@chrono-meta/fh-gate 3.1.4 → 3.2.0

package/scripts/gate_shape_scan.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+# gate_shape_scan.sh — is this file «gate-shaped»? The mechanical half of the Field-Harness
+# Load-Bearing Change Gate trigger for files whose project is NOT mapped (CLAUDE.md
+# §Field-Harness Load-Bearing Change Gate · field_verdict_crossfamily_gate.md
+# §Registration is not a precondition, 2026-09-08).
+#
+# IT IS A CLASSIFIER OF THE FILE'S SHAPE, NOT A VERDICT ON THE FILE. A hit means «this file is
+# in the gate's scope — run degrade-lint + cross-family before a merge verdict». A miss means
+# «not in scope by identifier»; the task's own naming of the file as gate/auth/exposure code is a
+# separate MANUAL escalation and is not read here (a prompt is not a property of the file).
+#
+# What counts (three classes — each hit is printed with the class and the matched line):
+#   VERDICT   word-bounded, case-insensitive: allow(ed) deny denied permit(ted) approve/approved/approval
+#             verdict permission(s) auth authn authz authorize(d) authorization authenticat* auth_<x>
+#             (🟥 `author`/`authored`/`allowance` do NOT match — the auth branch is a closed list, not `auth.*`)
+#             (🟥 `reject` is deliberately absent — it collides with the Promise API `reject(err)`,
+#              measured on a real TS mock server: 2 hits, both Promise callbacks. Named residual:
+#              a gate that spells its refusal `reject(` is missed by this class; `deny` is not.)
+#             permission auth authn authz  ·  plus the UPPERCASE enum literals PASS FAIL BLOCK
+#             (uppercase only — lowercase `pass`/`fail`/`block` are ordinary words/keywords)
+#   EXPOSURE  a socket/server bind or listen: listen( bind( ListenAndServe Serve( 0.0.0.0 INADDR_ANY
+#   IRREV     an irreversible-op path: publish( delete( unlink( rm -rf force-push --force
+#             history-rewrite filter-branch reset --hard
+# Comment/string handling (named residual, crude on purpose): a line whose first non-blank
+# characters are `#`, `//`, `* ` (star+space/end: block-comment body), `/*`, `-- ` (dash-dash+space/end:
+# SQL/Lua), `;`, `"""`, `'''` is skipped; `*allow = 1` and a continued `--force` line are CODE and scanned. Inline trailing comments
+# and string literals are NOT stripped — a false positive here costs one review, a false negative
+# costs a missed gate, so the scan leans toward firing.
+# Supported: any text file. Binary or unreadable → UNSCANNABLE (exit 3), never a silent miss.
+#
+# Usage:  bash scripts/gate_shape_scan.sh <file> [file ...]
+#         bash scripts/gate_shape_scan.sh --selftest        # known-pair calibration
+# Exit:   0 = GATE-SHAPED (≥1 hit, all files scannable) · 1 = NOT-GATE-SHAPED · 3 = UNSCANNABLE/usage
+#         (3 dominates 0: a hit next to an unscannable file still exits 3 — that file is unresolved)
+set -uo pipefail
+export LC_ALL=C
+VERDICT_RE='\b(allow(ed)?|deny|denied|permit(ted)?|approv(e|ed|al)|verdict|permissions?|auth(n|z|orize|orized|orization|entic[a-z]*|_[a-z_]+)?)\b'
+ENUM_RE='\b(PASS|FAIL|BLOCK)\b'
+EXPOSURE_RE='(\blisten\(|\bbind\(|ListenAndServe|\bServe\(|0\.0\.0\.0|INADDR_ANY)'
+IRREV_RE='(\bpublish\(|\bdelete\(|\bunlink\(|rm -rf|force-push|--force\b|history-rewrite|filter-branch|reset --hard)'
+COMMENT_RE='^[[:space:]]*(#|//|\*([[:space:]]|$)|/\*|--([[:space:]]|$)|;|"""|'"'''"')'
+
+scan_one() { # $1=file → prints hits, returns 0 hit / 1 none / 3 unscannable
+  local f="$1" body v e r hits
+  [ -r "$f" ] || { echo "UNSCANNABLE  $f (unreadable)"; return 3; }
+  if /usr/bin/file -b --mime-encoding "$f" 2>/dev/null | /usr/bin/grep -q '^binary$'; then
+    echo "UNSCANNABLE  $f (binary)"; return 3; fi
+  # one pass: drop comment-led lines, then classify (VERDICT wins over EXPOSURE over IRREV per line)
+  body=$(/usr/bin/grep -nEv "$COMMENT_RE" "$f" 2>/dev/null || true)
+  v=$(printf '%s\n' "$body" | /usr/bin/grep -Ei "$VERDICT_RE" || true)
+  v2=$(printf '%s\n' "$body" | /usr/bin/grep -E "$ENUM_RE" || true)
+  e=$(printf '%s\n' "$body" | /usr/bin/grep -E "$EXPOSURE_RE" || true)
+  r=$(printf '%s\n' "$body" | /usr/bin/grep -E "$IRREV_RE" || true)
+  hits=0
+  # 🟥 파일명을 sed 프로그램에 넣지 않는다. `s|^|... $f:|` 는 파일명 안의 `|` 로 구분자를 벗어나고,
+  #    거기에 `r <path>` 를 이어 붙이면 임의 파일 내용이 스캔 출력에 실리고 `w` 는 덮어쓴다
+  #    (cross-family security review 2026-09-09, 무해한 프로브로 추가 파일 읽기 실증).
+  #    awk 의 ENVIRON 은 값을 «프로그램»이 아니라 «데이터»로 받으므로 이 통로가 닫힌다.
+  [ -n "$v" ] && { hits=1; printf '%s\n' "$v" | /usr/bin/cut -c1-140 | FH_LABEL="VERDICT   $f:" /usr/bin/awk '{print ENVIRON["FH_LABEL"] $0}'; }
+  [ -n "$v2" ] && { hits=1; printf '%s\n' "$v2" | /usr/bin/cut -c1-140 | FH_LABEL="VERDICT   $f:" /usr/bin/awk '{print ENVIRON["FH_LABEL"] $0}'; }
+  [ -n "$e" ] && { hits=1; printf '%s\n' "$e" | /usr/bin/cut -c1-140 | FH_LABEL="EXPOSURE  $f:" /usr/bin/awk '{print ENVIRON["FH_LABEL"] $0}'; }
+  [ -n "$r" ] && { hits=1; printf '%s\n' "$r" | /usr/bin/cut -c1-140 | FH_LABEL="IRREV     $f:" /usr/bin/awk '{print ENVIRON["FH_LABEL"] $0}'; }
+  [ "$hits" -gt 0 ] && return 0 || return 1
+}
+
+selftest() { # known pair — positive must hit, negative must not, comment-only must not
+  local d rc_pos rc_pos2 rc_neg rc_cmt rc_bin rc_irr rc_bnd rc_star fails=0
+  d="$(mktemp -d 2>/dev/null)" || d=""
+  [ -n "$d" ] && [ -w "$d" ] || { echo "SELFTEST: ENV-BLOCKED (mktemp -d failed) — result unmeasured, not a pass"; return 3; }
+  printf 'export class S {\n  start() {\n    this.app.listen(this.config.port, () => {});\n  }\n}\n' > "$d/pos_exposure.ts"
+  printf 'def check(user):\n    if user.role == "admin":\n        return Verdict.ALLOW\n    return Verdict.DENY\n' > "$d/pos_verdict.py"
+  printf 'def add(a, b):\n    """Return the sum. Pass through ints."""\n    return a + b\n\ndef fmt(x):\n    return f"{x:.2f}"\n' > "$d/neg_util.py"
+  printf '# we allow anything here\n// auth is elsewhere\n/* listen( is not called */\n * allow: block-comment body\n-- deny in a SQL comment\nx = 1\n' > "$d/neg_comments.py"
+  printf '\x00\x01\x02binary\x00' > "$d/bin.dat"
+  printf 'set -e\ngit push origin main \\\n  --force\n' > "$d/pos_irrev.sh"
+  printf 'authored_by = "x"\nallowance = 3\nauthor = "y"\n' > "$d/neg_boundary.py"
+  printf 'int f(int *allow) {\n  *allow = 1;\n  return 0;\n}\n' > "$d/pos_star.c"
+  scan_one "$d/pos_exposure.ts" >/dev/null; rc_pos=$?
+  scan_one "$d/pos_verdict.py"  >/dev/null; rc_pos2=$?
+  scan_one "$d/neg_util.py"     >/dev/null; rc_neg=$?
+  scan_one "$d/neg_comments.py" >/dev/null; rc_cmt=$?
+  scan_one "$d/bin.dat"         >/dev/null; rc_bin=$?
+  scan_one "$d/pos_irrev.sh"    >/dev/null; rc_irr=$?
+  scan_one "$d/neg_boundary.py" >/dev/null; rc_bnd=$?
+  scan_one "$d/pos_star.c"      >/dev/null; rc_star=$?
+  [ "$rc_pos" -eq 0 ]  && echo "  ✅ known-positive exposure (listen()) → GATE-SHAPED"      || { echo "  ❌ known-positive exposure rc=$rc_pos"; fails=1; }
+  [ "$rc_pos2" -eq 0 ] && echo "  ✅ known-positive verdict (ALLOW/DENY) → GATE-SHAPED"    || { echo "  ❌ known-positive verdict rc=$rc_pos2"; fails=1; }
+  [ "$rc_neg" -eq 1 ]  && echo "  ✅ known-negative util (docstring 'Pass') → NOT"          || { echo "  ❌ known-negative util rc=$rc_neg"; fails=1; }
+  [ "$rc_cmt" -eq 1 ]  && echo "  ✅ comment-only mentions (#, //, /*, ' * ', '-- ') → NOT"                            || { echo "  ❌ comment-only rc=$rc_cmt"; fails=1; }
+  [ "$rc_bin" -eq 3 ]  && echo "  ✅ binary → UNSCANNABLE (not a silent miss)"              || { echo "  ❌ binary rc=$rc_bin"; fails=1; }
+  [ "$rc_irr" -eq 0 ]  && echo "  ✅ known-positive irreversible (continued --force line) → GATE-SHAPED" || { echo "  ❌ known-positive irrev rc=$rc_irr"; fails=1; }
+  [ "$rc_bnd" -eq 1 ]  && echo "  ✅ boundary: author/authored/allowance → NOT"                || { echo "  ❌ boundary rc=$rc_bnd"; fails=1; }
+  [ "$rc_star" -eq 0 ] && echo "  ✅ code line starting with *allow (not a comment) → GATE-SHAPED" || { echo "  ❌ star-code rc=$rc_star"; fails=1; }
+  /bin/rm -rf "$d"
+  [ "$fails" -eq 0 ] && { echo "SELFTEST: PASS"; return 0; } || { echo "SELFTEST: FAIL"; return 3; }
+}
+
+[ $# -ge 1 ] || { echo "usage: $0 <file> [file ...] | --selftest" >&2; exit 3; }
+[ "$1" = "--selftest" ] && { selftest; exit $?; }
+ANY=0; UNS=0
+for f in "$@"; do scan_one "$f"; rc=$?; [ "$rc" -eq 0 ] && ANY=1; [ "$rc" -eq 3 ] && UNS=1; done
+if [ "$UNS" -eq 1 ]; then
+  [ "$ANY" -eq 1 ] && echo "GATE-SHAPED in the scannable files —"
+  echo "UNSCANNABLE — ≥1 file could not be classified; decide those by hand. Exit 3 dominates any hit (never a silent miss)"; exit 3
+elif [ "$ANY" -eq 1 ]; then echo "GATE-SHAPED — run degrade-lint + cross-family before a merge verdict"; exit 0
+else echo "NOT-GATE-SHAPED (by identifier; the task's own naming is a separate manual escalation)"; exit 1; fi

package/scripts/selfcheck.sh

@@ -418,6 +418,55 @@ else
   fail=1
 fi
 
+# doc-claim triad (bridge ①) — a doc that says «A uses B» where A never executes B.
+# Subject = scripts/doc_claim_triad_scan.py (review surface, not a verdict). Wired in the same
+# commit that created its lane, because lane_runner_check.sh rejects an undeclared unwired suite —
+# and adding it to DEBT instead would be the regrowth that file exists to stop.
+if [ ! -f scripts/doc_claim_triad_scan.py ]; then
+  _absent_subject_verdict "doc-claim triad lanes" "scripts/doc_claim_triad_scan.py" || fail=1
+elif [ -f scripts/test_doc_claim_triad_lanes.sh ]; then
+  if ! bash scripts/test_doc_claim_triad_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  doc-claim triad lanes: doc_claim_triad_scan.py present but its anchor is missing"
+  fail=1
+fi
+
+# typed-finding pipeline — fleet (multi-family, parallel) + reject stage (cross-family verdict, code
+# drops false positives). Subject = scripts/finding_fleet.sh + scripts/finding_verify.py.
+if [ ! -f scripts/finding_verify.py ]; then
+  _absent_subject_verdict "finding pipeline lanes" "scripts/finding_verify.py" || fail=1
+elif [ -f scripts/test_finding_pipeline_lanes.sh ]; then
+  if ! bash scripts/finding_fleet.sh --selftest >/dev/null 2>&1; then
+    echo "FAIL  finding fleet selftest: known-pair calibration failed"; fail=1
+  fi
+  if ! bash scripts/test_finding_pipeline_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  finding pipeline lanes: scripts present but their anchor is missing"
+  fail=1
+fi
+
+# gate-shape classifier — the mechanical half of the unmapped-file trigger of the Field-Harness
+# Load-Bearing Change Gate (2026-09-08). A classifier of scope, not a verdict; its lane holds the
+# known-pair (exposure/verdict positives · util/comment negatives · Promise reject( FP anchor).
+if [ ! -f scripts/gate_shape_scan.sh ]; then
+  _absent_subject_verdict "gate-shape lanes" "scripts/gate_shape_scan.sh" || fail=1
+elif [ -f scripts/test_gate_shape_scan_lanes.sh ]; then
+  # direct dispatch of the subject's own selftest (caller surface for the ratchet), then the lane
+  if ! bash scripts/gate_shape_scan.sh --selftest >/dev/null 2>&1; then
+    echo "FAIL  gate-shape selftest: known-pair calibration failed"; fail=1
+  fi
+  if ! bash scripts/test_gate_shape_scan_lanes.sh; then
+    fail=1
+  fi
+else
+  echo "FAIL  gate-shape lanes: gate_shape_scan.sh present but its anchor is missing"
+  fail=1
+fi
+
 # package-coverage — a shipped doc must not point at a file the tarball omits. Distinct from the
 # ref-path check below: that one asks "does this path exist at all", this one asks "does the
 # CONSUMER get it". Measured 2026-07-28: 35 paths existed, were named by a shipped doc, and were
@@ -663,6 +712,7 @@ for _pair in \
   "plugins/fh-commons/skills/preprep/lane_adjacent_dup.py|scripts/test_preprep_adjacent_dup_lanes.sh" \
   "plugins/fh-commons/skills/preprep/lane_promise.py|scripts/test_preprep_promise_lanes.sh" \
   "plugins/fh-commons/skills/preprep/lane_slide_refs.py|scripts/test_preprep_slide_refs_lanes.sh" \
+  "plugins/fh-commons/skills/preprep/lane_font.py|scripts/test_preprep_font_lanes.sh" \
   "plugins/fh-commons/skills/preprep/SKILL.md|scripts/test_preprep_drift_anchor.sh" \
   "scripts/test_preprep_drift_anchor.sh|scripts/test_preprep_drift_anchor_lanes.sh" \
   "scripts/field_canon_preload.sh|scripts/test_skill_canon_preload_lanes.sh" \

package/scripts/test_doc_claim_triad_lanes.sh

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# test_doc_claim_triad_lanes.sh — scripts/doc_claim_triad_scan.py 회귀 앵커.
+#
+# 🟥 이 레인이 지키는 것은 «숫자»가 아니라 «판별력»이다. 그 계기는 세션 중 세 번 뚫렸고
+#    (공존≠관계 · 방향 미해결 · 나열 통과) 세 번 다 손검증이 잡았다. 레인은 그 셋이
+#    되돌아오는지를 본다 — 픽스처는 실제로 뚫렸던 표기를 그대로 쓴다.
+set -uo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"; ROOT="$(dirname "$HERE")"
+SCAN="$HERE/doc_claim_triad_scan.py"
+PASS=0; FAIL=0
+ok(){ PASS=$((PASS+1)); printf '  ✅ %s\n' "$1"; }
+no(){ FAIL=$((FAIL+1)); printf '  ❌ %s — %s\n' "$1" "${2:-}"; }
+
+echo "── test_doc_claim_triad_lanes ──"
+
+# L1 — 파일 실재 + 실행 가능
+[ -f "$SCAN" ] || { no "L1 파일 실재" "$SCAN 없음"; echo "FAILED=1"; exit 1; }
+python3 -c "import ast,sys;ast.parse(open(sys.argv[1],encoding='utf-8').read())" "$SCAN" >/dev/null 2>&1 \
+  && ok "L1 구문" || no "L1 구문" "ast.parse 실패"
+
+# L2 — 계기 보정이 통과한다 (양쪽 절반)
+OUT=$(python3 "$SCAN" --selftest "$ROOT" 2>&1); RC=$?
+[ "$RC" -eq 0 ] && ok "L2 selftest rc=0" || no "L2 selftest" "rc=$RC"
+printf '%s' "$OUT" | grep -q "주장 추출기" && ok "L2b 추출기 보정 실행됨" || no "L2b 추출기 보정" "절이 없다"
+printf '%s' "$OUT" | grep -q "실행 판별기" && ok "L2c 실행판별 보정 실행됨" || no "L2c 실행판별 보정" "절이 없다"
+
+# L3 — 🟥 나열을 주장으로 세지 않는다 (v1 이 뚫린 자리, 실제 표기)
+python3 - "$SCAN" <<'PY' && ok "L3 나열 거부" || no "L3 나열 거부" "나열이 주장으로 셰짐"
+import importlib.util,sys
+spec=importlib.util.spec_from_file_location("m",sys.argv[1]); m=importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+A,B="scripts/foo.sh","scripts/bar.sh"
+# 🟥 cross-family codex [B]: 가운뎃점·백틱·쉼표만 막으면 «and/plus/인용부호» 로 뚫린다.
+# 그 표기를 픽스처에 넣는다 — 실제로 CATALOG.md:137 이 `X (pre-commit) and Y (pre-push)` 였다.
+lists=[f"**File:** {A} · {B} · templates/.git-hooks/pre-commit",
+       f"Fixtures: `{A}` · `{B}`.", f"Anchors: `{A}`, `{B}`",
+       f"Anchors: `{A}` and `{B}`", f"see `{A}` plus `{B}`",
+       f'"{A}" "{B}"']
+sys.exit(0 if not any(m.asserts_relation(l,A,B) for l in lists) else 1)
+PY
+
+# L4 — 관계 주장은 잡는다 (한/영 둘 다 — 언어 중립 요구)
+python3 - "$SCAN" <<'PY' && ok "L4 관계 포착(한·영)" || no "L4 관계 포착" "관계를 놓쳤다"
+import importlib.util,sys
+spec=importlib.util.spec_from_file_location("m",sys.argv[1]); m=importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+A,B="scripts/foo.sh","scripts/bar.sh"
+rel=[f"{A} 는 {B} 를 호출한다", f"`{A}` is wired into `{B}`", f"the hook {A} blocks by running {B}"]
+sys.exit(0 if all(m.asserts_relation(l,A,B) for l in rel) else 1)
+PY
+
+# L5 — 🟥 실행 vs 언급. 실제로 뚫렸던 표기(grep 대안식 안의 `name)\.sh`)를 픽스처로 쓴다
+TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT
+cat > "$TMP/hook_exec.sh" <<'EOF'
+#!/usr/bin/env bash
+bash "$REPO_ROOT/scripts/target_thing.sh" "$REPO_ROOT"
+EOF
+cat > "$TMP/hook_mention.sh" <<'EOF'
+#!/usr/bin/env bash
+# target_thing.sh is only named here, never run
+git diff --name-only | grep -E '(scripts/(other|target_thing)\.sh)' || true
+EOF
+# 🟥 cross-family codex [A]: 출력 구문 안의 인터프리터 호출은 «실행처럼 보이지만» 아무것도 안 돌린다
+cat > "$TMP/hook_echo.sh" <<'EOF'
+#!/usr/bin/env bash
+echo "run it yourself:  bash scripts/target_thing.sh"
+EOF
+python3 - "$SCAN" "$TMP" <<'PY' && ok "L5 실행/언급 판별" || no "L5 실행/언급 판별" "둘을 못 가른다"
+import importlib.util,sys,os
+spec=importlib.util.spec_from_file_location("m",sys.argv[1]); m=importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+t=sys.argv[2]
+v1,_=m.executes(os.path.join(t,"hook_exec.sh"),"target_thing.sh")
+v2,_=m.executes(os.path.join(t,"hook_mention.sh"),"target_thing.sh")
+v3,_=m.executes(os.path.join(t,"hook_echo.sh"),"target_thing.sh")
+sys.exit(0 if (v1=="EXECUTES" and v2=="MENTIONS-ONLY" and v3=="MENTIONS-ONLY") else 1)
+PY
+
+# L6 — 🟥 보정 실패 시 «스캔을 거부»한다 (fail-closed). 뮤턴트로 확인하고 되돌린다
+CP="$TMP/mutant.py"; cp "$SCAN" "$CP"
+python3 - "$CP" <<'PY'
+import sys
+p=sys.argv[1]; L=open(p,encoding="utf-8").read().split("\n")
+i=[k for k,l in enumerate(L) if l.startswith("def asserts_relation(")][0]
+L.insert(i+1,"    return True  # MUTANT: 모든 것을 주장이라 한다")
+open(p,"w",encoding="utf-8").write("\n".join(L))
+PY
+MOUT=$(python3 "$CP" --selftest "$ROOT" 2>&1); MRC=$?
+[ "$MRC" -eq 2 ] && ok "L6 뮤턴트 → rc=2 거부" || no "L6 뮤턴트 거부" "rc=$MRC (기대 2)"
+MS=$(python3 "$CP" "$ROOT" 2>&1); MSRC=$?
+[ "$MSRC" -eq 2 ] && ok "L6b 뮤턴트는 스캔도 거부" || no "L6b 뮤턴트 스캔거부" "rc=$MSRC (기대 2)"
+
+# L8 — 🟥 known-pair 가 «낡으면» 보정이 실패한다 (cross-family codex [S]).
+#      B 가 삭제·이동돼도 A 가 이름만 언급하면 통과하던 자리.
+cat > "$TMP/fakeroot_probe.py" <<'PY8'
+import importlib.util,sys,os
+spec=importlib.util.spec_from_file_location("m",sys.argv[1]); m=importlib.util.module_from_spec(spec)
+spec.loader.exec_module(m)
+sys.exit(0 if m.resolve(sys.argv[2], "scripts/zzq_nonexistent_target.sh") is None else 1)
+PY8
+python3 "$TMP/fakeroot_probe.py" "$SCAN" "$ROOT" && ok "L8 부재 대상은 resolve=None" || no "L8 resolve" "없는 파일을 찾았다고 했다"
+
+# L7 — 🟥 «진짜» 되돌림: 원본 자리에 뮤턴트를 넣었다 뺀다. 빨강→초록 전이를 본다
+cp "$SCAN" "$TMP/orig_backup.py"
+python3 - "$SCAN" <<'PY7'
+import sys
+p=sys.argv[1]; L=open(p,encoding="utf-8").read().split("\n")
+i=[k for k,l in enumerate(L) if l.startswith("def asserts_relation(")][0]
+L.insert(i+1,"    return True  # MUTANT-INPLACE")
+open(p,"w",encoding="utf-8").write("\n".join(L))
+PY7
+python3 "$SCAN" --selftest "$ROOT" >/dev/null 2>&1; INJ=$?
+cp "$TMP/orig_backup.py" "$SCAN"
+python3 "$SCAN" --selftest "$ROOT" >/dev/null 2>&1; RST=$?
+LEFT=$(grep -c "MUTANT-INPLACE" "$SCAN" || true)
+if [ "$INJ" -eq 2 ] && [ "$RST" -eq 0 ] && [ "$LEFT" -eq 0 ]; then
+  ok "L7 되돌림 전이 (주입 rc=2 → 복원 rc=0, 잔존 0)"
+else
+  no "L7 되돌림 전이" "주입rc=$INJ 복원rc=$RST 잔존=$LEFT"
+fi
+
+echo "── PASS=$PASS FAIL=$FAIL ──"
+[ "$FAIL" -eq 0 ] || { echo "FAILED=1"; exit 1; }
+echo "FAILED=0"