@chrono-meta/fh-gate 2.6.0 → 2.8.0

package/scripts/test_adapter_lanes.sh

@@ -268,6 +268,71 @@ echo
 #        부재로 HARNESS_ERROR(3) 를 낸다 — 기대값과 같은 값이다. 즉 R2 는 Q5 를 원리적으로
 #        구분하지 못한다. 그건 Q5 의 결함이 아니라 **이 프로브 축의 사각지대**이고,
 #        Q5 는 R1 이 아니라 별도 축(모호 판정 자체를 지우는 중화)으로만 흔들 수 있다.
+# ── P 레인: peer_resolve 자체의 이름 해석 (2026-08-21 신설) ─────────────────────
+# 🟥 이게 왜 필요한가: `peer_resolve.sh` 의 `FH_PROJECTS_HOME` 팔을 `fh_track_resolve.sh` 로
+#    배선하면서 **거짓 AMBIGUOUS 결함이 하나 닫혔는데, 그 변경을 되돌려도 빨개지는 레인이
+#    0개였다**(실측). 즉 기존 31 레인은 이 축에 대해 앵커가 아니다 —
+#    [[feedback_anchor_can_be_decorative]]. 픽스처는 **실제로 뚫려 있던 표기**(공백 이름)를 쓴다.
+#
+# 🟥 **초판 P 레인은 거짓 초록이었다 — 계기가 대상을 안 불렀다.** `peer_resolve.sh` 를
+#    `bash <파일> <이름>` 으로 «실행» 했는데 이 파일은 **sourced 라이브러리**라 실행하면
+#    아무것도 안 하고 rc=0 으로 끝난다. P1·P3 이 그 rc=0 을 «해소 성공» 으로 읽어 초록이었고,
+#    P2 의 빨강도 코드 결함이 아니라 내 하네스 결함이었다. 판별 근거는 **HEAD 에서도 같은
+#    값이 나왔다**는 것이다(변경 전후가 같으면 계기가 대상을 안 보고 있다).
+#    [[feedback_instrument_vs_target_and_budget]] — 이상하면 대상보다 계기를 먼저 의심해라.
+_PR="${FH_ADAPTER_DIR:-$REPO_ROOT/scripts/adapters}/peer_resolve.sh"
+if [ ! -f "$_PR" ]; then
+  echo "  SKIP P 레인 (peer_resolve.sh 없음) — PASS 가 아니라 미검사다"
+else
+  # shellcheck source=scripts/adapters/peer_resolve.sh
+  . "$_PR"
+  if ! type fh_peer_resolve >/dev/null 2>&1; then
+    echo "  ❌ P 레인 하네스 결함 — source 했는데 fh_peer_resolve 가 없다"
+    FAIL=1
+  else
+  _PW="$(mktemp -d)"
+  mkdir -p "$_PW/sp ace" "$_PW/aliased-dev" "$_PW/dual" "$_PW/dual-dev"
+  # P0 컨트롤 — 계기가 대상을 실제로 부르는가. 이게 초록이 아니면 아래 셋은 의미가 없다.
+  FH_PROJECTS_HOME="$_PW" fh_peer_resolve nosuchpeer >/dev/null 2>&1; _prc=$?
+  _lane P0 control "계기 생존 — 없는 peer 는 부재(1)로 온다(rc=0 무음이면 대상을 안 부른 것)" 1 "$_prc"
+  # P1 — 공백 이름 1건: 한 후보가 두 단어로 세어져 거짓 AMBIGUOUS(2) 가 나던 자리
+  FH_PROJECTS_HOME="$_PW" fh_peer_resolve 'sp ace' >/dev/null 2>&1; _prc=$?
+  _lane P1 resolve-guard "공백 이름 1건은 정상 해소 — 거짓 AMBIGUOUS 아님" 0 "$_prc"
+  # P2 컨트롤 — 진짜 모호는 여전히 거부해야 한다(P1 의 통과가 모호검출을 죽인 게 아니다)
+  FH_PROJECTS_HOME="$_PW" fh_peer_resolve dual >/dev/null 2>&1; _prc=$?
+  _lane P2 control "진짜 모호(dual + dual-dev)는 여전히 고르지 않는다" 2 "$_prc"
+  # P3 컨트롤 — 별칭 해소가 실제로 살아 있나(P 레인이 통째로 공허하지 않다는 증거)
+  FH_PROJECTS_HOME="$_PW" fh_peer_resolve aliased >/dev/null 2>&1; _prc=$?
+  _lane P3 resolve-alias "'-dev' 별칭이 해소된다" 0 "$_prc"
+  rm -rf "$_PW"
+  fi
+fi
+# 🟥 **명시 잔여 — 팔 A 는 안 닫혔다.** `FH_CLUSTER_ROOTS`(임의 절대경로의 basename 조회)는
+#    조회 모델이 달라 라이브러리로 통일하지 않았고, 거기 공백 거짓-AMBIGUOUS 가 **그대로 있다**
+#    (실측 확인). 별도 축의 독립 수리이므로 레인을 안 박았다 — 안 잰 것이지 통과한 게 아니다.
+
+# 🟥 **2026-08-21 — 사전등록 두 줄을 갱신했다. 이유를 적는 게 갱신 자체보다 중요하다.**
+#    (위 규율 그대로: 관측에 맞춰 «조용히» 고치면 프로브의 판별력 증거가 사라진다.)
+#      · **R1: `G1 G5 M1 Q1` → `G1 G5 M1 Q1 W1`** — **선재 오류**다. 사전등록이 `qasp_web_rules.sh`
+#        (W 레인) 도입 **이전**에 쓰였고, W1 도 부재 분기에 결박된 레인이라 빨간 게 맞다.
+#        내 변경 이전 HEAD 에서도 `--revert-probe` 는 이 차이로 RC=1 이었다(실측). 즉 이건
+#        내가 깬 게 아니라 **이미 틀려 있던 것을 이번에 갚는 것**이다.
+#      · **R2: 11개 → `M4 Q4 Q7 Q8`** — 이건 **내 변경이 원인**이고, 기대값을 낮추는 것으로
+#        끝내면 안 된다. `peer_resolve.sh` 의 `FH_PROJECTS_HOME` 팔이 이제 별칭을
+#        `fh_track_resolve.sh` 에서 받으므로 **`fh_peer_alias_candidates` 를 안 읽는다** →
+#        그걸 중화해도 안 흔들린다. 남은 넷은 전부 `FH_CLUSTER_ROOTS`(팔 A) 레인이다.
+#        🟥 **명시 잔여 — 커버리지가 줄었다**: R2 는 더 이상 «팔 B 가 별칭을 보는가» 를
+#        흔들지 못한다. 그 축의 앵커는 지금 `scripts/test_track_resolve_lanes.sh`(라이브러리
+#        레인 1~3 + 배선 레인 9)에만 있고, **어댑터 층에는 없다.** 팔 A 는 조회 모델이 달라
+#        (임의 절대경로의 basename) 통일하지 않았으므로 R2 는 그대로 유효하다.
+#        이 잔여를 닫으려면 라이브러리를 중화하는 별도 프로브 축(R3)이 필요하고,
+#        지금 프로브는 `scripts/adapters/` 만 사본으로 뜨므로 **그 축은 아직 없다.**
+#      · **P 레인 추가분(같은 날, 2차)**: `P0 P1` 이 R1 에, `P1` 이 R2 에 들어간다. 사전등록을
+#        P 레인 **추가 전에** 썼기 때문에 빠져 있었다. 기계적 설명: R1 은 부재 분기를 «순진한
+#        추측» 으로 바꾸므로 P0(없는 peer → rc=1 이어야 한다)이 rc=0 을 받아 빨개지고, P1 도
+#        그 조기 반환에 걸린다. R2 는 별칭 후보를 이름 하나로 줄이므로 P1(공백 이름 해소)이
+#        후보 루프를 못 탄다. 🟥 **둘 다 «레인이 그 중화에 실제로 반응한다»는 뜻이라 빨간 게
+#        맞다** — 이 갱신은 기대를 낮추는 게 아니라 **새 앵커를 사전등록에 등록하는 것**이다.
 # ★중화는 **실물 파일이 아니라 사본**에 건다(FH_ADAPTER_DIR). 실물 트리를 건드리지 않고,
 #  사본이 실물과 «중화한 줄 말고는 동일» 함을 적용확인 단계에서 대조한다.
 _revert_probe() {
@@ -317,14 +382,14 @@ case "${1:-}" in
     _revert_probe R1 \
       's|^    printf .peer-resolve: peer|    printf "%s" "${FH_PROJECTS_HOME:-$HOME/projects}/$n"; return 0  # NEUTRALIZED_R1\n    printf '"'"'peer-resolve: peer|' \
       'NEUTRALIZED_R1' \
-      'G1 G5 M1 Q1' \
+      'G1 G5 M1 P0 P1 Q1 W1' \
       '«부재» 분기 중화 → 부재 분기에 결박된 레인만 빨개져야 한다' || RP=1
     echo
     # R2: 별칭 후보를 이름 자신 하나로 줄인다 — `-dev` 를 못 찾게 된다.
     _revert_probe R2 \
       's|^  printf .%s\\n. "\$1" "\$1-dev".*$|  printf "%s\\n" "$1"   # NEUTRALIZED_R2|' \
       'NEUTRALIZED_R2' \
-      'M2 M3 M4 M5 M6 Q2 Q3 Q4 Q6 Q7 Q8' \
+      'M4 P1 Q4 Q7 Q8' \
       '별칭 목록 중화 → mate/qasp 쪽 레인만 빨개져야 한다(gstack 은 별칭이 필요 없다)' || RP=1
     echo
     [ "$RP" -eq 0 ] || FAIL=1

package/scripts/test_heavy_classifier_lanes.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+# test_heavy_classifier_lanes.sh — known-pair anchor for the pre-commit HEAVY/LIGHT path classifier.
+#
+# WHY: the classifier is three `grep -E` lines, and everything downstream of it — Axes 2+3, the
+# marker, the whole full-gate path — is gated on what they match. A term missing from those lines
+# does not FAIL; it makes the gate **silently not apply**, and the commit goes green. There is no
+# louder symptom. Nothing was watching the watcher: measured 2026-08-20, `scripts/test_*.sh` files
+# testing this classifier = **0**, while 12 test files touch the hook for other reasons.
+#
+# Absorbed from a sibling harness (pmh-dev, 2026-08-08) rather than invented here. The load-bearing
+# idea is the extraction below, not the fixture list.
+#
+# 🟥 FH's classifier is FOUR-WAY, not two-way like the sibling's. The port is not a copy:
+#     HEAVY     → full gate
+#     CARVEOUT  → knowledge/ · docs/*.md · AGENTS.md — promoted to HEAVY only if the diff is
+#                 substantive (adds a fenced block or a citation), else demoted to LIGHT
+#     LIGHT     → CATALOG.md · tracks/
+#     uncovered → matches none of the three. **This class is real and is pinned below** — a path
+#                 nobody classified is the quietest way for a surface to leave the gate.
+#
+# This lane pins all four directions. Over-matching is a defect too: a gate that fires on every
+# commit is the one people learn to bypass with `--no-verify`, which disarms the Destructive-Op
+# gate living in the same hook.
+#
+# Usage: bash scripts/test_heavy_classifier_lanes.sh   → exit 0 if all pairs hold, 1 otherwise.
+set -uo pipefail
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
+[ -r "$HOOK" ] || { echo "❌ FAIL — $HOOK not readable"; exit 1; }
+
+FAILED=0
+
+# Extract the LIVE regexes from the hook rather than restating them. A lane that hard-codes its own
+# copy of the pattern passes forever while the real classifier drifts away underneath it — that is
+# testing the fixture instead of the subject, and it is the failure this whole file exists to catch.
+_extract() { # $1 = variable name as it appears at column 0 in the hook
+  sed -n "/^$1=\\\$(echo \"\\\$STAGED\"/,/|| true)/p" "$HOOK" \
+    | grep -o 'grep -E "[^"]*"' | head -1 | sed 's/^grep -E "//; s/"$//'
+}
+HEAVY_RE=$(_extract HEAVY)
+CARVE_RE=$(_extract CARVEOUT)
+LIGHT_RE=$(_extract LIGHT)
+
+# 🟥 Fail CLOSED on extraction failure. An empty regex makes `grep -qE ""` match EVERYTHING, so a
+# silent extraction failure would turn this lane green while classifying every path as heavy.
+for v in HEAVY_RE CARVE_RE LIGHT_RE; do
+  if [ -z "${!v}" ]; then
+    echo "❌ FAIL — could not extract \$$v from the hook."
+    echo "   The hook's shape changed. Fix THIS extraction — do not delete the lane, and do not"
+    echo "   inline a copy of the pattern here (that is how a lane stops covering its subject)."
+    exit 1
+  fi
+done
+
+classify() { # <path> → heavy | carveout | light | uncovered
+  # Order mirrors the hook: HEAVY wins, then CARVEOUT (which the hook excludes
+  # knowledge/shared/rules/ from, since that is already HEAVY), then LIGHT.
+  if printf '%s\n' "$1" | grep -qE "$HEAVY_RE"; then echo heavy
+  elif printf '%s\n' "$1" | grep -qE "$CARVE_RE"; then echo carveout
+  elif printf '%s\n' "$1" | grep -qE "$LIGHT_RE"; then echo light
+  else echo uncovered; fi
+}
+
+check() { # <expect> <path> <why>
+  local expect="$1" path="$2" why="$3" got
+  got=$(classify "$path")
+  if [ "$got" = "$expect" ]; then
+    printf '  ✅ %-9s %-52s %s\n' "$expect" "$path" "$why"
+  else
+    printf '  ❌ %-9s %-52s expected %s, got %s\n' "$expect" "$path" "$expect" "$got"
+    FAILED=1
+  fi
+}
+
+echo "[heavy-classifier] known-pair anchor (4-way)"
+echo "  ── must be HEAVY (full 4-axis gate applies) ──"
+check heavy "plugins/fh-meta/skills/steel-quench/SKILL.md"        "skill spec"
+check heavy "plugins/fh-meta/skills/goal-quench/SKILL_detail.md"  "detail file — the salience-split half"
+check heavy "plugins/fh-meta/skills/fh/assets/note.md"            "any md under a skill dir"
+check heavy "plugins/fh-meta/agents/challenger.md"                "agent definition"
+check heavy ".claude/agents/local.md"                             "repo-local agent definition"
+check heavy ".claude/rules/fh_4axis_gate.md"                      "gate rule"
+check heavy "knowledge/shared/rules/operations.md"                "shared rules — HEAVY, not carveout"
+check heavy "templates/.git-hooks/pre-commit"                     "the gate machinery itself"
+check heavy "templates/CLAUDE.md"                                 "propagated field asset"
+check heavy "CLAUDE.md"                                           "the resident layer"
+check heavy "scripts/selfcheck.sh"                                "shipped executable"
+check heavy "scripts/adapters/qasp_web_rules.sh"                  "nested script still matches"
+
+echo "  ── CARVEOUT (heavy only if the diff is substantive) ──"
+check carveout "knowledge/shared/harness-core/sonnet_floor_doctrine.md" "doctrine prose"
+check carveout "docs/USER_GUIDE.md"                                    "published guide"
+check carveout "AGENTS.md"                                             "Codex entry point"
+
+echo "  ── must stay LIGHT (over-firing trains --no-verify) ──"
+check light "CATALOG.md"                     "index entry"
+check light "tracks/_meta/fh_completed.md"   "session record"
+check light "tracks/qasp/NEXT_ACTION.md"     "field track record"
+
+echo "  ── honestly UNCOVERED — pinned so the residual cannot be believed closed ──"
+check uncovered "README.md"                  "🟥 a README-only commit takes NO 4-axis path"
+check uncovered "package.json"               "files[] / version changes are unclassified"
+check uncovered ".github/workflows/validate.yml" "🟥 CI definition — changing what CI runs is unclassified"
+check uncovered "scripts/memory_link_check.py"   "🟥 .py is not .sh — shipped python is unclassified"
+
+echo "  ── controls (the classifier discriminates, it does not just fire) ──"
+# known-negative: a path that resembles a HEAVY one but must not match. This is the arm that
+# separates "the classifier works" from "the classifier fires on everything" — without it, a
+# regex of `.` would pass every HEAVY row above.
+check uncovered "notes/scripts/foo.sh.txt"   "control — .sh.txt is not a shell script (\$-anchored)"
+check uncovered "notes/skills-overview.md"   "control — 'skills' in a path is not a skill spec"
+# ⚠️ this control was first written as `docs/design/skills-overview.md`, which the lane
+#    correctly classified `carveout` (`^docs/.*\.md$`). The FIXTURE was wrong, not the
+#    subject — pick a path outside every class when the claim is "matches none of them".
+
+# 🟥 KNOWN OVER-MATCH, pinned deliberately as `heavy` rather than "fixed" (2026-08-20).
+# `SKILL(_detail)?\.md` is written WITHOUT a `$` anchor, so any path merely CONTAINING that
+# substring classifies HEAVY — `SKILL.md.bak`, `SKILL.md.orig`, `SKILL.md~`. Recorded, not
+# repaired, for three reasons, and the reasons are the point:
+#   ⓐ the error direction is fail-SAFE — it adds gate coverage, never removes it. The classifier's
+#     dangerous direction is under-matching (the gate silently not applying), which this is not.
+#   ⓑ those paths are not committed in practice, so the over-block the hook warns about
+#     ("a gate that always fires is the one people learn to bypass") does not actually fire here.
+#   ⓒ anchoring it is a live change to gate routing, and gate routing is exactly what this lane
+#     exists to detect changes in. Changing the subject in the same commit that first measures it
+#     leaves no before-state.
+# This row is therefore a RECORD, not an endorsement: if someone anchors the pattern later, this
+# line goes red and they will read this comment — which is the whole job of a known-pair.
+check heavy "docs/skills/SKILL.md.bak"       "🟥 over-match: pattern is unanchored (see comment)"
+
+echo
+echo "🟥 NOT COVERED BY THIS LANE (named, not silently absent):"
+echo "   · \`diff_is_substantive\` — whether a CARVEOUT file is promoted depends on diff CONTENT,"
+echo "     not path. This lane pins the PATH class only. That test needs its own anchor."
+echo "   · the hook's behaviour once classified (marker required, manifest required). Pinned"
+echo "     elsewhere (test_marker_*_lanes.sh); this lane covers only the routing decision."
+
+if [ "$FAILED" -eq 0 ]; then
+  echo "✅ heavy-classifier: all pairs hold"
+  exit 0
+fi
+echo "❌ heavy-classifier: at least one pair broke — the gate's routing changed"
+exit 1

package/scripts/test_listing_watch_lanes.sh

@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+# test_listing_watch_lanes.sh — listing_watch.sh 의 레인.
+# 🟥 네트워크를 안 쓴다: PATH 앞에 `gh` 스텁을 놓아 응답을 고정한다.
+#    (실망 사용 검증은 `--selftest` 가 known-pair 로 따로 한다 — 그건 네트워크가 필요하다)
+HUB="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/.." && pwd)}"
+SUT="$HUB/scripts/listing_watch.sh"
+PASS=0; FAIL=0
+ok(){ PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
+ng(){ FAIL=$((FAIL+1)); printf '  ❌ %s\n     기대: %s\n     실제: %s\n' "$1" "$2" "$3"; }
+
+SB=$(mktemp -d); trap 'rm -rf "$SB"' EXIT
+mkdir -p "$SB/tracks/_meta" "$SB/bin"
+
+mkstub(){ # $1 = state|merged|badexit
+  cat > "$SB/bin/gh" <<STUB
+#!/usr/bin/env bash
+case "\$*" in
+  *"contents/README.md"*) printf '%s' "\$(printf 'chrono-meta/forge-harness' | base64)" ;;
+  # 🟥 본체 jq 는 4필드다: state|merged|라벨개수|라벨목록. 스텁이 3필드면 계기가 대상과 어긋난다.
+  *"issues/33"*)   [ "$1" = "merged" ] && printf 'open|2026-08-19T06:48:10Z|0|' || printf 'open|null|1|validation-passed' ;;
+  *"issues/999"*)  exit 1 ;;
+  *) exit 1 ;;
+esac
+STUB
+  chmod +x "$SB/bin/gh"
+}
+
+run(){ CLAUDE_PROJECT_DIR="$SB" PATH="$SB/bin:$PATH" bash "$SUT" "$@" 2>&1; }
+
+# ── L1: gh 부재 → SKIPPED (pass 아님) ─────────────────────────────
+printf 'walkinglabs/x\t33\tpr\tchrono-meta/forge-harness\n' > "$SB/tracks/_meta/listing_watch_channels.tsv"
+# 🟥 두 번 틀린 자리다. ① 초판: `PATH=/nonexistent` 가 `bash` 까지 지워 «계기» 를 시험했다.
+#    ② 2판: `/bin:/usr/bin` 은 **호스트 의존**이다 — 리눅스에선 거기 진짜 gh 가 있을 수 있고
+#    그러면 이 레인이 «대상» 이 아니라 «그 머신» 을 재게 된다(cross-family 지목).
+#    ③ 정본: 본체에 주입 seam(`LISTING_WATCH_GH`)을 두고 존재하지 않는 이름을 넣는다.
+o=$(CLAUDE_PROJECT_DIR="$SB" LISTING_WATCH_GH="gh-does-not-exist-$$" bash "$SUT" --force 2>&1); r=$?
+case "$o" in *SKIPPED*) ok "L1 gh 부재 → SKIPPED (not passed)" ;; *) ng "L1" "SKIPPED" "$o" ;; esac
+[ "$r" = "0" ] && ok "L1b gh 부재여도 exit 0 (훅 무음 방지)" || ng "L1b" "0" "$r"
+
+# ── L2: 매니페스트 부재 → DISABLED (실패 아님) ────────────────────
+mkstub state
+mv "$SB/tracks/_meta/listing_watch_channels.tsv" "$SB/m.bak"
+o=$(run --force); case "$o" in *DISABLED*) ok "L2 매니페스트 부재 → DISABLED" ;; *) ng "L2" "DISABLED" "$o" ;; esac
+mv "$SB/m.bak" "$SB/tracks/_meta/listing_watch_channels.tsv"
+
+# ── L3: 주석만 있는 매니페스트 → DISABLED (0행을 «정상»으로 안 읽는다) ──
+cp "$SB/tracks/_meta/listing_watch_channels.tsv" "$SB/m.bak"
+printf '# only a comment\n' > "$SB/tracks/_meta/listing_watch_channels.tsv"
+o=$(run --force); case "$o" in *DISABLED*) ok "L3 유효행 0 → DISABLED" ;; *) ng "L3" "DISABLED" "$o" ;; esac
+cp "$SB/m.bak" "$SB/tracks/_meta/listing_watch_channels.tsv"
+
+# ── L4: 최초 실행 → 스냅샷 생성 + 변화 «없음» ─────────────────────
+rm -f "$SB/tracks/_meta/.listing_watch_state.tsv"
+o=$(run --force)
+case "$o" in *최초*) ok "L4 최초 실행을 «변화» 로 오보하지 않는다" ;; *) ng "L4" "최초 실행 안내" "$o" ;; esac
+[ -s "$SB/tracks/_meta/.listing_watch_state.tsv" ] && ok "L4b 스냅샷 파일 생성" || ng "L4b" "비어있지 않은 스냅샷" "(없음)"
+
+# ── L5: 무변화 → 무출력 (오탐 0) ──────────────────────────────────
+o=$(run --force)
+[ -z "$o" ] && ok "L5 무변화 → 무출력" || ng "L5" "(빈 출력)" "$o"
+
+# ── L6: 상태 전이 → 검출 ★ 이 레인이 본체다 ──────────────────────
+mkstub merged
+o=$(run --force)
+# 🟥 배너 문구만 보면 «라벨만 바뀐 버그» 도 통과한다 — **관측된 전이 자체**를 단언한다.
+case "$o" in *"바뀌었다"*) ok "L6 변화 배너 발화" ;; *) ng "L6" "변화 보고" "$o" ;; esac
+case "$o" in *MERGED*) ok "L6b 전이 «내용»이 MERGED 로 찍힌다" ;; *) ng "L6b" "지금: … MERGED" "$o" ;; esac
+case "$o" in *"이전:"*) ok "L6c 이전 상태도 같이 보여준다" ;; *) ng "L6c" "이전: …" "$o" ;; esac
+
+# ── L7: 스로틀 — 24h 안이면 조용 ──────────────────────────────────
+o=$(run)   # --force 없음
+[ -z "$o" ] && ok "L7 스로틀 동작 (24h 내 재실행 조용)" || ng "L7" "(빈 출력)" "$o"
+
+# ── L8: API 실패를 «없음» 이 아니라 FAILED 로 ─────────────────────
+printf 'walkinglabs/x\t999\tpr\t-\n' > "$SB/tracks/_meta/listing_watch_channels.tsv"
+rm -f "$SB/tracks/_meta/.listing_watch_state.tsv"
+run --force >/dev/null
+s=$(cat "$SB/tracks/_meta/.listing_watch_state.tsv" 2>/dev/null)
+case "$s" in *FAILED*) ok "L8 API 실패 → FAILED (0 으로 안 접는다)" ;; *) ng "L8" "FAILED" "$s" ;; esac
+
+# ── L9: 🟥 FAILED 반복이 «무출력» 이 되면 안 된다 (자기 헤더 배반 방지) ──
+cat > "$SB/bin/gh" <<'STUB'
+#!/usr/bin/env bash
+exit 1
+STUB
+chmod +x "$SB/bin/gh"
+printf 'r/x\t1\tpr\t-\n' > "$SB/tracks/_meta/listing_watch_channels.tsv"
+rm -f "$SB/tracks/_meta/.listing_watch_state.tsv"
+run --force >/dev/null 2>&1          # 1회차: 스냅샷이 FAILED 로 굳는다
+o=$(run --force)                      # 2회차: 변화는 «없다» — 그래도 말해야 한다
+case "$o" in *FAILED*|*"읽지 못했다"*) ok "L9 FAILED 반복도 매번 보고 (인증만료≠변화없음)" ;; *) ng "L9" "FAILED 보고" "${o:-（무출력）}" ;; esac
+
+# ── L10: 연속 탭(빈 필드)에서 needle 이 밀리지 않는다 ──
+mkstub state
+printf 'walkinglabs/x\t33\t\tchrono-meta/forge-harness\n' > "$SB/tracks/_meta/listing_watch_channels.tsv"
+rm -f "$SB/tracks/_meta/.listing_watch_state.tsv"
+run --force >/dev/null 2>&1
+s9=$(cat "$SB/tracks/_meta/.listing_watch_state.tsv" 2>/dev/null)
+case "$s9" in *LISTED*) ok "L10 빈 필드 있어도 needle 이 제자리 (IFS 탭 축약 방지)" ;; *) ng "L10" "LISTED" "$s9" ;; esac
+
+# ── L11: 개행 없는 마지막 행도 읽는다 ──
+printf 'walkinglabs/x\t33\tpr\tchrono-meta/forge-harness\nwalkinglabs/y\t33\tpr\tchrono-meta/forge-harness' > "$SB/tracks/_meta/listing_watch_channels.tsv"
+rm -f "$SB/tracks/_meta/.listing_watch_state.tsv"
+run --force >/dev/null 2>&1
+n=$(grep -c . "$SB/tracks/_meta/.listing_watch_state.tsv" 2>/dev/null || echo 0)
+[ "$n" = "2" ] && ok "L11 개행 없는 마지막 행 누락 안 함 (2/2)" || ng "L11" "2행" "${n}행"
+
+# ── L12: 라벨 개수를 실어 ["a,b"] 와 ["a","b"] 를 가른다 ──
+case "$s9" in *"	"[0-9]*:*) ok "L12 라벨 필드가 «개수:목록» 형태" ;; *) ng "L12" "N:labels" "$s9" ;; esac
+
+# ── L13/L14: 🟥 **반대 플랫폼 흉내** — 이 둘이 이 스위트의 하중선이다.
+#    2026-08-21 실측: 로컬(macOS) 16/16 초록인데 **CI(리눅스)에서 L7·L9 가 죽었다.**
+#    원인 둘 다 «한 플랫폼에서만 나는» 형태였다:
+#      ⓐ `stat -f %m` 은 GNU 에서 **실패가 아니라 성공하며 파일시스템 정보를 뱉는다**
+#         → `||` 폴백이 안 타고 산술식이 깨진다
+#      ⓑ grep 패턴의 `\t` 를 GNU grep 은 **리터럴 t** 로 읽는다 → FAILED 보고가 0건
+#    로컬 초록이 증거가 못 된다는 뜻이므로, **여기서 반대 플랫폼을 스텁으로 만든다.**
+mkstub state
+printf 'walkinglabs/x\t33\tpr\tchrono-meta/forge-harness\n' > "$SB/tracks/_meta/listing_watch_channels.tsv"
+rm -f "$SB/tracks/_meta/.listing_watch_state.tsv"
+
+# L13: `stat -f` 가 «성공하면서 쓰레기» 를 내는 플랫폼(=GNU)에서도 스로틀이 산다
+cat > "$SB/bin/stat" <<'STUB'
+#!/usr/bin/env bash
+# GNU 흉내: -f 는 성공하며 파일시스템 정보(비숫자)를 낸다 · -c %Y 만 mtime
+if [ "$1" = "-f" ]; then echo "  ID: deadbeef Namelen: 255  Type: ext2/ext3"; exit 0; fi
+if [ "$1" = "-c" ]; then echo 1000000000; exit 0; fi
+exit 1
+STUB
+chmod +x "$SB/bin/stat"
+run --force >/dev/null 2>&1            # 스냅샷 생성
+o=$(run 2>&1)                          # --force 없음 → 스로틀이 조용해야
+case "$o" in
+  *"syntax error"*|*"ext2"*) ng "L13 GNU-stat 흉내에서 스로틀 붕괴" "(빈 출력)" "$o" ;;
+  "") ok "L13 GNU-stat 흉내에서도 스로틀 정상 (비숫자 mtime 방어)" ;;
+  *) ng "L13" "(빈 출력)" "$o" ;;
+esac
+rm -f "$SB/bin/stat"
+
+# L14: grep 패턴의 `\t` 를 리터럴 t 로 읽는 플랫폼(=GNU grep)에서도 FAILED 가 보고된다
+#      → 실제 탭을 쓰는지 확인. 스크립트가 `\t` 를 패턴에 쓰면 여기서 죽는다.
+cat > "$SB/bin/gh" <<'STUB'
+#!/usr/bin/env bash
+exit 1
+STUB
+chmod +x "$SB/bin/gh"
+cat > "$SB/bin/grep" <<'STUB'
+#!/usr/bin/env bash
+# GNU 흉내: 패턴 안의 백슬래시-t 는 «리터럴 t» 다 (탭이 아니다)
+args=(); for a in "$@"; do case "$a" in *'\t'*) a="${a//\\t/t}" ;; esac; args+=("$a"); done
+exec /usr/bin/grep "${args[@]}"
+STUB
+chmod +x "$SB/bin/grep"
+printf 'r/x\t1\tpr\t-\n' > "$SB/tracks/_meta/listing_watch_channels.tsv"
+rm -f "$SB/tracks/_meta/.listing_watch_state.tsv"
+run --force >/dev/null 2>&1
+o=$(run --force 2>&1)
+case "$o" in *"읽지 못했다"*|*FAILED*) ok "L14 GNU-grep 흉내에서도 FAILED 보고 (실제 탭 사용)" ;; *) ng "L14 grep \\t 이식성" "FAILED 보고" "${o:-（무출력）}" ;; esac
+rm -f "$SB/bin/grep"
+
+printf '\nLISTING_WATCH_LANES: %d passed, %d failed\n' "$PASS" "$FAIL"
+[ "$FAIL" -eq 0 ] || exit 1

package/scripts/test_marker_defense_lanes.sh

@@ -0,0 +1,152 @@
+#!/usr/bin/env bash
+# test_marker_defense_lanes.sh — regression fixtures for pre-commit's validate_defense_leg
+# (Wave 1-D defense line, 2026-08-20).
+#
+# WHY THIS FILE EXISTS AT ALL: the procedure was absorbed from a sibling harness whose own document
+# asserted "the commit hook reads that line" and "pinned by scripts/test_marker_floor_lanes.sh".
+# 🟥 Measured twice, with a control (`crossfamily` → 21 hits in the same file): BOTH claims were
+# **0 hits** there. The prose was portable; the machine was not. This lane is the machine, built
+# here, so that FH's own claim is true when FH makes it.
+#
+# Fixtures assert BOTH directions (known-pair): every intended shape is admitted, and every hole the
+# leg closes still blocks. A suite that only asserts BLOCK cannot tell "blocked" from "blocked for
+# the wrong reason"; one that only asserts PASS cannot see a leg that admits everything.
+#
+# Usage: bash scripts/test_marker_defense_lanes.sh   Exit: 0 = all behave; 1 = regression.
+
+set -uo pipefail
+# Script-relative, NOT `git rev-parse --show-toplevel` — same reason as the sibling lanes: in a
+# vendored tree rev-parse answers with the OUTER repo and the suite measures somebody else's files.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+
+sed -n '/^validate_defense_leg()/,/^}/p' "$HOOK" > "$T/fn.sh"
+
+# Instrument calibration BEFORE any fixture runs. An empty extraction would let every BLOCK
+# fixture "pass" against nothing and every PASS fixture fail — and the suite would still print a
+# verdict. Assert the body actually arrived.
+if ! grep -q 'estimation-layer' "$T/fn.sh"; then
+  echo "❌ HARNESS-ERROR — validate_defense_leg did not extract from $HOOK."
+  echo "   Fixtures below would measure an empty function. Aborting rather than reporting green."
+  exit 1
+fi
+
+pass=0; fail=0
+mk() { printf '%s\n' "$2" > "$T/$1"; }
+run() { bash -c "source '$T/fn.sh'; validate_defense_leg '$T/$1'" >/dev/null 2>&1; }
+want() { # $1=fixture $2=expect(pass|block) $3=label
+  local rc; run "$1"; rc=$?
+  local got; [ "$rc" -eq 0 ] && got=pass || got=block
+  if [ "$got" = "$2" ]; then printf '  ✅ %-6s %s\n' "$2" "$3"; pass=$((pass+1))
+  else printf '  ❌ %-6s %s — got %s\n' "$2" "$3" "$got"; fail=$((fail+1)); fi
+}
+
+GOOD='axis2-defense: reproducibility=bash scripts/test_marker_defense_lanes.sh at 4c1f2ab fairness=both arms reps=3, same fixture dir, same shell estimation-layer=all measured; known-pair separated arm from control'
+
+echo "[marker-defense] known-pair fixtures"
+echo "  ── admitted (must not over-block; over-blocking teaches --no-verify) ──"
+mk ok.md          "floor-status: sonnet-floor
+$GOOD"
+want ok.md          pass  "all three substantive"
+mk multiline.md   "floor-status: sonnet-floor
+axis2-defense: reproducibility=git show 9cd7350 -- scripts/selfcheck.sh
+               fairness=arm and control both on 2.6.0 tarball, reps=1 each, named
+               estimation-layer=counts measured; the 2,367 b/day figure is a quotation"
+want multiline.md   pass  "continuation lines are one value"
+mk order.md       "floor-status: below-floor
+axis2-defense: estimation-layer=measured via npm pack --dry-run --json fairness=same tarball both arms reproducibility=npm pack @chrono-meta/fh-gate@2.6.0"
+want order.md       pass  "sub-answers in any order"
+
+echo "  ── blocked ──"
+mk none.md        "floor-status: sonnet-floor"
+want none.md        block "no axis2-defense line at all"
+mk empty.md       "floor-status: sonnet-floor
+axis2-defense:"
+want empty.md       block "key present, value empty (silence is not an answer)"
+mk partial.md     "floor-status: sonnet-floor
+axis2-defense: reproducibility=bash scripts/selfcheck.sh completes rc=0 fairness=both arms on same tree"
+want partial.md     block "estimation-layer missing — a partial form is not a defense"
+# 🟥 rc IS NOT ENOUGH HERE — measured by a revert probe on 2026-08-20, the day this was written.
+# Deleting the completeness guard leaves `partial.md` STILL blocked, because an absent sub-answer
+# also reads as an empty (vacuous) one and the next guard catches it. Gating on the exit code alone
+# therefore certifies a guard that is doing nothing: the classic decorative anchor. What the
+# completeness guard actually buys is the PRESCRIPTION — "missing sub-answer(s): estimation-layer"
+# tells the author which question they skipped, where "too short" sends them to rewrite the wrong
+# field. A gate's output is half its product, so the lane measures the output.
+want_msg() { # $1=fixture $2=substring $3=label
+  local out; out=$(bash -c "source '$T/fn.sh'; validate_defense_leg '$T/$1'" 2>&1)
+  if printf '%s' "$out" | grep -qF "$2"; then printf '  ✅ %-6s %s\n' "msg" "$3"; pass=$((pass+1))
+  else printf '  ❌ %-6s %s — output did not contain %s\n' "msg" "$3" "$2"; fail=$((fail+1)); fi
+}
+want_msg partial.md "missing sub-answer(s): estimation-layer" \
+  "prescription NAMES the skipped question (guard is load-bearing for the message)"
+# (the short.md prescription control lives below, AFTER that fixture is created —
+#  🟥 it was first written here, before `mk short.md`, so it measured a NON-EXISTENT file and
+#  read the "no line at all" message. The lane was wrong, not the subject. Fixture order is
+#  part of the instrument.)
+mk vacuous.md     "floor-status: sonnet-floor
+axis2-defense: reproducibility=ok fairness=yes estimation-layer=n/a"
+want vacuous.md     block "filled form, not an answer"
+mk short.md       "floor-status: sonnet-floor
+axis2-defense: reproducibility=ran it fairness=same estimation-layer=nums"
+want short.md       block "too short to name a command, reps or layer"
+want_msg short.md   "vacuous answer(s)" \
+  "control — the short case takes the OTHER prescription (the two are distinguishable)"
+mk dup.md         "floor-status: sonnet-floor
+$GOOD
+$GOOD"
+want dup.md         block "two lines — the reader takes the first, so a correction is shadowed"
+
+echo "  ── call-site pin (a function nobody calls is prose) ──"
+# 🟥 Found by cross-family review 2026-08-20 (codex/gpt-5.5), self-detection 0: this suite extracts
+# the FUNCTION and calls it directly, so deleting the hook's call site left every lane green while
+# the leg stopped running — and the skill doc claimed "pre-commit runs this". That is the exact
+# defect class this whole file was built to stop importing, reproduced one layer up.
+# The pin is a grep, and its limit is stated rather than hidden: it proves the call EXISTS and sits
+# in the full-gate marker block, not that the block is reached. Reachability is pinned by the hook's
+# own end-to-end lanes, not here.
+cs=$(grep -c 'validate_defense_leg "\$MARKER"' "$HOOK")
+if [ "$cs" -eq 1 ]; then
+  printf '  ✅ %-6s %s\n' "call" "hook calls validate_defense_leg exactly once"; pass=$((pass+1))
+else
+  printf '  ❌ %-6s %s — found %s call site(s)\n' "call" "hook calls validate_defense_leg exactly once" "$cs"; fail=$((fail+1))
+fi
+# and that the call is gated on the floor tiers the doc claims — not on load-bearing, which is
+# where it was first (wrongly) wired.
+if grep -B4 'validate_defense_leg "\$MARKER"' "$HOOK" | grep -qE 'floor-status:.*sonnet-floor\|below-floor'; then
+  printf '  ✅ %-6s %s\n' "call" "call is gated on floor-status (sonnet-floor|below-floor)"; pass=$((pass+1))
+else
+  printf '  ❌ %-6s %s\n' "call" "call is NOT gated on floor-status — scope drifted from the doc"; fail=$((fail+1))
+fi
+
+echo "  ── prescriptions (rc alone certifies guards that do nothing) ──"
+# 🟥 Same shadowing as the completeness guard: removing the presence guard leaves none.md/empty.md
+# still blocked by the missing-subanswer guard, so rc cannot see it. What presence buys is the
+# prescription that shows the author the whole field shape.
+want_msg none.md  "no 'axis2-defense:' line" \
+  "presence guard is load-bearing for its own message"
+want_msg empty.md "no 'axis2-defense:' line" \
+  "empty value takes the same prescription as absent (silence is silence)"
+
+echo "  ── controls (the leg discriminates; it does not just fire) ──"
+# 🟥 known-NEGATIVE for over-blocking: a legitimate answer that merely LOOKS terse per-field but
+# clears the bar. Without this, a leg that blocked everything would pass every BLOCK row above.
+mk borderline.md  "floor-status: sonnet-floor
+axis2-defense: reproducibility=see PR #471 CI log job 96296828886 fairness=arms differ: control is v2.5.1 tarball — stated estimation-layer=one measured, one quoted from CHANGELOG"
+want borderline.md  pass  "control — admits an honest answer that NAMES an asymmetry"
+# 🟥 known-negative on the em-dash: `fairness` here contains a dash, which must NOT truncate parsing
+mk dashes.md      "floor-status: sonnet-floor
+axis2-defense: reproducibility=git log main..HEAD --oneline fairness=both arms — same reps, same env estimation-layer=measured; instrument calibrated on a known pair"
+want dashes.md      pass  "control — dashes inside a value do not truncate it"
+
+echo
+if [ "$fail" -eq 0 ]; then
+  echo "✅ marker-defense: $pass lanes hold (0 failed)"
+  echo "   🟥 SCOPE: this suite pins PRESENCE, COMPLETENESS and NON-VACUITY. It cannot pin whether"
+  echo "   the answers are TRUE — that is the operator's and the weekly audit's, like every other"
+  echo "   marker field. A green line here is not a claim that the defense was actually mounted."
+  exit 0
+fi
+echo "❌ marker-defense: $fail failed / $pass passed"
+exit 1