@deftai/directive-core 0.107.0 → 0.109.0

package/dist/hooks/dispatcher.js

@@ -1,6 +1,7 @@
 import { lstatSync, realpathSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { appendAuthzAudit, classifyHookAuthzOps, evaluateAuthzMutation, evidenceSatisfiesImplementationApproval, listActiveHumanGrants, loadAuthzStateResult, markGrantUsed, shouldConsumeSingleUseGrant, utcIso, } from "../authz/index.js";
+import { runningInsideDeftRepo } from "../doctor/paths.js";
 import { assertProjectionContained, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { hasArtifactSuffix } from "../layout/resolve.js";
 import { detectDeftDirectiveDisable, formatDeftDirectiveDisableMessage, isDeftDirectiveDisableActive, } from "../policy/deft-directive-disable.js";
@@ -9,21 +10,23 @@ import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRE
 import { classifyMcpTool, DEFAULT_RUNTIME_AUTHORITY_POLICY, evaluateRuntimeAuthorityDirectWrite, evaluateRuntimeAuthorityShellOp, listShellOps, loadRuntimeAuthorityFromProject, } from "../policy/runtime-authority.js";
 import { loadStoryWriteFenceFromPath, resolveWriteFence } from "../policy/write-fence.js";
 import { appendSoftAgentsRebindToMessage, decisionCarriesSoftAgentsRebind, formatSoftAgentsRebindChecklist, } from "../session/compact-ritual.js";
-import { detectBranch } from "../session/git.js";
+import { defaultGitRunner, detectBranch, existingAncestorDir, gitCommonDir, memoizeGitRunner, worktreePathOrNull, } from "../session/git.js";
 import { evaluateOccupancyWriteGate } from "../session/occupancy.js";
 import { emitSessionRitualBlockedProcessCost } from "../session/process-cost.js";
 import { markRitualStaleAfterCompact } from "../session/ritual-sentinel.js";
 import { runSessionStartHookWrite } from "../session/session-start-hook.js";
-import { formatRitualRecoveryInstruction, verifySessionRitual, writeGateRitualOptions, } from "../session/verify-session-ritual.js";
-import { hookMcpArgsText, hookShellCommand, hookToolName, hookWriteTargetPath, missingToolNameMessage, record, } from "./classify/index.js";
-import { classifyProductDestForms, payloadWithInjectedWriteTarget } from "./dest-form.js";
+import { formatRitualRecoveryInstruction, inspectSessionRitual, verifySessionRitual, WRITE_GATED_REQUIRED_STEPS, writeGateRitualOptions, } from "../session/verify-session-ritual.js";
+import { hookApplyPatchBodyPaths, hookApplyPatchBodyText, hookMcpArgsText, hookMutationTargetPaths, hookShellCommand, hookToolName, hookWriteTargetPath, hostIdentityFallsBackToExplicitOwner, inspectExactLifecycleCommand, missingToolNameMessage, record, resolveHookHostIdentity, rewriteExactLifecycleCommand, toolInputRecord, } from "./classify/index.js";
+import { classifyGitDestructive, classifyProductDestForms, payloadWithInjectedWriteTarget, } from "./dest-form.js";
+import { appendGitDestructiveRecord, GIT_DESTRUCTIVE_LOG_ENV } from "./git-destructive-log.js";
 import { isAssistPosture, isEphemeralSpawn, isExploreSpawn, isReadOnlyHookContext, } from "./readonly.js";
 import { inspectActiveScope } from "./scope.js";
+import { classifyShellWriteTargets, isInRepoShellWritePath } from "./shell-write-targets.js";
 import { isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool } from "./tools.js";
 // Pure parse/classify helpers are defined in ./classify/ and re-exported from
 // ./index.ts (#2950). Dispatcher is orchestration: classify → policy → decision.
 export { ASSIST_SESSION_POSTURE_ENV, hookReadOnlyFromPayload, isAssistPosture, isEphemeralSpawn, isExploreSpawn, isReadOnlyHookContext, } from "./readonly.js";
-export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, GROK_MUTATION_TOOL_CATALOG, GROK_NON_MUTATION_TOOLS, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, matcherHasLiteralToken, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
 export const HOOK_HOSTS = ["claude", "grok", "cursor", "codex"];
 export const HOOK_EVENTS = ["session.start", "session.compact", "tool.before"];
 /** Hosts that receive compact/resume hook deposits via init/update (#2113). */
@@ -103,6 +106,66 @@ export function isProposedLifecycleWrite(projectRoot, targetPath) {
         return false;
     return posix.startsWith("xbrief/proposed/") || posix.startsWith("vbrief/proposed/");
 }
+/**
+ * ApplyPatch body present but no mutation header could be classified.
+ * Fail closed rather than authorizing the declared path alone (#3614).
+ */
+function applyPatchBodyUnclassified(payload) {
+    const text = hookApplyPatchBodyText(payload);
+    return text !== null && hookApplyPatchBodyPaths(payload).length === 0;
+}
+/**
+ * Proposed-lifecycle exemption is universally quantified over every mutated
+ * path, not the declared write target alone (#3614).
+ */
+function allMutationTargetsAreProposedLifecycleWrites(projectRoot, payload) {
+    if (applyPatchBodyUnclassified(payload))
+        return false;
+    const targets = hookMutationTargetPaths(payload);
+    if (targets.length === 0)
+        return false;
+    return targets.every((target) => isProposedLifecycleWrite(projectRoot, target));
+}
+function authzForMutationTargets(input, toolName, seams, options) {
+    const targets = hookMutationTargetPaths(input.payload);
+    const paths = targets.length > 0 ? targets : [null];
+    const pendingConsume = [];
+    for (const target of paths) {
+        const relPath = target !== null ? toProjectRelativePosix(options.projectRoot, target) : null;
+        const denied = authzForMutation(input, toolName, seams, {
+            isDirectWrite: options.isDirectWrite,
+            relPath,
+            scopePath: options.scopePath,
+            runGit: options.runGit,
+            consumeSingleUse: false,
+            pendingConsume,
+        });
+        if (denied !== null)
+            return denied;
+    }
+    const seen = new Set();
+    for (const ref of pendingConsume) {
+        if (seen.has(ref))
+            continue;
+        seen.add(ref);
+        try {
+            markGrantUsed(options.projectRoot, ref);
+        }
+        catch {
+            // Persistence failure must not flip allow after a successful check.
+        }
+    }
+    return null;
+}
+function allMutationTargetsAreAssistScratch(projectRoot, payload, environ) {
+    if (applyPatchBodyUnclassified(payload))
+        return false;
+    const targets = hookMutationTargetPaths(payload);
+    if (targets.length === 0) {
+        return isAssistScratchWrite(projectRoot, hookWriteTargetPath(payload), payload, environ);
+    }
+    return targets.every((target) => isAssistScratchWrite(projectRoot, target, payload, environ));
+}
 /**
  * Canonical + gitignored assist scratch roots for low-ceremony disposable notes (#1802).
  * Path fence only — not free-text "for Obsidian" NLP. Tracked trees (src/, packages/, …)
@@ -193,8 +256,8 @@ export function isAssistScratchWrite(projectRoot, targetPath, payload, environ =
         return true;
     return false;
 }
-function isWindowsDriveOnlyRoot(value) {
-    return /^[A-Za-z]:[/\\]?$/.test(value.trim());
+function isWindowsDriveOnlyRoot(value, platform = process.platform) {
+    return platform === "win32" && /^[A-Za-z]:[/\\]?$/.test(value.trim());
 }
 function hookPayloadRootCandidates(input) {
     const candidates = [];
@@ -250,22 +313,113 @@ export function projectRootFromHookPayload(payload, fallback) {
     }
     return fallbackResolved;
 }
+/** Interpolate both roots so a deny names the tree that was judged (#3794). */
+export function formatHookRootNote(payloadRoot, effectiveRoot) {
+    return `payloadRoot=${payloadRoot} effectiveRoot=${effectiveRoot}`;
+}
+function admitPayload(payload, candidate) {
+    return { root: payload, foreign: false, candidate, refusal: null };
+}
+/**
+ * Admit the Git toplevel of the write target only when it shares
+ * `--git-common-dir` with `payloadRoot`.
+ *
+ * Identity resolves to one of three outcomes, not two. A `payloadRoot` that is
+ * not a Git repository never posed a containment question, so it keeps today's
+ * payloadRoot gating. A `payloadRoot` that *is* a repository, paired with a
+ * target that resolved to some other toplevel whose identity cannot be read, is
+ * a question asked and left unanswered — that fails closed rather than
+ * inheriting payloadRoot's occupancy and ritual state (#3794).
+ */
+export function admitEffectiveHookRoot(payloadRoot, writeTarget, runGit) {
+    const payload = normalizeHookProjectRoot(payloadRoot);
+    if (writeTarget === null)
+        return admitPayload(payload, null);
+    const ancestor = existingAncestorDir(writeTarget);
+    if (ancestor === null)
+        return admitPayload(payload, null);
+    const candidateRaw = worktreePathOrNull(ancestor, runGit);
+    if (candidateRaw === null)
+        return admitPayload(payload, null);
+    const candidate = normalizeHookProjectRoot(candidateRaw);
+    if (candidate === payload)
+        return admitPayload(payload, candidate);
+    const payloadCommon = gitCommonDir(payload, runGit);
+    if (payloadCommon === null) {
+        // No containment question exists: payloadRoot is not a repository, so there
+        // is no boundary for the target to be inside or outside of. Denying here
+        // would invent a class this defect never had.
+        return admitPayload(payload, candidate);
+    }
+    const candidateCommon = gitCommonDir(candidate, runGit);
+    if (candidateCommon === null) {
+        return { root: payload, foreign: true, candidate, refusal: "unproven-identity" };
+    }
+    if (normalizeHookProjectRoot(payloadCommon) === normalizeHookProjectRoot(candidateCommon)) {
+        return { root: candidate, foreign: false, candidate, refusal: null };
+    }
+    return { root: payload, foreign: true, candidate, refusal: "foreign-repository" };
+}
+/**
+ * Admit every mutation target and require one effectiveRoot. A refused member
+ * short-circuits; a span of two admitted worktrees is also refused so
+ * occupancy/ritual cannot follow only the declared ApplyPatch path (#3794).
+ */
+export function admitMutationTargetSet(payloadRoot, targets, runGit) {
+    const payload = normalizeHookProjectRoot(payloadRoot);
+    if (targets.length === 0)
+        return admitPayload(payload, null);
+    const admitted = [];
+    for (const target of targets) {
+        const next = admitEffectiveHookRoot(payload, target, runGit);
+        if (next.foreign)
+            return next;
+        admitted.push(next);
+    }
+    const roots = [...new Set(admitted.map((item) => item.root))];
+    if (roots.length > 1) {
+        return {
+            root: payload,
+            foreign: true,
+            candidate: roots.join(" | "),
+            refusal: "worktree-span",
+        };
+    }
+    return admitted[0] ?? admitPayload(payload, null);
+}
 export function isHookHost(value) {
     return HOOK_HOSTS.includes(value);
 }
 export function isHookEvent(value) {
     return HOOK_EVENTS.includes(value);
 }
-function scopeNotReadyCoverageHint(toolName) {
+/**
+ * Coverage sentence appended to a scope-not-ready deny.
+ *
+ * #3828: this used to claim Shell dest-form coverage unconditionally. Coverage
+ * is opt-in (`plan.policy.runtimeAuthority.shellDestForms: "enforce"`) and the
+ * default is `off`, so on a default-policy repository the sentence advertised a
+ * fence that was not there and, by naming `python -c` as the exception, implied
+ * the gap was a sliver rather than the whole Shell surface. State the coverage
+ * actually in force.
+ */
+function scopeNotReadyCoverageHint(toolName, shellDestFormsEnforced) {
     if (isSpawnTool(toolName))
         return "";
     if (isShellTool(toolName)) {
         return (" This deny is the active-scope write gate on a recognized Shell dest-form " +
             "(git checkout --, git restore, rm/rmdir of in-repo paths).");
     }
-    return (" This gate covers direct-write tools (Edit/Write) and implementation spawn, " +
-        "plus recognized Shell dest-forms (git checkout --, git restore, rm/rmdir). " +
-        "Other shell (python -c, cmd /c copy, git status) is not this deny.");
+    if (shellDestFormsEnforced) {
+        return (" This gate covers direct-write tools (Edit/Write), implementation spawn, and " +
+            "recognized Shell dest-forms (git checkout --, git restore, rm/rmdir), because " +
+            "plan.policy.runtimeAuthority.shellDestForms is enforce. Shell whose target " +
+            "cannot be resolved to a product path stays outside this deny.");
+    }
+    return (" This gate covers direct-write tools (Edit/Write) and implementation spawn. " +
+        "plan.policy.runtimeAuthority.shellDestForms is off (the default), so no Shell " +
+        "command is covered by this deny -- reaching for one to get around it defeats " +
+        "the gate rather than satisfying it.");
 }
 function deny(input, code, toolName, message, scopePath = null) {
     return {
@@ -279,8 +433,56 @@ function deny(input, code, toolName, message, scopePath = null) {
         scopePath,
     };
 }
-function runtimeAuthorityForDirectWrite(input, toolName, seams, scopePath) {
+/**
+ * Resolve the cooperative actor presented to the occupancy gate.
+ * A resolved host identity is authoritative; ambient identity may only
+ * corroborate. Hosts whose identity source is the hook environment fall back to
+ * the explicit owner flow when that variable is absent (#3873).
+ */
+function resolveMutationActor(input, environ) {
+    const hostIdentity = resolveHookHostIdentity(input.host, input.payload, environ);
+    const environmentId = environ.DEFT_SESSION_ID?.trim() || undefined;
+    if (hostIdentity.status === "unsupported" ||
+        hostIdentityFallsBackToExplicitOwner(input.host, hostIdentity)) {
+        return {
+            sessionId: environmentId,
+            issue: null,
+            message: null,
+            hostAuthoritative: false,
+        };
+    }
+    if (hostIdentity.status === "ok" && hostIdentity.sessionId !== null) {
+        if (environmentId !== undefined && environmentId !== hostIdentity.sessionId) {
+            return {
+                sessionId: hostIdentity.sessionId,
+                issue: "conflict",
+                message: `Host owner ${hostIdentity.sessionId} conflicts with ` +
+                    `DEFT_SESSION_ID ${environmentId}.`,
+                hostAuthoritative: true,
+            };
+        }
+        return {
+            sessionId: hostIdentity.sessionId,
+            issue: null,
+            message: null,
+            hostAuthoritative: true,
+        };
+    }
+    return {
+        sessionId: undefined,
+        issue: hostIdentity.status === "conflict" ? "conflict" : "unavailable",
+        message: hostIdentity.message,
+        hostAuthoritative: true,
+    };
+}
+function runtimeAuthorityForDirectWrite(input, toolName, seams, scopePath, effectiveRoot) {
+    // #3794 commit 2: the project runtimeAuthority layer is project-level
+    // authorization config and stays on payloadRoot, alongside authz. Only the
+    // story fence and the path it is matched against follow the tree the write
+    // lands in, so a story `file_scope` of `packages/**` still matches a write
+    // inside a linked worktree rather than `.deft-scratch/worktrees/<x>/packages/`.
     const projectRoot = resolve(input.projectRoot);
+    const fenceRoot = resolve(effectiveRoot);
     // Project policy load failure: treat as disabled project layer, still apply
     // independent story file_scope when present (#516 / #2443 Greptile P1).
     let basePolicy = DEFAULT_RUNTIME_AUTHORITY_POLICY;
@@ -296,7 +498,7 @@ function runtimeAuthorityForDirectWrite(input, toolName, seams, scopePath) {
     let storyFence;
     try {
         storyFence = seams.loadStoryWriteFence
-            ? seams.loadStoryWriteFence(projectRoot, scopePath)
+            ? seams.loadStoryWriteFence(fenceRoot, scopePath)
             : loadStoryWriteFenceFromPath(scopePath);
     }
     catch {
@@ -309,15 +511,28 @@ function runtimeAuthorityForDirectWrite(input, toolName, seams, scopePath) {
     // Neither layer active → allow (same as disabled runtimeAuthority historically).
     if (!fence.fenceActive)
         return null;
-    const writeTarget = hookWriteTargetPath(input.payload);
-    const relPath = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
-    const verdict = evaluateRuntimeAuthorityDirectWrite({
-        policy: fence.policy,
-        relPathPosix: relPath,
-    });
-    if (verdict.allowed)
-        return null;
-    return deny(input, verdict.code ?? "runtime-policy-deny-path", toolName, verdict.reason ?? "Directive denied this direct write under write fence policy.", scopePath);
+    // #3794: relPath is now measured from the tree the write lands in. When that
+    // differs from the payload root, a bare "outside file_scope" reason does not
+    // say which tree the fence was relativised against.
+    const fenceRootNote = fenceRoot === projectRoot ? "" : ` ${formatHookRootNote(projectRoot, fenceRoot)}`;
+    if (applyPatchBodyUnclassified(input.payload)) {
+        return deny(input, "runtime-policy-deny-path", toolName, "Directive denied this direct write: apply_patch body named no classifiable mutation target, so the write fence cannot authorize it." +
+            fenceRootNote, scopePath);
+    }
+    const targets = hookMutationTargetPaths(input.payload);
+    const toCheck = targets.length > 0 ? targets : [null];
+    for (const target of toCheck) {
+        const relPath = target !== null ? toProjectRelativePosix(fenceRoot, target) : null;
+        const verdict = evaluateRuntimeAuthorityDirectWrite({
+            policy: fence.policy,
+            relPathPosix: relPath,
+        });
+        if (!verdict.allowed) {
+            return deny(input, verdict.code ?? "runtime-policy-deny-path", toolName, (verdict.reason ?? "Directive denied this direct write under write fence policy.") +
+                fenceRootNote, scopePath);
+        }
+    }
+    return null;
 }
 function loadAuthzContext(projectRoot, seams) {
     if (seams.loadAuthzState !== undefined) {
@@ -380,6 +595,8 @@ function recordAuthzAudit(projectRoot, decision, state, seams) {
  * Composes before runtimeAuthority path/scope checks for direct writes and shell/MCP.
  */
 function authzForMutation(input, toolName, seams, options) {
+    // #3794: grant scoping and the authz audit trail stay on payloadRoot.
+    // Re-pointing would break exact-string UAT grants and shard the audit file.
     const projectRoot = resolve(input.projectRoot);
     let state;
     let grants;
@@ -413,7 +630,7 @@ function authzForMutation(input, toolName, seams, options) {
     // Structural context for bound grants (branch from git; repo optional env).
     let branch = null;
     try {
-        branch = detectBranch(projectRoot);
+        branch = detectBranch(projectRoot, options.runGit);
     }
     catch {
         branch = null;
@@ -436,12 +653,17 @@ function authzForMutation(input, toolName, seams, options) {
         }
         // Consume single-use grants after allow (persist usedAt).
         if (shouldConsumeSingleUseGrant(decision) && decision.humanApprovalRef !== null) {
-            try {
-                markGrantUsed(projectRoot, decision.humanApprovalRef);
+            if (options.consumeSingleUse === false) {
+                options.pendingConsume?.push(decision.humanApprovalRef);
             }
-            catch {
-                // Persistence failure must not flip allow → deny after a successful check;
-                // next load will still see unused if write failed (prefer allow-once risk over deadlock).
+            else {
+                try {
+                    markGrantUsed(projectRoot, decision.humanApprovalRef);
+                }
+                catch {
+                    // Persistence failure must not flip allow → deny after a successful check;
+                    // next load will still see unused if write failed (prefer allow-once risk over deadlock).
+                }
             }
         }
     }
@@ -552,23 +774,48 @@ function decideShellOrMcpRuntimeAuthority(input, toolName, seams) {
     };
 }
 function inspectMutationGates(input, toolName, seams, options) {
-    const projectRoot = resolve(input.projectRoot);
+    // payloadRoot stays authoritative for authz grant scoping, the authz audit
+    // trail, the kill-switch, the #2885 outside-root carve-out, and
+    // deny().projectRoot. effectiveRoot governs occupancy and ritual (commit 1),
+    // and active scope, the story write fence and assist-scratch (commit 2).
+    const payloadRoot = resolve(input.projectRoot);
+    const projectRoot = payloadRoot;
     const environ = input.environ ?? process.env;
+    const dispatchGit = memoizeGitRunner(seams.ritualRunGit ?? defaultGitRunner);
+    const mutationTargets = isSpawnTool(toolName) ? [] : hookMutationTargetPaths(input.payload);
+    const admission = isSpawnTool(toolName)
+        ? { root: payloadRoot, foreign: false, candidate: null, refusal: null }
+        : admitMutationTargetSet(payloadRoot, mutationTargets, dispatchGit);
+    const effectiveRoot = admission.root;
+    const rootsNote = ` ${formatHookRootNote(payloadRoot, effectiveRoot)}`;
+    if (admission.foreign) {
+        const candidate = admission.candidate ?? "<none>";
+        const reason = admission.refusal === "worktree-span"
+            ? `write targets span more than one Git worktree (candidate=${candidate}).`
+            : admission.refusal === "unproven-identity"
+                ? `write target resolved to a separate Git working tree whose repository ` +
+                    `identity could not be read, so containment is unproven (candidate=${candidate}).`
+                : `write target is in a different Git repository ` +
+                    `than the hook payload root (candidate=${candidate}).`;
+        return deny(input, "foreign-repository-deny", toolName, `Directive denied ${toolName}: ${reason}${rootsNote}`);
+    }
     // Assist/scratch low-ceremony writes (#1802): allowlisted gitignored roots under
     // assist/ephemeral classification skip ritual + active-scope (no fake scope:activate).
     // Tracked product paths never match the path fence. Read-only still denied upstream.
     if (!isSpawnTool(toolName)) {
-        const scratchTarget = hookWriteTargetPath(input.payload);
-        if (isAssistScratchWrite(projectRoot, scratchTarget, input.payload, environ)) {
-            const relPath = scratchTarget !== null ? toProjectRelativePosix(projectRoot, scratchTarget) : null;
-            const authzDeny = authzForMutation(input, toolName, seams, {
+        // #3794 commit 2: classify against effectiveRoot. Relative to payloadRoot every
+        // file in a `.deft-scratch/worktrees/<x>/` worktree read as assist scratch, so
+        // assist/ephemeral worktree writes skipped ritual, occupancy and scope entirely.
+        if (allMutationTargetsAreAssistScratch(effectiveRoot, input.payload, environ)) {
+            const authzDeny = authzForMutationTargets(input, toolName, seams, {
                 isDirectWrite: true,
-                relPath,
                 scopePath: null,
+                runGit: dispatchGit,
+                projectRoot,
             });
             if (authzDeny !== null)
                 return authzDeny;
-            const runtimeDeny = runtimeAuthorityForDirectWrite(input, toolName, seams, null);
+            const runtimeDeny = runtimeAuthorityForDirectWrite(input, toolName, seams, null, effectiveRoot);
             if (runtimeDeny !== null)
                 return runtimeDeny;
             return {
@@ -586,6 +833,72 @@ function inspectMutationGates(input, toolName, seams, options) {
             };
         }
     }
+    const actor = isSpawnTool(toolName) ? null : resolveMutationActor(input, environ);
+    const occupancyGate = isSpawnTool(toolName)
+        ? {
+            allow: true,
+            message: null,
+            occupant: null,
+            admitted: null,
+        }
+        : evaluateOccupancyWriteGate(effectiveRoot, {
+            sessionId: actor?.sessionId,
+            // Hosts with a resolved owner must not fall back to a stale ambient one.
+            env: actor?.hostAuthoritative === true ? {} : environ,
+        });
+    // #3769: occupancy decides before any ritual persist. The gated verifier
+    // executes agent_hooks and rebinds a forward HEAD, and both rewrite
+    // .deft/ritual-state.json — so verifying first let a session this gate was
+    // about to deny rewrite the occupant's record. The deny paths below read the
+    // ritual through the no-write inspect, which runs no step and never rebinds;
+    // only a session occupancy would admit reaches the verifier.
+    //
+    // Ritual detail on an occupancy deny is telemetry and message decoration, so
+    // an inspect failure must not convert an occupancy verdict into a ritual one.
+    const ritualDetailForOccupancyDeny = () => {
+        try {
+            return (seams.inspectRitual ??
+                seams.verifyRitual ??
+                ((root) => inspectSessionRitual(root, {
+                    tier: "gated",
+                    posture: "mutation",
+                    runGit: dispatchGit,
+                    requiredGatedSteps: WRITE_GATED_REQUIRED_STEPS,
+                })))(effectiveRoot);
+        }
+        catch {
+            return null;
+        }
+    };
+    if (occupancyGate.occupant !== null && actor?.issue !== null && actor !== null) {
+        const inspected = ritualDetailForOccupancyDeny();
+        const code = actor.issue === "conflict" ? "occupancy-identity-conflict" : "occupancy-identity-unavailable";
+        const detail = actor.message ??
+            "The host did not supply a usable cooperative session/conversation identity.";
+        emitSessionRitualBlockedProcessCost({
+            toolName,
+            code,
+            recoveryTier: inspected?.recoveryTier === "rearm" ? "rearm" : "cold",
+            detail,
+        }, { projectRoot });
+        return deny(input, code, toolName, `Directive denied ${toolName}: ${detail} A live occupancy lease exists for ` +
+            `session ${occupancyGate.occupant.sessionId}; use an exact host-mediated lifecycle ` +
+            "command or pass the matching --session-id explicitly." +
+            rootsNote);
+    }
+    if (!occupancyGate.allow && occupancyGate.message !== null) {
+        const inspected = ritualDetailForOccupancyDeny();
+        const ritualNote = inspected !== null && inspected.code !== 0
+            ? ` Also ritual-not-ready: ${inspected.message}`
+            : "";
+        emitSessionRitualBlockedProcessCost({
+            toolName,
+            code: "occupancy-occupied",
+            recoveryTier: inspected?.recoveryTier === "rearm" ? "rearm" : "cold",
+            detail: occupancyGate.message,
+        }, { projectRoot });
+        return deny(input, "occupancy-occupied", toolName, `Directive denied ${toolName}: ${occupancyGate.message}${ritualNote}${rootsNote}`);
+    }
     let ritual;
     try {
         // Mutation dispatch is a live gated boundary: active verification reruns
@@ -600,8 +913,8 @@ function inspectMutationGates(input, toolName, seams, options) {
                 bypass: false,
                 runner: seams.ritualRunner,
                 detectWorkSelection: seams.detectWorkSelection,
-                runGit: seams.ritualRunGit,
-            }))))(projectRoot);
+                runGit: dispatchGit,
+            }))))(effectiveRoot);
     }
     catch (cause) {
         // #2994: best-effort local process-cost; never changes deny verdict.
@@ -612,20 +925,36 @@ function inspectMutationGates(input, toolName, seams, options) {
             detail: `inspect threw: ${String(cause)}`,
         }, { projectRoot });
         return deny(input, "ritual-not-ready", toolName, `Directive could not inspect the gated session ritual: ${String(cause)}. ` +
-            formatRitualRecoveryInstruction("cold"));
-    }
-    const occupancyGate = isSpawnTool(toolName)
-        ? { allow: true, message: null, occupant: null }
-        : evaluateOccupancyWriteGate(projectRoot, { env: environ });
-    if (!occupancyGate.allow && occupancyGate.message !== null) {
-        const ritualNote = ritual.code !== 0 ? ` Also ritual-not-ready: ${ritual.message}` : "";
-        emitSessionRitualBlockedProcessCost({
-            toolName,
-            code: "occupancy-occupied",
-            recoveryTier: ritual.recoveryTier === "rearm" ? "rearm" : "cold",
-            detail: occupancyGate.message,
-        }, { projectRoot });
-        return deny(input, "occupancy-occupied", toolName, `Directive denied ${toolName}: ${occupancyGate.message}${ritualNote}`);
+            formatRitualRecoveryInstruction("cold") +
+            rootsNote);
+    }
+    if (occupancyGate.occupant !== null && actor !== null) {
+        // A granted member writes under the owner's ceremony (#3755). Ritual state
+        // is single-owner and a child cannot bind its own while the owner's lease is
+        // live, so requiring the writer's own binding would make every admitted
+        // member's write unreachable — the grant would authorize nothing. What is
+        // checked instead is the identity that issued the grant: the tree's exact
+        // verified ritual owner must be the occupant whose lease admits this member.
+        const expectedOwner = occupancyGate.admitted === "member" ? occupancyGate.occupant.sessionId : actor.sessionId;
+        const verifiedOwner = ritual.boundSessionId;
+        const ritualOwnerMismatch = expectedOwner !== undefined &&
+            (verifiedOwner !== undefined ? verifiedOwner !== expectedOwner : ritual.code === 0);
+        if (ritualOwnerMismatch) {
+            const detail = verifiedOwner === undefined
+                ? "gated ritual verification returned ready without an exact bound owner"
+                : `exact verified ritual owner ${verifiedOwner} differs from host/lease owner ${expectedOwner}`;
+            emitSessionRitualBlockedProcessCost({
+                toolName,
+                code: "occupancy-ritual-mismatch",
+                recoveryTier: ritual.recoveryTier === "rearm" ? "rearm" : "cold",
+                detail,
+            }, { projectRoot });
+            return deny(input, "occupancy-ritual-mismatch", toolName, `Directive denied ${toolName}: ${detail}. ` +
+                "Run `deft session:start --rearm --session-id=<same-session-id>` when re-arm is eligible; " +
+                "otherwise run `deft session:start --session-id=<same-session-id>` for a cold ceremony. " +
+                "Intermediate lease/ritual mismatches fail closed." +
+                rootsNote);
+        }
     }
     if (ritual.code !== 0) {
         // #2992: prefer re-arm recovery when age/compact stale; cold when bind invalid.
@@ -637,23 +966,73 @@ function inspectMutationGates(input, toolName, seams, options) {
             recoveryTier,
             detail: ritual.message,
         }, { projectRoot });
-        return deny(input, "ritual-not-ready", toolName, `Directive denied ${toolName}: ${ritual.message} ${formatRitualRecoveryInstruction(recoveryTier)}`);
-    }
+        return deny(input, "ritual-not-ready", toolName, `Directive denied ${toolName}: ${ritual.message} ${formatRitualRecoveryInstruction(recoveryTier)}` +
+            rootsNote);
+    }
+    // Narrow the cooperative file-gate race: authorization/scope checks can
+    // take long enough for another session to transition the lease. Re-read
+    // only occupancy immediately before each direct-write allow, while retaining
+    // the exact ritual owner above (never adopt a later ritual file here).
+    // #3599: the owner's lease is only kept alive here, on the last evaluation
+    // before an allowed write, so the stamp records a write that really happened.
+    let occupancyWarning = null;
+    const recheckOccupancyBeforeWriteAllow = () => {
+        if (actor === null)
+            return null;
+        const finalOccupancy = evaluateOccupancyWriteGate(effectiveRoot, {
+            sessionId: actor.sessionId,
+            env: actor.hostAuthoritative ? {} : environ,
+            refresh: true,
+        });
+        occupancyWarning = finalOccupancy.warning;
+        if (finalOccupancy.occupant !== null && actor.issue !== null) {
+            return deny(input, actor.issue === "conflict"
+                ? "occupancy-identity-conflict"
+                : "occupancy-identity-unavailable", toolName, `Directive denied ${toolName}: the live occupancy owner changed while mutation ` +
+                "gates were running, and this hook has no unambiguous matching actor identity." +
+                rootsNote);
+        }
+        if (!finalOccupancy.allow && finalOccupancy.message !== null) {
+            return deny(input, "occupancy-occupied", toolName, `Directive denied ${toolName}: occupancy changed while mutation gates were running. ` +
+                finalOccupancy.message +
+                rootsNote);
+        }
+        // Same member rule as the pre-gate check above (#3755): an admitted member
+        // is measured against the occupant that granted it, not against itself.
+        const finalExpectedOwner = finalOccupancy.admitted === "member" && finalOccupancy.occupant !== null
+            ? finalOccupancy.occupant.sessionId
+            : actor.sessionId;
+        if (finalOccupancy.occupant !== null &&
+            finalExpectedOwner !== undefined &&
+            ritual.boundSessionId !== finalExpectedOwner) {
+            return deny(input, "occupancy-ritual-mismatch", toolName, `Directive denied ${toolName}: final lease owner ${finalExpectedOwner} does not match ` +
+                `the exact verified ritual owner ${ritual.boundSessionId ?? "<unbound>"}. ` +
+                "Run `deft session:start --rearm --session-id=<same-session-id>` when re-arm is eligible; " +
+                "otherwise run `deft session:start --session-id=<same-session-id>` for a cold ceremony." +
+                rootsNote);
+        }
+        return null;
+    };
+    const withOccupancyWarning = (message) => occupancyWarning === null ? message : `${message} ${occupancyWarning}`;
     if (options.proposedLifecycleExempt) {
-        const writeTarget = hookWriteTargetPath(input.payload);
-        if (isProposedLifecycleWrite(projectRoot, writeTarget)) {
-            const relPath = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
+        if (allMutationTargetsAreProposedLifecycleWrites(effectiveRoot, input.payload)) {
             // UAT still allows xbrief/proposed/** as evidence/defect capture (#2944).
-            const authzDeny = authzForMutation(input, toolName, seams, {
+            // Authz and the write fence run on every mutated path, not the declared
+            // one (#3614).
+            const authzDeny = authzForMutationTargets(input, toolName, seams, {
                 isDirectWrite: true,
-                relPath,
                 scopePath: null,
+                runGit: dispatchGit,
+                projectRoot,
             });
             if (authzDeny !== null)
                 return authzDeny;
-            const runtimeDeny = runtimeAuthorityForDirectWrite(input, toolName, seams, null);
+            const runtimeDeny = runtimeAuthorityForDirectWrite(input, toolName, seams, null, effectiveRoot);
             if (runtimeDeny !== null)
                 return runtimeDeny;
+            const occupancyDeny = recheckOccupancyBeforeWriteAllow();
+            if (occupancyDeny !== null)
+                return occupancyDeny;
             return {
                 verdict: "allow",
                 code: "write-propose-ready",
@@ -661,27 +1040,36 @@ function inspectMutationGates(input, toolName, seams, options) {
                 host: input.host,
                 toolName,
                 projectRoot,
-                message: `Directive write gate allowed ${toolName} for a proposed lifecycle xBRIEF ` +
-                    "(planning write; active scope not required).",
+                message: withOccupancyWarning(`Directive write gate allowed ${toolName} for a proposed lifecycle xBRIEF ` +
+                    "(planning write; active scope not required)."),
                 scopePath: null,
             };
         }
     }
     let scope;
     try {
-        scope = (seams.inspectScope ?? inspectActiveScope)(projectRoot);
+        // #3794 commit 2: a write is governed by the active scope of the worktree it
+        // lands in, not the primary checkout's. Admission has already proved
+        // effectiveRoot shares --git-common-dir with payloadRoot.
+        scope = (seams.inspectScope ?? inspectActiveScope)(effectiveRoot);
     }
     catch (cause) {
         scope = { ready: false, path: null, message: String(cause) };
     }
     if (!scope.ready) {
         const writeTarget = hookWriteTargetPath(input.payload);
-        const relTarget = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
+        const relTarget = writeTarget !== null ? toProjectRelativePosix(effectiveRoot, writeTarget) : null;
         // Active-scope governs in-repo lifecycle work only. Outside-root Write/Edit
         // (agent memory, $TMPDIR, user config) skips the deny; null/unparseable
         // targets stay fail-closed. Spawn has no write target → still requires scope (#2885).
         // Lexical ../ + realpath re-entry guard (not bare startsWith(".."); not symlink aliases).
-        const outsideRoot = writeTarget !== null && isOutsideProjectRootWrite(projectRoot, writeTarget);
+        // #3794: the #2885 carve-out is measured from payloadRoot, so a linked
+        // worktree that lives outside the payload root keeps today's skip. Worktrees
+        // under the payload root -- `.deft-scratch/worktrees/`, the swarm layout --
+        // are inside it and are now gated on their own active scope.
+        const mutationTargets = hookMutationTargetPaths(input.payload);
+        const outsideRoot = mutationTargets.length > 0 &&
+            mutationTargets.every((target) => isOutsideProjectRootWrite(projectRoot, target));
         if (!outsideRoot || isSpawnTool(toolName)) {
             let proposedPathHint;
             if (isSpawnTool(toolName)) {
@@ -720,8 +1108,17 @@ function inspectMutationGates(input, toolName, seams, options) {
                                 "assist posture (commands.md #1802) — do not fake `scope:activate` for notes.");
             }
             const denyCode = isSpawnTool(toolName) ? "spawn-not-ready" : "scope-not-ready";
+            // #3794: the recovery has to run in the tree whose active scope was read.
+            // Once the two roots differ, "the project root" names no single directory
+            // the agent can act on, and activating in the payload root does not clear
+            // a deny measured against the worktree.
+            const recoveryRootNote = resolve(effectiveRoot) === payloadRoot
+                ? ""
+                : ` Active scope was read from ${effectiveRoot}, so run that recovery there rather than in ${payloadRoot}.`;
             return deny(input, denyCode, toolName, `Directive denied ${toolName}: ${scope.message}${proposedPathHint}` +
-                scopeNotReadyCoverageHint(toolName));
+                scopeNotReadyCoverageHint(toolName, loadRuntimeAuthorityPolicySafe(input, seams)?.shellDestForms === "enforce") +
+                recoveryRootNote +
+                rootsNote);
         }
     }
     const allowCode = isSpawnTool(toolName) ? "spawn-ready" : "write-ready";
@@ -733,19 +1130,21 @@ function inspectMutationGates(input, toolName, seams, options) {
         }
     }
     if (!isSpawnTool(toolName)) {
-        const writeTarget = hookWriteTargetPath(input.payload);
-        const relPath = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
         // Wave 1 authz (UAT lease + human-origin grant) before runtimeAuthority (#2944 / #2948 L1–L2).
-        const authzDeny = authzForMutation(input, toolName, seams, {
+        const authzDeny = authzForMutationTargets(input, toolName, seams, {
             isDirectWrite: true,
-            relPath,
             scopePath: scope.path,
+            runGit: dispatchGit,
+            projectRoot,
         });
         if (authzDeny !== null)
             return authzDeny;
-        const runtimeDeny = runtimeAuthorityForDirectWrite(input, toolName, seams, scope.path);
+        const runtimeDeny = runtimeAuthorityForDirectWrite(input, toolName, seams, scope.path, effectiveRoot);
         if (runtimeDeny !== null)
             return runtimeDeny;
+        const occupancyDeny = recheckOccupancyBeforeWriteAllow();
+        if (occupancyDeny !== null)
+            return occupancyDeny;
     }
     return {
         verdict: "allow",
@@ -754,10 +1153,104 @@ function inspectMutationGates(input, toolName, seams, options) {
         host: input.host,
         toolName,
         projectRoot,
-        message: `Directive ${isSpawnTool(toolName) ? "spawn" : "write"} gate passed for ${toolName}.`,
+        message: withOccupancyWarning(`Directive ${isSpawnTool(toolName) ? "spawn" : "write"} gate passed for ${toolName}.`),
         scopePath: scope.path,
     };
 }
+function gitDestructiveIsFixture(form, projectRoot) {
+    if (form.unprovable || form.relocators.length === 0)
+        return false;
+    return form.relocators.every((raw) => {
+        const path = raw.trim();
+        if (path.length === 0 || !isAbsolute(path))
+            return false;
+        return isOutsideProjectRootWrite(projectRoot, path);
+    });
+}
+const GIT_DESTRUCTIVE_REMEDIATION = "Tree-wide destructive git (reset --hard, clean -f, checkout -f / switch -f, " +
+    "stash drop/clear) is fail-closed when aimed at this checkout. Rewrite as a " +
+    "non-destructive command, or run it against an absolute out-of-root fixture " +
+    "(`git -C /abs/fixture reset --hard`). This is a guard, not a root-cause claim.";
+/**
+ * Always-on recognition for tree-wide destructive git (#3917). Independent of
+ * `shellDestForms`. Records a durable JSONL line outside the repository so the
+ * next occurrence names its actor even if reflogs are gone.
+ */
+function decideGitDestructive(input, toolName) {
+    const command = hookShellCommand(input.payload);
+    if (command === null)
+        return null;
+    const forms = classifyGitDestructive(command);
+    if (forms.length === 0)
+        return null;
+    const projectRoot = resolve(input.projectRoot);
+    const env = input.environ ?? process.env;
+    const actor = env.DEFT_SESSION_ID?.trim() || env.GROK_SESSION_ID?.trim() || "";
+    const logPath = env[GIT_DESTRUCTIVE_LOG_ENV]?.trim() || undefined;
+    let anyProjectAimed = false;
+    for (const form of forms) {
+        const fixture = gitDestructiveIsFixture(form, projectRoot);
+        if (!fixture)
+            anyProjectAimed = true;
+        appendGitDestructiveRecord({
+            ts: new Date().toISOString(),
+            kind: form.kind,
+            disposition: fixture ? "allow-fixture" : "deny",
+            command,
+            projectRoot,
+            host: input.host,
+            toolName,
+            actor,
+            pid: process.pid,
+            relocators: form.relocators,
+            unprovable: form.unprovable,
+        }, { env, logPath });
+    }
+    if (!anyProjectAimed) {
+        return {
+            verdict: "allow",
+            code: "git-destructive-fixture",
+            event: input.event,
+            host: input.host,
+            toolName,
+            projectRoot,
+            message: `Directive allowed ${toolName}: destructive git is aimed at an out-of-root fixture.`,
+            scopePath: null,
+        };
+    }
+    return deny(input, "git-destructive-deny", toolName, `Directive denied ${toolName}: ${GIT_DESTRUCTIVE_REMEDIATION}`);
+}
+/**
+ * Authorize recognized in-repo Shell file-write dests through inspectMutationGates (#3983 / #3987).
+ * Deny is returned; allow falls through so dest-forms and push/merge still run.
+ */
+function decideShellWriteReissue(input, toolName, seams) {
+    const command = hookShellCommand(input.payload);
+    if (command === null)
+        return null;
+    const projectRoot = resolve(input.projectRoot);
+    for (const dest of classifyShellWriteTargets(command)) {
+        if (dest.unprovable === true) {
+            if (!isInRepoShellWritePath(projectRoot, dest.path))
+                continue;
+            return deny(input, "scope-not-ready", toolName, "Directive denied " +
+                toolName +
+                ": Shell write dest is not reconstructable (compound command). Use one simple command or Edit/Write.");
+        }
+        if (!isInRepoShellWritePath(projectRoot, dest.path))
+            continue;
+        const destInput = {
+            ...input,
+            payload: payloadWithInjectedWriteTarget(input.payload, dest.path),
+        };
+        const destDecision = inspectMutationGates(destInput, toolName, seams, {
+            proposedLifecycleExempt: true,
+        });
+        if (destDecision.verdict === "deny")
+            return destDecision;
+    }
+    return null;
+}
 /**
  * Route recognized Shell dest-forms through inspectMutationGates, then push/merge.
  * Dest-form allow is kept when runtime authority has nothing classifiable.
@@ -810,6 +1303,166 @@ function decideShellDestFormsThenRuntimeAuthority(input, toolName, seams) {
     }
     return runtime;
 }
+const LIFECYCLE_EXECUTION_DIRECTORY_FIELDS = [
+    "cwd",
+    "workdir",
+    "working_directory",
+    "workingDirectory",
+];
+function sameExecutionDirectory(left, right) {
+    if (process.platform === "win32")
+        return left.toLowerCase() === right.toLowerCase();
+    return left === right;
+}
+function lifecycleExecutionRootCheck(payload, projectRoot, realpath, platform) {
+    const input = record(payload);
+    if (input === null) {
+        return { aligned: false, message: "the hook payload has no inspectable execution root" };
+    }
+    const expected = normalizeHookProjectRoot(projectRoot);
+    const toolInput = toolInputRecord(input);
+    const records = toolInput === null || toolInput === input ? [input] : [input, toolInput];
+    for (const source of records) {
+        for (const field of LIFECYCLE_EXECUTION_DIRECTORY_FIELDS) {
+            if (!(field in source))
+                continue;
+            const raw = source[field];
+            if (typeof raw !== "string" || raw.trim().length === 0) {
+                return {
+                    aligned: false,
+                    message: `execution-directory field ${field} is missing or invalid`,
+                };
+            }
+            const trimmed = raw.trim();
+            // Cursor can report a drive-only cwd (for example `C:`) while the
+            // explicit/workspace-derived project root remains usable (#2787). Keep
+            // this fence aligned with projectRootFromHookPayload: a drive-only value
+            // is not a concrete execution directory and must not override that root.
+            if (isWindowsDriveOnlyRoot(trimmed, platform))
+                continue;
+            if (trimmed.replace(/\\/g, "/").split("/").includes("..")) {
+                return {
+                    aligned: false,
+                    message: `execution-directory field ${field} contains parent traversal`,
+                };
+            }
+            const candidate = isAbsolute(trimmed) ? trimmed : `${expected}${sep}${trimmed}`;
+            let actual;
+            let expectedReal;
+            try {
+                // Keep relative `..` segments intact until realpath resolution. Lexical
+                // path.resolve would collapse `link/..` before observing that `link`
+                // can be a symlink to a foreign tree.
+                expectedReal = normalizeHookProjectRoot(realpath(expected));
+                actual = normalizeHookProjectRoot(realpath(candidate));
+            }
+            catch (cause) {
+                return {
+                    aligned: false,
+                    message: `execution-directory field ${field} could not be realpath-bound: ${String(cause)}`,
+                };
+            }
+            if (!sameExecutionDirectory(actual, expectedReal)) {
+                return {
+                    aligned: false,
+                    message: `execution-directory field ${field} resolves to ${actual}, not the hook project ` +
+                        `root ${expectedReal}`,
+                };
+            }
+        }
+    }
+    return { aligned: true, message: "execution directory is project-root aligned" };
+}
+/**
+ * Hosts whose PreToolUse wire format can carry a rewritten tool input.
+ *
+ * `renderHostDecision` reads the same list, so the bridge cannot offer -- or
+ * deny on behalf of -- a delivery channel a host does not have (#3873). A host
+ * outside it binds its claim in the CLI instead: `resolveOccupancySessionId`
+ * resolves the same ambient host owner the write gate will present.
+ */
+const UPDATED_INPUT_WIRE_HOSTS = ["codex", "claude", "cursor"];
+function hostAcceptsUpdatedInput(host) {
+    return UPDATED_INPUT_WIRE_HOSTS.includes(host);
+}
+/**
+ * Add the claim-time owner only after the existing shell decision allowed the
+ * command. The host wire format must emit `allow` with updated input, so this
+ * path is intentionally restricted by rewriteExactLifecycleCommand.
+ */
+function attachLifecycleIdentityRewrite(input, toolName, decision, seams) {
+    if (decision.verdict !== "allow")
+        return decision;
+    if (!hostAcceptsUpdatedInput(input.host))
+        return decision;
+    const lifecycle = inspectExactLifecycleCommand(input.payload);
+    if (lifecycle === null)
+        return decision;
+    if (!lifecycle.requiresOwner)
+        return decision;
+    if (lifecycle.sessionIdStatus === "invalid") {
+        return deny(input, "occupancy-identity-conflict", toolName, `Directive denied exact lifecycle command ${lifecycle.verb}: ` +
+            "--session-id is empty, duplicated, or otherwise ambiguous.");
+    }
+    const identity = resolveHookHostIdentity(input.host, input.payload, input.environ ?? process.env);
+    // #3873: an absent host-env variable is the pre-#3873 explicit-owner flow, not
+    // a broken contract. Claim binding is skipped, the command keeps ordinary host
+    // permission handling, and any owner it carries is still its own.
+    if (identity.status === "unsupported" ||
+        hostIdentityFallsBackToExplicitOwner(input.host, identity)) {
+        return decision;
+    }
+    if (identity.status !== "ok" || identity.sessionId === null) {
+        const code = identity.status === "conflict"
+            ? "occupancy-identity-conflict"
+            : "occupancy-identity-unavailable";
+        return deny(input, code, toolName, `Directive denied exact lifecycle command ${lifecycle.verb}: ` +
+            `${identity.message ?? "host session identity is unavailable"}. ` +
+            "Directive cannot bind the occupancy claim without a stable host owner; " +
+            "manual callers must pass --session-id explicitly outside the host rewrite path.");
+    }
+    const environmentId = (input.environ ?? process.env).DEFT_SESSION_ID?.trim();
+    if (environmentId !== undefined &&
+        environmentId.length > 0 &&
+        environmentId !== identity.sessionId) {
+        return deny(input, "occupancy-identity-conflict", toolName, `Directive denied ${toolName}: host owner ${identity.sessionId} conflicts with ` +
+            `DEFT_SESSION_ID ${environmentId}; refusing an auto-approved lifecycle rewrite.`);
+    }
+    if (lifecycle.sessionIdStatus === "present" && lifecycle.sessionId !== identity.sessionId) {
+        return deny(input, "occupancy-identity-conflict", toolName, `Directive denied ${toolName}: lifecycle command ${lifecycle.verb} names ` +
+            `${lifecycle.sessionId ?? "<missing>"}, but the host owner is ` +
+            `${identity.sessionId}.`);
+    }
+    const sourceTask = !lifecycle.task ||
+        (seams.runningInsideDeftRepo ?? runningInsideDeftRepo)(resolve(input.projectRoot));
+    const executionRoot = lifecycleExecutionRootCheck(input.payload, input.projectRoot, seams.realpathLifecycleExecutionRoot ?? realpathSync, seams.lifecycleExecutionPlatform ?? process.platform);
+    if (!executionRoot.aligned) {
+        return deny(input, "occupancy-identity-conflict", toolName, `Directive denied exact lifecycle command ${lifecycle.verb}: ${executionRoot.message}. ` +
+            `Run the lifecycle command from ${normalizeHookProjectRoot(resolve(input.projectRoot))} ` +
+            "so policy, lease, and ritual state target the same worktree.");
+    }
+    const rewriteAllowed = lifecycle.rewriteSafe && sourceTask;
+    if (lifecycle.sessionIdStatus === "absent" && !rewriteAllowed) {
+        let reason;
+        if (lifecycle.task && !sourceTask) {
+            reason = "Task lifecycle rewrites are only trusted in the Directive source repository";
+        }
+        else {
+            reason = "this argument shape is outside the narrowly auto-approved rewrite surface";
+        }
+        return deny(input, "occupancy-identity-unavailable", toolName, `Directive denied exact lifecycle command ${lifecycle.verb}: ${reason}. ` +
+            `Re-run the command with --session-id=${identity.sessionId}; Directive will verify ` +
+            "that explicit owner without auto-approving or replacing the command.");
+    }
+    const rewrite = rewriteExactLifecycleCommand(input.payload, identity.sessionId);
+    if (rewrite === null)
+        return decision;
+    if (rewrite.kind === "conflict") {
+        return deny(input, "occupancy-identity-conflict", toolName, `Directive denied ${toolName}: ${rewrite.message} Host payload owner is ` +
+            `${identity.sessionId}, but the command names ${rewrite.existingSessionId}.`);
+    }
+    return { ...decision, updatedInput: rewrite.updatedInput };
+}
 /** Decide a normalized event using only the P0 direct-write policy. */
 export function decideHook(input, seams = {}) {
     const projectRoot = resolve(input.projectRoot);
@@ -817,6 +1470,8 @@ export function decideHook(input, seams = {}) {
     // short-circuit (SessionStart / compact / PreToolUse). Deposit may remain.
     // Tracked/committed flags do NOT bypass gates (repo-controlled content must
     // not disable enforcement for clones) — doctor warns instead.
+    // #3794: the kill-switch is pinned to payloadRoot. The flag is untracked, so
+    // linked worktrees do not carry it; re-pointing would silently re-arm.
     {
         const detectKill = seams.detectDeftDirectiveDisable ?? detectDeftDirectiveDisable;
         const kill = detectKill(projectRoot);
@@ -843,6 +1498,12 @@ export function decideHook(input, seams = {}) {
         }
     }
     if (input.event === "session.compact") {
+        // #3769 Path 2: compact stays always-allow and never routes through
+        // inspectMutationGates — entering the mutation gates would re-run the
+        // ritual persist Path 1 closes, or occupancy-deny an owner's own compact.
+        // The stale-mark is fail-open: it writes even when no acting identity can
+        // be bound, because compact has no issue context and no surface a human
+        // reads. The accepted cost is an unidentified compact re-arming the owner.
         try {
             const result = (seams.markCompactStale ?? markRitualStaleAfterCompact)(projectRoot);
             if (!result.changed) {
@@ -998,11 +1659,21 @@ export function decideHook(input, seams = {}) {
         }
         return inspectMutationGates(input, toolName, seams, { proposedLifecycleExempt: false });
     }
-    // Shell dest-forms (#3438): recognized product mutations share inspectMutationGates
+    // Tree-wide destructive git (#3917): always-on, independent of shellDestForms.
+    // Dest-forms (#3438): recognized product mutations share inspectMutationGates
     // with Edit/Write (assist/scratch, proposed lifecycle, file_scope). Push/merge stay
     // on runtimeAuthority (#2711). Non-dest unclassifiable shell (git status) fail-open.
     if (isShellTool(toolName)) {
-        return decideShellDestFormsThenRuntimeAuthority(input, toolName, seams);
+        const destructive = decideGitDestructive(input, toolName);
+        if (destructive !== null) {
+            return attachLifecycleIdentityRewrite(input, toolName, destructive, seams);
+        }
+        const writeReissue = decideShellWriteReissue(input, toolName, seams);
+        if (writeReissue !== null) {
+            return attachLifecycleIdentityRewrite(input, toolName, writeReissue, seams);
+        }
+        const decision = decideShellDestFormsThenRuntimeAuthority(input, toolName, seams);
+        return attachLifecycleIdentityRewrite(input, toolName, decision, seams);
     }
     // Classifiable MCP: enforce scopes.push / scopes.merge (#2711).
     // Route bare push/merge MCP names (merge_pull_request, git_push, …) even when
@@ -1057,6 +1728,24 @@ function softAgentsRebindWireText(decision) {
  */
 export function renderHostDecision(host, decision) {
     if (decision.verdict === "allow") {
+        if (decision.event === "tool.before" &&
+            decision.updatedInput !== undefined &&
+            hostAcceptsUpdatedInput(host)) {
+            if (host === "cursor") {
+                return JSON.stringify({
+                    permission: "allow",
+                    code: decision.code,
+                    updated_input: decision.updatedInput,
+                });
+            }
+            return JSON.stringify({
+                hookSpecificOutput: {
+                    hookEventName: "PreToolUse",
+                    permissionDecision: "allow",
+                    updatedInput: decision.updatedInput,
+                },
+            });
+        }
         const soft = softAgentsRebindWireText(decision);
         if (host === "cursor") {
             if (decision.event === "session.start" && soft !== null) {