@chrono-meta/fh-gate 2.15.1 → 3.1.0

package/scripts/test_package_coverage_lanes.sh

@@ -36,7 +36,9 @@ trap 'rm -rf "$TMP"' EXIT
 
 pass=0; fail=0; skipped=0
 ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
-bad() { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+# $2 (optional) = the actual stdout/stderr/rc this case caught — printed so a red lane in CI is
+# diagnosable without re-running it by hand. Truncated/flattened like the node-check lanes' bad().
+bad() { printf '  ❌ %s\n' "$1"; [ -n "${2:-}" ] && printf '     got: %s\n' "$(printf '%s' "$2" | tr '\n' '|' | cut -c1-220)"; fail=$((fail+1)); }
 # A skip is COUNTED and reported. An uncounted skip is how "could not run" becomes indistinguishable
 # from "ran and passed" in the summary line — measured on this very suite in review round 2, where a
 # broken git produced "7 passed, 0 failed" and exit 0 while the real-worktree claim went untested.
@@ -70,23 +72,30 @@ make_tree() { # make_tree <dir> <git_shape> <cover_target:yes|no> [omit_manifest
 }
 
 run_tree() { bash "$1/scripts/package_coverage_check.sh" 2>&1; }
-rc_tree()  { bash "$1/scripts/package_coverage_check.sh" >/dev/null 2>&1; echo $?; }
+# 🟥 no more rc_tree(): it used to re-run the subject a SECOND time just to get $? (`out=$(run_tree
+# ...); rc=$(rc_tree ...)` — two executions of the same script, so a nondeterministic subject could
+# report an (out, rc) pair that never co-occurred in either real run). Every call site below now
+# does `out=$(run_tree ...); rc=$?` — one execution, $? read off THAT command substitution.
 
 # Assert a POSITIVE outcome, never merely the absence of the SKIP line. Cross-family review caught
 # the first draft here: it checked only that `SKIP  package-coverage` was missing, so a checker that
 # exited 1 on every worktree — the opposite defect, equally broken — would have passed the lane that
 # exists to prove the worktree path works. "Did not say the wrong thing" is not "did the right
 # thing"; a lane phrased as a negative can only ever fail one way.
+# Both functions below stash their single execution's output/rc in _LAST_OUT/_LAST_RC (not `local`,
+# deliberately — the caller reads them straight off the one run instead of re-invoking the subject a
+# second time just to build a diagnostic string, which would be the same two-executions-for-one-
+# verdict shape the L3–L7 dual-execution fix below removes).
 ran_clean() { # ran_clean <dir> -> 0 iff the check actually ran AND reported a clean scan
-  local d="$1" o rc
-  o=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); rc=$?
-  [ "$rc" -eq 0 ] && printf '%s' "$o" | grep -q 'PASS  package-coverage' \
-    && ! printf '%s' "$o" | grep -q 'SKIP  package-coverage'
+  local d="$1"
+  _LAST_OUT=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); _LAST_RC=$?
+  [ "$_LAST_RC" -eq 0 ] && printf '%s' "$_LAST_OUT" | grep -q 'PASS  package-coverage' \
+    && ! printf '%s' "$_LAST_OUT" | grep -q 'SKIP  package-coverage'
 }
 caught_defect() { # caught_defect <dir> -> 0 iff the check FOUND the planted omission
-  local d="$1" o rc
-  o=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); rc=$?
-  [ "$rc" -eq 1 ] && printf '%s' "$o" | grep -q 'scripts/helper.sh'
+  local d="$1"
+  _LAST_OUT=$(bash "$d/scripts/package_coverage_check.sh" 2>&1); _LAST_RC=$?
+  [ "$_LAST_RC" -eq 1 ] && printf '%s' "$_LAST_OUT" | grep -q 'scripts/helper.sh'
 }
 # A CLEAN LANE ALONE PROVES NOTHING ABOUT THE WORKTREE PATH. Cross-family review round 2 demonstrated
 # this by EXECUTION: it replaced the subject with a mutant that printed `PASS  package-coverage`
@@ -99,11 +108,11 @@ wt_pair() { # wt_pair <label> <dir> <git_shape>
   local label="$1" d="$2" shape="$3"
   make_tree "$d" "$shape" yes
   if ! ran_clean "$d"; then
-    bad "$label — clean leg: did not run to a PASS ($(run_tree "$d" | head -1))"; return
+    bad "$label — clean leg: did not run to a PASS (rc=$_LAST_RC)" "$_LAST_OUT"; return
   fi
   make_tree "$d" "$shape" no        # identical tree, files[] no longer covers the referenced path
   if ! caught_defect "$d"; then
-    bad "$label — DEFECT leg: planted omission not caught, so the clean PASS proved nothing"; return
+    bad "$label — DEFECT leg: planted omission not caught, so the clean PASS proved nothing (rc=$_LAST_RC)" "$_LAST_OUT"; return
   fi
   ok "$label"
 }
@@ -171,15 +180,20 @@ else
     esac
   }
   mkdir -p "$TMP/emptytpl"
-  if git "${GIT_ISO[@]}" -C "$TMP/realrepo" init -q --template="$TMP/emptytpl" . >/dev/null 2>&1 \
+  # The whole fixture-build chain runs as ONE group so its combined stdout+stderr lands in one
+  # variable instead of /dev/null — a failed build used to report only "could not be built", with
+  # no way to tell which of the four steps broke or why.
+  _l1b_ok=1
+  _l1b_out="$( { git "${GIT_ISO[@]}" -C "$TMP/realrepo" init -q --template="$TMP/emptytpl" . \
      && _gitdir_ok \
-     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" commit -q --allow-empty -m init >/dev/null 2>&1 \
-     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" worktree add -q --detach "$TMP/realwt" >/dev/null 2>&1 \
-     && [ -f "$TMP/realwt/.git" ]; then
+     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" commit -q --allow-empty -m init \
+     && git "${GIT_ISO[@]}" -C "$TMP/realrepo" worktree add -q --detach "$TMP/realwt" \
+     && [ -f "$TMP/realwt/.git" ]; } 2>&1 )" || _l1b_ok=0
+  if [ "$_l1b_ok" -eq 1 ]; then
     wt_pair "L1-b real \`git worktree add\` (.git is a genuine gitdir pointer): scans for real" \
             "$TMP/realwt" none          # the REAL .git file is already in place; do not overwrite it
   else
-    bad "L1-b git IS installed but the real-worktree fixture could not be built — the claim was testable and was not tested"
+    bad "L1-b git IS installed but the real-worktree fixture could not be built — the claim was testable and was not tested" "$_l1b_out"
   fi
 fi
 
@@ -190,11 +204,11 @@ wt_pair "L2 ordinary checkout (.git is a DIR): scans for real — both legs" "$T
 # The widening from -d to -e must not cost the legitimate skip. An installed npm package has no
 # .git of either kind; making it fail there would fire on every consumer running `npm test`.
 make_tree "$TMP/l3" none yes
-out=$(run_tree "$TMP/l3"); rc=$(rc_tree "$TMP/l3")
+out=$(run_tree "$TMP/l3"); rc=$?
 if printf '%s' "$out" | grep -q 'SKIP  package-coverage' && [ "$rc" -eq 0 ]; then
   ok "L3 package mode (no .git): still skips, exit 0"
 else
-  bad "L3 package mode (no .git): expected SKIP+0, got rc=$rc / $(printf '%s' "$out" | head -1)"
+  bad "L3 package mode (no .git): expected SKIP+0, got rc=$rc" "$out"
 fi
 
 # ── L4 · a checkout with no manifest is UNMEASURED, not clean ────────────────────────
@@ -203,48 +217,60 @@ fi
 # file list cannot be read, which is "cannot measure", not "nothing to measure". An anchor that
 # pins the wrong direction is worse than no anchor — it makes the hole look deliberate.
 make_tree "$TMP/l4" dir yes omit
-out=$(run_tree "$TMP/l4"); rc=$(rc_tree "$TMP/l4")
+out=$(run_tree "$TMP/l4"); rc=$?
 if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'UNMEASURED, not clean'; then
   ok "L4 .git present but no package.json: FAILS as unmeasured, not a clean skip"
 else
-  bad "L4 no package.json: expected exit 1 (unmeasured), got rc=$rc / $(printf '%s' "$out" | head -1)"
+  bad "L4 no package.json: expected exit 1 (unmeasured), got rc=$rc" "$out"
 fi
 
 # ── L5/L6 · KNOWN PAIR ───────────────────────────────────────────────────────────────
 # Same tree twice; the ONLY difference is whether files[] covers the referenced path.
 # L5 known-POSITIVE: referenced, exists, not shipped -> must FAIL.
 make_tree "$TMP/l5" dir no
-out=$(run_tree "$TMP/l5"); rc=$(rc_tree "$TMP/l5")
+out=$(run_tree "$TMP/l5"); rc=$?
 if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'scripts/helper.sh'; then
   ok "L5 known-positive (referenced ∧ exists ∧ ¬shipped): FAIL, names the path"
 else
-  bad "L5 known-positive: expected exit 1 naming scripts/helper.sh, got rc=$rc"
+  bad "L5 known-positive: expected exit 1 naming scripts/helper.sh, got rc=$rc" "$out"
 fi
 
 # L6 known-NEGATIVE: identical, but the path is in files[] -> must PASS.
 make_tree "$TMP/l6" dir yes
-out=$(run_tree "$TMP/l6"); rc=$(rc_tree "$TMP/l6")
+out=$(run_tree "$TMP/l6"); rc=$?
 if [ "$rc" -eq 0 ] && printf '%s' "$out" | grep -q 'PASS  package-coverage'; then
   ok "L6 known-negative (same tree, path shipped): PASS"
 else
-  bad "L6 known-negative: expected exit 0 PASS, got rc=$rc"
+  bad "L6 known-negative: expected exit 0 PASS, got rc=$rc" "$out"
 fi
 
 # ── L7 · the impossible-zero guard is not reachable by an empty files[] ──────────────
 # A manifest with no shipped docs must report the extractor as broken, not print a pass.
 mkdir -p "$TMP/l7/scripts"; cp "$SUBJECT" "$TMP/l7/scripts/"; mkdir -p "$TMP/l7/.git"
 printf '{"files":[]}\n' > "$TMP/l7/package.json"
-out=$(run_tree "$TMP/l7"); rc=$(rc_tree "$TMP/l7")
+out=$(run_tree "$TMP/l7"); rc=$?
 if [ "$rc" -eq 1 ] && printf '%s' "$out" | grep -q 'the check broke, it did not pass'; then
   ok "L7 zero shipped docs: reported as broken extractor, not as a pass"
 else
-  bad "L7 zero shipped docs: expected exit 1 'check broke', got rc=$rc"
+  bad "L7 zero shipped docs: expected exit 1 'check broke', got rc=$rc" "$out"
 fi
 
 echo
 if [ "$skipped" -gt 0 ]; then
   echo "package-coverage lanes: ${pass} passed, ${fail} failed, ${skipped} UNCALIBRATED (not verified here)"
 else
-  echo "package-coverage lanes: ${pass} passed, ${fail} failed"
+  
+# ── lane 7: tarball oracle JSON without files[] → text-listing fallback (CI 2026-09-04, v3.0.0) ──
+# Known-pair: stub npm returns JSON lacking files[] but delegates the text `pack --dry-run` to the
+# real npm → PASS (7a). Stub returns the same JSON and an EMPTY text listing → ORACLE_UNAVAILABLE rc=2 (7b).
+cd "$REPO_ROOT" || exit 10; _REAL_NPM=$(command -v npm); _ST=$(mktemp -d)   # earlier lanes cd into fixtures — the subject reads .git/package.json from cwd
+printf '#!/bin/bash\nif [ "$*" = "pack --dry-run --json" ]; then echo "[{\\"id\\":\\"x\\"}]"; else exec %s "$@"; fi\n' "$_REAL_NPM" > "$_ST/npm"; chmod +x "$_ST/npm"
+o=$(PATH="$_ST:$PATH" bash "$SUBJECT" --vs-tarball 2>&1); rc=$?
+if [ "$rc" = 0 ] && printf '%s' "$o" | grep -q "^PASS  package-coverage"; then echo "  ✅ lane 7a: JSON without files[] → text listing fallback PASSes"; pass=$((pass+1)); else echo "  ❌ lane 7a: fallback did not PASS (rc=$rc)"; printf "%s\n" "$o" | grep -E "UNAVAILABLE|head:" | cut -c1-220; fail=$((fail+1)); fi
+printf '#!/bin/bash\nif [ "$*" = "pack --dry-run --json" ]; then echo "[{\\"id\\":\\"x\\"}]"; elif [ "$*" = "pack --dry-run" ]; then exit 0; else exec %s "$@"; fi\n' "$_REAL_NPM" > "$_ST/npm"
+o=$(PATH="$_ST:$PATH" bash "$SUBJECT" --vs-tarball 2>&1); rc=$?
+if [ "$rc" = 2 ] && printf '%s' "$o" | grep -q "UNAVAILABLE"; then echo "  ✅ lane 7b: JSON without files[] AND empty text listing → UNAVAILABLE rc=2 (fail-closed)"; pass=$((pass+1)); else echo "  ❌ lane 7b: expected rc=2 UNAVAILABLE, got rc=$rc"; fail=$((fail+1)); fi
+rm -rf "$_ST"
+echo "package-coverage lanes: ${pass} passed, ${fail} failed"
 fi
 [ "$fail" -eq 0 ] || exit 1

package/scripts/test_pipe_verdict_guard_lanes.sh

@@ -45,9 +45,9 @@ expect() {
 echo "[pipe-verdict-guard] known pairs"
 echo "-- R1: PIPESTATUS under zsh (deterministic) --"
 # The exact shape emitted 6× in this project, including twice on 2026-07-31.
-expect "R1 the measured shape"            HIT   'bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'
-expect "R1 any index"                     HIT   'a | b; rc=${PIPESTATUS[1]}'
-expect "R1 inside a larger command"       HIT   'cd /r && npm t | tail; E=${PIPESTATUS[0]}; echo $E'
+expect "R1 the measured shape"            HIT   'bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'  # portability-noqa: fixture string fed to pipe_verdict_guard.sh for static analysis, never executed by this shell
+expect "R1 any index"                     HIT   'a | b; rc=${PIPESTATUS[1]}'  # portability-noqa: same as above
+expect "R1 inside a larger command"       HIT   'cd /r && npm t | tail; E=${PIPESTATUS[0]}; echo $E'  # portability-noqa: same as above
 # zsh's own spelling is correct here and must never be flagged.
 expect "R1 zsh spelling is CLEAN"         CLEAN 'a | b; rc=$pipestatus[1]'
 
@@ -56,6 +56,22 @@ expect "R2 tail then \$?"                  HIT   'bash gate.sh | tail -20; echo
 expect "R2 head then \$?"                  HIT   'make test | head -40; rc=$?'
 expect "R2 cat then \$?"                   HIT   'run.sh | cat; if [ $? -ne 0 ]; then echo bad; fi'
 
+echo "-- R2 «바로 다음 문장» 좁힘 (2026-09-06, 운영자 실사용 신고) --"
+# 🟥 종전 꼬리 `[;&].*\$\?` 는 파이프 뒤 **어디든** `$?` 가 있으면 잡았다 — 그게 다른
+#   명령의 것이어도. 한 호출에 문장이 여럿인 실사용 커맨드는 거의 항상 걸렸고, 그건
+#   «100% FP 는 정작 중요한 한 건을 무시하도록 훈련시킨다» 는 이 훅 자신의 경고 그대로다.
+expect "R2 좁힘: 사이에 다른 명령이 끼면 그 \$? 는 그 명령의 것" CLEAN \
+       'out=$(a 2>&1); rc=$?; echo "$out" | tail -1; b; echo $?'
+expect "R2 좁힘: 두 문장 뒤의 \$? 도 아니다"                    CLEAN \
+       'pytest | tail -2; echo done; echo $?'
+expect "R2 좁힘: 파이프 앞에서 잡은 rc 는 원래 정상"             CLEAN \
+       'out=$(pytest 2>&1); rc=$?; echo "$out" | tail -2 | head -1; echo "rc=$rc"'
+# 짝 — 좁히다가 진짜 결함을 죽이면 그게 과교정이다
+expect "R2 좁힘 짝: 직후 문장의 \$? 는 여전히 잡는다"           HIT \
+       'pytest 2>&1 | tail -2; echo "rc=$?"'
+expect "R2 좁힘 짝: && 로 이어진 직후 읽기도 잡는다"             HIT \
+       'make test | head -5 && echo $?'
+
 echo "-- R2 false-positive lanes: the 7 shapes this repo actually ships --"
 # Every one of these was hand-verified on 2026-07-31 as CORRECT: the final stage IS the command
 # whose status is wanted. A detector that flags these is noise, and noise trains dismissal.
@@ -83,7 +99,7 @@ echo x | grep -q y
 rc=$?'
 # B: zsh accepts `$PIPESTATUS[0]` without braces; the brace-anchored regex missed it.
 expect "B PIPESTATUS without braces"      HIT   'a | b; rc=$PIPESTATUS[0]'
-expect "B braced form still caught"       HIT   'a | b; rc=${PIPESTATUS[0]}'
+expect "B braced form still caught"       HIT   'a | b; rc=${PIPESTATUS[0]}'  # portability-noqa: fixture string fed to pipe_verdict_guard.sh for static analysis, never executed by this shell
 
 echo "-- D: statement-continuation flatten + wrapped filter (leg-C MED round, 2026-08-01) --"
 # The blanket newline→`;` rewrite broke the CONTINUATION shapes: a newline after `|`/`&&` or a
@@ -167,7 +183,7 @@ echo "-- C: delivery channel (closes N=8 — detection without delivery is decor
 # NAMED RESIDUAL (cross-family LOW, accepted): $(…) capture strips NUL bytes, so a mutant emitting
 # NUL+JSON would pass C1. The producer's hits text is static ASCII+⚠️ with no NUL source, so the
 # lane does not pay for a byte-exact harness; revisit only if the producer ever emits dynamic bytes.
-HIT_CMD='bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'
+HIT_CMD='bash x.sh | tail -5; echo "exit=${PIPESTATUS[0]}"'  # portability-noqa: fixture string fed to the guard for static analysis, never executed by this shell
 payload() { python3 -c 'import json,sys; print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]}}))' "$1"; }
 
 # All C lanes measure ONE invocation: stdout, stderr, and exit code from the same run (a pair of
@@ -226,6 +242,16 @@ else
   printf '  ❌ %-52s rc=%s out=%s\n' "C4 ascii-codec env: JSON still delivered" "$c_rc" "$c_out"; fail=$((fail+1))
 fi
 
+# ── R3 — redirection-only statement (zsh NULLCMD=cat reads an open-pipe stdin). Measured 2026-09-04:
+# nine `git commit -q -F - <<'CEOF' … CEOF ⏎ 2>&1)` tasks in two sessions hung after the commit landed.
+# Fixtures are the measured shape verbatim (P), the same shape with the redirect moved onto the
+# command line (N1 — the one-token fix), and a one-word markdown blockquote INSIDE the heredoc body
+# (N2 — data, not a redirection; must stay CLEAN or the guard fires on every quoted commit message).
+expect "R3 measured shape: bare 2>&1 line closes \$( )" HIT   $'out=$(git commit -q -F - <<\'CEOF\'\nfix: x\n\nbody\nCEOF\n2>&1); rc=$?; echo "commit rc=$rc"'
+expect "R3 bare > file line after a heredoc"           HIT   $'cat <<\'EOF\'\nhello\nEOF\n> out.txt\necho done'
+expect "R3 fixed: 2>&1 on the command line"            CLEAN $'out=$(git commit -q -F - 2>&1 <<\'CEOF\'\nfix: x\n\nbody\nCEOF\n); rc=$?; echo "commit rc=$rc"'
+expect "R3 blockquote inside heredoc body is data"     CLEAN $'out=$(git commit -q -F - 2>&1 <<\'CEOF\'\nfix: x\n\n> 정본\n> see also)\nCEOF\n); rc=$?'
+
 echo
 if [ "$fail" -eq 0 ]; then
   echo "[pipe-verdict-guard] ✅ all $pass known pairs hold"; exit 0

package/scripts/test_precommit_pointer_index_lanes.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# test_precommit_pointer_index_lanes.sh — known pair for templates/.git-hooks/pre-commit [Pointers]:
+# the Detail-pointer gate must read the STAGED blob, not the working tree. Found 2026-09-03 (arm C
+# wt2, A3 triage): `[ -f "$REPO_ROOT/$f" ] || continue` let a staged .md with a broken
+# `**Detail**: See §X` pointer land silently when the file was rm'd from disk after staging
+# (git commits the INDEX). Runs in a disposable shallow clone — never touches this checkout.
+#   P1 staged broken pointer, file rm'd from disk       → commit BLOCKED (❌ pointer line printed)
+#   N1 staged VALID pointer, file rm'd from disk        → [Pointers] block runs with no ❌ (control: index read works)
+#   N2 staged broken pointer, file still on disk        → BLOCKED (the pre-fix path also caught this — control)
+# Usage: bash scripts/test_precommit_pointer_index_lanes.sh [--hook <path>]   (default = templates/.git-hooks/pre-commit)
+set -u; ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"; HOOK="$ROOT/templates/.git-hooks/pre-commit"
+[ "${1:-}" = "--hook" ] && HOOK="$2"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT; pass=0; fail=0
+git clone -q --depth 1 "file://$ROOT" "$T/r" 2>/dev/null || { echo "❌ clone failed"; exit 10; }
+cd "$T/r" && git config user.email t@t && git config user.name t && mkdir -p .git/hooks && cp "$HOOK" .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
+mkdir -p docs/lanefix; printf '## §Alive\ntext\n' > docs/lanefix/target.md; git add docs/lanefix/target.md; git -c core.hooksPath=/dev/null commit -qm base 2>/dev/null
+run_case(){ local label="$1" want="$2" ptr="$3" rm_after="$4"
+  printf '# probe\n\n> **Detail**: See `docs/lanefix/target.md §%s`\n' "$ptr" > docs/lanefix/probe.md
+  git add docs/lanefix/probe.md; [ "$rm_after" = 1 ] && rm -f docs/lanefix/probe.md
+  out=$(FH_SKIP_GATE_AXES=1 git commit -qm probe 2>&1); rc=$?
+  # Discriminate on the [Pointers] block itself, not on commit rc: the fixture clone carries no
+  # marker/manifest, so OTHER axes block every commit here — rc is not this lane's signal.
+  if printf '%s' "$out" | grep -q "Detail pointer §"; then got=BLOCK_PTR
+  elif printf '%s' "$out" | grep -q "unreadable from the index"; then got=BLOCK_INDEX
+  elif printf '%s' "$out" | grep -q "\[Pointers\]"; then got=PTR_OK
+  else got=PTR_NOT_RUN; fi
+  git reset -q --hard HEAD 2>/dev/null;  # noqa: destructive-op — disposable clone under mktemp git rm -q --cached docs/lanefix/probe.md 2>/dev/null; rm -f docs/lanefix/probe.md
+  if [ "$got" = "$want" ]; then printf '  ✅ %-48s %s\n' "$label" "$got"; pass=$((pass+1)); else printf '  ❌ %-48s %s (expected %s)\n' "$label" "$got" "$want"; fail=$((fail+1)); printf '%s\n' "$out" | grep -E "Pointers|❌" | head -4 | sed 's/^/       /'; fi; }
+echo "[precommit-pointer-index] hook=$HOOK"
+run_case "P1 broken pointer, staged then rm'd from disk"  BLOCK_PTR Ghost 1
+run_case "N1 valid pointer, staged then rm'd (index read)" PTR_OK    Alive 1
+run_case "N2 broken pointer, still on disk (old path too)" BLOCK_PTR Ghost 0
+echo "[precommit-pointer-index] $pass passed, $fail failed"; [ "$fail" -eq 0 ]

package/scripts/test_preprep_diagram_lanes.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# test_preprep_diagram_lanes.sh — L12 diagram 레인 + diagram_from_json.py 거부 경로의 known-pair.
+#
+# 재는 것:
+#   K1 known-negative  영수증·지문·validate·폭·viewBox·pad 전부 맞으면 findings 0
+#   K2 stale          JSON 을 한 글자 고치면 «지문 다름» 1건을 이름으로 짚나
+#   K3 resolution     PNG 실제 폭(IHDR)이 하한 미달이면 1건 — 영수증 자기신고(png_size)가 아니라 헤더를 읽나
+#   K4 viewbox        viewBox 폭 > 상한이면 1건(글자 배율)
+#   K5 unmeasured     영수증 없는 PNG 는 findings 0 + UNMEASURED 노트(0 으로 안 접나)
+#   K6 not-configured diagram_source 표면이 없으면 NOT_CONFIGURED(통과 아님)
+#   K7 refuse         diagram_from_json.py 가 validate 실패 JSON 을 **굽지 않나** — archify 는 스텁으로 대체
+#                     (실물 archify·Chrome 없이 도는 레인이어야 CI 에서 앵커다)
+# 🟥 archify·Chrome 이 없어도 돌아야 한다 — 그래서 K7 은 스텁 archify(ok:false)로 «거부»만 잰다.
+#    «굽힘» 쪽 실사용은 tracks-meta/dispatch/2026-09-05_archify-preprep/REPORT.md 가 기록한다.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SKILL="$HERE/plugins/fh-commons/skills/preprep"
+PASS=0; FAIL=0
+ok(){ echo "  ✅ $1"; PASS=$((PASS+1)); }
+ng(){ echo "  ❌ $1"; FAIL=$((FAIL+1)); }
+command -v python3 >/dev/null 2>&1 || { echo "  ⚠️  UNMEASURED — python3 unavailable (not a pass)"; echo "diagram lanes: SKIPPED (not passed)"; exit 0; }
+
+out=$(cd "$SKILL" && python3 - <<'PY' 2>&1
+import sys, os, json, hashlib, struct, zlib, tempfile, subprocess
+sys.path.insert(0, '.')
+import lane_diagram as LD
+def sha(p): return hashlib.sha256(open(p,'rb').read()).hexdigest()
+def png(path, w, h=2):
+    # 순수 표준 라이브러리 PNG(회색 1바이트/픽셀) — 폭만 의미 있다
+    raw = b''.join(b'\x00' + b'\x80'*w for _ in range(h))
+    def chunk(t, d): return struct.pack('>I', len(d)) + t + d + struct.pack('>I', zlib.crc32(t+d) & 0xffffffff)
+    open(path,'wb').write(b'\x89PNG\r\n\x1a\n' + chunk(b'IHDR', struct.pack('>IIBBBBB', w, h, 8, 0, 0, 0, 0)) + chunk(b'IDAT', zlib.compress(raw)) + chunk(b'IEND', b''))
+d = tempfile.mkdtemp(prefix='l12_')
+spec = os.path.join(d, 'fig.workflow.json'); json.dump({'diagram_type':'workflow','nodes':[{'id':'a','label':'개발'}]}, open(spec,'w'))
+def receipt(pngp, **kw):
+    r = {'spec_sha256': sha(spec), 'validate': {'ok': True, 'profile': 'showcase'}, 'viewbox_w': 720, 'pad': 0.03, 'png_size': [3840, 2]}
+    r.update(kw); json.dump(r, open(pngp[:-4] + '.receipt.json', 'w'))
+def run(surfs, extra=None):
+    cfg = {'surfaces': surfs, 'diagram': {'min_px': 3840, 'max_viewbox_w': 720, 'min_pad': 0.02}}
+    return LD.scan(cfg, d)
+R = {}
+# K1 negative
+p1 = os.path.join(d, 'ok.png'); png(p1, 3840); receipt(p1)
+f, n = run([{'id':'fig','path':'fig.workflow.json','kind':'diagram_source','render':'ok.png'}]); R['K1'] = len(f)
+# K2 stale: JSON 고침
+open(spec,'a').write('\n'); f, n = run([{'id':'fig','path':'fig.workflow.json','kind':'diagram_source','render':'ok.png'}])
+R['K2'] = [x[2] for x in f]
+receipt(p1)  # 다시 맞춤
+# K3 resolution: 영수증은 3840 이라 «말하지만» 실제 헤더는 1000
+p3 = os.path.join(d, 'small.png'); png(p3, 1000); receipt(p3, png_size=[3840, 2])
+f, n = run([{'id':'fig','path':'fig.workflow.json','kind':'diagram_source','render':'small.png'}]); R['K3'] = [x[2] for x in f]
+# K4 viewbox
+p4 = os.path.join(d, 'wide.png'); png(p4, 3840); receipt(p4, viewbox_w=1137)
+f, n = run([{'id':'fig','path':'fig.workflow.json','kind':'diagram_source','render':'wide.png'}]); R['K4'] = [x[2] for x in f]
+# K5 unmeasured (영수증 없음)
+p5 = os.path.join(d, 'hand.png'); png(p5, 3840)
+f, n = run([{'id':'fig','path':'fig.workflow.json','kind':'diagram_source','render':'hand.png'}]); R['K5'] = {'n': len(f), 'unm': any('UNMEASURED' in s for s in n)}
+# K6 not configured
+f, n = run([]); R['K6'] = {'n': len(f), 'nc': any('NOT_CONFIGURED' in s for s in n)}
+# K7 refuse — 스텁 archify(항상 ok:false) + 가짜 chrome. PNG 가 «안 생겨야» 한다
+stub = os.path.join(d, 'archify_stub.mjs'); open(stub,'w').write('console.log(JSON.stringify({ok:false,diagnostics:[{code:"stub/fail",message:"stub"}]}))')
+fake_chrome = os.path.join(d, 'chrome'); open(fake_chrome,'w').write('#!/bin/sh\nexit 0\n'); os.chmod(fake_chrome, 0o755)
+outp = os.path.join(d, 'refused.png')
+import shutil
+if shutil.which('node'):
+    r = subprocess.run([sys.executable, 'diagram_from_json.py', spec, '--out', outp, '--archify', stub, '--chrome', fake_chrome], capture_output=True, text=True)
+    R['K7'] = {'rc': r.returncode, 'png': os.path.exists(outp), 'msg': 'REFUSE' in r.stdout}
+else:
+    R['K7'] = {'rc': 'NO_NODE'}
+print(json.dumps(R, ensure_ascii=False))
+PY
+); rc=$?
+[ $rc -eq 0 ] || { echo "  ❌ INSTRUMENT ERROR — lane_diagram 실행 실패 (rc=$rc): $out"; exit 1; }
+g(){ python3 -c "import json,sys;v=json.loads(sys.argv[1]);exec('r=v'+sys.argv[2]);print(r)" "$out" "$1"; }
+[ "$(g "['K1']")" = "0" ] && ok "K1 known-negative: 다 맞으면 0건" || ng "K1 오탐 $(g "['K1']")건"
+[ "$(g "['K2']")" = "['stale']" ] && ok "K2 stale: JSON 고치면 «stale» 1건을 이름으로" || ng "K2 실패: $(g "['K2']")"
+[ "$(g "['K3']")" = "['resolution']" ] && ok "K3 resolution: 영수증이 3840 이라 해도 IHDR 1000 을 잡는다(자기신고 아님)" || ng "K3 실패: $(g "['K3']")"
+[ "$(g "['K4']")" = "['viewbox']" ] && ok "K4 viewbox: 1137 > 720 을 잡는다(글자 배율)" || ng "K4 실패: $(g "['K4']")"
+[ "$(g "['K5']['n']")" = "0" ] && [ "$(g "['K5']['unm']")" = "True" ] && ok "K5 영수증 없는 손그림 = UNMEASURED(0 아님·통과 아님)" || ng "K5 실패: $(g "['K5']")"
+[ "$(g "['K6']['n']")" = "0" ] && [ "$(g "['K6']['nc']")" = "True" ] && ok "K6 표면 없음 = NOT_CONFIGURED" || ng "K6 실패: $(g "['K6']")"
+k7=$(g "['K7']")
+case "$k7" in
+  *NO_NODE*) echo "  ⏭  K7 거부 경로 — node 부재라 UNMEASURED (통과 아님)";;
+  *) [ "$(g "['K7']['rc']")" = "1" ] && [ "$(g "['K7']['png']")" = "False" ] && [ "$(g "['K7']['msg']")" = "True" ] && ok "K7 refuse: validate 실패면 exit 1 + PNG 미생성 + REFUSE 표기" || ng "K7 실패: $k7";;
+esac
+echo "diagram lanes: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ] || exit 1

package/scripts/test_preprep_drift_anchor.sh

@@ -16,7 +16,16 @@ set -uo pipefail
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 SRC="$HERE/plugins/fh-commons/skills/preprep"
 # standalone 배포 위치는 환경변수로 받는다. 기본값을 박으면 다른 머신에서 거짓 SKIP 이 된다.
-DIST="${PREPREP_STANDALONE_DIR:-}"
+# 🟥 2026-09-03 — 그런데 «아무도 그 변수를 안 걸어서» D2 가 여태 SKIP 이었고, 그 사이 컴패니언
+#    저장소의 fork(724줄)가 정본(789줄)과 갈라져 L9~L11 을 안 부르고 있었다 — 정본 주석이 이미
+#    한 번 적어 둔 사고의 2회째(fh_signal_2026-09-03_preprep-standalone-anchor-skip.md). 슬롯은
+#    있고 소비처가 0 인 형태. 처방: 명시 변수가 없으면 운영자 로컬 바인딩이 이미 export 하는
+#    FH_COMPANION_STORE 아래 preprep/ 을 «자동 후보»로 쓴다 — 기본값을 박는 게 아니라 이미
+#    선언된 경로를 읽는 것이라 다른 머신에서 거짓 SKIP 을 만들지 않는다(없으면 여전히 SKIP).
+DIST="${PREPREP_STANDALONE_DIR:-}"; DIST_SRC="PREPREP_STANDALONE_DIR"
+if [ -z "$DIST" ] && [ -n "${FH_COMPANION_STORE:-}" ] && [ -d "${FH_COMPANION_STORE}/preprep" ]; then
+  DIST="${FH_COMPANION_STORE}/preprep"; DIST_SRC="FH_COMPANION_STORE/preprep (자동 후보)"
+fi
 PASS=0; FAIL=0; SKIP=0
 ok(){ echo "  ✅ $1"; PASS=$((PASS+1)); }
 ng(){ echo "  ❌ $1"; FAIL=$((FAIL+1)); }
@@ -24,7 +33,7 @@ sk(){ echo "  ⏭  $1 — SKIPPED (**통과 아님**)"; SKIP=$((SKIP+1)); }
 
 # D1 — 단일 소스
 missing=""
-for f in preprep.py interslide_deps.py lane_progression.py lane_adjacent_dup.py lane_promise.py SKILL.md README.md surfaces.example.yaml; do
+for f in preprep.py interslide_deps.py lane_progression.py lane_adjacent_dup.py lane_promise.py lane_diagram.py diagram_from_json.py SKILL.md README.md surfaces.example.yaml; do
   [ -f "$SRC/$f" ] || missing="$missing $f"
 done
 if [ -n "$missing" ]; then ng "D1 단일 소스 결손:$missing"
@@ -32,25 +41,25 @@ elif ! command -v python3 >/dev/null 2>&1; then
   sk "D1 구문 검사 — python3 부재라 «돌 수 있나»를 못 쟀다(UNMEASURED)"
 else
   synerr=""
-  for f in preprep.py interslide_deps.py lane_progression.py lane_adjacent_dup.py lane_promise.py; do
+  for f in preprep.py interslide_deps.py lane_progression.py lane_adjacent_dup.py lane_promise.py lane_diagram.py diagram_from_json.py; do
     python3 -c "import ast,sys;ast.parse(open(sys.argv[1],encoding='utf-8').read())" "$SRC/$f" 2>/dev/null || synerr="$synerr $f"
   done
-  [ -z "$synerr" ] && ok "D1 단일 소스 8파일 실재 + python 5파일 구문 통과" \
+  [ -z "$synerr" ] && ok "D1 단일 소스 10파일 실재 + python 7파일 구문 통과" \
                    || ng "D1 구문 실패:$synerr"
 fi
 
 # D2 — standalone 대조
 if [ -z "$DIST" ]; then
-  sk "D2 standalone 대조 — PREPREP_STANDALONE_DIR 미설정이라 배포본을 못 찾았다"
+  sk "D2 standalone 대조 — PREPREP_STANDALONE_DIR 미설정이고 FH_COMPANION_STORE/preprep 도 없어 배포본을 못 찾았다. UNCHECKED — 배포본이 있는 머신이면 둘 중 하나를 export 해라"
 elif [ ! -d "$DIST" ]; then
-  ng "D2 PREPREP_STANDALONE_DIR 이 가리키는 곳이 없다: $DIST (설정됐는데 부재 = 드리프트 아니라 배선 결함)"
+  ng "D2 $DIST_SRC 이 가리키는 곳이 없다: $DIST (설정됐는데 부재 = 드리프트 아니라 배선 결함)"
 else
   drift=""
   for f in preprep.py interslide_deps.py lane_progression.py lane_adjacent_dup.py; do
     if [ ! -f "$DIST/$f" ]; then drift="$drift $f(부재)"
     elif ! cmp -s "$SRC/$f" "$DIST/$f"; then drift="$drift $f(갈림)"; fi
   done
-  [ -z "$drift" ] && ok "D2 standalone 코드 5파일이 단일 소스와 바이트 동일" \
+  [ -z "$drift" ] && ok "D2 standalone 코드 5파일이 단일 소스와 바이트 동일 ($DIST_SRC)" \
                   || ng "D2 드리프트:$drift ⇒ 사본이 둘이 됐다. 단일 소스에서 다시 뽑아라"
 fi
 

package/scripts/test_preprep_drift_anchor_lanes.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# test_preprep_drift_anchor_lanes.sh — known pairs for the D2 leg of scripts/test_preprep_drift_anchor.sh
+# WHY (2026-09-03): D2 compared the standalone copy only when PREPREP_STANDALONE_DIR was set. Nobody
+# set it, so the leg SKIPPED for weeks while the companion-store fork drifted (724 vs 789 lines, L9-L11
+# never called) — the second occurrence of the exact accident the canon's own comment records.
+# Fix under test: with the env var unset, the anchor falls back to $FH_COMPANION_STORE/preprep when it
+# exists. These lanes pin: fallback used · fallback discriminates (identical PASS / drifted FAIL) ·
+# explicit var still wins · nothing set → SKIP (never a silent PASS).
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"; A="$HERE/scripts/test_preprep_drift_anchor.sh"
+SRC="$HERE/plugins/fh-commons/skills/preprep"; T=$(mktemp -d); pass=0; fail=0
+chk(){ if [ "$1" = 0 ]; then echo "  ✅ $2"; pass=$((pass+1)); else echo "  ❌ $2"; fail=$((fail+1)); fi; }
+mk(){ mkdir -p "$1"; for f in preprep.py interslide_deps.py lane_progression.py lane_adjacent_dup.py lane_promise.py; do cp "$SRC/$f" "$1/$f"; done; }
+echo "[preprep-drift-anchor] D2 known pairs"
+# L1 nothing set → D2 SKIP (skip != pass), rc 0 (D2 is not a FAIL)
+out=$(env -u PREPREP_STANDALONE_DIR FH_COMPANION_STORE="$T/nostore" bash "$A" 2>&1); printf '%s' "$out" | grep -q "D2 .*SKIPPED"; chk $? "L1 var unset + no companion preprep → D2 SKIPPED (not PASS)"
+# L2 companion copy identical → fallback used, D2 PASS
+mk "$T/be/preprep"; out=$(env -u PREPREP_STANDALONE_DIR FH_COMPANION_STORE="$T/be" bash "$A" 2>&1); printf '%s' "$out" | grep -q "✅ D2 .*자동 후보"; chk $? "L2 fallback FH_COMPANION_STORE/preprep identical → D2 PASS via 자동 후보"
+# L3 companion copy drifted → D2 FAIL, rc 1 (the accident class)
+printf '\n# drift\n' >> "$T/be/preprep/preprep.py"; env -u PREPREP_STANDALONE_DIR FH_COMPANION_STORE="$T/be" bash "$A" >"$T/l3.out" 2>&1; rc=$?; [ "$rc" -ne 0 ] && grep -q "D2 드리프트.*preprep.py(갈림)" "$T/l3.out"; chk $? "L3 fallback copy drifted → D2 FAIL rc=$rc (known-positive)"
+# L4 explicit var wins over companion
+mk "$T/explicit"; out=$(PREPREP_STANDALONE_DIR="$T/explicit" FH_COMPANION_STORE="$T/be" bash "$A" 2>&1); printf '%s' "$out" | grep -q "✅ D2 .*(PREPREP_STANDALONE_DIR)"; chk $? "L4 explicit PREPREP_STANDALONE_DIR wins over drifted companion copy"
+rm -rf "$T"; echo "[preprep-drift-anchor] $pass passed, $fail failed"; [ "$fail" -eq 0 ]