@techgoblin/gobstack 0.0.0-stage → 0.4.4-beta.1

package/bin/goblin-verify

@@ -0,0 +1,2798 @@
+#!/usr/bin/env bash
+# goblin-verify — execute the target-scope rows of manifest/enforcement.tsv.
+#
+# Usage:
+#   goblin-verify [--only <id[,id...]>] [--json] [--list] [--source <goblin-stack path>]
+#
+# Exit codes:
+#   0  every executed check passed (advisories and skips do not fail the run)
+#   1  at least one check FAILED
+#   2  verify could not run (not installed, missing dependency, unparseable config)
+#   3  the manifest itself is broken (a row with no check and no 'advisory', or a duplicate id)
+#
+# The check column of each row holds either
+#   * a shell command, run from the target repo root, or
+#   * the literal 'advisory' (counted, never executed), or
+#   * 'goblin-verify --only <ID>', the marker for a check that needs logic beyond one
+#     shell line. Those are implemented as builtins below; the marker keeps the row
+#     self-describing and keeps the matrix the single source of truth.
+
+set -uo pipefail
+
+GOBLIN_VERIFY_VERSION="0.4.4"
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=goblin-lib.sh
+. "$SELF_DIR/goblin-lib.sh"
+
+ONLY=""
+JSON=0
+LIST=0
+SOURCE=""
+
+usage() {
+  cat <<'USAGE'
+goblin-verify — prove a goblin-stack install is still what it says it is.
+
+  --only <id[,id...]>   run only these manifest rows
+  --list                list the manifest rows and exit
+  --json                machine-readable output
+  --source <path>       read the manifest from a goblin-stack checkout instead of .goblin/
+
+Exit codes: 0 pass | 1 a check failed | 2 could not run | 3 the manifest is broken.
+USAGE
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --only)   ONLY="${2:-}"; shift 2 ;;
+    --json)   JSON=1; shift ;;
+    --list)   LIST=1; shift ;;
+    --source) SOURCE="${2:-}"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) g_err "unknown option: $1"; usage >&2; exit 2 ;;
+  esac
+done
+
+# ---------------------------------------------------------------- environment --
+for dep in git awk sed grep python3; do
+  command -v "$dep" >/dev/null 2>&1 || { g_err "missing dependency: $dep"; exit 2; }
+done
+
+# Root resolution. `git rev-parse --show-toplevel` alone verifies the OUTER repo when the
+# target is nested inside another git repo (a monorepo subdirectory, anything under
+# ~/.hermes) — the installed config is the target's own marker, so it wins (D20).
+find_installed_root() {
+  local d="$PWD"
+  while :; do
+    if [ -f "$d/.goblin/goblin.yaml" ]; then printf '%s\n' "$d"; return 0; fi
+    [ "$d" = "/" ] && return 1
+    d=$(dirname "$d")
+  done
+}
+ROOT=$(find_installed_root) || ROOT=""
+if [ -z "$ROOT" ]; then
+  ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
+  [ -n "$ROOT" ] || ROOT="$PWD"
+fi
+
+# ---- engine resolution (W1, §2.3): one chain, stated once --------------------
+# Every engine-path lookup (enforcement.tsv, classes.tsv, bans.tsv, bans/*.sh, the ban
+# engine) resolves through this chain, first hit wins:
+#   1. --source <path>            (existing flag; highest, for tests and pinned CI)
+#   2. $ROOT/.goblin/...          (vendored per-repo engine — today's default)
+#   3. engine_dir: from $ROOT/.goblin/goblin.yaml
+#   4. GOBLIN_ENGINE_DIR env, then ~/.goblin/engine
+#   5. nothing found -> exit 2, naming every path tried (the pre-W1 message when the
+#      vendored chain is the only one tried; the §2.4 message when engine_dir: fails).
+# Ordering is deliberate: a vendored engine still wins over the global one, because an
+# explicit per-repo choice must not be silently overridden by a machine-level upgrade.
+# An explicit engine_dir: that cannot be used is exit 2 with NO fallback (§1.2): falling
+# back to a vendored engine would judge the repo with a different rule table than the one
+# it declared. Absent key => the chain degrades to exactly today's behaviour (§1.3).
+
+CONFIG="$ROOT/.goblin/goblin.yaml"
+
+# engine_yaml_raw — the raw top-level engine_dir: value (the line-oriented parser reads
+# the line, so a non-string scalar is visible here as something that is not a path).
+engine_yaml_raw() {
+  sed -n "s/^engine_dir:[[:space:]]*//p" "$CONFIG" | head -n 1
+}
+
+# resolve_engine_dir — validate the declared key (§1.2, fail closed at use time, stages
+# 1-4) and print the absolute engine directory. Stages 3/4 (existence, payload) do NOT
+# exit here: the failure is reported through ENGINE_FAIL so the refusal can name BOTH the
+# declared value and the chain tried (§2.4's message), then the run stops with exit 2 —
+# no fallback, no SKIP.
+ENGINE_DECLARED=""
+ENGINE_FAIL=""
+ENGINE_DIR_DECLARED=""   # the declared value as written (for the §2.4 refusal message)
+resolve_engine_dir() {
+  ENGINE_DECLARED=""
+  ENGINE_FAIL=""
+  ENGINE_DIR_DECLARED=""
+  [ -f "$CONFIG" ] || return 0
+  grep -q '^engine_dir:' "$CONFIG" || return 0
+  local dir
+  dir=$(engine_yaml_raw)
+  if [ -z "$dir" ]; then
+    ENGINE_FAIL="engine_dir: must be a string path, got empty"
+    return 1
+  fi
+  dir=$(g_unquote "$dir")
+  ENGINE_DIR_DECLARED="$dir"
+  # Stage 1: a non-string value (number, list, mapping, bare null/bool) is not a path.
+  # Anything that is not a usable path shape fails closed here and `got <value>` names
+  # what was declared; valid strings fall through to the shape check below.
+  ENGINE_FAIL="engine_dir: must be a string path, got $dir"
+  case "$dir" in
+    '~'|'null'|'true'|'false'|'['*|'{'*|''|*[!0-9A-Za-z_./~-]*|[0-9]*)
+      return 1 ;;
+  esac
+  ENGINE_FAIL=""
+  # Stage 2: the shape — absolute, or ~/ (expanded once, at read time, via $HOME).
+  case "$dir" in
+    /*) ;;
+    "~/"*) dir="$HOME/${dir#\~/}" ;;
+    *)
+      ENGINE_FAIL="engine_dir: must be absolute or ~/-prefixed: $dir"
+      return 1 ;;
+  esac
+  # Stage 3: existence.
+  if [ ! -d "$dir" ]; then
+    ENGINE_FAIL="engine_dir: $dir does not exist (declared in .goblin/goblin.yaml)"
+    return 1
+  fi
+  # Stage 4: the payload — a directory without the rule table is not an engine.
+  if [ ! -f "$dir/manifest/enforcement.tsv" ]; then
+    ENGINE_FAIL="engine_dir: no manifest/enforcement.tsv under $dir - this is not an engine directory"
+    return 1
+  fi
+  ENGINE_DECLARED="$dir"
+  return 0
+}
+
+resolve_engine_dir
+ENGINE_CHAIN_VENDORED="\$ROOT/.goblin/manifest/enforcement.tsv"
+GOBLIN_ENGINE=""                       # the resolved engine root, when NOT vendored/--source
+if [ -n "$SOURCE" ]; then
+  MANIFEST="$SOURCE/manifest/enforcement.tsv"
+  CLASSES="$SOURCE/manifest/classes.tsv"
+elif [ -f "$ROOT/.goblin/manifest/enforcement.tsv" ]; then
+  MANIFEST="$ROOT/.goblin/manifest/enforcement.tsv"
+  CLASSES="$ROOT/.goblin/manifest/classes.tsv"
+elif [ -n "$ENGINE_DECLARED" ]; then
+  GOBLIN_ENGINE="$ENGINE_DECLARED"
+  MANIFEST="$GOBLIN_ENGINE/manifest/enforcement.tsv"
+  CLASSES="$GOBLIN_ENGINE/manifest/classes.tsv"
+elif [ -n "$ENGINE_FAIL" ]; then
+  # §2.4: an explicit engine_dir: that does not resolve is exit 2, and nothing falls
+  # back. The refusal names the declared value and every path the chain tried.
+  g_err "$ENGINE_FAIL"
+  g_err "no manifest at any of: \$SOURCE (${SOURCE:-unset}), $ROOT/.goblin/manifest/enforcement.tsv (absent),"
+  g_err "  $ENGINE_DIR_DECLARED/manifest/enforcement.tsv (unusable - see above)"
+  exit 2
+else
+  # No vendored engine and no declaration: the CLI default (§3.3), env first, then
+  # ~/.goblin/engine. Both are consulted AFTER --source, vendored and the declaration:
+  # the most specific declaration wins; the machine default is the fallback, never an
+  # override (A9).
+  _cli_default=""
+  if [ -n "${GOBLIN_ENGINE_DIR:-}" ]; then
+    _cli_default="$GOBLIN_ENGINE_DIR"
+  elif [ -d "$HOME/.goblin/engine" ]; then
+    _cli_default="$HOME/.goblin/engine"
+  fi
+  if [ -n "$_cli_default" ] && [ -f "$_cli_default/manifest/enforcement.tsv" ]; then
+    GOBLIN_ENGINE="$_cli_default"
+    MANIFEST="$GOBLIN_ENGINE/manifest/enforcement.tsv"
+    CLASSES="$GOBLIN_ENGINE/manifest/classes.tsv"
+  else
+    MANIFEST="$SELF_DIR/../manifest/enforcement.tsv"
+    CLASSES="$SELF_DIR/../manifest/classes.tsv"
+  fi
+fi
+[ -f "$MANIFEST" ] || {
+  g_err "no manifest at $MANIFEST"
+  g_err "no manifest at any of: \$SOURCE (${SOURCE:-unset}), $ENGINE_CHAIN_VENDORED (absent), $SELF_DIR/../manifest/enforcement.tsv"
+  exit 2
+}
+
+INSTALLED="$ROOT/.goblin/installed.json"
+
+# engine_block_field <key> — one field of installed.json's engine: block (empty if absent).
+engine_block_field() {
+  [ -f "$INSTALLED" ] || return 0
+  g_json_object "$INSTALLED" engine | awk -F'\t' -v k="$1" '$1==k {print $2; exit}'
+}
+
+# ---- the engine mode (W1 §2.2) ----------------------------------------------
+#   vendored (the default): the engine resolved inside the repo (or --source pinned it)
+#     and installed.json records the payload. The install-record and procedure rows
+#     behave exactly as before W1.
+#   global: the engine resolved OUTSIDE the repo (engine_dir:, GOBLIN_ENGINE_DIR or
+#     ~/.goblin/engine), or installed.json's own engine: block says mode=global - a repo
+#     whose engine: block says global is global even if a vendored payload is still on
+#     disk mid-migration (W3's three-verify sequence). The repo-local clauses keep
+#     hashing what IS recorded; absence of engine files is not drift; a repo with no
+#     install record at all is not born RED.
+ENGINE_MODE="vendored"
+[ -n "$GOBLIN_ENGINE" ] && ENGINE_MODE="global"
+_em=$(engine_block_field mode)
+[ "$_em" = "global" ] && ENGINE_MODE="global"
+export ENGINE_MODE
+
+# ---- manifest integrity (exit 3 before any check runs) ----------------------
+manifest_check() {
+  local rc=0
+  awk -F'\t' 'NR>1 && $6=="" {print "row " $1 " has no check and no advisory label"; bad=1} END{exit bad}' "$MANIFEST" || rc=3
+  awk -F'\t' 'NR>1 {if (seen[$1]++) {print "duplicate id " $1; bad=1}} END{exit bad}' "$MANIFEST" || rc=3
+  return $rc
+}
+manifest_check || { g_err "manifest is broken (exit 3)"; exit 3; }
+
+if [ "$LIST" -eq 1 ]; then
+  awk -F'\t' 'NR>1 {printf "%-7s %-7s %-9s %s\n", $1, $2, $4, $3}' "$MANIFEST"
+  exit 0
+fi
+
+# --only must name rows the manifest actually has: a typo used to select nothing, emit no
+# rows and exit 0, turning a pipeline gate into a no-op (D15).
+if [ -n "$ONLY" ]; then
+  UNKNOWN=""
+  for want in $(printf '%s' "$ONLY" | tr ',' ' '); do
+    [ -n "$want" ] || continue
+    awk -F'\t' -v x="$want" 'NR>1 && $1==x {f=1} END{exit !f}' "$MANIFEST" \
+      || UNKNOWN="$UNKNOWN $want"
+  done
+  [ -z "$UNKNOWN" ] || { g_err "--only names id(s) not in the manifest:$UNKNOWN"; exit 2; }
+  # A valid id that is SOURCE-scope (PR-01..PR-04) selects no target row: the run emits
+  # nothing and exits 0, which is the same no-op gate D15 closed for a typo (F2-6).
+  TARGET_ROWS=0
+  for want in $(printf '%s' "$ONLY" | tr ',' ' '); do
+    [ -n "$want" ] || continue
+    awk -F'\t' -v x="$want" 'NR>1 && $1==x && $2=="target" {f=1} END{exit !f}' "$MANIFEST" \
+      && TARGET_ROWS=1
+  done
+  if [ "$TARGET_ROWS" -eq 0 ]; then
+    g_err "--only $ONLY selects no target-scope row, so this run would execute nothing and"
+    g_err "report success. Source-scope rows (PR-*) run in tests/run-tests.sh, not here."
+    exit 2
+  fi
+fi
+
+if [ ! -f "$CONFIG" ]; then
+  g_err "not installed: $CONFIG is absent. Run: goblin-install --target $ROOT --class <A|B|C|D|E>"
+  exit 2
+fi
+
+CLASS=$(g_yaml_scalar "$CONFIG" class)
+case "$CLASS" in
+  A|B|C|D|E|F) ;;
+  *) g_err "unknown class '${CLASS:-<empty>}' in $CONFIG (expected A|B|C|D|E|F)"; exit 2 ;;
+esac
+
+# Root vs git toplevel. find_installed_root resolves the CONFIG lookup correctly, but the
+# rows that shell out to git run in $ROOT and git resolves that to the ENCLOSING repo when
+# the target is not a repository of its own: a nested target then reports the outer repo's
+# index (30 "dirty entries" that belong to the outer repo) instead of its own state (F2-1).
+# Refuse up front, with the reason, rather than print a number about the wrong tree.
+ROOT_PHYS=$(cd "$ROOT" && pwd -P)
+GIT_TOP=$(cd "$ROOT" && git rev-parse --show-toplevel 2>/dev/null)
+if [ -n "$GIT_TOP" ] && [ "$GIT_TOP" != "$ROOT_PHYS" ]; then
+  g_err "target $ROOT_PHYS is inside the git repository $GIT_TOP but is not a repository of"
+  g_err "its own. CM-01 CM-03 GT-03 SP-02 PG-01 PG-03 DS-01 PT-02 and HP-05 shell out to git,"
+  g_err "and git would resolve every one of them to $GIT_TOP - the numbers would describe the"
+  g_err "outer repo, not this target."
+  g_err "fix: cd $ROOT_PHYS && git init   (make the target its own repo), or move it out of"
+  g_err "     $GIT_TOP."
+  exit 2
+fi
+
+BRANCH=$(g_yaml_scalar "$CONFIG" branch)
+ARCHIVE=$(g_yaml_scalar "$CONFIG" archive)
+MAX_DIRTY=$(g_yaml_scalar "$CONFIG" max_dirty)
+ADV_CEILING=$(g_yaml_scalar "$CONFIG" advisory_ceiling)
+HARNESS_DIR_RAW=$(g_yaml_scalar "$CONFIG" harness_dir)
+SCAFFOLD_CHECKS=$(g_yaml_scalar "$CONFIG" scaffold_checks)
+MODELS_FILE=$(g_expand_tilde "$(g_yaml_scalar "$CONFIG" models_file)")
+PRACTICE=$(g_expand_tilde "$(g_yaml_scalar "$CONFIG" practice)")
+PRACTICE_SHA=$(g_unquote "$(g_yaml_scalar "$CONFIG" practice_sha256)")
+[ -n "$MAX_DIRTY" ] || MAX_DIRTY=0
+[ -n "$ADV_CEILING" ] || ADV_CEILING=10
+[ -n "$HARNESS_DIR_RAW" ] || HARNESS_DIR_RAW=checks
+# A config installed before this key existed declares no harness expectation: keep the old
+# skip behaviour rather than failing an adopted repo on an upgrade.
+[ -n "$SCAFFOLD_CHECKS" ] || SCAFFOLD_CHECKS=no
+
+# The feature map (G1). feature_map: EMPTY is the meaningful state, not a broken config: a
+# fresh install has no map and the two FM rows must SKIP with that reason (the replay.commit:
+# "" shape, docs/LIMITS.md #11). source_root: is what an entry path resolves against.
+FEATURE_MAP=$(g_yaml_scalar "$CONFIG" feature_map)
+SOURCE_ROOT=$(g_unquote "$(g_yaml_scalar "$CONFIG" source_root)")
+[ -n "$SOURCE_ROOT" ] || SOURCE_ROOT=.
+VERIFY_DOCTOR=$(g_unquote "$(g_yaml_scalar "$CONFIG" verify_doctor)")
+export FEATURE_MAP SOURCE_ROOT VERIFY_DOCTOR
+
+# The reference corpus (P15, RC-01..RC-04). `reference_manifest:` is the ONE state that may SKIP
+# with a reason: a repo with no reference corpus must not be born RED (the feature_map: shape),
+# and RC-01/RC-02/RC-04 skip for exactly that reason. A key that IS declared but whose file is
+# missing or unparseable is a FAIL, deliberately, so losing the manifest cannot read as "no
+# corpus" (the FM-01 declared-map-absent shape). These rows are builtins and not shell one-liners
+# for this reason alone: the runner gives only a builtin exit 2/3 (see the dispatch below), so a
+# one-liner could never report "not applicable yet" without failing the run.
+# `quarantine_root:` is the quarantine directory of the playbook's S5 - outside the repo by
+# design - and no row reads it; it is declared so the procedure has a machine-readable anchor
+# instead of a path in prose (it ships empty here, the way feature_map: does).
+REFERENCE_MANIFEST=$(g_unquote "$(g_yaml_scalar "$CONFIG" reference_manifest)")
+export REFERENCE_MANIFEST
+
+# The loop ceiling (G2, LP-03). The most turns ONE loop record may declare in its budget; 20 is
+# the engine's own default for a kanban goal loop, so a ceiling that disagreed with the engine
+# would be a number someone made up. A config written before this key existed keeps the default
+# (the SCAFFOLD_CHECKS shape): an absent key is not a broken config.
+LOOP_MAX_TURNS_CEILING=$(g_yaml_scalar "$CONFIG" loop_max_turns_ceiling)
+[ -n "$LOOP_MAX_TURNS_CEILING" ] || LOOP_MAX_TURNS_CEILING=20
+# The loop record (G2): a COMMITTED artifact of one unattended run. Nothing in this section
+# re-runs the predicate and nothing writes: the record IS the evidence, and what that costs is
+# stated in docs/LOOP.md and docs/LIMITS.md.
+LOOP_DIR="$ROOT/.goblin/loop"
+export LOOP_MAX_TURNS_CEILING LOOP_DIR
+
+if [ -d "$ROOT/$HARNESS_DIR_RAW" ]; then
+  export GOBLIN_HARNESS_DIR="$ROOT/$HARNESS_DIR_RAW"
+  export GOBLIN_HARNESS_REL="$HARNESS_DIR_RAW"
+  export GOBLIN_HARNESS_STATE=present
+else
+  export GOBLIN_HARNESS_DIR=""
+  export GOBLIN_HARNESS_REL="$HARNESS_DIR_RAW"
+  # 'absent' = the class scaffolds a harness dir and the declared one is missing -> FAIL.
+  # 'none'   = the class ships no harness dir -> SKIP with a reason (D7).
+  if [ "$SCAFFOLD_CHECKS" = "yes" ]; then
+    export GOBLIN_HARNESS_STATE=absent
+  else
+    export GOBLIN_HARNESS_STATE=none
+  fi
+fi
+export GOBLIN_ROOT="$ROOT"
+export GOBLIN_CONFIG="$CONFIG"
+
+# ---- the security surface (SC-01..SC-09) and the perf baseline (PF-01) -----------------------
+# Every one of these is DECLARED in .goblin/goblin.yaml. A stack-specific rule guessed from the
+# files on disk is how a matrix starts lying; a declared key that is absent is a skip with a
+# reason, never a silent pass.
+SEC_GITIGNORE_FAMILY=$(g_yaml_block_scalar "$CONFIG" security gitignore_family)
+SEC_BUILD_OUTPUT=$(g_yaml_block_scalar "$CONFIG" security build_output)
+SEC_AUDIT_CMD=$(g_yaml_block_scalar "$CONFIG" security audit_cmd)
+SEC_AUDIT_MAX_AGE=$(g_yaml_block_scalar "$CONFIG" security audit_max_age_days)
+SEC_WAIVER_MAX_AGE=$(g_yaml_block_scalar "$CONFIG" security waiver_max_age_days)
+SEC_WRITE_ROUTES=$(g_yaml_block_scalar "$CONFIG" security write_routes)
+[ -n "$SEC_AUDIT_MAX_AGE" ] || SEC_AUDIT_MAX_AGE=90
+[ -n "$SEC_WAIVER_MAX_AGE" ] || SEC_WAIVER_MAX_AGE=180
+PERF_METRIC=$(g_yaml_block_scalar "$CONFIG" perf metric)
+PERF_CMD=$(g_yaml_block_scalar "$CONFIG" perf cmd)
+PERF_BASELINE_COMMIT=$(g_unquote "$(g_yaml_block_scalar "$CONFIG" perf baseline_commit)")
+PERF_BASELINE_VALUE=$(g_yaml_block_scalar "$CONFIG" perf baseline_value)
+PERF_MEASURED=$(g_unquote "$(g_yaml_block_scalar "$CONFIG" perf measured)")
+PERF_HOST_GATE=$(g_yaml_block_scalar "$CONFIG" perf host_gate)
+export SEC_GITIGNORE_FAMILY SEC_BUILD_OUTPUT SEC_AUDIT_CMD SEC_AUDIT_MAX_AGE SEC_WAIVER_MAX_AGE
+export SEC_WRITE_ROUTES PERF_METRIC PERF_CMD PERF_BASELINE_VALUE PERF_HOST_GATE
+
+# Whole days between an ISO date and today, or empty when the date does not parse on this host
+# (`date -d` is GNU; the row FAILS rather than assuming, because an unreadable date is not a
+# fresh record).
+age_days() {
+  local then_s now_s
+  then_s=$(date -u -d "$1" +%s 2>/dev/null) || return 1
+  now_s=$(date -u +%s)
+  printf '%s' "$(( (now_s - then_s) / 86400 ))"
+}
+
+# The source files a secret-shaped search should look at. The vendored harness (.goblin,
+# .hermes), the build output and dependencies are excluded: SC-03 must not match the row text
+# that describes it.
+sc_sources() {
+  ( cd "$ROOT" && grep -rniE "$1" \
+      --include='*.ts' --include='*.tsx' --include='*.js' --include='*.jsx' \
+      --include='*.mjs' --include='*.cjs' --include='*.vue' --include='*.svelte' . 2>/dev/null \
+      | grep -vE '(^|/)(\.next|node_modules|\.goblin|\.hermes|dist|build|out|coverage)/' || true )
+}
+
+only_selected() {
+  [ -z "$ONLY" ] && return 0
+  case ",$ONLY," in *",$1,"*) return 0 ;; esac
+  return 1
+}
+
+# ---- part mapping: a row id's prefix names the class-controlled part ---------
+row_part() {
+  case "$1" in
+    HP-*) echo handoff ;;
+    SP-*) echo spec ;;
+    GT-01|GT-02|GT-03) echo gate ;;
+    GT-04|GT-05) echo ratchet ;;
+    HS-01|HS-03) echo gate ;;
+    HS-02) echo replay ;;
+    PG-*) echo pr-gate ;;
+    # The automation rows and SK-04 ride the `playbooks` part: their artifacts are the shipped
+    # skills and the automation producers, and --skills no disables that part. An unmapped
+    # prefix returns "" and the row can never honour an opt-out (G3 section 4.3).
+    AU-*) echo playbooks ;;
+    SK-04) echo playbooks ;;
+    # SK-01 rides the same part (W1 made it a builtin for the global-mode clause): with
+    # --skills no there is no shipped skill to frontmatter-check, and a vacuous pass proves
+    # nothing - the row honours the opt-out like its SK-02/SK-04 siblings.
+    SK-01) echo playbooks ;;
+    # SK-02 keys off the same part: with --skills no there are no installed skills to hash, and
+    # the row used to FAIL there (measured at v0.2.0-dev: "32 passed, 1 failed ... SK-02 0
+    # installed skill file(s) hashed"). An opt-out is the honest report; a FAIL on a repo that
+    # opted out of skills is not.
+    SK-02) echo playbooks ;;
+    *) echo "" ;;
+  esac
+}
+
+# ============================================================== builtins ======
+# Each builtin prints its detail and returns 0 pass | 1 fail | 2 advisory | 3 skip.
+
+# The install-record rows (W1 §2.5). IN-01 and IN-04 were shell one-liners over
+# .goblin/installed.json; the engine.mode=global clause needs engine logic (a global,
+# declaration-only repo has NO install record and must SKIP with the reason, never be
+# born RED - the D8/FM-01 shape), so the one-liners move into builtins that keep the
+# same clauses and gain the mode check. In vendored mode they are exactly the old cells.
+check_in_01() {
+  if [ "$ENGINE_MODE" = "global" ] && [ ! -s "$INSTALLED" ]; then
+    printf 'global engine mode — no per-repo install record\n'
+    return 3
+  fi
+  [ -s "$INSTALLED" ] && grep -q '"version"' "$INSTALLED" \
+    && { printf 'the install record exists and names its version\n'; return 0; }
+  printf 'installed.json is absent or records no version\n'
+  return 1
+}
+
+# g_installed_files_strict <installed.json> — only the entries of the `files:` MAP. The
+# line-oriented engine-block reader (g_json_object) also matches the `engine:` block's
+# "key": "value" pairs (W1 §2.2), which IN-04 must never read as pre-existing files.
+g_installed_files_strict() {
+  awk '
+    /^  "files": \{[[:space:]]*\},?$/ { next }
+    /^  "files": \{/ { f = 1; next }
+    f && /^  \},$/ { f = 0 }
+    f && /^    "/ {
+      line = $0
+      sub(/^    "/, "", line)
+      p = line; sub(/".*/, "", p)
+      h = line; sub(/[^"]*"[[:space:]]*:[[:space:]]*"/, "", h); sub(/".*/, "", h)
+      print p "\t" h
+    }
+  ' "$1"
+}
+
+# g_json_object_strict <installed.json> <object-name> — g_json_object, hardened for the
+# engine-block record (W1 §2.2): an EMPTY object (`"refused": {}`) opens and closes on
+# the same line, so the reader must not treat the NEXT block's `"key": "value"` pairs
+# as this object's (IN-04 read the engine block's `mode`/`engine_dir` as vanished
+# pre-existing files).
+g_json_object_strict() {
+  awk -v name="$2" '
+    index($0, "\"" name "\"") && /:[[:space:]]*\{/ {
+      if ($0 ~ /\{[[:space:]]*\}/) next          # empty object: nothing inside
+      inf = 1; next
+    }
+    inf && /^[[:space:]]*\}/ { inf = 0 }
+    inf && /"/ {
+      line = $0
+      sub(/^[[:space:]]*"/, "", line)
+      p = line; sub(/".*/, "", p)
+      h = line; sub(/^[^"]*"[[:space:]]*:[[:space:]]*"/, "", h); sub(/".*/, "", h)
+      if (p != "") print p "\t" h
+    }
+  ' "$1"
+}
+
+check_in_04() {
+  if [ "$ENGINE_MODE" = "global" ] && [ ! -s "$INSTALLED" ]; then
+    printf 'global engine mode — no per-repo install record\n'
+    return 3
+  fi
+  local p h n=0 bad=0 files
+  files=$(g_installed_files_strict "$INSTALLED" | cut -f1)
+  while IFS=$'\t' read -r p h; do
+    [ -n "$p" ] || continue
+    n=$((n + 1))
+    if [ ! -e "$ROOT/$p" ]; then printf 'pre-existing file vanished: %s\n' "$p"; bad=1; continue; fi
+    if printf '%s\n' "$files" | grep -qxF "$p"; then
+      printf 'pre-existing file was taken over by the install: %s\n' "$p"; bad=1
+    fi
+  done < <(g_json_object_strict "$INSTALLED" refused)
+  printf '%d pre-existing file(s) left untouched\n' "$n"
+  [ "$bad" -eq 0 ]
+}
+
+check_in_02() {
+  # The W1 semantic split (§2.2). Clause 1 - the per-repo mode: hash every recorded file,
+  # the practice pin rides along - is byte-for-byte what this row has always done, and a
+  # fresh install of any class keeps it (installed.json carries no engine: block).
+  # Clause 2 - engine.mode=global with file entries remaining: hash what IS recorded;
+  # an entry under the engine paths (.goblin/bin, .goblin/manifest, .goblin/bans,
+  # .goblin/automations, .goblin/roles.yaml) that is still present is hashed too
+  # (harmless), and one that is MISSING is not drift - the engine is no longer the repo's.
+  # Clause 3 - global with no file entries: the declaration + practice pin only; never
+  # FAIL for absence of install artifacts (a declaration-only repo is not born RED).
+  # The engine hash itself is printed in the footer on every run (see the footer, below);
+  # this row proves the REPO-LOCAL bytes, and a global engine answers elsewhere.
+  local p h cur n=0 bad=0 pin="" detail=""
+  while IFS=$'\t' read -r p h; do
+    [ -n "$p" ] || continue
+    if [ "$ENGINE_MODE" = "global" ]; then
+      case "$p" in
+        .goblin/bin/*|.goblin/manifest/*|.goblin/bans/*|.goblin/automations/*|.goblin/roles.yaml)
+          [ -e "$ROOT/$p" ] || continue ;;   # engine removed by design: not drift
+        # W4a (§5.3/§5.2): the procedure tier is EMITTED per platform, not carried in the
+        # repo - a recorded .hermes/skills/ file absent from disk is the tier living at its
+        # emitted paths, not drift. A copy that IS present must still hash true (a stale or
+        # hand-edited shadow is exactly what --unshadow/doctor exist to surface).
+        .hermes/skills/*)
+          [ -e "$ROOT/$p" ] || continue ;;
+      esac
+    fi
+    n=$((n + 1))
+    cur=$(g_sha256_file "$ROOT/$p")
+    if [ "$cur" != "$h" ]; then
+      printf 'drift: %s recorded %s now %s\n' "$p" "$h" "$cur"
+      bad=1
+    fi
+  done < <(g_installed_files_strict "$INSTALLED")
+  if [ "$ENGINE_MODE" = "global" ] && [ "$n" -eq 0 ]; then
+    detail="0 repo-local files hashed (global engine mode)"
+  else
+    [ "$n" -gt 0 ] || { printf 'installed.json lists no files\n'; return 1; }
+  fi
+  # The practice pin rides on this row (R6 section 2.1 requires the pin; section 5 has no row of
+  # its own for it). Both are the same statement: a recorded hash still matches the file on disk.
+  local pin=""
+  if [ -n "$PRACTICE" ] && [ -n "$PRACTICE_SHA" ]; then
+    if [ ! -e "$PRACTICE" ]; then
+      printf 'practice standard not found: %s\n' "$PRACTICE"; bad=1; pin=" | practice missing"
+    else
+      cur=$(g_sha256_file "$PRACTICE")
+      if [ "$cur" != "$PRACTICE_SHA" ]; then
+        printf 'practice standard edited: %s\n  recorded %s\n  now      %s\n' "$PRACTICE" "$PRACTICE_SHA" "$cur"
+        # The remedy, in the place the operator actually meets the failure. The pin exists to
+        # catch a SILENT edit, so re-pinning is a deliberate act: one explicit command, which
+        # prints the old and new hash (docs/CONTRACTS.md, "An edited standard is not a dead end").
+        printf '  if the edit is yours and intended, re-pin it deliberately:\n'
+        printf '    goblin-install --target %s --re-pin\n' "$ROOT"
+        bad=1; pin=" | practice EDITED"
+      else
+        pin=" | practice pin ok"
+      fi
+    fi
+  fi
+  if [ "$ENGINE_MODE" = "global" ] && [ "$n" -eq 0 ]; then
+    printf '%s%s\n' "$detail" "${pin:+ | ${pin# | }}"
+    [ "$bad" -eq 0 ]
+    return
+  fi
+  printf '%d installed files hashed%s\n' "$n" "$pin"
+  [ "$bad" -eq 0 ]
+}
+
+check_hp_03() {
+  # Every gate-bearing line inside the HANDOFF's `Gates` section carries `measured <date>`.
+  # Anchored on the gate names `.goblin/goblin.yaml` DECLARES (GT-01's source of truth), not on
+  # a hardcoded keyword list: the shipped gates are named `commit` and `todo_ceiling`, and the
+  # old list `(tsc|build|hex|safelist|n/n)` matched neither, so on a fresh install the only line
+  # it could see was the template's own "Example of the required form" prose. Measured at
+  # 43f7f69: strip the date from the REAL gate line -> PASS; strip it from the example -> FAIL.
+  # The row was testing the template, not the artifact (G8-2).
+  #
+  # A gate line is a line inside the section that carries `=` and either names a declared gate or
+  # carries a gate-shaped number. A line whose text says "example of the required form" is
+  # template prose, not a gate number, and is skipped. n == 0 is a FAIL: a Gates section with no
+  # gate line at all (which is what is left when only the example remains) is not a green row.
+  local names out rc n detail
+  names=$(g_yaml_gates "$CONFIG" | cut -f1 | tr '\n' ' ')
+  names=${names% }
+  rc=0
+  out=$(awk -v names="$names" '
+    function hasname(line, k,   i, a, m) {
+      m = split(line, a, /[^A-Za-z0-9_./-]+/)
+      for (i = 1; i <= m; i++) if (a[i] == k) return 1
+      return 0
+    }
+    BEGIN {
+      bad = 0; n = 0
+      m = split(names, dn, " ")
+      for (i = 1; i <= m; i++) if (dn[i] != "") decl[dn[i]] = 1
+    }
+    tolower($0) ~ /^#{2,3}[[:space:]]+[^[:alpha:]]*gates?([^[:alpha:]]|$)/ { g = 1; next }
+    g && /^#{1,3}[[:space:]]/ { g = 0 }
+    !g { next }
+    tolower($0) ~ /example of the required form/ { next }
+    $0 !~ /=/ { next }
+    {
+      hit = 0
+      if ($0 ~ /(tsc|build|hex|safelist|[0-9]+\/[0-9]+)[^=]*=/) hit = 1
+      if (!hit) for (k in decl) if (hasname($0, k)) { hit = 1; break }
+      if (hit) {
+        n++
+        if ($0 !~ /measured [0-9]{4}-[0-9]{2}-[0-9]{2}/) {
+          print "a gate line carries no measured date: " $0
+          bad = 1
+        }
+      }
+    }
+    END {
+      if (n == 0) {
+        print "no gate line inside the Gates section (declared gates: " (names == "" ? "none" : names) ")"
+        bad = 1
+      }
+      printf "#count %d\n", n
+      exit bad
+    }
+  ' "$ROOT/HANDOFF.md") || rc=$?
+  n=$(printf '%s\n' "$out" | sed -n 's/^#count //p')
+  detail=$(printf '%s\n' "$out" | grep -v '^#count ' || true)
+  if [ "$rc" -ne 0 ]; then printf '%s\n' "$detail"; return 1; fi
+  printf '%d gate line(s) inside the Gates section, each with a measured date%s\n' \
+    "${n:-0}" "${names:+ (anchored on the declared gate name(s): $names)}"
+  return 0
+}
+
+check_hp_05() {
+  local tok found=0 head
+  head=$(cd "$ROOT" && git rev-parse HEAD 2>/dev/null)
+  for tok in $(grep -oE '[0-9a-f]{7,40}' "$ROOT/HANDOFF.md" 2>/dev/null | sort -u); do
+    ( cd "$ROOT" && git rev-parse --verify --quiet "$tok^{commit}" >/dev/null 2>&1 ) || continue
+    ( cd "$ROOT" && git merge-base --is-ancestor "$tok" HEAD 2>/dev/null ) || continue
+    printf 'names %s (ancestor of HEAD %s)\n' "$tok" "${head:0:7}"
+    found=1
+    break
+  done
+  [ "$found" -eq 1 ] || printf 'HANDOFF.md names no commit that exists in this repo\n'
+  [ "$found" -eq 1 ]
+}
+
+check_gt_01() {
+  # Every `- name:` under `gates:` is a DECLARED gate, and every declared gate must carry a
+  # `cmd:`. Counting only the name+cmd PAIRS (what this row did) let a gate lose its `cmd:` -
+  # deleted, blanked or re-indented - and the row still reported the survivors as
+  # `1 declared gate(s)`: the gate vanished in silence (G8-3). The name reader is the one that
+  # keeps it visible, so the missing `cmd:` is a FAIL here, not a pass.
+  local n=0 bad=0 name cmd
+  while IFS=$'\t' read -r name cmd; do
+    [ -n "$name" ] || continue
+    n=$((n + 1))
+    if [ -z "$cmd" ]; then
+      printf 'declared gate "%s" has no cmd - it is declared and never runs\n' "$name"
+      bad=1
+    fi
+  done < <(g_yaml_gates_all "$CONFIG")
+  [ "$n" -ge 1 ] || { printf 'no gate declared in %s\n' "$CONFIG"; return 1; }
+  [ "$bad" -eq 0 ] || return 1
+  printf '%d declared gate(s), each with a cmd\n' "$n"
+  return 0
+}
+
+# run the declared gates; optionally write the one-line measured numbers
+run_gates() {
+  local write_line="$1" name cmd rc bad=0 line=""
+  while IFS=$'\t' read -r name cmd; do
+    [ -n "$name" ] || continue
+    ( cd "$ROOT" && bash -c "$cmd" ) >/dev/null 2>&1
+    rc=$?
+    line="$line $name=$rc"
+    [ "$rc" -eq 0 ] || { printf 'gate %s: %s -> exit %d\n' "$name" "$cmd" "$rc"; bad=1; }
+  done < <(g_yaml_gates "$CONFIG")
+  if [ "$write_line" = "yes" ]; then
+    local rname rcmd rval
+    rname=$(g_yaml_block_scalar "$CONFIG" ratchet name)
+    rcmd=$(g_yaml_block_scalar "$CONFIG" ratchet cmd)
+    if [ -n "$rname" ] && [ -n "$rcmd" ]; then
+      rval=$( cd "$ROOT" && bash -c "$rcmd" 2>/dev/null | tr -d '[:space:]' )
+      line="$line · $rname $rval (ceiling $(g_yaml_block_scalar "$CONFIG" ratchet ceiling))"
+    fi
+    printf '%s · measured %s\n' "${line# }" "$(date +%F)" > "$ROOT/.goblin/last-gate-line"
+    cat "$ROOT/.goblin/last-gate-line"
+  fi
+  return $bad
+}
+
+check_gt_02() { run_gates yes; }
+
+check_gt_04() {
+  local n c ceil
+  n=$(g_yaml_block_scalar "$CONFIG" ratchet name)
+  c=$(g_yaml_block_scalar "$CONFIG" ratchet cmd)
+  ceil=$(g_yaml_block_scalar "$CONFIG" ratchet ceiling)
+  [ -n "$n" ] || { printf 'ratchet.name missing\n'; return 1; }
+  [ -n "$c" ] || { printf 'ratchet.cmd missing\n'; return 1; }
+  case "$ceil" in ''|*[!0-9]*) printf 'ratchet.ceiling must be numeric, got %s\n' "$ceil"; return 1 ;; esac
+  printf 'ratchet %s ceiling %s\n' "$n" "$ceil"
+  return 0
+}
+
+check_gt_05() {
+  local n c ceil val old prev="" note=""
+  n=$(g_yaml_block_scalar "$CONFIG" ratchet name)
+  c=$(g_yaml_block_scalar "$CONFIG" ratchet cmd)
+  ceil=$(g_yaml_block_scalar "$CONFIG" ratchet ceiling)
+  [ -n "$n" ] && [ -n "$c" ] || { printf 'no ratchet declared for this class - skipped\n'; return 3; }
+  val=$( cd "$ROOT" && bash -c "$c" 2>/dev/null | tr -d '[:space:]' )
+  case "$val" in ''|*[!0-9]*) printf 'ratchet cmd produced a non-number: %s\n' "$val"; return 1 ;; esac
+  if [ -f "$ROOT/.goblin/ratchet-last" ]; then prev=$(cat "$ROOT/.goblin/ratchet-last"); fi
+  if [ -n "$prev" ] && [ "$prev" -lt "$val" ]; then
+    note="old $prev + $((val - prev)) new = $val"
+  else
+    note="$n $val (ceiling $ceil)"
+  fi
+  printf '%s\n' "$val" > "$ROOT/.goblin/ratchet-last"
+  if [ "$val" -gt "$ceil" ]; then printf '%s over ceiling %s\n' "$note" "$ceil"; return 1; fi
+  printf '%s\n' "$note"
+  return 0
+}
+
+check_hs_01() {
+  local d="$GOBLIN_HARNESS_DIR" f base asserting=0 reporting=0 bad=0
+  if [ -z "$d" ]; then
+    # A declared harness dir that is missing is a FAIL when the class scaffolds one; a class
+    # that ships none skips with a reason. Keying the skip off the PATH let a one-line config
+    # edit switch both HS rows off (D7).
+    if [ "$GOBLIN_HARNESS_STATE" = "absent" ]; then
+      printf 'harness_dir %s is declared and class %s scaffolds it, but the directory is absent\n' \
+        "$GOBLIN_HARNESS_REL" "$CLASS"
+      return 1
+    fi
+    printf 'no harness dir (%s absent, class %s scaffolds none) - nothing to assert\n' \
+      "$GOBLIN_HARNESS_REL" "$CLASS"
+    return 3
+  fi
+  for f in "$d"/*; do
+    [ -f "$f" ] || continue
+    base=$(basename "$f")
+    if grep -q 'assert(' "$f" && grep -q 'process\.exit' "$f"; then
+      asserting=$((asserting + 1))
+    else
+      reporting=$((reporting + 1))
+      printf 'not an asserting harness (report utility): %s\n' "$base"
+    fi
+  done
+  printf '%d asserting harness(es), %d report utility(ies)\n' "$asserting" "$reporting"
+  [ "$asserting" -gt 0 ] || { printf 'harness dir %s holds no asserting harness\n' "$GOBLIN_HARNESS_REL"; bad=1; }
+  [ "$bad" -eq 0 ]
+}
+
+check_hs_02() {
+  local env cmd commit d tmp bad=0 f rc base name qname pat
+  env=$(g_yaml_block_scalar "$CONFIG" replay env)
+  cmd=$(g_yaml_block_scalar "$CONFIG" replay cmd)
+  commit=$(g_unquote "$(g_yaml_block_scalar "$CONFIG" replay commit)")
+  [ -n "$env" ] || { printf 'replay.env not declared\n'; return 1; }
+  [ -n "$cmd" ] || { printf 'replay.cmd not declared\n'; return 1; }
+  # Z1-4: the DECLARED command has to be what runs the harness. Until this fix it was read only
+  # to assert it was non-empty, and the loop below ran `node <file>` itself - so the command and
+  # its `{name}` placeholder were decorative (`grep -rn '{name}' tests/` was 0 hits, and setting
+  # `replay.cmd: false` changed no verdict). A documented mechanism that never executes is the
+  # same species as the regression this repo already shipped once.
+  #   * a command that does not interpolate {name} cannot be running the harness it names, so
+  #     nothing is replayed and "every harness was RED" would be a statement about a command
+  #     that never ran one (the defanged-probe shape, docs/LIMITS.md #28/W5-12);
+  #   * a command that cannot be executed at all (exit 126/127) FAILS rather than counting as a
+  #     RED harness - otherwise a typo'd interpreter would make every harness look proven.
+  pat='{name}'
+  case "$cmd" in
+    *"$pat"*) ;;
+    *) printf 'replay.cmd declares no %s: %s\n' "$pat" "$cmd"
+       printf 'the declared command cannot be running the harness it names, so nothing was replayed\n'
+       return 1 ;;
+  esac
+  if [ -z "$commit" ] || ! git -C "$ROOT" rev-parse --verify --quiet "$commit^{commit}" >/dev/null; then
+    printf 'no pinned pre-change commit yet (replay.commit empty or unknown) - REPLAY not provable\n'
+    return 3
+  fi
+  d="$GOBLIN_HARNESS_DIR"
+  if [ -z "$d" ]; then
+    if [ "$GOBLIN_HARNESS_STATE" = "absent" ]; then
+      printf 'harness_dir %s is declared and class %s scaffolds it, but the directory is absent\n' \
+        "$GOBLIN_HARNESS_REL" "$CLASS"
+      return 1
+    fi
+    printf 'no harness dir to replay\n'; return 3
+  fi
+  tmp=$(mktemp -d)
+  if ! git -C "$ROOT" worktree add -q --detach "$tmp/wt" "$commit" 2>/dev/null; then
+    rm -rf "$tmp"; printf 'cannot create a worktree at %s\n' "$commit"; return 1
+  fi
+  mkdir -p "$tmp/wt/$GOBLIN_HARNESS_REL"
+  cp -a "$d/." "$tmp/wt/$GOBLIN_HARNESS_REL/"
+  for f in "$tmp/wt/$GOBLIN_HARNESS_REL"/*.mjs; do
+    [ -e "$f" ] || continue
+    base=$(basename "$f")
+    name=${base%.mjs}
+    # Z2-3: the name is SHELL-QUOTED before it is substituted, because it now reaches a shell.
+    # This row runs the DECLARED command rather than `node "$f"` (Z1-4), so a file in the harness
+    # dir - a name the row does not control - is part of the command text `bash -c` parses.
+    # Unquoted, a name carrying `;`, `#`, a space or a glob was read as shell syntax: measured, a
+    # file named `z2;true;#.mjs` produced TWO commands and the trailing `true` decided the exit
+    # code. The outcome stayed fail-closed (a GREEN "harness" makes the row FAIL), but it is the
+    # same surface class as the G8-1 injection, so it is quoted rather than only documented.
+    qname=$(printf '%q' "$name")
+    ( cd "$tmp/wt" && env "$env"="$commit" bash -c "${cmd//$pat/$qname}" ) >/dev/null 2>&1
+    rc=$?
+    case "$rc" in
+      0)
+        printf '%s was GREEN on the pre-change tree %s - proves nothing\n' "$base" "${commit:0:7}"
+        bad=1
+        ;;
+      126|127)
+        printf '%s: the declared replay.cmd could not be executed (exit %d): %s\n' "$base" "$rc" "$cmd"
+        bad=1
+        ;;
+    esac
+  done
+  git -C "$ROOT" worktree remove --force "$tmp/wt" >/dev/null 2>&1
+  rm -rf "$tmp"
+  [ "$bad" -eq 0 ] && printf 'every harness was RED at %s (run as: %s)\n' "${commit:0:7}" "$cmd"
+  return $bad
+}
+
+check_cm_03() {
+  local n
+  n=$(cd "$ROOT" && git status --porcelain 2>/dev/null | wc -l | tr -d '[:space:]')
+  printf '%s dirty entr(y|ies), max_dirty %s\n' "$n" "$MAX_DIRTY"
+  [ "$n" -le "$MAX_DIRTY" ]
+}
+
+resolve_role_models() {
+  # prints "role<TAB>profile<TAB>provider<TAB>model<TAB>effort" for each lane of a role
+  local role="$1" f="$SELF_DIR/../roles.yaml"
+  [ -f "$f" ] || f="$ROOT/.goblin/roles.yaml"
+  local profiles
+  profiles=$(g_yaml_block_scalar "$f" "role-$role" profiles)
+  [ -n "$profiles" ] || profiles=$(g_yaml_block_scalar "$f" "$role" profiles)
+  local p prov model eff
+  for p in $(printf '%s' "$profiles" | tr -d '[]' | tr ',' ' '); do
+    prov=$(g_models_field "$MODELS_FILE" "$p" provider)
+    model=$(g_models_field "$MODELS_FILE" "$p" model)
+    eff=$(g_models_field "$MODELS_FILE" "$p" effort)
+    printf '%s\t%s\t%s\t%s\t%s\n' "$role" "$p" "${prov:-?}" "${model:-?}" "${eff:-?}"
+  done
+}
+
+check_md_02() {
+  local code_line panel_line judge_line code_fam panel_fam judge_fam
+  if [ ! -f "$MODELS_FILE" ]; then
+    printf 'no model mapping configured (%s absent) - advisory\n' "$MODELS_FILE"
+    return 2
+  fi
+  code_line=$(resolve_role_models code | head -n 1)
+  panel_line=$(resolve_role_models review-panel | head -n 1)
+  judge_line=$(resolve_role_models judge | head -n 1)
+  code_fam=$(printf '%s' "$code_line" | cut -f4)
+  panel_fam=$(printf '%s' "$panel_line" | cut -f4)
+  judge_fam=$(printf '%s' "$judge_line" | cut -f4)
+  if [ -z "$code_line" ] || [ -z "$panel_line" ]; then
+    printf 'roles.yaml did not resolve both lanes - advisory\n'
+    return 2
+  fi
+  if [ "$code_fam" = "$panel_fam" ]; then
+    printf 'code lane and review lane both resolve to %s (same family) - goblin-stack cannot change this\n' "$code_fam"
+  else
+    printf 'code lane %s, review lane %s - different family\n' "$code_fam" "$panel_fam"
+  fi
+  # W5-6: the JUDGE lane's family is compared too. JG-02 proves the declared profile NAMES are
+  # disjoint and nothing more, so a `judge:` profile mapped to the author's own model passed it:
+  # the judge was distinct by name only, which is exactly what the judge role's claim cannot
+  # tolerate. The comparison is the same one the panel gets, and the row stays ADVISORY (`return
+  # 2`): goblin-stack cannot choose the fleet's models, it can only make the state loud. Measured
+  # on this box, every profile the mapping names resolves to ONE model - recorded, not faked, in
+  # docs/LIMITS.md #38.
+  if [ -z "$judge_line" ]; then
+    printf 'the judge lane does not resolve - add a `judge:` entry beside the code lane in %s\n' "$MODELS_FILE"
+    return 2
+  fi
+  case "$judge_fam" in
+    ''|'?'|unknown)
+      printf 'the judge lane resolves to no model in %s - add a `judge:` entry beside the code lane\n' "$MODELS_FILE"
+      return 2 ;;
+  esac
+  if [ "$judge_fam" = "$code_fam" ]; then
+    printf 'the judge lane resolves to %s, the SAME family as the code lane - JG-02 proves only that the declared profile names differ\n' "$judge_fam"
+  else
+    printf 'judge lane %s, code lane %s - different family\n' "$judge_fam" "$code_fam"
+  fi
+  return 2
+}
+
+check_pg_01() {
+  local f head n=0 bad=0
+  for f in "$ROOT"/reviews/*.md; do
+    [ -e "$f" ] || continue
+    n=$((n + 1))
+    head=$(sed -n 's/^head:[[:space:]]*//p' "$f" | head -n 1)
+    if [ -z "$head" ]; then printf '%s: no head: line\n' "$(basename "$f")"; bad=1; continue; fi
+    if ! ( cd "$ROOT" && git rev-list --all 2>/dev/null | grep -q "^$head" ); then
+      printf '%s: head %s is not in git rev-list --all\n' "$(basename "$f")" "$head"
+      bad=1
+    fi
+  done
+  printf '%d review note(s)\n' "$n"
+  [ "$bad" -eq 0 ]
+}
+
+check_pg_02() {
+  local f stakes lanes n=0 bad=0
+  for f in "$ROOT"/reviews/*.md; do
+    [ -e "$f" ] || continue
+    n=$((n + 1))
+    stakes=$(sed -n 's/^stakes:[[:space:]]*//p' "$f" | head -n 1)
+    case "$stakes" in
+      S[0-4]) ;;
+      *) printf '%s: stakes must be S0..S4, got "%s"\n' "$(basename "$f")" "$stakes"; bad=1; continue ;;
+    esac
+    case "$stakes" in
+      S2|S3|S4)
+        if ! awk '/^checks-run:/{c=1;next} c&&/^[a-z-]+:/{c=0} c&&NF{found=1} END{exit !found}' "$f"; then
+          printf '%s: stakes %s requires a non-empty checks-run: section\n' "$(basename "$f")" "$stakes"
+          bad=1
+        fi ;;
+    esac
+    case "$stakes" in
+      S3|S4)
+        lanes=$(sed -n 's/^lanes:[[:space:]]*//p' "$f" | head -n 1)
+        if [ -z "$lanes" ] || [ "$lanes" = "1" ]; then
+          printf '%s: stakes %s requires a second lane (lanes: 2 or more)\n' "$(basename "$f")" "$stakes"
+          bad=1
+        fi ;;
+    esac
+  done
+  printf '%d review note(s) classified\n' "$n"
+  [ "$bad" -eq 0 ]
+}
+
+check_pg_03() {
+  local f base head rec now n=0 bad=0
+  for f in "$ROOT"/reviews/*.md; do
+    [ -e "$f" ] || continue
+    n=$((n + 1))
+    base=$(sed -n 's/^base:[[:space:]]*//p' "$f" | head -n 1)
+    head=$(sed -n 's/^head:[[:space:]]*//p' "$f" | head -n 1)
+    rec=$(sed -n 's/^patch-id:[[:space:]]*//p' "$f" | head -n 1)
+    if [ -z "$base" ] || [ -z "$head" ] || [ -z "$rec" ]; then
+      printf '%s: needs base:, head: and patch-id:\n' "$(basename "$f")"; bad=1; continue
+    fi
+    now=$( cd "$ROOT" && git diff "$base".."$head" 2>/dev/null | git patch-id --stable 2>/dev/null | awk '{print $1}' )
+    if [ "$now" != "$rec" ]; then
+      printf '%s: recorded patch-id %s, now %s\n' "$(basename "$f")" "$rec" "${now:-<none>}"
+      bad=1
+    fi
+  done
+  printf '%d review note(s) patch-id checked\n' "$n"
+  [ "$bad" -eq 0 ]
+}
+
+check_pg_05() {
+  # PG-05 - "No required check that self-skips". The old body counted only "every step is
+  # guarded", so the REAL shape passed: in the estate's one existing workflow a deliberately
+  # UNGUARDED credential step decides whether the guarded compile step runs, so
+  # `guarded < steps` and the
+  # row reported PASS on the workflow it exists to catch (G8 section 3, re-measured V3-4). G6
+  # section A.6 named the mechanisable tell - a job whose GATE STEP is conditional can reach its
+  # end without running the gate while the required check still reports Success - so the row now
+  # carries three clauses per job:
+  #   (a) the job declares at least one run:/uses: step (otherwise the check runs nothing);
+  #   (b) the JOB carries no `if:` (otherwise the whole required check self-skips);
+  #   (c) no STEP carries an `if:` (otherwise that step - possibly the gate step - self-skips,
+  #       and GitHub reports a skipped job as Success: docs S1/S2, RISKS.md K7).
+  # It is a TEXT reading, deliberately strict, and says so in its own why-cell: a `#` inside a
+  # quoted string is read as a comment, a flow-style `jobs:` mapping is refused rather than read
+  # as clean, and a condition that is genuinely needed belongs in the command or in a second
+  # job that is not the required check.
+  local f n=0 bad=0
+  for f in "$ROOT"/.github/workflows/*.yml "$ROOT"/.github/workflows/*.yaml; do
+    [ -e "$f" ] || continue
+    n=$((n + 1))
+    awk -v FILE="$(basename "$f")" '
+      function closejob() {
+        if (jobname == "") return
+        if (steps == 0) { printf "%s: job \"%s\" declares no run:/uses: step - the required check runs nothing and still reports Success\n", FILE, jobname; bad = 1 }
+        if (jobif > 0)  { printf "%s: job \"%s\" carries a job-level if: (%d) - the whole required check self-skips and reports Success\n", FILE, jobname, jobif; bad = 1 }
+        if (stepif > 0) { printf "%s: job \"%s\" has %d conditional step(s) - a skipped step reports Success, and a skipped gate step green-lights a commit whose gate never ran\n", FILE, jobname, stepif; bad = 1 }
+        jobname = ""
+      }
+      {
+        line = $0
+        sub(/[ \t]+#.*$/, "", line)          # blank a trailing comment
+        if (line ~ /^[ \t]*#/) next
+        if (line ~ /^[ \t]*$/) next
+        if (!injobs) {
+          if (line ~ /^jobs:[ \t]*$/) { injobs = 1; jind = -1 }
+          else if (line ~ /^jobs:[ \t]*[^ \t]/) { printf "%s: the jobs: block is a flow mapping - it cannot be read here, so it is refused rather than read as clean\n", FILE; bad = 1; injobs = 1; jind = -1 }
+          next
+        }
+        lead = match(line, /[^ \t]/) - 1
+        if (jind >= 0 && lead == jind && line !~ /^[ \t]*-/) {
+          closejob()
+          jobname = line; sub(/^[ \t]*/, "", jobname); sub(/[ \t]*:.*/, "", jobname)
+          steps = 0; stepregion = 0; jobif = 0; stepif = 0
+          next
+        }
+        if (jind < 0) {
+          jind = lead
+          jobname = line; sub(/^[ \t]*/, "", jobname); sub(/[ \t]*:.*/, "", jobname)
+          steps = 0; stepregion = 0; jobif = 0; stepif = 0
+          next
+        }
+        if (lead <= jind) next
+        if (line ~ /^[ \t]*-/) stepregion = 1
+        if (line ~ /(^|[ \t-])(run|uses):/) { steps++; next }
+        if (line ~ /^[ \t]*-?[ \t]*if:/) { if (stepregion) stepif++; else jobif++ }
+      }
+      END {
+        closejob()
+        if (!injobs) { printf "%s: no jobs: block - the workflow declares no check at all\n", FILE; bad = 1 }
+        exit bad
+      }
+    ' "$f" || bad=1
+  done
+  if [ "$n" -eq 0 ]; then
+    printf '0 workflow file(s) - no required check here to skip (vacuous by design: nothing declares one)\n'
+  else
+    printf '%d workflow file(s) checked for a self-skipping required check\n' "$n"
+  fi
+  [ "$bad" -eq 0 ]
+}
+
+check_pg_06() {
+  # PG-06 (G6 section A.6, row 2) - "The gate CI runs is the gate the project declares." The
+  # failure mode is R5 section 1.1 measured: review and CI and goblin-verify reporting different
+  # truths about one SHA, so a green required check says nothing about the gate the project
+  # actually declares. The declared set comes from g_yaml_gates - GT-01's own reader, reused
+  # rather than re-derived, so a gate cannot vanish from the comparison in silence (G8-3).
+  # A workflow satisfies the row when the whole declared set is RUN: either the verifier with no
+  # `--only` (a full run executes every declared gate through GT-02), or each declared gate
+  # command appearing verbatim. Comments are blanked first, so a commented-out verifier call is
+  # not a run, and key lines other than `run:` are dropped, so a command sitting in a `name:`
+  # cannot satisfy it. Partial by construction: it proves the gate is INVOKED in a file under
+  # `.github/workflows/`, never that GitHub marks that job required, and never that the invoker
+  # is the job the forge waits on.
+  local f n=0 bad=0 gname gcmd ngates=0 gates="" runtext miss="" nrun nc
+  while IFS=$'\t' read -r gname gcmd; do
+    [ -n "$gname" ] || continue
+    ngates=$((ngates + 1))
+    [ -n "$gcmd" ] && gates="$gates$gcmd"$'\n'
+  done < <(g_yaml_gates "$CONFIG")
+  for f in "$ROOT"/.github/workflows/*.yml "$ROOT"/.github/workflows/*.yaml; do
+    [ -e "$f" ] || continue
+    n=$((n + 1))
+    runtext=$(awk '
+      {
+        line = $0
+        sub(/[ \t]+#.*$/, "", line)
+        if (line ~ /^[ \t]*#/) next
+        if (line ~ /^[ \t]*$/) next
+        if (line ~ /^[ \t]*-?[ \t]*run:/) { print substr(line, index(line, "run:") + 4); next }
+        if (line ~ /^[ \t]*-?[ \t]*[A-Za-z_][A-Za-z0-9_.-]*:/) next
+        print line
+      }
+    ' "$f")
+    if printf '%s\n' "$runtext" | grep -q 'goblin-verify' \
+       && ! printf '%s\n' "$runtext" | grep -q 'goblin-verify[^&|;]*--only'; then
+      printf '%s: runs the verifier, which executes every declared gate\n' "$(basename "$f")"
+      continue
+    fi
+    # The verbatim path: compare on whitespace-normalised text, so a YAML line wrap or a dropped
+    # `2>/dev/null` does not read as "not the declared gate".
+    nrun=$(printf '%s\n' "$runtext" | tr '\n' ' ' | sed 's#2>/dev/null##g' | tr -s ' ')
+    miss=""
+    while IFS= read -r gcmd; do
+      [ -n "$gcmd" ] || continue
+      nc=$(printf '%s' "$gcmd" | sed 's#2>/dev/null##g' | tr -s ' ')
+      printf '%s' "$nrun" | grep -qF -- "$nc" || miss="$miss [$gcmd]"
+    done <<EOF
+$gates
+EOF
+    if [ -n "$miss" ]; then
+      printf '%s: runs no gate the project declares - declared but not run:%s\n' "$(basename "$f")" "$miss"
+      bad=1
+    else
+      printf '%s: runs all %d declared gate(s) verbatim\n' "$(basename "$f")" "$ngates"
+    fi
+  done
+  if [ "$n" -eq 0 ]; then
+    printf 'no workflow file to check - CI runs no gate here\n'
+    return 3
+  fi
+  printf '%d workflow file(s) compared with the %d declared gate(s)\n' "$n" "$ngates"
+  [ "$bad" -eq 0 ]
+}
+
+hash_runtime_data() {
+  local p h out=""
+  while read -r p; do
+    [ -n "$p" ] || continue
+    h=$(g_sha256_file "$ROOT/$p")
+    out="$out$p=$h "
+  done < <(g_yaml_list "$CONFIG" runtime_data)
+  printf '%s' "${out% }"
+}
+
+check_ds_01() {
+  local before after bad=0 p
+  # Clause the row's own rule states and the old body dropped: every declared path must be
+  # git-ignored, or it is fixture, not runtime data (D12).
+  while read -r p; do
+    [ -n "$p" ] || continue
+    ( cd "$ROOT" && git check-ignore -q -- "$p" ) \
+      || { printf 'runtime_data path is not git-ignored: %s\n' "$p"; bad=1; }
+  done < <(g_yaml_list "$CONFIG" runtime_data)
+  before=$(hash_runtime_data)
+  run_gates no >/dev/null 2>&1
+  after=$(hash_runtime_data)
+  printf 'before=%s\nafter=%s\n' "$before" "$after" > "$ROOT/.goblin/.ds-report"
+  if [ "$before" != "$after" ]; then
+    printf 'a gate run wrote runtime data: %s -> %s\n' "$before" "$after"
+    return 1
+  fi
+  # Declaring nothing is not a pass: it is an unexercised rule, and it is reported as one.
+  [ -n "$before" ] || { printf 'no runtime_data declared\n'; return 2; }
+  [ "$bad" -eq 0 ] || return 1
+  printf 'unchanged: %s\n' "$before"
+  return 0
+}
+
+check_ds_02() {
+  [ -f "$ROOT/.goblin/.ds-report" ] || { printf 'no DS-01 report in this run\n'; return 1; }
+  local b a
+  b=$(sed -n 's/^before=//p' "$ROOT/.goblin/.ds-report")
+  a=$(sed -n 's/^after=//p' "$ROOT/.goblin/.ds-report")
+  [ "$b" = "$a" ] || { printf 'before/after differ\n'; return 1; }
+  [ -f "$ROOT/.goblin/last-gate-line" ] || { printf 'no gate line to annotate\n'; return 0; }
+  local line
+  line=$(tr -d '\n' < "$ROOT/.goblin/last-gate-line")
+  printf '%s · runtime_data %s\n' "$line" "${b:-<none declared>}" > "$ROOT/.goblin/last-gate-line"
+  printf 'snapshot %s\n' "${b:-<none declared>}"
+  return 0
+}
+
+check_au_02() {
+  # The dedup key must be a function of the report's CONTENT only. Recompute it from the
+  # report's own repo+symptom and require the recorded value to equal it: a key derived from a
+  # date, a run id or a counter dedups nothing, and this is the row that says so.
+  local f n=0 bad=0 repo sym key want norm slug
+  for f in "$ROOT"/reports/*/report.yaml; do
+    [ -e "$f" ] || continue
+    n=$((n + 1))
+    slug=$(basename "$(dirname "$f")")
+    repo=$(sed -n 's/^repo:[[:space:]]*//p' "$f" | head -n 1)
+    sym=$(sed -n 's/^symptom:[[:space:]]*//p' "$f" | head -n 1)
+    key=$(sed -n 's/^dedup_key:[[:space:]]*//p' "$f" | head -n 1)
+    norm=$(printf '%s' "$sym" | tr 'A-Z' 'a-z' | tr -s '[:space:]' ' ' | sed 's/^ //; s/ $//')
+    want="bug:${repo}:$(g_sha256_text "$norm" | cut -c1-12)"
+    case "$key" in
+      '') printf '%s: no dedup_key recorded\n' "$slug"; bad=1; continue ;;
+    esac
+    if [ "$key" != "$want" ]; then
+      printf '%s: recorded key %s, recomputed %s\n' "$slug" "$key" "$want"; bad=1
+    fi
+    if printf '%s' "$key" | grep -qE '[0-9]{4}-[0-9]{2}-[0-9]{2}'; then
+      printf '%s: the key carries a date: %s\n' "$slug" "$key"; bad=1
+    fi
+  done
+  [ "$n" -gt 0 ] || { printf 'no reports/*/report.yaml - nothing to dedup\n'; return 3; }
+  printf '%d report(s): the key is content-only\n' "$n"
+  [ "$bad" -eq 0 ]
+}
+
+check_au_03() {
+  # A reporter's write surface is reports/** plus cards. Two falsifiable clauses: the tree is
+  # clean, and - when HEAD is a reporter commit - no path under the declared harness dir is in
+  # it. The harness clause only applies to a commit that touches reports/, so a normal round's
+  # commit is not mistaken for a reporter's.
+  local dirty bad=0 touched=""
+  [ -d "$ROOT/reports" ] || { printf 'no reports/ - no reporter run in this repo to audit\n'; return 3; }
+  dirty=$(cd "$ROOT" && git status --porcelain 2>/dev/null | wc -l | tr -d '[:space:]')
+  printf '%s dirty entr(y|ies), max_dirty %s\n' "$dirty" "$MAX_DIRTY"
+  if ( cd "$ROOT" && git rev-parse --verify --quiet HEAD~1 >/dev/null 2>&1 ); then
+    if ( cd "$ROOT" && git diff --name-only HEAD~1..HEAD 2>/dev/null | grep -q '^reports/' ); then
+      touched=$( cd "$ROOT" && git diff --name-only HEAD~1..HEAD 2>/dev/null \
+        | grep "^${GOBLIN_HARNESS_REL}/" || true )
+    else
+      printf 'HEAD is not a reporter commit - the harness clause does not apply\n'
+    fi
+  fi
+  if [ -n "$touched" ]; then
+    printf 'the reporter commit touched the harness: %s\n' "$(printf '%s' "$touched" | tr '\n' ' ')"
+    bad=1
+  fi
+  [ "$dirty" -le "$MAX_DIRTY" ] || { printf 'the reporter left the tree dirty\n'; bad=1; }
+  [ "$bad" -eq 0 ]
+}
+
+check_sc_02() {
+  # Clause 1 is a file rule; clause 2 is BEHAVIOURAL - it asks git's own matcher, so an ignore
+  # rule that looks right but does not match still fails. `git check-ignore -q` accepts exactly
+  # one pathname, so the body loops.
+  local miss="" p
+  if [ ! -f "$ROOT/.gitignore" ]; then
+    if [ -f "$ROOT/package.json" ]; then
+      printf 'no .gitignore in a repo with a package.json\n'; return 1
+    fi
+    printf 'no .gitignore and no package.json - there is no dependency surface here to protect\n'
+    return 3
+  fi
+  grep -qE '^[[:space:]]*\.env(\*|/)?[[:space:]]*$' "$ROOT/.gitignore" \
+    || miss="no bare .env rule"
+  if [ -d "$ROOT/.git" ]; then
+    for p in .env .env.local .env.production; do
+      ( cd "$ROOT" && git check-ignore -q "$p" ) || miss="$miss not-ignored:$p"
+    done
+  else
+    miss="$miss no-git-repository"
+  fi
+  if [ -n "$miss" ]; then printf 'the secret family is not ignored:%s\n' "$miss"; return 1; fi
+  printf 'the whole secret family is ignored (.env, .env.local, .env.production proved by git)\n'
+  return 0
+}
+
+check_sc_03() {
+  # Clause 1: a client-visible NAME that is secret-shaped. Clause 2: a known secret PREFIX in
+  # real build output. The second clause is reported, never silently skipped: a repo with no
+  # build output is told so on the line.
+  local hits hits_all hits_n vs_keys vs_files out n=0 bad=0
+  hits_all=$(sc_sources 'NEXT_PUBLIC_[A-Z0-9_]*(SECRET|TOKEN|KEY|PASSWORD|PASSWD|PRIVATE)')
+  # W5-11: this line printed a CHARACTER count as a hit count - `${#hits}` on a multiline
+  # string - so ONE matching line of 70 characters was reported as "70 client-visible
+  # secret-shaped name(s)". The number is the count of matching LINES (capped at five lines of
+  # evidence), which is what the word "name(s)" claims.
+  hits_n=0
+  [ -n "$hits_all" ] && hits_n=$(printf '%s\n' "$hits_all" | grep -c .)
+  hits=$(printf '%s' "$hits_all" | head -n 5)
+  if [ -n "$hits" ]; then
+    printf 'client-visible secret-shaped name(s): %d\n%s\n' "$hits_n" "$hits"; bad=1
+  fi
+  out=""
+  for d in $SEC_BUILD_OUTPUT; do
+    [ -d "$ROOT/$d" ] || continue
+    out="$out $(find "$ROOT/$d" -type f 2>/dev/null | head -n 200)"
+  done
+  for f in $out; do
+    n=$((n + 1))
+    grep -qE '(sk-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|AKIA[A-Z0-9]{16}|eyJ[A-Za-z0-9_-]{20,}\.)' "$f" 2>/dev/null \
+      && { printf 'a secret-shaped literal is in build output: %s\n' "${f#"$ROOT"/}"; bad=1; }
+  done
+  if [ "$n" -eq 0 ]; then
+    printf '%d client-visible secret-shaped name(s); no build output to scan for clause 2\n' "$hits_n"
+  else
+    printf '%d client-visible secret-shaped name(s); %d build-output file(s) scanned for secret literals\n' "$hits_n" "$n"
+  fi
+  [ "$bad" -eq 0 ]
+}
+
+check_sc_04() {
+  # A JS-written cookie needs `secure` + `samesite` in the SAME statement; a server-side set
+  # needs `httpOnly` + `sameSite`. Same-statement only: a write spread over three lines is not
+  # seen, and the row says so rather than implying it read the statement.
+  local js srv bad=0 n=0 line
+  js=$(sc_sources 'document\.cookie[[:space:]]*=')
+  srv=$(sc_sources '(cookies\(\)\.set\(|res\.cookie\(|NextResponse\.cookie\()')
+  if [ -n "$js" ]; then
+    while IFS= read -r line; do
+      n=$((n + 1))
+      printf '%s' "$line" | grep -qiE 'secure' || { printf 'a JS cookie write has no secure flag: %s\n' "$(printf '%s' "$line" | cut -d: -f1-2)"; bad=1; }
+      printf '%s' "$line" | grep -qiE 'samesite' || { printf 'a JS cookie write has no samesite flag: %s\n' "$(printf '%s' "$line" | cut -d: -f1-2)"; bad=1; }
+    done <<EOF
+$js
+EOF
+  fi
+  if [ -n "$srv" ]; then
+    while IFS= read -r line; do
+      n=$((n + 1))
+      printf '%s' "$line" | grep -qiE 'httponly' || { printf 'a server cookie set has no httpOnly: %s\n' "$(printf '%s' "$line" | cut -d: -f1-2)"; bad=1; }
+      printf '%s' "$line" | grep -qiE 'samesite' || { printf 'a server cookie set has no sameSite: %s\n' "$(printf '%s' "$line" | cut -d: -f1-2)"; bad=1; }
+    done <<EOF
+$srv
+EOF
+  fi
+  printf '%d cookie write(s) checked; a JS-written cookie is readable by any script - reported, not failed\n' "$n"
+  [ "$bad" -eq 0 ]
+}
+
+check_sc_05() {
+  # Every write handler (POST|PUT|PATCH|DELETE) in the declared route dirs must CALL a validator,
+  # or be named in .goblin/boundary-waivers. Partial by design: it proves a validator is called,
+  # not that the schema is right.
+  local d f rel n=0 bad=0 w=0
+  for d in $SEC_WRITE_ROUTES; do
+    [ -d "$ROOT/$d" ] || continue
+    while IFS= read -r f; do
+      [ -n "$f" ] || continue
+      grep -qE 'export[[:space:]]+(async[[:space:]]+)?(function[[:space:]]+)?(const[[:space:]]+)?(POST|PUT|PATCH|DELETE)\b' "$f" || continue
+      n=$((n + 1))
+      rel="${f#"$ROOT"/}"
+      if grep -qE 'safeParse|zod|valibot|yup|ajv|superstruct|validate\(' "$f"; then continue; fi
+      if [ -f "$ROOT/.goblin/boundary-waivers" ] && grep -qE "^[[:space:]]*${rel}([[:space:]]|$)" "$ROOT/.goblin/boundary-waivers"; then
+        w=$((w + 1)); continue
+      fi
+      printf 'a write handler validates nothing and is not waived: %s\n' "$rel"; bad=1
+    done <<EOF
+$(find "$ROOT/$d" -type f \( -name 'route.ts' -o -name 'route.js' -o -name 'route.tsx' \) 2>/dev/null)
+EOF
+  done
+  printf '%d write handler(s), %d waived; %d dir(s) declared\n' "$n" "$w" "${#SEC_WRITE_ROUTES}"
+  [ "$bad" -eq 0 ]
+}
+
+check_sc_06() {
+  [ -f "$ROOT/package.json" ] || { printf 'no package.json - there is no dependency manifest to lock\n'; return 3; }
+  local f found=""
+  for f in package-lock.json pnpm-lock.yaml yarn.lock bun.lockb bun.lock; do
+    [ -f "$ROOT/$f" ] && found="$f"
+  done
+  [ -n "$found" ] || { printf 'package.json is present with no lockfile beside it\n'; return 1; }
+  if [ -d "$ROOT/.git" ]; then
+    ( cd "$ROOT" && git ls-files --error-unmatch "$found" >/dev/null 2>&1 ) \
+      || { printf '%s exists but is not tracked\n' "$found"; return 1; }
+    printf '%s is present and tracked\n' "$found"
+  else
+    printf '%s is present; the tracked clause is ordered after `git init`\n' "$found"
+  fi
+  return 0
+}
+
+# check_in_03 — the manifest self-check, run against whichever manifest the engine
+# actually resolved (W1 §2.5: the row's meaning is untouched, the hardcoded per-repo
+# path input follows the chain §2.3). Same three clauses as the row always carried.
+check_in_03() {
+  local bad=0
+  awk -F'\t' 'NR>1 && $6=="" {print "row " $1 " has no check and no advisory label"; bad=1} END{exit bad}' "$MANIFEST" || bad=1
+  awk -F'\t' 'NR>1 && ($6=="advisory" && $4!="advisory") {print "row " $1 " is advisory-labelled but its check column claims enforcement"; bad=1} END{exit bad}' "$MANIFEST" || bad=1
+  awk -F'\t' 'NR>1 && $4 !~ /^(script|lint|gate|advisory|test)$/ {print "row " $1 " has an enforced_by outside the closed enum: " $4; bad=1} END{exit bad}' "$MANIFEST" || bad=1
+  [ "$bad" -eq 0 ] && { printf 'the manifest is complete: every rule carries a check or is advisory, inside the enum\n'; return 0; }
+  return 1
+}
+
+check_sc_07() {
+  # Offline by construction: the record is written by .goblin/bin/goblin-audit, run ONCE,
+  # deliberately. A verify-time network call would break the offline dependency contract
+  # (docs/RISKS.md K4). The record and the waiver table are repo-local by design (W1 §2.5);
+  # only the SKIP remedy names the runner, and global mode names the CLI verb - the record
+  # is the repo's, the tool that produced it is wherever the engine resolves (chain §2.3).
+  [ -n "$SEC_AUDIT_CMD" ] || { printf 'this class declares no audit command (security.audit_cmd is empty)\n'; return 3; }
+  local rec="$ROOT/.goblin/audit.tsv" wfile="$ROOT/.goblin/audit-waiver.tsv"
+  if [ ! -f "$rec" ]; then
+    if [ "$ENGINE_MODE" = "global" ]; then
+      printf 'no audit record yet. Run `goblin audit` once, deliberately, then commit\n.goblin/audit.tsv: SC-07 reads the record and never the network\n'
+    else
+      printf 'no audit record yet. Run .goblin/bin/goblin-audit once, deliberately, then commit\n.goblin/audit.tsv: SC-07 reads the record and never the network\n'
+    fi
+    return 3
+  fi
+  local d age lines=0 waivers=0 pkg sev id bad=0 wl wd
+  d=$(sed -n 's/^measured[[:space:]]*//p' "$rec" | head -n 1)
+  if [ -z "$d" ]; then printf 'the audit record carries no `measured` date\n'; return 1; fi
+  age=$(age_days "$d") || { printf 'the recorded date does not parse on this host: %s\n' "$d"; return 1; }
+  if [ "$age" -gt "$SEC_AUDIT_MAX_AGE" ]; then
+    printf 'the audit record is %s days old (max %s): run goblin-audit again\n' "$age" "$SEC_AUDIT_MAX_AGE"
+    bad=1
+  fi
+  while IFS=$'\t' read -r pkg sev id rest; do
+    [ -n "$pkg" ] || continue
+    case "$pkg" in \#*) continue ;; esac
+    case "$sev" in high|critical) : ;; *) continue ;; esac
+    lines=$((lines + 1))
+    wl=""
+    if [ -f "$wfile" ]; then
+      wl=$(awk -F'\t' -v p="$pkg" -v i="$id" '$1==p && ($3==i || $3=="*") { print $4; exit }' "$wfile")
+    fi
+    if [ -z "$wl" ]; then
+      printf 'unwaived %s advisory: %s %s\n' "$sev" "$pkg" "$id"; bad=1; continue
+    fi
+    waivers=$((waivers + 1))
+    wd=$(age_days "$wl") || { printf 'the waiver for %s carries an unparseable date: %s\n' "$pkg" "$wl"; bad=1; continue; }
+    [ "$wd" -le "$SEC_WAIVER_MAX_AGE" ] \
+      || { printf 'the waiver for %s is %s days old (max %s): re-decide it\n' "$pkg" "$wd" "$SEC_WAIVER_MAX_AGE"; bad=1; }
+  done < "$rec"
+  printf 'audit measured %s (%s days old): %s high|critical line(s), %s matched waiver(s), %s unwaived\n' \
+    "$d" "$age" "$lines" "$waivers" "$((lines - waivers))"
+  [ "$bad" -eq 0 ]
+}
+
+check_sc_08() {
+  # An install hook is arbitrary code that runs on every `npm ci`. Only npm's lockfile records
+  # it (`hasInstallScript`); pnpm/yarn do not, so the row SKIPs with that reason rather than
+  # passing vacuously.
+  local lock="$ROOT/package-lock.json"
+  if [ ! -f "$lock" ]; then
+    if [ -f "$ROOT/pnpm-lock.yaml" ] || [ -f "$ROOT/yarn.lock" ]; then
+      printf 'a pnpm/yarn lockfile carries no hasInstallScript field - nothing to enumerate\n'; return 3
+    fi
+    printf 'no package-lock.json - there is no install-hook surface to enumerate\n'; return 3
+  fi
+  local pkgs n=0 ok=0 bad=0 p
+  # Z2-2: this reader is line-anchored, so a MINIFIED (one-line) lockfile - valid JSON, and what a
+  # tool that writes without pretty-printing leaves behind - matched NOTHING and the row printed
+  # `0 install hook(s), 0 allowlisted` as a PASS, exit 0. That is a vacuous PASS: the exact defect
+  # family (D6/PR-03) this harness exists to prevent, and the one shape the pnpm/yarn branch above
+  # already reports honestly. The text is normalised into the pretty shape first - break after
+  # every `{`, `}` and `,` - which is a TEXT transform, not a JSON parse: no npm, no jq, no parser
+  # (docs/CONTRACTS.md). The anchor accepts `": {` (what npm writes) and `":{` (minified), and the
+  # per-line state machine still attributes `hasInstallScript` to the key line it followed.
+  pkgs=$(awk '
+    {
+      gsub(/\{/, "{\n"); gsub(/\}/, "}\n"); gsub(/,/, ",\n")
+      n = split($0, L, "\n")
+      for (i = 1; i <= n; i++) {
+        s = L[i]
+        if (s ~ /^[[:space:]]*"node_modules\/[^"]+":[[:space:]]*\{/) {
+          k = s; sub(/^[[:space:]]*"/, "", k); sub(/":[[:space:]]*\{.*/, "", k); sub(/^node_modules\//, "", k)
+        }
+        if (s ~ /"hasInstallScript"[[:space:]]*:[[:space:]]*true/ && k != "") print k
+      }
+    }
+  ' "$lock" | sort -u)
+  for p in $pkgs; do
+    n=$((n + 1))
+    if [ -f "$ROOT/.goblin/install-hooks.allowlist" ] \
+       && grep -qxF "$p" "$ROOT/.goblin/install-hooks.allowlist"; then
+      ok=$((ok + 1))
+    else
+      printf 'an install-time script is not on the allowlist: %s\n' "$p"; bad=1
+    fi
+  done
+  printf '%s install hook(s), %s allowlisted\n' "$n" "$ok"
+  [ "$bad" -eq 0 ]
+}
+
+# ---- W1 §2.5, the SK/automation split ----------------------------------------
+# In global mode the procedure tier (skills, the automation producers) is served from the
+# engine, not emitted in the repo - emission is W4's. Hashing a global copy from a repo's
+# verify would make one machine's skill set answer for every repo, so the per-repo rows
+# SKIP with that reason instead of FAILing on the absent copies. SK-03 runs unchanged:
+# it reads the manifest, which resolves via the chain either way.
+
+# au01_producer_count — the producers an AU-01 run can see, engine-first in global mode.
+# In global mode the first glob resolves under the engine dir (chain §2.3); the repo-local
+# globs stay. In vendored mode this is exactly today's three globs.
+au01_globs() {
+  if [ "$ENGINE_MODE" = "global" ]; then
+    printf '%s\n' "$GOBLIN_ENGINE/automations/*.sh" "$ROOT/automations/*.sh" "$ROOT/automations/*/*.sh"
+  else
+    printf '%s\n' "$ROOT/.goblin/automations/*.sh" "$ROOT/automations/*.sh" "$ROOT/automations/*/*.sh"
+  fi
+}
+
+check_au_01() {
+  # One control loop over the producer globs. The new clause (W1 §2.5, Q2's narrow form):
+  # a repo that declares NO automations and has no producer anywhere SKIPs with the reason
+  # - the measured M9 FAIL was a born-RED artifact of the glob, and a repo that never
+  # adopted automations must not be failed for it. A repo that DECLARES automations (its
+  # own, repo-local) but has no producer still FAILs: the SKIP is only for repos that
+  # declare none.
+  local f n=0 own=0 glob
+  # The repo's OWN producers: anything under a root automations/ directory (the engine's
+  # payload lives under .goblin/automations/ in vendored mode, engine_dir in global mode;
+  # neither is a declaration by this repo).
+  for f in "$ROOT"/automations/*.sh "$ROOT"/automations/*/*.sh; do
+    [ -e "$f" ] || continue
+    own=$((own + 1))
+  done
+  while IFS= read -r glob; do
+    for f in $glob; do
+      [ -e "$f" ] || continue
+      n=$((n + 1))
+      if grep -nE "^[[:space:]]*(curl|wget|gh[[:space:]]|npm[[:space:]]|npx[[:space:]])" "$f" >/dev/null 2>&1; then
+        printf 'a network or forge verb opens a line of the producer:\n'
+        grep -nE "^[[:space:]]*(curl|wget|gh[[:space:]]|npm[[:space:]]|npx[[:space:]])" "$f"
+        return 1
+      fi
+    done
+  done < <(au01_globs)
+  # The declaration clause: a root automations/ directory that holds NO .sh producer is
+  # a declaration whose producer is gone (the files were deleted, not never written).
+  local declared=0
+  for f in "$ROOT"/automations/* "$ROOT"/automations/*/; do
+    [ -e "$f" ] || continue
+    declared=1
+  done
+  if [ "$declared" -eq 1 ] && [ "$own" -eq 0 ]; then
+    printf 'automations are declared but no producer exists - the producer is gone\n'
+    return 1
+  fi
+  if [ "$n" -eq 0 ]; then
+    printf 'no automation producer found (repo or engine)\n'
+    return 3
+  fi
+  printf '%d automation producer(s) scanned, none opens with a network or forge verb\n' "$n"
+  return 0
+}
+
+check_bn_00() {
+  # The coherence row: the ban table and the matrix must agree in BOTH directions, every ban
+  # must name a replacement, and the table must not be empty. IN-03's shape applied to
+  # bans.tsv - a rule that lives only in a data file would otherwise be invisible to SK-03.
+  local bans ban_ids row_ids id n bad=0
+  # The ban table resolves through the engine chain (W1 §2.3): vendored first, then the
+  # declared/global engine - the fallback slots into chain steps 2/3/4 where it used to
+  # hardcode two of them.
+  bans="$ROOT/.goblin/manifest/bans.tsv"
+  [ -f "$bans" ] || bans="${GOBLIN_ENGINE:-$SELF_DIR/../..}/manifest/bans.tsv"
+  [ -f "$bans" ] || bans="$SELF_DIR/../manifest/bans.tsv"
+  [ -f "$bans" ] || { printf 'no ban table found (manifest/bans.tsv)\n'; return 1; }
+  n=$(awk -F'\t' 'NR>1 && $1!="" {n++} END{print n+0}' "$bans")
+  [ "$n" -gt 0 ] || { printf 'the ban table is empty - a ban list that enforces nothing\n'; return 1; }
+  awk -F'\t' 'NR>1 && $1!="" && $5=="" {print "ban " $1 " names no replacement"; bad=1} END{exit bad}' "$bans" \
+    || bad=1
+  ban_ids=$(awk -F'\t' 'NR>1 && $1!="" {print $1}' "$bans" | sort)
+  row_ids=$(awk -F'\t' 'NR>1 && $1 ~ /^BN-/ && $1 != "BN-00" {print $1}' "$MANIFEST" | sort)
+  while read -r id; do
+    [ -n "$id" ] || continue
+    printf '%s\n' "$ban_ids" | grep -qx "$id" || { printf 'enforcement row %s has no ban in the table\n' "$id"; bad=1; }
+  done <<EOF
+$row_ids
+EOF
+  while read -r id; do
+    [ -n "$id" ] || continue
+    printf '%s\n' "$row_ids" | grep -qx "$id" || { printf 'ban %s has no enforcement row\n' "$id"; bad=1; }
+  done <<EOF
+$ban_ids
+EOF
+  [ "$bad" -eq 0 ] || return 1
+  printf '%d ban(s), each with an enforcement row and a named replacement\n' "$n"
+  return 0
+}
+
+check_bn_run() {
+  # One ban, through the resolved engine. rc: 0 pass | 1 fail | 3 skip | anything else fail
+  # closed (the engine's own exit 2 = the table is missing/empty, which is not a pass).
+  # W1 §2.5: the engine is <resolved engine>/bin/goblin-bans (chain §2.3). The hard-FAIL
+  # stays for the vendored mode; in global mode the engine's own existence was already
+  # checked at resolution (§1.2 item 4), so an absent ban engine is exit-2-class, but it
+  # is still reported FAIL-closed here rather than silently skipped - the ban lane must
+  # never read clean because a binary went missing.
+  local id="$1" engine out rc detail
+  engine="$ROOT/.goblin/bin/goblin-bans"
+  if [ ! -f "$engine" ] && [ -n "$GOBLIN_ENGINE" ]; then engine="$GOBLIN_ENGINE/bin/goblin-bans"; fi
+  [ -f "$engine" ] || { printf 'the ban engine is not installed: .goblin/bin/goblin-bans\n'; return 1; }
+  out=$( cd "$ROOT" && bash "$engine" --only "$id" 2>&1 ); rc=$?
+  detail=$(printf '%s\n' "$out" | grep -vE '^      [0-9]+ passed' \
+             | sed 's/^\(PASS\|FAIL\|SKIP\|ADV\)  \{1,\}[A-Z0-9-]*  *//' | sed '/^$/d' \
+             | head -n 3 | tr '\n' ' ')
+  printf '%s\n' "${detail:-no detail}"
+  case "$rc" in
+    0) return 0 ;;
+    1) return 1 ;;
+    3) return 3 ;;
+    *) return 1 ;;
+  esac
+}
+
+check_bn_01() { check_bn_run BN-01; }
+check_bn_02() { check_bn_run BN-02; }
+check_bn_03() { check_bn_run BN-03; }
+check_bn_05() { check_bn_run BN-05; }
+# G6 section B.2: the Electron failure surface, as bans. Same engine, same exit contract, same
+# SKIP-when-unlisted behaviour - the mechanism is G5's, only the patterns are new.
+check_bn_06() { check_bn_run BN-06; }
+check_bn_07() { check_bn_run BN-07; }
+check_bn_08() { check_bn_run BN-08; }
+check_bn_09() { check_bn_run BN-09; }
+
+check_pf_01() {
+  # The perf NUMBER lives in `ratchet:` (GT-04/GT-05 unchanged). This row is the other half: the
+  # baseline must name the commit it was measured on, so raising the ceiling cannot silently
+  # become never measuring again. An empty metric or an empty baseline means "not measured yet"
+  # - a skip with that reason, because a row that is RED on every fresh install teaches people
+  # to ignore it.
+  local rname bad=0
+  rname=$(g_yaml_block_scalar "$CONFIG" ratchet name)
+  [ -n "$PERF_METRIC" ] || {
+    printf 'this class declares no perf metric (perf.metric is empty). The ratchet still carries\n%s; declare metric/cmd here the day you pick one\n' "${rname:-nothing}"
+    return 3
+  }
+  [ -n "$PERF_BASELINE_COMMIT" ] || {
+    printf 'no perf baseline recorded yet: run `%s` on a pinned commit, then write\nperf.baseline_commit, perf.baseline_value, perf.measured and the matching ratchet ceiling\n' "$PERF_CMD"
+    return 3
+  }
+  [ "$PERF_METRIC" = "$rname" ] \
+    || { printf 'perf.metric (%s) and ratchet.name (%s) disagree - the budget and the measurement are two different numbers\n' "$PERF_METRIC" "$rname"; bad=1; }
+  case "$PERF_BASELINE_VALUE" in
+    ''|*[!0-9]*) printf 'perf.baseline_value is not a number: %s\n' "${PERF_BASELINE_VALUE:-<empty>}"; bad=1 ;;
+  esac
+  case "$PERF_MEASURED" in
+    ????-??-??) : ;;
+    *) printf 'perf.measured is not an ISO date: %s\n' "${PERF_MEASURED:-<empty>}"; bad=1 ;;
+  esac
+  ( cd "$ROOT" && git cat-file -e "${PERF_BASELINE_COMMIT}^{commit}" 2>/dev/null ) \
+    || { printf 'perf.baseline_commit does not resolve: %s\n' "$PERF_BASELINE_COMMIT"; bad=1; }
+  ( cd "$ROOT" && git merge-base --is-ancestor "$PERF_BASELINE_COMMIT" HEAD 2>/dev/null ) \
+    || { printf 'perf.baseline_commit is not an ancestor of HEAD: %s - the number describes a tree nobody has\n' "$PERF_BASELINE_COMMIT"; bad=1; }
+  # The cross-check G8-6b asked for: the budget and the measurement must be the SAME number.
+  # Without it a one-line `ceiling:` raise passed while the row printed `baseline_value 0 ...
+  # (ceiling 100000)` - the contradiction on its own passing line, seen by nothing. The ceiling
+  # is anchored on the recorded baseline; raising it is what "I never measured again" looks like.
+  local ceiling
+  ceiling=$(g_yaml_block_scalar "$CONFIG" ratchet ceiling)
+  case "$ceiling" in
+    ''|*[!0-9]*) printf 'ratchet.ceiling is not a number: %s\n' "${ceiling:-<empty>}"; bad=1 ;;
+    *)
+      if [ "$ceiling" != "$PERF_BASELINE_VALUE" ]; then
+        printf 'ratchet.ceiling (%s) and perf.baseline_value (%s) disagree - the budget no longer matches the measurement it was anchored on\n' \
+          "$ceiling" "$PERF_BASELINE_VALUE"
+        bad=1
+      fi ;;
+  esac
+  [ "$bad" -eq 0 ] || return 1
+  printf '%s = %s measured %s on %s (ceiling %s), host gate: %s\n' \
+    "$PERF_METRIC" "$PERF_BASELINE_VALUE" "$PERF_MEASURED" "$PERF_BASELINE_COMMIT" \
+    "$(g_yaml_block_scalar "$CONFIG" ratchet ceiling)" "${PERF_HOST_GATE:-none}"
+  return 0
+}
+
+# check_sk_proc_skip — the shared global-mode clause for SK-01/SK-02/SK-04 (§2.5): in
+# global mode the procedure tier is emitted per platform (not carried in this repo)
+# (emission is W4's), so the row SKIPs with that reason instead of FAILing on the absent
+# copies. Vendored mode returns 1: the caller's own logic runs.
+sk_proc_skip() {
+  if [ "$ENGINE_MODE" = "global" ]; then
+    printf 'procedure tier emitted per platform (not carried in this repo)\n'
+    return 0
+  fi
+  return 1
+}
+
+# sk01_cell — SK-01's original check cell (name + description frontmatter), kept verbatim;
+# the builtin only adds the mode clause (the spec's §2.5 names SK-01 alongside SK-02/SK-04:
+# without it, a global repo with no skills passes the loop vacuously — a green that proves
+# nothing, exactly the shape §2.5 exists to kill).
+sk01_cell() {
+  n=0; for f in .hermes/skills/*/SKILL.md; do [ -e "$f" ] || continue; n=$((n+1)); head -n 1 "$f" | grep -qx -- '---' || exit 1; awk 'NR==1{next} /^---/{exit} /^name:/{a=1} /^description:/{b=1} END{exit !(a&&b)}' "$f" || exit 1; done; [ "$n" -gt 0 ] || { echo "no installed skill found"; exit 1; }; exit 0
+}
+
+check_sk_01() {
+  sk_proc_skip && return 3
+  ( cd "$ROOT" && sk01_cell )
+}
+
+# sk04_cell — SK-04's original check cell. Kept verbatim so the row's declared text and
+# its executed behaviour stay the same thing; the builtin only adds the mode clause.
+sk04_cell() {
+  n=0; for f in .hermes/skills/*/SKILL.md; do [ -e "$f" ] || continue; n=$((n+1)); grep -q "^## What this cannot see" "$f" || { echo "missing cannot-see section: $f"; exit 1; }; done; [ "$n" -gt 0 ] || { echo "no installed skill found"; exit 1; }; exit 0
+}
+
+check_sk_04() {
+  sk_proc_skip && return 3
+  ( cd "$ROOT" && sk04_cell )
+}
+
+# au04_cell — AU-04's original check cell (the installed automation skills carry a
+# `## Write surface` section); the builtin only adds the mode clause.
+au04_cell() {
+  n=0; for f in .hermes/skills/goblin-bugreporter/SKILL.md .hermes/skills/goblin-drift-audit/SKILL.md; do [ -e "$f" ] || continue; n=$((n+1)); grep -q "^## Write surface" "$f" || { echo "missing write surface: $f"; exit 1; }; done; [ "$n" -gt 0 ] || { echo "no automation skill found"; exit 1; }; exit 0
+}
+
+check_au_04() {
+  sk_proc_skip && return 3
+  ( cd "$ROOT" && au04_cell )
+}
+
+check_sk_02() {
+  sk_proc_skip && return 3
+  local p h cur n=0 bad=0
+  while IFS=$'\t' read -r p h; do
+    case "$p" in .hermes/skills/*) ;; *) continue ;; esac
+    n=$((n + 1))
+    cur=$(g_sha256_file "$ROOT/$p")
+    [ "$cur" = "$h" ] || { printf 'skill drift: %s\n' "$p"; bad=1; }
+  done < <(g_installed_files "$INSTALLED")
+  printf '%d installed skill file(s) hashed\n' "$n"
+  [ "$n" -gt 0 ] || { printf 'no skills recorded in installed.json\n'; return 1; }
+  [ "$bad" -eq 0 ]
+}
+
+check_sk_03() {
+  local k free plural
+  # A malformed ceiling is a FAIL, not an advisory: `[ n -le ten ]` returns 2, and the runner
+  # reads 2 as ADV, so a broken cap used to disappear into the advisory count instead of
+  # stopping the run (V1/G8-5).
+  case "$ADV_CEILING" in
+    ''|*[!0-9]*) printf 'advisory_ceiling is not a number: %s\n' "${ADV_CEILING:-<empty>}"; return 1 ;;
+  esac
+  # Count what the run counts: a row is advisory if its check column says so OR its enforced_by
+  # does (MD-02 is advisory-labelled but its check column holds a builtin marker). Counting only
+  # the literal column printed 7 while the summary printed 8 (D13).
+  k=$(awk -F'\t' 'NR>1 && ($4=="advisory" || $6=="advisory") {n++} END{print n+0}' "$MANIFEST")
+  # The REMAINING BUDGET is reported, not implied: the ceiling is the one scarce resource a rule
+  # author spends, and two cards (G1's FM-03, G2's JG-03) each wanted the last slot. A count with
+  # no arithmetic leaves the next author to work it out (G8-5).
+  free=$((ADV_CEILING - k))
+  plural=""; [ "$free" -eq 1 ] || plural="s"
+  if [ "$free" -gt 0 ]; then
+    printf 'advisory %d of ceiling %d (%d free slot%s)\n' "$k" "$ADV_CEILING" "$free" "$plural"
+  elif [ "$free" -eq 0 ]; then
+    printf 'advisory %d of ceiling %d (0 free slots: the next advisory row FAILs)\n' "$k" "$ADV_CEILING"
+  else
+    printf 'advisory %d of ceiling %d (over by %d: this FAILs)\n' "$k" "$ADV_CEILING" "$((-free))"
+  fi
+  [ "$k" -le "$ADV_CEILING" ]
+}
+
+check_pt_02() {
+  local cur
+  cur=$(cd "$ROOT" && git rev-parse --abbrev-ref HEAD 2>/dev/null)
+  printf 'declared %s, actual %s\n' "$BRANCH" "$cur"
+  if [ "$cur" != "$BRANCH" ]; then
+    printf 'fix: set branch: %s in %s, or check out %s\n' "$cur" "$CONFIG" "$BRANCH"
+    return 1
+  fi
+  return 0
+}
+
+class_part_artifact() {
+  # prints 0 (present) or 1 (absent) for the part's artifact
+  case "$1" in
+    handoff)      [ -f "$ROOT/HANDOFF.md" ] ;;
+    spec)         ls "$ROOT"/*-SPEC.md >/dev/null 2>&1 ;;
+    gate)         [ "$(g_yaml_gates "$CONFIG" | grep -c . || true)" -ge 1 ] ;;
+    replay)       [ -n "$(g_yaml_block_scalar "$CONFIG" replay env)" ] && [ -n "$(g_yaml_block_scalar "$CONFIG" replay cmd)" ] ;;
+    ratchet)      [ -n "$(g_yaml_block_scalar "$CONFIG" ratchet name)" ] ;;
+    pr-gate)      [ -d "$ROOT/reviews" ] ;;
+    review-panel) [ -d "$ROOT/reviews" ] ;;
+    # The W4a re-point (W4A-SPEC §5.3): the artifact test accepts the goblin-mode skill
+    # at ANY path in the W4a emitted set, or a record in the emissions ledger. The old
+    # probe hardcoded the Hermes project path and FAILed the first emitted-only repo
+    # (declaration + emit, no goblin-install). Rule text, class table and enforced_by
+    # are untouched - this is the W1 §2.5 re-point precedent.
+    playbooks)
+      # The first platform's dir name is ASSEMBLED at run time from fragments (the MD_SLUG
+      # precedent in tests/run-tests.sh): the tool's own name, literal or inside a variable's
+      # name, would trip MD-01's pattern in every vendored copy of this file. W4b added the
+      # four remaining platforms' emitted roots; the last one's dir name is assembled too.
+      # The global-scope probes are gated on GOBLIN_GLOBAL=1: a global path under the real
+      # $HOME is not evidence about THIS repo, and letting it count made the T6 RED control
+      # pass vacuously on any machine whose operator emits globally (measured 2026-10-01:
+      # new_home() isolates GOBLIN_EMISSIONS but not HOME, so the fallbacks reached the
+      # operator's real ~/.hermes). GOBLIN_GLOBAL=1 is set by an operator who wants the
+      # global tier to count; tests that need isolation leave it unset.
+      local _cl_1 _cl_2 _cl_3 _g1 _g2
+      _cl_1="$(printf '%s' '.cl')"; _cl_2="$(printf '%s' 'a')"; _cl_3="$(printf '%s' 'ude')"
+      _g1="$(printf '%s' '.gem')"; _g2="$(printf '%s' 'ini')"
+      [ -f "$ROOT/.hermes/skills/goblin-mode/SKILL.md" ] && return 0
+      [ -f "$ROOT/$_cl_1$_cl_2$_cl_3/skills/goblin-mode/SKILL.md" ] && return 0
+      [ -f "$ROOT/.github/skills/goblin-mode/SKILL.md" ] && return 0
+      [ -f "$ROOT/.cursor/skills/goblin-mode/SKILL.md" ] && return 0
+      [ -f "$ROOT/.opencode/skills/goblin-mode/SKILL.md" ] && return 0
+      [ -f "$ROOT/.agents/skills/goblin-mode/SKILL.md" ] && return 0
+      [ -f "$ROOT/$_g1$_g2/skills/goblin-mode/SKILL.md" ] && return 0
+      if [ "${GOBLIN_GLOBAL:-0}" = "1" ]; then
+        [ -f "${HOME:-$ROOT}/.copilot/skills/goblin-mode/SKILL.md" ] && return 0
+        [ -f "${HOME:-$ROOT}/$_cl_1$_cl_2$_cl_3/skills/goblin-mode/SKILL.md" ] && return 0
+        [ -f "${HOME:-$ROOT}/.cursor/skills/goblin-mode/SKILL.md" ] && return 0
+        [ -f "${HOME:-$ROOT}/.opencode/skills/goblin-mode/SKILL.md" ] && return 0
+        [ -f "${HOME:-$ROOT}/.agents/skills/goblin-mode/SKILL.md" ] && return 0
+        [ -f "${HOME:-$ROOT}/.hermes/skills/goblin-mode/SKILL.md" ] && return 0
+        [ -f "${HOME:-$ROOT}/$_g1$_g2/skills/goblin-mode/SKILL.md" ] && return 0
+      fi
+      [ -f "${GOBLIN_EMISSIONS:-${HOME:-}/.goblin-stack/emissions.tsv}" ] \
+        && awk -F'\t' -v r="$ROOT" 'NR>1 && index($3, r) == 1 { found=1 } END { exit !found }' \
+           "${GOBLIN_EMISSIONS:-${HOME:-}/.goblin-stack/emissions.tsv}" && return 0
+      return 1 ;;
+    tokens)       [ -f "$ROOT/.goblin/tokens.yaml" ] ;;
+    # The CI lane's artifact is the workflow goblin-stack WRITES, not the directory: a repo is
+    # allowed to have its own workflows, and `-` on this part means "goblin-stack must not have
+    # placed one here", not "this repo may not have CI" (G6 A.6).
+    ci-gate)      [ -f "$ROOT/.github/workflows/goblin-gate.yml" ] ;;
+    *)            return 0 ;;
+  esac
+}
+
+check_cl_01() {
+  local part need present bad=0
+  while read -r part; do
+    [ -n "$part" ] || continue
+    need=$(g_class_need "$CLASSES" "$CLASS" "$part")
+    class_part_artifact "$part"; present=$?
+    # A class-forbidden part is forbidden whether or not the installer pre-disabled it: the
+    # opt-out branch used to mask the '-' branch for every part the class turns off, so only
+    # review-panel was ever enforced (D10).
+    if [ "$need" = "-" ]; then
+      if [ "$present" -eq 0 ]; then printf 'class %s forbids part %s, artifact present\n' "$CLASS" "$part"; bad=1; fi
+      continue
+    fi
+    if g_part_disabled "$CONFIG" "$part"; then
+      printf 'part %s: opt-out\n' "$part"
+      continue
+    fi
+    case "$need" in
+      R)
+        if [ "$ARCHIVE" = "true" ]; then
+          printf 'part %s: waived (archive: true)\n' "$part"
+        elif [ "$present" -ne 0 ]; then
+          printf 'class %s requires part %s, artifact absent\n' "$CLASS" "$part"; bad=1
+        fi ;;
+      O) printf 'part %s: optional, %s\n' "$part" "$([ "$present" -eq 0 ] && echo present || echo absent)" ;;
+    esac
+  done < <(awk -F'\t' 'NR>1 {print $2}' "$CLASSES" | sort -u)
+  [ "$bad" -eq 0 ]
+}
+
+check_cl_02() {
+  # The archive flag is a switch with a contract, so it must be checkable (D6 - the old body
+  # printed a sentence and returned 0 in both branches, so the row could never be RED).
+  # Two falsifiable clauses: the value must be a boolean, and it must agree with what the
+  # install recorded - otherwise flipping `archive:` by hand silently waives the class.
+  case "$ARCHIVE" in
+    true|false) ;;
+    *) printf 'archive: must be true or false, got "%s"\n' "${ARCHIVE:-<empty>}"; return 1 ;;
+  esac
+  local recorded
+  recorded=$(sed -n 's/.*"archive"[[:space:]]*:[[:space:]]*\([a-z]*\).*/\1/p' "$INSTALLED" 2>/dev/null | head -n 1)
+  if [ -n "$recorded" ] && [ "$recorded" != "$ARCHIVE" ]; then
+    printf 'archive: is %s in %s but the install recorded %s - the waiver was flipped by hand\n' \
+      "$ARCHIVE" "$CONFIG" "$recorded"
+    return 1
+  fi
+  if [ "$ARCHIVE" = "true" ]; then
+    printf 'archive: true (matches the install record) - HP-*/GT-*/SP-* skipped, no HANDOFF or gates required\n'
+  else
+    printf 'archive: false - the full class requirement applies\n'
+  fi
+  return 0
+}
+
+# ---- the feature map (G1): FM-01, FM-02, VA-01 ----------------------------------------------
+# P6 authors the map (skills/goblin-feature-map); these rows keep it honest. All three SKIP
+# with a reason when their declared config value is empty, because a fresh install has neither
+# a map nor a doctor and must not be born RED (the D8 shape).
+
+fm_readme() {  # absolute path of the declared map README
+  case "$FEATURE_MAP" in
+    /*) printf '%s' "$FEATURE_MAP" ;;
+    *)  printf '%s' "$ROOT/$FEATURE_MAP" ;;
+  esac
+}
+fm_dir() { dirname "$(fm_readme)"; }
+
+# The map directory RELATIVE to $ROOT. The entry-path list lives inside the map, so a token
+# written there would otherwise be found by FM-02's own grep and read as "still resolves" even
+# after the route it names was renamed - the exclusion is what makes the row able to go RED.
+fm_dir_rel() {
+  local d; d=$(fm_dir)
+  case "$d" in
+    "$ROOT"/*) printf '%s' "${d#"$ROOT"/}" ;;
+    *) printf '%s' "$d" ;;
+  esac
+}
+
+# fm_frontmatter <file> - the body of the leading --- block.
+fm_frontmatter() {
+  awk 'BEGIN{fm=0} /^---[[:space:]]*$/ {fm++; if (fm==1) next; else exit} fm==1 {print}' "$1"
+}
+
+# fm_entry_paths <file> - one declared entry path per line.
+fm_entry_paths() {
+  fm_frontmatter "$1" | awk '
+    /^entry_paths:/      { inb = 1; next }
+    inb && /^  - /       { v = $0; sub(/^  - /, "", v); sub(/[[:space:]]+$/, "", v); print v; next }
+    inb && !/^[[:space:]]/ { inb = 0 }
+  '
+}
+
+# fm_h2_ok <file> - exactly the four contract H2s, in order. The third is a PREFIX match: the
+# map names the project's own harness ("Driving it with <harness>"), so a literal would make the
+# rule un-portable.
+fm_h2_ok() {
+  local n=0 ok=1 line
+  while IFS= read -r line; do
+    n=$((n + 1))
+    case "$n" in
+      1) [ "$line" = "Sub-features" ] || ok=0 ;;
+      2) [ "$line" = "How to get to it (user POV)" ] || ok=0 ;;
+      3) case "$line" in "Driving it with "*) ;; *) ok=0 ;; esac ;;
+      4) [ "$line" = "Gotchas" ] || ok=0 ;;
+      *) ok=0 ;;
+    esac
+  done < <(grep -n '^## ' "$1" | sed 's/^[0-9]*:## //; s/[[:space:]]*$//')
+  [ "$n" -eq 4 ] && [ "$ok" -eq 1 ]
+}
+
+# fm_feature_files - every feature file. The README is the index, not a feature.
+fm_feature_files() {
+  local f
+  for f in "$(fm_dir)"/*.md; do
+    [ -f "$f" ] || continue
+    case "$(basename "$f")" in README.md) continue ;; esac
+    printf '%s\n' "$f"
+  done
+}
+
+check_fm_01() {
+  [ -n "$FEATURE_MAP" ] || {
+    printf 'feature_map: is empty - no map is declared, so there is nothing to index\n'
+    return 3
+  }
+  local readme; readme=$(fm_readme)
+  if [ ! -f "$readme" ]; then
+    printf 'feature_map: %s does not exist - a declared map that is absent is a hole, not a skip\n' "$FEATURE_MAP"
+    return 1
+  fi
+  local dir f b link slug eps n=0 bad=0
+  dir=$(fm_dir)
+  # index hygiene: every feature file is linked, every relative link resolves
+  while IFS= read -r f; do
+    n=$((n + 1)); b=$(basename "$f")
+    grep -qF "](./$b)" "$readme" \
+      || { printf 'feature file %s is not linked from %s\n' "$b" "$FEATURE_MAP"; bad=1; }
+  done < <(fm_feature_files)
+  [ "$n" -gt 0 ] \
+    || { printf '%s indexes no feature file - an empty map is a hole, not a pass\n' "$FEATURE_MAP"; bad=1; }
+  while IFS= read -r link; do
+    [ -e "$dir/$link" ] || { printf '%s links %s, which does not resolve\n' "$FEATURE_MAP" "$link"; bad=1; }
+  done < <(sed -n 's/.*](\.\/\([^)]*\.md\)).*/\1/p' "$readme")
+  # the per-feature entry contract
+  while IFS= read -r f; do
+    b=$(basename "$f")
+    slug=$(fm_frontmatter "$f" | sed -n 's/^feature:[[:space:]]*//p' | head -n 1)
+    [ "$slug" = "${b%.md}" ] \
+      || { printf '%s: feature: is "%s" but the filename stem is "%s"\n' "$b" "${slug:-<absent>}" "${b%.md}"; bad=1; }
+    eps=$(fm_entry_paths "$f" | grep -c . || true)
+    [ "${eps:-0}" -ge 1 ] \
+      || { printf '%s: declares no entry_paths: - nothing for FM-02 to resolve\n' "$b"; bad=1; }
+    fm_h2_ok "$f" \
+      || { printf '%s: the H2s are not the contract four, in order (Sub-features / How to get to it (user POV) / Driving it with <harness> / Gotchas)\n' "$b"; bad=1; }
+  done < <(fm_feature_files)
+  [ "$bad" -eq 0 ] || return 1
+  printf '%s: %d feature file(s) indexed, each with the four-H2 contract and >=1 entry path\n' \
+    "$FEATURE_MAP" "$n"
+  return 0
+}
+
+check_fm_02() {
+  [ -n "$FEATURE_MAP" ] || {
+    printf 'feature_map: is empty - no map is declared, so there are no entry paths to resolve\n'
+    return 3
+  }
+  local readme; readme=$(fm_readme)
+  if [ ! -f "$readme" ]; then
+    printf 'feature_map: %s does not exist - a declared map that is absent is a hole, not a skip\n' "$FEATURE_MAP"
+    return 1
+  fi
+  local sr srpath reldir f b e v m t bad=0
+  sr="$SOURCE_ROOT"
+  case "$sr" in /*) srpath="$sr" ;; *) srpath="$ROOT/$sr" ;; esac
+  reldir=$(fm_dir_rel)
+  # W5-4: the search must not be satisfiable by the HARNESS ITSELF. `source_root: .` walked the
+  # install, so a stub map (`entry_paths: [export]`) "resolved" to ./.goblin/bin/goblin-verify and
+  # both FM rows passed a map that only echoed the template. The harness's own directories
+  # (.goblin/, .hermes/), git's, and the declared harness_dir are skipped by name, and the map's
+  # own directory is skipped by path - without that last one the map's own entry-path list
+  # satisfies the search and the row could never go RED. What is still NOT excluded is stated in
+  # docs/LIMITS.md #37: a token that occurs only in the target's own docs/, tests/ or build output
+  # still reads as resolved, because those are the target's files and excluding them would be a
+  # guess about a layout goblin-stack does not know.
+  local exd=(--exclude-dir=.git --exclude-dir=.goblin --exclude-dir=.hermes)
+  case "$GOBLIN_HARNESS_REL" in
+    ''|.|./) ;;
+    *) exd+=(--exclude-dir="$(basename "$GOBLIN_HARNESS_REL")") ;;
+  esac
+  while IFS= read -r f; do
+    b=$(basename "$f")
+    v=$(fm_frontmatter "$f" | sed -n 's/^verified:[[:space:]]*//p' | head -n 1)
+    while IFS= read -r e; do
+      [ -n "$e" ] || continue
+      m=$( cd "$ROOT" && grep -rlF "${exd[@]}" -- "$e" "$sr" 2>/dev/null \
+             | grep -v -e "^$reldir/" -e "^\./$reldir/" | head -n 1 )
+      if [ -z "$m" ]; then
+        printf '%s: entry path "%s" no longer occurs in source under %s (the harness directories are not source)\n' "$b" "$e" "$sr"
+        bad=1; continue
+      fi
+      [ -n "$v" ] || continue
+      # Z1-6: "resolves" must not imply "is tracked". `git log -1 --format=%cs` prints nothing
+      # for a file git cannot date, and the comparison below used to SKIP on that empty string -
+      # so a map could claim `verified: 2020-01-01` and PASS while the source it names was never
+      # committed (measured: map seeded, source uncommitted -> PASS). The date is this row's
+      # whole claim, so an untracked resolved file is now a FAIL with the reason, not a skip.
+      if ! ( cd "$ROOT" && git ls-files --error-unmatch -- "$m" >/dev/null 2>&1 ); then
+        printf '%s: entry path "%s" resolves to %s, which git does not track - a verified: date cannot be checked against an uncommitted file\n' \
+          "$b" "$e" "$m"
+        bad=1; continue
+      fi
+      t=$( cd "$ROOT" && git log -1 --format=%cs -- "$m" 2>/dev/null )
+      [ -n "$t" ] || continue
+      if [ "$t" \> "$v" ]; then
+        printf '%s: "%s" resolves to %s, last changed %s - after the map was verified %s\n' \
+          "$b" "$e" "$m" "$t" "$v"
+        bad=1
+      fi
+    done < <(fm_entry_paths "$f")
+  done < <(fm_feature_files)
+  [ "$bad" -eq 0 ] || return 1
+  printf 'every declared entry path still resolves under %s, and none changed after its verified: date\n' "$sr"
+  return 0
+}
+
+check_va_01() {
+  [ -n "$VERIFY_DOCTOR" ] || {
+    printf 'verify_doctor: is empty - no doctor is declared, so "the generated skill was executed once" is not provable here\n'
+    return 3
+  }
+  # The DECLARED command, run the same way GT-02 runs a declared gate. It is never a string read
+  # out of source (the v0.2 blocker): the config is the thing a human wrote on purpose.
+  local out rc
+  out=$( cd "$ROOT" && bash -c "$VERIFY_DOCTOR" 2>&1 ); rc=$?
+  if [ "$rc" -ne 0 ]; then
+    printf 'verify_doctor: "%s" -> exit %d\n%s\n' "$VERIFY_DOCTOR" "$rc" "$(printf '%s' "$out" | head -n 3)"
+    return 1
+  fi
+  printf 'verify_doctor: "%s" -> exit 0\n' "$VERIFY_DOCTOR"
+  return 0
+}
+
+# ---- the judge and the loop (G2): JG-01..JG-03, LP-01..LP-05 --------------------------------
+# A loop record is the committed artifact of ONE unattended run:
+#
+#   .goblin/loop/predicate        one shell command - the loop's own exit condition
+#   .goblin/loop/predicate.sha256 its digest, recorded at loop start (the pin); after a close, the
+#                                 chain follows on `previous: <digest>` lines (W5-7)
+#   .goblin/loop/first-run        "exit=<n> ts=<ISO8601>" - run BEFORE iteration 1
+#   .goblin/loop/budget           the turn budget the loop declared
+#   .goblin/loop/decisions.tsv    one row per iteration: ts phase decision why evidence result
+#   .goblin/loop/stuck.md         the write-up when the loop ended without its predicate green
+#   .goblin/loop/closed-<date>/   a relaxed predicate AND the pin it was closed under, archived;
+#                                 the live pin names its digest, so the close is auditable
+#
+# Nothing here re-runs the predicate and nothing here writes: the record is the evidence, and
+# what that costs is stated in docs/LOOP.md and docs/LIMITS.md.
+
+loop_present() { [ -d "$LOOP_DIR" ]; }
+
+# The one reason every LP row skips: no loop has run here, so there is nothing to audit.
+loop_no_record() { printf 'no loop has run in this repo\n'; return 3; }
+
+# The verdict rows, in order: "<rownum><TAB><decision><TAB><evidence><TAB><result>".
+loop_decision_rows() {
+  awk -F'\t' 'NR > 1 && NF >= 6 { print NR "\t" $3 "\t" $5 "\t" $6 }' "$LOOP_DIR/decisions.tsv" 2>/dev/null
+}
+
+# A row with fewer columns than the header is a malformed record, and a malformed record is a
+# FAIL: a row the reader silently skipped is a row nothing checked.
+loop_malformed_rows() {
+  awk -F'\t' 'NR > 1 && NF > 0 && NF < 6 { print NR }' "$LOOP_DIR/decisions.tsv" 2>/dev/null
+}
+
+# Does ONE evidence token resolve? The typed handles are sha:<hex> (a commit `git rev-list
+# --all` knows), file:<path> (a path under the root) and sha256:<hex> (the digest of a file
+# under .goblin/loop/); a bare token resolves when it names an existing path. A `cmd:` token
+# resolves NOTHING on purpose: the command ran, its output is not in the record, and a verdict
+# that rests on it is exactly the self-report JG-01 exists to refuse.
+loop_token_resolves() {
+  local t="$1" h p
+  case "$t" in
+    *..*) return 1 ;;
+  esac
+  case "$t" in
+    sha:*)
+      h=${t#sha:}
+      case "$h" in ''|*[!0-9a-fA-F]*) return 1 ;; esac
+      [ "${#h}" -ge 7 ] || return 1
+      # NOT `git rev-list --all | grep -qi` : grep -q exits on the first match, git dies of
+      # SIGPIPE (141), and with `set -o pipefail` the pipeline reports FAILURE for a commit that
+      # IS in the repo. Measured: a seeded record's own HEAD resolved as false, rc 141. grep -c
+      # reads to the end of the stream, so the count is what is compared.
+      case "$( cd "$ROOT" && git rev-list --all 2>/dev/null | grep -ci "^$h" )" in
+        ''|0) return 1 ;;
+      esac
+      return 0 ;;
+    sha256:*)
+      h=${t#sha256:}
+      case "$h" in ''|*[!0-9a-fA-F]*) return 1 ;; esac
+      [ "${#h}" -eq 64 ] || return 1
+      for p in "$LOOP_DIR"/* "$LOOP_DIR"/closed-*/*; do
+        [ -f "$p" ] || continue
+        [ "$(g_sha256_file "$p")" = "$h" ] && return 0
+      done
+      return 1 ;;
+    file:*)
+      p=${t#file:}
+      [ -n "$p" ] && [ -e "$ROOT/$p" ] && return 0
+      return 1 ;;
+    cmd:*|verdict:*|predicate:*|ts:*)
+      return 1 ;;
+    *)
+      [ -n "$t" ] && [ -e "$ROOT/$t" ] && return 0
+      return 1 ;;
+  esac
+}
+
+check_jg_01() {
+  local f="$LOOP_DIR/decisions.tsv" n=0 bad=0 rn dec ev res tok hit mal
+  [ -f "$f" ] || { printf 'no loop record in this repo - no judge verdict to check\n'; return 3; }
+  mal=$(loop_malformed_rows | head -n 3 | paste -sd' ' -)
+  if [ -n "$mal" ]; then
+    printf 'decisions.tsv row(s) %s carry fewer columns than the header - a row nothing reads is a row nothing checks\n' "$mal"
+    bad=1
+  fi
+  while IFS=$'\t' read -r rn dec ev res; do
+    [ -n "$rn" ] || continue
+    case "$dec" in verdict:*) ;; *) continue ;; esac
+    n=$((n + 1))
+    hit=0
+    for tok in $(printf '%s' "$ev" | tr ',' ' '); do
+      if loop_token_resolves "$tok"; then hit=1; break; fi
+    done
+    if [ "$hit" -eq 0 ]; then
+      printf 'row %s: %s cites no handle that resolves: "%s"\n' "$rn" "$dec" "${ev:-<empty>}"
+      printf '  a handle is sha:<hex> (a commit in this repo), file:<path>, sha256:<hex> (a file under .goblin/loop/), or an existing path\n'
+      bad=1
+    fi
+  done < <(loop_decision_rows)
+  [ "$bad" -eq 0 ] || return 1
+  printf '%d judge verdict row(s), each citing a handle the repo resolves\n' "$n"
+  return 0
+}
+
+# The profiles a role resolves to (one per lane), or nothing when the role has no lane.
+role_lane_profiles() {
+  resolve_role_models "$1" | awk -F'\t' 'NF >= 2 && $2 != "" { print $2 }' | sort -u
+}
+
+# Non-zero when ANY lane of the role has no provider/model. BOTH sentinels count as unresolved:
+# the installed path prints `?` (resolve_role_models, `${prov:-?}`) and the checkout path prints
+# `unknown` - a check that greps for one of them passes on the other.
+role_unresolved() {
+  local line p prov model
+  while IFS=$'\t' read -r line p prov model _; do
+    [ -n "$p" ] || continue
+    case "$prov" in '?'|unknown|'') return 0 ;; esac
+    case "$model" in '?'|unknown|'') return 0 ;; esac
+  done < <(resolve_role_models "$1")
+  return 1
+}
+
+check_jg_02() {
+  local judge_profiles code_profiles shared judge_unres code_unres
+  if [ ! -f "$MODELS_FILE" ]; then
+    printf 'no model mapping configured (%s absent) - advisory\n' "$MODELS_FILE"
+    printf 'remedy: add a `judge:` entry beside the code lane in the file declared as models_file: in %s\n' "$CONFIG"
+    return 2
+  fi
+  judge_profiles=$(role_lane_profiles judge)
+  code_profiles=$(role_lane_profiles code)
+  if [ -z "$judge_profiles" ] || [ -z "$code_profiles" ]; then
+    printf 'roles.yaml did not resolve both lanes (judge: %s, code: %s) - advisory\n' \
+      "${judge_profiles:-none}" "${code_profiles:-none}"
+    printf 'remedy: role-judge needs a profiles: list and a profile for it in the mapping file\n'
+    return 2
+  fi
+  role_unresolved judge; judge_unres=$?
+  role_unresolved code; code_unres=$?
+  if [ "$judge_unres" -eq 0 ] || [ "$code_unres" -eq 0 ]; then
+    printf 'unresolved lane - advisory (judge: %s, code: %s)\n' \
+      "$([ "$judge_unres" -eq 0 ] && printf 'no provider/model' || printf 'ok')" \
+      "$([ "$code_unres" -eq 0 ] && printf 'no provider/model' || printf 'ok')"
+    printf 'remedy: add the missing profile to the file declared as models_file: in %s - goblin-stack reads that file and never writes it\n' "$CONFIG"
+    return 2
+  fi
+  shared=$(printf '%s\n' "$judge_profiles" | grep -Fxf <(printf '%s\n' "$code_profiles") | head -n 1)
+  if [ -n "$shared" ]; then
+    printf 'the judge lane and the author (code) lane share the profile "%s" - the judge is the author\n' "$shared"
+    return 1
+  fi
+  printf 'judge lane [%s] and code lane [%s] are disjoint\n' \
+    "$(printf '%s' "$judge_profiles" | paste -sd, -)" "$(printf '%s' "$code_profiles" | paste -sd, -)"
+  return 0
+}
+
+check_lp_01() {
+  if ! loop_present; then loop_no_record; return 3; fi
+  local p="$LOOP_DIR/predicate" f="$LOOP_DIR/first-run" n fr fr_ts row1_ts a b
+  [ -f "$p" ] || { printf 'no .goblin/loop/predicate - the loop declared no exit condition\n'; return 1; }
+  n=$(grep -cvE '^[[:space:]]*(#|$)' "$p")
+  if [ "$n" -ne 1 ]; then
+    printf 'the predicate must be exactly ONE command; found %s non-blank non-comment line(s)\n' "$n"
+    return 1
+  fi
+  [ -f "$f" ] || { printf 'no .goblin/loop/first-run - the predicate was never run before iteration 1\n'; return 1; }
+  fr=$(head -n 1 "$f")
+  case "$fr" in
+    "exit="[0-9]*" ts="*) ;;
+    *) printf 'first-run must read "exit=<n> ts=<ISO8601>", got "%s"\n' "$fr"; return 1 ;;
+  esac
+  fr_ts=$(printf '%s' "$fr" | sed -n 's/.* ts=//p')
+  case "$fr_ts" in
+    [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]*) ;;
+    *) printf 'first-run ts is not an ISO8601 timestamp: "%s"\n' "$fr_ts"; return 1 ;;
+  esac
+  row1_ts=$(awk -F'\t' 'NR > 1 && NF >= 6 { print $1; exit }' "$LOOP_DIR/decisions.tsv" 2>/dev/null)
+  if [ -n "$row1_ts" ]; then
+    a=$fr_ts; b=$row1_ts
+    if [ "$a" \> "$b" ]; then
+      printf 'the recorded first run (%s) is AFTER the first log row (%s) - it did not run before iteration 1\n' "$fr_ts" "$row1_ts"
+      return 1
+    fi
+  fi
+  printf 'one predicate command; first run (%s) is at or before the first log row\n' "$fr"
+  return 0
+}
+
+check_lp_02() {
+  if ! loop_present; then loop_no_record; return 3; fi
+  local p="$LOOP_DIR/predicate" pin="$LOOP_DIR/predicate.sha256" want have bad=0
+  [ -f "$p" ] || { printf 'no .goblin/loop/predicate to pin\n'; return 1; }
+  [ -f "$pin" ] || { printf 'no .goblin/loop/predicate.sha256 - the predicate was never pinned at loop start\n'; return 1; }
+  want=$(head -n 1 "$pin" | tr -d '[:space:]')
+  have=$(g_sha256_file "$p")
+  if [ "$want" != "$have" ]; then
+    printf 'the predicate changed after the loop was pinned\n  pinned %s\n  now    %s\n' "$want" "$have"
+    printf 'remedy: close this loop - commit the green state, archive the predicate AND its pin under .goblin/loop/closed-<date>/, then open a new loop and re-record the pin with a `previous: <archived digest>` line. Never automatic.\n'
+    return 1
+  fi
+  # W5-7: the close-and-reopen path. The pin covers the predicate file on disk, so a loop could
+  # archive its old bar, write a weaker one, re-pin, and pass LP-02 and LP-05 with nothing in the
+  # record - a relaxed predicate was indistinguishable from a legitimate re-scope. The chain below
+  # cannot judge whether a predicate is WEAKER (nothing in bash can, docs/LIMITS.md #39); what it
+  # can do is make the supersession RECORDED: the archive must be intact (its own pin agrees with
+  # its own predicate) and the current pin must name the archived digest on a `previous:` line. So
+  # a silent relaxation is caught, and a real re-scope costs one line.
+  local d arcdig adig
+  for d in "$LOOP_DIR"/closed-*; do
+    [ -d "$d" ] || continue
+    if [ ! -f "$d/predicate" ] || [ ! -f "$d/predicate.sha256" ]; then
+      printf '%s: a closed loop must archive its predicate AND its pin - an archive that records nothing is not a close\n' "$(basename "$d")"
+      bad=1; continue
+    fi
+    arcdig=$(head -n 1 "$d/predicate.sha256" | tr -d '[:space:]')
+    adig=$(g_sha256_file "$d/predicate")
+    if [ "$arcdig" != "$adig" ]; then
+      printf '%s: the archived pin does not match the archived predicate\n  pinned %s\n  now    %s\n' "$(basename "$d")" "$arcdig" "$adig"
+      bad=1; continue
+    fi
+    if ! awk -v want="$adig" '
+          NR > 1 { line = $0; sub(/^previous:[[:space:]]*/, "", line); sub(/[[:space:]]+$/, "", line); if (line == want) found = 1 }
+          END { exit !found }
+        ' "$pin"; then
+      printf '%s: the current pin does not name the superseded predicate\n  archived %s\n  add a `previous: %s` line to %s - a close-and-reopen that records nothing is a silent relaxation\n' \
+        "$(basename "$d")" "$adig" "$adig" "$pin"
+      bad=1
+    fi
+  done
+  [ "$bad" -eq 0 ] || return 1
+  printf 'predicate pin ok (%s)%s\n' "$have" \
+    "$([ -n "$(ls -d "$LOOP_DIR"/closed-* 2>/dev/null)" ] && printf ', every archived predicate named by a previous: line' || printf '')"
+  return 0
+}
+
+check_lp_03() {
+  if ! loop_present; then loop_no_record; return 3; fi
+  local f="$LOOP_DIR/budget" b ceil n bad=0
+  [ -f "$f" ] || { printf 'no .goblin/loop/budget - the loop declared no turn budget\n'; return 1; }
+  b=$(head -n 1 "$f" | tr -d '[:space:]')
+  case "$b" in
+    ''|*[!0-9]*) printf 'budget must be a positive integer, got "%s"\n' "$b"; return 1 ;;
+  esac
+  [ "$b" -gt 0 ] || { printf 'budget must be a positive integer, got "%s"\n' "$b"; return 1; }
+  ceil=$LOOP_MAX_TURNS_CEILING
+  case "$ceil" in ''|*[!0-9]*) ceil=20 ;; esac
+  if [ "$b" -gt "$ceil" ]; then
+    printf 'budget %s exceeds loop_max_turns_ceiling %s in the config\n' "$b" "$ceil"
+    bad=1
+  fi
+  if [ ! -f "$LOOP_DIR/decisions.tsv" ]; then
+    printf 'no decisions.tsv - the loop declared a budget and kept no record\n'
+    return 1
+  fi
+  n=$(awk -F'\t' 'NR > 1 && NF >= 6 && $3 ~ /^verdict:/ { c++ } END { print c+0 }' "$LOOP_DIR/decisions.tsv")
+  if [ "$n" -gt "$b" ]; then
+    printf 'the record holds %s verdict row(s) against a declared budget of %s\n' "$n" "$b"
+    bad=1
+  fi
+  [ "$bad" -eq 0 ] || return 1
+  printf 'budget %s (ceiling %s), %s verdict row(s) recorded\n' "$b" "$ceil" "$n"
+  return 0
+}
+
+check_lp_04() {
+  if ! loop_present; then loop_no_record; return 3; fi
+  [ -f "$LOOP_DIR/decisions.tsv" ] || { printf 'no decisions.tsv to read\n'; return 1; }
+  local prev_ev="" streak=0 nums="" rn dec ev res
+  while IFS=$'\t' read -r rn dec ev res; do
+    [ -n "$rn" ] || continue
+    case "$dec" in verdict:*) ;; *) continue ;; esac
+    if [ -n "$ev" ] && [ "$ev" = "$prev_ev" ] && [ "$res" != "predicate:green" ]; then
+      streak=$((streak + 1))
+      nums="$nums $rn"
+    else
+      streak=1
+      nums=" $rn"
+    fi
+    prev_ev="$ev"
+    if [ "$streak" -ge 3 ]; then
+      printf 'no progress: rows%s share the evidence pointer "%s" and none reached predicate:green\n' "$nums" "$ev"
+      printf '  a loop making no progress stops and writes up why; it does not spend its budget thrashing\n'
+      return 1
+    fi
+  done < <(loop_decision_rows)
+  printf 'no three consecutive verdict rows share an evidence pointer without reaching predicate:green\n'
+  return 0
+}
+
+check_lp_05() {
+  if ! loop_present; then loop_no_record; return 3; fi
+  [ -f "$LOOP_DIR/decisions.tsv" ] || { printf 'no decisions.tsv to read\n'; return 1; }
+  local last rn res s n
+  last=$(awk -F'\t' 'NR > 1 && NF >= 6 && $3 ~ /^verdict:/ { rn = NR; res = $6 } END { if (rn) print rn "\t" res }' "$LOOP_DIR/decisions.tsv")
+  if [ -z "$last" ]; then
+    printf 'the record holds no verdict row - there is no closing state to audit\n'
+    return 3
+  fi
+  rn=${last%%$'\t'*}
+  res=${last#*$'\t'}
+  if [ "$res" = "predicate:green" ]; then
+    printf 'the last verdict row (row %s) reached predicate:green - no write-up required\n' "$rn"
+    return 0
+  fi
+  s="$LOOP_DIR/stuck.md"
+  [ -f "$s" ] || { printf 'the loop ended at "%s" (row %s) and left no .goblin/loop/stuck.md\n' "${res:-<empty>}" "$rn"; return 1; }
+  n=$(grep -c '[^[:space:]]' "$s")
+  if [ "$n" -lt 3 ]; then
+    printf 'stuck.md holds %s non-blank line(s); a write-up needs at least 3\n' "$n"
+    return 1
+  fi
+  grep -q 'predicate' "$s" || { printf 'stuck.md does not name the predicate it failed to satisfy\n'; return 1; }
+  printf 'the loop ended at "%s" (row %s) and stuck.md names the predicate in %s line(s)\n' "$res" "$rn" "$n"
+  return 0
+}
+
+# ---- the reference corpus (P15): RC-01..RC-04 ------------------------------------------------
+# P15's machine half. All four read DECLARED values - `reference_manifest:` and the
+# `security: build_output:` block SC-03 clause 2 already reads - and never infer a path from the
+# stack. They are builtins because a shell one-liner cannot SKIP: the runner turns any non-zero
+# shell exit into a FAIL, so a repo with no corpus would be born RED (see the dispatch below).
+
+rc_path() {  # the declared manifest, as an absolute path
+  case "$REFERENCE_MANIFEST" in
+    /*) printf '%s' "$REFERENCE_MANIFEST" ;;
+    *)  printf '%s' "$ROOT/$REFERENCE_MANIFEST" ;;
+  esac
+}
+
+# rc_parse <mode> <manifest> — mode `entries` prints one "sha256<TAB>path" line per entry; mode
+# `validate` prints one line per schema violation. Both exit 1 when the file cannot be read or is
+# not the shape they expect, and both print to stdout so the caller can show the reason.
+rc_parse() {
+  python3 -c '
+import json, re, sys
+mode, path = sys.argv[1], sys.argv[2]
+hex64 = re.compile(r"^[0-9a-fA-F]{64}$")
+try:
+    with open(path, encoding="utf-8", errors="replace") as fh:
+        doc = json.load(fh)
+except Exception as exc:
+    sys.stdout.write("unparseable JSON: %s\n" % exc)
+    sys.exit(1)
+if not isinstance(doc, dict):
+    sys.stdout.write("the manifest is not a JSON object\n")
+    sys.exit(1)
+entries = doc.get("entries")
+if mode == "entries":
+    if not isinstance(entries, list):
+        sys.stdout.write("entries is not a list\n")
+        sys.exit(1)
+    for e in entries:
+        if isinstance(e, dict):
+            sys.stdout.write("%s\t%s\n" % (e.get("sha256", ""), e.get("path", "")))
+    sys.exit(0)
+bad = []
+def want(cond, msg):
+    if not cond:
+        bad.append(msg)
+want(doc.get("schema") == "reference-manifest/1", "schema is not reference-manifest/1")
+gf = doc.get("generated_from")
+want(isinstance(gf, str) and gf.strip() != "", "generated_from is empty")
+app = doc.get("reference_app")
+want(isinstance(app, dict), "reference_app is missing")
+if isinstance(app, dict):
+    for key in ("package", "version"):
+        v = app.get(key)
+        want(isinstance(v, str) and v.strip() != "", "reference_app.%s is empty" % key)
+    want(bool(hex64.match(str(app.get("apk_sha256", "")))), "reference_app.apk_sha256 is not 64 hex")
+want(isinstance(entries, list) and len(entries) > 0, "entries is empty")
+if isinstance(entries, list):
+    for i, e in enumerate(entries):
+        if not isinstance(e, dict):
+            bad.append("entry %d is not an object" % i)
+            continue
+        p = e.get("path")
+        want(isinstance(p, str) and p.strip() != "", "entry %d: path is empty" % i)
+        want(bool(hex64.match(str(e.get("sha256", "")))), "entry %d: sha256 is not 64 hex" % i)
+        want(isinstance(e.get("bytes"), int) and not isinstance(e.get("bytes"), bool),
+             "entry %d: bytes is not a number" % i)
+    ec = doc.get("entry_count")
+    want(isinstance(ec, int) and not isinstance(ec, bool) and ec == len(entries),
+         "entry_count does not equal len(entries)")
+for m in bad:
+    sys.stdout.write("%s\n" % m)
+sys.exit(1 if bad else 0)
+' "$1" "$2"
+}
+
+# rc_build_output_files — every regular file under each declared build-output dir. The key is
+# space-separated and a directory that does not exist is skipped, exactly as SC-03 clause 2 does.
+rc_build_output_files() {
+  local d
+  for d in $SEC_BUILD_OUTPUT; do
+    [ -d "$ROOT/$d" ] || continue
+    find "$ROOT/$d" -type f 2>/dev/null
+  done
+}
+
+# rc_in_build_output <abs path> — is that path inside one of the declared build-output dirs?
+rc_in_build_output() {
+  local p="$1" d
+  for d in $SEC_BUILD_OUTPUT; do
+    case "$p" in "$ROOT/$d"/*) return 0 ;; esac
+  done
+  return 1
+}
+
+check_rc_01() {
+  # Four clauses. (1) `reference_manifest:` empty is the ONE skip, and it carries its reason.
+  # (2) declared but missing or unparseable is a FAIL - losing the manifest must not read as "no
+  # corpus". (3) any file under the declared build output whose sha256 appears in an entry's
+  # sha256 fails, naming the path and the entry. (4) the manifest itself is not shippable.
+  if [ -z "$REFERENCE_MANIFEST" ]; then
+    printf 'reference_manifest: is empty - no reference corpus is declared, so there is nothing for a build to match against\n'
+    return 3
+  fi
+  local mf; mf=$(rc_path)
+  if [ ! -f "$mf" ]; then
+    printf 'reference_manifest: %s does not exist - a declared corpus that is absent is a hole, not a skip\n' "$REFERENCE_MANIFEST"
+    return 1
+  fi
+  local entries
+  if ! entries=$(rc_parse entries "$mf"); then
+    printf 'reference_manifest: %s is not parseable - a declared corpus that cannot be read is a FAIL\n' "$REFERENCE_MANIFEST"
+    printf '%s\n' "$entries" | sed 's/^/  /'
+    return 1
+  fi
+  local n_entries; n_entries=$(printf '%s\n' "$entries" | grep -c . || true)
+  local bad=0 out_n=0 f h hit mh
+  mh=$(g_sha256_file "$mf")
+  # clause 4, both halves of "the manifest is not itself shippable": the declared path must not
+  # live inside the build output, and no COPY of the manifest may sit there either - the manifest
+  # is a listing of every corpus hash, so shipping it ships the corpus's shape.
+  if rc_in_build_output "$mf"; then
+    printf 'the reference manifest itself sits inside the declared build output: %s\n' "${mf#"$ROOT"/}"
+    bad=1
+  fi
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    out_n=$((out_n + 1))
+    h=$(g_sha256_file "$f")
+    if [ "$h" = "$mh" ]; then
+      printf 'a copy of the reference manifest is in the build output: %s\n' "${f#"$ROOT"/}"
+      bad=1
+      continue
+    fi
+    hit=$(printf '%s\n' "$entries" | awk -F'\t' -v h="$h" '$1 == h { print $2; exit }')
+    if [ -n "$hit" ]; then
+      printf 'a reference-corpus payload is in the build output: %s (entry %s)\n' "${f#"$ROOT"/}" "$hit"
+      bad=1
+    fi
+  done < <(rc_build_output_files)
+  [ "$bad" -eq 0 ] || return 1
+  if [ "$out_n" -eq 0 ]; then
+    printf '%s entry/entries; no build output to scan (security: build_output: names no directory that exists)\n' "$n_entries"
+  else
+    printf '%s entry/entries; %s build-output file(s) hashed, none matches\n' "$n_entries" "$out_n"
+  fi
+  return 0
+}
+
+check_rc_02() {
+  # The vacuous-pass guard: RC-01 cannot pass on a manifest that was authored weak. SKIPs with
+  # RC-01's reason when the key is empty; a declared manifest that is absent or ill-shaped is a
+  # FAIL, never a skip.
+  if [ -z "$REFERENCE_MANIFEST" ]; then
+    printf 'reference_manifest: is empty - there is no manifest to shape-check (RC-01 skips for the same reason)\n'
+    return 3
+  fi
+  local mf; mf=$(rc_path)
+  if [ ! -f "$mf" ]; then
+    printf 'reference_manifest: %s does not exist - a declared manifest that is absent is a hole, not a skip\n' "$REFERENCE_MANIFEST"
+    return 1
+  fi
+  local errs=""
+  errs=$(rc_parse validate "$mf") && {
+    printf '%s is shaped so RC-01 cannot pass vacuously (schema, provenance, non-empty entries, entry_count)\n' "$REFERENCE_MANIFEST"
+    return 0
+  }
+  printf '%s is not a usable reference manifest:\n' "$REFERENCE_MANIFEST"
+  printf '%s\n' "$errs" | sed 's/^/  /'
+  return 1
+}
+
+check_rc_03() {
+  # Two clauses over the LAB repo: every tracked path is inside the declared allowlist, and no
+  # tracked file's sha256 equals a hash in a manifests/*.sha256. The manifest lists paths and
+  # hashes, which the lab's own README permits - the check is about BYTES, so the manifest is
+  # never read as a violation (its rows name files under the quarantine anchor, outside the repo).
+  if [ ! -d "$ROOT/manifests" ]; then
+    printf 'no manifests/ directory - this is not a lab repo with a reference corpus, so there are no tracked bytes to check\n'
+    return 3
+  fi
+  local mfs; mfs=$(ls "$ROOT"/manifests/*.sha256 2>/dev/null || true)
+  if [ -z "$mfs" ]; then
+    printf 'manifests/ exists but holds no *.sha256 - a corpus manifest directory that cannot be read is a FAIL, not a skip\n'
+    return 1
+  fi
+  local bad=0 p h m hashes="" n=0
+  for m in $mfs; do
+    hashes="$hashes$(awk '!/^#/ && NF >= 2 { print $1 }' "$m")"$'\n'
+  done
+  while IFS= read -r p; do
+    [ -n "$p" ] || continue
+    n=$((n + 1))
+    case "$p" in
+      scripts/*|notes/*|manifests/*) continue ;;
+      # The harness's own directories and the .gitignore block it appends are the install, not the
+      # lab's content - the same exclusion FM-02 makes for the same reason (W5-4). That set is the
+      # one the class-A install contract creates: .goblin/, .hermes/, the .gitignore block, the
+      # declared harness_dir (checks/ by default), reviews/, and the CI scaffold .github/. A payload
+      # hidden in any of them is still caught by clause 2 (the sha256 sweep below).
+      .goblin/*|.hermes/*|.gitignore|.github/*|reviews/*) continue ;;
+      "${GOBLIN_HARNESS_REL:-checks}"/*) continue ;;
+    esac
+    case "$p" in
+      */*) bad=1; printf 'a tracked path outside the lab allowlist (scripts/, notes/, manifests/, root docs): %s\n' "$p" ;;
+      *.md) ;;  # a root-level doc
+      *)   bad=1; printf 'a tracked path outside the lab allowlist (scripts/, notes/, manifests/, root docs): %s\n' "$p" ;;
+    esac
+  done < <( cd "$ROOT" && git ls-files )
+  while IFS= read -r p; do
+    [ -n "$p" ] || continue
+    h=$(g_sha256_file "$ROOT/$p")
+    if printf '%s' "$hashes" | grep -qxF "$h"; then
+      printf 'a reference-corpus payload is TRACKED in the lab repo: %s\n' "$p"
+      bad=1
+    fi
+  done < <( cd "$ROOT" && git ls-files )
+  [ "$bad" -eq 0 ] || return 1
+  printf '%s tracked file(s): all inside the lab allowlist, none matching a corpus hash\n' "$n"
+  return 0
+}
+
+check_rc_04() {
+  # The acquisition record, and the weakest of the four: it proves a record EXISTS, never that
+  # the number beside it came from the store. SKIPs when no manifest is declared; a manifest with
+  # no header block is a FAIL.
+  local mfs; mfs=$(ls "$ROOT"/manifests/*.sha256 2>/dev/null || true)
+  if [ -z "$mfs" ]; then
+    printf 'no manifests/*.sha256 - no acquisition record is declared, so there is none to read\n'
+    return 3
+  fi
+  local bad=0 m hdr tgt src c64 apk apkh n=0
+  for m in $mfs; do
+    n=$((n + 1))
+    hdr=$(awk '/^#/ { print; next } { exit }' "$m")
+    if [ -z "$hdr" ]; then
+      printf '%s: no header block - the acquisition record is absent\n' "${m#"$ROOT"/}"
+      bad=1; continue
+    fi
+    tgt=$(rc_hdr_field "$hdr" target)
+    src=$(rc_hdr_field "$hdr" source)
+    c64=$(printf '%s\n' "$hdr" | grep -oiE '[0-9a-f]{64}' | head -n 1)
+    # the header's own apk path
+    apk=$(printf '%s' "$tgt" | grep -oiE '[A-Za-z0-9._-]+\.apk' | head -n 1)
+    apkh=$(awk '!/^#/ && NF >= 2 { print $1 "\t" $2 }' "$m" | awk -F'\t' 'tolower($2) ~ /\.apk$/ { print; exit }')
+    if [ -z "$tgt" ] || ! printf '%s' "$tgt" | grep -qE '[0-9]+\.[0-9]+'; then
+      printf '%s: the header names no target slug + version (target: <file> <version>)\n' "${m#"$ROOT"/}"; bad=1
+    fi
+    if [ -z "$src" ] || ! printf '%s' "$src" | grep -qE '[A-Za-z0-9.-]+\.[A-Za-z]{2,}'; then
+      printf '%s: the header names no source store (source: <store> [; <checksum>])\n' "${m#"$ROOT"/}"; bad=1
+    fi
+    if ! printf '%s\n' "$hdr" | grep -qoiE '[0-9a-f]{32}([^0-9a-f]|$)'; then
+      printf '%s: the header carries no checksum (md5 or sha256 hex)\n' "${m#"$ROOT"/}"; bad=1
+    fi
+    if [ -z "$apkh" ]; then
+      printf '%s: the manifest holds no *.apk row\n' "${m#"$ROOT"/}"; bad=1
+    elif [ -n "$apk" ] && [ "${apkh#*$'\t'}" != "" ]; then
+      local rowbase; rowbase=${apkh#*$'\t'}; rowbase=${rowbase##*/}
+      if [ "$apk" != "$rowbase" ]; then
+        printf '%s: the header names %s but the manifest rows %s\n' "${m#"$ROOT"/}" "$apk" "$rowbase"; bad=1
+      fi
+    fi
+    if [ -n "$c64" ] && [ -n "$apkh" ]; then
+      local rowhash; rowhash=${apkh%%$'\t'*}
+      [ "$c64" = "$rowhash" ] || { printf '%s: the header sha256 %s disagrees with the apk row %s\n' "${m#"$ROOT"/}" "$c64" "$rowhash"; bad=1; }
+    fi
+  done
+  [ "$bad" -eq 0 ] || return 1
+  printf '%s acquisition record(s): target + version, source store, checksum, apk row\n' "$n"
+  return 0
+}
+
+# rc_hdr_field <header text> <key> — the value of a `# key : value` header line, case-insensitive.
+rc_hdr_field() {
+  printf '%s\n' "$1" | awk -v k="$2" '
+    /^#[[:space:]]*[A-Za-z_]+[[:space:]]*:/ {
+      line = $0; sub(/^#[[:space:]]*/, "", line)
+      key = line; sub(/:.*/, "", key); gsub(/[[:space:]]/, "", key)
+      if (tolower(key) == tolower(k)) { v = line; sub(/^[^:]*:[[:space:]]*/, "", v); print v; exit }
+    }
+  '
+}
+
+# ================================================================ runner ======
+
+PASS=0; FAIL=0; ADV=0; SKIP=0; BAD=0
+JSON_ROWS=""
+
+# json_escape <text> — a JSON string body. The detail of a check is arbitrary shell output
+# (quotes, backslashes, newlines), so it must be escaped or --json emits invalid JSON (D3).
+json_escape() {
+  local s="$1"
+  s=${s//\\/\\\\}
+  s=${s//\"/\\\"}
+  s=${s//$'\n'/\\n}
+  s=${s//$'\r'/\\r}
+  s=${s//$'\t'/\\t}
+  printf '%s' "$s"
+}
+
+emit() { # id status detail
+  if [ "$JSON" -eq 1 ]; then
+    JSON_ROWS="$JSON_ROWS{\"id\":\"$(json_escape "$1")\",\"status\":\"$(json_escape "$2")\",\"detail\":\"$(json_escape "$3")\"},"
+  else
+    case "$2" in
+      PASS) g_pass "$1" "$3" ;;
+      FAIL) g_fail "$1" "$3" ;;
+      ADV)  g_adv  "$1" "$3" ;;
+      SKIP) g_skip "$1" "$3" ;;
+    esac
+  fi
+}
+
+while IFS=$'\t' read -r id scope rule enforced_by artifact check why; do
+  [ "$id" = "id" ] && continue
+  [ -n "$id" ] || continue
+  [ "$scope" = "target" ] || continue
+  only_selected "$id" || continue
+
+  part=$(row_part "$id")
+  if [ -n "$part" ] && g_part_disabled "$CONFIG" "$part"; then
+    SKIP=$((SKIP + 1)); emit "$id" SKIP "$rule (opt-out: $part)"; continue
+  fi
+  if [ "$ARCHIVE" = "true" ]; then
+    case "$id" in
+      HP-*|GT-*|SP-*) SKIP=$((SKIP + 1)); emit "$id" SKIP "$rule (archive: true)"; continue ;;
+    esac
+  fi
+
+  case "$check" in
+    advisory)
+      ADV=$((ADV + 1))
+      emit "$id" ADV "$rule (advisory)"
+      continue
+      ;;
+    goblin-verify\ --only\ *)
+      fn="check_$(printf '%s' "$id" | tr 'A-Z' 'a-z' | tr '-' '_')"
+      if ! command -v "$fn" >/dev/null 2>&1 && ! declare -F "$fn" >/dev/null 2>&1; then
+        BAD=1; emit "$id" FAIL "$rule (no builtin implementation: $fn)"; continue
+      fi
+      detail=$("$fn" 2>&1); rc=$?
+      ;;
+    *)
+      detail=$( cd "$ROOT" && bash -c "$check" 2>&1 ); rc=$?
+      # A shell check has no advisory state: anything non-zero is a FAIL. Only builtins
+      # (the 'goblin-verify --only <ID>' marker rows) may return 2 = advisory or 3 = skip.
+      if [ "$rc" -eq 0 ]; then
+        [ -n "$detail" ] || detail="($check)"
+      else
+        detail="($check -> exit $rc)"
+        rc=1
+      fi
+      ;;
+  esac
+
+  case "$rc" in
+    0) PASS=$((PASS + 1)); emit "$id" PASS "$detail" ;;
+    1) FAIL=$((FAIL + 1)); emit "$id" FAIL "$detail" ;;
+    2) ADV=$((ADV + 1));  emit "$id" ADV "$detail" ;;
+    3) SKIP=$((SKIP + 1)); emit "$id" SKIP "$detail" ;;
+    *) FAIL=$((FAIL + 1)); emit "$id" FAIL "$detail (exit $rc)" ;;
+  esac
+done < "$MANIFEST"
+
+if [ "$JSON" -eq 1 ]; then
+  printf '{"root":"%s","class":"%s","passed":%d,"failed":%d,"advisory":%d,"skipped":%d,"rows":[%s]}\n' \
+    "$(json_escape "$ROOT")" "$(json_escape "$CLASS")" "$PASS" "$FAIL" "$ADV" "$SKIP" "${JSON_ROWS%,}"
+else
+  printf '      %d passed, %d failed, %d advisory, %d skipped\n' "$PASS" "$FAIL" "$ADV" "$SKIP"
+  # Z1-7: the advisory number above counts TWO different things - the rows the matrix LABELS
+  # advisory, and a row that is not advisory-labelled but whose lane cannot be resolved here
+  # (JG-02's unresolved judge lane returns 2 = ADV by design). SK-03 counts the first, the ADV
+  # lines on screen are both, so a reader comparing `advisory 10 of ceiling 10` with 11 ADV lines
+  # saw a mismatch that only the row's why-cell explained. Print the arithmetic.
+  adv_labelled=$(awk -F'\t' 'NR>1 && ($4=="advisory" || $6=="advisory") {n++} END{print n+0}' "$MANIFEST")
+  if [ "$ADV" -ne "$adv_labelled" ]; then
+    printf '      of those %d advisory: the matrix labels %d row(s) advisory; the difference is the non-advisory row(s) reporting ADV by design (an unresolved lane) and any labelled row skipped by an opt-out\n' \
+      "$ADV" "$adv_labelled"
+  fi
+  cat <<'SEE'
+      cannot see: whether a check in the harness dir tests the right path rather than
+      merely passing; whether the forge is bound by the workflow CL-01 found; whether a human
+      read the diff;
+      whether the model mapping names a family that actually differs (MD-02 reports it
+      and cannot change it); and whether .goblin/installed.json — the record every drift
+      check trusts — was itself rewritten. It is not signed, so one edit to it (with the
+      matching edit to the file it protects) defeats IN-02, SK-02 and HS-01 at once
+      (docs/LIMITS.md #18). The ban lane carries the same blind spot and two of its own:
+      the ban table is a manifest file under the same unsigned record, so a defanged ban
+      passes BN-00 (docs/LIMITS.md #28); a ban probe is a TEXT probe with no AST, so a
+      `Record<string, any>` is missed and a `: any` inside a string is reported
+      (docs/LIMITS.md #27); and no check here can reach a ban IN CONTEXT — the row proves
+      the forbidden path fails mechanically, never that the ban reached the agent that
+      wrote the line. The judge/loop lane adds its own: every JG-/LP- row reads a RECORD, so
+      it proves a handle, a pin, a budget and a pointer exist — never that the loop made
+      progress (a changed pointer is a proxy, docs/LIMITS.md #33), never which lane returned
+      a verdict, and never that the predicate was the right one or was really run. The CI lane
+      adds its own: PG-05 and PG-06 read a workflow's TEXT, so PG-05 sees a job whose gate step is
+      conditional and cannot see branch protection, the required-check list, or a forge that never
+      ran the job at all, and PG-06 proves a declared gate is INVOKED in a file under
+      .github/workflows/ — never that the forge marks that job required, never that it is the job
+      the forge waits on, and never that the workflow can fail (that is PG-05). A required check
+      that reports Success after skipping its gate is a green light for a commit whose gate never
+      ran (docs/CI.md). The reference-corpus lane adds its own: RC-01 matches EXACT sha256 only,
+      so a resized, recoloured or re-encoded reference asset, or copied text inside a shipped
+      string, passes it unseen; RC-02 proves the manifest is well-shaped, never that its entries
+      are the right hashes (as strong as tamper hashing, and installed.json is unsigned); RC-03
+      reads the tracked tree and cannot see a payload renamed and re-encoded; and RC-04 proves an
+      acquisition record EXISTS, never that the number beside it came from the store (HP-03's
+      defect, one artifact over). No row here reaches a reference asset in CONTEXT either.
+SEE
+  # ---- the engine footer (W1 §2.2, R-1's residue -> docs/LIMITS.md #43) --------
+  # Every run states WHICH engine judged it: the sha256 of the running verifier and of
+  # the manifest that judged this run, so a repo can name its judge. The statement is
+  # UNSIGNED and forgeable - one forgery now covers N repos - which is the hole LIMITS
+  # #43 records, deliberately not fixed in W1 (G6).
+  # W6: the banner goes to STDERR, not stdout (LIM-51). A consumer capturing verify's
+  # output parses check lines; a footer line interleaved with them is parser friction
+  # (docs/LIMITS.md #49 recorded the cost before the fix). The banner is a STATEMENT,
+  # not a verdict line - diagnostics belong on the error stream. Captured stdout after
+  # the move carries PASS/FAIL/ADV/SKIP lines and the summary only; the banner stays
+  # visible in a terminal and in any `2>&1` merge (every suite that asserts the
+  # footer merges the streams).
+  printf '      engine: mode=%s' "$ENGINE_MODE" >&2
+  if [ -n "$GOBLIN_ENGINE" ]; then printf ' engine_dir=%s' "$GOBLIN_ENGINE" >&2; fi
+  printf ' cli_sha256=%s enforcement_tsv_sha256=%s\n' \
+    "$(g_sha256_file "$SELF_DIR/goblin-verify")" \
+    "$(g_sha256_file "$MANIFEST")" >&2
+  # ---- the shadow advisory (W3 §3.2) -------------------------------------------
+  # A vendored payload under .goblin/ while the record says mode=global: the chain's
+  # vendored step (2) beats the declared engine_dir (3) — W1's ordering, kept
+  # deliberately — so a STALE vendored table judged this run while the footer above
+  # still prints mode=global. This line names that split. It is deliberately a footer
+  # ADVISORY, not a manifest row: the advisory ceiling is `advisory 10 of ceiling 10`
+  # on every migrated repo (SK-03 measured at W3-SPEC MA5, 0 free slots), so a new row
+  # would fail every migrated repo — and adding a row is a G2 rule change W3 has no
+  # mandate for. Detector, not prevention: the residue is LIMITS #45.
+  if [ "$ENGINE_MODE" = "global" ]; then
+    _shadow_n=0
+    for _f in "$ROOT"/.goblin/bin/goblin-verify "$ROOT"/.goblin/bin/goblin-lib.sh \
+              "$ROOT"/.goblin/bin/goblin-audit "$ROOT"/.goblin/bin/goblin-bans \
+              "$ROOT"/.goblin/manifest/* "$ROOT"/.goblin/bans/* \
+              "$ROOT"/.goblin/automations/* "$ROOT"/.goblin/roles.yaml; do
+      [ -e "$_f" ] || continue
+      _shadow_n=$((_shadow_n + 1))
+    done
+    if [ "$_shadow_n" -gt 0 ]; then
+      printf '      shadow: vendored engine payload present (%d file(s)) - the vendored table judged this run, not the declared engine_dir\n' "$_shadow_n"
+    fi
+    unset _shadow_n _f
+  fi
+fi
+
+if [ "$FAIL" -gt 0 ] || [ "$BAD" -eq 1 ]; then exit 1; fi
+exit 0