@chrono-meta/fh-gate 2.15.1 → 3.1.0

package/scripts/test_proposal_hook_lanes.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# test_proposal_hook_lanes.sh — known pairs for scripts/proposal_hook.sh (written before shipping; r4 KP + Bash path)
+set -u; HDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"; T=$(mktemp -d); pass=0; fail=0
+export CLAUDE_PROJECT_DIR="$T"
+exp(){ local label="$1" want="$2" payload="$3" got; got=$(printf '%s' "$payload" | bash "$HDIR/proposal_hook.sh" 2>/dev/null | wc -c | tr -d ' '); [ "$got" -gt 0 ] && got=HIT || got=CLEAN
+  if [ "$got" = "$want" ]; then printf '  ✅ %-52s %s\n' "$label" "$got"; pass=$((pass+1)); else printf '  ❌ %-52s %s (expected %s)\n' "$label" "$got" "$want"; fail=$((fail+1)); fi; }
+echo "[proposal-hook] known pairs"
+exp "T1 Edit comm+LC_ALL (verdict compare)"   HIT   '{"tool_name":"Edit","tool_input":{"file_path":"/x/scripts/sim_isolated_run.sh","old_string":"  comm -13 <(sort a) <(sort b) \\","new_string":"  comm -13 <(LC_ALL=C sort a) <(LC_ALL=C sort b) \\"}}'
+exp "T2 Edit adds fail-open guard"            HIT   '{"tool_name":"Edit","tool_input":{"file_path":"/x/scripts/capability_effect_probe.sh","old_string":"  h=$(ls -A \"$HOME\" | shasum)","new_string":"  h=$(ls -A \"$HOME\" | shasum) || { echo LS_FAILED; exit 10; }"}}'
+exp "T3 Edit continue guard"                  HIT   '{"tool_name":"Edit","tool_input":{"file_path":"/x/templates/regression_guard.sh","old_string":"      [ -e \"$blk\" ] && [ -s \"$blk\" ] || continue","new_string":"      [ -e \"$blk\" ] || { echo missing >&2; continue; }"}}'
+exp "HARD Edit usage string only (r4 0/5)"    CLEAN '{"tool_name":"Edit","tool_input":{"file_path":"/x/scripts/daily_report.sh","old_string":"  *) echo \"usage: d.sh [run]\" >&2; exit 2 ;;","new_string":"  *) echo \"usage: d.sh [run|--self-test] (DR_DATE)\" >&2; exit 2 ;;"}}'
+exp "docs file with tokens"                   CLEAN '{"tool_name":"Edit","tool_input":{"file_path":"/x/docs/a.md","old_string":"a","new_string":"exit 1 || continue"}}'
+exp "Write new scripts/*.sh with verdict"     HIT   '{"tool_name":"Write","tool_input":{"file_path":"/x/scripts/new_check.sh","content":"#!/bin/bash\n[ -f x ] || exit 1"}}'
+exp "Bash sed -i on scripts/*.sh with token"  HIT   '{"tool_name":"Bash","tool_input":{"command":"sed -i \"\" \"s/comm -13/LC_ALL=C comm -13/\" scripts/sim_isolated_run.sh && [ -s out ] || exit 1"}}'
+exp "Bash sed -i token ONLY inside quotes (a1)"  HIT   '{"tool_name":"Bash","tool_input":{"command":"sed -i \"\" \"s/exit 1/exit 2/\" scripts/target.sh"}}'
+exp "Bash sed -i single-quoted token (a1b)"      HIT   '{"tool_name":"Bash","tool_input":{"command":"sed -i '"'"''"'"' '"'"'s/|| continue/|| { echo x; continue; }/'"'"' scripts/target.sh"}}'
+exp "Bash sed -i no token anywhere (a3)"         CLEAN '{"tool_name":"Bash","tool_input":{"command":"sed -i \"\" s/foo/bar/ scripts/target.sh"}}'
+exp "Bash redirect into scripts/*.sh w/ token" HIT  '{"tool_name":"Bash","tool_input":{"command":"printf \"[ -f x ] || exit 1\\n\" >> scripts/x.sh; grep -q y scripts/x.sh"}}'
+exp "Bash redirect into docs (no)"            CLEAN '{"tool_name":"Bash","tool_input":{"command":"echo \"exit 1\" >> docs/a.md || exit 1"}}'
+exp "Bash ls only (no target)"                CLEAN '{"tool_name":"Bash","tool_input":{"command":"ls scripts/ && [ -d scripts ] || exit 1"}}'
+# ── 2026-09-04 계기 교체 lanes — fixtures are the SHAPES the first independent grading quoted
+#    (tracks/_meta/RESULT_2026-09-04_identity5-armC-live-count.md §계기 결함), not easier spellings.
+#    Fail-before: the HEAD~ hook (whole-command regex) is HIT on R2/R3/R4-ctrl/D3-*/D4 and CLEAN on D2-* (recorded in
+#    proposal_hook_repair_lanes.txt for the patch); the scanner hook inverts exactly those.
+exp "R2 marker heredoc QUOTES sed -i … scripts/target.sh (row 2)" CLEAN '{"tool_name":"Bash","tool_input":{"command":"cat > tracks/_meta/.axes_23_2026-09-03.marker <<'"'"'MK'"'"'\naxes-run: ⓐ ⓑ\na1 `sed -i '"'"''"'"' '"'"'s/exit 1/exit 2/'"'"' scripts/target.sh` → HIT · lanes 16/16 · [ -s x ] || exit 1\nMK"}}'
+exp "R3 gh pr --body QUOTES sed -i … scripts/target.sh (row 3)"  CLEAN '{"tool_name":"Bash","tool_input":{"command":"gh pr create --title \"fix(hook): a1\" --body \"Lanes: a1 `sed -i '"'"''"'"' '"'"'s/exit 1/exit 2/'"'"' scripts/target.sh` now HIT; 16/16 · revert 14/16 || exit 1\""}}'
+exp "R4-ctrl : > \"\$T/scripts/…\" fixture root (var path)"      CLEAN '{"tool_name":"Bash","tool_input":{"command":"mkdir -p \"$T/scripts\"; : > \"$T/scripts/test_has_lane_lanes.sh\"; [ -f x ] || exit 1"}}'
+exp "D2-P python heredoc open(p,\"w\") verdict edit (8746)"      HIT   '{"tool_name":"Bash","tool_input":{"command":"python3 - <<'"'"'PY'"'"'\np=\"scripts/package_coverage_check.sh\"\ns=open(p).read()\nassert s.count(\"  exit 2\") == 1\ns=s.replace(\"  exit 2\", \"  echo \\\"PKG_ORACLE_MISSING: npm pack gave no files[]\\\" >&2; exit 2\")\nopen(p,\"w\").write(s)\nPY"}}'
+exp "D2-P2 python heredoc q=Path(…); q.write_text (verdict)"     HIT   '{"tool_name":"Bash","tool_input":{"command":"python3 - <<'"'"'PY'"'"'\nfrom pathlib import Path\nq=Path(\"scripts/selfcheck.sh\")\nq.write_text(q.read_text().replace(\"run_lane x\", \"run_lane x || exit 1\"))\nPY"}}'
+exp "D2-ctrl python heredoc comment-word replace (== in code only)" CLEAN '{"tool_name":"Bash","tool_input":{"command":"python3 - <<'"'"'PY'"'"'\np=\"scripts/sim_isolated_run.sh\"\ns=open(p).read()\nassert s.count(\"# 옛말\") == 1\ns=s.replace(\"# 옛말\", \"# 조직\")\nopen(p,\"w\").write(s)\nPY"}}'
+exp "D3 row 6: sed comment word + || exit 1 in another segment"  CLEAN '{"tool_name":"Bash","tool_input":{"command":"sed -i '"'"''"'"' '"'"'s/옛말/조직/g'"'"' scripts/sim_isolated_run.sh && bash scripts/test_sim_isolated_run_lanes.sh; rc=$?; [ $rc = 0 ] || exit 1"}}'
+exp "D3 row 1: self-probe sed (no token in expr) + [ -s ] || exit 1" CLEAN '{"tool_name":"Bash","tool_input":{"command":"sed -i '"'"''"'"' '"'"'s/^#NOOP-PROBE-LINE$//'"'"' scripts/proposal_hook.sh && [ -s scripts/proposal_hook.sh ] || exit 1; tail -1 .claude/.proposal_hook_events.tsv"}}'
+exp "D4 old shape: payload w/o token, check in next segment"      CLEAN '{"tool_name":"Bash","tool_input":{"command":"printf \"%s\\n\" x >> scripts/x.sh; grep -q y scripts/x.sh || exit 3"}}'
+exp "H1 cat > scripts/new.sh <<EOF body carries token"           HIT   '{"tool_name":"Bash","tool_input":{"command":"cat > scripts/new_lane.sh <<'"'"'EOF'"'"'\n#!/usr/bin/env bash\n[ -f x ] || exit 1\nEOF"}}'
+exp "H2 cat <<EOF > \"scripts/q.sh\" (quoted target after >)"    HIT   '{"tool_name":"Bash","tool_input":{"command":"cat <<'"'"'EOF'"'"' > \"scripts/q.sh\"\nexit 1\nEOF"}}'
+exp "H3 printf | tee -a scripts/t.sh"                            HIT   '{"tool_name":"Bash","tool_input":{"command":"printf \"exit 1\\n\" | tee -a scripts/t.sh"}}'
+# R4 proper: the real edit is a python heredoc whose CONTENT quotes `: > "$T/scripts/test_has_lane_lanes.sh"` — the hook
+# must record the file the python writes, not the fixture root inside the string (row 4 recorded `$T/scripts/…`).
+R4='{"tool_name":"Bash","tool_input":{"command":"python3 - <<'"'"'PY'"'"'\np=\"scripts/test_proposal_hook_lanes.sh\"\ns=open(p).read()\ns=s.replace(\"exp \\\"noqa\", \"mkdir -p \\\"$T/scripts\\\"; : > \\\"$T/scripts/test_has_lane_lanes.sh\\\"; [ -f x ] || exit 1; exp \\\"noqa\")\nopen(p,\"w\").write(s)\nPY"}}'
+printf '%s' "$R4" | bash "$HDIR/proposal_hook.sh" >/dev/null 2>&1; r4fp=$(tail -1 "$T/.claude/.proposal_hook_events.tsv" 2>/dev/null | cut -f3)
+if [ "$r4fp" = "scripts/test_proposal_hook_lanes.sh" ]; then printf '  ✅ %-52s fp=%s\n' "R4 python heredoc → recorded fp is the WRITTEN file" "$r4fp"; pass=$((pass+1)); else printf '  ❌ %-52s fp=%s (expected scripts/test_proposal_hook_lanes.sh)\n' "R4 python heredoc → recorded fp is the WRITTEN file" "${r4fp:-<none>}"; fail=$((fail+1)); fi
+exp "G1 Edit templates/.git-hooks/pre-commit (no .sh)" HIT '{"tool_name":"Edit","tool_input":{"file_path":"/x/templates/.git-hooks/pre-commit","old_string":"  [ -f x ] || continue","new_string":"  [ -f x ] || { echo missing; PTR_FAIL=1; continue; }"}}'
+exp "G1-ctrl Edit .git-hooks docs-ish no token"        CLEAN '{"tool_name":"Edit","tool_input":{"file_path":"/x/templates/.git-hooks/pre-commit","old_string":"# note a","new_string":"# note b"}}'
+exp "noqa exempts"                            CLEAN '{"tool_name":"Edit","tool_input":{"file_path":"/x/scripts/a.sh","old_string":"a","new_string":"exit 1  # noqa: proposal-hook"}}'
+exp "unparseable payload silent"              CLEAN 'not json'
+msg(){ printf '%s' "$2" | bash "$HDIR/proposal_hook.sh" 2>/dev/null; }
+fact(){ local label="$1" want="$2" payload="$3" got; got=$(msg x "$payload"); if printf '%s' "$got" | grep -q -- "$want"; then printf '  ✅ %-52s carries «%s»\n' "$label" "$want"; pass=$((pass+1)); else printf '  ❌ %-52s missing «%s»\n' "$label" "$want"; fail=$((fail+1)); fi; }
+mkdir -p "$T/scripts"; : > "$T/scripts/test_has_lane_lanes.sh"; printf 'scan of scripts/covered.sh\nfindings: 0\n' > "$T/scripts/.degrade_scan_last_2026-09-03.txt"
+E='{"tool_name":"Edit","tool_input":{"file_path":"/x/scripts/%s","old_string":"a","new_string":"[ -f x ] || exit 1"}}'
+fact "F1 lane exists → fact line, no known-pair item" "이미 있다" "$(printf "$E" has_lane.sh)"
+fact "F1b lane exists → scan item still proposed"     "degrade_direction_scan.sh 로" "$(printf "$E" has_lane.sh)"
+fact "F2 self-lane (test_*_lanes.sh) → fact line"     "이 파일 자체가 레인" "$(printf "$E" test_has_lane_lanes.sh)"
+fact "F3 scan covers file → fact line w/ findings"    "findings: 0" "$(printf "$E" covered.sh)"
+fact "F4 neither → both items proposed"               "known-pair(고친 케이스 + 반대 케이스) 컨트롤 degrade_direction_scan.sh" "$(printf "$E" bare.sh)"
+got=$(msg x "$(printf "$E" bare.sh)"); if printf '%s' "$got" | grep -q "사실:"; then echo "  ❌ F4-ctrl bare file must carry NO fact line"; fail=$((fail+1)); else echo "  ✅ F4-ctrl bare file carries no fact line (known-negative)"; pass=$((pass+1)); fi
+[ -f "$T/.claude/.proposal_hook_events.tsv" ] && [ "$(grep -c FIRE "$T/.claude/.proposal_hook_events.tsv")" -ge 5 ]; r=$?; [ $r = 0 ] && { echo "  ✅ evidence file carries a FIRE row per hit"; pass=$((pass+1)); } || { echo "  ❌ evidence file missing/short"; fail=$((fail+1)); }
+rm -rf "$T"; echo "[proposal-hook] $pass passed, $fail failed"; [ "$fail" -eq 0 ]

package/scripts/test_push_zone_lanes.sh

@@ -0,0 +1,304 @@
+#!/usr/bin/env bash
+# test_push_zone_lanes.sh — known-pair anchor for the pre-push hook's Push-Zone verdict, and for
+# the session-close ①-f advisory that mirrors it.
+#
+# ── WHY THIS FILE EXISTS ───────────────────────────────────────────────────────────────────────
+# 2026-09-05: templates/.git-hooks/pre-push gained a new verdict path and scripts/session_close_
+# check.sh gained a new ①-f advisory, both implementing CLAUDE.local.md §REST API push 계정규칙
+# mechanically — a push to a github.com remote whose owner is NOT on the operator's owner-account
+# list needs the REST Contents API channel, not plain git push. Before this suite the new code had
+# no known-pair anchor at all. Per CLAUDE.md §Instrument Calibration, a gate is not trusted until
+# calibrated on at least one known-positive and one known-negative, hand-verified.
+#
+# ── DISCIPLINE INHERITED FROM THE SIBLING SUITE (test_prepush_destructive_lanes.sh) ────────────
+#  (a) Run the hook FOR REAL — `bash -n` is not an instrument (a runtime fault can parse clean,
+#      abort the hook, and still exit 0).
+#  (b) A runtime fault is checked BEFORE the verdict, else an aborted hook scores as a clean pass.
+#  (c) "It blocked" is NOT "it blocked correctly" — a block must be ATTRIBUTED to a named FH gate.
+#  (d) NEVER read or assert on the operator's real owner-account list
+#      (.claude/rules/.push-zone-owners). Every lane below builds its own throwaway fixture list
+#      via the PUSH_ZONE_OWNERS override, with fictitious account names. The real file, if present
+#      on this machine, is never opened by this suite in either direction.
+#
+# Runs entirely in mktemp throwaway repos: never touches this repo's index, worktree, refs, or its
+# real .claude/rules/.push-zone-owners.
+#
+# Usage: bash scripts/test_push_zone_lanes.sh
+#   FH_PUSH_ZONE_HOOK_SRC=<path>  → test a DIFFERENT copy of the pre-push hook (fail-before proof).
+#   FH_PUSH_ZONE_SCC_SRC=<path>   → same, for session_close_check.sh.
+set -uo pipefail
+. "$(dirname "${BASH_SOURCE[0]}")/fixture_guard_lib.sh"
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+HOOK_SRC="${FH_PUSH_ZONE_HOOK_SRC:-$REPO_ROOT/templates/.git-hooks/pre-push}"
+SCC_SRC="${FH_PUSH_ZONE_SCC_SRC:-$REPO_ROOT/scripts/session_close_check.sh}"
+DEF_SRC="$REPO_ROOT/.claude/rules/.public-surface-patterns.defaults"
+ZERO="0000000000000000000000000000000000000000"
+
+if [ ! -f "$HOOK_SRC" ]; then
+  echo "HARNESS_ERROR — pre-push hook not found at $HOOK_SRC (subject absent; NOT a pass)"; exit 1
+fi
+
+WORK="$(fh_fixture_root "$(mktemp -d)")" || exit 1
+: "${WORK:?fixture root unset — refusing to run git in cwd}"
+trap 'rm -rf "$WORK"' EXIT
+cp "$HOOK_SRC" "$WORK/hook" || exit 1
+HOOK="$WORK/hook"
+
+# Fictitious owner-account fixture — NEVER the operator's real list. The second entry
+# (acme-shared-org) is asserted to never appear in any captured output — it is a decoy for the
+# "list content is never printed" requirement, not used by any URL in this suite.
+OWNERS_OK="$WORK/owners-ok.txt"
+printf '# fixture owner list — test only, not the operator real list\nknown-owner\nacme-shared-org\n' > "$OWNERS_OK"
+
+PASSED=0; FAILED=0; ALL_OUT=""
+
+# ── fixture: same shape as test_prepush_destructive_lanes.sh's newrepo() ───────────────────────
+newrepo() {
+  local d; d="$(fh_fixture_root "$(mktemp -d)")" || return 1
+  : "${d:?fixture root unset — refusing to run git in cwd}"
+  mkdir -p "$d/.claude/rules" "$d/templates/.git-hooks" "$d/tracks/_meta" "$d/scripts" || return 1
+  [ -f "$DEF_SRC" ] && cp "$DEF_SRC" "$d/.claude/rules/.public-surface-patterns.defaults"
+  [ -f "$REPO_ROOT/scripts/psa_scan_lib.sh" ] && cp "$REPO_ROOT/scripts/psa_scan_lib.sh" "$d/scripts/psa_scan_lib.sh"
+  printf '.claude/rules/.public-surface-patterns\n' > "$d/.gitignore"
+  cp "$HOOK" "$d/templates/.git-hooks/pre-push" || return 1
+  printf 'base\n' > "$d/a.txt"
+  (
+    cd "$d" || exit 1
+    git init -q                                  || exit 1
+    git symbolic-ref HEAD refs/heads/main        || exit 1
+    git config user.email t@example.com          || exit 1
+    git config user.name t                       || exit 1
+    git add -A >/dev/null 2>&1                   || exit 1
+    git commit -qm base >/dev/null 2>&1          || exit 1
+    git update-ref refs/remotes/origin/main HEAD || exit 1
+  ) || return 1
+  printf '%s' "$d"
+}
+
+require_repo() {   # $1 = candidate repo path, $2 = lane name
+  if [ -z "${1:-}" ] || [ ! -d "$1/.git" ]; then
+    echo "HARNESS_ERROR — fixture repo not built for $2 (setup failed; NOT a pass)"
+    exit 1
+  fi
+}
+
+# check_zone <name> <repo> <owners-file|""> <url> <push_zone_ok:0|1> <expect:block|pass> <cause-regex|""> <refline>
+check_zone() {
+  local name="$1" repo="$2" owners="$3" url="$4" pzok="$5" expect="$6" cause="$7"; shift 7
+  local out rc got _pzsrc
+  require_repo "$repo" "$name"
+  _pzsrc="${owners:-$WORK/nonexistent-owners-file-for-zone-test}"
+  out=$(printf '%s\n' "$@" | ( cd "$repo" && PUSH_ZONE_OWNERS="$_pzsrc" PUSH_ZONE_OK="$pzok" \
+        bash templates/.git-hooks/pre-push origin "$url" 2>&1 )); rc=$?
+  ALL_OUT="$ALL_OUT
+$out"
+
+  if printf '%s' "$out" | grep -qiE 'bad substitution|unbound variable|syntax error|command not found'; then
+    echo "  ❌ $name — RUNTIME FAULT in the hook (aborted, not passed)"
+    printf '%s\n' "$out" | grep -iE 'bad substitution|unbound|syntax error|command not found' | sed 's/^/       /' | head -3
+    FAILED=$((FAILED+1)); return
+  fi
+
+  if [ "$rc" -ne 0 ]; then
+    if printf '%s' "$out" | grep -qE 'FH (Push-Zone Gate|Destructive-Op Gate)'; then
+      got=block
+    else
+      echo "  ❌ $name — blocked, but NOT by a named FH gate (harness reason ≠ finding)"
+      printf '%s\n' "$out" | sed 's/^/       | /' | head -8
+      FAILED=$((FAILED+1)); return
+    fi
+  else
+    got=pass
+  fi
+
+  if [ "$got" != "$expect" ]; then
+    echo "  ❌ $name — expected $expect, got $got"
+    printf '%s\n' "$out" | sed 's/^/       | /' | head -10
+    FAILED=$((FAILED+1)); return
+  fi
+
+  if [ -n "$cause" ] && ! printf '%s' "$out" | grep -qE "$cause"; then
+    echo "  ❌ $name — verdict $got is correct but UNATTRIBUTED (missing: $cause)"
+    printf '%s\n' "$out" | sed 's/^/       | /' | head -10
+    FAILED=$((FAILED+1)); return
+  fi
+
+  echo "  ✅ $name (expected $expect)"
+  PASSED=$((PASSED+1))
+}
+
+echo "[push-zone] known-pair anchor for the pre-push Push-Zone verdict (hook: $HOOK_SRC)"
+echo ""
+
+# Z0 — no owner-account list at all → UNCALIBRATED, plain push allowed.
+R=$(newrepo); require_repo "$R" "Z0"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z0 no owner-account list         → PASS " "$R" "" \
+  "https://github.com/known-owner/repo.git" 0 pass 'push-zone: UNCALIBRATED' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+rm -rf "$R"
+
+# Z1 — owner IN the list, https → silent pass; the rest of the hook (confidentiality) still runs.
+R=$(newrepo); require_repo "$R" "Z1"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z1 owner IN list, https          → PASS " "$R" "$OWNERS_OK" \
+  "https://github.com/known-owner/repo.git" 0 pass 'FH Pre-Publish' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+rm -rf "$R"
+
+# Z2 — owner OUT of the list, https → BLOCK, attributed, names the URL's (fictitious) owner.
+R=$(newrepo); require_repo "$R" "Z2"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z2 owner OUT of list, https      → BLOCK" "$R" "$OWNERS_OK" \
+  "https://github.com/someone-else/repo.git" 0 block 'FH Push-Zone Gate' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+if printf '%s' "$ALL_OUT" | grep -qF 'github.com/someone-else'; then
+  echo "  ✅ Z2b block message names the URL's owner"; PASSED=$((PASSED+1))
+else
+  echo "  ❌ Z2b — block message did not name the URL's owner (someone-else)"; FAILED=$((FAILED+1))
+fi
+rm -rf "$R"
+
+# Z3 — owner OUT of the list, scp-like ssh (git@github.com:owner/repo) → BLOCK.
+R=$(newrepo); require_repo "$R" "Z3"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z3 owner OUT of list, ssh scp    → BLOCK" "$R" "$OWNERS_OK" \
+  "git@github.com:someone-else/repo.git" 0 block 'FH Push-Zone Gate' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+rm -rf "$R"
+
+# Z4 — remote host is not github.com → out of scope for this axis, pass allowed, says so.
+R=$(newrepo); require_repo "$R" "Z4"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z4 non-github host              → PASS " "$R" "$OWNERS_OK" \
+  "https://ghe.example.com/x/y" 0 pass 'not github.com' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+rm -rf "$R"
+
+# Z5 — PUSH_ZONE_OK=1 override on an out-of-list push → allowed, conscious, LOGGED.
+R=$(newrepo); require_repo "$R" "Z5"
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z5 PUSH_ZONE_OK=1 override       → PASS " "$R" "$OWNERS_OK" \
+  "https://github.com/someone-else/repo.git" 1 pass 'PUSH_ZONE_OK=1' \
+  "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+LOG="$R/tracks/_meta/.push_zone_override_log"
+if [ -f "$LOG" ] && grep -qF 'owner:someone-else' "$LOG"; then
+  echo "  ✅ Z5b override logged to tracks/_meta/.push_zone_override_log"; PASSED=$((PASSED+1))
+else
+  echo "  ❌ Z5b override NOT logged (wanted a line inside $LOG)"; FAILED=$((FAILED+1))
+fi
+rm -rf "$R"
+
+# Z6 — existing destructive verdict (branch DELETE, unique paths → REVIEW → BLOCK) still stands
+#      AFTER a silent zone PASS. Same shape as the sibling suite's P2, through an owner-matching
+#      github.com URL — proves the zone block, inserted near the TOP of the hook, does not shadow
+#      or reorder the destructive checks further down.
+R=$(newrepo); require_repo "$R" "Z6"
+( cd "$R" && git checkout -q -b unique-work && printf 'only here\n' > unique.txt \
+   && git add unique.txt && git commit -qm unique >/dev/null && git checkout -q main )
+TIP=$(cd "$R" && git rev-parse unique-work)
+check_zone "Z6 zone PASS, then BRANCH DELETE → BLOCK" "$R" "$OWNERS_OK" \
+  "https://github.com/known-owner/repo.git" 0 block 'REVIEW: .* unique path' \
+  "(delete) $ZERO refs/heads/unique-work $TIP"
+rm -rf "$R"
+
+# ── Residency: the owner-list's OTHER entries must never appear in any captured output ─────────
+if printf '%s' "$ALL_OUT" | grep -qF 'acme-shared-org'; then
+  echo "  ❌ RESIDENCY — the fixture owner-list's second entry leaked into hook output"
+  FAILED=$((FAILED+1))
+else
+  echo "  ✅ RESIDENCY — owner-list content never appears in any captured hook output"
+  PASSED=$((PASSED+1))
+fi
+
+echo ""
+# ── Z7–Z14 (cross-family codex gpt-5.5, 2026-09-05): the first draft accepted three literal URL
+# prefixes and read every other github.com shape as "unrecognized → allow" — four real shapes were
+# failing OPEN; an inline comment in the owner list authorised pushes; CRLF / trailing slash blocked
+# the operator's own remotes. Each lane below is one of those exact inputs.
+OWNERS_CRLF="$WORK/owners-crlf.txt";   printf 'known-owner\r\nacme-shared-org\r\n' > "$OWNERS_CRLF"
+OWNERS_COMMENT="$WORK/owners-comment.txt"; printf 'known-owner   # someone-else is NOT allowed\nacme-shared-org\n' > "$OWNERS_COMMENT"
+OWNERS_SLASH="$WORK/owners-slash.txt"; printf 'known-owner/\nacme-shared-org\n' > "$OWNERS_SLASH"
+
+_zone_ff_lane() {  # $1=id $2=desc $3=owners $4=url $5=expect $6=cause
+  local R BASESHA NEWSHA
+  R=$(newrepo); require_repo "$R" "$1"
+  BASESHA=$(cd "$R" && git rev-parse HEAD)
+  NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+  check_zone "$1 $2" "$R" "$3" "$4" 0 "$5" "$6" "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+  rm -rf "$R"
+}
+_zone_ff_lane Z7  "userinfo https (user@github.com), owner OUT → BLOCK" "$OWNERS_OK" "https://user@github.com/someone-else/repo.git" block 'FH Push-Zone Gate'
+_zone_ff_lane Z8  "https with :443 port, owner OUT → BLOCK"           "$OWNERS_OK" "https://github.com:443/someone-else/repo.git" block 'FH Push-Zone Gate'
+_zone_ff_lane Z9  "ssh:// with :22 port, owner OUT → BLOCK"           "$OWNERS_OK" "ssh://git@github.com:22/someone-else/repo.git" block 'FH Push-Zone Gate'
+_zone_ff_lane Z10 "scp form with leading slash (git@github.com:/o/r), owner OUT → BLOCK" "$OWNERS_OK" "git@github.com:/someone-else/repo.git" block 'FH Push-Zone Gate'
+_zone_ff_lane Z11 "inline comment in owner list must NOT authorise the commented name → BLOCK" "$OWNERS_COMMENT" "https://github.com/someone-else/repo.git" block 'FH Push-Zone Gate'
+_zone_ff_lane Z12 "CRLF owner list, owner IN → pass (no over-block)"  "$OWNERS_CRLF" "https://github.com/known-owner/repo.git" pass ''
+_zone_ff_lane Z13 "trailing-slash owner entry, owner IN → pass"       "$OWNERS_SLASH" "https://github.com/known-owner/repo.git" pass ''
+_zone_ff_lane Z13b "uppercase host/owner in URL, owner IN → pass (case-insensitive)" "$OWNERS_OK" "https://GitHub.com/Known-Owner/repo.git" pass ''
+# Z14 — $2 is a bare remote NAME (alias/insteadOf edge): the hook must resolve it, not read it as a host.
+R=$(newrepo); require_repo "$R" "Z14"
+( cd "$R" && git remote add origin https://github.com/someone-else/repo.git ) 2>/dev/null
+BASESHA=$(cd "$R" && git rev-parse HEAD)
+NEWSHA=$(cd "$R" && printf 'x\n' >> a.txt && git commit -qam ff >/dev/null && git rev-parse HEAD)
+check_zone "Z14 \$2 is the remote NAME → resolved via git remote get-url → BLOCK" "$R" "$OWNERS_OK" \
+  "origin" 0 block 'FH Push-Zone Gate' "refs/heads/feat $NEWSHA refs/heads/feat $BASESHA"
+rm -rf "$R"
+
+echo "── session-close ①-f wiring (scripts/session_close_check.sh) ──"
+if [ ! -f "$SCC_SRC" ]; then
+  echo "HARNESS_ERROR — session_close_check.sh not found at $SCC_SRC"; FAILED=$((FAILED+1))
+else
+  SR="$(fh_fixture_root "$(mktemp -d)")" || exit 1
+  mkdir -p "$SR/tracks/_meta" "$SR/scripts" "$SR/.claude/rules"
+  cp "$REPO_ROOT/scripts/push_zone_check.sh" "$SR/scripts/push_zone_check.sh" 2>/dev/null
+  chmod +x "$SR/scripts/push_zone_check.sh" 2>/dev/null
+  ( cd "$SR" && git init -q && git symbolic-ref HEAD refs/heads/main \
+      && git config user.email t@example.com && git config user.name t \
+      && git commit -q --allow-empty -m base >/dev/null ) >/dev/null 2>&1
+
+  if [ -x "$SR/scripts/push_zone_check.sh" ]; then
+    SC_OUT=$(PUSH_ZONE_OWNERS="$OWNERS_OK" bash "$SCC_SRC" "$SR" 2>&1)
+    if printf '%s' "$SC_OUT" | grep -qE '①-f push-zone: '; then
+      echo "  ✅ ①-f prints advisory-prefixed push_zone_check.sh output when both files exist"
+      PASSED=$((PASSED+1))
+    else
+      echo "  ❌ ①-f did not print the expected advisory prefix"; FAILED=$((FAILED+1))
+    fi
+    # RESIDENCY (codex #9, 2026-09-05): the enumerator prints owner-account names, and a close's
+    # output lands in transcripts and session cards. ①-f therefore prints COUNTS only — the decoy
+    # list entry must never appear, and the summary line must.
+    if printf '%s' "$SC_OUT" | grep -qF 'acme-shared-org'; then
+      echo "  ❌ ①-f leaked an owner-account list entry into the close output"; FAILED=$((FAILED+1))
+    else
+      echo "  ✅ ①-f withholds owner-account names (counts only)"; PASSED=$((PASSED+1))
+    fi
+    if printf '%s' "$SC_OUT" | grep -qE '①-f push-zone: [0-9]+ repo\(s\) enumerated'; then
+      echo "  ✅ ①-f prints the enumeration summary (repo count · outside-list count)"; PASSED=$((PASSED+1))
+    else
+      echo "  ❌ ①-f summary line missing"; FAILED=$((FAILED+1))
+    fi
+  else
+    echo "  ❌ Z-SC setup — fixture push_zone_check.sh not executable"; FAILED=$((FAILED+1))
+  fi
+
+  # Owner-account list absent → UNCALIBRATED, one line, never silent.
+  SC_OUT2=$(PUSH_ZONE_OWNERS="$SR/no-such-owners-file" bash "$SCC_SRC" "$SR" 2>&1)
+  if printf '%s' "$SC_OUT2" | grep -qE '①-f push-zone UNCALIBRATED'; then
+    echo "  ✅ ①-f UNCALIBRATED when the owner-account list is absent"; PASSED=$((PASSED+1))
+  else
+    echo "  ❌ ①-f did not report UNCALIBRATED with no owner-account list"; FAILED=$((FAILED+1))
+  fi
+  rm -rf "$SR"
+fi
+
+echo ""
+echo "[push-zone] $PASSED passed, $FAILED failed"
+[ "$FAILED" -eq 0 ]

package/scripts/test_residency_closure_lanes.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# residency_closure_scan.py 레인 테스트 — known-pair 교정.
+#
+# 이 파일이 있는 이유: 초판이 cross-family 적대검증(gpt-5.5, 2026-08-09)에서 **false-CLEAN
+# 다수**로 반증됐다. 아래 L1~L3 은 그때 재현한 실제 우회 경로이고, 되돌리면 이 레인들이
+# 적색이 된다. 「고쳤다」를 주장으로 두지 않고 실행으로 남긴다.
+#
+# 각 레인 = (입력, 기대 rc). rc 계약: 0=CLEAN(스크리닝) · 1=TAINTED · 10=HARNESS(fail-closed)
+set -uo pipefail
+
+HERE=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SCAN="$HERE/residency_closure_scan.py"
+TMP=$(mktemp -d) || exit 10
+trap 'rm -rf "$TMP"' EXIT
+
+PASS=0; FAIL=0
+lane() { # lane <이름> <기대rc> <모듈> [패턴파일]
+  local name=$1 want=$2 mod=$3 pat=${4:-$TMP/pat}
+  RESIDENCY_PATTERNS="$pat" python3 "$SCAN" --repo "$TMP/repo" "$mod" >/dev/null 2>&1
+  local got=$?
+  if [ "$got" = "$want" ]; then PASS=$((PASS+1)); printf '  ✅ %-42s rc=%s\n' "$name" "$got"
+  else FAIL=$((FAIL+1)); printf '  ❌ %-42s rc=%s (기대 %s)\n' "$name" "$got" "$want"; fi
+}
+
+R="$TMP/repo"
+mkdir -p "$R"/{src/pkg,myapp,app,clean,deep/sub}
+: > "$R/src/pkg/__init__.py"; : > "$R/app/__init__.py"; : > "$R/deep/__init__.py"
+: > "$R/deep/sub/__init__.py"
+
+# L1 상대 임포트 — 초판이 `level == 0` 으로 통째로 버렸다
+printf 'from .secrets import HOST\n' > "$R/src/pkg/main.py"
+printf 'HOST = "api.acme.corp"\n'    > "$R/src/pkg/secrets.py"
+# L2 루트 화이트리스트 밖 레이아웃 — 초판은 ("src","scripts",…) 만 따라갔다
+printf 'import myapp.config\n'    > "$R/myapp/main.py"
+printf 'HOST = "api.acme.corp"\n' > "$R/myapp/config.py"
+# L3 `from pkg import sub` — 초판은 pkg/__init__.py 만 훑었다
+printf 'from app import secrets\n' > "$R/app/main.py"
+printf 'HOST = "api.acme.corp"\n'  > "$R/app/secrets.py"
+# L4 부모 패키지 __init__.py 오염 — payload 에 같이 나간다
+printf 'HOST = "api.acme.corp"\n' > "$R/deep/__init__.py"
+printf 'X = 1\n'                  > "$R/deep/sub/leaf.py"
+# 과교정 컨트롤 — 진짜 깨끗한 모듈
+printf 'X = 1\n' > "$R/clean/ok.py"
+
+printf 'acme\n' > "$TMP/pat"
+: > "$TMP/pat_empty"
+printf '# 주석뿐\n' > "$TMP/pat_comment"
+
+echo "== residency 폐포 스캔 레인 =="
+lane "L1 상대 임포트 → TAINTED"          1  src.pkg.main
+lane "L2 루트 화이트리스트 밖 → TAINTED"  1  myapp.main
+lane "L3 from pkg import sub → TAINTED"  1  app.main
+lane "L4 부모 __init__ 오염 → TAINTED"    1  deep.sub.leaf
+lane "★컨트롤: 깨끗한 모듈 → CLEAN"       0  clean.ok
+lane "빈 운영자 패턴 → HARNESS"           10 clean.ok "$TMP/pat_empty"
+lane "주석뿐 운영자 패턴 → HARNESS"        10 clean.ok "$TMP/pat_comment"
+lane "운영자 패턴 부재 → HARNESS"          10 clean.ok "$TMP/nonexistent"
+lane "모듈 부재 → HARNESS"                10 no.such.module
+
+# --files 모드: 실제 송신 목록만 잰다
+RESIDENCY_PATTERNS="$TMP/pat" python3 "$SCAN" --repo "$R" --files src/pkg/secrets.py >/dev/null 2>&1
+[ $? = 1 ] && { PASS=$((PASS+1)); echo "  ✅ --files 오염 파일 → TAINTED             rc=1"; } \
+           || { FAIL=$((FAIL+1)); echo "  ❌ --files 오염 파일"; }
+RESIDENCY_PATTERNS="$TMP/pat" python3 "$SCAN" --repo "$R" --files clean/ok.py >/dev/null 2>&1
+[ $? = 0 ] && { PASS=$((PASS+1)); echo "  ✅ --files 깨끗한 파일 → CLEAN             rc=0"; } \
+           || { FAIL=$((FAIL+1)); echo "  ❌ --files 깨끗한 파일"; }
+
+echo "── PASS $PASS · FAIL $FAIL"
+[ "$FAIL" -eq 0 ] || exit 1
+exit 0

package/scripts/test_revert_probe_lanes.sh

@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+# test_revert_probe_lanes.sh — known-pair calibration for scripts/revert_probe.sh
+#
+# WHY THESE LANES. revert_probe.sh exists to replace 15+ hand-written revert-and-observe scripts
+# with one generic tool. The two failure modes that would make it worse than the hand-rolled
+# scripts it replaces are exactly the two known-pair lanes below:
+#   L1  DECORATIVE anchor — a suite whose lanes never actually depend on the target file's content
+#       must be reported as decorative (exit 1), not silently scored as "passed".
+#   L2  REAL anchor        — the mirror-image known-positive: a suite that DOES catch the revert
+#       must report the exact flipped lane and exit 0. Without this half, L1 proves nothing
+#       ([[feedback_control_presence_is_not_discrimination]]).
+#   L3  RESTORE GUARANTEED — the target file must come back byte-identical after the probe, in
+#       BOTH the normal-completion path and the harness-error path (suite crashes / produces no
+#       parseable output). A revert tool that leaves the baseline content sitting in the working
+#       tree on the failure path is strictly worse than not having the tool.
+#   L4+ usage guards, harness-error detection, and the git-show (not git-checkout) restore path.
+#
+# Fixtures are throwaway git repos + throwaway suite scripts, never this repo's own assets — a
+# lane suite that references a repo-specific path fails on a fresh clone (portability_lint P9).
+#
+# Usage: bash scripts/test_revert_probe_lanes.sh
+
+set -uo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SUT="${FH_REVERT_PROBE_BIN:-$ROOT/scripts/revert_probe.sh}"
+pass=0; fail=0
+ok()  { printf '  ✅ %s\n' "$1"; pass=$((pass+1)); }
+no()  { printf '  ❌ %s\n' "$1"; fail=$((fail+1)); }
+
+if [ ! -f "$SUT" ]; then
+  echo "FAIL  test_revert_probe_lanes.sh: subject absent ($SUT) — skipped is not passed"
+  exit 1
+fi
+
+WORKROOT="$(mktemp -d "${TMPDIR:-/tmp}/revertlane-XXXXXX")"
+trap 'rm -rf "$WORKROOT"' EXIT
+
+# ── throwaway repo: commit 1 = baseline (missing the fix) · commit 2/HEAD = current (has the fix)
+SRC="$WORKROOT/src"; mkdir -p "$SRC"
+(
+  cd "$SRC" && git init -q . && git config user.email l@l && git config user.name l
+  printf 'value = old_and_broken\n' > guard.txt
+  git add guard.txt && git commit -qm "baseline (no fix)"
+  printf 'value = MARKER_OK\n' > guard.txt
+  git add guard.txt && git commit -qm "current (has the fix)"
+) >/dev/null 2>&1
+TARGET="$SRC/guard.txt"
+TARGET_SHA_BEFORE() { shasum -a 256 "$TARGET" 2>/dev/null | awk '{print $1}'; }
+
+# ── fixture suites ──────────────────────────────────────────────────────────────────────────
+# REAL anchor: the lane's pass/fail genuinely depends on the target file's content.
+REAL_SUITE="$WORKROOT/real_suite.sh"
+cat > "$REAL_SUITE" <<'EOF'
+#!/usr/bin/env bash
+if grep -q MARKER_OK "$FIXTURE_TARGET" 2>/dev/null; then
+  printf '  %s %s\n' "✅" "marker present in guard.txt"
+else
+  printf '  %s %s\n' "❌" "marker present in guard.txt"
+fi
+exit 0
+EOF
+chmod +x "$REAL_SUITE"
+
+# DECORATIVE anchor: always ✅, never actually reads the target file.
+DECO_SUITE="$WORKROOT/deco_suite.sh"
+cat > "$DECO_SUITE" <<'EOF'
+#!/usr/bin/env bash
+printf '  %s %s\n' "✅" "unrelated check that never reads guard.txt"
+exit 0
+EOF
+chmod +x "$DECO_SUITE"
+
+# HARNESS-ERROR suite: crashes before printing any ✅/❌ line at all.
+CRASH_SUITE="$WORKROOT/crash_suite.sh"
+cat > "$CRASH_SUITE" <<'EOF'
+#!/usr/bin/env bash
+echo "no verdict lines here, just noise" >&2
+exit 1
+EOF
+chmod +x "$CRASH_SUITE"
+
+echo "── revert_probe known-pair lanes ──────────────────────────────────"
+
+# L1 — DECORATIVE anchor → exit 1, 0 flipped lanes
+BEFORE1="$(TARGET_SHA_BEFORE)"
+OUT1=$(FIXTURE_TARGET="$TARGET" bash "$SUT" "$TARGET" "$DECO_SUITE" --baseline HEAD~1 2>&1); RC1=$?
+[ "$RC1" -eq 1 ] && ok "L1 decorative anchor → exit 1" || no "L1 decorative anchor: rc=$RC1 (want 1)"
+printf '%s' "$OUT1" | grep -q "되돌린 레인 (✅→❌, 앵커가 실제로 잡은 것): 0개" \
+  && ok "L1b report states 0 flipped lanes" || no "L1b report did not state 0 flipped lanes"
+AFTER1="$(TARGET_SHA_BEFORE)"
+[ "$BEFORE1" = "$AFTER1" ] && ok "L1c target file restored after decorative run" \
+  || no "L1c target file NOT restored (before=$BEFORE1 after=$AFTER1)"
+
+# L2 — REAL anchor → exit 0, exactly 1 flipped lane, names it
+BEFORE2="$(TARGET_SHA_BEFORE)"
+OUT2=$(FIXTURE_TARGET="$TARGET" bash "$SUT" "$TARGET" "$REAL_SUITE" --baseline HEAD~1 2>&1); RC2=$?
+[ "$RC2" -eq 0 ] && ok "L2 real anchor → exit 0" || no "L2 real anchor: rc=$RC2 (want 0)"
+printf '%s' "$OUT2" | grep -q "되돌린 레인 (✅→❌, 앵커가 실제로 잡은 것): 1개" \
+  && ok "L2b report states exactly 1 flipped lane" || no "L2b report did not state 1 flipped lane"
+printf '%s' "$OUT2" | grep -q "marker present in guard.txt" \
+  && ok "L2c report names the exact flipped label" || no "L2c flipped label not named in report"
+AFTER2="$(TARGET_SHA_BEFORE)"
+[ "$BEFORE2" = "$AFTER2" ] && ok "L2d target file restored after real-anchor run" \
+  || no "L2d target file NOT restored (before=$BEFORE2 after=$AFTER2)"
+
+# L3 — frontier warning header always present (both suites above already exercised it; assert once)
+printf '%s' "$OUT2" | grep -q "2607.22880" && ok "L3 frontier-warning citation present in output" \
+  || no "L3 frontier-warning citation missing"
+printf '%s' "$OUT2" | grep -q "되돌린 파일(뮤턴트) 수: 1" \
+  && ok "L3b mutant-count line present (n=1 caveat)" || no "L3b mutant-count line missing"
+
+# L4 — HARNESS ERROR: suite produces zero ✅/❌ lines → exit 10, and restore STILL happens.
+# This is the lane that matters most: a crash on the baseline run is exactly the moment a naive
+# implementation would leave the baseline content sitting in the working tree.
+BEFORE4="$(TARGET_SHA_BEFORE)"
+OUT4=$(FIXTURE_TARGET="$TARGET" bash "$SUT" "$TARGET" "$CRASH_SUITE" --baseline HEAD~1 2>&1); RC4=$?
+[ "$RC4" -eq 10 ] && ok "L4 zero-label suite → exit 10 (harness error, not a silent pass)" \
+  || no "L4 zero-label suite: rc=$RC4 (want 10)"
+AFTER4="$(TARGET_SHA_BEFORE)"
+[ "$BEFORE4" = "$AFTER4" ] && ok "L4b target file restored even on the harness-error path" \
+  || no "L4b RESTORE FAILED ON HARNESS-ERROR PATH (before=$BEFORE4 after=$AFTER4) — this is the defect class this suite exists to catch"
+
+# L5 — usage guards
+OUT5=$(bash "$SUT" 2>&1); RC5=$?
+[ "$RC5" -eq 2 ] && ok "L5 no args → exit 2" || no "L5 no args: rc=$RC5"
+OUT5b=$(bash "$SUT" "$TARGET" 2>&1); RC5b=$?
+[ "$RC5b" -eq 2 ] && ok "L5b missing suite arg → exit 2" || no "L5b missing suite arg: rc=$RC5b"
+OUT5c=$(bash "$SUT" "$WORKROOT/does_not_exist.txt" "$REAL_SUITE" 2>&1); RC5c=$?
+[ "$RC5c" -eq 2 ] && ok "L5c missing target file → exit 2" || no "L5c missing target file: rc=$RC5c"
+OUT5d=$(bash "$SUT" "$TARGET" "$WORKROOT/does_not_exist.sh" 2>&1); RC5d=$?
+[ "$RC5d" -eq 2 ] && ok "L5d missing suite file → exit 2" || no "L5d missing suite file: rc=$RC5d"
+OUT5e=$(bash "$SUT" "$TARGET" "$REAL_SUITE" --baseline totally-bogus-ref 2>&1); RC5e=$?
+[ "$RC5e" -eq 2 ] && ok "L5e bad --baseline ref → exit 2" || no "L5e bad baseline ref: rc=$RC5e"
+
+# L6 — the restore path uses `git show`, never `git checkout <ref> -- <path>` (the latter STAGES
+# the revert into the index — [[feedback_git_checkout_path_stages_the_revert]]). Assert the repo's
+# index carries no staged change after a probe run, both directions.
+( cd "$SRC" && git diff --cached --quiet ) \
+  && ok "L6 no staged changes left in the index after any probe run" \
+  || no "L6 the index has staged changes — a checkout-based restore would do this"
+( cd "$SRC" && git status --porcelain ) | grep -q . \
+  && no "L6b working tree not clean after probes (git status is non-empty)" \
+  || ok "L6b working tree clean after all probes (file content == committed HEAD)"
+
+echo "revert_probe lanes: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/test_session_close_lanes.sh

@@ -138,9 +138,7 @@ PREMISE_FAILED=0
 # Human-readable on both platforms: GNU prints a date for %y, BSD's %Fm prints a raw epoch, so the
 # BSD branch asks for a formatted date instead — the whole point of this line is eyeballing.
 _mtime_h() {
-  stat -c %y "$1" 2>/dev/null \
-    || stat -f "%Sm" -t "%Y-%m-%d %H:%M:%S" "$1" 2>/dev/null \
-    || echo "?"
+  stat -c %y "$1" 2>/dev/null || stat -f "%Sm" -t "%Y-%m-%d %H:%M:%S" "$1" 2>/dev/null || echo "?"
 }
 
 _assert_newer() {  # $1=expected-newer  $2=reference  $3=lane label — returns 1 if premise fails
@@ -298,7 +296,7 @@ _carry_fixture() {  # $1=오늘카드 본문  $2=fh_completed 본문(빈 문자
   printf '%s\n' "$card_body" > "$T/tracks/_meta/reference_next_session_starter.md"
   [ -n "$done_body" ] && printf '%s\n' "$done_body" > "$T/tracks/_meta/fh_completed_${TODAY}.md"
   # companion store: 어제 날짜로 커밋된 «이전 카드» 미러 하나
-  FUT=$(date -v+2d '+%m-%d' 2>/dev/null || date -d '+2 days' '+%m-%d')
+  FUT=$(date -d '+2 days' '+%m-%d' 2>/dev/null || date -v+2d '+%m-%d')
   ( cd "$S" && git init -q . && git config user.email a@l && git config user.name a \
     && mkdir -p tracks-meta \
     && printf '기한 %s 미팅 안건 [B]\n' "$FUT" > tracks-meta/reference_next_session_starter.md \
@@ -307,7 +305,7 @@ _carry_fixture() {  # $1=오늘카드 본문  $2=fh_completed 본문(빈 문자
        git commit -qm prior ) >/dev/null 2>&1
   printf '%s|%s' "$T" "$S"
 }
-_carry_future() { date -v+2d '+%m-%d' 2>/dev/null || date -d '+2 days' '+%m-%d'; }
+_carry_future() { date -d '+2 days' '+%m-%d' 2>/dev/null || date -v+2d '+%m-%d'; }
 
 _carry_lane() {  # $1=name $2=pattern $3=expect $4="REPO|STORE" $5=extra-env(옵션)
   local name="$1" pat="$2" expect="$3" pair="$4" env5="${5:-}" T S out hit