@chrono-meta/fh-gate 3.0.0 → 3.1.0

package/scripts/session_close_check.sh

@@ -269,6 +269,73 @@ fi
 
 fi
 
+# ── ①-f UTTERANCE LANDING (advisory) ─────────────────────────────────────────
+# WHY. 마감 체크는 **형식**만 본다 — 카드가 로그보다 새로운가, 필수 아티팩트가 있는가.
+# **운영자 발화가 기록에 착지했는지는 아무도 안 봤다.** `utterance_landing_check.sh` 가 그걸
+# 재려고 2026-08-08 에 지어졌는데 probes.tsv 를 **손으로** 짜야 해서 호출부가 0 개였다
+# (2026-09-05 실측: 이 파일에서 그 스크립트를 부르는 줄이 하나도 없었다). 그 사이의 빠진 칸이
+# `utterance_intake.sh` 다 — 전사본에서 발화를 뽑아 프로브를 자동 생성한다.
+# 근거: 같은 날 운영자의 교리·설계급 발화 6 건이 착지한 경로가 전부 **거버너의 손**이었다.
+#
+# 🟥 라벨이 `①-e` 가 아닌 이유: 그건 아래 stray-path 블록이 **이미 쓰고 있다.** 한 라벨을 두
+#    검사가 나눠 쓰면 「어느 ①-e 가 울렸나」를 아무도 못 가른다 — 이 배선을 준비한 진단은
+#    «①-e 는 비어 있다» 고 적었고, 그건 거짓이었다(레인 L13 이 «배선 전인데 초록» 으로 잡았다).
+#
+# 🟥 **advisory 다 — 막지 않는다.** 프로브는 키 낱말이라 기록이 같은 뜻을 다른 낱말로 적으면
+#    과차단이 난다(안전한 방향이지만 소음이다). 노출 사다리(shadow) 로 몇 세션 관찰한 뒤
+#    close push 차단으로 승격할지는 **운영자 결정**이고, 그때까지 FAIL 을 세우지 않는다.
+_UI_SUT="$FH/scripts/utterance_intake.sh"
+if [ -f "$_UI_SUT" ]; then
+  # 세션 id 의 정본은 `branch_claim.sh` 다 — **새 판정기를 짓지 않는다**(재발명 금지).
+  # `show` 의 `세션ID` 줄이 그 값이고, 값이 `pid-` 로 시작하면 런타임이 id 를 안 준 것이라
+  # 전사본을 특정할 수 없다. 그때는 «다른 세션 것을 대신 읽는» 대신 UNMEASURED 로 남긴다 —
+  # 남의 전사본으로 낸 착지 판정은 틀린 답이지 근사값이 아니다.
+  _UI_SID=""
+  if [ -f "$FH/scripts/branch_claim.sh" ]; then
+    _UI_SID=$(LC_ALL=C bash "$FH/scripts/branch_claim.sh" show 2>/dev/null \
+              | LC_ALL=C sed -n 's/^세션ID[[:space:]][[:space:]]*//p' | head -1)
+  fi
+  case "$_UI_SID" in pid-*|'') _UI_SID="" ;; esac
+  # 전사본 slug = 프로젝트 절대경로에서 `/` `.` `_` 를 `-` 로 (실측 2026-09-05, ~/.claude/projects 대조)
+  _UI_SLUG=$(printf '%s' "$FH" | tr '/._' '---')
+  _UI_TRDIR="${FH_TRANSCRIPT_DIR:-$HOME/.claude/projects/$_UI_SLUG}"
+  _UI_TR="$_UI_TRDIR/$_UI_SID.jsonl"
+  if [ -z "$_UI_SID" ]; then
+    echo "ℹ️  ①-f UNMEASURED — 세션 id 미상(런타임이 CLAUDE_CODE_SESSION_ID 를 안 줬다)"
+    echo "     전사본을 특정할 수 없다. «발화가 다 적혔다» 가 아니라 «못 쟀다» 다."
+  elif [ ! -f "$_UI_TR" ]; then
+    echo "ℹ️  ①-f UNMEASURED — 전사본 부재: $_UI_TR"
+    echo "     부재를 0 으로 접지 마라 — 발화가 없었다는 뜻이 아니다."
+  else
+    # 기록 대상: 오늘자 산출 + 상시 카드/UAP. 배열로 모은다(zsh word-split 함정 회피).
+    _UI_RECS=()
+    for _p in "$FH/tracks/_meta/fh_completed_$TODAY.md" \
+              "$FH/tracks/_meta/user_adaptation_profile.md" \
+              "$FH/tracks/_meta/reference_next_session_starter.md"; do
+      [ -f "$_p" ] && _UI_RECS+=("$_p")
+    done
+    for _p in "$FH"/tracks/_meta/fh_signal_"$TODAY"_*.md "$FH"/tracks/*/*_"$TODAY".md; do
+      [ -f "$_p" ] && _UI_RECS+=("$_p")
+    done
+    if [ "${#_UI_RECS[@]}" -eq 0 ]; then
+      echo "⚠️  ①-f 오늘자 기록 파일이 하나도 없다 — 발화 착지를 잴 대상이 없다(UNMEASURED)"
+      echo "     ④/⑤ 가 아직 안 돌았다는 뜻일 수 있다. 마감 순서를 확인해라."
+    else
+      _UI_OUT=$(bash "$_UI_SUT" "$_UI_TR" "${_UI_RECS[@]}" 2>&1); _UI_RC=$?
+      case "$_UI_RC" in
+        0) echo "✅ ①-f 발화 착지 — 프로브 전건 착지 (${#_UI_RECS[@]} 파일 대조)"
+           echo "     ⚠️ 발화별 최장 토큰 ⌈n/2⌉ 일치 기준(키 2 개 이하는 OR) — «제대로 적혔다» 의 증명이 아니다." ;;
+        1) echo "⚠️  ①-f 미착지 발화가 있다 — advisory, 막지 않는다. 아래를 **확인**해라(기록 강제 아님):"
+           printf '%s\n' "$_UI_OUT" | sed 's/^/     /' ;;
+        *) echo "⚠️  ①-f 발화 착지 검사 UNMEASURED/계기이상 (rc=$_UI_RC) — 0 으로 읽지 마라"
+           printf '%s\n' "$_UI_OUT" | sed 's/^/     /' ;;
+      esac
+    fi
+  fi
+else
+  echo "⚠️  ①-f utterance_intake.sh 없음 — skipped, not passed (UNMEASURED)"
+fi
+
 # ② FH assets changed today → harvest-loop owed
 # NOTE: no `grep -q` here — under `set -o pipefail`, -q's early exit SIGPIPEs git log (141),
 # masking a real match as pipeline failure so the warning NEVER fired on true positives
@@ -704,5 +771,38 @@ else
   echo "⚠️  ①-e stray_path_scan.sh 없음 — skipped, not passed"
 fi
 
+# ── ①-f PUSH-ZONE advisory (surface-not-block; mirrors the pre-push hook's own zone check) ────
+# WHY: templates/.git-hooks/pre-push blocks a single push whose remote sits outside the owner-
+# account list, but it only ever sees the ONE push in front of it. The 2026-07-26 miss this whole
+# axis exists for was a multi-repo ROUND — CLAUDE.local.md §REST API push 계정규칙 was applied
+# correctly to one org repo and forgotten on another in the SAME round. `scripts/push_zone_check.sh`
+# is the hand-run ENUMERATE tool for that round; wiring it here means it runs at least once per
+# close without the operator separately remembering to ask for it — same shape as the ①-b open-PR
+# sweep above. Advisory only: it lists, it never blocks (CLAUDE.md §Surface-Class Degrade Invariant,
+# reversible half — a session-close check is not the irreversible boundary; that is the pre-push
+# hook's job). Applicability is mechanical: both the script and an owner-account list must exist,
+# or this reports UNCALIBRATED rather than guessing.
+_PZ_SCRIPT="$FH/scripts/push_zone_check.sh"
+_PZ_OWNERS="${PUSH_ZONE_OWNERS:-$FH/.claude/rules/.push-zone-owners}"
+if [ -x "$_PZ_SCRIPT" ] && [ -f "$_PZ_OWNERS" ]; then
+  if _pz_out=$(bash "$_PZ_SCRIPT" 2>&1); then
+    # Counts only — the enumerator prints owner-account names and per-repo owners, and this close
+    # output lands in transcripts and session cards. The pre-push block never prints the list; this
+    # advisory must not either (codex #9, 2026-09-05). The names are one command away for the operator.
+    _pz_n=$(printf '%s\n' "$_pz_out" | grep -cE '^(✅|🔶) ' 2>/dev/null || true)
+    _pz_rest=$(printf '%s\n' "$_pz_out" | grep -cE '^🔶 ' 2>/dev/null || true)
+    echo "⚠️  ①-f push-zone: ${_pz_n:-0} repo(s) enumerated · ${_pz_rest:-0} outside the owner accounts (REST channel) — names withheld here; run: bash scripts/push_zone_check.sh"
+  else
+    # Verified 2026-09-05: push_zone_check.sh does not exit non-zero merely because `gh` is
+    # missing (its own `active="(unknown)"` fallback absorbs that) — the only documented non-zero
+    # exit is UNCALIBRATED for a missing owner list, already excluded by the `-f "$_PZ_OWNERS"`
+    # guard above. A non-zero exit reaching here is therefore an unanticipated failure; report it
+    # as UNMEASURED rather than silently treating empty/partial output as "nothing to enumerate".
+    echo "⚠️  ①-f push-zone: UNMEASURED — push_zone_check.sh exited non-zero, could not enumerate"
+  fi
+else
+  echo "⏭️  ①-f push-zone UNCALIBRATED — script or owner-account list absent"
+fi
+
 echo "── close check: $([ "$FAIL" -eq 0 ] && echo CONSISTENT || echo VIOLATIONS) ──"
 exit "$FAIL"

package/scripts/sim_isolated_run.sh

@@ -149,6 +149,23 @@
 #        이유는 헤더 상단 "WHAT THIS GIVES YOU" 절이 이미 말한다 — 여기서 되풀이하지 않는다.
 #   요약: 파일시스템 코퍼스 축(WIPE+RESEED)은 클론 단위로 이미 wipe-and-reseed다. 기계 표면 축은
 #   아니다 — 탐지기이지 리셋기가 아니다. 이 두 문장이 "샌드박스 표준"의 정직한 전부다.
+#
+# ── timeout(1) RESOLUTION — macOS ships none, and launchd's PATH cannot see Homebrew's
+#   (2026-09-05, measured) ──────────────────────────────────────────────────────────────────────
+#   WHY: stock macOS ships no `timeout(1)`. Homebrew coreutils installs `gtimeout` (plain
+#   `timeout` only if the user un-prefixes GNU coreutils onto PATH) under a prefix an interactive
+#   login shell sees but a launchd job's PATH does NOT — this repo's own plist templates ship
+#   `$HOME/.local/bin:/usr/local/bin:/usr/bin:/bin`, no Homebrew prefix at all. The first launchd
+#   live-eval run (2026-09-05 02:30) hit exactly this: every one of 12 probes × 2 arms died at
+#   `timeout: command not found` before `claude` ever ran, and the report showed 12/12
+#   FAILED-TO-RUN with no clue why — a "did this fire" question this repo cares about a great
+#   deal (§Skeleton-Not-Muscle) answered wrong for a reason that had nothing to do with the
+#   harness under test. FH ships this script via npm (package.json `files[]`), so a stock-macOS
+#   consumer with no Homebrew coreutils hits the identical wall running it by hand — this is not
+#   a launchd-only defect. Resolution below: GNU `timeout` → `gtimeout` → a bash-native watchdog
+#   fallback, so a run never silently trades "no timeout enforcement" for "works on my machine".
+#   The resolved kind is printed in the run header as `timeout_tool=` so a run names its own
+#   control rather than leaving it to be inferred from a failure days later.
 
 set -uo pipefail
 
@@ -311,6 +328,7 @@ while [ $# -gt 0 ]; do
     --base-sha) BASE_SHA="${2:-}"; shift 2 ;;
     --setup)   SETUP="${2:-}"; shift 2 ;;  # shell run INSIDE each clone before the sim. See below.
     --extra-tools) EXTRA="${2:-}"; shift 2 ;;  # append tools to the mode's set. See TOOL VISIBILITY.
+    --mcp-config) MCPCFG="${2:-}"; shift 2 ;;  # the ONLY MCP servers an arm may see (see MCP ISOLATION). Default: none.
     *) echo "unknown flag: $1" >&2; exit 2 ;;
   esac
 done
@@ -320,6 +338,62 @@ case "$MODE" in observe|act) ;; *) echo "FAIL: --mode must be observe|act" >&2;
 
 command -v claude >/dev/null 2>&1 || { echo "FAIL: claude CLI not on PATH" >&2; exit 2; }
 
+# ── timeout(1) resolution — see §timeout(1) RESOLUTION in the header above for WHY. ──────────────
+# GNU `timeout` → Homebrew's `gtimeout` → a bash-native watchdog. Never silently proceeds with NO
+# enforcement at all — that would trade "wrong binary name" for "no timeout, ever", which is worse.
+TIMEOUT_KIND=""; TIMEOUT_BIN=""
+if command -v timeout >/dev/null 2>&1; then
+  TIMEOUT_KIND="gnu"; TIMEOUT_BIN="$(command -v timeout)"
+elif command -v gtimeout >/dev/null 2>&1; then
+  TIMEOUT_KIND="gtimeout"; TIMEOUT_BIN="$(command -v gtimeout)"
+else
+  TIMEOUT_KIND="bash-fallback"; TIMEOUT_BIN=""
+fi
+
+# fh_run_with_timeout SECONDS CMD... — used only when neither `timeout` nor `gtimeout` resolved.
+# Backgrounds CMD, TERMs it if SECONDS elapses, grants 5s to exit cleanly, then KILLs. The verdict
+# "did this actually time out" is a FLAG FILE the watchdog writes when it intervenes — not CMD's
+# own exit code — because a child that catches SIGTERM and exits 0 anyway must still be reported
+# as timed out (matching GNU timeout's rc=124 convention), not read as if it had answered normally.
+fh_run_with_timeout() {
+  local _secs="$1"; shift
+  local _flag; _flag="$(mktemp "${TMPDIR:-/tmp}/fh_to_XXXXXX")"; rm -f "$_flag"
+  "$@" &
+  local _cpid=$!
+  ( sleep "$_secs" 2>/dev/null
+    if kill -0 "$_cpid" 2>/dev/null; then
+      : > "$_flag"
+      kill -TERM "$_cpid" 2>/dev/null
+      sleep 5
+      kill -0 "$_cpid" 2>/dev/null && kill -KILL "$_cpid" 2>/dev/null
+    fi
+  ) &
+  local _watchdog=$!
+  local _rc=0
+  wait "$_cpid" 2>/dev/null; _rc=$?
+  # The watchdog subshell owns a `sleep`; killing the subshell alone leaves that sleep as an
+  # orphan for up to SECONDS (test_frontier_digest_retry.sh challenger B-2 measured exactly this
+  # class). Kill the subshell's children first, then the subshell.
+  pkill -P "$_watchdog" 2>/dev/null; kill "$_watchdog" 2>/dev/null; wait "$_watchdog" 2>/dev/null
+  if [ -f "$_flag" ]; then
+    rm -f "$_flag"
+    return 124
+  fi
+  rm -f "$_flag" 2>/dev/null
+  return "$_rc"
+}
+
+# fh_timeout SECONDS CMD... — drop-in for `timeout SECONDS CMD...` using whichever kind resolved
+# above. The call site never branches on TIMEOUT_KIND itself.
+fh_timeout() {
+  local _secs="$1"; shift
+  case "$TIMEOUT_KIND" in
+    gnu)      command timeout "$_secs" "$@" ;;
+    gtimeout) command gtimeout "$_secs" "$@" ;;
+    *)        fh_run_with_timeout "$_secs" "$@" ;;
+  esac
+}
+
 OUTDIR="${OUTDIR:-$(mktemp -d "${TMPDIR:-/tmp}/fh-sim-XXXXXX")}"
 mkdir -p "$OUTDIR"
 
@@ -355,6 +429,7 @@ _model_known_cutoff() { # $1=--model 값 → ISO 월 또는 UNKNOWN
 
 echo "── sim_isolated_run ──────────────────────────────────────────────"
 echo "arm=$ARM mode=$MODE model=$MODEL reps=$REPS timeout=${TIMEOUT}s"
+echo "timeout_tool=${TIMEOUT_KIND}${TIMEOUT_BIN:+:$TIMEOUT_BIN}"
 echo "out=$OUTDIR"
 
 snapshot "$OUTDIR/_machine_before.txt"
@@ -435,6 +510,19 @@ for r in $(seq 1 "$REPS"); do
   #     compaction_probe.sh 7 중 1 · starter.md 22 중 1 — 여유 충분
   ARM_BLIND_PATHS=( "scripts/fixtures" "scripts/round" "scripts/context_continuity_score.sh" )
   for _bp in "${ARM_BLIND_PATHS[@]}"; do
+    # 🟥 STATUS 오염 차단 (2026-09-06) — `rm` 만 하면 클론의 `git status` 가 `D` 160줄이 되고,
+    #    그 목록이 세션 시작 컨텍스트로 **팔에** 들어간다. 실측: 기록된 응답 76개 중 11개가
+    #    삭제된 파일을 «이름으로» 인용했고 **11건 전부 primary · 컨트롤 0** — 오염이 한쪽 팔에만
+    #    걸려 «없는 차이»를 만드는 방향이었다([[feedback_instrument_blindspot_correlated_with_arm]]).
+    #    skip-worktree 로 인덱스가 삭제를 안 보게 한 뒤 지운다. 파일은 여전히 실제로 부재이므로
+    #    헤더의 «없는 파일은 어느 도구로도 못 읽는다» 보장은 그대로다(아래 [ -e ] 판정이 그것을 잰다).
+    #    ⚠️ 남는 잔여: `git ls-files` 는 이름을 계속 나열한다(인덱스 메타데이터). observe 모드엔
+    #    Bash 가 없어 도달 불가, **act 모드엔 도달 가능** — 닫힌 게 아니라 좁아진 것이다.
+    _bp_n=$(git -C "$WORK" ls-files -- "$_bp" 2>/dev/null | wc -l | tr -d ' ')
+    if [ "${_bp_n:-0}" -gt 0 ]; then
+      git -C "$WORK" ls-files -z -- "$_bp" 2>/dev/null \
+        | xargs -0 git -C "$WORK" update-index --skip-worktree -- 2>/dev/null || true
+    fi
     rm -rf "$WORK/$_bp"
     # 🟥 rm 의 rc 를 안 믿는다 — 경로 오타면 rm 은 «성공»을 낸다(지울 게 없으니).
     #    판정은 «제거 후에 정말 없는가»로 한다.
@@ -514,8 +602,16 @@ for r in $(seq 1 "$REPS"); do
   #    부르며 정직하게 거부하면서도, 거부문 안에서 정답을 말한다. 채점기는 그걸 토큰으로 센다.
   #    이것이 회차 1~3 과 probe1~4 를 전부 무효로 만든 근인이고, 경로 deny·코퍼스 마스킹은
   #    **원리적으로 못 막는다**(도구 읽기가 아니라 프롬프트 조립이다).
-  ( cd "$WORK" && timeout "$TIMEOUT" claude -p "$PROMPT" \
-        --model "$MODEL" "${TOOLS[@]}" \
+  # 🟥 MCP ISOLATION (measured 2026-09-05, QP chamber floor sim): a headless arm launched by this
+  #    runner saw the OPERATOR'S user-scope MCP servers (a cloud drive, a wiki, a browser bridge)
+  #    in its tool list — the clone isolates files and settings, not `~/.claude.json` MCP scope.
+  #    A blind arm with a write-capable MCP is a residency hole, not a sim. `--strict-mcp-config`
+  #    = "only the servers given by --mcp-config" (CLI --help), and with no --mcp-config that is
+  #    NONE. An arm that legitimately needs a server (e.g. Playwright for a web target) gets it
+  #    explicitly via --mcp-config <file inside the clone>; nothing is inherited.
+  MCPARGS=(--strict-mcp-config); [ -n "${MCPCFG:-}" ] && MCPARGS+=(--mcp-config "$MCPCFG")   # bash 3.2 + set -u: expanded with the ${a[@]+"${a[@]}"} idiom below
+  ( cd "$WORK" && fh_timeout "$TIMEOUT" claude -p "$PROMPT" \
+        --model "$MODEL" "${TOOLS[@]}" ${MCPARGS[@]+"${MCPARGS[@]}"} \
         < /dev/null 2>"$OUTDIR/${ARM}_r${r}.stderr.txt" ) > "$OUTDIR/${ARM}_r${r}.txt"
   rc=$?
   bytes=$(wc -c < "$OUTDIR/${ARM}_r${r}.txt" | tr -d ' ')

package/scripts/test_action_yml_lanes.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# test_action_yml_lanes.sh — behavioural lanes for action.yml's exit-code mapping.
+#
+# WHY: `action.yml` is the only place where the gate's SEVEN typed exit codes get turned into a
+# GitHub step outcome. That translation is exactly where a typed verdict silently becomes a
+# boolean — the failure this repo names in `[[feedback_not_found_is_not_zero_family]]`. Two
+# properties carry the weight and neither is visible by reading the YAML:
+#   A. an UNKNOWN exit code (a future gate version adding one) must land on HARNESS_ERROR-class
+#      handling, never on PASS. A `case` whose `*)` arm is missing would default to... nothing,
+#      and `verdict` would be unset — which under `set -u` is a crash, but under a careless edit
+#      could become an empty string that matches no fail-on entry and exits 0. That is the leak.
+#   B. `reviewed` must be false for every code where no review ran (10 · 11 · 12 · unknown).
+#      «did not run» reported as «passed» is the same defect class as a skipped check scored green.
+#
+# HOW: the mapping is extracted from action.yml and executed as shell — the lanes run the REAL
+# case block, not a copy. A copy would drift and every lane would stay green while the shipped
+# file rotted (that is `[[feedback_built_but_not_wired]]` wearing a test's clothes).
+#
+# USAGE: bash scripts/test_action_yml_lanes.sh   → exit 0 all pass · 1 any fail · 10 harness error
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+A="$ROOT/action.yml"
+[ -f "$A" ] || { echo "❌ HARNESS: action.yml absent at $A"; exit 10; }
+PASS=0; FAIL=0
+ok(){ PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
+no(){ FAIL=$((FAIL+1)); printf '  ❌ %s\n' "$1"; }
+chk(){ if [ "$1" = "0" ]; then ok "$2"; else no "$2"; fi; }
+
+# ── extract the real case block from the shipped file ────────────────────────────────────────
+MAP="$(awk '/^ *case "\$rc" in/{f=1} f{print} /^ *esac/{if(f){exit}}' "$A" | sed 's/^ *//')"
+[ -n "$MAP" ] || { echo "❌ HARNESS: could not extract the case block from action.yml"; exit 10; }
+printf '%s' "$MAP" | grep -q 'esac' || { echo "❌ HARNESS: extracted block has no esac (truncated)"; exit 10; }
+
+verdict_for(){ # $1 = rc → prints "verdict reviewed"
+  rc="$1"; verdict=""; reviewed=""
+  eval "$MAP"
+  printf '%s %s' "${verdict:-<UNSET>}" "${reviewed:-<UNSET>}"
+}
+
+echo "── L1 documented exit codes map to their documented verdict ──"
+while read -r rc want_v want_r; do
+  got="$(verdict_for "$rc")"
+  [ "$got" = "$want_v $want_r" ]; chk $? "rc=$rc → $want_v (reviewed=$want_r) [got: $got]"
+done <<'CASES'
+0 PASS true
+1 PENDING true
+2 BLOCKED true
+3 ESCALATE true
+10 HARNESS_ERROR false
+11 ARG_ERROR false
+12 DRY_RUN false
+CASES
+
+echo "── L2 KNOWN-NEGATIVE: an undocumented exit code is never PASS and never reviewed=true ──"
+for rc in 4 5 9 13 42 127 255; do
+  got="$(verdict_for "$rc")"; v="${got%% *}"; r="${got##* }"
+  { [ "$v" != "PASS" ] && [ "$v" != "PENDING" ] && [ "$v" != "<UNSET>" ] && [ "$r" = "false" ]; }
+  chk $? "rc=$rc → $v (reviewed=$r) — not a pass, not unset"
+done
+
+echo "── L3 the mapping is TOTAL: no rc leaves verdict unset (the silent-green hole) ──"
+_unset=0
+for rc in $(seq 0 20) 42 100 127 255; do
+  got="$(verdict_for "$rc")"; case "$got" in "<UNSET>"*) _unset=$((_unset+1)) ;; esac
+done
+[ "$_unset" -eq 0 ]; chk $? "0 of 28 sampled codes leave verdict unset (found $_unset)"
+
+echo "── L4 CONTROL: a mutated mapping without the catch-all IS caught (the lane can fail) ──"
+_MUT="$(printf '%s' "$MAP" | grep -v '^\*)')"
+verdict_mut(){ rc="$1"; verdict=""; reviewed=""; eval "$_MUT"; printf '%s' "${verdict:-<UNSET>}"; }
+[ "$(verdict_mut 42)" = "<UNSET>" ]; chk $? "catch-all removed → rc=42 leaves verdict unset (control is alive)"
+[ "$(verdict_mut 0)" = "PASS" ]; chk $? "…and the mutant still maps documented codes (mutation is surgical)"
+
+echo "── L5 action.yml's documented codes match scripts/fh-gate.sh's exit contract ──"
+G="$ROOT/scripts/fh-gate.sh"
+if [ -f "$G" ]; then
+  _gate_codes="$(grep -oE '^#   [0-9]+ +—' "$G" | grep -oE '[0-9]+' | sort -un | tr '\n' ' ')"
+  _act_codes="$(printf '%s' "$MAP" | grep -oE '^[0-9]+\)' | grep -oE '[0-9]+' | sort -un | tr '\n' ' ')"
+  [ -n "$_gate_codes" ]; chk $? "CONTROL: the gate's exit contract was actually parsed (got: $_gate_codes)"
+  [ "$_gate_codes" = "$_act_codes" ]; chk $? "every documented gate code has an action arm [gate: $_gate_codes | action: $_act_codes]"
+else
+  echo "  ⬜ L5 SKIPPED (not PASS) — scripts/fh-gate.sh absent, contract un-cross-checked"
+fi
+
+echo "── L6 fail-on default is fail-closed: every non-reviewed verdict is in it ──"
+_failon="$(grep -A3 "^  fail-on:" "$A" | grep "default:" | sed "s/.*default: *'//; s/'.*//")"
+[ -n "$_failon" ]; chk $? "CONTROL: fail-on default parsed (got: $_failon)"
+for v in BLOCKED ESCALATE HARNESS_ERROR ARG_ERROR DRY_RUN UNKNOWN; do
+  case ",$_failon," in *",$v,"*) ok "fail-on default contains $v" ;; *) no "fail-on default is MISSING $v — that verdict would exit 0" ;; esac
+done
+for v in PASS PENDING; do
+  case ",$_failon," in *",$v,"*) no "fail-on default contains $v (over-blocks a reviewed pass)" ;; *) ok "fail-on default correctly omits $v" ;; esac
+done
+
+echo ""
+echo "── action.yml lanes: $PASS passed · $FAIL failed ──"
+[ "$FAIL" -eq 0 ]

package/scripts/test_fh_qp_lanes.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# test_fh_qp_lanes.sh — known-pair lanes for plugins/fh-qp (QP · Quality Platform).
+#
+# What it proves: the MECHANICAL half (plugins/fh-qp/scripts/qp_tools.sh) discriminates on fixtures
+# shipped with the plugin — three negatives from the chamber oracle (profile-required target → refuse ·
+# adapter absent → HARNESS_ERROR · dirty evidence → masked, residue 0), surface_reach four states,
+# the verdict-record contract (mtm-check), the state-changing-verb floor, and a residency scan of the
+# whole scaffold (fail-closed when the scanner cannot run — exit 10 is never read as clean).
+# What it does NOT prove: that a session FOLLOWS the SKILL prose (that is the floor-tier sim's job),
+# or that any verdict label is TRUE (judgment, deliberately unmechanised).
+# Exit: 0 all lanes pass · 1 any lane fails · 10 harness error (plugin/tool missing).
+set -uo pipefail
+FH="$(cd "$(dirname "$0")/.." && pwd)"
+T="$FH/plugins/fh-qp/scripts/qp_tools.sh"
+X="$FH/plugins/fh-qp/fixtures"
+[ -f "$T" ] || { echo "HARNESS-ERROR: $T missing"; exit 10; }
+[ -d "$X" ] || { echo "HARNESS-ERROR: fixtures dir missing"; exit 10; }
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/fhqp.XXXXXX")"; trap 'rm -rf "$TMP"' EXIT
+PASS=0; FAIL=0
+lane() { # $1 name · $2 expected rc · $3 expected stdout regex · rest = command
+  local name="$1" want_rc="$2" want_re="$3"; shift 3
+  local out rc; out="$("$@" 2>&1)"; rc=$?
+  if [ "$rc" = "$want_rc" ] && printf '%s' "$out" | /usr/bin/grep -qE "$want_re"; then
+    PASS=$((PASS+1)); printf '  ✅ %-34s rc=%s  %s\n' "$name" "$rc" "$(printf '%s' "$out" | head -1 | cut -c1-70)"
+  else
+    FAIL=$((FAIL+1)); printf '  ❌ %-34s rc=%s (want %s /%s/)\n     %s\n' "$name" "$rc" "$want_rc" "$want_re" "$out"
+  fi
+}
+echo "── fh-qp lanes ──"
+# ── negative ① profile-required → refuse (and the positive pair: public passes, profile unlocks) ──
+lane N1-private-host-refused      4  '^PROFILE_REQUIRED kind=web'          bash "$T" target-class https://private.example.internal/x
+lane N1-rfc1918-refused           4  '^PROFILE_REQUIRED'                   bash "$T" target-class http://10.1.2.3/login
+lane N1-desktop-needs-profile     4  '^PROFILE_REQUIRED kind=desktop'      bash "$T" target-class app:SomeApp
+lane N1-public-passes             0  '^PUBLIC kind=web host=example\.com'  bash "$T" target-class https://example.com/
+printf 'targets:\n  web:\n    - base_url: https://private.example.internal\n' > "$TMP/profile.yaml"
+lane N1-profile-unlocks           0  '^PROFILE_OK'                         bash "$T" target-class https://private.example.internal/x --profile "$TMP/profile.yaml"
+lane N1-bad-form-unknown         10  '^UNKNOWN'                            bash "$T" target-class ftp://x
+# ── negative ② adapter absent → HARNESS_ERROR (pair: present → ADAPTER=) ──
+lane N2-no-tools-harness-error   10  '^HARNESS_ERROR reason=tool-list-not-supplied' bash "$T" adapter-probe --need web
+lane N2-wrong-kind-harness-error 10  '^HARNESS_ERROR reason=no-desktop-adapter'     bash "$T" adapter-probe --need desktop --tools "mcp__playwright__browser_navigate,Read"
+lane N2-web-adapter-found         0  '^ADAPTER=playwright-mcp evidence=dom'         bash "$T" adapter-probe --need web --tools "Read,mcp__playwright__browser_navigate"
+lane N2-desktop-adapter-found     0  '^ADAPTER=computer-use-mcp evidence=pixel'     bash "$T" adapter-probe --need desktop --tools "mcp__computer-use__screenshot"
+# ── negative ③ dirty evidence → masked, residue 0 (pair: clean stays clean; raw never survives) ──
+lane N3-dirty-masked              0  '^MASKED residue=0'                   bash "$T" mask "$X/evidence_known_dirty.txt" "$TMP/masked.txt"
+if /usr/bin/grep -qE 'qa\.tester@|hunter2|eyJhbGci|abcdefghijklmnop' "$TMP/masked.txt"; then FAIL=$((FAIL+1)); echo "  ❌ N3-raw-survived-in-output"; else PASS=$((PASS+1)); echo "  ✅ N3-raw-absent-in-output"; fi
+lane N3-clean-stays-clean         0  '^MASKED residue=0'                   bash "$T" mask "$X/evidence_known_clean.txt" "$TMP/masked2.txt"
+lane N3-missing-input-harness    10  '^HARNESS_ERROR'                      bash "$T" mask "$X/does_not_exist.txt" "$TMP/m3.txt"
+# ── surface_reach four states ──
+lane SR-reached                   0  '^REACHED tcs_beyond_entry=2 tcs_total=2'      bash "$T" surface-reach "$X/reach_known_reached.tsv"
+lane SR-partial                   5  '^PARTIAL tcs_beyond_entry=1 tcs_total=2'      bash "$T" surface-reach "$X/reach_known_partial.tsv"
+lane SR-wall                      5  '^NOT_REACHED tcs_beyond_entry=0 tcs_total=3'  bash "$T" surface-reach "$X/reach_known_wall.tsv"
+: > "$TMP/reach_empty.tsv"   # generated here — an empty file cannot travel in a diff (PATCH.diff dropped it; measured 2026-09-05)
+lane SR-empty-unmeasured         10  '^UNMEASURED reason=evidence-empty'           bash "$T" surface-reach "$TMP/reach_empty.tsv"
+lane SR-missing-unmeasured       10  '^UNMEASURED reason=evidence-missing'         bash "$T" surface-reach "$X/no_such_file.tsv"
+# ── verdict record contract ──
+lane MTM-good                     0  '^OK mtm=UNAVAILABLE rows=3 machine_closed=2 judgment_left=1' bash "$T" mtm-check "$X/verdicts_known_good.tsv"
+lane MTM-branch-needs-active     10  'DIFFERS_FROM_PLAN-needs-mtm-ACTIVE'                        bash "$T" mtm-check "$X/verdicts_known_bad_branch.tsv"
+lane MTM-vacuous-machine         10  'MACHINE-closure-without-assertion'                         bash "$T" mtm-check "$X/verdicts_known_bad_vacuous_machine.tsv"
+printf '#mtm: ACTIVE\nTC-1\tFAIL\tDIFFERS_FROM_PLAN\tMACHINE\tverify\ttext-visible:x\tINVENTORY\n' > "$TMP/v_src.tsv"
+lane MTM-branch-source-binding   10  'DIFFERS_FROM_PLAN-needs-expected_source=PLAN_DOC'          bash "$T" mtm-check "$TMP/v_src.tsv"
+printf 'TC-1\tPASS\tAS_PLANNED\tMACHINE\tclick\tx\tINVENTORY\n' > "$TMP/v_nomtm.tsv"
+lane MTM-state-line-required     10  'mtm-state-missing'                                         bash "$T" mtm-check "$TMP/v_nomtm.tsv"
+lane VERBS-good                   0  '^OK state_changing_verbs=2'          bash "$T" run-verbs "$X/verdicts_known_good.tsv"
+lane VERBS-verify-only            5  '^VERIFY_ONLY'                        bash "$T" run-verbs "$X/verdicts_verify_only.tsv"
+# ── screen-id: same content with different ref tokens → same id; different content → different id ──
+printf -- '- heading "Home" [level=1] [ref=e2]\n- link "About" [ref=e7]\n' > "$TMP/s1.md"
+printf -- '- heading "Home" [level=1] [ref=f3e2]\n- link "About"   [ref=f3e7]\n' > "$TMP/s2.md"
+printf -- '- heading "About" [level=1] [ref=e2]\n' > "$TMP/s3.md"
+id1=$(bash "$T" screen-id "$TMP/s1.md"); id2=$(bash "$T" screen-id "$TMP/s2.md"); id3=$(bash "$T" screen-id "$TMP/s3.md")
+if [ "$id1" = "$id2" ] && [ "$id1" != "$id3" ] && [ ${#id1} -eq 12 ]; then PASS=$((PASS+1)); echo "  ✅ SID-content-hash-stable-across-refs ($id1)"; else FAIL=$((FAIL+1)); echo "  ❌ SID-content-hash ($id1 / $id2 / $id3)"; fi
+# ── residency: the whole scaffold, fail-closed ──
+FILES="$(cd "$FH" && find plugins/fh-qp scripts/test_fh_qp_lanes.sh -type f | sort)"
+# Worktrees do not carry the gitignored operator pattern file — fall back to the main checkout's copy
+# (git-common-dir), else honour RESIDENCY_PATTERNS, else the scanner exits 10 and this lane FAILS (fail-closed).
+if [ -z "${RESIDENCY_PATTERNS:-}" ] && [ ! -f "$FH/.claude/rules/.residency-patterns" ]; then
+  _common="$(cd "$FH" && git rev-parse --git-common-dir 2>/dev/null)"
+  [ -n "$_common" ] && [ -f "$_common/../.claude/rules/.residency-patterns" ] && export RESIDENCY_PATTERNS="$(cd "$_common/.." && pwd)/.claude/rules/.residency-patterns"
+fi
+if [ -f "$FH/scripts/residency_closure_scan.py" ]; then
+  # shellcheck disable=SC2086
+  out="$(cd "$FH" && python3 scripts/residency_closure_scan.py --files $FILES 2>&1)"; rc=$?
+  case "$rc" in
+    0)  PASS=$((PASS+1)); echo "  ✅ RES-closure-scan CLEAN ($(printf '%s' "$FILES" | wc -l | tr -d ' ') files)" ;;
+    10) if printf '%s' "$out" | grep -q '운영자 패턴 파일이 없다'; then
+          # CI and consumer clones structurally lack the operator override (gitignored). That is
+          # UNMEASURED, not a failure of the shipped files — the generic RES-zero-constant-grep lane
+          # below is the guarantee that travels; this lane measures only where the override exists.
+          echo "  ⚪ RES-closure-scan SKIPPED — operator patterns file absent (UNMEASURED, not clean; the generic grep lane still runs)"
+        else
+          FAIL=$((FAIL+1)); echo "  ❌ RES-closure-scan HARNESS (rc=10 — defaults missing or pattern compile error)"; echo "$out" | tail -3
+        fi ;;
+    *)  FAIL=$((FAIL+1)); echo "  ❌ RES-closure-scan TAINTED (rc=$rc)"; echo "$out" | tail -5 ;;
+  esac
+else
+  FAIL=$((FAIL+1)); echo "  ❌ RES-closure-scan scanner missing (fail-closed)"
+fi
+# generic zero-constant grep (no scanner needed): private hosts / secrets shapes must not appear in shipped files
+# except inside the profile EXAMPLE and fixtures, which exist to show the shapes.
+# The lane itself is the instrument (its known-negative literals are the point) — scanned by residency above, excluded here.
+SHIPPED="$(printf '%s' "$FILES" | /usr/bin/grep -vE 'fixtures/|qp_profile\.example\.yaml|test_fh_qp_lanes\.sh')"
+# shellcheck disable=SC2086
+hits="$(cd "$FH" && /usr/bin/grep -nE '\b(10|192\.168)\.[0-9]+\.[0-9]+\.[0-9]+\b|eyJ[A-Za-z0-9_-]{8,}\.|AKIA[A-Z0-9]{8,}' $SHIPPED 2>/dev/null | /usr/bin/grep -vE 'qp_tools\.sh:.*(_MASK_|case|10\.\*)' || true)"
+if [ -z "$hits" ]; then PASS=$((PASS+1)); echo "  ✅ RES-zero-constant-grep (0 hits in shipped files)"; else FAIL=$((FAIL+1)); echo "  ❌ RES-zero-constant-grep"; echo "$hits"; fi
+echo "── fh-qp lanes: $PASS passed, $FAIL failed ──"
+[ "$FAIL" -eq 0 ]

package/scripts/test_gate_two_verdicts_lanes.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# test_gate_two_verdicts_lanes.sh — pre-commit 의 `_acceptance_evidence_line` 계약을 고정한다.
+#
+# WHY (2026-09-06, frontier-digest 답습 · arXiv:2609.04167 «SWE-Gate»): 그 논문의 실측은
+# 기능 테스트를 통과한 수리 644 건 중 **221 건(34%)** 이 실제 PR 리뷰 코멘트에서 뽑은 제약을
+# 어겼다는 것이고, 처방은 «기능 정확성과 리뷰 제약 충족을 따로 채점하라» 다. 이 훅도 같은
+# 형태였다 — 축이 다 통과하면 «ALL AXES PASSED» 라는 **합성 판정 하나**만 찍혔고, 마커의
+# `crossfamily: DEGRADED_PANEL_UNUSED` 같은 값은 출력 어디에도 안 나왔다.
+#
+# SCOPE — 채널이지 판정이 아니다(§Mechanization Boundary): 이 함수는 «어떤 값이 적혔나」만
+# 찍는다. 값의 진위를 판정하지 않고, 어떤 경우에도 종료코드를 바꾸지 않는다. 그래서 레인도
+# «막나」가 아니라 «가려지나」를 잰다 — 특히 DEGRADED/UNKNOWN 이 조용히 사라지지 않는지.
+#
+# 종료코드: 0 = 계약대로 · 1 = 회귀
+set -uo pipefail
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+HOOK="$REPO_ROOT/templates/.git-hooks/pre-commit"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+[ -f "$HOOK" ] || { echo "ⓘ $HOOK absent — subject missing when we looked (NOT a pass)"; exit 2; }
+
+sed -n '/^_acceptance_evidence_line()/,/^}/p' "$HOOK" > "$T/fn.sh"
+# 계기 보정: 추출이 비면 아래 픽스처가 «아무것도 아닌 것」을 재고 전부 통과한다.
+if ! grep -q '_acceptance_evidence_line' "$T/fn.sh"; then
+  echo "❌ HARNESS-ERROR — _acceptance_evidence_line 이 $HOOK 에서 추출되지 않았다."
+  echo "   픽스처가 빈 함수를 잴 참이었다. 초록을 보고하지 않고 중단한다."
+  exit 1
+fi
+
+FAIL=0
+run() { bash -c 'set -uo pipefail; . "$1"; _acceptance_evidence_line "$2"' _ "$T/fn.sh" "${1:-}" 2>&1; }
+lane() { # $1=id  $2=marker body ('' = 마커 없음)  $3..=출력에 반드시 있어야 하는 조각들
+  local id="$1" body="$2"; shift 2
+  local path="" out n rc
+  if [ -n "$body" ]; then path="$T/m.marker"; printf '%s\n' "$body" > "$path"; fi
+  out=$(run "$path"); rc=$?
+  if [ $rc -ne 0 ]; then
+    printf '  ❌ %-34s 함수가 rc=%s — 보고 전용인데 실패했다\n     %s\n' "$id" "$rc" "$out"; FAIL=1; return
+  fi
+  for n in "$@"; do
+    if ! printf '%s' "$out" | grep -qF -- "$n"; then
+      printf '  ❌ %-34s «%s» 가 출력에 없다\n     %s\n' "$id" "$n" "$out"; FAIL=1; return
+    fi
+  done
+  printf '  ✅ %-34s %s\n' "$id" "$(printf '%s' "$out" | head -1)"
+}
+
+echo "== 수용-근거 줄: 값이 그대로 드러나는가 =="
+
+# L1 known-positive — 네 필드가 다 있으면 네 값이 다 나온다
+lane L1-all-four "crossfamily: panel(codex,gemini) — 2라운드
+standpoint: tier2(qasp) — 명령과 출력을 댔다
+thirdparty: checked — 상류 소스 독해
+oracle: known-pair — 양성/음성 픽스처" \
+  "crossfamily=panel(codex,gemini)" "standpoint=tier2(qasp)" "thirdparty=checked" "oracle=known-pair"
+
+# L2 🟥 하중 레인 — DEGRADED 가 «통과» 뒤에 숨지 않는다 (이 레인 스위트의 존재 이유)
+lane L2-degraded-visible "crossfamily: DEGRADED_PANEL_UNUSED — 패널 미사용
+standpoint: not-applicable — Q0 ⓒ
+oracle: none — 잴 값이 없다" \
+  "crossfamily=DEGRADED_PANEL_UNUSED" "standpoint=not-applicable"
+
+# L3 UNKNOWN 도 마찬가지 — «안 봤다»가 «봤는데 괜찮다»로 안 접힌다
+lane L3-unknown-visible "crossfamily: UNKNOWN — 안 봤다
+standpoint: UNKNOWN — 안 봤다" \
+  "crossfamily=UNKNOWN" "standpoint=UNKNOWN"
+
+# L4 부재는 «(없음)» 으로 — 빈 문자열이면 필드가 있었는지조차 안 보인다 (미측정≠0)
+lane L4-absent-is-typed "axis2-model: opus" \
+  "crossfamily=(없음)" "standpoint=(없음)" "thirdparty=(없음)" "oracle=(없음)"
+
+# L5 마커 자체가 없는 경로(경량 게이트) — 근거가 «있다»고 주장하지 않는다
+lane L5-no-marker "" "n/a" "경량 게이트"
+
+# L6 들여쓴 필드도 읽는다(마커는 손으로 쓰는 파일이다)
+lane L6-indented "  crossfamily: declined — 근거 있음" "crossfamily=declined"
+
+# L7 첫 줄만 — 같은 키가 둘이면 앞의 것을 찍고 조용히 합치지 않는다
+lane L7-first-wins "crossfamily: UNKNOWN — 안 봤다
+crossfamily: panel(codex) — 나중 줄" "crossfamily=UNKNOWN"
+
+# L8 🟥 첫 실사용이 잡은 결함 — 괄호 «안»에 공백이 있으면 값이 잘려 문법도 깨진 문자열이 찍혔다
+#    (`thirdparty: checked(확인한 것 = …)` → `checked(확인한`). 판별자는 «괄호가 닫혔는가» 하나.
+lane L8-open-paren-trimmed "thirdparty: checked(확인한 것 = 초록 원문 대조)" "thirdparty=checked"
+# L9 반대편 — 닫힌 괄호는 값의 일부라 그대로 살아야 한다(L8 의 수리가 이걸 깨면 안 된다)
+lane L9-closed-paren-kept "crossfamily: panel(codex,gemini) — 2라운드" "crossfamily=panel(codex,gemini)"
+lane L9b-tier-paren-kept  "standpoint: tier2(qasp) — 명령과 출력" "standpoint=tier2(qasp)"
+
+# L8b 잘린 값이 «그대로» 새어나오지 않는지 직접 확인 (needle 부재를 단언)
+printf 'thirdparty: checked(확인한 것 = x)\n' > "$T/p.marker"
+if run "$T/p.marker" | grep -qF 'checked(확인한'; then
+  echo "  ❌ L8b 잘린 괄호 문자열이 아직 출력에 있다"; FAIL=1
+else
+  echo "  ✅ L8b 잘린 괄호 문자열은 출력에 없다"
+fi
+
+# ── 컨트롤 A (판별력): 값이 다르면 출력도 달라야 한다 ─────────────────────
+printf 'crossfamily: panel(codex) — x\n' > "$T/a.marker"
+printf 'crossfamily: DEGRADED_SINGLE_FAMILY — y\n' > "$T/b.marker"
+OA=$(run "$T/a.marker"); OB=$(run "$T/b.marker")
+if [ "$OA" != "$OB" ] && printf '%s' "$OB" | grep -qF 'DEGRADED_SINGLE_FAMILY'; then
+  echo "  ✅ CTRL-A 판별력: 서로 다른 값이 서로 다른 줄을 낸다"
+else
+  echo "  ❌ CTRL-A 판별력 없음 — 두 마커가 같은 줄을 냈다(계기가 값을 안 읽는다)"; FAIL=1
+fi
+
+# ── 컨트롤 B (되돌림): 값 추출을 죽인 뮤턴트에서 L2 가 빨개지는가 ──────────
+#    이게 없으면 «필드를 안 읽는 함수»도 이 스위트를 통과한다.
+sed 's/^  for f in crossfamily.*/  for f in ; do :; done; out="";/' "$T/fn.sh" > "$T/mut.sh"
+if ! grep -q 'out=""' "$T/mut.sh"; then
+  echo "  ❌ CTRL-B 뮤턴트가 적용되지 않았다 — 되돌림 프로브가 장식이다"; FAIL=1
+else
+  MOUT=$(bash -c 'set -uo pipefail; . "$1"; _acceptance_evidence_line "$2"' _ "$T/mut.sh" "$T/b.marker" 2>&1 || true)
+  if printf '%s' "$MOUT" | grep -qF 'DEGRADED_SINGLE_FAMILY'; then
+    echo "  ❌ CTRL-B 뮤턴트인데도 값이 나온다 — 레인이 실물을 안 재고 있다"; FAIL=1
+  else
+    echo "  ✅ CTRL-B 되돌림: 추출을 죽이면 값이 사라진다(레인이 실패할 수 있음을 증명)"
+  fi
+fi
+
+# ── 컨트롤 C (배선): 훅의 PASS 배너가 이 함수를 실제로 부르는가 ───────────
+#    함수만 있고 호출부가 없으면 산문이다([[feedback_built_but_not_wired]]).
+if grep -q '_acceptance_evidence_line "\${MARKER:-}"' "$HOOK" \
+   && grep -q 'ALL AXES PASSED' "$HOOK"; then
+  echo "  ✅ CTRL-C 배선: PASS 배너가 이 함수를 부른다"
+else
+  echo "  ❌ CTRL-C 배선 없음 — 정의만 있고 PASS 배너가 안 부른다"; FAIL=1
+fi
+
+# ── 컨트롤 D (무해): 이 함수는 종료코드를 바꾸지 않는다 (채널이지 게이트가 아니다) ──
+run "" >/dev/null 2>&1; RC_NONE=$?
+run "$T/b.marker" >/dev/null 2>&1; RC_DEG=$?
+if [ "$RC_NONE" -eq 0 ] && [ "$RC_DEG" -eq 0 ]; then
+  echo "  ✅ CTRL-D 채널: 마커 부재도 DEGRADED 도 rc=0 (막지 않는다)"
+else
+  echo "  ❌ CTRL-D 이 함수가 종료코드를 바꾼다 (none=$RC_NONE degraded=$RC_DEG) — 채널이 아니라 게이트가 됐다"; FAIL=1
+fi
+
+echo "── gate-two-verdicts lanes: $([ $FAIL -eq 0 ] && echo 'all green' || echo 'FAILED')"
+exit "$FAIL"