@event4u/agent-config 10.1.0 → 10.3.0

package/src/scripts/design_slop_rules.ts

@@ -17,6 +17,14 @@
  * dependency-free approach. Council 2026-06-28 assumed those libs were present;
  * for THIS package, pattern-based is the correct, frugal adaptation.
  *
+ * WHAT THE NEGATIVE FIXTURES ARE NOT: each rule ships one positive and one
+ * negative fixture, and the suite asserts both exist. That is a PRESENCE guard —
+ * "this regex stays quiet on one clean snippet crafted for it" — and it is NOT a
+ * false-positive RATE. Nineteen green negatives say nothing about how often a
+ * rule fires on clean UI it has never seen. Reading them as an FP measurement is
+ * the mistake that makes the registry look better-evidenced than it is; the rate
+ * is measured against the clean corpus under `internal/bench/corpora/`, not here.
+ *
  * Severity is a REBUTTABLE PRESUMPTION, never a hard block:
  *   P0 — objective failure (none here; those live in lint_design_quality)
  *   P1 — high-confidence tell (e.g. the side-stripe signature)
@@ -437,7 +445,7 @@ export const SLOP_RULES: SlopRule[] = [
     },
   },
   {
-    id: "slop-lock-shape",
+    id: "slop-v8-lock-shape",
     catalogId: "V8",
     severity: "P2",
     engines: ["css"],
@@ -464,27 +472,6 @@ export const SLOP_RULES: SlopRule[] = [
       return [];
     },
   },
-  {
-    id: "slop-lock-colour",
-    catalogId: "C6",
-    severity: "P3",
-    engines: ["css"],
-    description: "Colour Lock — multiple saturated accent hue families",
-    message: "Several accent hue families read as no single accent identity; lock one (C6 / Colour Lock).",
-    gated: (ctx) => ctx.has("colour lock", "color lock"),
-    detect: ({ content }) => {
-      const buckets = new Set<number>();
-      for (const pm of content.matchAll(/#([0-9a-f]{3}|[0-9a-f]{6})\b/gi)) {
-        const b = hueBucket("#" + (pm[1] ?? ""));
-        if (b !== null) buckets.add(b);
-      }
-      if (buckets.size >= 3) {
-        const idx = content.search(/#[0-9a-f]{3,6}\b/i);
-        return [{ line: lineOf(content, Math.max(0, idx)), snippet: `${buckets.size} distinct accent hue families` }];
-      }
-      return [];
-    },
-  },
   {
     id: "slop-l9-section-monotony",
     catalogId: "L9",
@@ -527,4 +514,145 @@ export const SLOP_RULES: SlopRule[] = [
       return [];
     },
   },
+  // -------------------------------------------------------------------------
+  // Catalog thresholds promoted to rules (road-to-design-detector-evidence
+  // Phase 3). Each entry below already published its number in
+  // docs/guidelines/design-antipatterns.md — the prose is the specification,
+  // nothing here is invented, and each was graded per rule against the clean
+  // corpus rather than as a batch.
+  // -------------------------------------------------------------------------
+  {
+    id: "slop-v4-over-rounded",
+    catalogId: "V4",
+    severity: "P3",
+    engines: ["css"],
+    description: "border-radius > 16px on an element declared under 200px wide",
+    message: "Heavy rounding on a small surface reads as scaffold-default; scale the radius to the element (V4).",
+    gated: (ctx) => ctx.has("pill", "fully rounded", "soft ui", "claymorphism"),
+    detect: ({ content }) =>
+      cssBlocks(content)
+        .filter((b) => {
+          // A pill (9999px / 50% / 999px) and a circle are deliberate shapes,
+          // not over-rounding — the tell is a mid-range radius on a small box.
+          const r = /border-radius\s*:\s*(\d+)px/i.exec(b.body);
+          if (!r?.[1]) return false;
+          const radius = parseInt(r[1], 10);
+          if (radius <= 16 || radius >= 100) return false;
+          // "small" must be declared in the same block; nothing here infers
+          // layout, because inferring it would need a cascade.
+          const size = /(?:^|[;{\s])(?:max-)?(?:width|height)\s*:\s*(\d+)px/i.exec(b.body);
+          return size?.[1] !== undefined && parseInt(size[1], 10) < 200;
+        })
+        .map((b) => ({ line: b.line, snippet: b.selector.slice(0, 80) })),
+  },
+  {
+    id: "slop-c3-dark-glow",
+    catalogId: "C3",
+    severity: "P2",
+    engines: ["css"],
+    description: "Saturated zero-offset glow (box-shadow / text-shadow) in a dark context",
+    message: "A neon glow on dark reads as gaming-UI default rather than a considered accent (C3).",
+    gated: (ctx) => ctx.has("glow", "neon", "cyberpunk", "gaming"),
+    detect: ({ content, lines }) => {
+      // The tell is dark-context-specific, so a file with no dark surface at all
+      // is out of scope — a glow on a light page is a different question.
+      const darkContext =
+        /prefers-color-scheme\s*:\s*dark/i.test(content) ||
+        /\.dark\b|\[data-theme=["']?dark/i.test(content) ||
+        /background(?:-color)?\s*:\s*#(?:0[0-9a-f]{5}|1[0-9a-f]{5}|000|111)\b/i.test(content);
+      if (!darkContext) return [];
+      const out: RawHit[] = [];
+      for (let i = 0; i < lines.length; i++) {
+        const l = lines[i] ?? "";
+        // zero-offset + real blur is the glow signature; an offset shadow is depth.
+        const m = /(?:box|text)-shadow\s*:\s*0\s+0\s+(\d+)px[^;]*?(#[0-9a-f]{3,8})/i.exec(l);
+        if (!m?.[1] || !m[2]) continue;
+        if (parseInt(m[1], 10) < 8) continue;
+        if (hueBucket(m[2]) === null) continue; // a neutral halo is not a neon accent
+        out.push({ line: i + 1, snippet: l.trim().slice(0, 80) });
+      }
+      return out;
+    },
+  },
+  {
+    id: "slop-t9-uppercase-body",
+    catalogId: "T9",
+    severity: "P3",
+    engines: ["css"],
+    description: "text-transform: uppercase applied to body-length text",
+    message: "All-caps destroys word-shape for sustained reading; reserve it for short labels (T9).",
+    gated: (ctx) => ctx.has("all caps", "all-caps", "uppercase display"),
+    detect: ({ content }) =>
+      cssBlocks(content)
+        // Short UI surfaces (labels, buttons, table headers, badges, eyebrows)
+        // are the legitimate home of uppercase and are excluded by selector.
+        .filter((b) => /\b(p|body|article|\.prose|\.body|\.content|\.copy|blockquote|li)\b/i.test(b.selector))
+        .filter((b) => !/label|button|\bth\b|badge|chip|tag|eyebrow|kicker|caption|nav/i.test(b.selector))
+        .filter((b) => /text-transform\s*:\s*uppercase/i.test(b.body))
+        .map((b) => ({ line: b.line, snippet: b.selector.slice(0, 80) })),
+  },
+  {
+    id: "slop-t10-wide-tracking-body",
+    catalogId: "T10",
+    severity: "P3",
+    engines: ["css"],
+    description: "letter-spacing above 0.05em on body-length text",
+    message: "Wide tracking slows sustained reading; it belongs to display type, not body (T10).",
+    gated: (ctx) => ctx.has("wide tracking", "letterspacing", "letter-spacing"),
+    detect: ({ content }) =>
+      cssBlocks(content)
+        .filter((b) => /\b(p|body|article|\.prose|\.body|\.content|\.copy|blockquote|li)\b/i.test(b.selector))
+        .filter((b) => !/label|button|\bth\b|badge|chip|tag|eyebrow|kicker|caption|nav|h[1-6]/i.test(b.selector))
+        .filter((b) => {
+          const em = /letter-spacing\s*:\s*(\d*\.?\d+)(em|rem)/i.exec(b.body);
+          if (em?.[1]) return parseFloat(em[1]) > 0.05;
+          const px = /letter-spacing\s*:\s*(\d*\.?\d+)px/i.exec(b.body);
+          return px?.[1] !== undefined && parseFloat(px[1]) > 0.8;
+        })
+        .map((b) => ({ line: b.line, snippet: b.selector.slice(0, 80) })),
+  },
+  {
+    id: "slop-m1-bounce-easing",
+    catalogId: "M1",
+    severity: "P2",
+    engines: ["css"],
+    description: "Bounce or elastic easing on a UI transition",
+    message: "Overshoot draws attention to the animation instead of the state change (M1).",
+    gated: (ctx) => ctx.has("bounce", "playful motion", "elastic"),
+    detect: ({ lines }) => {
+      const out: RawHit[] = [];
+      for (let i = 0; i < lines.length; i++) {
+        const l = lines[i] ?? "";
+        // Overshoot is decidable from the curve itself: a control point outside
+        // [0,1] on the output axis means the value passes its target and returns.
+        const cb = /cubic-bezier\(\s*[-\d.]+\s*,\s*(-?[\d.]+)\s*,\s*[-\d.]+\s*,\s*(-?[\d.]+)\s*\)/i.exec(l);
+        if (cb?.[1] !== undefined && cb[2] !== undefined) {
+          const y1 = parseFloat(cb[1]);
+          const y2 = parseFloat(cb[2]);
+          if (y1 < 0 || y1 > 1 || y2 < 0 || y2 > 1) {
+            out.push({ line: i + 1, snippet: l.trim().slice(0, 80) });
+            continue;
+          }
+        }
+        if (/(?:transition|animation)[^;]*\b(?:bounce|elastic|back(?:In|Out|InOut))\b/i.test(l)) {
+          out.push({ line: i + 1, snippet: l.trim().slice(0, 80) });
+        }
+      }
+      return out;
+    },
+  },
+  {
+    id: "slop-m3-img-hover-transform",
+    catalogId: "M3",
+    severity: "P3",
+    engines: ["css"],
+    description: "transform or filter animation on an <img> hover",
+    message: "Hover-scaling an image triggers composite plus decode and often shifts layout (M3).",
+    gated: (ctx) => ctx.has("image hover", "hover zoom", "ken burns"),
+    detect: ({ content }) =>
+      cssBlocks(content)
+        .filter((b) => /\bimg\b/i.test(b.selector) && /:hover|:focus-within/i.test(b.selector))
+        .filter((b) => /(?:^|[;{\s])(?:transform|filter)\s*:/i.test(b.body))
+        .map((b) => ({ line: b.line, snippet: b.selector.slice(0, 80) })),
+  },
 ];

package/src/scripts/dispatch_r2_reviewer.ts

@@ -642,7 +642,21 @@ function reviewerPrompt(args: {
  * Writing the hash of the prompt THIS dispatcher built makes the channel
  * attributable: the artefact now records which prompt produced it, so a review
  * run against a different prompt is distinguishable from one run against the
- * dispatcher's. `--verify` re-derives it from the same inputs and compares.
+ * dispatcher's.
+ *
+ * `--verify` / `--verify-current` do NOT re-derive it. {@link runVerify}
+ * re-derives `scope_hash`, `roadmap_hash` and `ac_hash` only — it re-computes
+ * the review's INPUTS from the current repo state, and the prompt is not one of
+ * them (it is not reconstructible from the repo; it is an artefact this
+ * dispatcher wrote). An earlier revision of this comment claimed otherwise for
+ * roughly a year, which is how the field came to be written, parsed, and
+ * compared to nothing.
+ *
+ * What compares it is `check_review_prompt_binding`, against the prompt package
+ * this dispatcher commits beside the artefact (`<slug>.review-input/prompt.md`,
+ * written below) — a different check with a different scope: corpus-wide rather
+ * than current-branch, because a committed prompt and its recorded hash are both
+ * immutable.
  *
  * It does not CLOSE the residual and is not sold as doing so: the same host that
  * authors a steered prompt could hash the steered text. The gain is an

package/src/scripts/external_sources_denylist.json

@@ -59,7 +59,9 @@
     "graphify-labs",
     "penpax",
     "\\bagent-reach\\b",
-    "panniantong"
+    "panniantong",
+    "virgiliojr94",
+    "book-to-skill"
   ],
   "skip_paths": [
     "src/scripts/check_no_external_sources.py",

package/src/scripts/hook_manifest.yaml

@@ -306,12 +306,23 @@ concerns:
     args: []
     fail_closed: true
     severity: blocking
-  # Evaluator independence. Gates EVALUATION dispatches only — a verdict
-  # pre-loaded into the prompt, or a second evaluation of the same work in one
-  # turn. Ordinary parallel fan-out is untouched: the council's "second dispatch
-  # of any kind" criterion would have blocked 6 of the 7 analysis subagents in
-  # the very session that produced this guard. fail_closed: false — a malformed
-  # envelope must never block a dispatch.
+  # Evaluator independence. Gates EVALUATION dispatches only. Two branches with
+  # DIFFERENT severities, per the tier rule in
+  # docs/contracts/hook-architecture-v1.md (§ What a concern may block on):
+  #   · pre-loaded verdict → BLOCKS. It matches a literal steering formulation
+  #     ("NO-FINDINGS is expected and welcome"), which IS the violation rather
+  #     than evidence of one.
+  #   · second self-scoped dispatch in a turn → WARNS (exit 0 + decision:"warn").
+  #     It decides from prose alone — Tier 3 — and a cross-project audit measured
+  #     the cost of blocking on that: a 16-way IMPLEMENTATION fan-out lost 15 of
+  #     its workers, because the phrase `this branch` (an address every worktree
+  #     dispatch prompt carries) read as a self-reference.
+  # `severity: blocking` therefore states the HIGHEST severity this concern can
+  # reach, not the severity of every path through it.
+  # Ordinary parallel fan-out was always meant to be untouched: the council's
+  # "second dispatch of any kind" criterion would have blocked 6 of the 7 analysis
+  # subagents in the very session that produced this guard. fail_closed: false — a
+  # malformed envelope must never block a dispatch.
   evidence-independence:
     script: src/scripts/hooks/evidence_independence.ts
     args: []

package/src/scripts/hooks/block_unauthorized_git.ts

@@ -105,25 +105,71 @@ export const WARN_OPS: ReadonlySet<GitOp> = new Set<GitOp>([
 // gate. `G` allows any run of them.
 const G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
 
+/** Optional absolute/relative path in front of the tool word: `/usr/bin/npm`. */
+const P = "^(?:\\S*\\/)?";
+
+/**
+ * A `gh api` call that WRITES. Read-only `gh api` is the standard way to inspect
+ * GitHub state and must never be refused.
+ *
+ * Two lookaheads rather than one linear pattern, because `-X POST` may appear on
+ * either side of the path: `gh api -X POST repos/o/r/releases` and
+ * `gh api repos/o/r/releases -X POST` are the same call.
+ */
+function ghApiWrite(pathRe: string): RegExp {
+  return new RegExp(
+    `${P}gh\\s+api\\b(?=[^\\n]*${pathRe})(?=[^\\n]*(?:-X|--method)\\s+(?:POST|PATCH|PUT|DELETE)\\b)`,
+    "i",
+  );
+}
+
 /**
  * Command → operation. Order matters: the most specific pattern wins, so
  * `git push --tags` is a tag push and not a plain push.
+ *
+ * Every pattern is anchored at command position (`P`), not `\b`. An unanchored
+ * verb matches its own name inside a QUOTED ARGUMENT, and the 2026-08-12 session
+ * audit measured all three of that window's blocked ops as exactly that false
+ * positive — every one read-only or harmless:
+ *
+ *   gh pr create … --title "…(unblock npm publish)"   → classified `publish`
+ *   gh api repos/o/r/releases/latest --jq …           → classified `release`
+ *   gh api repos/jdx/aube-action/releases --jq …      → classified `release`
+ *
+ * The first is a PR *about* a publishing problem; the other two are GETs, one of
+ * them against a third-party repo. All three are BLOCK ops, so on a hook-bound
+ * host the operator could neither open that PR nor diagnose why a release had
+ * not appeared — while the transcripts of that same window carry "Ich kann
+ * wieder nicht releasen. Warum nicht?".
+ *
+ * The heredoc stripper upstream already removes `--body "$(cat <<EOF …)"`
+ * payloads; it cannot help here because `--title` is an ordinary quoted
+ * argument. Anchoring is what separates *invoking* a verb from *naming* one.
  */
 const COMMAND_OPS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
-  { op: "publish", re: new RegExp(`\\b(npm|pnpm|yarn)\\s+${G}publish\\b`, "i") },
-  { op: "release", re: /\bgh\s+release\s+create\b|\bgh\s+api\b[^\n]*\/releases\b/i },
+  { op: "publish", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}publish\\b`, "i") },
+  {
+    op: "release",
+    re: new RegExp(`${P}gh\\s+release\\s+create\\b|${ghApiWrite("\\/releases\\b").source}`, "i"),
+  },
   {
     op: "tag",
+    re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--tags|--follow-tags|refs\\/tags\\/)`, "i"),
+  },
+  {
+    op: "pr-merge",
     re: new RegExp(
-      `\\bgit\\s+${G}push\\b[^\\n;|&]*(--tags|--follow-tags|refs\\/tags\\/)`,
+      `${P}gh\\s+pr\\s+merge\\b|${ghApiWrite("\\/pulls\\/\\d+\\/merge\\b").source}`,
       "i",
     ),
   },
-  { op: "pr-merge", re: /\bgh\s+pr\s+merge\b|\bgh\s+api\b[^\n]*\/pulls\/\d+\/merge\b/i },
-  { op: "pr-create", re: /\bgh\s+pr\s+create\b|\bgh\s+api\b[^\n]*-X\s+POST[^\n]*\/pulls\b/i },
-  { op: "push", re: new RegExp(`\\bgit\\s+${G}push\\b`, "i") },
-  { op: "commit", re: new RegExp(`\\bgit\\s+${G}commit\\b`, "i") },
-  { op: "branch", re: new RegExp(`\\bgit\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") },
+  {
+    op: "pr-create",
+    re: new RegExp(`${P}gh\\s+pr\\s+create\\b|${ghApiWrite("\\/pulls\\b").source}`, "i"),
+  },
+  { op: "push", re: new RegExp(`${P}git\\s+${G}push\\b`, "i") },
+  { op: "commit", re: new RegExp(`${P}git\\s+${G}commit\\b`, "i") },
+  { op: "branch", re: new RegExp(`${P}git\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") },
 ];
 
 const COMMAND_TOOLS: ReadonlySet<string> = new Set([

package/src/scripts/hooks/delegation_nudge_hook.ts

@@ -128,10 +128,35 @@ function _isObject(v: unknown): v is JsonObject {
 const FILE_TOKEN_RE =
   /`?\b[\w][\w.\-]{0,80}\.(ts|tsx|js|jsx|mjs|cjs|py|php|rb|go|rs|java|kt|swift|md|mdx|json|ya?ml|css|scss|less|html|vue|svelte|sql|sh|bash|c|cpp|h|hpp|cs|toml|xml)\b`?/gi;
 
-export function detectEnumeratedFiles(text: string): number {
+/**
+ * The unique file tokens themselves, lower-cased and stripped of backticks.
+ *
+ * `detectEnumeratedFiles` needs only the size, but `conformance_scan`'s
+ * `task-completeness` check needs the IDENTITIES: it asks which of the files a
+ * prompt enumerated were actually touched, which a count cannot answer. Exposing
+ * them here rather than re-matching `FILE_TOKEN_RE` in the scanner keeps one
+ * regex in the tree — a second copy is the "second artefact to keep in sync"
+ * that would let the classifier and the measurement disagree silently, which is
+ * the property `conformance_scan`'s own header requires of every classifier it
+ * imports.
+ */
+/**
+ * Minimum unique file tokens before the FILE shape counts as a delegable
+ * signal (F7, review). Named rather than inlined because `conformance_scan`'s
+ * `task-completeness` check gates on the same floor: a prompt whose file
+ * enumeration is below it is not treated as naming a deliverable SET by either
+ * reader, and two copies of the number would let them disagree about which
+ * prompts are in scope.
+ */
+export const FILE_SIGNAL_FLOOR = 3;
+
+export function enumeratedFileTokens(text: string): string[] {
   const matches = text.match(FILE_TOKEN_RE) ?? [];
-  const unique = new Set(matches.map((m) => m.replace(/`/g, "").toLowerCase()));
-  return unique.size;
+  return [...new Set(matches.map((m) => m.replace(/`/g, "").toLowerCase()))];
+}
+
+export function detectEnumeratedFiles(text: string): number {
+  return enumeratedFileTokens(text).length;
 }
 
 /**
@@ -246,12 +271,12 @@ export function extractTaskSignals(text: string): ExtractedSignals {
   const conjunction = detectMultiDeliverableConjunction(text);
   const forEach = detectForEachShape(text);
 
-  // F7 (review): a bare file-token count below 3 is common and NOT itself
-  // evidence of independent, parallelizable work — "rename a.ts to b.ts"
-  // names 2 files but is one mechanical edit, not two delegable slices. The
-  // explicit "N files/Dateien" phrase (`detectExplicitSliceCount`) is a
+  // F7 (review): a bare file-token count below FILE_SIGNAL_FLOOR is common and
+  // NOT itself evidence of independent, parallelizable work — "rename a.ts to
+  // b.ts" names 2 files but is one mechanical edit, not two delegable slices.
+  // The explicit "N files/Dateien" phrase (`detectExplicitSliceCount`) is a
   // stronger, author-stated signal and keeps its existing floor of N>=2.
-  const fileSignal = fileCount >= 3 ? fileCount : 0;
+  const fileSignal = fileCount >= FILE_SIGNAL_FLOOR ? fileCount : 0;
 
   let slices = Math.max(fileSignal, explicit, conjunction);
   if (slices === 0 && forEach) {

package/src/scripts/hooks/evidence_independence.ts

@@ -135,9 +135,27 @@ export function isEvaluationPrompt(prompt: string): boolean {
  * ON, so the second-dispatch block requires a self-reference. The pre-loaded-
  * verdict block does NOT: steering an evaluator is wrong whatever it is
  * pointed at.
+ *
+ * That fix was still too wide, and the cross-project session audit (2026-08-12)
+ * measured the cost: `road-to-release-truth/fc1ff181` turn 3 fanned out 16
+ * IMPLEMENTATION workers, and 15 were classified self-scoped on one phrase —
+ * `this branch`. In context it read "two conversions already landed on this
+ * branch in exactly the style you should match", i.e. it named WHERE the work
+ * happens. A worktree dispatch prompt carries that phrase by construction
+ * ("Work in <worktree> (branch …)"), so on a hook-bound host the guard ate 15
+ * of 16 workers — the exact behaviour `evaluator-independence` § "When it does
+ * NOT fire" promises is out of scope ("…or IMPLEMENT is not evaluation and is
+ * not gated").
+ *
+ * So the self-reference must name a SUBJECT a verdict can be shopped for — a
+ * diff, a change, a patch — never the LOCATION the work happens in. `this
+ * branch` is dropped for that reason; `my branch` stays, because the possessive
+ * makes it a claim about the agent's own work rather than an address. `this pr`
+ * stays for the same reason `this diff` does: a PR is a thing reviewers render
+ * verdicts on, whereas a branch is where you stand while working.
  */
 const SELF_SCOPE_RE =
-  /\b(my (work|change|diff|implementation|code|fix|patch|branch|pr)|this (diff|change|branch|pr|delta|implementation|patch)|the delta|the change i|what i (wrote|built|changed|implemented)|i just (wrote|built|changed|implemented))\b/i;
+  /\b(my (work|change|diff|implementation|code|fix|patch|branch|pr)|this (diff|change|pr|delta|implementation|patch)|the delta|the change i|what i (wrote|built|changed|implemented)|i just (wrote|built|changed|implemented))\b/i;
 
 export function isSelfScoped(prompt: string): boolean {
   return SELF_SCOPE_RE.test(prompt);
@@ -251,16 +269,50 @@ export function decide(
     return { exit: EXIT_ALLOW, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
 
+  // WARN, not block — a deliberate severity decision, not an oversight.
+  //
+  // This branch decides from PROSE ALONE: `isEvaluationPrompt` and `isSelfScoped`
+  // both infer intent from a natural-language prompt, and no structured fact
+  // corroborates them. Under the tier rule in `docs/contracts/hook-architecture-v1.md`
+  // (§ What a concern may block on) that is Tier 3, and Tier 3 may only warn.
+  //
+  // It is written from measurement, not taste. A 16-way fan-out of IMPLEMENTATION
+  // subagents lost 15 workers to this branch, because `isEvaluationPrompt` fired
+  // on the unavoidable words review/audit/check and `isSelfScoped` on the phrase
+  // `this branch` — an address every worktree dispatch prompt carries. Narrowing
+  // the phrase list fixed that instance; the council convened on the design
+  // (anthropic + openai, 2026-08-12, quorum 2/2) held that no finite pattern can
+  // bound the false-positive set, and that a prompt — unlike a shell command —
+  // has no grammar to anchor an "invoked vs named" discriminator to.
+  //
+  // What is NOT downgraded: the pre-loaded-verdict block above. That one matches
+  // a literal steering formulation ("NO-FINDINGS is expected and welcome"), which
+  // IS the violation rather than evidence of one, so it keeps blocking.
+  //
+  // The route back to blocking is structural, not another regex: a `role` /
+  // `evidence_scope` field the dispatcher sets at the call site, where the caller
+  // knows by construction whether it is commissioning an evaluation. Then this
+  // branch reads a field instead of guessing, and becomes Tier 1.
+  // exit 0 + `decision: "warn"` on stdout is how this dispatcher carries an
+  // advisory — NOT exit 2. The internal ladder's `2 = warn` is read as BLOCK by
+  // Claude Code's native PreToolUse contract, which is the defect that made an
+  // advisory guard a hard deny once already; the same shape here would have kept
+  // the fan-out blocked while claiming to warn.
   if (priorEvaluations >= 1) {
     return {
-      exit: EXIT_BLOCK,
-      stdout: "",
-      stderr:
-        `Blocked: second evaluation dispatch of your own work in this turn (verdict ` +
-        `shopping). One evaluation has already run; commissioning another with a ` +
-        `different prompt or scope selects the answer instead of measuring it. ` +
-        `Report what the first pass returned, then re-plan.\n`,
-      evaluations: priorEvaluations,
+      exit: EXIT_ALLOW,
+      stdout: `${JSON.stringify({
+        decision: "warn",
+        reason:
+          `Second evaluation dispatch of your own work in this turn. If both passes ` +
+          `judge the SAME subject, that is verdict shopping — commissioning another ` +
+          `with a different prompt or scope selects the answer instead of measuring ` +
+          `it. Report what the first pass returned, then re-plan. If this is an ` +
+          `implementation fan-out rather than a second review, carry on: this check ` +
+          `reads prose and cannot tell the two apart with certainty.`,
+      })}\n`,
+      stderr: "",
+      evaluations: priorEvaluations + 1,
     };
   }