@chrono-meta/fh-gate 2.15.0 → 3.0.0

package/scripts/test_mapped_tracks_lanes.sh

@@ -53,7 +53,7 @@ EXPECT=3   # the_bible + pmh-dev + qasp ; _meta and _audit excluded
 
 # PREMISE — if the worktree can already see the fixtures, every verdict below is meaningless.
 NAIVE_WT=0
-for d in "$TMP/wt"/tracks/*/; do [ -d "$d" ] || continue; case "$(basename "$d")" in _*) continue;; esac; NAIVE_WT=$((NAIVE_WT+1)); done
+for d in "$TMP/wt"/tracks/*/; do [ -d "$d" ] || continue; case "$(basename "$d")" in _*) continue;; esac; NAIVE_WT=$((NAIVE_WT+1)); done  # portability-noqa: the [ -d "$d" ] || continue guard is on this SAME line (right after 'do'), not the next 1-2 lines the P8 scanner checks
 [ "$NAIVE_WT" -lt "$EXPECT" ] \
   && ok "premise: a naive cwd count from the worktree sees $NAIVE_WT of $EXPECT — the blindness is real here" \
   || ng "premise BROKEN: worktree already sees $NAIVE_WT — fixture does not reproduce the defect"

package/scripts/test_marker_soul_check_lanes.sh

@@ -165,6 +165,30 @@ crossfamily: panel(codex,agy) — 겹친 지적 0'
 planep P6-real-corpus-negative BLOCK "$GRACE" "$(cat "$REPO_ROOT/tracks/_meta/.axes_23_passed_feat_target-freeze-gate_2026-08-18.marker" 2>/dev/null || echo 'axes-run: x')"
 planep P7-real-corpus-positive PASS  "$GRACE" "$(cat "$REPO_ROOT/tracks/_meta/.axes_23_passed_fix_witness-two-commit-discipline_2026-08-17.marker" 2>/dev/null || echo '①영혼: 성공 정의 = 하나 둘 셋 넷 다섯 여섯')"
 
+echo
+echo "== ①영혼 2칸(성공정의/절대안함) advisory lanes (2026-09-04, six_axis_review 판정안 4) =="
+# advisory only — 두 케이스 다 rc=0(PASS). 판별은 rc 가 아니라 stdout 의 ⚠️ 문자열이다
+# (known-pair: 한 칸만 있는 마커는 경고가 «찍혀야» 하고, 두 칸 다 있는 마커는 «안 찍혀야» 한다).
+planep_adv() { # $1=id $2=expect(WARN|QUIET) $3=filename-date $4=body
+  local id="$1" expect="$2" d="$3" body="$4" out f
+  f="$T/.axes_23_passed_fix_x_${d}.marker"
+  printf '%s\n' "$body" > "$f"
+  out=$( bash -c 'set -uo pipefail; SOUL_PRESENT_GRACE_DATE="$3"; . "$1"; validate_soul_present_leg "$2"' \
+         _ "$T/fnp.sh" "$f" "$GRACE" 2>&1 )
+  local got=QUIET; printf '%s' "$out" | grep -q '①영혼 2칸 미달' && got=WARN
+  if [ "$got" = "$expect" ]; then printf '  ✅ %-40s %s\n' "$id" "$got"
+  else printf '  ❌ %-40s expected %s, got %s\n     %s\n' "$id" "$expect" "$got" "$(printf '%s' "$out"|head -2)"; FAIL=1; fi
+}
+# known-positive — 「성공 정의」만 있고 「절대 안 함」이 없다 → advisory 가 찍혀야 한다, 그래도 PASS(rc=0)
+planep_adv Q1-one-slot-only-warns  WARN  "$GRACE" '①영혼: 성공 정의 = 소비자 경로에서 완주해 rc=0 을 낸다
+axes-run: ⓐ=codex'
+# known-negative — 두 칸 다 있다($SOUL 픽스처) → advisory 가 안 찍혀야 한다
+planep_adv Q2-both-slots-quiet     QUIET "$GRACE" "$SOUL
+axes-run: ⓐ=codex"
+# 둘 다 rc=0(PASS) 이어야 한다 — advisory 는 커밋을 막지 않는다(형식만 다르고 planep 로도 확인)
+planep Q1b-one-slot-still-passes PASS "$GRACE" '①영혼: 성공 정의 = 소비자 경로에서 완주해 rc=0 을 낸다
+axes-run: ⓐ=codex'
+
 echo
 echo "== cross-family findings — regression lanes (codex/gpt-5.5, diff 축, 2026-08-21) =="
 # F1 self-referential FP: codex's own alignment fix flipped G8 to PASS because the

package/scripts/test_node_check_lanes.sh

@@ -42,43 +42,43 @@ echo "── node-check lanes ──"
 # LANE 1 (S3-1) — NOT a git repo. The git-hook floor cannot be installed here at all, so it is
 # N/A, not missing. Reporting it would be an unfixable notice repeating every session forever.
 mkdir -p "$TMP/nogit"
-out="$(run "$TMP/nogit" "$TMP/s1" FH_MACHINE_ID=nogitbox)"
+out="$(run "$TMP/nogit" "$TMP/s1" FH_MACHINE_ID=nogitbox)"; rc=$?
 # POSITIVE CONTROL: assert what MUST appear alongside what must not. Absence-only lanes are
 # satisfied by a script that prints nothing at all — an `exit 0` stub passed lanes 1, 4 and 7
 # (cross-family mutation 2026-07-30), so each now pins an expected utterance too.
 case "$out" in
-  *"Missing mechanical floor"*) bad "lane1 non-git: must NOT claim a missing floor (N/A, unfixable)" "$out" ;;
+  *"Missing mechanical floor"*) bad "lane1 non-git: must NOT claim a missing floor (N/A, unfixable)" "rc=$rc | $out" ;;
   *"first session for this clone"*) ok "lane1 non-git: N/A on the git floor, but still reports the node event" ;;
-  *) bad "lane1 non-git: silent — a stub would pass this lane" "$out" ;;
+  *) bad "lane1 non-git: silent — a stub would pass this lane" "rc=$rc | $out" ;;
 esac
 
 # LANE 2 (S3-2) — hooks exist but belong to another framework (husky/pre-commit). Executable ≠ FH's
 # gate. Silence here is the exact accident this check was built for: FH gates absent, machine quiet.
 mk_git_hub "$TMP/husky" no
-out="$(run "$TMP/husky" "$TMP/s2" FH_MACHINE_ID=huskybox)"
+out="$(run "$TMP/husky" "$TMP/s2" FH_MACHINE_ID=huskybox)"; rc=$?
 case "$out" in
   *"Missing mechanical floor"*) ok "lane2 foreign hooks: FH gate absence reported" ;;
-  *) bad "lane2 foreign hooks: non-FH hooks were accepted as FH floors" "$out" ;;
+  *) bad "lane2 foreign hooks: non-FH hooks were accepted as FH floors" "rc=$rc | $out" ;;
 esac
 
 # LANE 3 (S3-3) — Mode D user on a FRESH clone: companion store present, settings.local.json absent
 # (it is gitignored, so a clone never has it). This is the MEASURED 2026-07-30 incident. Must speak.
 mk_git_hub "$TMP/moded" yes
 mkdir -p "$TMP/companion/.git"
-out="$(run "$TMP/moded" "$TMP/s3" FH_MACHINE_ID=modedbox BE_DIR="$TMP/companion")"
+out="$(run "$TMP/moded" "$TMP/s3" FH_MACHINE_ID=modedbox BE_DIR="$TMP/companion")"; rc=$?
 case "$out" in
   *companion-load*) ok "lane3 fresh Mode D clone: companion-load absence surfaced" ;;
-  *) bad "lane3 fresh Mode D clone: SILENT — the measured incident would recur" "$out" ;;
+  *) bad "lane3 fresh Mode D clone: SILENT — the measured incident would recur" "rc=$rc | $out" ;;
 esac
 
 # LANE 4 (M2-4) — public non-Mode-D user: no companion store anywhere. The companion item must not
 # appear, or the majority path gets a false positive for a feature it does not use.
 mk_git_hub "$TMP/public" yes
-out="$(run "$TMP/public" "$TMP/s4" FH_MACHINE_ID=publicbox)"
+out="$(run "$TMP/public" "$TMP/s4" FH_MACHINE_ID=publicbox)"; rc=$?
 case "$out" in
-  *companion-load*) bad "lane4a non-Mode-D: companion item shown to a user with no store" "$out" ;;
+  *companion-load*) bad "lane4a non-Mode-D: companion item shown to a user with no store" "rc=$rc | $out" ;;
   *"first session for this clone"*) ok "lane4a non-Mode-D: companion absent, node event still reported" ;;
-  *) bad "lane4a non-Mode-D: silent — a stub would pass this lane" "$out" ;;
+  *) bad "lane4a non-Mode-D: silent — a stub would pass this lane" "rc=$rc | $out" ;;
 esac
 
 # LANE 4b (S4-1) — CLAUDE.local.md is Claude Code's STANDARD local-override file; anyone may keep
@@ -86,9 +86,9 @@ esac
 # gets a companion notice every session forever (state-based emission makes it permanent, not
 # one-shot). Only the binding INSIDE the file counts.
 printf '# my local notes\nuse tabs not spaces\n' > "$TMP/public/CLAUDE.local.md"
-out="$(run "$TMP/public" "$TMP/s4b" FH_MACHINE_ID=publicbox)"
+out="$(run "$TMP/public" "$TMP/s4b" FH_MACHINE_ID=publicbox)"; rc=$?
 case "$out" in
-  *companion-load*) bad "lane4b plain CLAUDE.local.md: existence alone classified the user as Mode D" "$out" ;;
+  *companion-load*) bad "lane4b plain CLAUDE.local.md: existence alone classified the user as Mode D" "rc=$rc | $out" ;;
   *) ok "lane4b plain CLAUDE.local.md: not treated as a Mode D signal" ;;
 esac
 
@@ -106,10 +106,10 @@ for binding in 'BE_DIR=/x/store' 'companion store: ~/notes' '컴패니언 스토
                'vault: ~/vaults/notes' 'gbrain ingest target: ~/gbrain' 'backend: obsidian'; do
   i=$((i+1))
   printf '# local\n%s\n' "$binding" > "$TMP/public/CLAUDE.local.md"
-  out="$(run "$TMP/public" "$TMP/s4c$i" FH_MACHINE_ID=publicbox)"
+  out="$(run "$TMP/public" "$TMP/s4c$i" FH_MACHINE_ID=publicbox)"; rc=$?
   case "$out" in
     *companion-load*) ok "lane4c.$i Mode D detected via: $binding" ;;
-    *) bad "lane4c.$i binding present but Mode D not detected: $binding" "$out" ;;
+    *) bad "lane4c.$i binding present but Mode D not detected: $binding" "rc=$rc | $out" ;;
   esac
 done
 rm -f "$TMP/public/CLAUDE.local.md"
@@ -136,24 +136,24 @@ done
 # exist and working hooks read as missing.
 mk_git_hub "$TMP/wt" yes
 git -C "$TMP/wt" worktree add -q "$TMP/wt_linked" -b lane7 2>/dev/null
-out="$(run "$TMP/wt_linked" "$TMP/s7" FH_MACHINE_ID=wtbox)"
+out="$(run "$TMP/wt_linked" "$TMP/s7" FH_MACHINE_ID=wtbox)"; rc=$?
 case "$out" in
-  *"Missing mechanical floor"*) bad "lane7 worktree: false missing-floor (hooks resolve to the main gitdir)" "$out" ;;
+  *"Missing mechanical floor"*) bad "lane7 worktree: false missing-floor (hooks resolve to the main gitdir)" "rc=$rc | $out" ;;
   *"first session for this clone"*) ok "lane7 worktree: hooks resolved correctly, node event reported" ;;
-  *) bad "lane7 worktree: silent — a stub would pass this lane" "$out" ;;
+  *) bad "lane7 worktree: silent — a stub would pass this lane" "rc=$rc | $out" ;;
 esac
 
 # LANE 8 (M3-3) — python3 unavailable: the companion verdict is UNMEASURED, never silently "fine".
 # Simulated by a PATH with no python3, for a Mode D hub (so the check is applicable).
 mk_git_hub "$TMP/nopy" yes
 mkdir -p "$TMP/emptybin" "$TMP/companion2/.git"
-out="$(PATH="$TMP/emptybin:/usr/bin:/bin" run "$TMP/nopy" "$TMP/s8" FH_MACHINE_ID=nopybox BE_DIR="$TMP/companion2")"
+out="$(PATH="$TMP/emptybin:/usr/bin:/bin" run "$TMP/nopy" "$TMP/s8" FH_MACHINE_ID=nopybox BE_DIR="$TMP/companion2")"; rc=$?
 if command -v python3 >/dev/null 2>&1 && [ -x /usr/bin/python3 ]; then
   ok "lane8 skipped: /usr/bin/python3 exists so absence cannot be simulated via PATH"
 else
   case "$out" in
     *UNMEASURED*|*unmeasured*) ok "lane8 no python3: reported UNMEASURED, not silence" ;;
-    *) bad "lane8 no python3: absence read as pass" "$out" ;;
+    *) bad "lane8 no python3: absence read as pass" "rc=$rc | $out" ;;
   esac
 fi
 
@@ -249,11 +249,11 @@ else
   fi
   git -C "$_dn" fetch -q origin >/dev/null 2>&1
   _h0="$(git -C "$_dn" rev-parse HEAD)"
-  run "$_dn" "$_ap_root/s_a" >/dev/null 2>&1
+  _out_a="$(run "$_dn" "$_ap_root/s_a" 2>&1)"; _rc_a=$?
   if [ "$(git -C "$_dn" rev-parse HEAD)" != "$_h0" ]; then
     ok "lane10-a APPLY: consented + on default branch → fast-forwarded"
   else
-    bad "lane10-a APPLY: consented + on default branch did NOT fast-forward (feature inert — every refuse lane below is then vacuous)" "$_h0"
+    bad "lane10-a APPLY: consented + on default branch did NOT fast-forward (feature inert — every refuse lane below is then vacuous)" "before=$_h0 rc=$_rc_a out=$_out_a"
   fi
 
   # b — the envelope. Never applies off the default branch, and NEVER switches branches.
@@ -267,13 +267,13 @@ else
   # version of this lane asserted only those two and stayed green against a defeated envelope —
   # decorative. The tip that must not move is the CURRENT branch's own.
   _f0="$(git -C "$_dn" rev-parse feat-x)"
-  run "$_dn" "$_ap_root/s_b" >/dev/null 2>&1
+  _out_b="$(run "$_dn" "$_ap_root/s_b" 2>&1)"; _rc_b=$?
   if [ "$(git -C "$_dn" rev-parse "$_DEF")" = "$_m0" ] \
      && [ "$(git -C "$_dn" rev-parse feat-x)" = "$_f0" ] \
      && [ "$(git -C "$_dn" branch --show-current)" = "feat-x" ]; then
     ok "lane10-b ENVELOPE: off default branch → no apply on EITHER branch, no switch"
   else
-    bad "lane10-b ENVELOPE: a branch tip moved off the default branch — the shared-checkout hazard" "main=$_m0->$(git -C "$_dn" rev-parse "$_DEF") feat-x=$_f0->$(git -C "$_dn" rev-parse feat-x) branch=$(git -C "$_dn" branch --show-current)"
+    bad "lane10-b ENVELOPE: a branch tip moved off the default branch — the shared-checkout hazard" "main=$_m0->$(git -C "$_dn" rev-parse "$_DEF") feat-x=$_f0->$(git -C "$_dn" rev-parse feat-x) branch=$(git -C "$_dn" branch --show-current) rc=$_rc_b out=$_out_b"
   fi
   git -C "$_dn" switch -q "$_DEF" >/dev/null 2>&1
 
@@ -285,29 +285,29 @@ p=sys.argv[1]; s=open(p,encoding='utf-8').read()
 open(p,'w',encoding='utf-8').write(re.sub(r'\nstanding_consent:\n(?:  .*\n|    .*\n)*', '\n', s, count=1))
 PYX
   _h1="$(git -C "$_dn" rev-parse HEAD)"
-  run "$_dn" "$_ap_root/s_c" >/dev/null 2>&1
+  _out_c="$(run "$_dn" "$_ap_root/s_c" 2>&1)"; _rc_c=$?
   [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h1" ] \
     && ok "lane10-c NO-GRANT: absent standing_consent → no apply" \
-    || bad "lane10-c NO-GRANT: applied without a grant" "$_h1"
+    || bad "lane10-c NO-GRANT: applied without a grant" "before=$_h1 rc=$_rc_c out=$_out_c"
 
   # d — expired lease. A lease nobody enforces is not a lease.
   cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
   sed -i.bak2 's/expires: [0-9-]*/expires: 2020-01-01/' "$_dn/tracks/_meta/user_adaptation_profile.md"
   _h2="$(git -C "$_dn" rev-parse HEAD)"
-  run "$_dn" "$_ap_root/s_d" >/dev/null 2>&1
+  _out_d="$(run "$_dn" "$_ap_root/s_d" 2>&1)"; _rc_d=$?
   [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h2" ] \
     && ok "lane10-d EXPIRED: past-dated lease → no apply" \
-    || bad "lane10-d EXPIRED: applied under an expired lease" "$_h2"
+    || bad "lane10-d EXPIRED: applied under an expired lease" "before=$_h2 rc=$_rc_d out=$_out_d"
   cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
 
   # e — divergence. --ff-only must refuse rather than absorb, and local work must survive.
   (cd "$_dn" && echo local-only > mine.txt && git add -A && git commit -qm diverge) >/dev/null 2>&1
   _h3="$(git -C "$_dn" rev-parse HEAD)"
-  run "$_dn" "$_ap_root/s_e" >/dev/null 2>&1
+  _out_e="$(run "$_dn" "$_ap_root/s_e" 2>&1)"; _rc_e=$?
   if [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h3" ] && [ -f "$_dn/mine.txt" ]; then
     ok "lane10-e DIVERGED: ff refused, local commit survives"
   else
-    bad "lane10-e DIVERGED: local history was moved or lost" "$_h3 -> $(git -C "$_dn" rev-parse HEAD)"
+    bad "lane10-e DIVERGED: local history was moved or lost" "$_h3 -> $(git -C "$_dn" rev-parse HEAD) rc=$_rc_e out=$_out_e"
   fi
 
   # f — WRONG CLASS. The refusal that the other three arms structurally cannot produce.
@@ -367,7 +367,7 @@ PYX
   if [ "$_h5" = "$(git -C "$_dn" rev-parse "origin/$_DEF")" ]; then
     bad "lane10-f VACUOUS: clone is not behind origin, so 'no apply' proves nothing" "$_h5"
   fi
-  run "$_dn" "$_ap_root/s_f" >/dev/null 2>&1
+  _out_f="$(run "$_dn" "$_ap_root/s_f" 2>&1)"; _rc_f=$?
   _filewide=0
   bash "$FH_REPO/scripts/consent_registry_check.sh" \
        "$_dn/tracks/_meta/consent_classes.yaml" \
@@ -375,9 +375,9 @@ PYX
   if [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h5" ] && [ "$_filewide" = "0" ]; then
     ok "lane10-f WRONG-CLASS: another class granted, this one only in prose → no apply (file-wide check still 0)"
   elif [ "$_filewide" != "0" ]; then
-    bad "lane10-f VACUOUS: the fixture broke the file-wide verdict (rc=$_filewide), so it re-tests lane10-c's axis, not the class join" "rebuild the fixture so the bare check returns 0"
+    bad "lane10-f VACUOUS: the fixture broke the file-wide verdict (rc=$_filewide), so it re-tests lane10-c's axis, not the class join" "rebuild the fixture so the bare check returns 0 | run_rc=$_rc_f run_out=$_out_f"
   else
-    bad "lane10-f WRONG-CLASS: applied on a class that was never granted" "$_h5 -> $(git -C "$_dn" rev-parse HEAD)"
+    bad "lane10-f WRONG-CLASS: applied on a class that was never granted" "$_h5 -> $(git -C "$_dn" rev-parse HEAD) run_rc=$_rc_f run_out=$_out_f"
   fi
   cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
 
@@ -387,10 +387,10 @@ PYX
   (cd "$_ap_root/up" && echo newer3 > f.txt && git commit -qam ahead3) >/dev/null 2>&1
   git -C "$_dn" fetch -q origin >/dev/null 2>&1
   _h4="$(git -C "$_dn" rev-parse HEAD)"
-  run "$_dn" "$_ap_root/s_f" >/dev/null 2>&1
+  _out_ctrl="$(run "$_dn" "$_ap_root/s_f" 2>&1)"; _rc_ctrl=$?
   [ "$(git -C "$_dn" rev-parse HEAD)" != "$_h4" ] \
     && ok "lane10-CONTROL: apply arm still fires after the refuse arms (instrument alive)" \
-    || bad "lane10-CONTROL: apply arm went inert — the refuse lanes above prove nothing" "$_h4"
+    || bad "lane10-CONTROL: apply arm went inert — the refuse lanes above prove nothing" "before=$_h4 rc=$_rc_ctrl out=$_out_ctrl"
 fi
 rm -rf "$_ap_root"
 

package/scripts/test_package_coverage_lanes.sh

@@ -36,7 +36,9 @@ trap 'rm -rf "$TMP"' EXIT
 
 pass=0; fail=0; skipped=0
 ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
-bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+# $2 (optional) = the actual stdout/stderr/rc this case caught — printed so a red lane in CI is
+# diagnosable without re-running it by hand. Truncated/flattened like the node-check lanes' bad().
+bad() { printf '  ❌ %s\n' "$1"; [ -n "${2:-}" ] && printf '     got: %s\n' "$(printf '%s' "$2" | tr '\n' '|' | cut -c1-220)"; fail=$((fail+1)); }
 # A skip is COUNTED and reported. An uncounted skip is how "could not run" becomes indistinguishable
 # from "ran and passed" in the summary line — measured on this very suite in review round 2, where a
 # broken git produced "7 passed, 0 failed" and exit 0 while the real-worktree claim went untested.
@@ -70,23 +72,30 @@ make_tree() { # make_tree <dir> <git_shape> <cover_target:yes|no> [omit_manifest
 }
 
 run_tree() { bash "$1/scripts/package_coverage_check.sh" 2>&1; }
-rc_tree()  { bash "$1/scripts/package_coverage_check.sh" >/dev/null 2>&1; echo $?; }
+# 🟥 no more rc_tree(): it used to re-run the subject a SECOND time just to get $? (`out=$(run_tree
+# ...); rc=$(rc_tree ...)` — two executions of the same script, so a nondeterministic subject could
+# report an (out, rc) pair that never co-occurred in either real run). Every call site below now
+# does `out=$(run_tree ...); rc=$?` — one execution, $? read off THAT command substitution.
 
 # Assert a POSITIVE outcome, never merely the absence of the SKIP line. Cross-family review caught
 # the first draft here: it checked only that `SKIP  package-coverage` was missing, so a checker that
 # exited 1 on every worktree — the opposite defect, equally broken — would have passed the lane that
 # exists to prove the worktree path works. "Did not say the wrong thing" is not "did the right
 # thing"; a lane phrased as a negative can only ever fail one way.
+# Both functions below stash their single execution's output/rc in _LAST_OUT/_LAST_RC (not `local`,
+# deliberately — the caller reads them straight off the one run instead of re-invoking the subject a
+# second time just to build a diagnostic string, which would be the same two-executions-for-one-
+# verdict shape the L3–L7 dual-execution fix below removes).
 ran_clean() { # ran_clean <dir> -> 0 iff the check actually ran AND reported a clean scan
-  local d="$1" o rc
-  o=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); rc=$?
-  [ "$rc" -eq 0 ] && printf '%s' "$o" | grep -q 'PASS  package-coverage' \
-    && ! printf '%s' "$o" | grep -q 'SKIP  package-coverage'
+  local d="$1"
+  _LAST_OUT=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); _LAST_RC=$?
+  [ "$_LAST_RC" -eq 0 ] && printf '%s' "$_LAST_OUT" | grep -q 'PASS  package-coverage' \
+    && ! printf '%s' "$_LAST_OUT" | grep -q 'SKIP  package-coverage'
 }
 caught_defect() { # caught_defect <dir> -> 0 iff the check FOUND the planted omission
-  local d="$1" o rc
-  o=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); rc=$?
-  [ "$rc" -eq 1 ] && printf '%s' "$o" | grep -q 'scripts/helper.sh'
+  local d="$1"
+  _LAST_OUT=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); _LAST_RC=$?
+  [ "$_LAST_RC" -eq 1 ] && printf '%s' "$_LAST_OUT" | grep -q 'scripts/helper.sh'
 }
 # A CLEAN LANE ALONE PROVES NOTHING ABOUT THE WORKTREE PATH. Cross-family review round 2 demonstrated
 # this by EXECUTION: it replaced the subject with a mutant that printed `PASS  package-coverage`
@@ -99,11 +108,11 @@ wt_pair() { # wt_pair <label> <dir> <git_shape>
   local label="$1" d="$2" shape="$3"
   make_tree "$d" "$shape" yes
   if ! ran_clean "$d"; then
-    bad "$label — clean leg: did not run to a PASS ($(run_tree "$d" | head -1))"; return
+    bad "$label — clean leg: did not run to a PASS (rc=$_LAST_RC)" "$_LAST_OUT"; return
   fi
   make_tree "$d" "$shape" no        # identical tree, files[] no longer covers the referenced path
   if ! caught_defect "$d"; then
-    bad "$label — DEFECT leg: planted omission not caught, so the clean PASS proved nothing"; return
+    bad "$label — DEFECT leg: planted omission not caught, so the clean PASS proved nothing (rc=$_LAST_RC)" "$_LAST_OUT"; return
   fi
   ok "$label"
 }
@@ -171,15 +180,20 @@ else
     esac
   }
   mkdir -p "$TMP/emptytpl"
-  if git "${GIT_ISO[@]}" -C "$TMP/realrepo" init -q --template="$TMP/emptytpl" . >/dev/null 2>&1 \
+  # The whole fixture-build chain runs as ONE group so its combined stdout+stderr lands in one
+  # variable instead of /dev/null — a failed build used to report only "could not be built", with
+  # no way to tell which of the four steps broke or why.
+  _l1b_ok=1
+  _l1b_out="$( { git "${GIT_ISO[@]}" -C "$TMP/realrepo" init -q --template="$TMP/emptytpl" . \
      && _gitdir_ok \
-     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" commit -q --allow-empty -m init >/dev/null 2>&1 \
-     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" worktree add -q --detach "$TMP/realwt" >/dev/null 2>&1 \
-     && [ -f "$TMP/realwt/.git" ]; then
+     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" commit -q --allow-empty -m init \
+     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" worktree add -q --detach "$TMP/realwt" \
+     && [ -f "$TMP/realwt/.git" ]; } 2>&1 )" || _l1b_ok=0
+  if [ "$_l1b_ok" -eq 1 ]; then
     wt_pair "L1-b real \`git worktree add\` (.git is a genuine gitdir pointer): scans for real" \
             "$TMP/realwt" none          # the REAL .git file is already in place; do not overwrite it
   else
-    bad "L1-b git IS installed but the real-worktree fixture could not be built — the claim was testable and was not tested"
+    bad "L1-b git IS installed but the real-worktree fixture could not be built — the claim was testable and was not tested" "$_l1b_out"
   fi
 fi
 
@@ -190,11 +204,11 @@ wt_pair "L2 ordinary checkout (.git is a DIR): scans for real — both legs" "$T
 # The widening from -d to -e must not cost the legitimate skip. An installed npm package has no
 # .git of either kind; making it fail there would fire on every consumer running `npm test`.
 make_tree "$TMP/l3" none yes
-out=$(run_tree "$TMP/l3"); rc=$(rc_tree "$TMP/l3")
+out=$(run_tree "$TMP/l3"); rc=$?
 if printf '%s' "$out" | grep -q 'SKIP  package-coverage' && [ "$rc" -eq 0 ]; then
   ok "L3 package mode (no .git): still skips, exit 0"
 else
-  bad "L3 package mode (no .git): expected SKIP+0, got rc=$rc / $(printf '%s' "$out" | head -1)"
+  bad "L3 package mode (no .git): expected SKIP+0, got rc=$rc" "$out"
 fi
 
 # ── L4 · a checkout with no manifest is UNMEASURED, not clean ────────────────────────
@@ -203,48 +217,60 @@ fi
 # file list cannot be read, which is "cannot measure", not "nothing to measure". An anchor that
 # pins the wrong direction is worse than no anchor — it makes the hole look deliberate.
 make_tree "$TMP/l4" dir yes omit
-out=$(run_tree "$TMP/l4"); rc=$(rc_tree "$TMP/l4")
+out=$(run_tree "$TMP/l4"); rc=$?
 if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'UNMEASURED, not clean'; then
   ok "L4 .git present but no package.json: FAILS as unmeasured, not a clean skip"
 else
-  bad "L4 no package.json: expected exit 1 (unmeasured), got rc=$rc / $(printf '%s' "$out" | head -1)"
+  bad "L4 no package.json: expected exit 1 (unmeasured), got rc=$rc" "$out"
 fi
 
 # ── L5/L6 · KNOWN PAIR ───────────────────────────────────────────────────────────────
 # Same tree twice; the ONLY difference is whether files[] covers the referenced path.
 # L5 known-POSITIVE: referenced, exists, not shipped -> must FAIL.
 make_tree "$TMP/l5" dir no
-out=$(run_tree "$TMP/l5"); rc=$(rc_tree "$TMP/l5")
+out=$(run_tree "$TMP/l5"); rc=$?
 if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'scripts/helper.sh'; then
   ok "L5 known-positive (referenced ∧ exists ∧ ¬shipped): FAIL, names the path"
 else
-  bad "L5 known-positive: expected exit 1 naming scripts/helper.sh, got rc=$rc"
+  bad "L5 known-positive: expected exit 1 naming scripts/helper.sh, got rc=$rc" "$out"
 fi
 
 # L6 known-NEGATIVE: identical, but the path is in files[] -> must PASS.
 make_tree "$TMP/l6" dir yes
-out=$(run_tree "$TMP/l6"); rc=$(rc_tree "$TMP/l6")
+out=$(run_tree "$TMP/l6"); rc=$?
 if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -q 'PASS  package-coverage'; then
   ok "L6 known-negative (same tree, path shipped): PASS"
 else
-  bad "L6 known-negative: expected exit 0 PASS, got rc=$rc"
+  bad "L6 known-negative: expected exit 0 PASS, got rc=$rc" "$out"
 fi
 
 # ── L7 · the impossible-zero guard is not reachable by an empty files[] ──────────────
 # A manifest with no shipped docs must report the extractor as broken, not print a pass.
 mkdir -p "$TMP/l7/scripts"; cp "$SUBJECT" "$TMP/l7/scripts/"; mkdir -p "$TMP/l7/.git"
 printf '{"files":[]}\n' > "$TMP/l7/package.json"
-out=$(run_tree "$TMP/l7"); rc=$(rc_tree "$TMP/l7")
+out=$(run_tree "$TMP/l7"); rc=$?
 if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'the check broke, it did not pass'; then
   ok "L7 zero shipped docs: reported as broken extractor, not as a pass"
 else
-  bad "L7 zero shipped docs: expected exit 1 'check broke', got rc=$rc"
+  bad "L7 zero shipped docs: expected exit 1 'check broke', got rc=$rc" "$out"
 fi
 
 echo
 if [ "$skipped" -gt 0 ]; then
   echo "package-coverage lanes: ${pass} passed, ${fail} failed, ${skipped} UNCALIBRATED (not verified here)"
 else
-  echo "package-coverage lanes: ${pass} passed, ${fail} failed"
+  
+# ── lane 7: tarball oracle JSON without files[] → text-listing fallback (CI 2026-09-04, v3.0.0) ──
+# Known-pair: stub npm returns JSON lacking files[] but delegates the text `pack --dry-run` to the
+# real npm → PASS (7a). Stub returns the same JSON and an EMPTY text listing → ORACLE_UNAVAILABLE rc=2 (7b).
+cd "$REPO_ROOT" || exit 10; _REAL_NPM=$(command -v npm); _ST=$(mktemp -d)   # earlier lanes cd into fixtures — the subject reads .git/package.json from cwd
+printf '#!/bin/bash\nif [ "$*" = "pack --dry-run --json" ]; then echo "[{\\"id\\":\\"x\\"}]"; else exec %s "$@"; fi\n' "$_REAL_NPM" > "$_ST/npm"; chmod +x "$_ST/npm"
+o=$(PATH="$_ST:$PATH" bash "$SUBJECT" --vs-tarball 2>&1); rc=$?
+if [ "$rc" = 0 ] && printf '%s' "$o" | grep -q "^PASS  package-coverage"; then echo "  ✅ lane 7a: JSON without files[] → text listing fallback PASSes"; pass=$((pass+1)); else echo "  ❌ lane 7a: fallback did not PASS (rc=$rc)"; printf "%s\n" "$o" | grep -E "UNAVAILABLE|head:" | cut -c1-220; fail=$((fail+1)); fi
+printf '#!/bin/bash\nif [ "$*" = "pack --dry-run --json" ]; then echo "[{\\"id\\":\\"x\\"}]"; elif [ "$*" = "pack --dry-run" ]; then exit 0; else exec %s "$@"; fi\n' "$_REAL_NPM" > "$_ST/npm"
+o=$(PATH="$_ST:$PATH" bash "$SUBJECT" --vs-tarball 2>&1); rc=$?
+if [ "$rc" = 2 ] && printf '%s' "$o" | grep -q "UNAVAILABLE"; then echo "  ✅ lane 7b: JSON without files[] AND empty text listing → UNAVAILABLE rc=2 (fail-closed)"; pass=$((pass+1)); else echo "  ❌ lane 7b: expected rc=2 UNAVAILABLE, got rc=$rc"; fail=$((fail+1)); fi
+rm -rf "$_ST"
+echo "package-coverage lanes: ${pass} passed, ${fail} failed"
 fi
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_pipe_verdict_guard_lanes.sh

@@ -45,9 +45,9 @@ expect() {
 echo "[pipe-verdict-guard] known pairs"
 echo "-- R1: PIPESTATUS under zsh (deterministic) --"
 # The exact shape emitted 6× in this project, including twice on 2026-07-31.
-expect "R1 the measured shape"            HIT   'bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'
-expect "R1 any index"                     HIT   'a | b; rc=${PIPESTATUS[1]}'
-expect "R1 inside a larger command"       HIT   'cd /r && npm t | tail; E=${PIPESTATUS[0]}; echo $E'
+expect "R1 the measured shape"            HIT   'bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'  # portability-noqa: fixture string fed to pipe_verdict_guard.sh for static analysis, never executed by this shell
+expect "R1 any index"                     HIT   'a | b; rc=${PIPESTATUS[1]}'  # portability-noqa: same as above
+expect "R1 inside a larger command"       HIT   'cd /r && npm t | tail; E=${PIPESTATUS[0]}; echo $E'  # portability-noqa: same as above
 # zsh's own spelling is correct here and must never be flagged.
 expect "R1 zsh spelling is CLEAN"         CLEAN 'a | b; rc=$pipestatus[1]'
 
@@ -83,7 +83,7 @@ echo x | grep -q y
 rc=$?'
 # B: zsh accepts `$PIPESTATUS[0]` without braces; the brace-anchored regex missed it.
 expect "B PIPESTATUS without braces"      HIT   'a | b; rc=$PIPESTATUS[0]'
-expect "B braced form still caught"       HIT   'a | b; rc=${PIPESTATUS[0]}'
+expect "B braced form still caught"       HIT   'a | b; rc=${PIPESTATUS[0]}'  # portability-noqa: fixture string fed to pipe_verdict_guard.sh for static analysis, never executed by this shell
 
 echo "-- D: statement-continuation flatten + wrapped filter (leg-C MED round, 2026-08-01) --"
 # The blanket newline→`;` rewrite broke the CONTINUATION shapes: a newline after `|`/`&&` or a
@@ -167,7 +167,7 @@ echo "-- C: delivery channel (closes N=8 — detection without delivery is decor
 # NAMED RESIDUAL (cross-family LOW, accepted): $(…) capture strips NUL bytes, so a mutant emitting
 # NUL+JSON would pass C1. The producer's hits text is static ASCII+⚠️ with no NUL source, so the
 # lane does not pay for a byte-exact harness; revisit only if the producer ever emits dynamic bytes.
-HIT_CMD='bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'
+HIT_CMD='bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'  # portability-noqa: fixture string fed to the guard for static analysis, never executed by this shell
 payload() { python3 -c 'import json,sys; print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]}}))' "$1"; }
 
 # All C lanes measure ONE invocation: stdout, stderr, and exit code from the same run (a pair of

package/scripts/test_precommit_pointer_index_lanes.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# test_precommit_pointer_index_lanes.sh — known pair for templates/.git-hooks/pre-commit [Pointers]:
+# the Detail-pointer gate must read the STAGED blob, not the working tree. Found 2026-09-03 (arm C
+# wt2, A3 triage): `[ -f "$REPO_ROOT/$f" ] || continue` let a staged .md with a broken
+# `**Detail**: See §X` pointer land silently when the file was rm'd from disk after staging
+# (git commits the INDEX). Runs in a disposable shallow clone — never touches this checkout.
+#   P1 staged broken pointer, file rm'd from disk       → commit BLOCKED (❌ pointer line printed)
+#   N1 staged VALID pointer, file rm'd from disk        → [Pointers] block runs with no ❌ (control: index read works)
+#   N2 staged broken pointer, file still on disk        → BLOCKED (the pre-fix path also caught this — control)
+# Usage: bash scripts/test_precommit_pointer_index_lanes.sh [--hook <path>]   (default = templates/.git-hooks/pre-commit)
+set -u; ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"; HOOK="$ROOT/templates/.git-hooks/pre-commit"
+[ "${1:-}" = "--hook" ] && HOOK="$2"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT; pass=0; fail=0
+git clone -q --depth 1 "file://$ROOT" "$T/r" 2>/dev/null || { echo "❌ clone failed"; exit 10; }
+cd "$T/r" && git config user.email t@t && git config user.name t && mkdir -p .git/hooks && cp "$HOOK" .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
+mkdir -p docs/lanefix; printf '## §Alive\ntext\n' > docs/lanefix/target.md; git add docs/lanefix/target.md; git -c core.hooksPath=/dev/null commit -qm base 2>/dev/null
+run_case(){ local label="$1" want="$2" ptr="$3" rm_after="$4"
+  printf '# probe\n\n> **Detail**: See `docs/lanefix/target.md §%s`\n' "$ptr" > docs/lanefix/probe.md
+  git add docs/lanefix/probe.md; [ "$rm_after" = 1 ] && rm -f docs/lanefix/probe.md
+  out=$(FH_SKIP_GATE_AXES=1 git commit -qm probe 2>&1); rc=$?
+  # Discriminate on the [Pointers] block itself, not on commit rc: the fixture clone carries no
+  # marker/manifest, so OTHER axes block every commit here — rc is not this lane's signal.
+  if printf '%s' "$out" | grep -q "Detail pointer §"; then got=BLOCK_PTR
+  elif printf '%s' "$out" | grep -q "unreadable from the index"; then got=BLOCK_INDEX
+  elif printf '%s' "$out" | grep -q "\[Pointers\]"; then got=PTR_OK
+  else got=PTR_NOT_RUN; fi
+  git reset -q --hard HEAD 2>/dev/null;  # noqa: destructive-op — disposable clone under mktemp git rm -q --cached docs/lanefix/probe.md 2>/dev/null; rm -f docs/lanefix/probe.md
+  if [ "$got" = "$want" ]; then printf '  ✅ %-48s %s\n' "$label" "$got"; pass=$((pass+1)); else printf '  ❌ %-48s %s (expected %s)\n' "$label" "$got" "$want"; fail=$((fail+1)); printf '%s\n' "$out" | grep -E "Pointers|❌" | head -4 | sed 's/^/       /'; fi; }
+echo "[precommit-pointer-index] hook=$HOOK"
+run_case "P1 broken pointer, staged then rm'd from disk"  BLOCK_PTR Ghost 1
+run_case "N1 valid pointer, staged then rm'd (index read)" PTR_OK    Alive 1
+run_case "N2 broken pointer, still on disk (old path too)" BLOCK_PTR Ghost 0
+echo "[precommit-pointer-index] $pass passed, $fail failed"; [ "$fail" -eq 0 ]

package/scripts/test_preprep_drift_anchor.sh

@@ -16,7 +16,16 @@ set -uo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 SRC="$HERE/plugins/fh-commons/skills/preprep"
 # standalone 배포 위치는 환경변수로 받는다. 기본값을 박으면 다른 머신에서 거짓 SKIP 이 된다.
-DIST="${PREPREP_STANDALONE_DIR:-}"
+# 🟥 2026-09-03 — 그런데 «아무도 그 변수를 안 걸어서» D2 가 여태 SKIP 이었고, 그 사이 컴패니언
+#    저장소의 fork(724줄)가 정본(789줄)과 갈라져 L9~L11 을 안 부르고 있었다 — 정본 주석이 이미
+#    한 번 적어 둔 사고의 2회째(fh_signal_2026-09-03_preprep-standalone-anchor-skip.md). 슬롯은
+#    있고 소비처가 0 인 형태. 처방: 명시 변수가 없으면 운영자 로컬 바인딩이 이미 export 하는
+#    FH_COMPANION_STORE 아래 preprep/ 을 «자동 후보»로 쓴다 — 기본값을 박는 게 아니라 이미
+#    선언된 경로를 읽는 것이라 다른 머신에서 거짓 SKIP 을 만들지 않는다(없으면 여전히 SKIP).
+DIST="${PREPREP_STANDALONE_DIR:-}"; DIST_SRC="PREPREP_STANDALONE_DIR"
+if [ -z "$DIST" ] && [ -n "${FH_COMPANION_STORE:-}" ] && [ -d "${FH_COMPANION_STORE}/preprep" ]; then
+  DIST="${FH_COMPANION_STORE}/preprep"; DIST_SRC="FH_COMPANION_STORE/preprep (자동 후보)"
+fi
 PASS=0; FAIL=0; SKIP=0
 ok(){ echo "  ✅ $1"; PASS=$((PASS+1)); }
 ng(){ echo "  ❌ $1"; FAIL=$((FAIL+1)); }
@@ -41,16 +50,16 @@ fi
 
 # D2 — standalone 대조
 if [ -z "$DIST" ]; then
-  sk "D2 standalone 대조 — PREPREP_STANDALONE_DIR 미설정이라 배포본을 못 찾았다"
+  sk "D2 standalone 대조 — PREPREP_STANDALONE_DIR 미설정이고 FH_COMPANION_STORE/preprep 도 없어 배포본을 못 찾았다. UNCHECKED — 배포본이 있는 머신이면 둘 중 하나를 export 해라"
 elif [ ! -d "$DIST" ]; then
-  ng "D2 PREPREP_STANDALONE_DIR 이 가리키는 곳이 없다: $DIST (설정됐는데 부재 = 드리프트 아니라 배선 결함)"
+  ng "D2 $DIST_SRC 이 가리키는 곳이 없다: $DIST (설정됐는데 부재 = 드리프트 아니라 배선 결함)"
 else
   drift=""
   for f in preprep.py interslide_deps.py lane_progression.py lane_adjacent_dup.py; do
     if [ ! -f "$DIST/$f" ]; then drift="$drift $f(부재)"
     elif ! cmp -s "$SRC/$f" "$DIST/$f"; then drift="$drift $f(갈림)"; fi
   done
-  [ -z "$drift" ] && ok "D2 standalone 코드 5파일이 단일 소스와 바이트 동일" \
+  [ -z "$drift" ] && ok "D2 standalone 코드 5파일이 단일 소스와 바이트 동일 ($DIST_SRC)" \
                   || ng "D2 드리프트:$drift ⇒ 사본이 둘이 됐다. 단일 소스에서 다시 뽑아라"
 fi
 

package/scripts/test_preprep_drift_anchor_lanes.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# test_preprep_drift_anchor_lanes.sh — known pairs for the D2 leg of scripts/test_preprep_drift_anchor.sh
+# WHY (2026-09-03): D2 compared the standalone copy only when PREPREP_STANDALONE_DIR was set. Nobody
+# set it, so the leg SKIPPED for weeks while the companion-store fork drifted (724 vs 789 lines, L9-L11
+# never called) — the second occurrence of the exact accident the canon's own comment records.
+# Fix under test: with the env var unset, the anchor falls back to $FH_COMPANION_STORE/preprep when it
+# exists. These lanes pin: fallback used · fallback discriminates (identical PASS / drifted FAIL) ·
+# explicit var still wins · nothing set → SKIP (never a silent PASS).
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"; A="$HERE/scripts/test_preprep_drift_anchor.sh"
+SRC="$HERE/plugins/fh-commons/skills/preprep"; T=$(mktemp -d); pass=0; fail=0
+chk(){ if [ "$1" = 0 ]; then echo "  ✅ $2"; pass=$((pass+1)); else echo "  ❌ $2"; fail=$((fail+1)); fi; }
+mk(){ mkdir -p "$1"; for f in preprep.py interslide_deps.py lane_progression.py lane_adjacent_dup.py lane_promise.py; do cp "$SRC/$f" "$1/$f"; done; }
+echo "[preprep-drift-anchor] D2 known pairs"
+# L1 nothing set → D2 SKIP (skip != pass), rc 0 (D2 is not a FAIL)
+out=$(env -u PREPREP_STANDALONE_DIR FH_COMPANION_STORE="$T/nostore" bash "$A" 2>&1); printf '%s' "$out" | grep -q "D2 .*SKIPPED"; chk $? "L1 var unset + no companion preprep → D2 SKIPPED (not PASS)"
+# L2 companion copy identical → fallback used, D2 PASS
+mk "$T/be/preprep"; out=$(env -u PREPREP_STANDALONE_DIR FH_COMPANION_STORE="$T/be" bash "$A" 2>&1); printf '%s' "$out" | grep -q "✅ D2 .*자동 후보"; chk $? "L2 fallback FH_COMPANION_STORE/preprep identical → D2 PASS via 자동 후보"
+# L3 companion copy drifted → D2 FAIL, rc 1 (the accident class)
+printf '\n# drift\n' >> "$T/be/preprep/preprep.py"; env -u PREPREP_STANDALONE_DIR FH_COMPANION_STORE="$T/be" bash "$A" >"$T/l3.out" 2>&1; rc=$?; [ "$rc" -ne 0 ] && grep -q "D2 드리프트.*preprep.py(갈림)" "$T/l3.out"; chk $? "L3 fallback copy drifted → D2 FAIL rc=$rc (known-positive)"
+# L4 explicit var wins over companion
+mk "$T/explicit"; out=$(PREPREP_STANDALONE_DIR="$T/explicit" FH_COMPANION_STORE="$T/be" bash "$A" 2>&1); printf '%s' "$out" | grep -q "✅ D2 .*(PREPREP_STANDALONE_DIR)"; chk $? "L4 explicit PREPREP_STANDALONE_DIR wins over drifted companion copy"
+rm -rf "$T"; echo "[preprep-drift-anchor] $pass passed, $fail failed"; [ "$fail" -eq 0 ]

package/scripts/test_proposal_hook_lanes.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# test_proposal_hook_lanes.sh — known pairs for scripts/proposal_hook.sh (written before shipping; r4 KP + Bash path)
+set -u; HDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; T=$(mktemp -d); pass=0; fail=0
+export CLAUDE_PROJECT_DIR="$T"
+exp(){ local label="$1" want="$2" payload="$3" got; got=$(printf '%s' "$payload" | bash "$HDIR/proposal_hook.sh" 2>/dev/null | wc -c | tr -d ' '); [ "$got" -gt 0 ] && got=HIT || got=CLEAN
+  if [ "$got" = "$want" ]; then printf '  ✅ %-52s %s\n' "$label" "$got"; pass=$((pass+1)); else printf '  ❌ %-52s %s (expected %s)\n' "$label" "$got" "$want"; fail=$((fail+1)); fi; }
+echo "[proposal-hook] known pairs"
+exp "T1 Edit comm+LC_ALL (verdict compare)"   HIT   '{"tool_name":"Edit","tool_input":{"file_path":"/x/scripts/sim_isolated_run.sh","old_string":"  comm -13 <(sort a) <(sort b) \\","new_string":"  comm -13 <(LC_ALL=C sort a) <(LC_ALL=C sort b) \\"}}'
+exp "T2 Edit adds fail-open guard"            HIT   '{"tool_name":"Edit","tool_input":{"file_path":"/x/scripts/capability_effect_probe.sh","old_string":"  h=$(ls -A \"$HOME\" | shasum)","new_string":"  h=$(ls -A \"$HOME\" | shasum) || { echo LS_FAILED; exit 10; }"}}'
+exp "T3 Edit continue guard"                  HIT   '{"tool_name":"Edit","tool_input":{"file_path":"/x/templates/regression_guard.sh","old_string":"      [ -e \"$blk\" ] && [ -s \"$blk\" ] || continue","new_string":"      [ -e \"$blk\" ] || { echo missing >&2; continue; }"}}'
+exp "HARD Edit usage string only (r4 0/5)"    CLEAN '{"tool_name":"Edit","tool_input":{"file_path":"/x/scripts/daily_report.sh","old_string":"  *) echo \"usage: d.sh [run]\" >&2; exit 2 ;;","new_string":"  *) echo \"usage: d.sh [run|--self-test] (DR_DATE)\" >&2; exit 2 ;;"}}'
+exp "docs file with tokens"                   CLEAN '{"tool_name":"Edit","tool_input":{"file_path":"/x/docs/a.md","old_string":"a","new_string":"exit 1 || continue"}}'
+exp "Write new scripts/*.sh with verdict"     HIT   '{"tool_name":"Write","tool_input":{"file_path":"/x/scripts/new_check.sh","content":"#!/bin/bash\n[ -f x ] || exit 1"}}'
+exp "Bash sed -i on scripts/*.sh with token"  HIT   '{"tool_name":"Bash","tool_input":{"command":"sed -i \"\" \"s/comm -13/LC_ALL=C comm -13/\" scripts/sim_isolated_run.sh && [ -s out ] || exit 1"}}'
+exp "Bash sed -i token ONLY inside quotes (a1)"  HIT   '{"tool_name":"Bash","tool_input":{"command":"sed -i \"\" \"s/exit 1/exit 2/\" scripts/target.sh"}}'
+exp "Bash sed -i single-quoted token (a1b)"      HIT   '{"tool_name":"Bash","tool_input":{"command":"sed -i '"'"''"'"' '"'"'s/|| continue/|| { echo x; continue; }/'"'"' scripts/target.sh"}}'
+exp "Bash sed -i no token anywhere (a3)"         CLEAN '{"tool_name":"Bash","tool_input":{"command":"sed -i \"\" s/foo/bar/ scripts/target.sh"}}'
+exp "Bash redirect into scripts/*.sh w/ token" HIT  '{"tool_name":"Bash","tool_input":{"command":"printf \"%s\\n\" x >> scripts/x.sh; grep -q y scripts/x.sh || exit 3"}}'
+exp "Bash redirect into docs (no)"            CLEAN '{"tool_name":"Bash","tool_input":{"command":"echo \"exit 1\" >> docs/a.md || exit 1"}}'
+exp "Bash ls only (no target)"                CLEAN '{"tool_name":"Bash","tool_input":{"command":"ls scripts/ && [ -d scripts ] || exit 1"}}'
+exp "G1 Edit templates/.git-hooks/pre-commit (no .sh)" HIT '{"tool_name":"Edit","tool_input":{"file_path":"/x/templates/.git-hooks/pre-commit","old_string":"  [ -f x ] || continue","new_string":"  [ -f x ] || { echo missing; PTR_FAIL=1; continue; }"}}'
+exp "G1-ctrl Edit .git-hooks docs-ish no token"        CLEAN '{"tool_name":"Edit","tool_input":{"file_path":"/x/templates/.git-hooks/pre-commit","old_string":"# note a","new_string":"# note b"}}'
+exp "noqa exempts"                            CLEAN '{"tool_name":"Edit","tool_input":{"file_path":"/x/scripts/a.sh","old_string":"a","new_string":"exit 1  # noqa: proposal-hook"}}'
+exp "unparseable payload silent"              CLEAN 'not json'
+msg(){ printf '%s' "$2" | bash "$HDIR/proposal_hook.sh" 2>/dev/null; }
+fact(){ local label="$1" want="$2" payload="$3" got; got=$(msg x "$payload"); if printf '%s' "$got" | grep -q -- "$want"; then printf '  ✅ %-52s carries «%s»\n' "$label" "$want"; pass=$((pass+1)); else printf '  ❌ %-52s missing «%s»\n' "$label" "$want"; fail=$((fail+1)); fi; }
+mkdir -p "$T/scripts"; : > "$T/scripts/test_has_lane_lanes.sh"; printf 'scan of scripts/covered.sh\nfindings: 0\n' > "$T/scripts/.degrade_scan_last_2026-09-03.txt"
+E='{"tool_name":"Edit","tool_input":{"file_path":"/x/scripts/%s","old_string":"a","new_string":"[ -f x ] || exit 1"}}'
+fact "F1 lane exists → fact line, no known-pair item" "이미 있다" "$(printf "$E" has_lane.sh)"
+fact "F1b lane exists → scan item still proposed"     "degrade_direction_scan.sh 로" "$(printf "$E" has_lane.sh)"
+fact "F2 self-lane (test_*_lanes.sh) → fact line"     "이 파일 자체가 레인" "$(printf "$E" test_has_lane_lanes.sh)"
+fact "F3 scan covers file → fact line w/ findings"    "findings: 0" "$(printf "$E" covered.sh)"
+fact "F4 neither → both items proposed"               "known-pair(고친 케이스 + 반대 케이스) 컨트롤 degrade_direction_scan.sh" "$(printf "$E" bare.sh)"
+got=$(msg x "$(printf "$E" bare.sh)"); if printf '%s' "$got" | grep -q "사실:"; then echo "  ❌ F4-ctrl bare file must carry NO fact line"; fail=$((fail+1)); else echo "  ✅ F4-ctrl bare file carries no fact line (known-negative)"; pass=$((pass+1)); fi
+[ -f "$T/.claude/.proposal_hook_events.tsv" ] && [ "$(grep -c FIRE "$T/.claude/.proposal_hook_events.tsv")" -ge 5 ]; r=$?; [ $r = 0 ] && { echo "  ✅ evidence file carries a FIRE row per hit"; pass=$((pass+1)); } || { echo "  ❌ evidence file missing/short"; fail=$((fail+1)); }
+rm -rf "$T"; echo "[proposal-hook] $pass passed, $fail failed"; [ "$fail" -eq 0 ]