >/dev/null 2>&1
+_dn="$_ap_root/dn"
+if [ ! -d "$_dn/.git" ] || [ ! -f "$_dn/tracks/_meta/consent_classes.yaml" ]; then
+  bad "lane10 fixture: could not build the consent fixture (registry/UAP absent — lanes not run)" "$_ap_root"
+else
+  git -C "$_dn" config user.email t@t >/dev/null 2>&1; git -C "$_dn" config user.name t >/dev/null 2>&1
+  # Derive rather than assume — belt-and-braces over the pin above, so a future git
+  # whose init behaviour changes again cannot make these lanes vacuous a second time.
+  _DEF="$(git -C "$_dn" symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^origin/##')"
+  [ -n "$_DEF" ] || _DEF=main
+  if ! git -C "$_dn" show-ref --verify --quiet "refs/heads/$_DEF"; then
+    bad "lane10 fixture: default branch '$_DEF' has no local ref — assertions below would be vacuous" "$(git -C "$_dn" branch -a)"
+  fi
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  _h0="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_a" >/dev/null 2>&1
+  if [ "$(git -C "$_dn" rev-parse HEAD)" != "$_h0" ]; then
+    ok "lane10-a APPLY: consented + on default branch → fast-forwarded"
+  else
+    bad "lane10-a APPLY: consented + on default branch did NOT fast-forward (feature inert — every refuse lane below is then vacuous)" "$_h0"
+  fi
+
+  # b — the envelope. Never applies off the default branch, and NEVER switches branches.
+  (cd "$_ap_root/up" && echo newer2 > f.txt && git commit -qam ahead2) >/dev/null 2>&1
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  git -C "$_dn" switch -c feat-x -q >/dev/null 2>&1
+  _m0="$(git -C "$_dn" rev-parse "$_DEF")"
+  # ⚠️ CHECKING main AND THE BRANCH NAME IS NOT ENOUGH — measured by a revert probe 2026-08-15.
+  # With the envelope deliberately broken, `merge --ff-only origin/main` fast-forwards THE BRANCH
+  # YOU ARE ON, so feat-x moved while `main` sat still and the branch name never changed. The first
+  # version of this lane asserted only those two and stayed green against a defeated envelope —
+  # decorative. The tip that must not move is the CURRENT branch's own.
+  _f0="$(git -C "$_dn" rev-parse feat-x)"
+  run "$_dn" "$_ap_root/s_b" >/dev/null 2>&1
+  if [ "$(git -C "$_dn" rev-parse "$_DEF")" = "$_m0" ] \
+     && [ "$(git -C "$_dn" rev-parse feat-x)" = "$_f0" ] \
+     && [ "$(git -C "$_dn" branch --show-current)" = "feat-x" ]; then
+    ok "lane10-b ENVELOPE: off default branch → no apply on EITHER branch, no switch"
+  else
+    bad "lane10-b ENVELOPE: a branch tip moved off the default branch — the shared-checkout hazard" "main=$_m0->$(git -C "$_dn" rev-parse "$_DEF") feat-x=$_f0->$(git -C "$_dn" rev-parse feat-x) branch=$(git -C "$_dn" branch --show-current)"
+  fi
+  git -C "$_dn" switch -q "$_DEF" >/dev/null 2>&1
+
+  # c — no grant. absent ≠ granted.
+  cp "$_dn/tracks/_meta/user_adaptation_profile.md" "$_ap_root/uap.bak"
+  python3 - "$_dn/tracks/_meta/user_adaptation_profile.md" <<'PYX'
+import re,sys
+p=sys.argv[1]; s=open(p,encoding='utf-8').read()
+open(p,'w',encoding='utf-8').write(re.sub(r'\nstanding_consent:\n(?:  .*\n|    .*\n)*', '\n', s, count=1))
+PYX
+  _h1="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_c" >/dev/null 2>&1
+  [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h1" ] \
+    && ok "lane10-c NO-GRANT: absent standing_consent → no apply" \
+    || bad "lane10-c NO-GRANT: applied without a grant" "$_h1"
+
+  # d — expired lease. A lease nobody enforces is not a lease.
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+  sed -i.bak2 's/expires: [0-9-]*/expires: 2020-01-01/' "$_dn/tracks/_meta/user_adaptation_profile.md"
+  _h2="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_d" >/dev/null 2>&1
+  [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h2" ] \
+    && ok "lane10-d EXPIRED: past-dated lease → no apply" \
+    || bad "lane10-d EXPIRED: applied under an expired lease" "$_h2"
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+
+  # e — divergence. --ff-only must refuse rather than absorb, and local work must survive.
+  (cd "$_dn" && echo local-only > mine.txt && git add -A && git commit -qm diverge) >/dev/null 2>&1
+  _h3="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_e" >/dev/null 2>&1
+  if [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h3" ] && [ -f "$_dn/mine.txt" ]; then
+    ok "lane10-e DIVERGED: ff refused, local commit survives"
+  else
+    bad "lane10-e DIVERGED: local history was moved or lost" "$_h3 -> $(git -C "$_dn" rev-parse HEAD)"
+  fi
+
+  # f — WRONG CLASS. The refusal that the other three arms structurally cannot produce.
+  # Arms c/d/e all refuse by breaking the FILE-WIDE verdict (grant block deleted → exit 3; lease
+  # past-dated → exit 1; divergence → git itself refuses). None of them touches the question "is
+  # THIS class granted", so a caller keyed on the file-wide 0 passed them all — measured 2026-08-15
+  # by a pre-publish security pass, with a live control: one unrelated class validly granted plus
+  # the target class named only in prose, and the merge ran while the banner claimed a standing
+  # consent that never existed. The revoke path was the broken one.
+  # The second assertion below is the load-bearing half: this arm must refuse WHILE the bare
+  # file-wide check still returns 0. Without it the lane would pass for the same reason lane10-c
+  # does, and the axis would go unexercised again.
+  # ORDER MATTERS, and getting it wrong is silent: the UAP is a TRACKED file in this fixture, so
+  # `git reset --hard` reverts any edit made to it. The first draft transformed the UAP and then
+  # reset — restoring the original grant, so the apply fired legitimately and the lane failed for a
+  # reason that looked like the defect. Reset and advance origin FIRST, edit the UAP AFTER.
+  git -C "$_dn" reset -q --hard "origin/$_DEF" >/dev/null 2>&1   # noqa: destructive-op (throwaway fixture)
+  (cd "$_ap_root/up" && echo newer-f > f.txt && git commit -qam ahead-f) >/dev/null 2>&1
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+  python3 - "$_dn/tracks/_meta/user_adaptation_profile.md" <<'PYX'
+import sys, re as _re
+p = sys.argv[1]; s = open(p, encoding='utf-8').read()
+old = "  repo-freshness-autopull:"
+assert old in s, "lane10-f fixture: grant key not found"
+# Reuse the lease dates the fixture already computed, so this arm cannot fail for a date reason and
+# be mistaken for a class-join refusal. (First draft omitted them: R5 fired, the file-wide verdict
+# went to 1, and the arm's own vacuity guard caught it — which is what that guard is for.)
+_g = _re.search(r"granted: (\S+)", s).group(1)
+_e = _re.search(r"expires: (\S+)", s).group(1)
+# A VALID grant for a different registered, promotion_eligible class, scope-matched to its
+# registration so R6/R7 pass — the point is a file that is entirely well-formed.
+other = ("  dispatch-readonly-sim-local-artifact:\n"
+         f"    granted: {_g}\n"
+         f"    expires: {_e}\n"
+         "    owner: fh-meta:sim-conductor\n"
+         "    mode: blind-target-tier-sim\n"
+         "    target: a single local file under the current repo\n"
+         "    effects: [read, dispatch]\n"
+         "    sinks: []\n")
+s = s.replace(old, "  __TARGET_GRANT__:", 1)
+head, sep, tail = s.partition("standing_consent:\n")
+s = head + sep + other + tail
+# the target class survives ONLY as prose — the shape the old raw grep could not tell from a grant
+s = s.replace("lane fixture — not a real profile",
+              "lane fixture — not a real profile\n\n  repo-freshness-autopull: 철회함 (revoked)")
+import re
+s = re.sub(r"  __TARGET_GRANT__:\n(?:    .*\n)*", "", s, count=1)
+open(p, 'w', encoding='utf-8').write(s)
+PYX
+  # PRECONDITION, asserted rather than assumed. lane10-e leaves the clone DIVERGED, and a diverged
+  # clone refuses the fast-forward for a reason that has nothing to do with consent — so without the
+  # reset above the arm passes whether the class join works or not. Measured: a revert probe against
+  # the repaired fh_node_check.sh left this lane green, i.e. it was decorative. Same shape as the
+  # self-exclusion lane earlier the same day; the probe is what separates the two cases.
+  _h5="$(git -C "$_dn" rev-parse HEAD)"
+  if [ "$_h5" = "$(git -C "$_dn" rev-parse "origin/$_DEF")" ]; then
+    bad "lane10-f VACUOUS: clone is not behind origin, so 'no apply' proves nothing" "$_h5"
+  fi
+  run "$_dn" "$_ap_root/s_f" >/dev/null 2>&1
+  _filewide=0
+  bash "$FH_REPO/scripts/consent_registry_check.sh" \
+       "$_dn/tracks/_meta/consent_classes.yaml" \
+       "$_dn/tracks/_meta/user_adaptation_profile.md" >/dev/null 2>&1 || _filewide=$?
+  if [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h5" ] && [ "$_filewide" = "0" ]; then
+    ok "lane10-f WRONG-CLASS: another class granted, this one only in prose → no apply (file-wide check still 0)"
+  elif [ "$_filewide" != "0" ]; then
+    bad "lane10-f VACUOUS: the fixture broke the file-wide verdict (rc=$_filewide), so it re-tests lane10-c's axis, not the class join" "rebuild the fixture so the bare check returns 0"
+  else
+    bad "lane10-f WRONG-CLASS: applied on a class that was never granted" "$_h5 -> $(git -C "$_dn" rev-parse HEAD)"
+  fi
+  cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
+
+  # CONTROL — after all the refuse arms, prove the apply arm still fires. Without this, a lane
+  # suite where the feature has gone inert reports 4 clean refusals and looks perfect.
+  git -C "$_dn" reset -q --hard "origin/$_DEF" >/dev/null 2>&1   # noqa: destructive-op (throwaway fixture)
+  (cd "$_ap_root/up" && echo newer3 > f.txt && git commit -qam ahead3) >/dev/null 2>&1
+  git -C "$_dn" fetch -q origin >/dev/null 2>&1
+  _h4="$(git -C "$_dn" rev-parse HEAD)"
+  run "$_dn" "$_ap_root/s_f" >/dev/null 2>&1
+  [ "$(git -C "$_dn" rev-parse HEAD)" != "$_h4" ] \
+    && ok "lane10-CONTROL: apply arm still fires after the refuse arms (instrument alive)" \
+    || bad "lane10-CONTROL: apply arm went inert — the refuse lanes above prove nothing" "$_h4"
+fi
+rm -rf "$_ap_root"
+
 printf '\nnode-check lanes: %d passed, %d failed\n' "$PASS" "$FAIL"
 [ "$FAIL" -eq 0 ] || exit 1
 exit 0