@chrono-meta/fh-gate 2.15.1 → 3.1.0

package/scripts/revert_probe.sh

@@ -0,0 +1,250 @@
+#!/usr/bin/env bash
+# revert_probe.sh — general-purpose ⓕ revert-and-observe probe (rung 강화 #2, six_axis_review_2026-09-04).
+#
+# WHY THIS EXISTS. `되돌림`(revert-and-observe) has been done by hand 15+ times in this repo's own
+# history (see 6축 실측: ⓕ none 비율 57.4%, «정확히 4레인 적색» 급 실물은 매번 손으로 짠 1회성
+# 스크립트였다). Hand-rolled revert probes are the exact shape §Mechanize-at-repetition names —
+# N≥3 recurrence on the SAME operation (swap a file to an older version, rerun a suite, read which
+# lines changed color) is a mechanization trigger, not a one-off. This is that mechanization.
+#
+# 🟥 FRONTIER WARNING — read before citing this tool's PASS as "the suite has detection power".
+#   A single revert of a single file is ONE mutant. Mutation-testing research (arXiv 2607.22880,
+#   and the companion Meta engineering write-up cited alongside it in
+#   frontier_verification_map_2026-09-04.md §ⓕ) found that coverage/mutation SCORE loses its
+#   correlation with real fault-detection effectiveness once suite size is controlled for — a
+#   single kill is evidence the ANCHOR under test is load-bearing for THIS ONE reverted file,
+#   never a general claim that the suite "has good mutation coverage" or "catches regressions".
+#   Run this against every file you actually care about; do not average or extrapolate from one.
+#
+# WHAT IT DOES
+#   1. Runs the lane suite AS-IS against the file's CURRENT (working-tree) content — the "수리 후"
+#      run.
+#   2. Swaps ONLY the target file to its content at --baseline (default HEAD), backing up the
+#      current content first.
+#   3. Reruns the same lane suite against that swapped-in baseline content — the "되돌린" run.
+#   4. Restores the target file to its exact pre-probe content — ALWAYS, even if either suite run
+#      crashes, hangs past its timeout, or this script itself errors. Restore is attempted from an
+#      EXIT trap (safety net) in addition to the normal-path restore, so a `kill`-free abnormal
+#      exit still restores. Physical restore, never `git checkout <ref> -- <path>` — that stages
+#      the revert into the index ([[feedback_git_checkout_path_stages_the_revert]]); this tool
+#      writes bytes to the file only, with `git show <ref>:<path>` (never `git checkout`), and
+#      never touches the index.
+#   5. Diffs the two runs' ✅/❌ label lines (this repo's universal `ok()`/`no()` convention —
+#      every test_*.sh / *_lanes.sh in scripts/ prints `  ✅ <label>` / `  ❌ <label>`) and reports
+#      EXACTLY which labels flipped from ✅ (current) to ❌ (baseline) — i.e. which lane actually
+#      went red when the fix was undone.
+#
+# WHAT IT ASSUMES (named, not hidden): the lane suite's ✅/❌ label text is STABLE across the two
+#   runs for a given lane (the suite script itself does not change between the two invocations —
+#   only the target file's content does). A suite whose pass/fail label text is dynamically built
+#   from data that changes with the target file (e.g. embeds a byte count in the label) will show
+#   as "label only in one run" rather than a flip — reported honestly as UNMATCHED, not silently
+#   dropped, and not counted toward the flip total.
+#
+# USAGE
+#   bash scripts/revert_probe.sh <target-file> <lane-suite-script> [--baseline <ref>] [--timeout <sec>]
+#   bash scripts/revert_probe.sh scripts/foo.sh scripts/test_foo_lanes.sh
+#   bash scripts/revert_probe.sh scripts/foo.sh scripts/test_foo_lanes.sh --baseline HEAD~1
+#
+# EXIT CODES (fail-closed, per CLAUDE.md §Irreversibility Surface-Class Degrade Invariant — this
+#   is a REVERSIBLE, read-then-restore surface, so the floor here is "never mis-score", not
+#   "never run"):
+#   0  = exactly ≥1 lane flipped ✅→❌ when reverted (anchor is alive — it caught the mutant)
+#   1  = 0 lanes flipped (anchor is DECORATIVE for this file — nothing depended on the fix)
+#   2  = usage error (bad args, target/suite/ref not found)
+#   10 = the probe itself is unreliable for this run — either suite run produced ZERO parseable
+#        ✅/❌ lines (harness error, not "0 lanes exist"), OR the restore step failed (the target
+#        file may still hold BASELINE content — treated as the more severe failure and reported
+#        loudly, never silently folded into a verdict)
+#
+# Usage in a lane test: see scripts/test_revert_probe_lanes.sh for the known-pair calibration
+# (decorative anchor → 1, real anchor → 0, restore-guaranteed-on-suite-crash).
+
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+TARGET=""; SUITE=""; BASELINE="HEAD"; TIMEOUT="120"
+_POS=()
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --baseline) BASELINE="${2:-HEAD}"; shift 2 ;;
+    --timeout)  TIMEOUT="${2:-120}"; shift 2 ;;
+    -*)         echo "FAIL: unknown flag: $1" >&2; exit 2 ;;
+    *)          _POS+=("$1"); shift ;;
+  esac
+done
+TARGET="${_POS[0]:-}"; SUITE="${_POS[1]:-}"
+
+[ -n "$TARGET" ] || { echo "FAIL: usage: revert_probe.sh <target-file> <lane-suite-script> [--baseline <ref>]" >&2; exit 2; }
+[ -n "$SUITE" ]  || { echo "FAIL: usage: revert_probe.sh <target-file> <lane-suite-script> [--baseline <ref>]" >&2; exit 2; }
+[ -f "$TARGET" ] || { echo "FAIL: target file not found: $TARGET" >&2; exit 2; }
+[ -f "$SUITE" ]  || { echo "FAIL: lane suite script not found: $SUITE" >&2; exit 2; }
+
+# 🟥 physical path (`pwd -P`), not logical — macOS `/tmp` and `$TMPDIR` are symlinks into
+# `/private/...`, and `git rev-parse --show-toplevel` always answers with the PHYSICAL path.
+# A logical `pwd` here would make every fixture under a temp dir fail the prefix-strip below
+# (same class of defect `sim_isolated_run.sh` already names for its own path isolation).
+TARGET_DIR="$(cd "$(dirname "$TARGET")" && pwd -P)"
+TARGET_ABS="$TARGET_DIR/$(basename "$TARGET")"
+GIT_ROOT="$(cd "$TARGET_DIR" && git rev-parse --show-toplevel 2>/dev/null)"
+[ -n "$GIT_ROOT" ] || { echo "FAIL: target file is not inside a git repository: $TARGET" >&2; exit 2; }
+case "$TARGET_ABS" in
+  "$GIT_ROOT"/*) REL_PATH="${TARGET_ABS#"$GIT_ROOT"/}" ;;
+  *) echo "FAIL: could not compute a repo-relative path for $TARGET" >&2; exit 2 ;;
+esac
+
+if ! git -C "$GIT_ROOT" cat-file -e "${BASELINE}:${REL_PATH}" 2>/dev/null; then
+  echo "FAIL: $REL_PATH not found at baseline '$BASELINE' (bad ref, or the file did not exist there)" >&2
+  exit 2
+fi
+
+echo "── revert_probe ────────────────────────────────────────────────────"
+echo "target:   $REL_PATH"
+echo "suite:    $SUITE"
+echo "baseline: $BASELINE"
+echo ""
+echo "🟥 FRONTIER WARNING (arXiv 2607.22880): this run reverts EXACTLY ONE file — ONE mutant."
+echo "   A ✅ verdict here means the anchor caught THIS mutant, not that the suite has general"
+echo "   mutation-detection power. Coverage/mutation score decorrelates from real effectiveness"
+echo "   once suite size is controlled for — do not average or extrapolate from a single run."
+echo "되돌린 파일(뮤턴트) 수: 1 — $REL_PATH"
+echo ""
+
+WORKDIR="$(mktemp -d "${TMPDIR:-/tmp}/revert_probe.XXXXXX")" || { echo "FAIL: mktemp -d failed" >&2; exit 10; }
+BACKUP="$WORKDIR/backup"
+RUN_A="$WORKDIR/run_current.txt"
+RUN_B="$WORKDIR/run_baseline.txt"
+
+cp -p "$TARGET_ABS" "$BACKUP" || { echo "FAIL: could not back up $TARGET_ABS — refusing to touch it" >&2; rm -rf "$WORKDIR"; exit 10; }
+
+RESTORED=0
+_restore() {
+  [ "$RESTORED" = 1 ] && return 0
+  if cp -p "$BACKUP" "$TARGET_ABS" 2>/dev/null; then
+    RESTORED=1
+  else
+    echo "🟥🟥🟥 RESTORE FAILED — $TARGET_ABS may still hold BASELINE ($BASELINE) content." >&2
+    echo "    Backup of the pre-probe content is kept at: $BACKUP" >&2
+    echo "    Restore it by hand: cp \"$BACKUP\" \"$TARGET_ABS\"" >&2
+  fi
+}
+# Safety net — fires on ANY exit path (normal, error, unbound-var under set -u), so a crash
+# mid-probe still restores. The normal path below also calls _restore explicitly and checks its
+# result directly, because a trap cannot hand its own success/failure back to the exit-code logic.
+trap '_restore' EXIT
+
+_run_suite() { # $1=output-file
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$TIMEOUT" bash "$SUITE" > "$1" 2>&1
+  else
+    bash "$SUITE" > "$1" 2>&1
+  fi
+  return 0   # the suite's own exit code (pass/fail count) is not this function's concern
+}
+
+echo "── run 1/2: 현재(수리 후) 판 ──"
+_run_suite "$RUN_A"
+echo "  captured $(wc -l < "$RUN_A" | tr -d ' ') lines"
+
+if ! git -C "$GIT_ROOT" show "${BASELINE}:${REL_PATH}" > "$TARGET_ABS.new" 2>"$WORKDIR/show.err"; then
+  echo "FAIL: git show ${BASELINE}:${REL_PATH} failed:" >&2
+  cat "$WORKDIR/show.err" >&2
+  rm -f "$TARGET_ABS.new"
+  # trap restores (no-op here, file was never swapped) and exits
+  exit 10
+fi
+mv "$TARGET_ABS.new" "$TARGET_ABS"
+
+echo "── run 2/2: 기준($BASELINE) 판 (파일만 되돌림, 인덱스는 안 건드림) ──"
+_run_suite "$RUN_B"
+echo "  captured $(wc -l < "$RUN_B" | tr -d ' ') lines"
+
+_restore
+trap - EXIT   # explicit restore already ran; the safety net has nothing left to do
+if [ "$RESTORED" != 1 ]; then
+  echo "" >&2
+  echo "RESULT: RESTORE-FAILED — do not trust the file on disk, see backup path above" >&2
+  rm -rf "$WORKDIR"
+  exit 10
+fi
+
+# ── ✅/❌ 라벨 추출 — 심볼\tSPACE-트림한 설명 ────────────────────────────────────────────
+_extract_labels() { # $1=source-file → writes "P|F<TAB>desc"
+  grep -E '(✅|❌)' "$1" 2>/dev/null | while IFS= read -r line; do
+    case "$line" in
+      *✅*) sym=P; rest="${line#*✅}" ;;
+      *)   sym=F; rest="${line#*❌}" ;;
+    esac
+    rest="$(printf '%s' "$rest" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
+    [ -n "$rest" ] && printf '%s\t%s\n' "$sym" "$rest"
+  done
+}
+
+LABELS_A="$WORKDIR/labels_a.tsv"; LABELS_B="$WORKDIR/labels_b.tsv"
+_extract_labels "$RUN_A" > "$LABELS_A"
+_extract_labels "$RUN_B" > "$LABELS_B"
+NA=$(wc -l < "$LABELS_A" | tr -d ' ')
+NB=$(wc -l < "$LABELS_B" | tr -d ' ')
+
+if [ "$NA" -eq 0 ] || [ "$NB" -eq 0 ]; then
+  echo ""
+  echo "🟥 HARNESS ERROR — one of the two runs produced ZERO ✅/❌ lines (current=$NA, baseline=$NB)."
+  echo "   That is not \"0 lanes exist\" — it means this probe cannot see the suite's verdicts at"
+  echo "   all for that run (crash, missing labels, wrong suite path). Read the raw output:"
+  echo "     current:  $RUN_A"
+  echo "     baseline: $RUN_B"
+  rm -rf "$WORKDIR"
+  exit 10
+fi
+
+# DESC\tSYM, sorted by DESC — LC_ALL=C throughout so non-ASCII label text (this repo's labels are
+# routinely Korean) never collapses under a locale-dependent string-equality/sort
+# ([[feedback_locale_string_equality_breaks_nonascii]]).
+DESC_A="$WORKDIR/desc_a.tsv"; DESC_B="$WORKDIR/desc_b.tsv"
+awk -F'\t' '{print $2"\t"$1}' "$LABELS_A" | LC_ALL=C sort -t"$(printf '\t')" -k1,1 -k2,2 > "$DESC_A"
+awk -F'\t' '{print $2"\t"$1}' "$LABELS_B" | LC_ALL=C sort -t"$(printf '\t')" -k1,1 -k2,2 > "$DESC_B"
+
+JOINED="$WORKDIR/joined.tsv"
+LC_ALL=C join -t "$(printf '\t')" -j 1 -o 1.1,1.2,2.2 "$DESC_A" "$DESC_B" > "$JOINED" 2>/dev/null || : > "$JOINED"
+
+FLIPPED_RED="$WORKDIR/flipped_red.txt"     # ✅(현재) → ❌(기준) — 앵커가 실제로 잡은 것
+FLIPPED_GREEN="$WORKDIR/flipped_green.txt" # ❌(현재) → ✅(기준) — 이상 신호, 참고용
+awk -F'\t' '$2=="P" && $3=="F" {print $1}' "$JOINED" > "$FLIPPED_RED"
+awk -F'\t' '$2=="F" && $3=="P" {print $1}' "$JOINED" > "$FLIPPED_GREEN"
+K=$(wc -l < "$FLIPPED_RED" | tr -d ' ')
+J=$(wc -l < "$FLIPPED_GREEN" | tr -d ' ')
+
+# 라벨 텍스트가 두 실행에서 안 겹치는 경우 — 조용히 버리지 않고 이름으로 남긴다(가정 위반 알림).
+ONLY_A="$WORKDIR/only_a.txt"; ONLY_B="$WORKDIR/only_b.txt"
+LC_ALL=C comm -23 <(cut -f1 "$DESC_A" | LC_ALL=C sort -u) <(cut -f1 "$DESC_B" | LC_ALL=C sort -u) > "$ONLY_A"
+LC_ALL=C comm -13 <(cut -f1 "$DESC_A" | LC_ALL=C sort -u) <(cut -f1 "$DESC_B" | LC_ALL=C sort -u) > "$ONLY_B"
+NUM_ONLY_A=$(wc -l < "$ONLY_A" | tr -d ' '); NUM_ONLY_B=$(wc -l < "$ONLY_B" | tr -d ' ')
+
+echo ""
+echo "── 결과 ──────────────────────────────────────────────────────────"
+echo "현재(수리 후) 라벨: ${NA}줄  ·  기준($BASELINE) 라벨: ${NB}줄"
+echo ""
+echo "되돌린 레인 (✅→❌, 앵커가 실제로 잡은 것): ${K}개"
+if [ "$K" -gt 0 ]; then sed 's/^/    ❌ /' "$FLIPPED_RED"; fi
+echo ""
+echo "(참고) 반대방향 (❌→✅, 이상 신호): ${J}개"
+if [ "$J" -gt 0 ]; then sed 's/^/    ⚠️  /' "$FLIPPED_GREEN"; fi
+if [ "$NUM_ONLY_A" -gt 0 ] || [ "$NUM_ONLY_B" -gt 0 ]; then
+  echo ""
+  echo "🟥 라벨 텍스트가 두 실행에서 완전히 겹치지 않는다 — 이 도구의 가정(라벨 텍스트가 안정적)"
+  echo "   이 이 스위트에서는 안 맞을 수 있다. 아래는 매칭 대상에서 빠진 라벨(플립 집계에 미포함):"
+  [ "$NUM_ONLY_A" -gt 0 ] && sed 's/^/    현재에만: /' "$ONLY_A"
+  [ "$NUM_ONLY_B" -gt 0 ] && sed 's/^/    기준에만: /' "$ONLY_B"
+fi
+
+echo ""
+if [ "$K" -ge 1 ]; then
+  echo "판정: 앵커 살아있음 — 되돌리면 정확히 ${K}개 레인이 빨개진다"
+  rm -rf "$WORKDIR"
+  exit 0
+else
+  echo "판정: 앵커 장식 — 되돌려도 빨개지는 레인이 0개다"
+  rm -rf "$WORKDIR"
+  exit 1
+fi

package/scripts/selfcheck.sh

@@ -187,10 +187,22 @@ else
   fail=1
 fi
 
-# Bash surface: npm-shipped scripts + local bin wrappers + gate-chain infra
+# Bash surface: npm-shipped scripts + local bin wrappers + gate-chain infra.
+# `bin/fh-gate` · `bin/fh-run` · `bin/fh-goal` are named EXPLICITLY here (not a glob) and, unlike
+# most of this list, are not covered by files_manifest_shipping_check.sh either (only their
+# `.js` counterparts are declared in package.json files[]) — so a plain `[ -f "$f" ] || continue`
+# made their disappearance invisible to BOTH checks at once. Reproduced 2026-09-03: deleting
+# bin/fh-gate from a fixture tree left fail=0, no FAIL line, nothing. `scripts/*.sh` staying a
+# silent skip on a genuinely-empty glob is correct (that arm still has no non-glob name); the
+# named gate-chain-infra paths must not degrade the same way.
 for f in scripts/*.sh bin/fh-gate bin/fh-run bin/fh-goal \
          templates/regression_guard.sh templates/temper_check.sh templates/predelete_check.sh templates/.git-hooks/pre-commit; do
-  [ -f "$f" ] || continue
+  if [ ! -f "$f" ]; then
+    case "$f" in
+      *'*'*) continue ;;   # unmatched glob (nullglob off) — not a real path, legitimate skip
+      *) echo "FAIL  bash -n coverage: gate-chain infra file missing: $f"; fail=1; continue ;;
+    esac
+  fi
   check "bash -n $f" bash -n "$f"
 done
 
@@ -594,6 +606,9 @@ for _pair in \
   "scripts/destructive_pre_gate.sh|scripts/test_destructive_pre_gate_lanes.sh" \
   "templates/.git-hooks/pre-push|scripts/test_prepush_destructive_lanes.sh" \
   "templates/.git-hooks/pre-push|scripts/test_prepush_destructive_liveness.sh" \
+  "templates/.git-hooks/pre-push|scripts/test_push_zone_lanes.sh" \
+  "scripts/push_zone_check.sh|scripts/test_push_zone_lanes.sh" \
+  "scripts/session_close_check.sh|scripts/test_push_zone_lanes.sh" \
   "scripts/session_close_check.sh|scripts/test_peer_worktree_detect_lanes.sh" \
   "scripts/env_purity_scan.sh|scripts/test_env_purity_lanes.sh" \
   "scripts/frontier_digest_daily.sh|scripts/test_frontier_digest_retry.sh" \
@@ -606,19 +621,36 @@ for _pair in \
   "templates/.git-hooks/pre-commit|scripts/test_marker_thirdparty_lanes.sh" \
   "templates/.git-hooks/pre-commit|scripts/test_marker_soul_check_lanes.sh" \
   "templates/.git-hooks/pre-commit|scripts/test_marker_soul_tenet_lanes.sh" \
+  "templates/.git-hooks/pre-commit|scripts/test_marker_affected_lanes.sh" \
+  "templates/.git-hooks/pre-commit|scripts/test_marker_oracle_lanes.sh" \
+  `# ── 판정을 둘로 (2026-09-06, SWE-Gate 답습): 합성 «PASS» 가 acceptance-evidence 를 가리지 않는가 ──` \
+  "templates/.git-hooks/pre-commit|scripts/test_gate_two_verdicts_lanes.sh" \
+  `# ── fh-qp (QP) — chamber run #18 EMIT 2026-09-05: qp_tools.sh known-pair + residency lanes ──` \
+  "plugins/fh-qp/scripts/qp_tools.sh|scripts/test_fh_qp_lanes.sh" \
+  "plugins/fh-commons/skills/preprep/diagram_from_json.py|scripts/test_preprep_diagram_lanes.sh" \
+  `# ── action.yml — the GitHub Action wrapper: its exit-code mapping is where a typed verdict could become a boolean ──` \
+  "action.yml|scripts/test_action_yml_lanes.sh" \
   "scripts/sim_isolated_run.sh|scripts/test_sim_path_isolation_lanes.sh" \
+  `# ── live-eval — the live twin of the static /prompt-regression probe check (2026-09-04) ──` \
+  "scripts/probe_live_eval.sh|scripts/test_probe_live_eval_lanes.sh" \
+  "scripts/probe_live_eval_lib.py|scripts/test_probe_live_eval_lanes.sh" \
   "templates/.git-hooks/pre-commit|scripts/test_marker_first_use_lanes.sh" \
   "scripts/fixture_guard_lib.sh|scripts/test_fixture_guard_lanes.sh" \
   "scripts/stray_path_scan.sh|scripts/test_stray_path_lanes.sh" \
   "scripts/session_close_check.sh|scripts/test_stray_path_lanes.sh" \
   "templates/.git-hooks/pre-commit|scripts/test_hook_leg_wiring_lanes.sh" \
   ".claude/soul_tenets.txt|scripts/test_marker_soul_tenet_lanes.sh" \
+  "docs/map/fh_assets.architecture.json|scripts/test_fh_map_paths_lanes.sh" \
+  `# ── 지도 후처리(2026-09-06): 발행 폭 하한 + SVG 재생성. 리터럴 드리프트를 fail-closed 로 잡는다 ──` \
+  "scripts/map_postprocess.py|scripts/test_map_postprocess_lanes.sh" \
   "templates/.git-hooks/pre-commit|scripts/test_precommit_staged_drift_lanes.sh" \
   "templates/.git-hooks/pre-commit|scripts/test_marker_address_lanes.sh" \
+  "templates/.git-hooks/pre-commit|scripts/test_precommit_pointer_index_lanes.sh" \
   "scripts/residency_closure_scan.py|scripts/test_residency_closure_lanes.sh" \
   "scripts/reviewer_capability_corpus.tsv|scripts/test_reviewer_capability_conformance.sh" \
   "scripts/field_canon_preload.sh|scripts/test_field_canon_lanes.sh" \
   "scripts/stale_clone_guard.sh|scripts/test_stale_clone_guard_lanes.sh" \
+  "scripts/proposal_hook.sh|scripts/test_proposal_hook_lanes.sh" \
   "plugins/fh-commons/skills/ko-tech-writer/SKILL.md|scripts/test_ko_tech_writer_lanes.sh" \
   "scripts/script_caller_ratchet.sh|scripts/test_script_caller_ratchet_lanes.sh" \
   "scripts/script_caller_ratchet.sh|scripts/test_runner_surface_index_lanes.sh" \
@@ -630,14 +662,23 @@ for _pair in \
   "plugins/fh-commons/skills/preprep/lane_progression.py|scripts/test_preprep_progression_lanes.sh" \
   "plugins/fh-commons/skills/preprep/lane_adjacent_dup.py|scripts/test_preprep_adjacent_dup_lanes.sh" \
   "plugins/fh-commons/skills/preprep/lane_promise.py|scripts/test_preprep_promise_lanes.sh" \
+  "plugins/fh-commons/skills/preprep/lane_slide_refs.py|scripts/test_preprep_slide_refs_lanes.sh" \
   "plugins/fh-commons/skills/preprep/SKILL.md|scripts/test_preprep_drift_anchor.sh" \
+  "scripts/test_preprep_drift_anchor.sh|scripts/test_preprep_drift_anchor_lanes.sh" \
   "scripts/field_canon_preload.sh|scripts/test_skill_canon_preload_lanes.sh" \
   `# ── round/ 회차 계기 4종(2026-09-01). 넷 다 한 스위트가 잡는다 — 주체별로 행을 둔다 ──` \
   "scripts/round/delta_guard.sh|scripts/test_round_instruments_lanes.sh" \
   "scripts/round/target_pin.sh|scripts/test_round_instruments_lanes.sh" \
   "scripts/round/instrument_manifest.sh|scripts/test_round_instruments_lanes.sh" \
   "scripts/round/eligcheck_qset.sh|scripts/test_round_instruments_lanes.sh" \
-  "scripts/round/gatecheck_qset.sh|scripts/test_round_instruments_lanes.sh"
+  "scripts/round/gatecheck_qset.sh|scripts/test_round_instruments_lanes.sh" \
+  `# ── 발화 착지(2026-09-05). 네 주체가 한 스위트로 묶인다 — 주체별로 행을 둔다 ──` \
+  "scripts/utterance_intake.sh|scripts/test_utterance_intake_lanes.sh" \
+  "scripts/transcript_utterances.py|scripts/test_utterance_intake_lanes.sh" \
+  "scripts/compaction_probe.sh|scripts/test_utterance_intake_lanes.sh" \
+  "scripts/session_close_check.sh|scripts/test_utterance_intake_lanes.sh" \
+  `# ── 워크트리 회수(2026-09-05, N=2 재발 → 스크립트). 사람이 부르는 도구지만 레인은 자동 ──` \
+  "scripts/worktree_reclaim.sh|scripts/test_worktree_reclaim_lanes.sh"
 do
   _subj="${_pair%%|*}"; _anc="${_pair##*|}"; _lbl="${_anc##*/}"
   if [ ! -f "$_subj" ]; then
@@ -1056,6 +1097,29 @@ else
   esac
 fi
 
+# prepublish_scope_note — an embedded --self-test subject lane_runner_check.sh flagged as having
+# no dispatcher anywhere (2026-09-03): its own 7-lane known-pair (does validate.yml still call
+# selfcheck.sh — known-positive/negative, missing-workflow, commented-out call, real call beside a
+# stale commented one, the real `run: |` block-scalar shape, and echo-mention-is-not-a-call) lives
+# behind `--self-test`, and nothing runs it. It IS invoked at publish time (package.json
+# `prepublishOnly`) — but that is `check()`, the gate's default argument-less mode, running for
+# real; it never exercises the gate's OWN calibration. Not in the `for _subj in ...` loop above:
+# its terminal line is `── N pass / M fail`, never 캘리브레이션, same reason capability_registry_check
+# and capability_effect_probe were pulled out of that loop. Direct dispatch instead, same shape as
+# capability_effect_probe.sh above — whole-line terminal verdict with a non-zero PASS count, so an
+# emptied suite cannot certify itself. Ships via package.json files[], so absence is FAIL, not SKIP.
+if [ ! -f scripts/prepublish_scope_note.sh ]; then
+  echo "FAIL  prepublish_scope_note.sh: missing — it ships via package.json files[], so absence is deletion, not package mode"
+  fail=1
+elif _out=$(bash scripts/prepublish_scope_note.sh --self-test < /dev/null 2>&1) \
+     && printf '%s\n' "$_out" | grep -qE '^  ── [1-9][0-9]* pass / 0 fail$'; then
+  echo "PASS  prepublish_scope_note.sh --self-test ($(printf '%s\n' "$_out" | grep -oE '[0-9]+ pass / [0-9]+ fail' | tail -1))"
+else
+  echo "FAIL  prepublish_scope_note.sh: --self-test failed or produced no terminal verdict line"
+  _show_failure "$_out"
+  fail=1
+fi
+
 # memory-link-check — the memory store is a GRAPH (memory_intent_recall.md: nodes=files,
 # edges=[[links]], recall walks one hop). Measured 2026-07-28: 50 of 872 edges pointed at a note
 # that existed under a different separator and 22 at nothing — a dead edge returns nothing and is
@@ -1143,6 +1207,20 @@ else
   fail=1
 fi
 
+# ⓕ 되돌림 범용 프로브 (six_axis_review_2026-09-04 강화 #2) — 15+ 손짜기 되돌림 스크립트를
+# 대체하는 계기다. 자기 자신을 known-pair 로 검증한다(장식 앵커→1, 실물 앵커→0, 복원 보장) —
+# 앵커가 아니라 그 앵커를 검증하는 계기이므로 반드시 실행돼야 한다.
+if [ ! -f scripts/revert_probe.sh ]; then
+  _absent_subject_verdict "test_revert_probe_lanes.sh" "scripts/revert_probe.sh" || fail=1
+elif [ -f scripts/test_revert_probe_lanes.sh ]; then
+  if ! bash scripts/test_revert_probe_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_revert_probe_lanes.sh: revert_probe.sh present but its anchor is missing"
+  fail=1
+fi
+
 # 무효 워터마크 — 무효 회차의 «숫자 줄»이 자기 무효를 나르는가.
 # 🟥 회차 3 은 자기 게이트가 VOID 를 찍고도 그 숫자만 기록으로 넘어갔다(VOID 낱말은 0회).
 #    판정이 표 «밖»에 있었고 사람은 표를 복사하기 때문이다. 그 채널을 닫은 배선의 앵커다.
@@ -1533,6 +1611,20 @@ else
   fail=1
 fi
 
+# outbound-query PreToolUse 훅 — 위 CLI 가드의 **배선**(WebSearch|WebFetch). 레인이 두 층 판정
+# (override→deny · defaults→advisory), 미측정 4가지→deny, N/A 무음, 그리고 🟥 «출력에 토큰 값이
+# 없다»(H10)를 각각 짝으로 잡는다. 마지막 것이 이 훅의 존재 이유를 지키는 레인이다.
+if [ ! -f scripts/outbound_query_hook.sh ]; then
+  _absent_subject_verdict "test_outbound_query_hook_lanes.sh" "scripts/outbound_query_hook.sh" || fail=1
+elif [ -f scripts/test_outbound_query_hook_lanes.sh ]; then
+  if ! bash scripts/test_outbound_query_hook_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_outbound_query_hook_lanes.sh: outbound_query_hook.sh present but its anchor is missing"
+  fail=1
+fi
+
 if [ ! -f scripts/pipe_verdict_guard.sh ]; then
   _absent_subject_verdict "test_pipe_verdict_guard_lanes.sh" "scripts/pipe_verdict_guard.sh" || fail=1
 elif [ -f scripts/test_pipe_verdict_guard_lanes.sh ]; then
@@ -1544,6 +1636,17 @@ else
   fail=1
 fi
 
+if [ ! -f scripts/backtick_guard.sh ]; then
+  _absent_subject_verdict "test_backtick_guard_lanes.sh" "scripts/backtick_guard.sh" || fail=1
+elif [ -f scripts/test_backtick_guard_lanes.sh ]; then
+  if ! bash scripts/test_backtick_guard_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  test_backtick_guard_lanes.sh: backtick_guard.sh present but its anchor is missing"
+  fail=1
+fi
+
 if [ ! -f scripts/halffix_propagation_scan.sh ]; then
   _absent_subject_verdict "test_halffix_lanes.sh" "scripts/halffix_propagation_scan.sh" || fail=1
 elif [ -f scripts/test_halffix_lanes.sh ]; then

package/scripts/session_close_check.sh

@@ -269,6 +269,73 @@ fi
 
 fi
 
+# ── ①-f UTTERANCE LANDING (advisory) ─────────────────────────────────────────
+# WHY. 마감 체크는 **형식**만 본다 — 카드가 로그보다 새로운가, 필수 아티팩트가 있는가.
+# **운영자 발화가 기록에 착지했는지는 아무도 안 봤다.** `utterance_landing_check.sh` 가 그걸
+# 재려고 2026-08-08 에 지어졌는데 probes.tsv 를 **손으로** 짜야 해서 호출부가 0 개였다
+# (2026-09-05 실측: 이 파일에서 그 스크립트를 부르는 줄이 하나도 없었다). 그 사이의 빠진 칸이
+# `utterance_intake.sh` 다 — 전사본에서 발화를 뽑아 프로브를 자동 생성한다.
+# 근거: 같은 날 운영자의 교리·설계급 발화 6 건이 착지한 경로가 전부 **거버너의 손**이었다.
+#
+# 🟥 라벨이 `①-e` 가 아닌 이유: 그건 아래 stray-path 블록이 **이미 쓰고 있다.** 한 라벨을 두
+#    검사가 나눠 쓰면 「어느 ①-e 가 울렸나」를 아무도 못 가른다 — 이 배선을 준비한 진단은
+#    «①-e 는 비어 있다» 고 적었고, 그건 거짓이었다(레인 L13 이 «배선 전인데 초록» 으로 잡았다).
+#
+# 🟥 **advisory 다 — 막지 않는다.** 프로브는 키 낱말이라 기록이 같은 뜻을 다른 낱말로 적으면
+#    과차단이 난다(안전한 방향이지만 소음이다). 노출 사다리(shadow) 로 몇 세션 관찰한 뒤
+#    close push 차단으로 승격할지는 **운영자 결정**이고, 그때까지 FAIL 을 세우지 않는다.
+_UI_SUT="$FH/scripts/utterance_intake.sh"
+if [ -f "$_UI_SUT" ]; then
+  # 세션 id 의 정본은 `branch_claim.sh` 다 — **새 판정기를 짓지 않는다**(재발명 금지).
+  # `show` 의 `세션ID` 줄이 그 값이고, 값이 `pid-` 로 시작하면 런타임이 id 를 안 준 것이라
+  # 전사본을 특정할 수 없다. 그때는 «다른 세션 것을 대신 읽는» 대신 UNMEASURED 로 남긴다 —
+  # 남의 전사본으로 낸 착지 판정은 틀린 답이지 근사값이 아니다.
+  _UI_SID=""
+  if [ -f "$FH/scripts/branch_claim.sh" ]; then
+    _UI_SID=$(LC_ALL=C bash "$FH/scripts/branch_claim.sh" show 2>/dev/null \
+              | LC_ALL=C sed -n 's/^세션ID[[:space:]][[:space:]]*//p' | head -1)
+  fi
+  case "$_UI_SID" in pid-*|'') _UI_SID="" ;; esac
+  # 전사본 slug = 프로젝트 절대경로에서 `/` `.` `_` 를 `-` 로 (실측 2026-09-05, ~/.claude/projects 대조)
+  _UI_SLUG=$(printf '%s' "$FH" | tr '/._' '---')
+  _UI_TRDIR="${FH_TRANSCRIPT_DIR:-$HOME/.claude/projects/$_UI_SLUG}"
+  _UI_TR="$_UI_TRDIR/$_UI_SID.jsonl"
+  if [ -z "$_UI_SID" ]; then
+    echo "ℹ️  ①-f UNMEASURED — 세션 id 미상(런타임이 CLAUDE_CODE_SESSION_ID 를 안 줬다)"
+    echo "     전사본을 특정할 수 없다. «발화가 다 적혔다» 가 아니라 «못 쟀다» 다."
+  elif [ ! -f "$_UI_TR" ]; then
+    echo "ℹ️  ①-f UNMEASURED — 전사본 부재: $_UI_TR"
+    echo "     부재를 0 으로 접지 마라 — 발화가 없었다는 뜻이 아니다."
+  else
+    # 기록 대상: 오늘자 산출 + 상시 카드/UAP. 배열로 모은다(zsh word-split 함정 회피).
+    _UI_RECS=()
+    for _p in "$FH/tracks/_meta/fh_completed_$TODAY.md" \
+              "$FH/tracks/_meta/user_adaptation_profile.md" \
+              "$FH/tracks/_meta/reference_next_session_starter.md"; do
+      [ -f "$_p" ] && _UI_RECS+=("$_p")
+    done
+    for _p in "$FH"/tracks/_meta/fh_signal_"$TODAY"_*.md "$FH"/tracks/*/*_"$TODAY".md; do
+      [ -f "$_p" ] && _UI_RECS+=("$_p")
+    done
+    if [ "${#_UI_RECS[@]}" -eq 0 ]; then
+      echo "⚠️  ①-f 오늘자 기록 파일이 하나도 없다 — 발화 착지를 잴 대상이 없다(UNMEASURED)"
+      echo "     ④/⑤ 가 아직 안 돌았다는 뜻일 수 있다. 마감 순서를 확인해라."
+    else
+      _UI_OUT=$(bash "$_UI_SUT" "$_UI_TR" "${_UI_RECS[@]}" 2>&1); _UI_RC=$?
+      case "$_UI_RC" in
+        0) echo "✅ ①-f 발화 착지 — 프로브 전건 착지 (${#_UI_RECS[@]} 파일 대조)"
+           echo "     ⚠️ 발화별 최장 토큰 ⌈n/2⌉ 일치 기준(키 2 개 이하는 OR) — «제대로 적혔다» 의 증명이 아니다." ;;
+        1) echo "⚠️  ①-f 미착지 발화가 있다 — advisory, 막지 않는다. 아래를 **확인**해라(기록 강제 아님):"
+           printf '%s\n' "$_UI_OUT" | sed 's/^/     /' ;;
+        *) echo "⚠️  ①-f 발화 착지 검사 UNMEASURED/계기이상 (rc=$_UI_RC) — 0 으로 읽지 마라"
+           printf '%s\n' "$_UI_OUT" | sed 's/^/     /' ;;
+      esac
+    fi
+  fi
+else
+  echo "⚠️  ①-f utterance_intake.sh 없음 — skipped, not passed (UNMEASURED)"
+fi
+
 # ② FH assets changed today → harvest-loop owed
 # NOTE: no `grep -q` here — under `set -o pipefail`, -q's early exit SIGPIPEs git log (141),
 # masking a real match as pipeline failure so the warning NEVER fired on true positives
@@ -704,5 +771,38 @@ else
   echo "⚠️  ①-e stray_path_scan.sh 없음 — skipped, not passed"
 fi
 
+# ── ①-f PUSH-ZONE advisory (surface-not-block; mirrors the pre-push hook's own zone check) ────
+# WHY: templates/.git-hooks/pre-push blocks a single push whose remote sits outside the owner-
+# account list, but it only ever sees the ONE push in front of it. The 2026-07-26 miss this whole
+# axis exists for was a multi-repo ROUND — CLAUDE.local.md §REST API push 계정규칙 was applied
+# correctly to one org repo and forgotten on another in the SAME round. `scripts/push_zone_check.sh`
+# is the hand-run ENUMERATE tool for that round; wiring it here means it runs at least once per
+# close without the operator separately remembering to ask for it — same shape as the ①-b open-PR
+# sweep above. Advisory only: it lists, it never blocks (CLAUDE.md §Surface-Class Degrade Invariant,
+# reversible half — a session-close check is not the irreversible boundary; that is the pre-push
+# hook's job). Applicability is mechanical: both the script and an owner-account list must exist,
+# or this reports UNCALIBRATED rather than guessing.
+_PZ_SCRIPT="$FH/scripts/push_zone_check.sh"
+_PZ_OWNERS="${PUSH_ZONE_OWNERS:-$FH/.claude/rules/.push-zone-owners}"
+if [ -x "$_PZ_SCRIPT" ] && [ -f "$_PZ_OWNERS" ]; then
+  if _pz_out=$(bash "$_PZ_SCRIPT" 2>&1); then
+    # Counts only — the enumerator prints owner-account names and per-repo owners, and this close
+    # output lands in transcripts and session cards. The pre-push block never prints the list; this
+    # advisory must not either (codex #9, 2026-09-05). The names are one command away for the operator.
+    _pz_n=$(printf '%s\n' "$_pz_out" | grep -cE '^(✅|🔶) ' 2>/dev/null || true)
+    _pz_rest=$(printf '%s\n' "$_pz_out" | grep -cE '^🔶 ' 2>/dev/null || true)
+    echo "⚠️  ①-f push-zone: ${_pz_n:-0} repo(s) enumerated · ${_pz_rest:-0} outside the owner accounts (REST channel) — names withheld here; run: bash scripts/push_zone_check.sh"
+  else
+    # Verified 2026-09-05: push_zone_check.sh does not exit non-zero merely because `gh` is
+    # missing (its own `active="(unknown)"` fallback absorbs that) — the only documented non-zero
+    # exit is UNCALIBRATED for a missing owner list, already excluded by the `-f "$_PZ_OWNERS"`
+    # guard above. A non-zero exit reaching here is therefore an unanticipated failure; report it
+    # as UNMEASURED rather than silently treating empty/partial output as "nothing to enumerate".
+    echo "⚠️  ①-f push-zone: UNMEASURED — push_zone_check.sh exited non-zero, could not enumerate"
+  fi
+else
+  echo "⏭️  ①-f push-zone UNCALIBRATED — script or owner-account list absent"
+fi
+
 echo "── close check: $([ "$FAIL" -eq 0 ] && echo CONSISTENT || echo VIOLATIONS) ──"
 exit "$FAIL"