@chrono-meta/fh-gate 2.15.1 → 3.0.0

package/scripts/test_degrade_scan_shell_probes.sh

@@ -81,7 +81,7 @@ EOF
 cat > "$TMP/non_detections.sh" <<'EOF'
 #!/usr/bin/env bash
 # (a) integer sanitization — the PRESCRIBED remedy for the pipefail-fallback class, not the defect.
-count=$(grep -c pattern file)
+count=$(grep -c pattern file)  # portability-noqa: fixture text written by a quoted heredoc, never executed — statically grepped by degrade_direction_scan.sh only
 if [ "${count:-0}" -gt 0 ]; then echo "found"; fi
 # (b) SCOPE guards — "this run does not apply here" is not a claim that a check passed.
 [ -d "$HOME/projects" ] || exit 0
@@ -165,11 +165,11 @@ N=$(find /nope . -maxdepth 1 2>/dev/null | grep -c . || echo 0)
 M=$(git log --oneline 2>/dev/null | wc -l || echo 0)
 # WIDENED 2026-08-04. Every line below was INVISIBLE to the narrowed rule, and each was verified to
 # actually produce "0\n0" before being pinned here (line count measured, not assumed):
-P=$(cat /etc/hosts | grep -c . | tr -d ' ' || echo 0)   # transparent filter after the counter
-Q=$(grep -c "^nosuchline$" /etc/hosts 2>/dev/null | tr -d ' ' || echo 0)  # the PR #251 shape
-R=$(grep -Ec "^nosuchline$" /etc/hosts || echo 0)       # combined flag cluster -Ec
-S=$(grep --count "^nosuchline$" /etc/hosts || echo 0)   # long option
-T=$(grep -Fcx "nosuchline" /etc/hosts || echo 0)        # -Fcx
+P=$(cat /etc/hosts | grep -c . | tr -d ' ' || echo 0)   # transparent filter after the counter  # portability-noqa: fixture text, never executed
+Q=$(grep -c "^nosuchline$" /etc/hosts 2>/dev/null | tr -d ' ' || echo 0)  # the PR #251 shape  # portability-noqa: fixture text, never executed
+R=$(grep -Ec "^nosuchline$" /etc/hosts || echo 0)       # combined flag cluster -Ec  # portability-noqa: fixture text, never executed
+S=$(grep --count "^nosuchline$" /etc/hosts || echo 0)   # long option  # portability-noqa: fixture text, never executed
+T=$(grep -Fcx "nosuchline" /etc/hosts || echo 0)        # -Fcx  # portability-noqa: fixture text, never executed
 U=$(false | grep -c . | cat || echo 0)                  # trailing stage that always emits
 V=$(false | grep -c . | grep -v nosuch || echo 0)       # trailing grep whose pattern misses the "0"
 EOF
@@ -688,7 +688,7 @@ fi
 # flips to a hit — proves the exclusion is load-bearing for this specific fixture, not just
 # present somewhere in the file.
 _scan_reverted="$TMP/scan_reverted.sh"
-_excl_line=$(grep -n "grep -vE 'in \[A-Z_\]" "$SCAN" | head -1 | cut -d: -f1)
+_excl_line=$(grep -n "grep -vE 'in \[A-Z_\]" "$SCAN" | head -1 | cut -d: -f1)  # portability-noqa: this file has no `set -e` (top line 22 is `set -uo pipefail` only) and the next line already guards empty via -z
 if [ -z "$_excl_line" ]; then
   bad "C2-REVERT could not locate the exclusion line by its known text — fixture cannot run"
 else

package/scripts/test_files_manifest_shipping_lanes.sh

@@ -46,9 +46,9 @@ trap 'rm -rf "$LANE2_DIR"' EXIT
 cp package.json "$LANE2_DIR/package.json.orig"
 node -e '
   const fs = require("fs");
-  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));  // # portability-noqa: cwd is REPO_ROOT (line 18) -- this is the subject under tests own manifest, not a foreign fixture
   pkg.files.push("scripts/__test_fixture_does_not_exist__.sh");
-  fs.writeFileSync("package.json", JSON.stringify(pkg, null, 2) + "\n");
+  fs.writeFileSync("package.json", JSON.stringify(pkg, null, 2) + "\n");  // # portability-noqa: same as above -- writes back to the same repo-relative manifest it read
 '
 restore_pkg() { cp "$LANE2_DIR/package.json.orig" package.json; }
 
@@ -132,7 +132,7 @@ D6="$(fixture_dir)"
 mkdir -p "$D6/.git"
 node -e '
   const fs = require("fs");
-  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));  // # portability-noqa: cwd is REPO_ROOT -- seeds the fixture from the subject own real manifest, then mutates a copy
   pkg.files = ".";
   fs.writeFileSync(process.argv[1], JSON.stringify(pkg, null, 2) + "\n");
 ' "$D6/package.json"
@@ -152,7 +152,7 @@ D7="$(fixture_dir)"
 mkdir -p "$D7/.git"
 node -e '
   const fs = require("fs");
-  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));  // # portability-noqa: cwd is REPO_ROOT -- seeds the fixture from the subject own real manifest, then mutates a copy
   pkg.files.push("missing\nPASS\\t999 entries checked, 0 phantom, 0 unpacked");
   fs.writeFileSync(process.argv[1], JSON.stringify(pkg, null, 2) + "\n");
 ' "$D7/package.json"
@@ -175,7 +175,7 @@ mkdir -p "$D8/.git" "$D8/scripts_dummy"
 echo x > "$D8/scripts_dummy/foo.sh"
 node -e '
   const fs = require("fs");
-  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));
+  const pkg = JSON.parse(fs.readFileSync("package.json", "utf8"));  // # portability-noqa: cwd is REPO_ROOT -- seeds the fixture from the subject own real manifest, then mutates a copy
   pkg.files = ["scripts_dummy"];
   delete pkg.scripts.prepare;
   delete pkg.scripts.prepublishOnly;

package/scripts/test_heavy_classifier_lanes.sh

@@ -103,7 +103,7 @@ check carveout  "README.md"                  "npm-shipped surface — first-scre
 check carveout  "README.ko.md"               "language variants route the same way"
 check carveout  "README.zh-CN.md"            "🟥 5-char locale forms too — cross-family caught [a-z]{2} missing these"
 check uncovered ".claude/registry/README.md" "🟥 STILL UNCOVERED — in files[] but not root; named, not closed"
-check uncovered "package.json"               "files[] / version changes are unclassified"
+check uncovered "package.json"               "files[] / version changes are unclassified"  # portability-noqa: "package.json" is a string literal fed to classify()'s regex test, never opened from disk — a ported repo without this exact file still exercises the same classifier logic
 check uncovered ".github/workflows/validate.yml" "🟥 CI definition — changing what CI runs is unclassified"
 check uncovered "scripts/memory_link_check.py"   "🟥 .py is not .sh — shipped python is unclassified"
 

package/scripts/test_lane_runner_lanes.sh

@@ -30,18 +30,32 @@ mkfixture() { # $1 = dir
   printf '#!/usr/bin/env bash\nbash scripts/lane_runner_check.sh\n' > "$d/scripts/selfcheck.sh"
   printf '#!/usr/bin/env bash\n: orphan lane suite\n'  > "$d/scripts/test_orphan_lanes.sh"
 }
-run() { ( cd "$1" && bash scripts/lane_runner_check.sh 2>&1 ); }
-rcof() { ( cd "$1" && bash scripts/lane_runner_check.sh >/dev/null 2>&1; echo $? ); }
+# ONE execution per fixture, stdout AND rc from the SAME run — never two separate invocations.
+# Until 2026-09-03 this was split into run()+rcof(), each running lane_runner_check.sh on its own.
+# lane_runner_check.sh reads live filesystem/git state on every invocation (its own mktemp, a
+# `.git` up-chain walk, `git ls-files -z`, a python3 subprocess) and is not guaranteed to answer
+# identically twice in a row under CI resource pressure — so a call site combining `$(run "$D")`
+# with a SEPARATE `$(rcof "$D")` could silently pair stdout from one run with the exit code of a
+# DIFFERENT run. That produced an impossible-looking CI flake: rc=0 with the literal substring
+# "declared debt" absent from $out, even though every rc=0 exit path in lane_runner_check.sh
+# unconditionally prints that substring (traced exhaustively — see
+# tracks/_meta/armC_armC-wt2_report2_2026-09-03.md). Sets LRC_OUT/LRC_RC as globals: this file is
+# flat top-level (no `local` scoping across call sites), and bash functions cannot return two
+# values through their exit status alone.
+run_check() {   # $1 = fixture dir
+  LRC_OUT="$(cd "$1" && bash scripts/lane_runner_check.sh 2>&1)"; LRC_RC=$?
+}
 
 # ── L1 known-POSITIVE: an undeclared orphan suite must FAIL ───────────────────────────────────
 # Without this arm every lane below proves nothing: a checker that passed unconditionally would
 # satisfy all the "declaration suppresses it" lanes.
 D="$T/l1"; mkfixture "$D"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "1" ] && printf '%s' "$out" | grep -q 'test_orphan_lanes.sh'; then
   ok "L1 known-positive: undeclared orphan suite → rc=1 and it is named"
 else
   bad "L1 known-positive did not fire (rc=$rc) — every lane below is meaningless without it"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── IDX7 the FAIL path must EXECUTE the provenance note, not merely contain a call to it ──────
@@ -55,7 +69,7 @@ fi
 # It asserts the SHAPE of provenance, not the exact sentence: the fixture is a non-git dir, so the
 # honest answer there is the DISK one, and pinning the index wording would make the lane wrong.
 D="$T/idx7"; mkfixture "$D"
-out=$(run "$D")
+run_check "$D"; out="$LRC_OUT"
 if printf '%s' "$out" | grep -qE 'unbound variable|command not found|syntax error'; then
   bad "IDX7 the FAIL path errored: $(printf '%s' "$out" | grep -E 'unbound|not found|syntax' | head -1)"
 elif printf '%s' "$out" | grep -qE 'ⓘ|🟥'; then
@@ -67,41 +81,45 @@ fi
 # ── L2 NO-OP: no declaration file → behaviour is exactly the L1 behaviour ─────────────────────
 # This is the arm that protects THIS repo, which ships no company/ directory.
 D="$T/l2"; mkfixture "$D"
-out=$(run "$D")
+run_check "$D"; out="$LRC_OUT"
 if ! printf '%s' "$out" | grep -q 'lane_declarations'; then
   ok "L2 no-op: absent declaration file is silent (no mention in output)"
 else
   bad "L2 no-op: output mentions the declaration file when none exists"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L3 org EXEMPT suppresses the orphan ───────────────────────────────────────────────────────
 D="$T/l3"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'exempt:\n  - test_orphan_lanes.sh   # org-owned, runs in the org CI only\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q '1 exempt'; then
   ok "L3 org exempt: declared suite no longer fails the check (rc=0, counted exempt)"
 else
-  bad "L3 org exempt did not suppress (rc=$rc) — out: $(printf '%s' "$out" | tail -1)"
+  bad "L3 org exempt did not suppress (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L4 org DEBT suppresses AND is counted as debt ─────────────────────────────────────────────
 D="$T/l4"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'debt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'declared debt'; then
   ok "L4 org debt: declared suite suppressed and reported as debt"
 else
   bad "L4 org debt did not land (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L5 VISIBILITY: an org-declared list must never look like this repo's own zero ─────────────
 D="$T/l5"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'debt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D")
+run_check "$D"; out="$LRC_OUT"
 if printf '%s' "$out" | grep -q 'org-declared'; then
   ok "L5 visibility: output names the org file and its counts"
 else
   bad "L5 visibility: org declarations are invisible in the output"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L6 FAIL-CLOSED on an unparseable file ─────────────────────────────────────────────────────
@@ -109,41 +127,46 @@ fi
 # render UNMEASURED as ZERO, and it would do so on the arm where a fork is relying on the file.
 D="$T/l6"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'exempt:\n  this line is not an entry\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "2" ] && printf '%s' "$out" | grep -q 'UNMEASURED'; then
   ok "L6 fail-closed: unparseable declaration file → rc=2 and says UNMEASURED"
 else
   bad "L6 fail-closed FAILED (rc=$rc) — a malformed file was read as 'no declarations'"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L6b control for L6: the SAME orphan tree with a WELL-FORMED file must not exit 2 ──────────
 # Without this, L6 would also pass on a checker that exits 2 for any declaration file at all.
 D="$T/l6b"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'exempt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-if [ "$(rcof "$D")" != "2" ]; then
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
+if [ "$rc" != "2" ]; then
   ok "L6b control: a well-formed file does NOT trip the fail-closed arm"
 else
   bad "L6b control: every declaration file exits 2 — L6 proved nothing"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L7 unknown section is a parse failure, not a silent skip ──────────────────────────────────
 D="$T/l7"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'allowed:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D")
-if [ "$(rcof "$D")" = "2" ] && printf '%s' "$out" | grep -q "unknown section"; then
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
+if [ "$rc" = "2" ] && printf '%s' "$out" | grep -q "unknown section"; then
   ok "L7 unknown section → rc=2 and names the section"
 else
-  bad "L7 unknown section was tolerated — a typo'd header would silently declare nothing"
+  bad "L7 unknown section was tolerated — a typo'd header would silently declare nothing (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L8 the same name in both sections is ambiguous, not last-wins ─────────────────────────────
 D="$T/l8"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'exempt:\n  - test_orphan_lanes.sh\ndebt:\n  - test_orphan_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D")
-if [ "$(rcof "$D")" = "2" ] && printf '%s' "$out" | grep -q "both exempt and debt"; then
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
+if [ "$rc" = "2" ] && printf '%s' "$out" | grep -q "both exempt and debt"; then
   ok "L8 same suite in both sections → rc=2 (ambiguous, not silently resolved)"
 else
-  bad "L8 double declaration was silently resolved"
+  bad "L8 double declaration was silently resolved (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L9 a stale entry WARNS but does not block (same voice as upstream DEBT hygiene) ───────────
@@ -151,20 +174,23 @@ fi
 # would train forks to delete the file, which costs more than a stale line.
 D="$T/l9"; mkfixture "$D"; mkdir -p "$D/company"
 printf 'exempt:\n  - test_orphan_lanes.sh\n  - test_deleted_lanes.sh\n' > "$D/company/lane_declarations.yaml"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'test_deleted_lanes.sh'; then
   ok "L9 stale entry: warns and names it, does not block (rc=0)"
 else
   bad "L9 stale entry handling wrong (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L10 comments and blank lines are not entries ──────────────────────────────────────────────
 D="$T/l10"; mkfixture "$D"; mkdir -p "$D/company"
 printf '# org lane declarations\n\nexempt:\n\n  - test_orphan_lanes.sh   # reason lives here\n' > "$D/company/lane_declarations.yaml"
-if [ "$(rcof "$D")" = "0" ]; then
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
+if [ "$rc" = "0" ]; then
   ok "L10 comments/blank lines tolerated (a file people can annotate)"
 else
-  bad "L10 a commented, spaced file failed to parse"
+  bad "L10 a commented, spaced file failed to parse (rc=$rc)"
+  printf '%s\n' "$out" | sed 's/^/       │ /'
 fi
 
 # ── L11/L12 embedded --self-test subjects (found→extend, 2026-08-14) ──────────────────────────
@@ -186,7 +212,7 @@ mkfixture_clean() { # $1 = dir
 # L11 known-POSITIVE: an unwired --self-test subject is reported, advisory (rc stays 0).
 D="$T/l11"; mkfixture_clean "$D"
 printf '#!/usr/bin/env bash\n[ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }\n' > "$D/scripts/orphan_probe.sh"
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L11 known-positive: unwired --self-test subject named, advisory (rc=0)"
 else
@@ -206,7 +232,7 @@ for _subj in orphan_probe; do
   bash "scripts/$_subj.sh" --self-test
 done
 SC
-out=$(run "$D")
+run_check "$D"; out="$LRC_OUT"
 if ! printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L12 known-negative: --self-test subject wired via _subj for-loop is not reported"
 else
@@ -228,7 +254,7 @@ bash scripts/lane_runner_check.sh
 bash scripts/test_ok_lanes.sh
 bash scripts/orphan_probe.sh --self-test >/dev/null 2>&1
 SC
-out=$(run "$D")
+run_check "$D"; out="$LRC_OUT"
 if ! printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L13 known-negative: --self-test subject wired via direct dispatch is not reported"
 else
@@ -262,7 +288,7 @@ cat > "$D/scripts/orphan_probe.sh" <<'SUBJ'
 #   bash scripts/orphan_probe.sh --self-test        # known-pair calibration
 [ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }
 SUBJ
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L14 known-positive: subject's own usage comment is not a caller — still reported unwired"
 else
@@ -280,7 +306,7 @@ bash scripts/lane_runner_check.sh
 bash scripts/test_ok_lanes.sh
 # historical note: we used to run `bash scripts/orphan_probe.sh --self-test` here, removed 2026-01-01
 SC
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L15 known-positive: a commented-out dispatch in another file is not a caller"
 else
@@ -302,7 +328,7 @@ usage() { echo "run: bash scripts/orphan_probe.sh --self-test"; }
 [ "${1:-}" = "--self-test" ] && { echo ok; exit 0; }
 usage
 SUBJ
-out=$(run "$D"); rc=$(rcof "$D")
+run_check "$D"; out="$LRC_OUT"; rc="$LRC_RC"
 if [ "$rc" = "0" ] && printf '%s' "$out" | grep -q 'orphan_probe'; then
   ok "L16 known-positive: a subject's own NON-comment self-reference is not a caller"
 else
@@ -323,36 +349,36 @@ fi
 # ([[feedback_not_found_is_not_zero_family]]).
 _ISN=$(mktemp); sed -n '/^index_source_note()/,/^}/p' "$CHECK" > "$_ISN"
 if ! grep -q 'UNMEASURED' "$_ISN"; then
-  no "IDX-harness — index_source_note did not extract from $CHECK (lanes would measure nothing)"
+  bad "IDX-harness — index_source_note did not extract from $CHECK (lanes would measure nothing)"
 else
   # shellcheck disable=SC1090
   . "$_ISN"
   o=$(index_source_note "index")
   printf '%s' "$o" | grep -q "INDEX 기준" && printf '%s' "$o" | grep -q "스테이징" \
     && ok "IDX1 index mode names the index AND the staging remedy" \
-    || no "IDX1 index mode note missing/incomplete: $o"
+    || bad "IDX1 index mode note missing/incomplete: $o"
 
   o=$(index_source_note "nongit")
   printf '%s' "$o" | grep -q "DISK" && ok "IDX2 nongit mode says DISK, not index" \
-                                    || no "IDX2 nongit: $o"
+                                    || bad "IDX2 nongit: $o"
 
   o=$(index_source_note "UNMEASURED")
   printf '%s' "$o" | grep -q "못 셌다" && ok "IDX3 UNMEASURED says «could not count», not «none»" \
-                                       || no "IDX3 UNMEASURED: $o"
+                                       || bad "IDX3 UNMEASURED: $o"
 
   # 🟥 CONTROL — an unknown/empty mode must stay SILENT. Inventing a source line for a state the
   # check does not recognise is worse than saying nothing, and without this lane the function
   # could pass IDX1–IDX3 while emitting the index sentence for every input.
   o=$(index_source_note "")
   [ -z "$o" ] && ok "IDX4 control — empty mode is silent (no invented provenance)" \
-              || no "IDX4 control — empty mode spoke: $o"
+              || bad "IDX4 control — empty mode spoke: $o"
 
   # 🟥 CONTROL 2 — the three states must be DISTINGUISHABLE from each other, not merely non-empty.
   a=$(index_source_note "index"); b=$(index_source_note "nongit"); c=$(index_source_note "UNMEASURED")
   if [ "$a" != "$b" ] && [ "$b" != "$c" ] && [ "$a" != "$c" ]; then
     ok "IDX5 control — the three states produce three different sentences"
   else
-    no "IDX5 control — states collapsed into the same sentence"
+    bad "IDX5 control — states collapsed into the same sentence"
   fi
 fi
 rm -f "$_ISN"
@@ -362,7 +388,7 @@ if sed -n '/lane suite(s) with no runner and no declaration/,/Fix by ONE of/p' "
      | grep -q 'index_source_note'; then
   ok "IDX6 the note is CALLED on the FAIL path (not just defined)"
 else
-  no "IDX6 index_source_note is defined but the FAIL path does not call it"
+  bad "IDX6 index_source_note is defined but the FAIL path does not call it"
 fi
 
 echo "----"

package/scripts/test_mapped_tracks_lanes.sh

@@ -53,7 +53,7 @@ EXPECT=3   # the_bible + pmh-dev + qasp ; _meta and _audit excluded
 
 # PREMISE — if the worktree can already see the fixtures, every verdict below is meaningless.
 NAIVE_WT=0
-for d in "$TMP/wt"/tracks/*/; do [ -d "$d" ] || continue; case "$(basename "$d")" in _*) continue;; esac; NAIVE_WT=$((NAIVE_WT+1)); done
+for d in "$TMP/wt"/tracks/*/; do [ -d "$d" ] || continue; case "$(basename "$d")" in _*) continue;; esac; NAIVE_WT=$((NAIVE_WT+1)); done  # portability-noqa: the [ -d "$d" ] || continue guard is on this SAME line (right after 'do'), not the next 1-2 lines the P8 scanner checks
 [ "$NAIVE_WT" -lt "$EXPECT" ] \
   && ok "premise: a naive cwd count from the worktree sees $NAIVE_WT of $EXPECT — the blindness is real here" \
   || ng "premise BROKEN: worktree already sees $NAIVE_WT — fixture does not reproduce the defect"

package/scripts/test_marker_soul_check_lanes.sh

@@ -165,6 +165,30 @@ crossfamily: panel(codex,agy) — 겹친 지적 0'
 planep P6-real-corpus-negative BLOCK "$GRACE" "$(cat "$REPO_ROOT/tracks/_meta/.axes_23_passed_feat_target-freeze-gate_2026-08-18.marker" 2>/dev/null || echo 'axes-run: x')"
 planep P7-real-corpus-positive PASS  "$GRACE" "$(cat "$REPO_ROOT/tracks/_meta/.axes_23_passed_fix_witness-two-commit-discipline_2026-08-17.marker" 2>/dev/null || echo '①영혼: 성공 정의 = 하나 둘 셋 넷 다섯 여섯')"
 
+echo
+echo "== ①영혼 2칸(성공정의/절대안함) advisory lanes (2026-09-04, six_axis_review 판정안 4) =="
+# advisory only — 두 케이스 다 rc=0(PASS). 판별은 rc 가 아니라 stdout 의 ⚠️ 문자열이다
+# (known-pair: 한 칸만 있는 마커는 경고가 «찍혀야» 하고, 두 칸 다 있는 마커는 «안 찍혀야» 한다).
+planep_adv() { # $1=id $2=expect(WARN|QUIET) $3=filename-date $4=body
+  local id="$1" expect="$2" d="$3" body="$4" out f
+  f="$T/.axes_23_passed_fix_x_${d}.marker"
+  printf '%s\n' "$body" > "$f"
+  out=$( bash -c 'set -uo pipefail; SOUL_PRESENT_GRACE_DATE="$3"; . "$1"; validate_soul_present_leg "$2"' \
+         _ "$T/fnp.sh" "$f" "$GRACE" 2>&1 )
+  local got=QUIET; printf '%s' "$out" | grep -q '①영혼 2칸 미달' && got=WARN
+  if [ "$got" = "$expect" ]; then printf '  ✅ %-40s %s\n' "$id" "$got"
+  else printf '  ❌ %-40s expected %s, got %s\n     %s\n' "$id" "$expect" "$got" "$(printf '%s' "$out"|head -2)"; FAIL=1; fi
+}
+# known-positive — 「성공 정의」만 있고 「절대 안 함」이 없다 → advisory 가 찍혀야 한다, 그래도 PASS(rc=0)
+planep_adv Q1-one-slot-only-warns  WARN  "$GRACE" '①영혼: 성공 정의 = 소비자 경로에서 완주해 rc=0 을 낸다
+axes-run: ⓐ=codex'
+# known-negative — 두 칸 다 있다($SOUL 픽스처) → advisory 가 안 찍혀야 한다
+planep_adv Q2-both-slots-quiet     QUIET "$GRACE" "$SOUL
+axes-run: ⓐ=codex"
+# 둘 다 rc=0(PASS) 이어야 한다 — advisory 는 커밋을 막지 않는다(형식만 다르고 planep 로도 확인)
+planep Q1b-one-slot-still-passes PASS "$GRACE" '①영혼: 성공 정의 = 소비자 경로에서 완주해 rc=0 을 낸다
+axes-run: ⓐ=codex'
+
 echo
 echo "== cross-family findings — regression lanes (codex/gpt-5.5, diff 축, 2026-08-21) =="
 # F1 self-referential FP: codex's own alignment fix flipped G8 to PASS because the

package/scripts/test_node_check_lanes.sh

@@ -42,43 +42,43 @@ echo "── node-check lanes ──"
 # LANE 1 (S3-1) — NOT a git repo. The git-hook floor cannot be installed here at all, so it is
 # N/A, not missing. Reporting it would be an unfixable notice repeating every session forever.
 mkdir -p "$TMP/nogit"
-out="$(run "$TMP/nogit" "$TMP/s1" FH_MACHINE_ID=nogitbox)"
+out="$(run "$TMP/nogit" "$TMP/s1" FH_MACHINE_ID=nogitbox)"; rc=$?
 # POSITIVE CONTROL: assert what MUST appear alongside what must not. Absence-only lanes are
 # satisfied by a script that prints nothing at all — an `exit 0` stub passed lanes 1, 4 and 7
 # (cross-family mutation 2026-07-30), so each now pins an expected utterance too.
 case "$out" in
-  *"Missing mechanical floor"*) bad "lane1 non-git: must NOT claim a missing floor (N/A, unfixable)" "$out" ;;
+  *"Missing mechanical floor"*) bad "lane1 non-git: must NOT claim a missing floor (N/A, unfixable)" "rc=$rc | $out" ;;
   *"first session for this clone"*) ok "lane1 non-git: N/A on the git floor, but still reports the node event" ;;
-  *) bad "lane1 non-git: silent — a stub would pass this lane" "$out" ;;
+  *) bad "lane1 non-git: silent — a stub would pass this lane" "rc=$rc | $out" ;;
 esac
 
 # LANE 2 (S3-2) — hooks exist but belong to another framework (husky/pre-commit). Executable ≠ FH's
 # gate. Silence here is the exact accident this check was built for: FH gates absent, machine quiet.
 mk_git_hub "$TMP/husky" no
-out="$(run "$TMP/husky" "$TMP/s2" FH_MACHINE_ID=huskybox)"
+out="$(run "$TMP/husky" "$TMP/s2" FH_MACHINE_ID=huskybox)"; rc=$?
 case "$out" in
   *"Missing mechanical floor"*) ok "lane2 foreign hooks: FH gate absence reported" ;;
-  *) bad "lane2 foreign hooks: non-FH hooks were accepted as FH floors" "$out" ;;
+  *) bad "lane2 foreign hooks: non-FH hooks were accepted as FH floors" "rc=$rc | $out" ;;
 esac
 
 # LANE 3 (S3-3) — Mode D user on a FRESH clone: companion store present, settings.local.json absent
 # (it is gitignored, so a clone never has it). This is the MEASURED 2026-07-30 incident. Must speak.
 mk_git_hub "$TMP/moded" yes
 mkdir -p "$TMP/companion/.git"
-out="$(run "$TMP/moded" "$TMP/s3" FH_MACHINE_ID=modedbox BE_DIR="$TMP/companion")"
+out="$(run "$TMP/moded" "$TMP/s3" FH_MACHINE_ID=modedbox BE_DIR="$TMP/companion")"; rc=$?
 case "$out" in
   *companion-load*) ok "lane3 fresh Mode D clone: companion-load absence surfaced" ;;
-  *) bad "lane3 fresh Mode D clone: SILENT — the measured incident would recur" "$out" ;;
+  *) bad "lane3 fresh Mode D clone: SILENT — the measured incident would recur" "rc=$rc | $out" ;;
 esac
 
 # LANE 4 (M2-4) — public non-Mode-D user: no companion store anywhere. The companion item must not
 # appear, or the majority path gets a false positive for a feature it does not use.
 mk_git_hub "$TMP/public" yes
-out="$(run "$TMP/public" "$TMP/s4" FH_MACHINE_ID=publicbox)"
+out="$(run "$TMP/public" "$TMP/s4" FH_MACHINE_ID=publicbox)"; rc=$?
 case "$out" in
-  *companion-load*) bad "lane4a non-Mode-D: companion item shown to a user with no store" "$out" ;;
+  *companion-load*) bad "lane4a non-Mode-D: companion item shown to a user with no store" "rc=$rc | $out" ;;
   *"first session for this clone"*) ok "lane4a non-Mode-D: companion absent, node event still reported" ;;
-  *) bad "lane4a non-Mode-D: silent — a stub would pass this lane" "$out" ;;
+  *) bad "lane4a non-Mode-D: silent — a stub would pass this lane" "rc=$rc | $out" ;;
 esac
 
 # LANE 4b (S4-1) — CLAUDE.local.md is Claude Code's STANDARD local-override file; anyone may keep
@@ -86,9 +86,9 @@ esac
 # gets a companion notice every session forever (state-based emission makes it permanent, not
 # one-shot). Only the binding INSIDE the file counts.
 printf '# my local notes\nuse tabs not spaces\n' > "$TMP/public/CLAUDE.local.md"
-out="$(run "$TMP/public" "$TMP/s4b" FH_MACHINE_ID=publicbox)"
+out="$(run "$TMP/public" "$TMP/s4b" FH_MACHINE_ID=publicbox)"; rc=$?
 case "$out" in
-  *companion-load*) bad "lane4b plain CLAUDE.local.md: existence alone classified the user as Mode D" "$out" ;;
+  *companion-load*) bad "lane4b plain CLAUDE.local.md: existence alone classified the user as Mode D" "rc=$rc | $out" ;;
   *) ok "lane4b plain CLAUDE.local.md: not treated as a Mode D signal" ;;
 esac
 
@@ -106,10 +106,10 @@ for binding in 'BE_DIR=/x/store' 'companion store: ~/notes' '컴패니언 스토
                'vault: ~/vaults/notes' 'gbrain ingest target: ~/gbrain' 'backend: obsidian'; do
   i=$((i+1))
   printf '# local\n%s\n' "$binding" > "$TMP/public/CLAUDE.local.md"
-  out="$(run "$TMP/public" "$TMP/s4c$i" FH_MACHINE_ID=publicbox)"
+  out="$(run "$TMP/public" "$TMP/s4c$i" FH_MACHINE_ID=publicbox)"; rc=$?
   case "$out" in
     *companion-load*) ok "lane4c.$i Mode D detected via: $binding" ;;
-    *) bad "lane4c.$i binding present but Mode D not detected: $binding" "$out" ;;
+    *) bad "lane4c.$i binding present but Mode D not detected: $binding" "rc=$rc | $out" ;;
   esac
 done
 rm -f "$TMP/public/CLAUDE.local.md"
@@ -136,24 +136,24 @@ done
 # exist and working hooks read as missing.
 mk_git_hub "$TMP/wt" yes
 git -C "$TMP/wt" worktree add -q "$TMP/wt_linked" -b lane7 2>/dev/null
-out="$(run "$TMP/wt_linked" "$TMP/s7" FH_MACHINE_ID=wtbox)"
+out="$(run "$TMP/wt_linked" "$TMP/s7" FH_MACHINE_ID=wtbox)"; rc=$?
 case "$out" in
-  *"Missing mechanical floor"*) bad "lane7 worktree: false missing-floor (hooks resolve to the main gitdir)" "$out" ;;
+  *"Missing mechanical floor"*) bad "lane7 worktree: false missing-floor (hooks resolve to the main gitdir)" "rc=$rc | $out" ;;
   *"first session for this clone"*) ok "lane7 worktree: hooks resolved correctly, node event reported" ;;
-  *) bad "lane7 worktree: silent — a stub would pass this lane" "$out" ;;
+  *) bad "lane7 worktree: silent — a stub would pass this lane" "rc=$rc | $out" ;;
 esac
 
 # LANE 8 (M3-3) — python3 unavailable: the companion verdict is UNMEASURED, never silently "fine".
 # Simulated by a PATH with no python3, for a Mode D hub (so the check is applicable).
 mk_git_hub "$TMP/nopy" yes
 mkdir -p "$TMP/emptybin" "$TMP/companion2/.git"
-out="$(PATH="$TMP/emptybin:/usr/bin:/bin" run "$TMP/nopy" "$TMP/s8" FH_MACHINE_ID=nopybox BE_DIR="$TMP/companion2")"
+out="$(PATH="$TMP/emptybin:/usr/bin:/bin" run "$TMP/nopy" "$TMP/s8" FH_MACHINE_ID=nopybox BE_DIR="$TMP/companion2")"; rc=$?
 if command -v python3 >/dev/null 2>&1 && [ -x /usr/bin/python3 ]; then
   ok "lane8 skipped: /usr/bin/python3 exists so absence cannot be simulated via PATH"
 else
   case "$out" in
     *UNMEASURED*|*unmeasured*) ok "lane8 no python3: reported UNMEASURED, not silence" ;;
-    *) bad "lane8 no python3: absence read as pass" "$out" ;;
+    *) bad "lane8 no python3: absence read as pass" "rc=$rc | $out" ;;
   esac
 fi
 
@@ -249,11 +249,11 @@ else
   fi
   git -C "$_dn" fetch -q origin >/dev/null 2>&1
   _h0="$(git -C "$_dn" rev-parse HEAD)"
-  run "$_dn" "$_ap_root/s_a" >/dev/null 2>&1
+  _out_a="$(run "$_dn" "$_ap_root/s_a" 2>&1)"; _rc_a=$?
   if [ "$(git -C "$_dn" rev-parse HEAD)" != "$_h0" ]; then
     ok "lane10-a APPLY: consented + on default branch → fast-forwarded"
   else
-    bad "lane10-a APPLY: consented + on default branch did NOT fast-forward (feature inert — every refuse lane below is then vacuous)" "$_h0"
+    bad "lane10-a APPLY: consented + on default branch did NOT fast-forward (feature inert — every refuse lane below is then vacuous)" "before=$_h0 rc=$_rc_a out=$_out_a"
   fi
 
   # b — the envelope. Never applies off the default branch, and NEVER switches branches.
@@ -267,13 +267,13 @@ else
   # version of this lane asserted only those two and stayed green against a defeated envelope —
   # decorative. The tip that must not move is the CURRENT branch's own.
   _f0="$(git -C "$_dn" rev-parse feat-x)"
-  run "$_dn" "$_ap_root/s_b" >/dev/null 2>&1
+  _out_b="$(run "$_dn" "$_ap_root/s_b" 2>&1)"; _rc_b=$?
   if [ "$(git -C "$_dn" rev-parse "$_DEF")" = "$_m0" ] \
      && [ "$(git -C "$_dn" rev-parse feat-x)" = "$_f0" ] \
      && [ "$(git -C "$_dn" branch --show-current)" = "feat-x" ]; then
     ok "lane10-b ENVELOPE: off default branch → no apply on EITHER branch, no switch"
   else
-    bad "lane10-b ENVELOPE: a branch tip moved off the default branch — the shared-checkout hazard" "main=$_m0->$(git -C "$_dn" rev-parse "$_DEF") feat-x=$_f0->$(git -C "$_dn" rev-parse feat-x) branch=$(git -C "$_dn" branch --show-current)"
+    bad "lane10-b ENVELOPE: a branch tip moved off the default branch — the shared-checkout hazard" "main=$_m0->$(git -C "$_dn" rev-parse "$_DEF") feat-x=$_f0->$(git -C "$_dn" rev-parse feat-x) branch=$(git -C "$_dn" branch --show-current) rc=$_rc_b out=$_out_b"
   fi
   git -C "$_dn" switch -q "$_DEF" >/dev/null 2>&1
 
@@ -285,29 +285,29 @@ p=sys.argv[1]; s=open(p,encoding='utf-8').read()
 open(p,'w',encoding='utf-8').write(re.sub(r'\nstanding_consent:\n(?:  .*\n|    .*\n)*', '\n', s, count=1))
 PYX
   _h1="$(git -C "$_dn" rev-parse HEAD)"
-  run "$_dn" "$_ap_root/s_c" >/dev/null 2>&1
+  _out_c="$(run "$_dn" "$_ap_root/s_c" 2>&1)"; _rc_c=$?
   [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h1" ] \
     && ok "lane10-c NO-GRANT: absent standing_consent → no apply" \
-    || bad "lane10-c NO-GRANT: applied without a grant" "$_h1"
+    || bad "lane10-c NO-GRANT: applied without a grant" "before=$_h1 rc=$_rc_c out=$_out_c"
 
   # d — expired lease. A lease nobody enforces is not a lease.
   cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
   sed -i.bak2 's/expires: [0-9-]*/expires: 2020-01-01/' "$_dn/tracks/_meta/user_adaptation_profile.md"
   _h2="$(git -C "$_dn" rev-parse HEAD)"
-  run "$_dn" "$_ap_root/s_d" >/dev/null 2>&1
+  _out_d="$(run "$_dn" "$_ap_root/s_d" 2>&1)"; _rc_d=$?
   [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h2" ] \
     && ok "lane10-d EXPIRED: past-dated lease → no apply" \
-    || bad "lane10-d EXPIRED: applied under an expired lease" "$_h2"
+    || bad "lane10-d EXPIRED: applied under an expired lease" "before=$_h2 rc=$_rc_d out=$_out_d"
   cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
 
   # e — divergence. --ff-only must refuse rather than absorb, and local work must survive.
   (cd "$_dn" && echo local-only > mine.txt && git add -A && git commit -qm diverge) >/dev/null 2>&1
   _h3="$(git -C "$_dn" rev-parse HEAD)"
-  run "$_dn" "$_ap_root/s_e" >/dev/null 2>&1
+  _out_e="$(run "$_dn" "$_ap_root/s_e" 2>&1)"; _rc_e=$?
   if [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h3" ] && [ -f "$_dn/mine.txt" ]; then
     ok "lane10-e DIVERGED: ff refused, local commit survives"
   else
-    bad "lane10-e DIVERGED: local history was moved or lost" "$_h3 -> $(git -C "$_dn" rev-parse HEAD)"
+    bad "lane10-e DIVERGED: local history was moved or lost" "$_h3 -> $(git -C "$_dn" rev-parse HEAD) rc=$_rc_e out=$_out_e"
   fi
 
   # f — WRONG CLASS. The refusal that the other three arms structurally cannot produce.
@@ -367,7 +367,7 @@ PYX
   if [ "$_h5" = "$(git -C "$_dn" rev-parse "origin/$_DEF")" ]; then
     bad "lane10-f VACUOUS: clone is not behind origin, so 'no apply' proves nothing" "$_h5"
   fi
-  run "$_dn" "$_ap_root/s_f" >/dev/null 2>&1
+  _out_f="$(run "$_dn" "$_ap_root/s_f" 2>&1)"; _rc_f=$?
   _filewide=0
   bash "$FH_REPO/scripts/consent_registry_check.sh" \
        "$_dn/tracks/_meta/consent_classes.yaml" \
@@ -375,9 +375,9 @@ PYX
   if [ "$(git -C "$_dn" rev-parse HEAD)" = "$_h5" ] && [ "$_filewide" = "0" ]; then
     ok "lane10-f WRONG-CLASS: another class granted, this one only in prose → no apply (file-wide check still 0)"
   elif [ "$_filewide" != "0" ]; then
-    bad "lane10-f VACUOUS: the fixture broke the file-wide verdict (rc=$_filewide), so it re-tests lane10-c's axis, not the class join" "rebuild the fixture so the bare check returns 0"
+    bad "lane10-f VACUOUS: the fixture broke the file-wide verdict (rc=$_filewide), so it re-tests lane10-c's axis, not the class join" "rebuild the fixture so the bare check returns 0 | run_rc=$_rc_f run_out=$_out_f"
   else
-    bad "lane10-f WRONG-CLASS: applied on a class that was never granted" "$_h5 -> $(git -C "$_dn" rev-parse HEAD)"
+    bad "lane10-f WRONG-CLASS: applied on a class that was never granted" "$_h5 -> $(git -C "$_dn" rev-parse HEAD) run_rc=$_rc_f run_out=$_out_f"
   fi
   cp "$_ap_root/uap.bak" "$_dn/tracks/_meta/user_adaptation_profile.md"
 
@@ -387,10 +387,10 @@ PYX
   (cd "$_ap_root/up" && echo newer3 > f.txt && git commit -qam ahead3) >/dev/null 2>&1
   git -C "$_dn" fetch -q origin >/dev/null 2>&1
   _h4="$(git -C "$_dn" rev-parse HEAD)"
-  run "$_dn" "$_ap_root/s_f" >/dev/null 2>&1
+  _out_ctrl="$(run "$_dn" "$_ap_root/s_f" 2>&1)"; _rc_ctrl=$?
   [ "$(git -C "$_dn" rev-parse HEAD)" != "$_h4" ] \
     && ok "lane10-CONTROL: apply arm still fires after the refuse arms (instrument alive)" \
-    || bad "lane10-CONTROL: apply arm went inert — the refuse lanes above prove nothing" "$_h4"
+    || bad "lane10-CONTROL: apply arm went inert — the refuse lanes above prove nothing" "before=$_h4 rc=$_rc_ctrl out=$_out_ctrl"
 fi
 rm -rf "$_ap_root"