specpro-cli 0.1.0__py3-none-any.whl

specpro_cli/assets/scripts/bash/verify-shapes.sh

@@ -0,0 +1,1082 @@
+#!/bin/bash
+#
+# Shape-detection verifier — one re-runnable detection per registered defect shape.
+#
+# Why this exists: `spec.md` -> FR-048 要求登记表中**每一个**形态 MUST 有一条**可重跑**
+# 的检出方式，且**消除**以重跑检出成立、**不以"已修"的声明**（US10 的 Acceptance
+# Scenario 5）。`plan.md` -> Constraint 7 定了形态登记表，其「落点」列已按同处的
+# 「落点政策」重新解释：可执行的实现体落 `scripts/`，命令文档只**调用**它们。
+# This script is that implementation.
+#
+# ⚠️ THE RULE THIS FILE OBEYS, AND THE ONE IT IS MOST LIKELY TO BREAK:
+# **一条恒真的检出与一条不存在的检出，在报告上同形**（形态 6）。 A check over an
+# empty registry prints nothing, and "nothing" reads exactly like "nothing wrong".
+# ⇒ **Every check here declares its own scope, and an empty scope is `⊘`, never `✓`.**
+# The same guard the QC criterion gained in T096/FR-041, applied to this file's checks.
+#
+# ⚠️ A second consequence, stated rather than papered over: several of the eleven shapes
+# cannot be decided by a generic rule over the whole repository — shape 2 needs to know
+# WHICH four wiring points a given rule claims; shape 3 needs to be told WHICH fact
+# appears in two places. Those checks therefore run against an **explicit registry**,
+# declared below. A registry that is thin is visible as such; a check that guessed its
+# subjects would instead fire on innocent files, and a check that fires on innocent files
+# is turned off by its readers — after which it is a decoration.
+#
+# ⚠️ What this verifier does NOT do: it has no enforcement point. Per 落点政策 §4 it is
+# the CALLER that creates one, and today no caller runs it (`ISS-90` ③b records that gap
+# for the fixture cases as well). This file reports; something else must stop on it.
+#
+# Usage:  scripts/bash/verify-shapes.sh
+#         SHAPES_HOOK_BASE=<path> scripts/bash/verify-shapes.sh   (verify a copy)
+# Exit:   0 = no shape has a hit;  1 = at least one hit (details printed)
+
+# ⚠️ NOT `set -e`: the logic below reads the exit codes of subcommands, and `set -e`
+# would end the run before the reading happens (宪法 2.2.2, second carve-out).
+set -uo pipefail
+
+# Resolved from THIS script's location, not the caller's cwd — the fixture cases run it
+# from a temporary tree, and a cwd-relative base would then verify the wrong place.
+BASE="${SHAPES_HOOK_BASE:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+
+HITS=0
+OKS=0
+SKIPS=0
+
+hit() { HITS=$((HITS + 1)); echo "        ✗ $1"; }
+ok() { OKS=$((OKS + 1)); echo "        ✓ $1"; }
+skip() { SKIPS=$((SKIPS + 1)); echo "        ⊘ $1"; }
+
+# ---------------------------------------------------------------------------------------
+# ⊘ sites that are a LIVE SILENCE — 形态 12's subject, collected as DATA
+# ---------------------------------------------------------------------------------------
+# `skip` above means "this subject could not be exercised **here**" (absent carrier, stale
+# registry row, empty registry). `unreceived` means something stronger: **the subject
+# exists and was not judged**, so somebody must own filling its scope.
+#
+# ⚠️ Why the receiver is a COLLECTED PAIR and not parsed back out of the report text
+# (`T213` / `ISS-177`): deriving the subject from the message is 形态 1 — a semantic
+# conclusion drawn from a literal match — and it would go silently dead the first time
+# somebody reworded a message. The messages below are NOT uniform (some carry a subject id,
+# some do not), so there is nothing stable to parse even today.
+UNRECEIVED=""
+unreceived() { # unreceived <receiver-id-or-empty> <message>
+    SKIPS=$((SKIPS + 1))
+    UNRECEIVED="${UNRECEIVED}${1}"$'\t'"${2}"$'\n'
+    echo "        ⊘ $2"
+}
+
+# Is <id> present as an ENTRY — not as a mention? The pattern is the entry body's
+# line-start shape, which is the discipline the ledger's own verifier already uses
+# (`^- \[[x ]\] ISS-<N>:` rather than a full-text ID search; `TOOL-009`). A full-text
+# match would count every cross-reference as a receiver, and this file's own commentary
+# names these ids — so the weaker check would pass on its own prose.
+receivers_exist() { # receivers_exist <id>
+    local id=$1 f
+    for f in "specs/tasks.md" "specs/implement_issues.md"; do
+        [ -f "$BASE/$f" ] || continue
+        grep -qE "^- \[[x ]\] ${id}([ :]|\$)" "$BASE/$f" && return 0
+    done
+    return 1
+}
+
+# Count of lines matching a regex in a file, as a number. `grep -c` prints 0 AND exits 1
+# on no match, so `$(grep -c … || echo 0)` yields "0\n0" — a two-line string that breaks
+# every numeric comparison it is fed to (the `|| echo "0"` trap, fixed repo-wide in T125).
+count_of() { # count_of <file> <regex>
+    local n
+    n=$(grep -cE "$2" "$1" 2>/dev/null || true)
+    echo "${n:-0}"
+}
+
+count_of_unfenced() { # count_of_unfenced <file> <regex> — 只数围栏**之外**的行
+    # ⚠️ **为什么必须有这一支**（`T222` 同轮实测）：`specs/checklists/requirements.md` 由模板
+    # 重建，而**模板里有一条 `- [ ] **Status**: ⊘ Skipped` 的 fenced EXAMPLE** —— 它示范的是
+    # 取值语义。逐行计数的判据会把它算成**第 12 项**，而清单里只有 **11** 个 `### ID:` 条目
+    # ⇒ 报出一个**假 hit**。同一个判别器 `update_checklist` 的 awk **已经用了**
+    # （`id ~ /^[A-Z]+[0-9]+$/`），只是这一处没有。**围栏就是那条示例的判别器**：真条目不在围栏里。
+    # ⚠️ **The regex travels through ENVIRON, NOT through `-v`** — and that is a FIX, not
+    # a style choice. `awk -v re='...\[...'` makes awk process the argument's backslash
+    # ESCAPES, so `\[` arrives as a bare `[` and `\*` as a bare `*` (a quantifier): the
+    # pattern silently stops matching and the count comes back **0** — a wrong number with
+    # no error, measured on this very call (`n=0` while `grep -cE` said 12). `ENVIRON` is
+    # read verbatim, escapes intact.
+    RE="$2" awk '
+      /^[[:space:]]*```/ { infence = !infence; next }
+      !infence && $0 ~ ENVIRON["RE"] { n++ }
+      END { print n + 0 }
+    ' "$1" 2>/dev/null
+}
+
+echo "Shape detections: $BASE"
+echo
+
+# =======================================================================================
+# SHAPE 1 — literal match used as a semantic conclusion
+# =======================================================================================
+# 判据: 误报即命中. The probe is a COMPLIANT text in which every listed keyword appears
+# only as a SUBSTRING of an unrelated word (`class` inside `classify`, `def` inside
+# `definition`). A keyword scan that matches those is drawing a semantic conclusion from
+# a literal match. ⚠️ The probe deliberately does NOT contain whole-word uses such as
+# "the interface between two layers": that case still matches by design, it is documented
+# as a declared limit of a keyword scan, and testing a declared non-property would be a
+# false positive of this detector rather than of the criterion (形态 1, turned around).
+#
+# ⚠️ Why the criterion is EXTRACTED from its carrier rather than re-stated here: a second
+# copy of the predicate is a second source (形态 3) and would drift silently. The adapter
+# below is the only way to reach a criterion that is still carried in Markdown — which is
+# precisely the state 落点政策 §1 exists to end (`T186` carries that migration).
+echo "  [1] literal match used as a semantic conclusion"
+
+# --- the criterion harness, shared by shapes 1 and 6 -----------------------------------
+#
+# ⚠️ Why the criterion is EXTRACTED from its carrier rather than re-stated here: a second
+# copy of the predicate is a second source (形态 3) and would drift silently. Extraction is
+# the only way to reach a criterion that is still carried in Markdown — which is precisely
+# the state 落点政策 §1 exists to end (`T186` carries that migration for one family).
+#
+# ⚠️ The harness FAILS LOUDLY when extraction stops working. An extraction that silently
+# returns nothing is ISS-83's shape: the criterion never runs and the run reads as clean.
+extract_fence() { # extract_fence <carrier> <fn-name> — the fence that DEFINES <fn-name>
+    local carrier=$1 fn=$2
+    [ -f "$carrier" ] || return 0
+    awk -v fn="$fn" '
+        /^```bash/ { infence=1; buf=""; next }
+        /^```/     { if (infence && buf ~ (fn "\\(\\)")) { printf "%s", buf; exit } infence=0; next }
+        infence    { buf = buf $0 "\n" }
+    ' "$carrier"
+}
+
+# The probes. Two per criterion: one it must NOT report on, one it MUST.
+crit_probe() { # crit_probe <criterion-id> <compliant|falsifying>
+    case "$1-$2" in
+      CQ001-compliant) cat <<'P'
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+  - **FR-001**: The system MUST classify incoming events into categories.
+    **Lifecycle**: [specify:create][plan:create][tasks:create]
+    System MUST classify each event and record its category.
+
+  - **FR-002**: The system MUST show a definition of every category it reports.
+    **Lifecycle**: [specify:create][plan:create][tasks:create]
+    System MUST present a declarative summary for each category.
+P
+      ;;
+      CQ001-falsifying) cat <<'P'
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+  - **FR-001**: The system MUST render its configuration screen with React.
+    **Lifecycle**: [specify:create][plan:create][tasks:create]
+    System MUST use an async/await HTTP client for the sync endpoint.
+P
+      ;;
+      CS003-compliant) cat <<'P'
+### US1 - Alpha (Priority: P1)
+
+**Independent Test**: run it.
+
+### US2 - Beta (Priority: P2)
+
+**Independent Test**: run it.
+
+## Requirements *(mandatory)*
+
+#### Alpha (US1)
+
+  - **FR-001**: The system MUST do alpha.
+
+#### Beta (US2)
+
+  - **FR-002**: The system MUST do beta.
+P
+      ;;
+      CS003-falsifying) cat <<'P'
+### US1 - Alpha (Priority: P1)
+
+**Independent Test**: run it.
+
+### US2 - Beta (Priority: P2)
+
+**Independent Test**: run it.
+
+## Requirements *(mandatory)*
+
+#### Alpha (US1)
+
+  - **FR-001**: The system MUST do alpha.
+P
+      ;;
+      # ---- the rest (T192, minus one retired 2026-09-19 / T197) ----------------------
+      # Each is a MINIMAL input that falsifies its criterion's predicate. They are the
+      # cases T124 ran through a throwaway harness; without a home here they had no
+      # owner at all (ISS-151) — the obligation had been written onto a task that could
+      # not write this file. ⚠️ The probe for the retired criterion was removed with it:
+      # a probe for a criterion that no longer exists would be registered against a
+      # `CRITERIA` row that no longer exists, and `S6_DECLARED` would then never reach it.
+      CQ003-falsifying) cat <<'P'
+## Requirements
+
+  - **FR-001**: The system MUST implement search using React for the index.
+P
+      ;;
+      CP001-falsifying) cat <<'P'
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+  - **FR-001**: The system MUST do the thing.
+P
+      ;;
+      # ⚠️ US1 carries no `**Acceptance Scenarios**` block at all; US2 does. The criterion
+      # compares the two counts, so a spec where BOTH were missing would still be caught —
+      # but a spec with ONE missing is the smaller failing input, and this is it.
+      CP002-falsifying) cat <<'P'
+### US1 - Alpha (Priority: P1)
+
+No scenarios here at all.
+
+### US2 - Beta (Priority: P2)
+
+**Acceptance Scenarios**:
+
+1. **Given** a, **When** b, **Then** c
+P
+      ;;
+      # The metric sits INSIDE an Acceptance Scenarios block: CP003 does not scan the whole
+      # document, it scans that block — a metric anywhere else would falsify nothing here.
+      CP003-falsifying) cat <<'P'
+### US1 - Alpha (Priority: P1)
+
+**Acceptance Scenarios**:
+
+1. **Given** a live session, **When** the screen changes, **Then** it updates within 200ms
+
+**Why this priority**: because.
+P
+      ;;
+      CS001-falsifying) cat <<'P'
+### US1 - Alpha (Priority: P1)
+
+The system MUST support offline mode for disconnected sites.
+
+### US2 - Beta (Priority: P2)
+
+The system MUST require an always-on connection to the server.
+P
+      ;;
+      CS002-falsifying) cat <<'P'
+## Requirements
+
+  - **FR-001**: The system MUST store the data locally on the device.
+  - **FR-002**: The system MUST NOT use local storage for records.
+P
+      ;;
+      # ⚠️ The reference is on the DEFINITION line, and that is the point: it is the form
+      # T190 fixed. A continuation-line variant was already caught before that fix, so a
+      # probe written that way would report green against the broken criterion too — it
+      # would test nothing about the repair.
+      #
+      # ⚠️ **Why the cited id is `FR-042` and not a number outside the project's own range**
+      # this probe's subject is "**cited inside this sample but not defined in it**" — the
+      # id only has to be absent *from the sample*, and any number satisfies that. A number
+      # ABOVE the project's own range, however, is indistinguishable from a **foreign
+      # identifier** to `check-anti-coupling.sh`'s class 1, so the fixture itself became an
+      # O1 finding and kept that class's hit count permanently non-zero. Using an id inside
+      # the project's range removes the false finding **without touching the probe's
+      # subject or the criterion**.
+      # ⚠️ When writing a new probe, pick an id the project allocates but this sample does
+      # not define — never one the project has never heard of.
+      CS004-falsifying) cat <<'P'
+## Requirements
+
+  - **FR-001**: The system MUST do alpha, per FR-042.
+P
+      ;;
+      # TR001 reads `specs/constitution.md` relative to the working directory, and reports
+      # ⊘ when it is absent. The probe needs one present: here the criterion fails because
+      # the spec documents no Constitution Constraints while the constitution exists.
+      TR001-falsifying) cat <<'P'
+## Requirements *(mandatory)*
+
+  - **FR-001**: The system MUST do the thing.
+P
+      ;;
+      # ⚠️ A LABELLED name (`external service`), not the unlabelled functional-layer form.
+      # Both are real, but only the labelled one is inside the criterion's declared
+      # vocabulary — the unlabelled case is a documented limit that reports ⊘ by design
+      # (ISS-150 / research.md → Addendum (T191)). Feeding it here would test the declared
+      # limit, not "is this criterion ever able to say no".
+      TR002-falsifying) cat <<'P'
+## Requirements *(mandatory)*
+
+  - **FR-001**: The system MUST call the external service to settle the order.
+P
+      ;;
+      *) return 1 ;;
+    esac
+}
+
+CRITERIA="
+CQ001|commands/specpro.qc.md|check_cq001_implementation_details
+CQ003|commands/specpro.qc.md|check_cq003_functional_not_technical
+CP001|commands/specpro.qc.md|check_cp001_mandatory_sections
+CP002|commands/specpro.qc.md|check_cp002_acceptance_scenarios
+CP003|commands/specpro.qc.md|check_cp003_scenarios_functional
+CS001|commands/specpro.qc.md|check_cs001_us_consistency
+CS002|commands/specpro.qc.md|check_cs002_fr_consistency
+CS003|commands/specpro.qc.md|check_cs003_us_fr_mapping
+CS004|commands/specpro.qc.md|check_cs004_reference_integrity
+TR001|commands/specpro.qc.md|check_tr001_constitution_constraints
+TR002|commands/specpro.qc.md|check_tr002_external_dependencies
+"
+
+# run_criterion <criterion-id> <carrier> <fn> <probe-kind> — the criterion's own output.
+# Exit 2 = not executable (the criterion could not be reached or its probe is unregistered).
+#
+# ⚠️ The write-back functions the criteria call are stubbed: this harness judges the
+# CRITERION's verdict, and a probe that tripped the auto-fix path would edit its own input.
+run_criterion() {
+    local cid=$1 carrier=$2 fn=$3 kind=$4
+    local probe; probe=$(crit_probe "$cid" "$kind") || return 2
+    local block; block=$(extract_fence "$BASE/$carrier" "$fn")
+    [ -n "$block" ] || return 2
+    local f; f=$(mktemp)
+    printf '%s\n' "$probe" > "$f"
+    # ⚠️ `cd "$BASE"` and an ABSOLUTE `$SPEC_TEMPLATE` are both load-bearing, and their
+    # absence was a false positive of this harness rather than a finding about the criteria:
+    # CP001 and TR002 read `$SPEC_TEMPLATE` (unset ⇒ "" ⇒ "the template declares no
+    # mandatory sections"), and TR001 reads `specs/constitution.md` relative to the working
+    # directory. Run from anywhere but BASE, and the harness reports three criteria as
+    # ⊘/wrong for reasons that have nothing to do with the criteria. The fixture suite only
+    # masked it because the parent test happens to run from the repository root.
+    ( cd "$BASE" || exit 9
+      FEATURE_SPEC="$f" SPEC_TEMPLATE="$BASE/.specpro/templates/spec-template.md" \
+      TARGET_FRS=all SCOPE=full bash -c '
+        eval "$1"
+        PASSED=0; FAILED=0; SKIPPED=0; FAILED_ITEMS=(); AUTO_FIXED_COUNT=0
+        NEED_CLARIFY=false
+        auto_fix_implementation_details() { return 0; }
+        add_to_clarifications() { return 0; }
+        update_checklist() { return 0; }
+        save_qc_cache() { return 0; }
+        "$2" 2>/dev/null
+    ' _ "$block" "$fn" )
+    rm -f "$f"
+}
+
+# ⚠️ The registry is SHARED with shape 6, and that is deliberate: both ask a question about
+# "every criterion the carrier declares", and two registries would drift. The consequence is
+# that shape 1 must say what it can and cannot reach — **only the criteria with a COMPLIANT
+# probe are probed here**; the rest are reported once, as a coverage fact, not as a run of
+# per-criterion ⊘ lines that read like failures.
+#
+# ⚠️ It previously reported those as "not executable — '$fn' is not reachable in $carrier",
+# which was simply untrue: the criterion is reachable, the PROBE is what is missing. A ⊘
+# whose stated reason is wrong is worse than no line at all — the reader checks the claim,
+# finds the function present, and stops trusting the report.
+S1_N=0
+S1_UNPROBED=""
+S1_UNPROBED_N=0
+while IFS='|' read -r cid carrier fn; do
+    [ -n "${cid:-}" ] || continue
+    S1_N=$((S1_N + 1))
+    verdict=$(run_criterion "$cid" "$carrier" "$fn" compliant)
+    if [ $? -eq 2 ]; then
+        S1_UNPROBED="$S1_UNPROBED $cid"
+        S1_UNPROBED_N=$((S1_UNPROBED_N + 1))
+        continue
+    fi
+    if printf '%s' "$verdict" | grep -q '✗'; then
+        hit "SHAPE-1 $cid: reports on a compliant probe where the keywords are substrings only"
+        printf '%s\n' "$verdict" | grep '✗' | head -2 | sed 's/^/          /'
+    else
+        ok "SHAPE-1 $cid: compliant probe reported clean"
+    fi
+done <<EOF
+$CRITERIA
+EOF
+if [ "$S1_UNPROBED_N" -gt 0 ]; then
+    unreceived "T124" "SHAPE-1: $S1_UNPROBED_N of $S1_N criteria have no COMPLIANT probe — unproven, not clean:$S1_UNPROBED"
+fi
+[ "$S1_N" -gt 0 ] || skip "SHAPE-1: no criterion is registered"
+
+# =======================================================================================
+# SHAPE 2 — mechanism written but not wired into the execution chain
+# =======================================================================================
+# 判据: 缺任意一处即命中. A claim of the form "X is enforced by Y" is a mechanism; if Y
+# does not actually invoke X, the claim is a statement with no enforcement point. Each
+# registry row names a CLAIM and the artefacts it points at; the detection resolves the
+# claim against the files, not against the prose that makes it.
+#
+# ⚠️ Registered as rows rather than derived from prose: "which four points a rule claims"
+# is not recoverable from the repository by any regex, and a check that guessed would fire
+# on every rule that wires itself differently — see this file's header on that trade.
+echo "  [2] mechanism written but not wired into the execution chain"
+
+S2_CLAIMS="
+verify-ledger-enforcement|commands/specpro.implement.md|verify-ledger|scripts/git-hooks/pre-commit|verify-ledger
+verify-deployment-enforcement|CLAUDE.md|verify-deployment|scripts/git-hooks/pre-commit|verify-deployment
+"
+S2_N=0
+while IFS='|' read -r cid claim_file subject enforcer inv; do
+    [ -n "${cid:-}" ] || continue
+    S2_N=$((S2_N + 1))
+    if [ ! -f "$BASE/$claim_file" ]; then
+        skip "SHAPE-2 $cid: not executable — claim carrier $claim_file is absent"
+        continue
+    fi
+    if ! grep -q "$subject" "$BASE/$claim_file" 2>/dev/null; then
+        skip "SHAPE-2 $cid: the claim is no longer made in $claim_file (registry row is stale)"
+        continue
+    fi
+    if [ ! -f "$BASE/$enforcer" ]; then
+        hit "SHAPE-2 $cid: $claim_file claims enforcement by $enforcer, which does not exist"
+        continue
+    fi
+    if grep -q "$inv" "$BASE/$enforcer" 2>/dev/null; then
+        ok "SHAPE-2 $cid: $enforcer really invokes '$inv'"
+    else
+        hit "SHAPE-2 $cid: $enforcer does not invoke '$inv' — the claim has no enforcement point"
+    fi
+done <<EOF
+$S2_CLAIMS
+EOF
+[ "$S2_N" -gt 0 ] || skip "SHAPE-2: no enforcement claim is registered"
+
+# --- the consumer side: is a consumer NAMED where the artifact is defined? ---------------
+# 判据 (Q2's OTHER half — `ISS-174` / `T212`): 宪法 Q2 要求「新增产物时必须**同时指定**其负责
+# 命令与**具名消费者**」。⚠️ **写入侧**有强制点（上面那两行：pre-commit 真的调用核验体）；
+# **消费者侧此前什么都没有** —— 而 `S2_CLAIMS` 问的是另一个问题（"声称的强制者是否真的调用
+# 它"），把两者塞进同一个表会让"命令有没有声明该产物"与"产物有没有人读"互相冒充。
+#
+# ⚠️ 注册的对象是「**产物 ↔ 它的定义载体**」这一**对**，不是产物单侧。单侧那一半
+# （"这个字在仓库里出现过吗"）是**形态 1**（字面匹配求语义结论）—— 而本文件的 SHAPE 1
+# 存在的意义就是查它。
+#
+# ⚠️ 今天每一行都是 `carrier == artifact`（这些产物**在自身**里点名消费者）。该列**不是装饰**：
+# 它是"消费者被写在**契约**里而不是产物里"那一行要用的槽位，而这样的行**今天还没有**。
+#
+# ⚠️ **一次命中证明了什么、没证明什么**：载体里有 ≥1 行匹配，回答的是「**这里点名了消费者**」；
+# **不**回答「这个产物的每一部分都有」—— 后者是**形态 10**（一般规则只以实例形式存在）的
+# 判据，是另一处检查。写在这里，是因为把它当成后者读的人**会停止寻找**。
+S2_CONSUMER_ROWS="
+ledger-sections|specs/contracts/ledger.md|specs/contracts/ledger.md|^## Sections and their consumers
+plan-purpose-consumers|specs/plan.md|specs/plan.md|^\*Purpose:.*Consumers:
+"
+S2C_N=0
+while IFS='|' read -r cid artifact carrier cpattern; do
+    [ -n "${cid:-}" ] || continue
+    S2C_N=$((S2C_N + 1))
+    if [ ! -f "$BASE/$artifact" ]; then
+        skip "SHAPE-2 $cid: not executable — the artifact $artifact is absent"
+        continue
+    fi
+    if [ ! -f "$BASE/$carrier" ]; then
+        hit "SHAPE-2 $cid: $artifact names no consumer — its definition carrier $carrier does not exist"
+        continue
+    fi
+    if [ "$(count_of "$BASE/$carrier" "$cpattern")" -gt 0 ]; then
+        ok "SHAPE-2 $cid: $artifact names its consumer(s) in $carrier"
+    else
+        hit "SHAPE-2 $cid: $artifact names no consumer in $carrier — Q2 requires one"
+    fi
+done <<EOF
+$S2_CONSUMER_ROWS
+EOF
+[ "$S2C_N" -gt 0 ] || skip "SHAPE-2: no consumer-side row is registered (Q2's consumer half is unproven, not clean)"
+
+# =======================================================================================
+# SHAPE 3 — the same fact in two places, and they disagree
+# =======================================================================================
+# 判据: 取文不同即命中. Each row names one fact and the two carriers that state it; the
+# detection extracts each statement's VALUE and compares, so the two never have to be
+# re-read by a human to notice they have parted.
+#
+# ⚠️ Rows are limited to facts that NO existing verifier already asserts. Restating an
+# asserted fact here would create the very thing this shape is about — a second source.
+# (The shape-table sync between `spec.md` and `plan.md`, for one, is already asserted by
+# `scripts/git-hooks/pre-commit`; re-checking it here would be that mistake.)
+echo "  [3] the same fact in two places, and they disagree"
+
+S3_FACTS="
+analyze-pass-count|commands/specpro.analyze.md|^#### ([A-P])\. |count|CLAUDE.md|([0-9]+) 个检测通道
+"
+S3_N=0
+while IFS='|' read -r fid afile are arity bfile bre; do
+    [ -n "${fid:-}" ] || continue
+    S3_N=$((S3_N + 1))
+    if [ ! -f "$BASE/$afile" ] || [ ! -f "$BASE/$bfile" ]; then
+        skip "SHAPE-3 $fid: not executable — a carrier is absent"
+        continue
+    fi
+    if [ "$arity" = "count" ]; then av=$(count_of "$BASE/$afile" "$are"); else av=$(grep -oE "$are" "$BASE/$afile" 2>/dev/null | head -1 || true); fi
+    bv=$(grep -oE "$bre" "$BASE/$bfile" 2>/dev/null | grep -oE '[0-9]+' | head -1 || true)
+    if [ -z "$av" ] || [ -z "$bv" ]; then
+        skip "SHAPE-3 $fid: not executable — one side states no value (a form change, not agreement)"
+        continue
+    fi
+    if [ "$av" = "$bv" ]; then
+        ok "SHAPE-3 $fid: both carriers state $av"
+    else
+        hit "SHAPE-3 $fid: $afile says $av, $bfile says $bv"
+    fi
+done <<EOF
+$S3_FACTS
+EOF
+[ "$S3_N" -gt 0 ] || skip "SHAPE-3: no fact pair is registered"
+
+# =======================================================================================
+# SHAPE 4 — the report disagrees with what is actually there
+# =======================================================================================
+# 判据: 不符即命中. A report states a NUMBER; the detection RE-DERIVES that number from the
+# artifact the report is about and compares. Re-running the judgement is the whole point:
+# reading the report back to itself proves nothing (形态 4 is exactly that confusion).
+echo "  [4] the report disagrees with what is actually there"
+
+S4_ROWS="
+checklist-total|specs/checklists/requirements.md|Total Items|\*\*Total Items\*\*: ([0-9]+)|unfenced:^[[:space:]]*- \[[ x]\] \*\*Status\*\*:[[:space:]]*[^[:space:]]+
+checklist-passed|specs/checklists/requirements.md|Passed|\*\*Passed\*\*: ([0-9]+)|unfenced:^[[:space:]]*- \[[ x]\] \*\*Status\*\*:[[:space:]]*x[[:space:]]*$
+checklist-failed|specs/checklists/requirements.md|Failed|\*\*Failed\*\*: ([0-9]+)|unfenced:^[[:space:]]*- \[[ x]\] \*\*Status\*\*:[[:space:]]*✗
+req-template-total|templates/requirements-template.md|Total Items|\*\*Total Items\*\*: ([0-9]+)|^### [A-Z]{2}[0-9]{3}:
+"
+S4_N=0
+while IFS='|' read -r rid rfile label claim_re count_re; do
+    [ -n "${rid:-}" ] || continue
+    S4_N=$((S4_N + 1))
+    if [ ! -f "$BASE/$rfile" ]; then
+        skip "SHAPE-4 $rid: not executable — report $rfile is absent"
+        continue
+    fi
+    stated=$(grep -oE "$claim_re" "$BASE/$rfile" 2>/dev/null | grep -oE '[0-9]+' | head -1 || true)
+    # ⚠️ `unfenced:` 前缀 = 这一行必须**跳过围栏内的行**（见 `count_of_unfenced` 的理由）
+    if [ "${count_re#unfenced:}" != "$count_re" ]; then
+        actual=$(count_of_unfenced "$BASE/$rfile" "${count_re#unfenced:}")
+    else
+        actual=$(count_of "$BASE/$rfile" "$count_re")
+    fi
+    if [ -z "$stated" ]; then
+        skip "SHAPE-4 $rid: not executable — the report states no '$label' value"
+        continue
+    fi
+    if [ "$stated" = "$actual" ]; then
+        ok "SHAPE-4 $rid: report says $stated, re-derived $actual"
+    else
+        hit "SHAPE-4 $rid: report says $label=$stated, re-derived $actual"
+    fi
+done <<EOF
+$S4_ROWS
+EOF
+[ "$S4_N" -gt 0 ] || skip "SHAPE-4: no report claim is registered"
+
+# =======================================================================================
+# SHAPE 5 — the deliverable is there, the record that receives it is not
+# =======================================================================================
+# 判据: 无承接即命中. Every artifact file must be named by something that takes delivery
+# of it — a task or a ledger entry. A file nobody receives is a file nobody will notice
+# the loss of.
+#
+# ⚠️ The corpus is the two artifacts that carry delivery records, and the needle is the
+# BASENAME (a full path in the record is not required — records cite by name).
+echo "  [5] the deliverable is there, the record that receives it is not"
+
+S5_GLOBS="scripts/bash/*.sh
+tools/*.sh
+tools/*.md
+"
+S5_LEDGER="$BASE/specs/implement_issues.md"
+S5_TASKS="$BASE/specs/tasks.md"
+S5_N=0
+# ⚠️ With NEITHER index present the corpus is empty, and an empty corpus is not "nothing
+# receives it" — it is "there is no list of receivers". The first version of this check
+# reported every file as unclaimed in that state, which is a finding about the fixture
+# tree, not about the project (the same confusion the ledger's §0 guard exists to stop).
+S5_RECEIVERS=0
+for corpus in "$S5_TASKS" "$S5_LEDGER"; do [ -f "$corpus" ] && S5_RECEIVERS=$((S5_RECEIVERS + 1)); done
+if [ "$S5_RECEIVERS" -eq 0 ]; then
+    skip "SHAPE-5: not executable — neither tasks.md nor the ledger exists, so nothing can receive anything"
+    while IFS= read -r glob; do
+        [ -n "$glob" ] || continue
+        for f in $BASE/$glob; do [ -f "$f" ] && S5_N=$((S5_N + 1)); done
+    done <<EOF
+$S5_GLOBS
+EOF
+else
+while IFS= read -r glob; do
+    [ -n "$glob" ] || continue
+    for f in $BASE/$glob; do
+        [ -f "$f" ] || continue
+        S5_N=$((S5_N + 1))
+        name=$(basename "$f")
+        found=0
+        for corpus in "$S5_TASKS" "$S5_LEDGER"; do
+            [ -f "$corpus" ] || continue
+            if grep -qF "$name" "$corpus" 2>/dev/null; then found=1; fi
+        done
+        if [ "$found" = 1 ]; then
+            ok "SHAPE-5 $name: named by a task or a ledger entry"
+        else
+            hit "SHAPE-5 $name: no task and no ledger entry receives it"
+        fi
+    done
+done <<EOF
+$S5_GLOBS
+EOF
+fi
+[ "$S5_N" -gt 0 ] || skip "SHAPE-5: the registered globs matched no artifact — the scope is the finding"
+
+# =======================================================================================
+# SHAPE 6 — the criterion is voided by the way it is written
+# =======================================================================================
+# 判据: 判据恒真即命中. A criterion is only a criterion if there is an input on which it
+# says NO. Each registered criterion must therefore carry a REGISTERED falsifying case —
+# and the registry is checked against the fixture corpus, so "it has one" is a lookup, not
+# a recollection. A criterion with no falsifying case is reported as unproven; it is NOT
+# reported as sound, because an always-true criterion and an absent one read the same.
+echo "  [6] the criterion is voided by the way it is written"
+
+# ⚠️ The declared set is DERIVED from `run_qc_check()`'s own body, never hand-listed. A
+# hand-listed set fails by omission, and the omission is invisible: a criterion that was
+# added last week and given no falsifying case simply does not appear in the report — the
+# same "a list of this kind fails by omission" problem the parity suite solved by
+# comparing its covered set against the directory.
+S6_CARRIER="commands/specpro.qc.md"
+S6_DECLARED=$(extract_fence "$BASE/$S6_CARRIER" run_qc_check 2>/dev/null \
+    | grep -oE '^  check_[a-z0-9_]+' | sed 's/^  //' | sort -u || true)
+
+if [ -z "$S6_DECLARED" ]; then
+    skip "SHAPE-6: not executable — no criterion is declared in $S6_CARRIER's run_qc_check"
+else
+    # Every criterion the carrier declares must be exercised by a falsifying case.
+    unproven=""
+    unproven_n=0
+    while IFS= read -r fn; do
+        [ -n "$fn" ] || continue
+        cid=$(printf '%s' "$fn" | sed -E 's/^check_([a-z]+[0-9]+)_.*/\1/' | tr 'a-z' 'A-Z')
+        if ! printf '%s\n' "$CRITERIA" | grep -qE "^$cid\|"; then
+            unproven="$unproven $cid"
+            unproven_n=$((unproven_n + 1))
+            continue
+        fi
+        carrier=$(printf '%s\n' "$CRITERIA" | grep -E "^$cid\|" | head -1 | cut -d'|' -f2)
+        fn_name=$(printf '%s\n' "$CRITERIA" | grep -E "^$cid\|" | head -1 | cut -d'|' -f3)
+        verdict=$(run_criterion "$cid" "$carrier" "$fn_name" falsifying)
+        if [ $? -eq 2 ]; then
+            skip "SHAPE-6 $cid: not executable — the falsifying probe or the criterion is unreachable"
+        elif printf '%s' "$verdict" | grep -q '✗'; then
+            ok "SHAPE-6 $cid: judges fail on an input that falsifies it"
+        else
+            hit "SHAPE-6 $cid: did NOT judge fail on a falsifying input — always-true, or never ran"
+            printf '%s\n' "$verdict" | head -2 | sed 's/^/          /'
+        fi
+    done <<EOF
+$S6_DECLARED
+EOF
+    if [ "$unproven_n" -gt 0 ]; then
+        # ⚠️ Reported as ⊘ rather than ✗, and the distinction is deliberate: an unproven
+        # criterion has not been SHOWN to be always-true — there is simply no registered
+        # input that would tell the two apart. Folding it into the hit count would inflate
+        # the verdict with something nobody has measured; dropping it would hide it.
+        #
+        # ⚠️ **The next step belongs to a task that NAMES this file** (ISS-151). This line
+        # previously said the obligation was `T124`'s — and `T124` has no Location, so it
+        # could not write here; the duty had been assigned to a party without the right to
+        # discharge it, and the ⊘ would have pointed at a finished task forever. When this
+        # message appears, register or extend a task whose Location lists
+        # `scripts/bash/verify-shapes.sh` AND `scripts/powershell/verify-shapes.ps1`
+        # (both, or the parity suite fails — ISS-105).
+        unreceived "T124" "SHAPE-6: $unproven_n declared criterion(s) have no falsifying probe — unproven, not clean:$unproven"
+    fi
+fi
+
+# =======================================================================================
+# SHAPE 7 — self-witnessing (the evidence's producer is the judged implementation)
+# =======================================================================================
+# 判据: 自证即命中. Each row names an artifact whose assertions rest on a citation, and the
+# producer that citation must NOT be. When the only witness for a behaviour is the code
+# that implements it, a passing read proves that the two agree with each other.
+echo "  [7] self-witnessing (the evidence's producer is the judged implementation)"
+
+# ⚠️ **Only `Source:` citation LINES are examined — a mention is not a citation.**
+# The first version of this check matched the bare path anywhere in the artefact and duly
+# reported both contracts as self-witnessing. They are not: one says the implementation is
+# the contract's CARRIER, which is a statement of ownership, and the other names the
+# verifier as the ledger's authority, which is a statement about a checker. Reporting a
+# mention as a witness is TOOL-009's failure — 点名与提及不同形 — and it would have made
+# this detector fire on innocent files until a reader turned it off.
+S7_CITE='^[[:space:]]*>[[:space:]]*\**[Ss]ource\**[[:space:]]*[:：]'
+# ⚠️ A row whose subject is NOT the surface the contract judges would misfire, and one did:
+# `agent-registry.md` documents a VENDORED EXTERNAL library, so its Source: lines citing
+# `src/specify_cli/` are attributions to the thing it describes — correct by construction.
+# The row was wrong, not the check, and it is removed rather than the check loosened.
+S7_ROWS="
+dev-shellcheck-contract|specs/contracts/dev-shellcheck-tool.md|tools/verify-doc-shell\.sh
+ledger-contract|specs/contracts/ledger.md|scripts/bash/verify-ledger\.sh
+"
+S7_N=0
+while IFS='|' read -r aid afile subject; do
+    [ -n "${aid:-}" ] || continue
+    S7_N=$((S7_N + 1))
+    if [ ! -f "$BASE/$afile" ]; then
+        skip "SHAPE-7 $aid: not executable — artifact $afile is absent"
+        continue
+    fi
+    cites=$(grep -cE "$S7_CITE" "$BASE/$afile" 2>/dev/null || true)
+    : "${cites:=0}"
+    if [ "$cites" -eq 0 ]; then
+        unreceived "ISS-178" "SHAPE-7 $aid: not executable — $afile carries no Source: citation, so there is no evidence chain to audit"
+        continue
+    fi
+    selfwitness=$(grep -E "$S7_CITE" "$BASE/$afile" 2>/dev/null | grep -E "$subject" || true)
+    if [ -n "$selfwitness" ]; then
+        hit "SHAPE-7 $aid: a Source: line attributes the fact to the surface being judged"
+        printf '%s\n' "$selfwitness" | head -1 | cut -c1-120 | sed 's/^/          /'
+    else
+        ok "SHAPE-7 $aid: $cites Source: citation(s), none of them self-witnessing"
+    fi
+done <<EOF
+$S7_ROWS
+EOF
+[ "$S7_N" -gt 0 ] || skip "SHAPE-7: no artifact is registered"
+
+# =======================================================================================
+# SHAPE 8 — position decides ownership and there is no boundary sentinel
+# =======================================================================================
+# 判据: 无哨兵即命中. A structure where "where a row sits" decides which section owns it
+# needs a marker that makes an out-of-bounds placement VISIBLE — otherwise the misfiled
+# row still looks filed (the ledger's end-of-file sentinel is one instance of the
+# marker, not the whole class: a section-boundary assertion counts too, ISS-61).
+echo "  [8] position decides ownership and there is no boundary sentinel"
+
+# ⚠️ **The marker is a MARKER, matched by its form — not the phrase "end-of-file sentinel"
+# matched anywhere in the file.** The first version of this check looked for the phrase, and
+# `specs/checklists/requirements.md` line 33 carries it in a sentence that says the sentinel
+# is in the LEDGER and NOT in this file. The check read that sentence and reported the
+# sentinel as present — a literal match turned into a semantic conclusion, i.e. **shape 1
+# committed by the shape-1 detector**. The form below (`<!-- … sentinel…`) is the marker
+# itself, and prose about it no longer satisfies it.
+# ⚠️ **The marker FORM is declared per row, and the two carriers do not share one.** The
+# ledger's sentinel is the bare `-->` closer (`verify-ledger.sh` §1 reads `^-->$`); the
+# requirements checklist's is an `<!-- End-of-file sentinel: …` comment opener whose closer
+# is deliberately NOT alone on its line (the template says why). A single form would have
+# reported one of the two as sentinel-less — a finding about my regex, not about the repo.
+S8_ROWS="
+ledger|specs/implement_issues.md|^-->$
+requirements-checklist|specs/checklists/requirements.md|^[[:space:]]*<!--[[:space:]]*[Ee]nd-of-file sentinel
+"
+S8_N=0
+while IFS='|' read -r sid sfile marker; do
+    [ -n "${sid:-}" ] || continue
+    S8_N=$((S8_N + 1))
+    if [ ! -f "$BASE/$sfile" ]; then
+        skip "SHAPE-8 $sid: not executable — carrier $sfile is absent"
+        continue
+    fi
+    if grep -qE "$marker" "$BASE/$sfile" 2>/dev/null; then
+        ok "SHAPE-8 $sid: $sfile declares a boundary sentinel"
+    else
+        hit "SHAPE-8 $sid: $sfile owns rows by position and declares no boundary sentinel"
+    fi
+done <<EOF
+$S8_ROWS
+EOF
+[ "$S8_N" -gt 0 ] || skip "SHAPE-8: no position-owned structure is registered"
+
+# =======================================================================================
+# SHAPE 9 — a compatibility layer for a gap that is not there
+# =======================================================================================
+# 判据: 缺口不成立即命中. Each row names a compatibility layer and the gap it exists for;
+# the detection PROBES the gap. A layer whose reason has disappeared is not harmless — it
+# is a second path that the next reader must evaluate, and it will be kept up to date
+# forever by nobody.
+echo "  [9] a compatibility layer for a gap that is not there"
+
+S9_ROWS="
+create-new-feature|scripts/bash/create-new-feature.sh|commands/specpro.specify.md
+"
+S9_N=0
+while IFS='|' read -r lid lfile consumer; do
+    [ -n "${lid:-}" ] || continue
+    S9_N=$((S9_N + 1))
+    if [ ! -f "$BASE/$lfile" ]; then
+        skip "SHAPE-9 $lid: not executable — $lfile is absent (the layer may already be gone)"
+        continue
+    fi
+    if [ ! -f "$BASE/$consumer" ]; then
+        skip "SHAPE-9 $lid: not executable — the consumer named for the gap is absent"
+        continue
+    fi
+    if grep -qF "$(basename "$lfile" .sh)" "$BASE/$consumer" 2>/dev/null; then
+        ok "SHAPE-9 $lid: the gap is real — $consumer still calls it"
+    else
+        hit "SHAPE-9 $lid: $consumer no longer calls it — the gap it exists for is gone"
+    fi
+done <<EOF
+$S9_ROWS
+EOF
+[ "$S9_N" -gt 0 ] || skip "SHAPE-9: no compatibility layer is registered"
+
+# =======================================================================================
+# SHAPE 10 — a general rule that exists only as an instance
+# =======================================================================================
+# 判据: 缺一处即命中. A rule stated in some of the artifacts it governs is a rule whose
+# scope is decided by whoever last edited it. Each row declares the rule's OWN claimed
+# scope, and the detection requires the statement in every file of that scope.
+echo "  [10] a general rule that exists only as an instance"
+
+S10_ROWS="
+detect-then-ask|detect-then-ask|commands/specpro.implement.md commands/specpro.plan.md commands/specpro.tasks.md commands/specpro.test-plan.md commands/specpro.specify.md
+"
+S10_N=0
+while IFS='|' read -r rid statement scope; do
+    [ -n "${rid:-}" ] || continue
+    S10_N=$((S10_N + 1))
+    missing=""
+    seen=0
+    for f in $scope; do
+        [ -f "$BASE/$f" ] || continue
+        seen=$((seen + 1))
+        if ! grep -qi "$statement" "$BASE/$f" 2>/dev/null; then missing="$missing $f"; fi
+    done
+    if [ "$seen" -eq 0 ]; then
+        skip "SHAPE-10 $rid: not executable — none of the declared scope exists"
+    elif [ -n "$missing" ]; then
+        hit "SHAPE-10 $rid: stated in $((seen - $(echo $missing | wc -w | tr -d ' '))) of $seen declared files; missing:$missing"
+    else
+        ok "SHAPE-10 $rid: stated in all $seen files of its declared scope"
+    fi
+done <<EOF
+$S10_ROWS
+EOF
+[ "$S10_N" -gt 0 ] || skip "SHAPE-10: no rule is registered"
+
+# =======================================================================================
+# SHAPE 11 — the criterion's conclusion is not a function of its input
+# =======================================================================================
+# 判据: 结论不恒定即命中. The same input, run N times, MUST give the same answer. This is
+# the ISS-62 class: a `grep -q` that exits early leaves its writer with SIGPIPE, and under
+# `pipefail` the pipeline reports 141 — so a real finding appears and disappears between
+# runs. A non-deterministic criterion is worse than a missing one: it is a missing one
+# that occasionally reports.
+echo "  [11] the criterion's conclusion is not a function of its input"
+
+S11_ROWS="
+verify-ledger|scripts/bash/verify-ledger.sh
+"
+S11_N=0
+S11_RUNS=3
+while IFS='|' read -r cid runner; do
+    [ -n "${cid:-}" ] || continue
+    S11_N=$((S11_N + 1))
+    if [ ! -f "$BASE/$runner" ]; then
+        skip "SHAPE-11 $cid: not executable — runner $runner is absent"
+        continue
+    fi
+    first=""
+    varies=0
+    i=1
+    while [ "$i" -le "$S11_RUNS" ]; do
+        out=$(cd "$BASE" && bash "$runner" 2>&1)
+        if [ -z "$first" ]; then first="$out"; elif [ "$out" != "$first" ]; then varies=1; fi
+        i=$((i + 1))
+    done
+    if [ "$varies" = 1 ]; then
+        hit "SHAPE-11 $cid: $S11_RUNS runs on one input disagreed — the verdict is not a function of the input"
+    else
+        ok "SHAPE-11 $cid: $S11_RUNS runs on one input agreed"
+    fi
+done <<EOF
+$S11_ROWS
+EOF
+[ "$S11_N" -gt 0 ] || skip "SHAPE-11: no criterion runner is registered"
+
+# =======================================================================================
+# COVERAGE — the register and the detections must be the same set
+# =======================================================================================
+# 判据 (形态 4 applied to this file itself): the report states how many shapes were
+# checked, and that number MUST be re-derived — from the detections this file defines,
+# and from the REGISTER the claim is about.
+#
+# ⚠️ Why this block exists (`ISS-171` / `T211`): the verdict used to read
+# `shapes: 11 checked` — a LITERAL. Registering a 12th shape (in both carriers, so
+# pre-commit's own sync invariant still holds) produced `11 checked` and `rc=0`: a shape
+# with no detection at all, reported as completely covered. That is 形态 6's shape — the
+# step was there, but its verdict could not be anything but pass — and it is why `T132`,
+# whose whole job is "every registered shape has a detection", could not fail.
+#
+# ⚠️ One derived number, against the register — and it MUST be the register, not this
+# file's own count. Comparing the report only to its own detections would catch an edited
+# comment and nothing else; it is the REGISTER that the report makes a claim about.
+#
+# ⚠️ The marker is `# SHAPE n`, and it is the SAME regex on both implementations on purpose.
+# An earlier version counted the section-heading idiom instead, which is `echo "  [n] …" on
+# this side and `Write-Output "  [n] …"` on the PowerShell side — so the two sides counted
+# different things and the PowerShell half read 0. The parity suite caught it, and the fix
+# is to count the one marker both files actually share.
+echo "  [coverage] the register and the detections must be the same set"
+
+SELF="${BASH_SOURCE[0]}"
+SHAPES_CHECKED=$(count_of "$SELF" '^# SHAPE [0-9]+')
+REGISTER="$BASE/specs/plan.md"
+if [ ! -f "$REGISTER" ]; then
+    skip "COVERAGE: not executable — the shape register $REGISTER is absent, so 'every registered shape was checked' cannot be judged"
+else
+    SHAPES_REGISTERED=$(count_of "$REGISTER" '^\| \*\*[0-9]+\*\* \|')
+    if [ "$SHAPES_CHECKED" = "$SHAPES_REGISTERED" ]; then
+        ok "COVERAGE: $SHAPES_CHECKED detection(s) for $SHAPES_REGISTERED registered shape(s)"
+    else
+        hit "COVERAGE: the register declares $SHAPES_REGISTERED shape(s) but this file defines $SHAPES_CHECKED detection(s) — the difference has no detection"
+    fi
+fi
+
+# =======================================================================================
+# SHAPE 12 — a silence with no receiver
+# =======================================================================================
+# 判据 (`spec.md` → FR-047 登记表第 12 行 · `plan.md` → Constraint 7 第 12 行，照引不重推):
+# 一条**已登记**的检出，其作用域对某一**整类**对象为空（或全部为"不可行使"）；该 `⊘` 在
+# **任务与台账里都零承接**即命中。
+#
+# ⚠️ **承接的匹配是「条目形状」的，不是「关键词出现」的** (`TOOL-009`): the ledger's own
+# verifier already made this correction (`^- \[[x ]\] ISS-<N>:` rather than a full-text ID
+# search). ⚠️ And the weaker check would pass on THIS FILE'S OWN COMMENTARY — the comments
+# above name `T124` and `ISS-178` — which is the cleanest available demonstration that a
+# full-text match answers a different question.
+#
+# ⚠️ **What a pass does and does not prove**, stated because reading it as the stronger
+# claim would stop the search: it proves **the silences declared this run have receivers
+# that exist as entries**. It does NOT prove that every silence declared a receiver — that
+# judgement is made at the call site (`skip` vs `unreceived`) and is visible in the code,
+# not decidable here.
+echo "  [12] a silence with no receiver"
+
+S12_N=0
+if [ -n "$UNRECEIVED" ]; then
+    while IFS=$'\t' read -r rcv msg; do
+        [ -n "${msg:-}" ] || continue
+        S12_N=$((S12_N + 1))
+        if [ -z "$rcv" ]; then
+            hit "SHAPE-12: a silence names no receiver — $msg"
+            continue
+        fi
+        if receivers_exist "$rcv"; then
+            ok "SHAPE-12 $rcv: receives '$msg'"
+        else
+            hit "SHAPE-12 $rcv: names a receiver that is not an entry in tasks.md or the ledger — $msg"
+        fi
+    done <<EOF
+$UNRECEIVED
+EOF
+fi
+[ "$S12_N" -gt 0 ] || skip "SHAPE-12: no silence was declared this run — nothing to receive, so nothing is proven"
+
+
+# =======================================================================================
+# Constraint 7's detection column — a TWO-WAY map (`T222`)
+# =======================================================================================
+# 判据 (`plan.md` → Constraint 7 · `spec.md` → FR-047 形态 2 的判据, 照引不重推):
+# 那张表的**每一行**点名一处检出，而**每一处检出都要有一行点名它**。
+#
+# ⚠️ **本条补的是哪个缺口** (`ISS-192`): `S2_CLAIMS` · `S2_CONSUMER_ROWS` · `COVERAGE`
+# 三处**都在本文件内部自洽，没有一处读 `plan.md`**。而 `spec.md` 的判据**明确把检出方式
+# 的真源指给 `plan.md`** ⇒ 那张表**指不到任何东西时不报错**，且它自称是真源。
+#
+# 注册表一行三格: <形状号>|<该行的检出列里 MUST 出现的字串>|<本文件里 MUST 存在的字串>
+C7_ROWS="
+1|回归用例|SHAPE 1
+2|S2_CLAIMS|S2_CLAIMS
+3|全文反查|SHAPE 3
+4|重跑|SHAPE 4
+5|承接|SHAPE 5
+6|使该判据为假的输入|SHAPE 6
+7|生产者是不是被判定的实现本身|SHAPE 7
+8|边界哨兵|SHAPE 8
+9|缺口是否真实存在|SHAPE 9
+10|同一表述|SHAPE 10
+11|连跑 N 次|SHAPE 11
+12|有谁承接它|SHAPE 12
+"
+C7_PLAN="$BASE/specs/plan.md"
+C7_N=0
+if [ ! -f "$C7_PLAN" ]; then
+    skip "SHAPE-2 c7-table: not executable — $C7_PLAN is absent"
+else
+    while IFS='|' read -r num plan_tok script_tok; do
+        [ -n "${num:-}" ] || continue
+        C7_N=$((C7_N + 1))
+        # (a) 正向: Constraint 7 的该行存在, 且其检出列点名了 plan_tok
+        c7_row=$(grep -E "^\| \*\*${num}\*\* \|" "$C7_PLAN" | head -1)
+        if [ -z "$c7_row" ]; then
+            hit "SHAPE-2 c7-$num: Constraint 7 has no row for shape $num"
+            continue
+        fi
+        if ! printf '%s' "$c7_row" | grep -q "$plan_tok"; then
+            hit "SHAPE-2 c7-$num: the row's detection column does not name '$plan_tok'"
+            continue
+        fi
+        # (b) 该处检出 MUST 在本文件里真实存在
+        if ! grep -q "$script_tok" "$SELF" 2>/dev/null; then
+            hit "SHAPE-2 c7-$num: the row names a detection that does not exist here — '$script_tok'"
+            continue
+        fi
+        ok "SHAPE-2 c7-$num: names '$plan_tok' → '$script_tok' exists"
+    done <<EOF
+$C7_ROWS
+EOF
+    # (c) 反向: 三处计数必须相等 —— 表里的行数 · 注册表的行数 · 本文件里的形态段数。
+    # ⚠️ 少了这一半, "表里多一行而注册表没有" 与 "注册表多一行而表里没有" 都读不出来。
+    # ⚠️ **计数被约束在 `#### Constraint 7` 那一节之内** —— 数全文件的 `| **N** |` 行是
+    # 一个**当下恰好成立**的判据（实测：那 12 行全部落在该标题下），而任何**别处**新出现的
+    # 同形表格都会让它**静默**读成"表里多了一行"。锚在标题上才是它要问的那个集合。
+    c7_plan_rows=$(awk '/^#### Constraint 7/ {p=1; next} p && /^#### / {p=0} p && /^\| \*\*[0-9]+\*\* \|/ {n++} END {print n+0}' "$C7_PLAN" 2>/dev/null)
+    if [ "$c7_plan_rows" -ne "$C7_N" ]; then
+        hit "SHAPE-2 c7-table: Constraint 7 declares $c7_plan_rows row(s), this registry maps $C7_N"
+    fi
+    if [ "$SHAPES_CHECKED" -ne "$C7_N" ]; then
+        hit "SHAPE-2 c7-table: this file defines $SHAPES_CHECKED detection(s), this registry maps $C7_N"
+    fi
+    [ "$C7_N" -gt 0 ] || skip "SHAPE-2 c7-table: the registry is empty — nothing is proven"
+fi
+
+# =======================================================================================
+# `specs/audit/` — NO COMMAND MAY DECLARE IT (`T221`)
+# =======================================================================================
+# 判据 (`plan.md` → Pattern 7 的边界裁定 · `specs/contracts/dev-audit-tool.md`):
+# `specs/audit/` 下的产物**不属于任何命令** —— 它们的生产者是**维护者的人工轮次**
+# (三条理由见 Pattern 7: `writes:` 的载体是 frontmatter 而 `tools/*.md` 没有 /
+#  映射是随工具分发的产品规则而 `tools/` 不参与分发 / 本类产物不与任何命令竞争)。
+# ⇒ 任何命令的 `writes:` 里出现它即**越界**。
+#
+# ⚠️ 这条判据此前只写在 `plan.md` 与契约里、**标着 `⚠️ 评审级，非硬门`** —— 本条把它接上。
+C7_AUDIT_HITS=$(grep -rn 'artifact: specs/audit' "$BASE"/commands/*.md 2>/dev/null || true)
+if [ -n "$C7_AUDIT_HITS" ]; then
+    while IFS= read -r c7_line; do
+        [ -n "$c7_line" ] || continue
+        hit "SHAPE-2 audit-boundary: a command declares an artifact no command owns — $c7_line"
+    done <<EOF
+$C7_AUDIT_HITS
+EOF
+else
+    ok "SHAPE-2 audit-boundary: no command declares specs/audit/"
+fi
+
+# =======================================================================================
+# Verdict
+# =======================================================================================
+echo
+echo "shapes: $SHAPES_CHECKED checked · $OKS clean · $HITS hit · $SKIPS not executable"
+if [ "$HITS" -eq 0 ]; then
+    echo "✓ shapes: no registered shape has a live instance"
+    # ⚠️ 覆盖声明 (FR-050): a clean run means "no known instance among the registered
+    # subjects", never "the tool has no defect". The two are not the same claim, and the
+    # difference is entirely in the size of the registries above.
+    echo "  ⚠️ coverage: this is 'no known instance' for the registered subjects only."
+    echo "     It is NOT a statement that the tool is free of defects. $SKIPS subject group(s)"
+    echo "     could not be exercised at all, and each such group is unproven, not clean."
+    exit 0
+else
+    echo "✗ shapes: $HITS hit(s) — each one is a live instance of its shape"
+    echo "  ⚠️ FR-048: 消除以重跑检出成立，不以「已修」的声明。"
+    exit 1
+fi