W14: pin C1/C1b command-channel crash guards (test-only)

Pre-fix, one malformed or non-ASCII line on sx_server's top-level command
channel raised an uncaught Parse_error and killed the whole shared process
(bridges + conformance runners). dc7aa709 guards the parse; the server now
answers (error N "Malformed command line: ...") and keeps serving.

Add scripts/test-protocol-gate.sh: per case, spawn a fresh timeout-bounded
sx_server.exe (never touches a shared process) and assert the error
response, the follow-up epoch still evaluating, and a clean exit. Cases:
C1 unterminated list + garbage line, C1b non-ASCII byte (exact review
repros from plans/sx-review/hosts.md), plus a well-formed control. 4/4
green. Structured to grow into W14 section E's protocol fuzz suite (C3-C7).

Test-only: no semantics edits, no push.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

plans/agent-briefings/sx-gate-loop.md

@@ -52,7 +52,8 @@ Pin each confirmed-and-fixed finding with a minimal repro. Add suites to
       is K16 [W8], still OPEN — not a W14 pin target until its fix lands
 - [x] crit-2 [W1] — signal-return kont pinned NON-VACUOUSLY (side-effect
       sentinel across two tests; a plain assert would inherit the vacuity)
-- [ ] C1/C1b [W3] — HTTP-mode concurrency fixes, pin
+- [x] C1/C1b [W3] — command-channel crash guards pinned
+      (`scripts/test-protocol-gate.sh`, seed for section E's fuzz suite)
 - [ ] S4 [conformance] — housekeeping repro, pin
 
 ### B. Runner/production env unification
@@ -80,6 +81,16 @@ Pin each confirmed-and-fixed finding with a minimal repro. Add suites to
 
 ## Progress log (newest first)
 
+- 2026-07-04 — **C1/C1b command-channel pins (item A.6)**. These are
+  protocol-level, not .sx-suite pins: authored
+  `scripts/test-protocol-gate.sh` — each case spawns its OWN timeout-bounded
+  `sx_server.exe` (no shared process touched) and asserts three things: an
+  `(error N "Malformed command line: ...")` response is emitted, the
+  follow-up epoch still evaluates (process survived), and no `Fatal error`
+  escapes / exit is clean. Cases: C1 unterminated list (exact review repro),
+  C1 plain-garbage line, C1b non-ASCII byte (`café`), plus a well-formed
+  control session. 4/4 green. The script is deliberately structured to grow
+  into section E's fuzz suite (C3–C7). Test-only.
 - 2026-07-04 — **crit-2 non-vacuous pin (item A.5)**. The original bug's
   signature — handler value becomes the WHOLE program result, discarding
   every outer frame *including the covering test's own assert* — means a