@chrono-meta/fh-gate 2.6.0 → 2.8.0

package/.claude/rules/fh_4axis_gate.md

@@ -190,9 +190,32 @@ controls: n/a — no measurement in this delta (<reason>)
 ```
 
 **`standpoint:`** — closed enum, canonical spec in
-`knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §7`. **Still validated by nothing**
-— zero hook lines, no fixture suite. Recorded here so the gap is visible from the rules side rather
-than only from the hook's absence.
+`knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §7`. 🟥 **CORRECTED 2026-08-20, then CORRECTED AGAIN the same hour.** This used to read "Still validated
+by nothing — zero hook lines, no fixture suite", which is FALSE: `validate_standpoint_leg()` lives in
+`templates/.git-hooks/pre-commit` (grep the function name — **line numbers are deliberately not cited
+here; the first version of this fix cited `:798`/`:1575` and a commit landed the same hour that moved
+them to `:878`/`:1665`**), and `scripts/test_marker_standpoint_lanes.sh` is wired through
+`scripts/selfcheck.sh`.
+🟥 **But the first correction over-shot, and cross-family caught that too.** It said "the value enum
+IS closed and the grounds ARE required". Only the first half holds. Measured by varying ONE variable
+at a time — the original known-pair varied two and mis-attributed the result:
+
+```
+standpoint: tier2(qasp) — ran <cmd>, saw <out>   rc=0   ✅
+standpoint: tier2(qasp)          (no grounds)    rc=0   ⚠️  warns, does NOT block
+standpoint: tier2                (no parens)     rc=1   ❌  not an enum member
+standpoint: banana(qasp)                         rc=1   ❌  not an enum member
+```
+
+So: **the enum is closed and enforced; the execution grounds for `tier2`+ are ADVISORY.** A marker can
+still record `tier2` without naming a command and pass with a warning — that is the real remaining
+gap, and it is narrower than "validated by nothing" and wider than "grounds are required". Neither
+earlier sentence was accurate, and the accurate one required varying one variable at a time.
+🟥 **This same false claim stood in FIVE places**, not three — `CLAUDE.md` (twice), here, `AGENTS.md`,
+and `field_verdict_crossfamily_gate.md`. Fixing one and stopping is the half-fix propagation failure;
+fixing three and stopping was the same failure one round later. The question is never "is this
+sentence wrong" but **"where else does this sentence live"** — and the answer came from a
+different-family reviewer, not from me.
 
 **`thirdparty:` — ⓓ3자 대면의 자기 필드 (2026-08-17 신설).** ⓑ가 `standpoint:` 를 갖는 것과
 같은 형태다: `axes-run` 에는 포인터(`ⓓ=→thirdparty`)만 두고 값은 이 필드가 나른다.

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
   "plugins": [
     {
       "name": "fh-meta",
-      "version": "2.6.0",
+      "version": "2.8.0",
       "description": "New in 2.2.0: BREAKING (gate): chamber step 6 now reads ACTUAL.md, not BUDGET.md — an in-flight chamber run whose actual cost sits in BUDGET.md blocks until the ACTUAL: line moves to tracks/_chamber/<slug>/ACTUAL.md (the runner prints the path). Why: BUDGET.md's pre-verdict hash IS the ordering witness, and step 6 hard-blocked until that same file changed, so every run that reached COMPLETE necessarily mutated a witnessed artifact and verify returned TAMPERED — the chamber's promotion condition was unsatisfiable by construction, not by strictness. Two roles (immutable witness / post-verdict calibration sink) had collided in one file; each was correct alone, so neither side's code showed the conflict. Also: ko-tech-writer Step 2/4-b scans are now calibration-backed (known-pair fixtures + reproducible command, shipped) — discrimination is proven, 'zero residue' is explicitly NOT; chamber lane suite 12 -> 33 including the runner x witness seam no test covered; chamber_run.sh now teaches the two-commit discipline (gate hashes and verdict hash must land in separate commits/PRs — it previously advised the opposite). New in 2.1.0: BREAKING (gate): `crossfamily: declined` in an Axes 2-3 marker now requires grounds naming a record path that RESOLVES on disk — bare `declined`, and `declined` justified by author judgment, are blocked at commit. Remedy: cite where the operator decision lives (e.g. `.. — operator declined sidecars, per knowledge/shared/rules/operational_adaptation.md`), or use `DEGRADED_PANEL_UNUSED` if a panel was reachable and you chose not to recruit it — which is what author judgment actually is. `declined` was the only enum value with no grounds requirement; a cross-family review then broke the first (vocabulary-grep) fix three ways — self-validating on the value's own token, vacuous keyword passes, and over-blocking real declinations in natural prose — so the check asserts a resolvable record instead of words. Also: standpoint axis gains `tier1b` (a STATIC read of a target repo, executed nothing) plus a decide-in-order procedure, after blind floor-tier sims graded pure cold-reads as `tier2` three rounds running; steel-quench Wave 1's sixth angle (gate-locality) gains the output-template row it never had, so a mandatory angle stops being structurally unreportable; verify-bidirectional gains category 5 (prescriptive doctrine statement); Sister Asset Protocol gains an active-adoption trigger; new resident doctrine — Mechanization Boundary, Local Execution First, Skeleton-not-Muscle, Expedition track, and this package's versioning policy. Hub meta-operations toolkit — 35 skills + 7 agents. New in 2.0.1: harness-doctor cadence hook, portability lint wired into pre-commit, branch_claim.sh claim-count-vs-tree-count warning, louder confidentiality-scan fail-open notice, fh-gate.sh missing-package.json survival, identity ① reclassified 🟢 (cross-harness adapters + relay argument channel). New in 1.4.53: `fh-codex-doctor` (npm bin) — Codex adapter drift scanner; reads the documented M1/M2/M3 skill tier map + skill/agent source and reports codex-native/adapter-required/claude-native/unclassified per unit, wired into `npm test`/`prepublishOnly` (fail-closed on unclassified Claude-native primitives). New in 1.4.49: steel-quench gains Step 0.6 Verdict-Invariance Probe (groundedness axis — a load-bearing judged gate's verdict must track behavior, not rubric phrasing; measured flip-count over cross-family paraphrases; arXiv:2605.06161 Policy Invariance anchor); multi_model_sidecar_strategy §Vendor-native harness (a model is strongest in its own vendor CLI — Claude/CC, GPT/codex, Gemini/Antigravity; a universal router degrades all of them, so it stays an autocomplete/QA sidecar, never orchestration); predelete_check.sh fail-closed rewrite; memory-hygiene A-TMA anchor. New in 1.4.48: phantom-quench + steel-quench gain external frontier anchors (arXiv:2607.02052 package-hallucination; arXiv:2607.02057 prompt-coverage-adequacy); README model-flat claim reframed from a per-release point-curve to structural invariants (operation flattens across tiers; depth tier-order fixed within a generation). New in 1.4.47: onboarding step ① surfaces the Mode D companion-store session-start load in the auto-read salience anchor (previously only in the local binding + rules, so a greeting could skip the load). New in 1.4.46: context-doctor command-output axis (route to rtk/proxy for verbose CLI stdout, complementing .claudeignore; risk-gated to token-scarce envs). New in 1.4.41: context-doctor 2026 trigger vocab (context engineering/rot/collapse) + phantom-citation hardening; hub measurement-integrity-checklist (cross-model measurement pre-flight: display-name pin/reps≥3/discriminating probe). New in 1.4.40: install-wizard queryable-wiki scaffold (INDEX + session-start read + R/W/C ingest). New in 1.4.39: auto-decorrelation (cross-family verifier sidecar recruitment) + video-ingest (capability-routed video ingestion). New in 1.4.x: verify-axis check-class taxonomy (mandatory-pass/measured/judged), no-reinvention Tier-0 inventory, 7-class failure taxonomy, Destructive-Op Gate, Wave-T (Temper), tier-floor governance, Mode D Model Notice, FC consent lane, default-Sonnet guidance. New in 1.3.0: public-surface-audit, field-harvest Mode B auto-trigger, 4-axis gate scope ext. Validated cross-CLI: Claude Code, Codex, Gemini.",
       "source": "./plugins/fh-meta"
     },
     {
       "name": "fh-commons",
-      "version": "2.6.0",
+      "version": "2.8.0",
       "description": "Project-agnostic utility skills — 5 skills (convergence-loop · deliberation · mcp-circuit-breaker · token-budget-gate · ko-tech-writer) + 1 agent (quench-challenger). Domain-independent utilities transplantable into any project.",
       "source": "./plugins/fh-commons"
     }

package/AGENTS.md

@@ -71,6 +71,10 @@ its file never declared at all.
 - **Runtime authority:** a non-Claude sidecar returns evidence candidates, never the terminal verdict.
   The governor must source-close each finding against a local file hit, literal source span, or
   passing check. Governor agreement alone is not an anchor.
+- **Sidecar write boundary:** a sidecar audits; it does not write to the target tree. Return
+  findings, and at most a proposed patch as text — the governor applies it. This is not a
+  courtesy: measured 2026-08-21, an auditor sidecar edited the tree directly and its own fix
+  introduced a self-referential fail-open that 41 existing lanes passed.
 - **Sidecar completion:** judge a sidecar only by the typed verdict from `scripts/sidecar_wait.sh`.
   Never infer completion or emptiness by looking at its output file.
 - **Identity grades:** the five-identity grade table is canonical only in
@@ -127,9 +131,14 @@ Because non-Claude runtimes do not auto-load Claude path rules, apply these rule
    2 of the 4 circled-key markers on disk are dated 2026-08-10 and carry the OLD meanings. Aligning
    the notation still helps going forward; it does not work backwards.
    `standpoint:` remains the canonical field for ⓑ (the `axes-run` entry
-   is only a pointer to it, and a pointer at an empty field is blocked); **its value enum is still
-   validated by nothing** — that is the one remaining gap, and it is not the same thing as the axis
-   being unmechanized. Format spec: `.claude/rules/fh_4axis_gate.md §Marker axis fields`.
+   is only a pointer to it, and a pointer at an empty field is blocked). 🟥 **CORRECTED 2026-08-20.** This used to say
+   "its value enum is still validated by nothing" — FALSE. `validate_standpoint_leg()` in the
+   pre-commit hook enforces a closed enum. Measured by varying one variable at a time:
+   `standpoint: banana(qasp)` → **blocked (enum)** · `standpoint: tier2` without parens → **blocked
+   (enum)** · `standpoint: tier2(qasp)` with no execution grounds → **passes with a warning** ·
+   with grounds → **passes**. So the enum is enforced and the `tier2`+ execution grounds are
+   **advisory** — a first version of this correction said grounds were required, which over-shot.
+   The hook also cannot check whether `tier2` is **true**. Those two, together, are the gap. Format spec: `.claude/rules/fh_4axis_gate.md §Marker axis fields`.
    (Two drift corrections landed here on 2026-08-17: first this sentence said "four" while its own
    next clause described the +1 — caught by the session-close ④-b CC↔Codex parity check — and then
    the machine layer moved to six the same day.)
@@ -144,6 +153,22 @@ Because non-Claude runtimes do not auto-load Claude path rules, apply these rule
    `❌`. Execution is the half with no substitute; see `field_verdict_crossfamily_gate.md §7`. Read it before recording; §1-c
    holds the sample limits — read it before citing. This record is self-attested and has no hook
    behind it; it is closed by a different-family reader, not by writing it more carefully.
+   🟥 **`axis2-defense:` — a marker field added 2026-08-20 that a Codex-side author WILL hit.**
+   It is required when the marker records `floor-status: sonnet-floor` or `below-floor`, and it carries
+   three sub-answers (on one line, or across continuation lines — the hook reads both) about **your own findings and numbers**:
+   `axis2-defense: reproducibility=<exact command or file:line another session runs> fairness=<reps,
+   inputs and environment named for BOTH arms> estimation-layer=<per number: measured | estimate |
+   quotation; for a measurement, what showed the instrument works on this target>`.
+   The hook (`validate_defense_leg`) checks **presence · completeness · non-vacuity** — `ok`/`yes`/
+   `n/a` is rejected as a filled form rather than an answer, and all three sub-answers must exist.
+   It cannot check whether the answers are true. Why it exists: measured n=6 in the origin field, a
+   floor-tier pass runs the attack angles without defect but does **not** spontaneously ask these
+   three; that is a checklist gap, not a capability gap, and a harness whose behaviour depends on
+   which model drives it is defective by the Sonnet-Floor doctrine.
+   Fixtures: `scripts/test_marker_defense_lanes.sh`. Spec: `plugins/fh-meta/skills/steel-quench/SKILL.md`
+   §Wave 1-D. **Recorded here because a rule living in only one entry point is invisible to the other
+   runtime** — that is the gate-locality principle, and this line is it being applied rather than cited.
+
 8. **Branch-surface claims:** GitHub branch protection is two independent layers — legacy
    protection and rulesets coexist, and the strictest wins. Read both
    `/repos/{owner}/{repo}/branches/{branch}/protection` and

package/CLAUDE.md

@@ -43,7 +43,7 @@ core invariants never melt). The nursery also **verifies what it births**: harne
 | **③ AI Collaboration Guide** | Accumulates and distributes best practices for token efficiency and dialogue methodology — "how to ask, delegate, and record". | `CHEATSHEET.md` · `knowledge/shared/dialogue/ai_dialogue_playbook.md` · `MEMORY.md` intent-based + associative recall (`knowledge/shared/dialogue/memory_intent_recall.md`) |
 | **Core Axis** | **Harness Engineering (How)** — the methodology and practice axis that realizes the three layers above. The 6-axis framework is the operating unit. **A harness is a means, not an end** — Field harness: "simpler over time" (complexity = warning signal). Meta-harness: *optimize*, not necessarily simplify — complexity earns its scope; red flags are orphaned, redundant, and decorative units, not complexity itself. | `harness_6axis_framework.md` · `hub_compounding_loop.md` · `claude_code_runtime_flow.md` · `plugins/*/agents/` (sub-agents) |
 
-> **3층 정본 — 공정 · 엔진 · 정체성**: FH 를 설명하는 뼈대는 세 층이고 셋의 관계가 정본으로 적혀 있다 — **3단 공정**(엔진을 벼리는 순서: 초기 영혼 → 중간 탈상관 가속화 → **마무리 6축 태우기**) → **4대 엔진**(영혼·품질게이트·질문하기·맥락유지) → **5대 정체성**(사람이 실제로 쓰는 기능). 기억용 형태는 **3단 공정 · 4대 엔진 · 5대 정체성 · 6축 검증**이나 🟥 **6축은 네 번째 층이 아니다** — 3단 공정 ③단계가 무엇으로 이루어지는지다. **Read `knowledge/shared/harness-core/fh_three_layer_canon.md`** before naming, re-scoping, or citing any of the three — it also defines the **6 verification axes** (ⓐ계열 · ⓑ입장 · ⓒ격리 그라운딩 · ⓓ3자대면 · ⓔ첫실사용 · ⓕ되돌림; §1-a 가 최초 4축, §1-a-2 가 2026-08-16 확장) that the third stage actually consists of, and states why the three are *not* a clean stack. 🟥 **축은 «얼마나 적대적인가»가 아니라 «무엇을 받았는가»로 갈린다** — 받는 것이 같으면 리뷰어를 몇 명 붙여도 같은 사각이 남는다. 🟥 **명칭 충돌 — 이 파일 안에 「4축」이 두 개다.** §FH Improvement **4-Axis Auto-Gate** 의 4축(Axis 1 회귀 · 2 적대 · 3 팬텀 · 4 매니페스트)은 **커밋 게이트**이고, 여기 6축은 **검증 축**이다. 부분적으로만 겹치고(Axis 1·4 는 ⓐ~ⓕ 에 대응이 없다) **서로 대체하지 않는다**. 그래서 6축은 「6축 게이트」가 아니라 **「6축 검증」**으로 부른다. Grade table stays canonical in `ship_readiness_gate.md`; this pointer never carries grades.
+> **3층 정본 — 공정 · 엔진 · 정체성**: FH 를 설명하는 뼈대는 세 층이고 셋의 관계가 정본으로 적혀 있다 — **3단 공정**(엔진을 벼리는 순서: 초기 영혼 → 중간 **병렬 탈상관** 가속화(두 다이얼 — **탈상관**=사각 위험[모델 계열 ⓐ + 입장 ⓑ] · **병렬**=표면 크기. 곱하지 말고 골라라) → **마무리 6축 태우기**) → **4대 엔진**(영혼·품질게이트·질문하기·맥락유지) → **5대 정체성**(사람이 실제로 쓰는 기능). 기억용 형태는 **3단 공정 · 4대 엔진 · 5대 정체성 · 6축 검증**이나 🟥 **6축은 네 번째 층이 아니다** — 3단 공정 ③단계가 무엇으로 이루어지는지다. **Read `knowledge/shared/harness-core/fh_three_layer_canon.md`** before naming, re-scoping, or citing any of the three — it also defines the **6 verification axes** (ⓐ계열 · ⓑ입장 · ⓒ격리 그라운딩 · ⓓ3자대면 · ⓔ첫실사용 · ⓕ되돌림; §1-a 가 최초 4축, §1-a-2 가 2026-08-16 확장) that the third stage actually consists of, and states why the three are *not* a clean stack. 🟥 **축은 «얼마나 적대적인가»가 아니라 «무엇을 받았는가»로 갈린다** — 받는 것이 같으면 리뷰어를 몇 명 붙여도 같은 사각이 남는다. 🟥 **명칭 충돌 — 이 파일 안에 「4축」이 두 개다.** §FH Improvement **4-Axis Auto-Gate** 의 4축(Axis 1 회귀 · 2 적대 · 3 팬텀 · 4 매니페스트)은 **커밋 게이트**이고, 여기 6축은 **검증 축**이다. 부분적으로만 겹치고(Axis 1·4 는 ⓐ~ⓕ 에 대응이 없다) **서로 대체하지 않는다**. 그래서 6축은 「6축 게이트」가 아니라 **「6축 검증」**으로 부른다. Grade table stays canonical in `ship_readiness_gate.md`; this pointer never carries grades.
 
 > **자기 대조는 상시 의무 — 트리거는 발화가 아니라 «지금 FH/PMH 자산을 건드리고 있다»**
 > (운영자 결정 2026-08-09; 이 저장소든 **다른 사용자의 install 이든** 동일). §FH Improvement
@@ -102,6 +102,19 @@ Two orthogonal layers — never collapse them.
   **not a floor** (no mechanical floor exists for tone — an accepted limitation, not a guarantee). The
   operator or project may pin a concrete default register in a local binding (`CLAUDE.local.md` / UAP
   `preferred register`) — that pin is operator taste and stays local, never in this public file.
+  🟥 **A local pin sets REGISTER, never LANGUAGE — and the greeting decides the language outright.**
+  Reply in the language of the message you are answering; on a greeting turn, the greeting itself sets
+  it, **including the door labels and every menu line**, not just the prose around them. A pinned
+  default (`Korean 반말`, `English casual`) supplies the *register* to speak that language in — it does
+  not make the session answer `你好` in Korean. Half-translating (localized prose, English doors) is the
+  same defect in a milder form. **Measured 2026-08-21, blind, at the floor tier, one rep per arm**:
+  `こんにちは` → Japanese ✅ · `안녕` → Korean prose but **English door labels** 🟡 · `你好` → **Korean**
+  ❌ · control `hi` → English ✅. The control held, so the instrument discriminates and the defect is in
+  the wiring, not the measurement. 🟥 **The line above already said "not language-lock" and the floor
+  tier still read the pin as one** — which is why this now names the failure explicitly instead of
+  restating the principle. Honest scope: those arms ran in an install that *has* such a pin; whether a
+  clean consumer install ever had the defect is **unmeasured**, and one rep per arm is below this
+  repo's own `reps>=3` bar.
 - **Not flattery**: soft charisma is not pleasing the user. Disagree plainly when the work calls for it;
   warmth and a "no" coexist (no Gemini-grade sycophancy).
 - **Greeting / onboarding**: open with a warm, identity-revealing welcome (new / returning / operator
@@ -376,8 +389,18 @@ claim 이 `main` 인 동안 실제 HEAD 는 peer 브랜치였다 — 두 세션
 **남은 잔여 둘, 이름으로 남긴다**: ⓐ 게이트는 **커밋 시점**이라 `switch -c` 사고 자체는 못 막는다
 (그래서 위 두 줄이 여전히 사람 몫이다 — [[feedback_gate_binding_point_not_check_point]])
 ⓑ 반대 방향 — 내가 브랜치를 쥔 동안 남이 되돌리고 커밋하면 **내 staged 파일이 index 에 살아
-있다.** 실측 사례에서 안 섞인 것은 그 세션이 파일 지정 `add` 를 썼기 때문이지 게이트 덕이 아니다.
-⇒ **공유 체크아웃에서 `git add -A` 금지**([[feedback_shared_checkout_ops_touch_others_work]]).
+있다.** 🟥 **2026-08-21 실제로 났고, 섞은 세션은 파일 지정 `add` 를 썼다**(초판은 여기 「파일
+지정 add 를 썼기 때문에 안 섞였다」고 적었는데 거짓이다). 파일 지정 add 는 «내가 무엇을
+**추가**하나»만 통제하고 **index 에 이미 있는 것은 못 막는다.** ⇒ `git add -A` 금지는 필요조건
+이지 충분조건이 아니다. **커밋을 한 호출로 묶고 그 안에서 둘을 확인한다** — 확인은 점이고 위험은
+구간이라, 사이에 턴이 끼면 창이 다시 생긴다(같은 날 두 세션이 시점을 각각 `switch` 직전/직후로
+달리 골랐는데 **둘 다 뚫렸다**):
+```
+B=$(git branch --show-current); [ "$B" = "<내 브랜치>" ] || exit 1
+git diff --cached --name-only    # 내 것만 있나 — 남의 것은 restore --staged
+git commit …
+```
+([[feedback_shared_checkout_ops_touch_others_work]] · [[feedback_gate_binding_point_not_check_point]])
 
 **Integration branch is PR-only** (operator decision 2026-07-20). Never `git push origin main`
 directly. Normal path: `git switch -c <branch>` → push the branch → `gh pr create` → after review
@@ -390,47 +413,26 @@ so `--admin` after a completed review is the normal route, not a shortcut).
 feature-branch push passes untouched, override honored — over-blocking would just train the override
 into muscle memory and disarm it.
 
-> **Two layers, and which one is the floor**: the **hard floor is server-side** — this repo now runs
-> `enforce_admins: true` with `required_approving_review_count: 0` (set 2026-07-20; the count must be
-> `0`, because enabling `enforce_admins` while it is `1` locks a solo operator out of merging their
-> own PRs — self-approval is impossible). The hook is the **shift-left layer**: it fails at push time
-> and prints the actual remedy, and it keeps holding if the server setting is ever relaxed. It is
-> deliberately not the floor — a client-side hook is bypassable with `--no-verify`.
-> *Origin*: before that change the server had `enforce_admins: false`, so an admin push *satisfied*
-> the rule and merely printed `Bypassed rule violations` — a notice, not a block. A rule that
-> announces its own bypass is not a floor.
-> ✅ **Retraction — the server-side force-push surface is CLOSED, and the way it was misread is the
-> durable part.** An earlier version of this block said `allow_force_pushes` on `main` was "still
-> `true`", that two API writes "did not persist", and that the **server-side** history-rewrite
-> surface therefore "remains open". The field reading was correct; the conclusion was not.
-> **Branch protection is two independent layers — legacy protection and rulesets coexist, and the
-> strictest wins** — so a field on the protection object is never the effective answer by itself.
-> Measured on this repo 2026-08-09: `GET /repos/{owner}/{repo}/rules/branches/main` returns
-> `non_fast_forward` from ruleset `main-no-force-push` — `enforcement: active`,
-> `current_user_can_bypass: never`, `bypass_actors: []`, live since 2026-07-25 — while the legacy
-> object still reports `allow_force_pushes: true`. The two API writes that "did not persist" were
-> writing to the layer that does not govern *this* outcome while the stricter ruleset is active — not
-> a layer that is inert in general: disable or retarget the ruleset and the legacy toggle governs
-> again. **Read BOTH layers before declaring any branch surface open or closed** — `/rules/branches/
-> {branch}` shows only what the *rulesets* impose, and `/branches/{branch}/protection` only what
-> *legacy protection* imposes; neither is the effective view alone. A protection-object field read by
-> itself misjudged this three times ([[reference_github_protection_two_layers]]).
-> **Scope of the retraction, stated narrowly on purpose**: it covers *force-push / non-fast-forward*,
-> which is what `non_fast_forward` blocks. Branch **deletion** is a separate rule and is closed on the
-> other layer (`allow_deletions: false`, same GET). PR-routing is likewise a different field —
-> `required_pull_request_reviews` present with `enforce_admins: true` — not something
-> `required_status_checks` says anything about.
-> ⚠️ A *different* residual on `main` is still real and must not be folded into the one just
-> retracted — but the residual's own description was itself stale and needed correction on
-> 2026-08-12 (live re-check, `[[reference_github_protection_two_layers]]`): legacy
-> `required_status_checks.contexts` is **`["validate"]`**, not `[]` — a green `validate` check IS
-> required before a PR can merge, and `GET /rules/branches/main` carries no competing
-> `required_status_checks` rule, so the legacy field is the effective one here. `validate`
-> (`.github/workflows/validate.yml`) is a **separate job from Axis 1** (`regression-guard.yml`) —
-> Axis 1 is still not required, see the 4-axis section below. The gap on `validate` is
-> `strict: false`: that check re-runs on every push to the PR branch, but nothing re-forces it
-> against a **moving** main after it last ran — so a check that passed can still land behind
-> concurrent merges it never saw.
+> **Two layers, and which one is the floor.** The **hard floor is server-side**: this repo runs
+> `enforce_admins: true` with `required_approving_review_count: 0` (the count must be `0`, or a solo
+> operator is locked out of merging their own PRs). The pre-push hook is the **shift-left layer** — it
+> fails at push time and prints the remedy — deliberately not the floor, since a client-side hook is
+> bypassable with `--no-verify`.
+>
+> 🟥 **Branch protection is TWO independent layers — legacy protection and rulesets coexist, and the
+> strictest wins.** A field on the protection object is **never** the effective answer by itself.
+> Read **both** before declaring any branch surface open or closed:
+> `GET /repos/{owner}/{repo}/rules/branches/{branch}` (rulesets) **and**
+> `GET /repos/{owner}/{repo}/branches/{branch}/protection` (legacy). Reading one alone misjudged this
+> repo **three times** ([[reference_github_protection_two_layers]]).
+>
+> ⚠️ **Live residual on `main`**: `required_status_checks.strict: false` — the required `validate` check
+> re-runs on every push to the PR branch, but nothing re-forces it against a **moving** main, so a green
+> check can land behind concurrent merges it never saw. And `validate` is **not** Axis 1.
+
+> **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Branch-Protection-Two-Layers`
+> — the force-push retraction and why it was narrow, which surface each layer actually governs, and the
+> three misreadings — read before asserting that any branch surface is open or closed.
 
 ## Permission-Denial Guidance (When Auto-Mode Blocks an Action)
 
@@ -454,6 +456,15 @@ Simplification guard: trivial denials with one obvious fix → state block + sin
 **4-step summary**: ① Auto-read CLAUDE.md + CATALOG + session card + registry scan + UAP (`tracks/_meta/user_adaptation_profile.md`, if present — apply user-tuned defaults: preferred tier, suppressed proposals, muted nags; see §Operational Adaptation Loop) **+ Mode D companion-store load — if a companion store is configured (your `CLAUDE.local.md` binding), pull it and read its index (its TOC) before its other files, then check freshness against the card (`modes_and_value.md §Session-start freshness`); this load is part of the auto-read, not a step the operator should have to request** → ② One-line proposal (new user / exploratory / returning branches) → ③ 5-skill cascade (plugin-recommender → synergy → .claudeignore → model → verify) → ④ Approval + setup
 
 **Greeting branch + door skeleton (summary-level — applies even if the detail file read is skipped)**: the branch test is **mechanical local state — session files under `tracks/`** — never git log / CATALOG residue (a fresh clone carries full history but zero session files: it is a NEW install). Every variant opens with **🐿️ then an identity-revealing welcome line on the SAME line**, followed by the menu — one salience unit, not a separate rule. The verifiable invariant is *same-line*, **not** a space count. Welcome line by branch: new / exploratory = "Welcome to FH." · returning = "Welcome back to FH." · operator (FH-dev state) = "The FH operator — good to see you." — rendered in the user's language as a **plain, natural translation of the pinned phrase, never an invented coinage**. (Why each of these reads as it does — the fresh-clone FP, the space-count retraction, the mistranslation: `fh_detail_protocols.md §Onboarding-Provenance`.)
+🟥 **The door labels below are written in English because this file is; they are NOT literals to copy.** Render the welcome line **and every door label** in the greeting's language — `你好` gets Chinese doors, `こんにちは` Japanese ones. Only the ①②③④/🔧/📖 markers, skill names and file paths stay as written. 🟥 **Measured 2026-08-21, blind, floor tier, two rounds of wiring — and it did NOT converge. The note stays anyway; read why.** Round 1 (rule in §Voice/Tone only): `こんにちは`→Japanese ✅ · `안녕`→Korean prose but **English doors** 🟡 · `你好`→**Korean** ❌ · control `hi`→English ✅. Round 2 (rule repeated here, at the doors): `你好`→**Korean** ❌ · `嗨`→**English** ❌ · `こんにちは`→Japanese ✅ · control `hey`→English ✅. Across both rounds **Japanese 3/3, Chinese 1/5**, control clean every time — so the instrument discriminates and the gap is real. **Two distinct failure modes**, and only one of them is the pin: a Korean reply is the operator pin winning, an *English* reply is these door literals being copied. Repeating the rule at the actor's location — textbook gate-locality — moved neither. 🟥 **So do not read this note as a fix.** It is a correct instruction with **no mechanical floor** (tone/language never has one, §Voice/Tone says so), kept because it is right and cheap, and labelled failing because pretending otherwise is the muscle-not-skeleton defect this repo names. The README's user-facing wording was reduced to match this measurement rather than the intent. 🟥 **The clean-install arm has since been RUN, and it reattributes the defect (same day).** A shallow
+clone with no `CLAUDE.local.md` — known-positive control: it answered a CLAUDE.md-only question
+correctly; known-negative: it refused to invent a nonexistent concept, so the harness was genuinely
+loaded — greeted `你好` and `嗨` with **fully Chinese** door menus, and `안녕` with a **fully Korean**
+one, doors included. So the operator's language pin was the **main cause**, and the 1/5 figure above is
+a property of *this* install, not of a consumer's. **Do not cite 1/5 as the shipped behaviour.**
+⚠️ What did *not* close: firing is **non-deterministic** — one Chinese variant (`你好呀`) produced no
+menu at all, and one Korean run opened with an English welcome line. Reps are 1–3 per arm, below this
+repo's own bar. So the softened README wording stays correct; only its *reason* changed.
 
 - **New user** (no session files AND no mapped project tracks under `tracks/` — fresh clone/install; **any underscore-prefixed dir** (`tracks/_*` — `_meta`/`_audit`/`_contrib`/`_chamber`…) doesn't count, general rule not a closed list — `_chamber` holds incubation chamber runs, never mapped projects): 2-door starter, never the returning menu —
 
@@ -591,58 +602,35 @@ runtime (local wiring visible, not independent) · `tier3(<harness>)` a *differe
 target harness ran it · `not-applicable` · degrade triad `DEGRADED_NO_TARGET_ACCESS` could-not /
 `DEGRADED_NOT_RUN` did-not / `UNKNOWN` did-not-look — same shape as `crossfamily:`'s triad,
 **distinct literal values**, do not reuse crossfamily's tokens).
-🟥 **Settle the TARGET CLASS(es) before the tier — §7's `Q0`, added 2026-08-17 (operator decision).**
+🟥 **Settle the TARGET CLASS(es) before the tier — §7's `Q0` (operator decision 2026-08-17).**
 A consumer install **is** another harness; what the enum scopes is not who *receives* the change but
-where it has to be **executed**. Q0 is **not first-match — it can return more than one target, and
-each owes its own tier**: ⓐ a **named peer** whose local repo carries the changed surface, or which
-the cluster registry / a `scripts/adapters/` entry names (decide by that test, not from a name list)
-→ the enum as written · ⓑ the delta changes **consumer-visible behavior** (what a consumer's gate
-blocks or passes, what their session is told to do, what an install receives) → target = a *clean
-install of the packed artifact*, and it binds **now, pre-push — never deferred to the eventual
-release** · ⓒ neither → `not-applicable`. 🟥 Do **not** read «no cross-repo consumer contract» as
-«this file is not shipped» — measured, **194/200 recent non-merge commits touch a shipped path (97%,
-all 6 exceptions hand-verified)**, so shipped-ness cannot be the discriminator; the behavior clause
-is. Pricing the axis at that rate is the **over-triggering** §7's own Trigger paragraph rejects.
-⚠️ 97% measures **the reach of the discarded shipped-path argument**, not the applicability rate —
-how often ⓑ actually fires is **unmeasured in both tails** (it could also land near-universal, which
-would be a rubber stamp — watch the next 20 markers). 🟥 Do **not** cite
-`[[feedback_unreachable_done_when_trains_evasion]]` here: that memory concerns an unreachable *pass
-condition*, and `not-applicable` is an *exemption* — the direction inverts. Three marker-audit legs all failed at that reading;
-they were **not** decorrelated (same family · same prompt · same canon) so that is one observation,
-not three. ⚠️ The consumer-install arm's *presence* half is mechanized at ship time; its
-**execution** half (extract the tarball, run the gate, record command + output) has **no lane** —
-do it by hand, and do not cite that arm as mechanized.
-🟥 **The execution is the load-bearing half** (operator decision 2026-08-16): a static standpoint
-read competes with cross-family review for the same defect classes and mostly loses — *running the
-target harness locally, to completion*, is the part with no substitute. Measured on one delta the
-same day: static read found 1, running the target's own suite found 2 more, one of which printed
-neither `FAIL` nor `❌` and was unreachable by any read. So **`tier2`+ asserts something was RUN** —
-if the review only read, it is `tier1b`, and `tier1b` is deliberately the weak rung so that
-recording it honestly surfaces that the execution arm is still owed. (Broken on the day it was
-written — a static read was recorded as `tier2` because `tier1b` did not yet exist; a missing rung
-gets filled by the next one up rather than staying empty.) Naming note: this collides in
-English with FH's own persona/viewpoint sense of "standpoint" (`fh-meta:beginner`/`main-player`/
-`expert`) — a different axis (which persona reviews, not whose repo is ground truth); kept as-is,
-not renamed, but do not conflate the two. 🟥 **CORRECTED 2026-08-20 — this paragraph used to say
-`standpoint:` was "Prose-only today — no pre-commit hook or fixture suite validates this field yet".
-That is FALSE and was false in this same file**: `validate_standpoint_leg()` is defined at
-`templates/.git-hooks/pre-commit:798` and called at `:1575`, and its fixture suite
-`scripts/test_marker_standpoint_lanes.sh` is wired through `scripts/selfcheck.sh:531`. §자기 대조
-above already said so (PR #429), so **one file carried both claims at once** and a reader landed on
-whichever they reached first. Found by the residency-ledger pass, not by a lane — no check compares
-a rule's self-description against the machinery it describes, which is why a stale "we have not
-built this yet" is the quietest form of drift: it reads as honest modesty and it suppresses use of a
-control that already exists. **What is validated is FORM, not truth** — the hook checks that the
-value is inside the closed enum and that its grounds are non-empty; whether `tier2` is *true* is
-still self-attested, exactly as with `crossfamily:`. That residual is real and unchanged; it is the
-sentence above that was wrong, not the caution. Three artifacts, one carrying two
-independent trials (forge-harness PR #368, a sibling field harness's PR #8 reps=3 and its
-known-answer trial, qasp-dev PR #161 as adjacent corroboration) crossed this repo's own evidence
-bar the same day this was formalized — including one caught by this session's own qasp PR #161
-review, not fed in externally, and a second live demonstration the same day when a cross-harness
-standpoint review of this very section caught real residency and citation defects in the first
-draft (fixed in the same commit that added this line).
-
+where it has to be **executed**. Q0 is **not first-match — it can return more than one target, and each
+owes its own tier**: ⓐ a **named peer** whose local repo carries the changed surface, or which the
+cluster registry / a `scripts/adapters/` entry names → the enum as written · ⓑ the delta changes
+**consumer-visible behavior** (what a consumer's gate blocks or passes, what their session is told to do,
+what an install receives) → target = a *clean install of the packed artifact*, and it binds **now,
+pre-push — never deferred to the eventual release** · ⓒ neither → `not-applicable`.
+🟥 Do **not** read «no cross-repo consumer contract» as «this file is not shipped» — shipped-ness is
+**not** the discriminator; the behavior clause is. ⚠️ The consumer-install arm's *presence* half is
+mechanized at ship time; its **execution** half has **no lane** — do it by hand, and never cite that arm
+as mechanized.
+
+> **Detail**: See `knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §Q0-Evidence`
+> — the 97% shipped-path measurement and what it does *not* say, plus two citation warnings that
+> three marker-audit legs got wrong — read before citing any number from this paragraph.
+
+🟥 **The execution is the load-bearing half** (operator decision 2026-08-16). A static standpoint read
+competes with cross-family review for the same defect classes and mostly loses; *running the target
+harness locally, to completion*, is the part with no substitute. **So `tier2`+ asserts something was RUN**
+— the discriminator is mechanical: **name the command you ran and the output you saw.** Cannot name one →
+`tier1b`, always. Reading the target's real files, however cold, is `tier1b`; that rung is deliberately
+the weak one so that recording it honestly surfaces that the execution arm is still owed.
+
+> **Detail**: See `knowledge/shared/harness-core/field_verdict_crossfamily_gate.md §Standpoint-Execution-Evidence` — the measured
+> one-delta comparison, the two RETRACTED citations this paragraph used to carry, the English naming
+> collision with FH's persona sense of "standpoint", and the 2026-08-20 correction about what the hook
+> actually validates (the enum, not the grounds) — read before citing this paragraph's evidence or
+> claiming what `standpoint:` enforces.
 > **Detail**: See `knowledge/shared/harness-core/field_verdict_crossfamily_gate.md` — the discretion
 > principle, the four-faces failure signature, why same-family review misses it, the full gate
 > mechanics, the n=7 qasp field evidence incl. the **9 default-toward-PASS holes across 3 harnesses**
@@ -824,7 +812,8 @@ deleted branch was carrying).
 **When this gate fires** — *before* any of: branch deletion (local or remote), history rewrite /
 force-push, scrub of tracked history, bulk deletion of session records / tracks content.
 
-1. **Enumerate (measured)**: `bash templates/predelete_check.sh <repo> [base]` — per branch: commits
+1. **Enumerate (measured)** — 🟥 **this step is run BY A HUMAN; no hook executes it** (measured
+   2026-08-20, residency-ledger pass): `bash templates/predelete_check.sh <repo> [base]` — per branch: commits
    off base + unique paths. Verdicts: SAFE (fully merged) · CHECK (0 unique paths but commits off
    base — shared files may hold *newer* content, e.g. an unmerged session card) · REVIEW (unique
    paths — recovery mandatory).
@@ -845,6 +834,15 @@ prose gate is now stopped); it does **not** close the injected/adversarial one
 or errors, this irreversible surface **fails closed** — the pre-push hook blocks (enumerate by hand or
 take the explicit `DESTRUCTIVE_OP_OK=1` override); a tooling-down enumerate step never silently degrades
 into "just delete it."
+🟥 **Read that precisely — the floor is the HOOK, not this script.** `templates/.git-hooks/pre-push`
+implements the per-ref verdict **inline**; it does not call `predelete_check.sh`. Measured 2026-08-20
+(control: the same scan finds `session_close_check` wired in that hook): every in-repo reference to
+`predelete_check.sh` is a **mention, not an execution** — `pre-push:408` lists the path inside a *grep
+pattern*, `destructive_pre_gate.sh:191` *prints the command* as advisory text, and `selfcheck.sh:192`
+runs `bash -n` on it. So the script is the **operator's enumerate tool**, and step 1 above is a human
+step that the machinery reminds you of rather than performs. Stating it the other way round is the
+"prose-invoked floor" the 4-axis marker spec calls M-tier when a rule claims a floor its script has
+no caller for — this section does not make that claim, and this note keeps it from drifting into one.
 
 > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Destructive-Op-Hook-Coverage`
 > — the per-ref verdict mechanics, what the hook does/does not close (honest scope + adversarial residual),
@@ -1005,7 +1003,7 @@ Self-healing is not only FH-self-dev (Mode D 4-axis) and reactive (`verify-bidir
 
 ## Agent Dispatch Operation (FH cwd-Based)
 
-> **Runtime authority (canonical):** one explicit governor per context + capability-routed sidecars; sidecar findings are evidence candidates, not terminal verdicts, until source-closed by the governor *via a mechanical anchor* — never governor agreement alone. CC=action/governor · Codex=repo-grounded audit sidecar · Gemini/agy=breadth/multimodal sidecar · other runtimes=portable `AGENTS.md` entrypoint only. Full doctrine + Maintenance-Cost Rule: `knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Runtime Authority`.
+> **Runtime authority (canonical):** one explicit governor per context + capability-routed sidecars; sidecar findings are evidence candidates, not terminal verdicts, until source-closed by the governor *via a mechanical anchor* — never governor agreement alone. 🟥 **A sidecar audits; it does not WRITE to the target tree** — findings and at-most a proposed patch as text, applied by the governor (measured 2026-08-21: an auditor sidecar edited the tree and its fix introduced a self-referential fail-open that 41 lanes passed). CC=action/governor · Codex=repo-grounded audit sidecar · Gemini/agy=breadth/multimodal sidecar · other runtimes=portable `AGENTS.md` entrypoint only. Full doctrine + Maintenance-Cost Rule: `knowledge/shared/harness-core/multi_model_sidecar_strategy.md §Runtime Authority`.
 
 **Isolated delegation is a component of the identity, not an optional extra** (operator decision,
 2026-08-08). FH/PMH are defined as governor + orchestrator; a harness that cannot dispatch is a
@@ -1020,19 +1018,15 @@ dispatching.** ⓐ the user saying not to, *in this environment* — a veto of *
 Under a conditional, silence is not permission. ⓐ is FH's own default being withdrawn by its owner;
 ⓑ is a sentence in a layer FH does not author. Do not read them as one operation.
 
-⚠️ **Neither direction has a confirmed hook-level floor. Say that plainly rather than implying one.**
-```
-opening    salience only for the POSTURE. The prohibition met in the field is CONDITIONAL,
-           which changes what "override" even means — see the measured block below.
-blocking   ALSO not hook-enforced. `SubagentStart` fires on spawn but is **context-only** —
-           it cannot block, exit 2 only surfaces stderr, and it has no decision field
-           (official hooks reference, read 2026-08-08). It can INJECT context at the moment
-           of dispatch, which is better-placed salience than this file, but still salience.
-UNVERIFIED whether a `permissions` deny entry or a `PreToolUse` matcher can target subagent
-           spawning at all — the reference does not name a tool for it, and this repo has no
-           precedent. **Do not cite a blocking mechanism until someone runs the known pair**
-           (configure the deny, attempt a dispatch, observe). Until then: unverified, not absent.
-```
+⚠️ **Neither direction has a confirmed hook-level floor — say that plainly rather than implying one.**
+Opening (the posture) is salience-only. Blocking is **also** not hook-enforced: `SubagentStart` fires on
+spawn but is **context-only** — it cannot block and has no decision field. Whether a `permissions` deny
+entry or a `PreToolUse` matcher can target subagent spawning at all is **UNVERIFIED** — unverified, not
+absent. 🟥 **Do not cite a blocking mechanism until someone runs the known pair.**
+
+> **Detail**: See `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §Hook-Floor-Unverified`
+> — the per-direction table and what each `UNVERIFIED` line covers — read before claiming any floor here.
+
 **The conditional line, and what a session must do about it.** Some runtimes ship the default
 *"Do not call the AgentTool unless the user requested it"* (with a workflows/deep-research twin).
 Measured 2026-08-09 on this machine: it is **not** a hard-coded constant and **not** global — it is
@@ -1099,14 +1093,10 @@ instruction-shaped. A self-test the session administers to itself is the thing
 > order, the model-bundle gate, the calibrated where-it-is-not table, and the reproduction commands.
 > **Read it before citing any of these numbers or claiming the line is absent from a surface.**
 
-An earlier draft of this very block asserted "a `SubagentStart` hook can deny, and a denial there is a
-real floor." That was false, taken on trust from an adjacent session and written here before the
-reference was read. A second draft, on 2026-08-09, then wrote that the constant's call site "needs
-binary inspection, which was blocked" — **also false**: three plain `grep` calls resolved it, and an
-adversarial reviewer demonstrated that by doing it. Declaring something unmeasurable before trying the
-cheap tool is [[feedback_impossible_verdict_may_be_unread_half]]; the honest label is *"not yet
-measured,"* never *"blocked."* A blind target-tier sim then read it back correctly — which shows a sim measures
-whether text is *followable*, never whether it is *true*. Both checks are needed; neither substitutes.
+🟥 **This block has been wrong twice, both times by asserting more machinery than existed.**
+> **Detail**: See `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §Retraction-SubagentStart` — both retractions and
+> what each teaches (*"not yet measured"* is the honest label, never *"blocked"*) — read before adding a
+> mechanism claim to this section.
 
 So "default-active" is a **posture, not a guarantee**. Measured 2026-08-08: a session running under
 exactly that system-prompt instruction worked alone for a full session and dispatched only at the two
@@ -1142,28 +1132,28 @@ Three execution paths:
 
 **Why not Agent View by default**: Agent View introduces worktree isolation (blocks settings.json writes, Stop hook timing differs), session context gaps (session card stale content bug), and path friction — with no benefit unless the user is actively managing multiple agent sessions. Parallel agents via `Agent` tool work identically in a standard session.
 
-**Fourth reason — gate-integrity in a worktree, and the answer is CONDITIONAL on how `core.hooksPath`
-was set (measured 2026-08-05, both arms).** Do not carry a single verdict here; the two installs
-behave differently:
-
-| `core.hooksPath` | Which hook actually runs in a worktree | Consequence |
-|---|---|---|
-| **relative** — `templates/.git-hooks`, the form every FH doc installs (`CHEATSHEET.md`, `.claude/rules/fh_4axis_gate.md`, `install-wizard`, `self_evolution_routine.md`) | the **worktree's own copy** | Editing that copy *inside the worktree* disables the gate for that worktree — measured: neutralized hook → FH-asset commit with no marker succeeded (`rc=0`). The verifier becomes the verified, and the edit is invisible to `git status` in the main tree. |
-| **absolute** — a hand-set full path (this operator's machine; **not** what any doc tells you to run) | the **main tree's copy** | A worktree-local edit has no effect; a known-positive is blocked there exactly as in the main tree (`rc=1`). |
-
-An earlier draft of this section reported only the absolute-path arm and declared the
-"worktree bypasses the gates" hypothesis *refuted* — from **n=1 on a non-canonical setting**, with a
-do-not-revisit label attached. The relative-path arm, which is what everyone else runs, reproduces
-the bypass. Freezing a conclusion is a defect when the measurement did not cover the shipped
-configuration.
-
-Separately and in **both** arms, the **evidence side** breaks: `tracks/` is gitignored, so it does not
-follow into a worktree, so the Axis 2+3 marker and the Axis 4 `edit_manifest.yaml` are *structurally
-absent* — an FH-asset commit in a worktree fails on evidence it has no way to have. That degrades
-fail-closed (correct), but a gate that **cannot** be satisfied is what trains the bypass. Note the
-hook itself prints `mkdir -p …/tracks/_meta` on that failure, i.e. the actor's own error message
-teaches the marker-creation path — so "just don't fabricate it" is prose sitting under a machine
-instruction pointing the other way.
+**Fourth reason — gate-integrity in a worktree, and it is CONDITIONAL on how `core.hooksPath` was set.**
+With the **relative** form every FH doc installs, the worktree runs **its own copy** of the hook — editing
+that copy there disables the gate for that worktree (measured 2026-08-05: marker-less FH-asset commit
+succeeded). With a hand-set **absolute** path it runs the main tree's copy and the bypass does not exist.
+🟥 **RETRACTED 2026-08-22.** This said the marker and manifest are *structurally absent* in a
+worktree. They are not: `templates/.git-hooks/pre-commit` resolves evidence through
+`git rev-parse --git-common-dir`, which returns the **main tree's** `.git` from inside a worktree.
+Measured in a clean worktree with the known-negative established first (its own `tracks/` = skeleton
+only; `$REPO_ROOT/tracks/_meta/edit_manifest.yaml` NOT FOUND, `$EVIDENCE_ROOT/...` FOUND — the two
+roots disagree, so the probe discriminates).
+**The operating rule is UNCHANGED: do not commit FH assets from a worktree.** Its remaining **open risk areas** — not
+established grounds — are marker provenance, concurrent manifest append, and a copy of `tracks/` that
+appears in a worktree from an unattributed source. They are **deliberately not enumerated as reasons
+here**; an earlier draft enumerated
+them and adversarial review found a defect in nearly every added claim. ⚠️ **Reachable is not automatic**: the hook *reads* `$EVIDENCE_ROOT`, but a
+worktree session writing by relative path lands in the worktree's own `tracks/`, not the main tree's.
+The gate is satisfiable — its failure message prints the absolute `MARKER_DIR` to write to — but the
+routing is the author's job, not the tool's.
+
+> **Detail**: See `knowledge/shared/harness-core/dispatch_conditional_prohibition.md §Worktree-Gate-Integrity` — the two-arm table with
+> exit codes, and why an earlier draft declared the bypass *refuted* from n=1 on a non-shipped setting —
+> read only when you must determine which arm your own install is on.
 
 **Therefore: do not commit FH assets from a worktree.** Not "carry the evidence in carefully" — a
 carried marker and a fabricated one are byte-identical, so *marker provenance* is unenforceable by
@@ -1310,36 +1300,24 @@ Closing phrase detected ("wrap up", "done", "good work", "end session", etc.)
        `package.json`) → Pre-Publish gate → `npm publish` → `git tag vX.Y.Z` at publish. **Propose, don't
        auto-publish.** (Why lockstep — Codex caches on plugin.json version — + drift-check + tag-drift caveat → §detail below.)
 
-       🟥 **WHICH DIGIT — operator decision 2026-08-17, and it is deliberately NOT strict semver.**
-       There was no policy before this line, which is why one session proposed three different bumps
-       for the same delta on three different (and each individually defensible) grounds. Decide by
-       **what the number tells a reader**, not by whether anything technically broke:
+       🟥 **WHICH DIGIT — 운영자 결정(2026-08-17). 의도적으로 strict semver 가 아니다.**
+       판단 기준은 **무엇이 기술적으로 깨졌나**가 아니라 **번호가 읽는 이에게 무엇을 말하나**다.
 
-       | Bump | Reserved for (operator's own wording, 2026-08-17) |
+       | major `+1.0.0` | ⓐ 완전히 새로 지음 · ⓑ 정체성 **다섯이 «전부» 🟢**(= `identity-v1.0.0` 급 사건. 🟥 하나가 🟢 로 올라선 순간이 **아니고**, 정체성 등급은 npm 이 나르는 신호가 **아니다**) · ⓒ capability **class** 가 생기거나 교체됨. 🟥 **이미 있던 게이트를 조인 것에는 절대 안 쓴다** |
        |---|---|
-       | **major** `+1.0.0` | **any one of three**: ⓐ **완전히 새로 지음** — rebuilt from scratch, not extended · ⓑ **정체성이 확립됨** — an identity of the five (+Ⓑ) actually standing 🟢, not progressing toward it · ⓒ **기능이 혁신적으로 변경되거나 늘어남** — a capability *class* appears or is replaced, not a capability instance. 🟥 **Never** for tightening a gate that already existed |
-       | **minor** `+0.1.0` | 미들급 — new assets, new gate lanes, doctrine that changes behavior; **including changes that break a consumer's gate acceptance**, which then carry a mandatory `BREAKING (gate):` line |
-       | **patch** `+0.0.1` | 트리비아급 — fixes, wiring, docs that change no behavior |
-
-       **The discriminator between major-ⓒ and minor**: *class* vs *instance*. A sixth Wave-1 attack
-       angle is an instance → minor. An attack-angle **registry** where none existed is a class → major.
-       Today's delta is instances and tightenings throughout, which is why it is 2.1.0 and not 3.0.0
-       even though it breaks a gate acceptance.
-
-       **Why gate-tightenings are minor here, stated so it is not mistaken for hiding a break**: what
-       breaks is the **record format of a gitignored local marker**, not an API or the consumer's code;
-       the hook prints exactly what to write instead; and the blast radius needs the consumer to have
-       installed the hook AND be making a load-bearing change AND have used the specific old form.
-       Against that, strict semver would burn a major on every gate we tighten — this repo took 2.0.0
-       for a publish-freshness gate one day and would have taken 3.0.0 for a commit gate the next.
-       **A major number that arrives monthly stops meaning anything**, and the milestone it should be
-       reserved for would have no word left.
-
-       ⚠️ **The condition that makes this honest, and it is not optional**: a minor that breaks gate
-       acceptance MUST carry `BREAKING (gate): <what now blocks> — <the one-line remedy>` in the
-       release description AND the CHANGELOG. Without it this policy is just burying breaks in minors.
-       **Applies from 2026-08-17 forward, not retroactively** (2.0.0 was the same class and is left
-       as-is rather than rewritten).
+       | **minor** `+0.1.0` | 새 자산 · 새 게이트 레인 · 행동을 바꾸는 교리. **소비자의 게이트 수용을 깨는 변경도 여기** — 대신 `BREAKING (gate):` 줄이 의무 |
+       | **patch** `+0.0.1` | 수정 · 배선 · 행동 무변경 문서 |
+
+       🟥 **major-ⓒ 와 minor 의 판별자 = *class* 냐 *instance* 냐.** Wave-1 공격각 하나 추가 =
+       instance → minor. 공격각 **레지스트리**가 없던 자리에 생김 = class → major.
+
+       ⚠️ **의무**: 게이트 수용을 깨는 minor 는 릴리스 설명 **과** CHANGELOG 에
+       `BREAKING (gate): <무엇이 이제 막히나> — <한 줄 처방>` 를 반드시 싣는다. 이 줄이 없으면
+       이 정책은 그냥 «minor 에 파괴적 변경을 묻는 것»이다. 2026-08-17 부터 적용, 소급 아님.
+
+       > **Detail**: See `knowledge/shared/harness-core/claude_md_gate_details.md §Version-Digit-Policy`
+       > — 왜 strict semver 가 아닌지, 3.0.0 이 될 뻔한 판례, 게이트-조임을 minor 로 두는 근거와
+       > 그 정직성 조건 — **버전 자릿수를 실제로 정할 때 읽어라.**
   → ④-c Handoff lifecycle (cross-machine continuity) — when a durable **result artifact lands** this
        session (mechanical hint: a new `*result*`/`*signal*`/`*_run_*` file in your companion store or
        `tracks/`), do two things: **(a) ④-c stamps** any `"run this/start here"` run-handoff whose