W14: env-parity ledger — runner-only bindings vs fresh sx_server (test-only)

Section-B audit, all verified live over the epoch protocol. Runner-only
bindings absent from production: values, call-with-values (run_tests.ml
:1131/:1140), contains-char? (rt.ml:728 + rt.js:85), trim-right (JS runner
ONLY — absent even from the OCaml runner), sha3-256 (rt.ml:745 + rt.js:88;
production's real primitive is crypto-sha3-256).

Consequences pinned: (canonical-serialize 42) on a fresh server errors
"Undefined symbol: contains-char?" — content addressing broken for ANY
number outside the runners. And BOTH runners' sha3-256 are FAKE stubs
(OCaml: Hashtbl.hash), so every test-computed CID differs from production.

scripts/test-env-parity.sh is a bidirectional ledger: MUST_HAVE bindings
going missing fail; a KNOWN_DRIFT binding APPEARING also fails with
instructions to move it to MUST_HAVE and flip the consequence pin — the
ledger cannot rot silently in either direction. 7/7 green.

Test-only: no semantics edits, no push.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plans/agent-briefings/sx-gate-loop.md

@@ -59,9 +59,11 @@ Pin each confirmed-and-fixed finding with a minimal repro. Add suites to
       conformance — "housekeeping" was a mislabel from F-15's tag)
 
 ### B. Runner/production env unification
-- [ ] Audit runner-only bindings (`values`/`call-with-values` F7/K42, JS
-      fake sha3/equal?/apply/env-set! shims JS5) — inventory + failing pin
-      that a fresh `sx_server` reproduces the drift
+- [x] Audit runner-only bindings — inventory + bidirectional ledger in
+      `scripts/test-env-parity.sh` (KNOWN_DRIFT: values, call-with-values,
+      contains-char?, trim-right, sha3-256; consequence pin:
+      canonical-serialize broken on server; BOTH runners' sha3-256 are FAKE
+      stubs → test CIDs ≠ production CIDs)
 
 ### C. Harness honesty
 - [ ] K19 — MCP `mcp_tree.ml` harness primitive table drift vs `sx_primitives`
@@ -83,6 +85,20 @@ Pin each confirmed-and-fixed finding with a minimal repro. Add suites to
 
 ## Progress log (newest first)
 
+- 2026-07-04 — **Section B: env-parity audit + ledger**. Probed a fresh
+  `sx_server` over the epoch protocol (`deps-check` + live eval). Confirmed
+  runner-only drift: `values`/`call-with-values` (run_tests.ml:1131/1140),
+  `contains-char?` (rt.ml:728 + rt.js:85), `trim-right` (**JS runner only**
+  — absent even from the OCaml runner), `sha3-256` (rt.ml:745 + rt.js:88).
+  Consequence verified live: `(canonical-serialize 42)` on the server →
+  `Undefined symbol: contains-char?` (content addressing broken for ANY
+  number outside the runners). **Worse than the finding**: BOTH runners'
+  `sha3-256` are FAKE stubs (OCaml uses `Hashtbl.hash`!) while production
+  has real `crypto-sha3-256` — every CID computed in tests differs from
+  production CIDs. Authored `scripts/test-env-parity.sh` as a bidirectional
+  ledger: MUST_HAVE regressions fail; a KNOWN_DRIFT binding *appearing*
+  also fails (forces ledger + consequence-pin update when W5/W7/W12 land
+  fixes). 7/7 green. Test-only.
 - 2026-07-04 — **S4 error-page-cache pin (item A.7) — section A COMPLETE**.
   Extended `scripts/test-protocol-gate.sh` with an HTTP-mode case: fresh
   `sx_server.exe --http <random-port>` (timeout-bounded, own PID killed at