@event4u/agent-config 14.14.0 → 14.15.0

package/dist/hooks/dispatch.js

@@ -112,17 +112,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path105) {
-      const ctrl = callVisitor(key, node, visitor, path105);
+    function visit_(key, node, visitor, path106) {
+      const ctrl = callVisitor(key, node, visitor, path106);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path105, ctrl);
-        return visit_(key, ctrl, visitor, path105);
+        replaceNode(key, path106, ctrl);
+        return visit_(key, ctrl, visitor, path106);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path105 = Object.freeze(path105.concat(node));
+          path106 = Object.freeze(path106.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path105);
+            const ci = visit_(i, node.items[i], visitor, path106);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -133,13 +133,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path105 = Object.freeze(path105.concat(node));
-          const ck = visit_("key", node.key, visitor, path105);
+          path106 = Object.freeze(path106.concat(node));
+          const ck = visit_("key", node.key, visitor, path106);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path105);
+          const cv = visit_("value", node.value, visitor, path106);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -160,17 +160,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path105) {
-      const ctrl = await callVisitor(key, node, visitor, path105);
+    async function visitAsync_(key, node, visitor, path106) {
+      const ctrl = await callVisitor(key, node, visitor, path106);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path105, ctrl);
-        return visitAsync_(key, ctrl, visitor, path105);
+        replaceNode(key, path106, ctrl);
+        return visitAsync_(key, ctrl, visitor, path106);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path105 = Object.freeze(path105.concat(node));
+          path106 = Object.freeze(path106.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path105);
+            const ci = await visitAsync_(i, node.items[i], visitor, path106);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -181,13 +181,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path105 = Object.freeze(path105.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path105);
+          path106 = Object.freeze(path106.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path106);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path105);
+          const cv = await visitAsync_("value", node.value, visitor, path106);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -214,23 +214,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path105) {
+    function callVisitor(key, node, visitor, path106) {
       if (typeof visitor === "function")
-        return visitor(key, node, path105);
+        return visitor(key, node, path106);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path105);
+        return visitor.Map?.(key, node, path106);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path105);
+        return visitor.Seq?.(key, node, path106);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path105);
+        return visitor.Pair?.(key, node, path106);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path105);
+        return visitor.Scalar?.(key, node, path106);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path105);
+        return visitor.Alias?.(key, node, path106);
       return void 0;
     }
-    function replaceNode(key, path105, node) {
-      const parent = path105[path105.length - 1];
+    function replaceNode(key, path106, node) {
+      const parent = path106[path106.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -840,10 +840,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path105, value) {
+    function collectionFromPath(schema, path106, value) {
       let v = value;
-      for (let i = path105.length - 1; i >= 0; --i) {
-        const k = path105[i];
+      for (let i = path106.length - 1; i >= 0; --i) {
+        const k = path106[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -862,7 +862,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path105) => path105 == null || typeof path105 === "object" && !!path105[Symbol.iterator]().next().done;
+    var isEmptyPath = (path106) => path106 == null || typeof path106 === "object" && !!path106[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -892,11 +892,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path105, value) {
-        if (isEmptyPath(path105))
+      addIn(path106, value) {
+        if (isEmptyPath(path106))
           this.add(value);
         else {
-          const [key, ...rest] = path105;
+          const [key, ...rest] = path106;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -910,8 +910,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path105) {
-        const [key, ...rest] = path105;
+      deleteIn(path106) {
+        const [key, ...rest] = path106;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -925,8 +925,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path105, keepScalar) {
-        const [key, ...rest] = path105;
+      getIn(path106, keepScalar) {
+        const [key, ...rest] = path106;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -944,8 +944,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path105) {
-        const [key, ...rest] = path105;
+      hasIn(path106) {
+        const [key, ...rest] = path106;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -955,8 +955,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path105, value) {
-        const [key, ...rest] = path105;
+      setIn(path106, value) {
+        const [key, ...rest] = path106;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -3471,9 +3471,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path105, value) {
+      addIn(path106, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path105, value);
+          this.contents.addIn(path106, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -3548,14 +3548,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path105) {
-        if (Collection.isEmptyPath(path105)) {
+      deleteIn(path106) {
+        if (Collection.isEmptyPath(path106)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path105) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path106) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -3570,10 +3570,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path105, keepScalar) {
-        if (Collection.isEmptyPath(path105))
+      getIn(path106, keepScalar) {
+        if (Collection.isEmptyPath(path106))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path105, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path106, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -3584,10 +3584,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path105) {
-        if (Collection.isEmptyPath(path105))
+      hasIn(path106) {
+        if (Collection.isEmptyPath(path106))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path105) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path106) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -3604,13 +3604,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path105, value) {
-        if (Collection.isEmptyPath(path105)) {
+      setIn(path106, value) {
+        if (Collection.isEmptyPath(path106)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path105), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path106), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path105, value);
+          this.contents.setIn(path106, value);
         }
       }
       /**
@@ -5570,9 +5570,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path105) => {
+    visit.itemAtPath = (cst, path106) => {
       let item = cst;
-      for (const [field, index] of path105) {
+      for (const [field, index] of path106) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -5581,23 +5581,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path105) => {
-      const parent = visit.itemAtPath(cst, path105.slice(0, -1));
-      const field = path105[path105.length - 1][0];
+    visit.parentCollection = (cst, path106) => {
+      const parent = visit.itemAtPath(cst, path106.slice(0, -1));
+      const field = path106[path106.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path105, item, visitor) {
-      let ctrl = visitor(item, path105);
+    function _visit(path106, item, visitor) {
+      let ctrl = visitor(item, path106);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path105.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path106.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -5608,10 +5608,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path105);
+            ctrl = ctrl(item, path106);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path105) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path106) : ctrl;
     }
     exports.visit = visit;
   }
@@ -6913,14 +6913,14 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs102 = this.flowScalar(this.type);
+              const fs103 = this.flowScalar(this.type);
               if (atNextItem || it.value) {
-                map.items.push({ start, key: fs102, sep: [] });
+                map.items.push({ start, key: fs103, sep: [] });
                 this.onKeyLine = true;
               } else if (it.sep) {
-                this.stack.push(fs102);
+                this.stack.push(fs103);
               } else {
-                Object.assign(it, { key: fs102, sep: [] });
+                Object.assign(it, { key: fs103, sep: [] });
                 this.onKeyLine = true;
               }
               return;
@@ -7048,13 +7048,13 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs102 = this.flowScalar(this.type);
+              const fs103 = this.flowScalar(this.type);
               if (!it || it.value)
-                fc.items.push({ start: [], key: fs102, sep: [] });
+                fc.items.push({ start: [], key: fs103, sep: [] });
               else if (it.sep)
-                this.stack.push(fs102);
+                this.stack.push(fs103);
               else
-                Object.assign(it, { key: fs102, sep: [] });
+                Object.assign(it, { key: fs103, sep: [] });
               return;
             }
             case "flow-map-end":
@@ -7363,14 +7363,14 @@ var require_dist = __commonJS({
 });
 
 // src/scripts/hooks/dispatch_entry.ts
-import * as path104 from "node:path";
+import * as path105 from "node:path";
 import { fileURLToPath as fileURLToPath67 } from "node:url";
 
 // src/scripts/hooks/dispatch_hook.ts
 var import_yaml6 = __toESM(require_dist(), 1);
 import { spawnSync as spawnSync10 } from "node:child_process";
-import fs101 from "node:fs";
-import path103 from "node:path";
+import fs102 from "node:fs";
+import path104 from "node:path";
 import * as tty2 from "node:tty";
 import { fileURLToPath as fileURLToPath66, pathToFileURL as pathToFileURL59 } from "node:url";
 
@@ -24686,8 +24686,8 @@ function lockfile_path(env) {
   }
   return write_target("installed.lock", { env: env ?? null });
 }
-function read_lockfile(path105) {
-  const target = path105 ?? lockfile_path();
+function read_lockfile(path106) {
+  const target = path106 ?? lockfile_path();
   let text;
   try {
     text = fs51.readFileSync(target, { encoding: "utf-8" });
@@ -25850,12 +25850,39 @@ var ALL_OPS = [
   "pr-merge-auto",
   "tag",
   "release",
-  "publish"
+  "publish",
+  "unpublish",
+  "deprecate",
+  "release-asset",
+  "protection",
+  "workflow-toggle",
+  "repo-lifecycle",
+  "review-approve",
+  "force-push",
+  "worktree-remove",
+  "clean-ignored",
+  "tag-force",
+  "rebase",
+  "reset-hard",
+  "clean",
+  "stash-drop",
+  "branch-delete",
+  "close"
 ];
 var PHRASES = [
   { op: "commit", re: /\b(commit(e|et|te|ten)?|committe|einchecken)\b/i },
   { op: "push", re: /\b(push(e|en|t)?|hochladen|hochschieben|raufschieben)\b/i },
-  { op: "branch", re: /\b(branch|feature-branch|zweig)\b/i },
+  // A CREATION VERB IS REQUIRED, as for `pr-create` above and for the same
+  // reason. The bare noun could not tell an authorization from a mention, and
+  // the mention is the dangerous half: "den branch nicht löschen" names the
+  // object precisely in order to forbid acting on it, yet authorized branch
+  // creation — the negation trails a bare-noun match, so neither the
+  // look-behind nor the span check in `negatedBefore` can reach it. Widened
+  // 2026-09-03 alongside the destructive-coverage work that measured it.
+  {
+    op: "branch",
+    re: /\b(erstell(e|en)?|mach(e|en)?|leg(e|en)?\s+an|anleg(e|en)?|(er|be)?(ö|oe)ffne|open|create|new|neuer?|starte?|checkout|wechsl?e|switch)\b[^.\n]{0,30}\b(branch|feature-branch|zweig)\b|\b(branch|feature-branch|zweig)\b[^.\n]{0,25}\b(erstellen|anlegen|aufmachen|(ö|oe)ffnen|starten)\b/i
+  },
   // A creation verb is required — "schau dir den PR an" is not "open a PR".
   {
     op: "pr-create",
@@ -25892,7 +25919,111 @@ var PHRASES = [
     op: "release",
     re: /\b(releasen?|ver(ö|oe)ffentlich(e|en))\b(?!\s*[- ]?(notes?|branch|candidate|pr\b|datum|date|zweig))/i
   },
-  { op: "publish", re: /\b(publish(e|en)?|publiziere[n]?)\b/i }
+  { op: "publish", re: /\b(publish(e|en)?|publiziere[n]?)\b/i },
+  // ── Authorization vocabulary for the ops added 2026-09-03.
+  //
+  // NON-NEGOTIABLE, and the reason it ships in the same change as the new BLOCK
+  // ops: a blocked operation with no phrase that authorizes it is a dead end.
+  // The guard refuses, the user says "doch, mach das", the classifier records
+  // nothing, and the refusal repeats forever. Every op the guard can block must
+  // have a sentence that unblocks it, or the user's override is a claim rather
+  // than a mechanism.
+  //
+  // Tight on purpose. Under-matching costs one confirmation; over-matching
+  // authorizes something the user did not ask for, so each pattern demands the
+  // object noun rather than a bare verb wherever the verb is ordinary German.
+  //
+  // `unpublish` before nothing in particular — `\bpublish\b` does not match
+  // inside "unpublish" (no word boundary between `n` and `p`), so the two never
+  // collide.
+  // TWO SHAPES EVERY GERMAN PATTERN BELOW MUST CARRY, both learned from tests
+  // that went red rather than from inspection:
+  //
+  //   1. THE IMPERATIVE DROPS ITS `-e`. "entfern die worktree", "archivier das
+  //      repo", "deaktivier den workflow" are what people type; `entfern(e|en)`
+  //      matches none of them. Every verb ending is therefore `(e|en)?`.
+  //   2. WORD ORDER GOES BOTH WAYS. "archivier das repo" and "das repo
+  //      archivieren" are one instruction, and a pattern anchored on the noun
+  //      first sees only the second.
+  //
+  // The object noun stays REQUIRED in every pattern that has one. That is what
+  // keeps the loosened verb endings from over-authorizing: "lösch" alone
+  // authorizes nothing, "lösch den branch" authorizes a branch deletion.
+  { op: "unpublish", re: /\bunpublish(e|en)?\b/i },
+  {
+    op: "deprecate",
+    re: /\bdeprecate(d|n)?\b|\bals\s+veraltet\s+markier(e|en)?\b/i
+  },
+  {
+    op: "release-asset",
+    re: /\brelease[-\s]?asset\b|\b(clobber|(ü|ue)berschreib(e|en)?|ersetz(e|en)?|replace|austausch(e|en)?)\b[^.\n]{0,25}\b(asset|artefakt|artifact|tarball|binary)\b|\b(asset|artefakt|artifact)\b[^.\n]{0,25}\b((ü|ue)berschreiben|ersetzen|austauschen|replace)\b/i
+  },
+  // A VERB IS REQUIRED, like `tag` and `release` above and for the same reason.
+  // A bare noun cannot tell an authorization from a mention, and here the
+  // mention is the dangerous half: "die branch-protection nicht anfassen" names
+  // the object precisely in order to forbid touching it. Measured — this was the
+  // one row of the negation corpus that neither the look-behind nor the
+  // span check could reach, because the negation trails a bare-noun match.
+  {
+    op: "protection",
+    re: /\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|deaktivier(e|en)?|nimm|weg|remove|delete|disable|drop|lift)\b[^.\n]{0,30}\b(branch[-\s]?protection|protection[-\s]?rule|schutzregel|ruleset)\b|\b(branch[-\s]?protection|protection[-\s]?rule|schutzregel|ruleset)\b[^.\n]{0,30}\b(entfernen|l(ö|oe)schen|deaktivieren|abschalten|remove|delete|disable|drop|lift|weg)\b/i
+  },
+  {
+    op: "workflow-toggle",
+    re: /\bworkflow\b[^.\n]{0,25}\b(deaktivier(e|en)?|aktivier(e|en)?|disable|enable|abschalt(e|en)?|ausschalt(e|en)?)\b|\b(deaktivier(e|en)?|aktivier(e|en)?|disable|enable|abschalt(e|en)?|ausschalt(e|en)?)\b[^.\n]{0,25}\bworkflow\b/i
+  },
+  {
+    op: "repo-lifecycle",
+    re: /\b(repo|repository)\b[^.\n]{0,30}\b(archivier(e|en)?|archive|l(ö|oe)sch(e|en)?|delete)\b|\b(archivier(e|en)?|archive|l(ö|oe)sch(e|en)?|delete)\b[^.\n]{0,25}\b(repo|repository)\b|\b(repo|repository)\b[^.\n]{0,30}\bauf\s+(privat|public|öffentlich|private)\b/i
+  },
+  {
+    op: "review-approve",
+    re: /\b(approve|genehmig(e|en)?|freigeb(e|en)?|abnehm(e|en)?)\b[^.\n]{0,30}\b(review|pr|pull[-\s]request)\b|\b(review|pr|pull[-\s]request)\b[^.\n]{0,20}\b(approve|approven|genehmigen|freigeben)\b/i
+  },
+  {
+    op: "force-push",
+    re: /\bforce[-\s]?push(e|en|st)?\b|--force(-with-lease)?\b|\bmit\s+gewalt\s+push(e|en)?\b/i
+  },
+  {
+    op: "worktree-remove",
+    re: /\bworktree\b[^.\n]{0,25}\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|remove|delete|weg(werfen|r(ä|ae)umen))\b|\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|remove|delete)\b[^.\n]{0,25}\bworktree\b/i
+  },
+  // The `-x` flag is the whole distinction: without it `git clean` spares
+  // ignored files, with it `.env` and local certificates go too.
+  {
+    op: "clean-ignored",
+    re: /\bgit\s+clean\b[^.\n]{0,20}-[A-Za-z]*x|\b(ignorierte|ignored)\b[^.\n]{0,25}\b(dateien|files)\b[^.\n]{0,25}\b(l(ö|oe)sch(e|en)?|entfern(e|en)?|remove|delete)\b/i
+  },
+  {
+    op: "tag-force",
+    re: /\btag\b[^.\n]{0,25}\b(verschieb(e|en)?|(ü|ue)berschreib(e|en)?|umh(ä|ae)ng(e|en)?|force|move)\b|\b(verschieb(e|en)?|(ü|ue)berschreib(e|en)?)\b[^.\n]{0,20}\btag\b/i
+  },
+  { op: "rebase", re: /\brebase(n|st|d)?\b/i },
+  {
+    op: "reset-hard",
+    re: /\breset\s+--hard\b|\bhard\s+reset\b|\bhart\s+zur(ü|ue)cksetz(e|en)?\b/i
+  },
+  { op: "clean", re: /\bgit\s+clean\b/i },
+  {
+    op: "stash-drop",
+    re: /\bstash\b[^.\n]{0,25}\b(drop|clear|verwerf(e|en)?|l(ö|oe)sch(e|en)?)\b|\b(verwerf(e|en)?|l(ö|oe)sch(e|en)?|drop)\b[^.\n]{0,20}\bstash\b/i
+  },
+  {
+    op: "branch-delete",
+    re: /\b(l(ö|oe)sch(e|en)?|entfern(e|en)?|delete|remove)\b[^.\n]{0,25}\b(branch|branches|zweig)\b|\b(branch|branches|zweig)\b[^.\n]{0,25}\b(l(ö|oe)schen|entfernen|delete|remove)\b/i
+  },
+  {
+    op: "close",
+    re: /\b(schlie(ß|ss)(e|en)?|close)\b[^.\n]{0,30}\b(pr|pull[-\s]request|issue|ticket)\b|\b(pr|pull[-\s]request|issue|ticket)\b[^.\n]{0,20}\b(schlie(ß|ss)en|close)\b/i
+  },
+  // Enabling auto-merge is its own op on the guard side, so it needs its own
+  // sentence. Without one it is the dead end this block exists to prevent: the
+  // plain merge phrase authorizes `pr-merge` and never `pr-merge-auto`, so the
+  // refusal would have repeated forever.
+  {
+    op: "pr-merge-auto",
+    re: /\bauto[-\s]?merge\b|\bmerge\b[^.\n]{0,20}\bautomatisch\b|\bautomatisch\b[^.\n]{0,20}\bmerg(e|en)\b/i
+  }
 ];
 var OUTPUT_LINE = /^\s*(To\s+\S+|remote:|error:|fatal:|hint:|warning:|!\s|\?\?\s|\s*\^|[-+]{3}\s|@@\s|\$\s|>\s|\d+\s+(pass|fail)|npm ERR!|Error:|Traceback|at\s+\S+:\d+)/i;
 function isInterrogative(prose) {
@@ -25953,6 +26084,67 @@ function splitFences(prompt) {
 function _commandLines(fence) {
   return fence.split("\n").map((l) => l.trim()).filter((l) => l.length > 0).filter((l) => !/^(remote:|error:|hint:|fatal:|warning:|To |!\s|\s*\^)/i.test(l)).map((l) => l.replace(/^[$>#]\s*/, "")).filter((l) => /^(git|gh|npm|pnpm|yarn|task)\b/.test(l));
 }
+function extractMergeTargets(prompt) {
+  const out = /* @__PURE__ */ new Set();
+  const re = /(?:#|\bpr[- ]?|\bpull[- ]request\s+#?)(\d{1,7})\b/giu;
+  let m;
+  while ((m = re.exec(prompt)) !== null) {
+    const n = Number.parseInt(m[1], 10);
+    if (Number.isSafeInteger(n) && n > 0) {
+      out.add(n);
+    }
+  }
+  return [...out].sort((a, b) => a - b);
+}
+var REVOKE_RE = /\b(stop|stopp|halt|abbrechen|abbruch|cancel|revoke|widerruf(en)?|zur(ü|ue)ck(nehmen|ziehen)|hold\s+(everything|on|the\s+merge)|warte|wait)\b|(?:\b(nicht|kein(e|en)?|no|not|dont|don't|never|niemals|nie)\b[^.!?\n]{0,30}\b(merg(e|en|ing)|zusammenf(ü|ue)hren)\b)/iu;
+function isRevocation(prompt) {
+  return REVOKE_RE.test(prompt);
+}
+function _grantId(session_id, at, targets) {
+  return `${sessionSlug(session_id) || "nosession"}:${at}:${targets.join(",")}`;
+}
+function foldGrants(prior, prompt, authorized, session_id, now) {
+  if (isRevocation(prompt)) {
+    return [];
+  }
+  const carried = prior.filter((g) => g.consumed.length < g.targets.length);
+  if (!authorized.includes("pr-merge")) {
+    return carried;
+  }
+  const targets = extractMergeTargets(prompt);
+  if (targets.length === 0) {
+    return carried;
+  }
+  const at = now.toISOString();
+  const already = new Set(carried.flatMap((g) => g.targets));
+  const fresh = targets.filter((t) => !already.has(t));
+  if (fresh.length === 0) {
+    return carried;
+  }
+  return [
+    ...carried,
+    {
+      id: _grantId(session_id, at, fresh),
+      op: "pr-merge",
+      targets: fresh,
+      consumed: [],
+      granted_at: at,
+      evidence: prompt.trim().slice(0, 120)
+    }
+  ];
+}
+var NEGATION_WORD = /\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b/i;
+function negatedBefore(text, index, matched = "") {
+  let start = 0;
+  for (const mark of [".", "!", "?", "\n"]) {
+    const at = text.lastIndexOf(mark, index - 1);
+    if (at + 1 > start) {
+      start = at + 1;
+    }
+  }
+  const before = text.slice(Math.max(start, index - 30), index);
+  return NEGATION_WORD.test(before) || NEGATION_WORD.test(matched);
+}
 function classifyAuthorization(prompt) {
   const { prose, fences } = splitFences(prompt);
   const authorized = /* @__PURE__ */ new Set();
@@ -25960,7 +26152,7 @@ function classifyAuthorization(prompt) {
   const instruction = prose.split("\n").filter((l) => !OUTPUT_LINE.test(l)).join("\n");
   for (const { op, re } of isInterrogative(instruction) ? [] : PHRASES) {
     const m = re.exec(instruction);
-    if (m) {
+    if (m && !negatedBefore(instruction, m.index, m[0])) {
       authorized.add(op);
       evidence[op] = `prose: "${m[0]}"`;
     }
@@ -25982,6 +26174,68 @@ function classifyAuthorization(prompt) {
   }
   return { authorized: [...authorized], evidence };
 }
+function readGrants(consumer_root, session_id) {
+  try {
+    const raw = fs55.readFileSync(path55.join(consumer_root, ledgerFileFor(session_id)), "utf8");
+    const decoded = JSON.parse(raw);
+    if (!_isObject8(decoded) || !Array.isArray(decoded["grants"])) {
+      return [];
+    }
+    const owner = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
+    if (session_id && owner && owner !== session_id) {
+      return [];
+    }
+    return decoded["grants"].flatMap((g) => {
+      if (!_isObject8(g)) return [];
+      const op = g["op"];
+      if (typeof op !== "string" || !ALL_OPS.includes(op)) return [];
+      const targets = Array.isArray(g["targets"]) ? g["targets"] : [];
+      const consumed = Array.isArray(g["consumed"]) ? g["consumed"] : [];
+      return [
+        {
+          id: String(g["id"] ?? ""),
+          op,
+          targets: targets.filter((t) => typeof t === "number"),
+          consumed: consumed.filter((t) => typeof t === "number"),
+          granted_at: String(g["granted_at"] ?? ""),
+          evidence: String(g["evidence"] ?? "")
+        }
+      ];
+    });
+  } catch {
+    return [];
+  }
+}
+function consumeGrantTarget(consumer_root, session_id, target) {
+  const file = path55.join(consumer_root, ledgerFileFor(session_id));
+  let decoded;
+  try {
+    decoded = JSON.parse(fs55.readFileSync(file, "utf8"));
+  } catch {
+    return;
+  }
+  if (!_isObject8(decoded) || !Array.isArray(decoded["grants"])) {
+    return;
+  }
+  let touched = false;
+  for (const g of decoded["grants"]) {
+    if (!_isObject8(g) || !Array.isArray(g["targets"]) || !Array.isArray(g["consumed"])) {
+      continue;
+    }
+    const targets = g["targets"];
+    const consumed = g["consumed"];
+    if (targets.includes(target) && !consumed.includes(target)) {
+      consumed.push(target);
+      touched = true;
+    }
+  }
+  if (touched) {
+    try {
+      atomic_write_json(file, decoded);
+    } catch {
+    }
+  }
+}
 function takePending(consumer_root, session_id, now) {
   const file = path55.join(consumer_root, pendingFileFor(session_id));
   let raw;
@@ -26050,12 +26304,24 @@ function run10(stdin_text, options) {
     authorized.push(pending.op);
     evidence[pending.op] = `confirmation of the refused \`${pending.op}\` (refused ${pending.refused_at}): "${prompt.trim().slice(0, 40)}"`;
   }
+  const now = /* @__PURE__ */ new Date();
   const ledger = {
     session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
-    detected_at: (/* @__PURE__ */ new Date()).toISOString(),
+    detected_at: now.toISOString(),
     authorized,
     evidence,
-    prompt_chars: prompt.length
+    prompt_chars: prompt.length,
+    // Grants survive this write; `authorized` does not. That asymmetry IS the
+    // decision. A bare operation name stays one-shot exactly as `commit-policy`
+    // requires, and only an authorization that also froze its objects earns a
+    // life longer than the turn. See ADR-252.
+    grants: foldGrants(
+      readGrants(options.consumer_root, session),
+      prompt,
+      authorized,
+      session,
+      now
+    )
   };
   try {
     atomic_write_json(path55.join(options.consumer_root, ledgerFileFor(session)), ledger);
@@ -26104,6 +26370,95 @@ if (_isCliEntry24()) {
 import fs56 from "node:fs";
 import path56 from "node:path";
 import { fileURLToPath as fileURLToPath34, pathToFileURL as pathToFileURL27 } from "node:url";
+
+// src/scripts/hooks/merge_impact.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+var DESTRUCTIVE_MARKERS = [
+  // Schema removal. Matched on ADDED lines only — a migration that *removes* a
+  // dropColumn call is the opposite of destructive, and matching the raw patch
+  // would score it the same way.
+  { label: "migration drops a column or table", re: /^\+.*\b(dropColumn|dropTable|dropIfExists|removeColumn|drop_column|drop_table)\b/im },
+  { label: "raw DROP or TRUNCATE in a migration", re: /^\+.*\b(DROP\s+(TABLE|COLUMN|INDEX|CONSTRAINT)|TRUNCATE\s+TABLE)\b/im },
+  // The author said so themselves. Conventional Commits marks a breaking change
+  // with a `!` before the colon or a body trailer.
+  { label: "author marked a BREAKING CHANGE", re: /^\+.*BREAKING[ -]CHANGE/m },
+  // A removed export is the shape most likely to break an importer.
+  { label: "an exported symbol was removed", re: /^-\s*export\s+(default\s+|const\s+|function\s+|class\s+|interface\s+|type\s+|async\s+)/m },
+  { label: "a public PHP or Python symbol was removed", re: /^-\s*(public\s+function|def\s+[a-z_]+\s*\()/m },
+  // Route removal breaks callers that never imported anything.
+  { label: "a route or endpoint was removed", re: /^-.*\b(Route::(get|post|put|patch|delete)|@(Get|Post|Put|Patch|Delete)Mapping|app\.(get|post|put|patch|delete)\s*\()/m },
+  { label: "a whole file was deleted", re: /^deleted file mode /m }
+];
+var MAJOR_BUMP = /^-\s*"version"\s*:\s*"(\d+)\.[^"]*"[\s\S]{0,200}?^\+\s*"version"\s*:\s*"(\d+)\./m;
+function classifyDiff(patch) {
+  if (patch.trim() === "") {
+    return { verdict: "undecidable", markers: [], reason: "empty diff" };
+  }
+  const markers = [];
+  for (const { label, re } of DESTRUCTIVE_MARKERS) {
+    if (re.test(patch)) {
+      markers.push(label);
+    }
+  }
+  const bump = MAJOR_BUMP.exec(patch);
+  if (bump && bump[1] !== bump[2]) {
+    markers.push(`major version bump ${bump[1]}.x to ${bump[2]}.x`);
+  }
+  const filesChanged = (patch.match(/^diff --git /gm) ?? []).length;
+  if (markers.length > 0) {
+    return { verdict: "destructive", markers, filesChanged };
+  }
+  return { verdict: "additive", markers: [], filesChanged };
+}
+function fetchPatch(pr, opts = {}) {
+  const run13 = opts.exec ?? execFileSync3;
+  const cwd = opts.cwd ?? process.cwd();
+  const capture = (file, args) => run13(file, args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 15e3 });
+  for (const ref of [`refs/pull/${pr}/head`, `pull/${pr}/head`]) {
+    try {
+      const base = capture("git", ["merge-base", "HEAD", ref]).trim();
+      if (base) {
+        const patch = capture("git", ["diff", `${base}...${ref}`]);
+        if (patch.trim() !== "") {
+          return { patch, source: "local" };
+        }
+      }
+    } catch {
+    }
+  }
+  if (opts.allowNetwork === false) {
+    return { patch: "", source: "none", reason: "no local ref and network reads disabled" };
+  }
+  try {
+    const patch = capture("gh", ["pr", "diff", String(pr), "--patch"]);
+    if (patch.trim() !== "") {
+      return { patch, source: "gh" };
+    }
+    return { patch: "", source: "none", reason: "gh returned an empty diff" };
+  } catch {
+    return { patch: "", source: "none", reason: "no local ref, and gh pr diff failed" };
+  }
+}
+function analyseMergeImpact(pr, opts = {}) {
+  const got = fetchPatch(pr, opts);
+  if (got.source === "none") {
+    return { verdict: "undecidable", markers: [], ...got.reason ? { reason: got.reason } : {} };
+  }
+  return classifyDiff(got.patch);
+}
+function describeImpact(pr, impact) {
+  const say = `Say "merge #${pr}" to authorize it.`;
+  switch (impact.verdict) {
+    case "additive":
+      return `Impact scan: PR #${pr} touches ${impact.filesChanged ?? 0} file(s) and trips no destructive marker \u2014 no schema drop, no removed export or route, no major bump, no BREAKING CHANGE. Additive as far as the diff can show, which is not the same as safe to merge: the base has moved since review and merging may trigger a deploy. ${say}`;
+    case "destructive":
+      return `Impact scan: PR #${pr} is NOT additive \u2014 ${impact.markers.join("; ")}. Read the diff before authorizing. ${say}`;
+    default:
+      return `Impact scan: could not read the diff for PR #${pr} (${impact.reason ?? "unknown"}), so nothing is known about what it changes. ${say}`;
+  }
+}
+
+// src/scripts/hooks/block_unauthorized_git.ts
 var EXIT_ALLOW11 = 0;
 var EXIT_BLOCK = 1;
 function _isObject9(v) {
@@ -26116,13 +26471,52 @@ var BLOCK_OPS = /* @__PURE__ */ new Set([
   "pr-merge",
   // Enabling auto-merge commits the outcome to a condition the agent does not
   // control, so it is blocked on the same terms as the merge it schedules.
-  "pr-merge-auto"
+  "pr-merge-auto",
+  // ── Added 2026-09-03. Every one is already never-autonomous in the
+  // `non-destructive-by-default` prose; the measurement that drove it is in the
+  // `GitOp` union's own note — 17 of 25 borderline operations classified as
+  // NOTHING, including three worse than anything the guard already caught.
+  /** The undo that is more destructive than the act: lockfiles break. */
+  "unpublish",
+  /** Metadata only, and every install on earth starts warning. */
+  "deprecate",
+  /** Replaces bytes consumers already hold a checksum for. */
+  "release-asset",
+  /** Deletes the guard rather than the data — everything after is unguarded. */
+  "protection",
+  /** No data lost; the gate that protects everything downstream is off. */
+  "workflow-toggle",
+  /** Reach outside the repository, and mostly one-way. */
+  "repo-lifecycle",
+  /** No code moves, and an armed auto-merge is released. */
+  "review-approve",
+  /** Discards commits that landed after the last fetch, on a shared ref. */
+  "force-push",
+  /** Destroys uncommitted work belonging to a session this one cannot see. */
+  "worktree-remove",
+  /** `-x` is the flag that takes `.env` and local certificates. */
+  "clean-ignored"
 ]);
 var WARN_OPS = /* @__PURE__ */ new Set([
   "commit",
   "push",
   "pr-create",
-  "branch"
+  "branch",
+  // ── Added 2026-09-03, deliberately at warn rather than block.
+  //
+  // Each is destructive in some reading, and each is also routine enough that
+  // blocking it would be the friction that gets the whole guard routed around —
+  // the failure mode this estate has already recorded twice. `reset-hard` is the
+  // sharpest case and stays here for a decidable reason: the Hard Floor's
+  // qualifier is "past unpushed work", and the command text cannot say whether
+  // the work was pushed.
+  "tag-force",
+  "rebase",
+  "reset-hard",
+  "clean",
+  "stash-drop",
+  "branch-delete",
+  "close"
 ]);
 var G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
 var P = "^(?:\\S*\\/)?";
@@ -26168,6 +26562,72 @@ var COMMAND_OPS = [
     op: "pr-create",
     re: new RegExp(`${P}gh\\s+pr\\s+create\\b|${ghApiWrite("\\/pulls\\b").source}`, "i")
   },
+  // ── Added 2026-09-03. Placement inside this table is as load-bearing as the
+  // patterns: the loop takes the MOST SEVERE match per segment, but within one
+  // op the first pattern wins, so anything more specific than a plain `git push`
+  // has to sit above it.
+  // `npm unpublish` is NOT reached by the publish pattern — `\bpublish\b` needs
+  // a word boundary that `unpublish` does not provide between `n` and `p`. That
+  // is why it classified as nothing for as long as it did.
+  { op: "unpublish", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}unpublish\\b`, "i") },
+  { op: "deprecate", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}deprecate\\b`, "i") },
+  {
+    op: "release-asset",
+    re: new RegExp(`${P}gh\\s+release\\s+(upload|edit|delete)\\b`, "i")
+  },
+  {
+    op: "protection",
+    re: new RegExp(
+      `${P}gh\\s+api\\b(?=[^\\n]*(?:protection|rulesets?)\\b)(?=[^\\n]*(?:-X|--method)\\s+(?:DELETE|PUT|PATCH|POST)\\b)|${P}gh\\s+ruleset\\s+delete\\b`,
+      "i"
+    )
+  },
+  {
+    op: "workflow-toggle",
+    re: new RegExp(`${P}gh\\s+workflow\\s+(disable|enable)\\b`, "i")
+  },
+  {
+    op: "repo-lifecycle",
+    re: new RegExp(
+      `${P}gh\\s+repo\\s+(archive|delete|unarchive)\\b|${P}gh\\s+repo\\s+edit\\b(?=[^\\n]*--visibility\\b)`,
+      "i"
+    )
+  },
+  {
+    op: "review-approve",
+    re: new RegExp(`${P}gh\\s+pr\\s+review\\b(?=[^\\n]*--approve\\b)`, "i")
+  },
+  // Above `push`, and both spellings: `--force` and `--force-with-lease`. The
+  // "safe force" is in the same class here because what it is safe against is a
+  // stale local view, not a collaborator who pushed after your fetch.
+  {
+    op: "force-push",
+    re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)`, "i")
+  },
+  {
+    op: "worktree-remove",
+    re: new RegExp(`${P}git\\s+worktree\\s+remove\\b[^\\n;|&]*(--force\\b|\\s-f\\b)`, "i")
+  },
+  // `-x` (or `-X`) anywhere in the flag cluster is what reaches ignored files.
+  {
+    op: "clean-ignored",
+    re: new RegExp(`${P}git\\s+clean\\b[^\\n;|&]*-[A-Za-z]*x`, "i")
+  },
+  { op: "tag-force", re: new RegExp(`${P}git\\s+tag\\b[^\\n;|&]*(-f\\b|--force\\b)`, "i") },
+  { op: "rebase", re: new RegExp(`${P}git\\s+${G}rebase\\b`, "i") },
+  { op: "reset-hard", re: new RegExp(`${P}git\\s+${G}reset\\b[^\\n;|&]*--hard\\b`, "i") },
+  { op: "clean", re: new RegExp(`${P}git\\s+clean\\b`, "i") },
+  { op: "stash-drop", re: new RegExp(`${P}git\\s+stash\\s+(drop|clear)\\b`, "i") },
+  // Remote deletion and the local `-D` are one op: both remove a ref, and the
+  // remote form additionally closes any open PR pointing at it.
+  {
+    op: "branch-delete",
+    re: new RegExp(
+      `${P}git\\s+branch\\b[^\\n;|&]*(-D\\b|--delete\\b)|${P}git\\s+${G}push\\b[^\\n;|&]*(--delete\\b|\\s:\\S)`,
+      "i"
+    )
+  },
+  { op: "close", re: new RegExp(`${P}gh\\s+(pr|issue)\\s+close\\b`, "i") },
   { op: "push", re: new RegExp(`${P}git\\s+${G}push\\b`, "i") },
   { op: "commit", re: new RegExp(`${P}git\\s+${G}commit\\b`, "i") },
   { op: "branch", re: new RegExp(`${P}git\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") }
@@ -26360,8 +26820,25 @@ function commandOp(command) {
   }
   return found;
 }
+function mergeTargetOf(command) {
+  const gh = /\bgh\s+pr\s+merge\s+(?:-{1,2}\S+\s+)*?(\d{1,7})\b/i.exec(command);
+  if (gh) {
+    return Number.parseInt(gh[1], 10);
+  }
+  const api = /\/pulls\/(\d{1,7})\/merge\b/i.exec(command);
+  return api ? Number.parseInt(api[1], 10) : null;
+}
+function grantCovers(grants, op, target) {
+  if (op !== "pr-merge" || target === null) {
+    return null;
+  }
+  return grants.find(
+    (g) => g.op === "pr-merge" && g.targets.includes(target) && !g.consumed.includes(target)
+  ) ?? null;
+}
 var LEDGER_MAX_AGE_MS = 30 * 60 * 1e3;
 function _loadLedger(consumer_root, session_id, now) {
+  const grants = readGrants(consumer_root, session_id);
   const candidates = [ledgerFileFor(session_id)];
   if (!candidates.includes(STATE_FILE7)) {
     candidates.push(STATE_FILE7);
@@ -26369,10 +26846,10 @@ function _loadLedger(consumer_root, session_id, now) {
   for (const rel of candidates) {
     const found = _readLedgerFile(path56.join(consumer_root, rel), session_id, now);
     if (found !== null) {
-      return found;
+      return { ...found, grants };
     }
   }
-  return { authorized: /* @__PURE__ */ new Set(), present: false };
+  return { authorized: /* @__PURE__ */ new Set(), present: false, grants };
 }
 function _readLedgerFile(file, session_id, now) {
   try {
@@ -26396,7 +26873,7 @@ function _readLedgerFile(file, session_id, now) {
   }
   return null;
 }
-function decide(command, ledger) {
+function decide(command, ledger, impact) {
   if (command === null) {
     return { exit: EXIT_ALLOW11, stdout: "", stderr: "" };
   }
@@ -26404,9 +26881,14 @@ function decide(command, ledger) {
   if (op === null || ledger.authorized.has(op)) {
     return { exit: EXIT_ALLOW11, stdout: "", stderr: "" };
   }
+  const target = mergeTargetOf(command);
+  if (grantCovers(ledger.grants ?? [], op, target) && target !== null) {
+    return { exit: EXIT_ALLOW11, stdout: "", stderr: "", consumedTarget: target };
+  }
   const shown = command.length > 120 ? `${command.slice(0, 117)}\u2026` : command;
   if (BLOCK_OPS.has(op)) {
-    const reason = `Blocked: \`${op}\` with no authorization in this turn's prompt. This operation is irreversible and non-destructive-by-default already declares it never-autonomous. Command: ${shown}. Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
+    const scan = op === "pr-merge" && target !== null && impact ? ` ${impact}` : "";
+    const reason = `Blocked: \`${op}\` with no authorization in this turn's prompt. This operation is irreversible and non-destructive-by-default already declares it never-autonomous. Command: ${shown}.${scan} Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
     return { exit: EXIT_BLOCK, stdout: "", stderr: `${reason}
 `, blockedOp: op };
   }
@@ -26434,10 +26916,24 @@ function run11(stdin_text, options) {
     }
   }
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
-  const decision = decide(
-    extractCommand(envelope),
-    _loadLedger(options.consumer_root, session_id, Date.now())
-  );
+  const command = extractCommand(envelope);
+  const ledger = _loadLedger(options.consumer_root, session_id, Date.now());
+  let impact;
+  const stage1 = command === null ? null : commandOp(command);
+  const stage2Target = command === null ? null : mergeTargetOf(command);
+  if (stage1 === "pr-merge" && stage2Target !== null && !ledger.authorized.has("pr-merge") && !grantCovers(ledger.grants ?? [], "pr-merge", stage2Target)) {
+    try {
+      impact = describeImpact(
+        stage2Target,
+        analyseMergeImpact(stage2Target, { cwd: options.consumer_root })
+      );
+    } catch {
+    }
+  }
+  const decision = decide(command, ledger, impact);
+  if (decision.consumedTarget !== void 0) {
+    consumeGrantTarget(options.consumer_root, session_id, decision.consumedTarget);
+  }
   if (decision.blockedOp) {
     try {
       atomic_write_json(path56.join(options.consumer_root, pendingFileFor(session_id)), {
@@ -29177,7 +29673,7 @@ import path67 from "node:path";
 import { fileURLToPath as fileURLToPath43, pathToFileURL as pathToFileURL36 } from "node:url";
 
 // src/scripts/code_graph/detect.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 import * as fs66 from "node:fs";
 import * as path66 from "node:path";
 
@@ -29228,7 +29724,7 @@ function validateGraph(g) {
 var CONSUMER_CANDIDATES = ["graph.json", "code-graph.json", ".code-graph/graph.json"];
 function gitLastCommitEpoch(root) {
   try {
-    const out = execFileSync3("git", ["-C", root, "log", "-1", "--format=%ct"], {
+    const out = execFileSync4("git", ["-C", root, "log", "-1", "--format=%ct"], {
       env: hardenedSpawnEnv(),
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -29241,7 +29737,7 @@ function gitLastCommitEpoch(root) {
 }
 function commitsBehind(root, sha) {
   try {
-    const out = execFileSync3("git", ["-C", root, "rev-list", "--count", `${sha}..HEAD`], {
+    const out = execFileSync4("git", ["-C", root, "rev-list", "--count", `${sha}..HEAD`], {
       env: hardenedSpawnEnv(),
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -33893,6 +34389,61 @@ function changedFiles(root, base) {
   const dirty = m.status === 0 ? m.stdout.split("\n") : [];
   return [.../* @__PURE__ */ new Set([...tracked, ...untracked, ...dirty])].filter((f) => f.trim().length > 0);
 }
+function addedLineMap(root, base) {
+  const out = /* @__PURE__ */ new Map();
+  const u = spawnSync9("git", ["ls-files", "--others", "--exclude-standard"], {
+    cwd: root,
+    encoding: "utf-8"
+  });
+  if (u.status === 0) {
+    for (const f of u.stdout.split("\n")) {
+      if (f.trim()) out.set(f.trim(), "all");
+    }
+  }
+  for (const argv of [
+    ["diff", "--unified=0", "--diff-filter=ACMR", `${base}...HEAD`],
+    ["diff", "--unified=0", "--diff-filter=ACMR"]
+  ]) {
+    const r = spawnSync9("git", argv, { cwd: root, encoding: "utf-8" });
+    if (r.status !== 0) continue;
+    mergeAddedLines(out, parseAddedLines(r.stdout));
+  }
+  return out;
+}
+function parseAddedLines(diffText) {
+  const out = /* @__PURE__ */ new Map();
+  let file = null;
+  for (const line of diffText.split("\n")) {
+    if (line.startsWith("+++ ")) {
+      const p = line.slice(4).trim();
+      file = p === "/dev/null" ? null : p.replace(/^b\//, "");
+      continue;
+    }
+    if (!file || !line.startsWith("@@")) continue;
+    const m = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+    if (!m) continue;
+    const start = Number.parseInt(m[1], 10);
+    const count = m[2] === void 0 ? 1 : Number.parseInt(m[2], 10);
+    const set = out.get(file) ?? /* @__PURE__ */ new Set();
+    for (let n = start; n < start + count; n += 1) set.add(n);
+    out.set(file, set);
+  }
+  return out;
+}
+function mergeAddedLines(into, from) {
+  for (const [file, lines] of from) {
+    const prev = into.get(file);
+    if (prev === "all") continue;
+    const set = prev ?? /* @__PURE__ */ new Set();
+    for (const n of lines) set.add(n);
+    into.set(file, set);
+  }
+}
+function findingsOnAddedLines(findings, lines) {
+  if (lines === void 0) return [];
+  if (lines === "all") return [...findings];
+  return findings.filter((f) => lines.has(f.line));
+}
 var COMMENT_CASES = [
   {
     name: "a block-comment continuation carrying no leading star is flagged",
@@ -34070,6 +34621,7 @@ ${HELP}`);
     return 1;
   }
   const candidates = (explicit.length > 0 ? explicit : changedFiles(root, base)).filter(isScannable);
+  const added = explicit.length > 0 ? null : addedLineMap(root, base);
   const findings = [];
   for (const rel of candidates) {
     const abs = path85.isAbsolute(rel) ? rel : path85.join(root, rel);
@@ -34079,7 +34631,8 @@ ${HELP}`);
     } catch {
       continue;
     }
-    findings.push(...scanText2(rel, text));
+    const all = scanText2(rel, text);
+    findings.push(...added ? findingsOnAddedLines(all, added.get(rel)) : all);
   }
   try {
     reportScanned({
@@ -34386,8 +34939,8 @@ if (_isCliEntry44()) {
 }
 
 // src/scripts/hooks/session_eol_hook.ts
-import * as fs89 from "node:fs";
-import * as path91 from "node:path";
+import * as fs91 from "node:fs";
+import * as path93 from "node:path";
 import process15 from "node:process";
 import { fileURLToPath as fileURLToPath59, pathToFileURL as pathToFileURL52 } from "node:url";
 
@@ -34561,9 +35114,112 @@ function readNewCompleteLines(filePath, fromByte) {
   }
 }
 
-// src/scripts/_lib/run_checkpoint.ts
+// src/scripts/_lib/context_observation.ts
+import * as fs89 from "node:fs";
+import * as path91 from "node:path";
+
+// src/scripts/_lib/loop_guards.ts
 import * as fs88 from "node:fs";
 import * as path90 from "node:path";
+function atomicWriteJson(file, value) {
+  const tmp = `${file}.${String(process.pid)}.tmp`;
+  try {
+    fs88.mkdirSync(path90.dirname(file), { recursive: true });
+    fs88.writeFileSync(tmp, `${JSON.stringify(value)}
+`, "utf8");
+    fs88.renameSync(tmp, file);
+    return true;
+  } catch {
+    try {
+      fs88.unlinkSync(tmp);
+    } catch {
+    }
+    return false;
+  }
+}
+var DEPENDENCY_PATTERNS = [
+  { kind: "binary", re: /\b(?:command not found|is not recognized as an internal or external command)\b/i },
+  { kind: "credential", re: /\b(?:not (?:authenticated|logged in)|authentication (?:failed|required)|no credentials found)\b/i },
+  { kind: "credential", re: /\b(?:missing|unset|not set)\b[^\n]{0,40}\b(?:credential|token|api[_ -]?key|secret)\b/i },
+  { kind: "permission", re: /\b(?:permission denied|forbidden|403 forbidden)\b/i },
+  { kind: "quota", re: /\b(?:rate limit(?:ed| exceeded| reached)?|quota exceeded|429 too many requests|spend (?:cap|limit) reached)\b/i },
+  { kind: "service", re: /\b(?:5\d\d (?:internal )?server error|service unavailable|connection refused)\b/i }
+];
+var DEPENDENCY_SCAN_BYTES = 64 * 1024;
+function detectUnavailableDependency(transcriptTail, tailLines = 200) {
+  const lines = transcriptTail.split("\n");
+  const window = lines.slice(Math.max(0, lines.length - tailLines));
+  for (const line of window) {
+    for (const { kind, re } of DEPENDENCY_PATTERNS) {
+      if (re.test(line)) {
+        return { kind, evidence: line.trim().slice(0, 200) };
+      }
+    }
+  }
+  return null;
+}
+function stallSignal(history, window = 3) {
+  if (history.length === 0) {
+    return { level: "flat", flatRun: 0, minimum: null, newMinimum: false };
+  }
+  const last = history[history.length - 1];
+  const minimum = Math.min(...history);
+  const earlier = history.slice(0, -1);
+  const newMinimum = earlier.length > 0 && last < Math.min(...earlier);
+  let flatRun = 1;
+  for (let i = history.length - 2; i >= 0; i -= 1) {
+    if (history[i] !== last) break;
+    flatRun += 1;
+  }
+  if (newMinimum) return { level: "progressing", flatRun, minimum, newMinimum };
+  if (flatRun >= window) return { level: "stalled", flatRun, minimum, newMinimum };
+  return { level: "flat", flatRun, minimum, newMinimum };
+}
+function readUnavailableDependency(transcriptPath) {
+  try {
+    const raw = fs88.readFileSync(transcriptPath, "utf8");
+    return detectUnavailableDependency(raw.slice(-DEPENDENCY_SCAN_BYTES));
+  } catch {
+    return null;
+  }
+}
+
+// src/scripts/_lib/context_observation.ts
+var CONTEXT_OBSERVATION_REL = path91.join(
+  "agents",
+  "runtime",
+  "state",
+  "context-observation.json"
+);
+function observationFile(repoRoot) {
+  return path91.join(repoRoot, CONTEXT_OBSERVATION_REL);
+}
+function readContextObservation(repoRoot) {
+  try {
+    const parsed = JSON.parse(fs89.readFileSync(observationFile(repoRoot), "utf-8"));
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const o = parsed;
+    if (typeof o["fingerprint"] !== "string" || o["fingerprint"] === "") return null;
+    if (typeof o["at"] !== "string") return null;
+    return {
+      schema_version: 1,
+      roadmap: typeof o["roadmap"] === "string" ? o["roadmap"] : "",
+      fingerprint: o["fingerprint"],
+      at: o["at"]
+    };
+  } catch {
+    return null;
+  }
+}
+function premiseMoved(claimed, observed) {
+  if (claimed === null || claimed === void 0 || claimed === "") return false;
+  if (observed === null || observed === void 0 || observed === "") return false;
+  return claimed !== observed;
+}
+
+// src/scripts/_lib/run_checkpoint.ts
+import * as fs90 from "node:fs";
+import * as path92 from "node:path";
 
 // src/scripts/_lib/roadmap_checkboxes.ts
 var CHECKBOX_LINE = /^[ \t]*[-*][ \t]+\[([ xX~-])\][ \t]+(.*)$/;
@@ -34593,7 +35249,7 @@ function phaseLines(text) {
 }
 
 // src/scripts/_lib/run_checkpoint.ts
-var CHECKPOINT_DIR_REL = path90.join("agents", "runtime", "state", "checkpoints");
+var CHECKPOINT_DIR_REL = path92.join("agents", "runtime", "state", "checkpoints");
 function countRoadmap(text) {
   const counts = { open: 0, done: 0, parked: 0, next: null };
   for (const raw of phaseLines(text)) {
@@ -34614,34 +35270,34 @@ function countRoadmap(text) {
   return counts;
 }
 function checkpointFile(repoRoot, runId) {
-  return path90.join(repoRoot, CHECKPOINT_DIR_REL, `${runId.replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
+  return path92.join(repoRoot, CHECKPOINT_DIR_REL, `${runId.replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
 }
 function roadmapPath(repoRoot, slug) {
-  return path90.join(repoRoot, "agents", "roadmaps", `${slug}.md`);
+  return path92.join(repoRoot, "agents", "roadmaps", `${slug}.md`);
 }
 function readHead(repoRoot) {
   try {
-    let gitDir = path90.join(repoRoot, ".git");
-    if (fs88.statSync(gitDir).isFile()) {
-      const m = /^gitdir:\s*(.+)$/m.exec(fs88.readFileSync(gitDir, "utf-8").trim());
+    let gitDir = path92.join(repoRoot, ".git");
+    if (fs90.statSync(gitDir).isFile()) {
+      const m = /^gitdir:\s*(.+)$/m.exec(fs90.readFileSync(gitDir, "utf-8").trim());
       if (m === null) return null;
-      gitDir = path90.resolve(repoRoot, m[1]);
+      gitDir = path92.resolve(repoRoot, m[1]);
     }
     let refRoot = gitDir;
     try {
-      const common = fs88.readFileSync(path90.join(gitDir, "commondir"), "utf-8").trim();
-      if (common !== "") refRoot = path90.resolve(gitDir, common);
+      const common = fs90.readFileSync(path92.join(gitDir, "commondir"), "utf-8").trim();
+      if (common !== "") refRoot = path92.resolve(gitDir, common);
     } catch {
     }
-    const head = fs88.readFileSync(path90.join(gitDir, "HEAD"), "utf-8").trim();
+    const head = fs90.readFileSync(path92.join(gitDir, "HEAD"), "utf-8").trim();
     if (/^[0-9a-f]{40}$/.test(head)) return head;
     const ref = /^ref:\s*(.+)$/.exec(head);
     if (ref === null) return null;
     const refName = ref[1];
     try {
-      return fs88.readFileSync(path90.join(refRoot, refName), "utf-8").trim() || null;
+      return fs90.readFileSync(path92.join(refRoot, refName), "utf-8").trim() || null;
     } catch {
-      const packed = fs88.readFileSync(path90.join(refRoot, "packed-refs"), "utf-8");
+      const packed = fs90.readFileSync(path92.join(refRoot, "packed-refs"), "utf-8");
       for (const line of packed.split("\n")) {
         const pm = /^([0-9a-f]{40})\s+(.+)$/.exec(line.trim());
         if (pm !== null && pm[2] === refName) return pm[1];
@@ -34655,7 +35311,7 @@ function readHead(repoRoot) {
 function buildCheckpoint(repoRoot, runId, slug, opts = {}) {
   let text;
   try {
-    text = fs88.readFileSync(roadmapPath(repoRoot, slug), "utf-8");
+    text = fs90.readFileSync(roadmapPath(repoRoot, slug), "utf-8");
   } catch {
     return null;
   }
@@ -34679,8 +35335,8 @@ function buildCheckpoint(repoRoot, runId, slug, opts = {}) {
 function writeCheckpoint(repoRoot, cp) {
   const file = checkpointFile(repoRoot, cp.run_id);
   try {
-    fs88.mkdirSync(path90.dirname(file), { recursive: true });
-    fs88.writeFileSync(file, `${JSON.stringify(cp, null, 2)}
+    fs90.mkdirSync(path92.dirname(file), { recursive: true });
+    fs90.writeFileSync(file, `${JSON.stringify(cp, null, 2)}
 `, "utf-8");
     return file;
   } catch {
@@ -34691,7 +35347,7 @@ function writeCheckpoint(repoRoot, cp) {
 // src/scripts/hooks/session_eol_hook.ts
 var EXIT_WARN17 = 2;
 var THRESHOLD_OVERRIDE_ENV = "AGENT_RECYCLE_THRESHOLD_TOKENS";
-var CONTEXT_FILL_REL = path91.join("agents", "runtime", "state", "context-fill.json");
+var CONTEXT_FILL_REL = path93.join("agents", "runtime", "state", "context-fill.json");
 function str12(value) {
   return typeof value === "string" ? value : "";
 }
@@ -34706,7 +35362,7 @@ function payloadSessionId(payload, envelope) {
 }
 function readState4(file) {
   try {
-    const parsed = JSON.parse(fs89.readFileSync(file, "utf-8"));
+    const parsed = JSON.parse(fs91.readFileSync(file, "utf-8"));
     if (parsed && typeof parsed === "object" && parsed.schema_version === 1 && parsed.counters && typeof parsed.counters.scanned_bytes === "number") {
       return {
         schema_version: 1,
@@ -34727,10 +35383,10 @@ function readState4(file) {
   };
 }
 function envelopeExists(workspaceRoot3, since = null) {
-  const target = path91.join(workspaceRoot3, RECYCLE_ENVELOPE_REL);
+  const target = path93.join(workspaceRoot3, RECYCLE_ENVELOPE_REL);
   let raw;
   try {
-    raw = fs89.readFileSync(target, "utf-8");
+    raw = fs91.readFileSync(target, "utf-8");
   } catch (exc) {
     return exc?.code !== "ENOENT";
   }
@@ -34744,7 +35400,7 @@ function envelopeExists(workspaceRoot3, since = null) {
   }
 }
 function buildMissingEnvelopeLine(workspaceRoot3) {
-  return `recycle advised earlier, but no envelope exists at ${path91.join(workspaceRoot3, RECYCLE_ENVELOPE_REL)} \u2014 /clear now starts the successor from nothing. Re-run \`agent-config session:recycle\` and check that it prints the absolute path it wrote before clearing.`;
+  return `recycle advised earlier, but no envelope exists at ${path93.join(workspaceRoot3, RECYCLE_ENVELOPE_REL)} \u2014 /clear now starts the successor from nothing. Re-run \`agent-config session:recycle\` and check that it prints the absolute path it wrote before clearing.`;
 }
 function readThresholdTokens() {
   const override = process15.env[THRESHOLD_OVERRIDE_ENV];
@@ -34760,7 +35416,7 @@ function buildAdvisoryLine4(tokens, threshold) {
 }
 function writeContextFill(workspaceRoot3, tokens, threshold, ts) {
   try {
-    atomic_write_json(path91.join(workspaceRoot3, CONTEXT_FILL_REL), {
+    atomic_write_json(path93.join(workspaceRoot3, CONTEXT_FILL_REL), {
       schema_version: 1,
       final_context_tokens: tokens,
       recycle_threshold_tokens: threshold,
@@ -34823,7 +35479,10 @@ function main58() {
     try {
       const slug = read_claimed_slug(workspaceRoot3, checkpointRunId);
       if (slug !== null) {
-        const cp = buildCheckpoint(workspaceRoot3, eolSessionKey(checkpointRunId), slug);
+        const observed = readContextObservation(workspaceRoot3)?.fingerprint ?? null;
+        const cp = buildCheckpoint(workspaceRoot3, eolSessionKey(checkpointRunId), slug, {
+          ...observed !== null ? { contextFingerprint: observed } : {}
+        });
         if (cp !== null) writeCheckpoint(workspaceRoot3, cp);
       }
     } catch {
@@ -34860,13 +35519,13 @@ function _isCliEntry45() {
   if (process15.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL52(path91.resolve(process15.argv[1])).href;
+  const argvUrl = pathToFileURL52(path93.resolve(process15.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs89.realpathSync(fileURLToPath59(import.meta.url));
-    const argv = fs89.realpathSync(path91.resolve(process15.argv[1]));
+    const here = fs91.realpathSync(fileURLToPath59(import.meta.url));
+    const argv = fs91.realpathSync(path93.resolve(process15.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -34877,14 +35536,14 @@ if (_isCliEntry45()) {
 }
 
 // src/scripts/hooks/tool_result_bytes_hook.ts
-import * as fs90 from "node:fs";
-import * as path92 from "node:path";
+import * as fs92 from "node:fs";
+import * as path94 from "node:path";
 import { fileURLToPath as fileURLToPath60, pathToFileURL as pathToFileURL53 } from "node:url";
 var EXIT_ALLOW30 = 0;
 function isObject15(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-var CENSUS_FILE = path92.join("agents", "runtime", "state", "tool-result-census.jsonl");
+var CENSUS_FILE = path94.join("agents", "runtime", "state", "tool-result-census.jsonl");
 var RESULT_KEYS = ["tool_response", "toolResponse", "tool_result", "toolUseResult"];
 function _resultBytes(payload) {
   for (const key of RESULT_KEYS) {
@@ -34919,13 +35578,13 @@ function unwrapPayload4(envelope) {
   return isObject15(inner) ? inner : envelope;
 }
 function censusFile(consumerRoot) {
-  return path92.join(consumerRoot, CENSUS_FILE);
+  return path94.join(consumerRoot, CENSUS_FILE);
 }
 function _appendCensusLine(consumerRoot, line) {
   if (is_replay_mode()) return;
   const file = censusFile(consumerRoot);
-  fs90.mkdirSync(path92.dirname(file), { recursive: true });
-  fs90.appendFileSync(file, `${JSON.stringify(line)}
+  fs92.mkdirSync(path94.dirname(file), { recursive: true });
+  fs92.appendFileSync(file, `${JSON.stringify(line)}
 `, "utf8");
 }
 function processEnvelope4(envelope, consumerRoot) {
@@ -34971,10 +35630,10 @@ function _isCliEntry46() {
     return false;
   }
   if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL53(path92.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL53(path94.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) return true;
   try {
-    return fs90.realpathSync(fileURLToPath60(import.meta.url)) === fs90.realpathSync(path92.resolve(process.argv[1]));
+    return fs92.realpathSync(fileURLToPath60(import.meta.url)) === fs92.realpathSync(path94.resolve(process.argv[1]));
   } catch {
     return false;
   }
@@ -34982,8 +35641,8 @@ function _isCliEntry46() {
 if (_isCliEntry46()) process.exit(main59());
 
 // src/scripts/hooks/spawn_guard_shadow_hook.ts
-import * as fs91 from "node:fs";
-import * as path93 from "node:path";
+import * as fs93 from "node:fs";
+import * as path95 from "node:path";
 import { fileURLToPath as fileURLToPath61, pathToFileURL as pathToFileURL54 } from "node:url";
 var EXIT_ALLOW31 = 0;
 function isObject16(v) {
@@ -35061,10 +35720,10 @@ function main60() {
 function _isCliEntry47() {
   if (true) return false;
   if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL54(path93.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL54(path95.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) return true;
   try {
-    return fs91.realpathSync(fileURLToPath61(import.meta.url)) === fs91.realpathSync(path93.resolve(process.argv[1]));
+    return fs93.realpathSync(fileURLToPath61(import.meta.url)) === fs93.realpathSync(path95.resolve(process.argv[1]));
   } catch {
     return false;
   }
@@ -35072,13 +35731,13 @@ function _isCliEntry47() {
 if (_isCliEntry47()) process.exit(main60());
 
 // src/scripts/hooks/source_first_gate_hook.ts
-import * as fs92 from "node:fs";
-import * as path94 from "node:path";
+import * as fs94 from "node:fs";
+import * as path96 from "node:path";
 import { fileURLToPath as fileURLToPath62, pathToFileURL as pathToFileURL55 } from "node:url";
 var EXIT_ALLOW32 = 0;
 var MAX_SHADOW_WARNS = 2;
-var SHADOW_LOG = path94.join("agents", "runtime", "state", "source-first-gate.jsonl");
-var STATE_FILE9 = path94.join("agents", "runtime", "state", "source-first-gate.json");
+var SHADOW_LOG = path96.join("agents", "runtime", "state", "source-first-gate.jsonl");
+var STATE_FILE9 = path96.join("agents", "runtime", "state", "source-first-gate.json");
 function isObject17(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -35152,7 +35811,7 @@ var EMPTY_STATE = { handoverSeen: false, sourceRead: false, wouldWarn: 0 };
 var MAX_SESSIONS2 = 50;
 function readState5(root, session) {
   try {
-    const all = JSON.parse(fs92.readFileSync(path94.join(root, STATE_FILE9), "utf-8"));
+    const all = JSON.parse(fs94.readFileSync(path96.join(root, STATE_FILE9), "utf-8"));
     const entry = all[session];
     if (entry && typeof entry.handoverSeen === "boolean" && typeof entry.sourceRead === "boolean" && typeof entry.wouldWarn === "number") {
       return entry;
@@ -35164,10 +35823,10 @@ function readState5(root, session) {
 function writeState4(root, session, state) {
   if (is_replay_mode()) return;
   try {
-    const file = path94.join(root, STATE_FILE9);
+    const file = path96.join(root, STATE_FILE9);
     let all = {};
     try {
-      all = JSON.parse(fs92.readFileSync(file, "utf-8"));
+      all = JSON.parse(fs94.readFileSync(file, "utf-8"));
     } catch {
     }
     if (!isObject17(all)) all = {};
@@ -35178,8 +35837,8 @@ function writeState4(root, session, state) {
       for (const key of keys.slice(keys.length - MAX_SESSIONS2)) pruned[key] = all[key];
       all = pruned;
     }
-    fs92.mkdirSync(path94.dirname(file), { recursive: true });
-    fs92.writeFileSync(file, JSON.stringify(all));
+    fs94.mkdirSync(path96.dirname(file), { recursive: true });
+    fs94.writeFileSync(file, JSON.stringify(all));
   } catch {
   }
 }
@@ -35200,7 +35859,7 @@ function evaluateCandidates2(handoverSeen, handoverOnDisk, sourceRead) {
 }
 function handoverPresentOnDisk(root) {
   try {
-    return fs92.statSync(path94.join(root, ".claude", "design-system")).isDirectory();
+    return fs94.statSync(path96.join(root, ".claude", "design-system")).isDirectory();
   } catch {
     return false;
   }
@@ -35208,9 +35867,9 @@ function handoverPresentOnDisk(root) {
 function appendShadowLine(root, line) {
   if (is_replay_mode()) return;
   try {
-    const file = path94.join(root, SHADOW_LOG);
-    fs92.mkdirSync(path94.dirname(file), { recursive: true });
-    fs92.appendFileSync(file, `${JSON.stringify(line)}
+    const file = path96.join(root, SHADOW_LOG);
+    fs94.mkdirSync(path96.dirname(file), { recursive: true });
+    fs94.appendFileSync(file, `${JSON.stringify(line)}
 `, "utf8");
   } catch {
   }
@@ -35286,10 +35945,10 @@ function main61() {
 function _isCliEntry48() {
   if (true) return false;
   if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL55(path94.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL55(path96.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) return true;
   try {
-    return fs92.realpathSync(fileURLToPath62(import.meta.url)) === fs92.realpathSync(path94.resolve(process.argv[1]));
+    return fs94.realpathSync(fileURLToPath62(import.meta.url)) === fs94.realpathSync(path96.resolve(process.argv[1]));
   } catch {
     return false;
   }
@@ -35297,12 +35956,12 @@ function _isCliEntry48() {
 if (_isCliEntry48()) process.exit(main61());
 
 // src/scripts/hooks/interruption_ledger_hook.ts
-import * as fs93 from "node:fs";
-import * as path95 from "node:path";
+import * as fs95 from "node:fs";
+import * as path97 from "node:path";
 import { fileURLToPath as fileURLToPath63, pathToFileURL as pathToFileURL56 } from "node:url";
 var EXIT_OK2 = 0;
 var TRANSCRIPT_READ_MAX_BYTES2 = 2 * 1024 * 1024;
-var LEDGER_RELPATH = path95.join("agents", "runtime", "state", "interruptions.jsonl");
+var LEDGER_RELPATH = path97.join("agents", "runtime", "state", "interruptions.jsonl");
 function hasNumberedOptions(reply) {
   let count = 0;
   for (const line of reply.split("\n")) {
@@ -35326,14 +35985,14 @@ function classifyReply(reply) {
 function readClaimedRoadmap(workspaceRoot3, sessionId2) {
   if (!sessionId2) return null;
   try {
-    const file = path95.join(
+    const file = path97.join(
       workspaceRoot3,
       "agents",
       "runtime",
       "state",
       `roadmap-claim-${sessionId2}.json`
     );
-    const parsed = JSON.parse(fs93.readFileSync(file, "utf8"));
+    const parsed = JSON.parse(fs95.readFileSync(file, "utf8"));
     if (parsed === null || typeof parsed !== "object") return null;
     const slug = parsed["slug"];
     return typeof slug === "string" && slug.length > 0 ? slug : null;
@@ -35344,7 +36003,7 @@ function readClaimedRoadmap(workspaceRoot3, sessionId2) {
 function alreadyRecorded(ledgerPath, runId, turn) {
   let raw;
   try {
-    raw = fs93.readFileSync(ledgerPath, "utf8");
+    raw = fs95.readFileSync(ledgerPath, "utf8");
   } catch {
     return false;
   }
@@ -35388,7 +36047,7 @@ function main62() {
   if (!lastAssistant) return EXIT_OK2;
   const sessionId2 = str14(payload["session_id"]) || str14(envelope["session_id"]);
   const runId = sessionId2 ? derive_session_tag(sessionId2) : "unknown";
-  const ledgerPath = path95.join(workspaceRoot3, LEDGER_RELPATH);
+  const ledgerPath = path97.join(workspaceRoot3, LEDGER_RELPATH);
   if (alreadyRecorded(ledgerPath, runId, turnOrdinal)) return EXIT_OK2;
   const verdict = classifyReply(lastAssistant);
   const record = {
@@ -35400,8 +36059,8 @@ function main62() {
     at: (/* @__PURE__ */ new Date()).toISOString()
   };
   try {
-    fs93.mkdirSync(path95.dirname(ledgerPath), { recursive: true });
-    fs93.appendFileSync(ledgerPath, `${JSON.stringify(record)}
+    fs95.mkdirSync(path97.dirname(ledgerPath), { recursive: true });
+    fs95.appendFileSync(ledgerPath, `${JSON.stringify(record)}
 `, "utf8");
   } catch {
   }
@@ -35411,13 +36070,13 @@ function _isCliEntry49() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL56(path95.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL56(path97.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs93.realpathSync(fileURLToPath63(import.meta.url));
-    const argv = fs93.realpathSync(path95.resolve(process.argv[1]));
+    const here = fs95.realpathSync(fileURLToPath63(import.meta.url));
+    const argv = fs95.realpathSync(path97.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -35428,15 +36087,15 @@ if (_isCliEntry49()) {
 }
 
 // src/scripts/hooks/run_continuation_hook.ts
-import * as fs96 from "node:fs";
+import * as fs97 from "node:fs";
 
 // src/scripts/_lib/billing_grant.ts
-import * as fs94 from "node:fs";
-import * as path96 from "node:path";
-var BILLING_GRANT_DIR_REL = path96.join("agents", "runtime", "billing-grants");
+import * as fs96 from "node:fs";
+import * as path98 from "node:path";
+var BILLING_GRANT_DIR_REL = path98.join("agents", "runtime", "billing-grants");
 var BILLING_GRANT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 function grantFile(repoRoot, runId) {
-  return path96.join(
+  return path98.join(
     repoRoot,
     BILLING_GRANT_DIR_REL,
     `${runId.replace(/[^A-Za-z0-9_-]/g, "_")}.json`
@@ -35444,79 +36103,96 @@ function grantFile(repoRoot, runId) {
 }
 function revokeBillingGrant(repoRoot, runId) {
   try {
-    fs94.unlinkSync(grantFile(repoRoot, runId));
+    fs96.unlinkSync(grantFile(repoRoot, runId));
   } catch {
   }
 }
 
 // src/scripts/hooks/run_continuation_hook.ts
-import * as path98 from "node:path";
+import * as path99 from "node:path";
 import { fileURLToPath as fileURLToPath64, pathToFileURL as pathToFileURL57 } from "node:url";
 
-// src/scripts/_lib/loop_guards.ts
-import * as fs95 from "node:fs";
-import * as path97 from "node:path";
-function atomicWriteJson(file, value) {
-  const tmp = `${file}.${String(process.pid)}.tmp`;
-  try {
-    fs95.mkdirSync(path97.dirname(file), { recursive: true });
-    fs95.writeFileSync(tmp, `${JSON.stringify(value)}
-`, "utf8");
-    fs95.renameSync(tmp, file);
-    return true;
-  } catch {
-    try {
-      fs95.unlinkSync(tmp);
-    } catch {
-    }
-    return false;
-  }
-}
-var DEPENDENCY_PATTERNS = [
-  { kind: "binary", re: /\b(?:command not found|is not recognized as an internal or external command)\b/i },
-  { kind: "credential", re: /\b(?:not (?:authenticated|logged in)|authentication (?:failed|required)|no credentials found)\b/i },
-  { kind: "credential", re: /\b(?:missing|unset|not set)\b[^\n]{0,40}\b(?:credential|token|api[_ -]?key|secret)\b/i },
-  { kind: "permission", re: /\b(?:permission denied|forbidden|403 forbidden)\b/i },
-  { kind: "quota", re: /\b(?:rate limit(?:ed| exceeded| reached)?|quota exceeded|429 too many requests|spend (?:cap|limit) reached)\b/i },
-  { kind: "service", re: /\b(?:5\d\d (?:internal )?server error|service unavailable|connection refused)\b/i }
+// src/scripts/_lib/outcome_vocabularies.ts
+var RUN_TERMINAL_STATES = [
+  "success",
+  "clean-no-op",
+  "blocked",
+  "approval-required",
+  "exhausted",
+  "stagnated",
+  /**
+   * The plan premise this run was built on no longer holds — the situational
+   * -awareness fingerprint the run engaged under (`origin/main` plus every open
+   * PR head) was re-observed and differs.
+   *
+   * Added by `road-to-wired-instruments` Phase 2 under the AI-council decision
+   * of 2026-09-03 (option (a), unanimous). It is NOT `blocked` with a reason
+   * field: premise invalidation is operationally distinct from a missing
+   * precondition and from an exhausted budget, and folding it into either loses
+   * both aggregation by state and type-enforced exhaustive handling. The
+   * remedy differs too — re-probe and re-plan, where `blocked` says obtain the
+   * missing thing and `exhausted` says the budget was too small.
+   */
+  "premise-invalidated"
 ];
-var DEPENDENCY_SCAN_BYTES = 64 * 1024;
-function detectUnavailableDependency(transcriptTail, tailLines = 200) {
-  const lines = transcriptTail.split("\n");
-  const window = lines.slice(Math.max(0, lines.length - tailLines));
-  for (const line of window) {
-    for (const { kind, re } of DEPENDENCY_PATTERNS) {
-      if (re.test(line)) {
-        return { kind, evidence: line.trim().slice(0, 200) };
-      }
-    }
-  }
-  return null;
+var RUN_TERMINAL_VOCABULARY_VERSION = 2;
+
+// src/scripts/_lib/continuation_ladder.ts
+var MAX_ITERATIONS = 25;
+var WALL_CLOCK_CAP_MS = 4 * 60 * 60 * 1e3;
+var STALL_WINDOW = 3;
+var HALT_ACTIONS = [
+  "halt-max-iterations",
+  "halt-wall-clock",
+  "halt-stall",
+  // Phase 5.4. Checked BEFORE the counter rungs: a dependency the run cannot
+  // obtain is not something more iterations close, so consuming the budget
+  // against it is the waste the rung exists to stop.
+  "halt-dependency-unavailable",
+  // `road-to-wired-instruments` 2.2, and BEFORE the counter rungs for the same
+  // reason: a run whose plan premise moved does not become correct by running
+  // more iterations against the stale plan, and letting it cap out reports
+  // `exhausted` — a budget problem, whose remedy is a bigger budget — for what
+  // is actually a staleness problem, whose remedy is a re-probe.
+  "halt-premise-invalidated"
+];
+var TERMINAL_STATE_BY_ACTION = {
+  engage: null,
+  complete: "success",
+  blocked: "blocked",
+  "halt-max-iterations": "exhausted",
+  "halt-wall-clock": "exhausted",
+  "halt-stall": "stagnated",
+  "halt-dependency-unavailable": "blocked",
+  "halt-premise-invalidated": "premise-invalidated"
+};
+function terminalStateFor(action) {
+  return TERMINAL_STATE_BY_ACTION[action] ?? null;
 }
-function stallSignal(history, window = 3) {
-  if (history.length === 0) {
-    return { level: "flat", flatRun: 0, minimum: null, newMinimum: false };
+function ladder(state, openCount, nowMs, blockedCount, caps = {
+  maxIterations: MAX_ITERATIONS,
+  wallClockMs: WALL_CLOCK_CAP_MS,
+  stallWindow: STALL_WINDOW
+}, unavailable = null, premiseInvalidated = false) {
+  if (state.halted) return state.halted;
+  if (openCount === 0) return blockedCount > 0 ? "blocked" : "complete";
+  if (unavailable !== null) return "halt-dependency-unavailable";
+  if (premiseInvalidated) return "halt-premise-invalidated";
+  if (state.iterations >= caps.maxIterations) return "halt-max-iterations";
+  const started = Date.parse(state.started_at);
+  if (Number.isFinite(started) && nowMs - started >= caps.wallClockMs) {
+    return "halt-wall-clock";
   }
-  const last = history[history.length - 1];
-  const minimum = Math.min(...history);
-  const earlier = history.slice(0, -1);
-  const newMinimum = earlier.length > 0 && last < Math.min(...earlier);
-  let flatRun = 1;
-  for (let i = history.length - 2; i >= 0; i -= 1) {
-    if (history[i] !== last) break;
-    flatRun += 1;
+  const tail = state.history.slice(-caps.stallWindow);
+  if (tail.length >= caps.stallWindow && tail.every((n) => n === openCount)) {
+    return "halt-stall";
   }
-  if (newMinimum) return { level: "progressing", flatRun, minimum, newMinimum };
-  if (flatRun >= window) return { level: "stalled", flatRun, minimum, newMinimum };
-  return { level: "flat", flatRun, minimum, newMinimum };
+  return "engage";
 }
-function readUnavailableDependency(transcriptPath) {
-  try {
-    const raw = fs95.readFileSync(transcriptPath, "utf8");
-    return detectUnavailableDependency(raw.slice(-DEPENDENCY_SCAN_BYTES));
-  } catch {
-    return null;
-  }
+function parseHaltStamp(v) {
+  if (typeof v !== "string") return null;
+  if (HALT_ACTIONS.includes(v)) return v;
+  return v.startsWith("halt-") ? v : null;
 }
 
 // src/scripts/hooks/run_continuation_hook.ts
@@ -35524,16 +36200,13 @@ var EXIT_ALLOW33 = 0;
 var EXIT_BLOCK5 = 1;
 var BLOCKED_BY_MARKER = /<!--\s*blocked-by:\s*\S[^>]*-->/;
 var LEDGER_TAIL_MAX_BYTES = 512 * 1024;
-var EVENTS_RELPATH = path98.join(
+var EVENTS_RELPATH = path99.join(
   "agents",
   "runtime",
   "state",
   "run-continuation.jsonl"
 );
-var STATE_DIR_REL = path98.join("agents", "runtime", "state");
-var MAX_ITERATIONS = 25;
-var WALL_CLOCK_CAP_MS = 4 * 60 * 60 * 1e3;
-var STALL_WINDOW = 3;
+var STATE_DIR_REL = path99.join("agents", "runtime", "state");
 var ABSENT_CONFIRM_FIRES = 2;
 var DUPLICATE_WINDOW_MS = 60 * 1e3;
 function isDuplicateFire(state, turnOrdinal, openCount, nowMs, roadmapSource) {
@@ -35548,15 +36221,6 @@ function isDuplicateFire(state, turnOrdinal, openCount, nowMs, roadmapSource) {
   const at = Date.parse(state.last_engaged_at ?? "");
   return Number.isFinite(at) && nowMs - at < DUPLICATE_WINDOW_MS;
 }
-var HALT_ACTIONS = [
-  "halt-max-iterations",
-  "halt-wall-clock",
-  "halt-stall",
-  // Phase 5.4. Checked BEFORE the counter rungs: a dependency the run cannot
-  // obtain is not something more iterations close, so consuming the budget
-  // against it is the waste the rung exists to stop.
-  "halt-dependency-unavailable"
-];
 function parseExecutionMode(text) {
   if (!text.startsWith("---")) return null;
   const end = text.indexOf("\n---", 3);
@@ -35611,42 +36275,23 @@ function extractVerify(stepText) {
   if (backticked !== null) return backticked[1].trim() || null;
   return null;
 }
-function ladder(state, openCount, nowMs, blockedCount, caps = {
-  maxIterations: MAX_ITERATIONS,
-  wallClockMs: WALL_CLOCK_CAP_MS,
-  stallWindow: STALL_WINDOW
-}, unavailable = null) {
-  if (state.halted) return state.halted;
-  if (openCount === 0) return blockedCount > 0 ? "blocked" : "complete";
-  if (unavailable !== null) return "halt-dependency-unavailable";
-  if (state.iterations >= caps.maxIterations) return "halt-max-iterations";
-  const started = Date.parse(state.started_at);
-  if (Number.isFinite(started) && nowMs - started >= caps.wallClockMs) {
-    return "halt-wall-clock";
-  }
-  const tail = state.history.slice(-caps.stallWindow);
-  if (tail.length >= caps.stallWindow && tail.every((n) => n === openCount)) {
-    return "halt-stall";
-  }
-  return "engage";
-}
 function stateRelPath(runId, slug) {
   const safeRun = runId.replace(/[^A-Za-z0-9_-]/g, "_");
   const safeSlug = slug.replace(/[^A-Za-z0-9_-]/g, "_");
-  return path98.join(STATE_DIR_REL, `run-continuation-${safeRun}-${safeSlug}.json`);
+  return path99.join(STATE_DIR_REL, `run-continuation-${safeRun}-${safeSlug}.json`);
 }
 function legacyStateRelPath(runId) {
   const safe = runId.replace(/[^A-Za-z0-9_-]/g, "_");
-  return path98.join(STATE_DIR_REL, `run-continuation-${safe}.json`);
+  return path99.join(STATE_DIR_REL, `run-continuation-${safe}.json`);
 }
 function readRunState(workspaceRoot3, runId, slug) {
-  const keyedFile = path98.join(workspaceRoot3, stateRelPath(runId, slug));
+  const keyedFile = path99.join(workspaceRoot3, stateRelPath(runId, slug));
   const keyed = readState6(keyedFile);
   if (keyed !== null) return { state: keyed, from: "keyed", keyedFile };
   if (fileExists(keyedFile)) {
     return { state: null, from: "keyed", keyedFile };
   }
-  const legacy = readState6(path98.join(workspaceRoot3, legacyStateRelPath(runId)));
+  const legacy = readState6(path99.join(workspaceRoot3, legacyStateRelPath(runId)));
   if (legacy === null) return { state: null, from: "none", keyedFile };
   if (legacy.roadmap !== void 0 && legacy.roadmap !== slug) {
     return { state: null, from: "none", keyedFile };
@@ -35659,25 +36304,25 @@ function writeState5(file, state) {
 function clearRunState(workspaceRoot3, runId, keyedFile, adoptedLegacy) {
   revokeBillingGrant(workspaceRoot3, runId);
   try {
-    fs96.rmSync(keyedFile, { force: true });
+    fs97.rmSync(keyedFile, { force: true });
   } catch {
   }
   if (!adoptedLegacy) return;
   try {
-    fs96.rmSync(path98.join(workspaceRoot3, legacyStateRelPath(runId)), { force: true });
+    fs97.rmSync(path99.join(workspaceRoot3, legacyStateRelPath(runId)), { force: true });
   } catch {
   }
 }
 function fileExists(p) {
   try {
-    return fs96.statSync(p).isFile();
+    return fs97.statSync(p).isFile();
   } catch {
     return false;
   }
 }
 function readState6(file) {
   try {
-    const parsed = JSON.parse(fs96.readFileSync(file, "utf8"));
+    const parsed = JSON.parse(fs97.readFileSync(file, "utf8"));
     if (parsed === null || typeof parsed !== "object") return null;
     const o = parsed;
     if (typeof o["started_at"] !== "string") return null;
@@ -35707,26 +36352,27 @@ function readState6(file) {
     if (o["inert_reported"] === true) {
       rec.inert_reported = true;
     }
-    const halted = o["halted"];
-    if (typeof halted === "string" && HALT_ACTIONS.includes(halted)) {
-      rec.halted = halted;
+    if (typeof o["context_fingerprint"] === "string" && o["context_fingerprint"] !== "") {
+      rec.context_fingerprint = o["context_fingerprint"];
     }
+    const halted = parseHaltStamp(o["halted"]);
+    if (halted !== null) rec.halted = halted;
     return rec;
   } catch {
     return null;
   }
 }
 function normalizeDir(p) {
-  const abs = path98.resolve(p);
+  const abs = path99.resolve(p);
   try {
-    return fs96.realpathSync(abs);
+    return fs97.realpathSync(abs);
   } catch {
     return abs;
   }
 }
 function normalizeFile(p) {
-  const abs = path98.resolve(p);
-  return path98.join(normalizeDir(path98.dirname(abs)), path98.basename(abs));
+  const abs = path99.resolve(p);
+  return path99.join(normalizeDir(path99.dirname(abs)), path99.basename(abs));
 }
 function provenance(workspaceRoot3, claimPath, sessionRoot, sessionCwd) {
   const reader = normalizeDir(workspaceRoot3);
@@ -35753,36 +36399,36 @@ function provenance(workspaceRoot3, claimPath, sessionRoot, sessionCwd) {
   };
 }
 function resolveRoadmap(sessionRoot, workspaceRoot3, slug) {
-  const dirRel = path98.join("agents", "roadmaps");
+  const dirRel = path99.join("agents", "roadmaps");
   const stem = slug.trim().replace(/\.md$/, "");
-  const rel = path98.join(dirRel, `${stem}.md`);
-  const norm = path98.normalize(rel);
-  if (path98.dirname(norm) !== dirRel) return null;
-  if (sessionRoot !== workspaceRoot3 && isDirectory(path98.join(sessionRoot, dirRel))) {
-    return path98.join(sessionRoot, norm);
+  const rel = path99.join(dirRel, `${stem}.md`);
+  const norm = path99.normalize(rel);
+  if (path99.dirname(norm) !== dirRel) return null;
+  if (sessionRoot !== workspaceRoot3 && isDirectory(path99.join(sessionRoot, dirRel))) {
+    return path99.join(sessionRoot, norm);
   }
-  return path98.join(normalizeDir(workspaceRoot3), norm);
+  return path99.join(normalizeDir(workspaceRoot3), norm);
 }
 function isDirectory(p) {
   try {
-    return fs96.statSync(p).isDirectory();
+    return fs97.statSync(p).isDirectory();
   } catch {
     return false;
   }
 }
 function eventAlreadyLogged(workspaceRoot3, runId, slug, event) {
   try {
-    const file = path98.join(workspaceRoot3, EVENTS_RELPATH);
-    const size = fs96.statSync(file).size;
+    const file = path99.join(workspaceRoot3, EVENTS_RELPATH);
+    const size = fs97.statSync(file).size;
     const start = Math.max(0, size - LEDGER_TAIL_MAX_BYTES);
-    const fd = fs96.openSync(file, "r");
+    const fd = fs97.openSync(file, "r");
     let text;
     try {
       const buf = Buffer.alloc(size - start);
-      const read = fs96.readSync(fd, buf, 0, buf.length, start);
+      const read = fs97.readSync(fd, buf, 0, buf.length, start);
       text = buf.subarray(0, read).toString("utf8");
     } finally {
-      fs96.closeSync(fd);
+      fs97.closeSync(fd);
     }
     for (const line of text.split("\n")) {
       if (line === "") continue;
@@ -35805,9 +36451,9 @@ function eventAlreadyLogged(workspaceRoot3, runId, slug, event) {
 }
 function appendEvent2(workspaceRoot3, record) {
   try {
-    const file = path98.join(workspaceRoot3, EVENTS_RELPATH);
-    fs96.mkdirSync(path98.dirname(file), { recursive: true });
-    fs96.appendFileSync(file, `${JSON.stringify(record)}
+    const file = path99.join(workspaceRoot3, EVENTS_RELPATH);
+    fs97.mkdirSync(path99.dirname(file), { recursive: true });
+    fs97.appendFileSync(file, `${JSON.stringify(record)}
 `, "utf8");
   } catch {
   }
@@ -35815,7 +36461,7 @@ function appendEvent2(workspaceRoot3, record) {
 function refusedThisTurn(workspaceRoot3, sessionId2, turnOrdinal) {
   try {
     const file = sessionRefusalFile(workspaceRoot3, deriveSessionKey(sessionId2 || "unknown-session"));
-    const rec = parseRecord(fs96.readFileSync(file, "utf-8"));
+    const rec = parseRecord(fs97.readFileSync(file, "utf-8"));
     return rec !== null && rec.refused_turn === turnOrdinal;
   } catch {
     return false;
@@ -35849,7 +36495,7 @@ function main63() {
   let roadmapText = null;
   if (roadmapPath2 !== null) {
     try {
-      roadmapText = fs96.readFileSync(roadmapPath2, "utf8");
+      roadmapText = fs97.readFileSync(roadmapPath2, "utf8");
       roadmapFile = roadmapPath2;
     } catch {
       roadmapText = null;
@@ -35898,7 +36544,7 @@ function main63() {
   );
   if (!transcriptPath) return EXIT_ALLOW33;
   try {
-    if (fs96.statSync(transcriptPath).size > TRANSCRIPT_READ_MAX_BYTES) {
+    if (fs97.statSync(transcriptPath).size > TRANSCRIPT_READ_MAX_BYTES) {
       const inert = readRunState(workspaceRoot3, runId, slug);
       if (inert.state !== null && inert.state.inert_reported !== true) {
         const inertRoots = provenance(
@@ -35973,7 +36619,17 @@ function main63() {
   }
   const unavailable = readUnavailableDependency(transcriptPath);
   state.stall = stallSignal(state.history, STALL_WINDOW).level;
-  const action = ladder(state, scan.open, Date.now(), scan.blocked, void 0, unavailable);
+  const observed = readContextObservation(workspaceRoot3)?.fingerprint ?? null;
+  const premiseInvalidated = premiseMoved(state.context_fingerprint, observed);
+  const action = ladder(
+    state,
+    scan.open,
+    Date.now(),
+    scan.blocked,
+    void 0,
+    unavailable,
+    premiseInvalidated
+  );
   if (action !== "engage") {
     const alreadyStamped = prev?.halted !== void 0;
     const alreadyBlocked = action === "blocked" && eventAlreadyLogged(workspaceRoot3, runId, slug, "blocked");
@@ -35986,6 +36642,12 @@ function main63() {
         iterations: state.iterations,
         open: scan.open,
         blocked: scan.blocked,
+        // A ledger line is a persisted shape carrying a `RunTerminalState`,
+        // so it names the vocabulary version it was written against: a
+        // reader meeting an unknown value can then tell a newer writer
+        // from a corrupt row.
+        terminal_state: terminalStateFor(action),
+        terminal_vocabulary_version: RUN_TERMINAL_VOCABULARY_VERSION,
         at: (/* @__PURE__ */ new Date()).toISOString(),
         ...roots
       });
@@ -36006,6 +36668,9 @@ function main63() {
   }
   state.iterations += 1;
   state.last_turn = turnOrdinal;
+  if (state.context_fingerprint === void 0 && observed !== null) {
+    state.context_fingerprint = observed;
+  }
   state.history.push(scan.open);
   state.last_engaged_at = (/* @__PURE__ */ new Date()).toISOString();
   if (!writeState5(stateFile4, state)) {
@@ -36038,11 +36703,11 @@ function _isCliEntry50() {
     return false;
   }
   if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL57(path98.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL57(path99.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) return true;
   try {
-    const here = fs96.realpathSync(fileURLToPath64(import.meta.url));
-    const argv = fs96.realpathSync(path98.resolve(process.argv[1]));
+    const here = fs97.realpathSync(fileURLToPath64(import.meta.url));
+    const argv = fs97.realpathSync(path99.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -36053,26 +36718,14 @@ if (_isCliEntry50()) {
 }
 
 // src/scripts/hooks/journal_record_hook.ts
-import * as fs98 from "node:fs";
-import * as path100 from "node:path";
+import * as fs99 from "node:fs";
+import * as path101 from "node:path";
 import { fileURLToPath as fileURLToPath65, pathToFileURL as pathToFileURL58 } from "node:url";
 
 // src/scripts/_lib/runtime_journal.ts
 import * as crypto14 from "node:crypto";
-import * as fs97 from "node:fs";
-import * as path99 from "node:path";
-
-// src/scripts/_lib/outcome_vocabularies.ts
-var RUN_TERMINAL_STATES = [
-  "success",
-  "clean-no-op",
-  "blocked",
-  "approval-required",
-  "exhausted",
-  "stagnated"
-];
-
-// src/scripts/_lib/runtime_journal.ts
+import * as fs98 from "node:fs";
+import * as path100 from "node:path";
 var JOURNAL_SCHEMA_VERSION = 3;
 var BOUNDARY_RULE_VERSION = 1;
 var RETENTION_TTL_DAYS = 30;
@@ -36163,7 +36816,7 @@ function requireId(name, id, optional) {
 }
 var JOURNAL_DIR_NAME = "agent-journal";
 var JOURNAL_FILE_NAME = "journal.sqlite";
-var JOURNAL_FALLBACK_REL = path99.join("agents", "runtime", "state", JOURNAL_FILE_NAME);
+var JOURNAL_FALLBACK_REL = path100.join("agents", "runtime", "state", JOURNAL_FILE_NAME);
 function digest(domain, input) {
   return crypto14.createHash("sha256").update(`${domain}\0${input}`).digest("hex").slice(0, 12);
 }
@@ -36174,20 +36827,20 @@ function resolveJournal(root) {
   if (common !== null) {
     const own = git_dir(root) ?? common;
     return {
-      path: path99.join(common, JOURNAL_DIR_NAME, JOURNAL_FILE_NAME),
+      path: path100.join(common, JOURNAL_DIR_NAME, JOURNAL_FILE_NAME),
       scope: "repo-shared",
       reason: "common git dir resolved \u2014 every worktree of this repo writes one database",
       repository_id: digest(REPO_DOMAIN, common),
       worktree_id: digest(WORKTREE_DOMAIN, own)
     };
   }
-  let real = path99.resolve(root);
+  let real = path100.resolve(root);
   try {
-    real = fs97.realpathSync(real);
+    real = fs98.realpathSync(real);
   } catch {
   }
   return {
-    path: path99.join(real, JOURNAL_FALLBACK_REL),
+    path: path100.join(real, JOURNAL_FALLBACK_REL),
     scope: "worktree-local",
     reason: "no common git dir \u2014 not inside a git repository; falling back to the tree-local path",
     repository_id: digest(REPO_DOMAIN, real),
@@ -36273,7 +36926,7 @@ function ensureWal(db) {
 function discard(dbPath) {
   for (const p of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
     try {
-      fs97.rmSync(p, { force: true });
+      fs98.rmSync(p, { force: true });
     } catch {
     }
   }
@@ -36285,9 +36938,9 @@ function openJournal(root) {
     );
   }
   const location = resolveJournal(root);
-  fs97.mkdirSync(path99.dirname(location.path), { recursive: true });
+  fs98.mkdirSync(path100.dirname(location.path), { recursive: true });
   const { DatabaseSync } = loadSqliteSync("runtime_journal");
-  if (fs97.existsSync(location.path)) {
+  if (fs98.existsSync(location.path)) {
     let drift = false;
     let probe = null;
     try {
@@ -36369,7 +37022,7 @@ function recordEvent(h, input) {
   const explicit = requireId("episode_id", input.episode_id, true);
   if (input.terminal_state !== null && input.terminal_state !== void 0 && !TERMINAL_STATES.includes(input.terminal_state)) {
     throw new JournalContractError(
-      `terminal_state ${JSON.stringify(input.terminal_state)} is not one of the six.`
+      `terminal_state ${JSON.stringify(input.terminal_state)} is not in the run vocabulary.`
     );
   }
   if (input.consumption !== null && input.consumption !== void 0 && !CONSUMPTION_STATES.includes(input.consumption)) {
@@ -36530,10 +37183,10 @@ function _isCliEntry51() {
     return false;
   }
   if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL58(path100.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL58(path101.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) return true;
   try {
-    return fs98.realpathSync(fileURLToPath65(import.meta.url)) === fs98.realpathSync(path100.resolve(process.argv[1]));
+    return fs99.realpathSync(fileURLToPath65(import.meta.url)) === fs99.realpathSync(path101.resolve(process.argv[1]));
   } catch {
     return false;
   }
@@ -36696,8 +37349,8 @@ function _py_json_dumps2(value, indent) {
 
 // src/scripts/_lib/collector_denominator.ts
 import crypto15 from "node:crypto";
-import fs100 from "node:fs";
-import path102 from "node:path";
+import fs101 from "node:fs";
+import path103 from "node:path";
 
 // src/scripts/_lib/collector_record.ts
 var COLLECTOR_EVENTS = [
@@ -36774,30 +37427,30 @@ var FIELD_PURPOSE = {
 var ALLOWED_FIELDS = new Set(Object.keys(FIELD_PURPOSE));
 
 // src/scripts/_lib/collector_store.ts
-import * as fs99 from "node:fs";
+import * as fs100 from "node:fs";
 import * as os12 from "node:os";
-import * as path101 from "node:path";
+import * as path102 from "node:path";
 var COLLECTOR_DIR_NAME = "agent-collector";
 var COLLECTOR_FILE_NAME = "collector.sqlite";
 var OPT_OUT_MARKER_NAME = "OPT-OUT";
 var MIGRATION_MARKER_NAME = "MIGRATION-IN-FLIGHT";
 var QUARANTINE_DIR_NAME = "quarantine";
 function defaultUserRoot() {
-  return path101.join(os12.homedir(), ".event4u", "agent-config");
+  return path102.join(os12.homedir(), ".event4u", "agent-config");
 }
 function resolveCollectorStore(userRoot = defaultUserRoot()) {
-  const dir = path101.join(userRoot, COLLECTOR_DIR_NAME);
+  const dir = path102.join(userRoot, COLLECTOR_DIR_NAME);
   return {
     userRoot,
     root: dir,
-    path: path101.join(dir, COLLECTOR_FILE_NAME),
-    optOutMarker: path101.join(dir, OPT_OUT_MARKER_NAME),
-    migrationMarker: path101.join(dir, MIGRATION_MARKER_NAME),
-    quarantineDir: path101.join(dir, QUARANTINE_DIR_NAME)
+    path: path102.join(dir, COLLECTOR_FILE_NAME),
+    optOutMarker: path102.join(dir, OPT_OUT_MARKER_NAME),
+    migrationMarker: path102.join(dir, MIGRATION_MARKER_NAME),
+    quarantineDir: path102.join(dir, QUARANTINE_DIR_NAME)
   };
 }
 function isOptedOut(userRoot = defaultUserRoot()) {
-  return fs99.existsSync(resolveCollectorStore(userRoot).optOutMarker);
+  return fs100.existsSync(resolveCollectorStore(userRoot).optOutMarker);
 }
 var MIGRATIONS = Object.freeze({
   // 0 → 1. No DDL: `user_version` 0 is the default SQLite assigns, and a
@@ -36814,24 +37467,24 @@ var SPOOL_DIR_NAME = "spool";
 var SPOOL_PENDING_NAME = "pending.jsonl";
 var ENABLED_MARKER_NAME = "ENABLED";
 function denominatorPath(userRoot) {
-  return path102.join(resolveCollectorStore(userRoot).root, DENOMINATOR_FILE_NAME);
+  return path103.join(resolveCollectorStore(userRoot).root, DENOMINATOR_FILE_NAME);
 }
 function spoolDir(userRoot) {
-  return path102.join(resolveCollectorStore(userRoot).root, SPOOL_DIR_NAME);
+  return path103.join(resolveCollectorStore(userRoot).root, SPOOL_DIR_NAME);
 }
 function spoolPendingPath(userRoot) {
-  return path102.join(spoolDir(userRoot), SPOOL_PENDING_NAME);
+  return path103.join(spoolDir(userRoot), SPOOL_PENDING_NAME);
 }
 function enabledMarkerPath(userRoot) {
-  return path102.join(resolveCollectorStore(userRoot).root, ENABLED_MARKER_NAME);
+  return path103.join(resolveCollectorStore(userRoot).root, ENABLED_MARKER_NAME);
 }
 function isCollectorEnabled(userRoot) {
   if (isOptedOut(userRoot)) return false;
-  if (fs100.existsSync(killSwitchPathLocal(userRoot))) return false;
-  return fs100.existsSync(enabledMarkerPath(userRoot));
+  if (fs101.existsSync(killSwitchPathLocal(userRoot))) return false;
+  return fs101.existsSync(enabledMarkerPath(userRoot));
 }
 function killSwitchPathLocal(userRoot) {
-  return path102.join(resolveCollectorStore(userRoot).root, "STOP");
+  return path103.join(resolveCollectorStore(userRoot).root, "STOP");
 }
 function utcDate(at = Date.now()) {
   return new Date(at).toISOString().slice(0, 10);
@@ -36843,8 +37496,8 @@ function recordOpportunity(event, platform, userRoot, at = Date.now(), opts = {}
     if (!COLLECTOR_EVENTS.includes(event)) return false;
     if (!COLLECTOR_PLATFORMS.includes(platform)) return false;
     const target = denominatorPath(userRoot);
-    fs100.mkdirSync(path102.dirname(target), { recursive: true });
-    fs100.appendFileSync(target, `${utcDate(at)}	${event}	${platform}
+    fs101.mkdirSync(path103.dirname(target), { recursive: true });
+    fs101.appendFileSync(target, `${utcDate(at)}	${event}	${platform}
 `);
     return true;
   } catch {
@@ -36858,19 +37511,19 @@ var MACHINE_ID_NAME = "machine-id";
 var EPISODE_DIR_NAME = "episodes";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function machineIdPath(userRoot) {
-  return path102.join(resolveCollectorStore(userRoot).root, MACHINE_ID_NAME);
+  return path103.join(resolveCollectorStore(userRoot).root, MACHINE_ID_NAME);
 }
 function machineId(userRoot) {
   const target = machineIdPath(userRoot);
   try {
-    const existing = fs100.readFileSync(target, "utf8").trim();
+    const existing = fs101.readFileSync(target, "utf8").trim();
     if (UUID_RE.test(existing)) return existing;
   } catch {
   }
   try {
     const minted = crypto15.randomUUID();
-    fs100.mkdirSync(path102.dirname(target), { recursive: true });
-    fs100.writeFileSync(target, `${minted}
+    fs101.mkdirSync(path103.dirname(target), { recursive: true });
+    fs101.writeFileSync(target, `${minted}
 `);
     return minted;
   } catch {
@@ -36894,17 +37547,17 @@ function episodeId(env = process.env) {
   ].join("-");
 }
 function nextSequence(episode, userRoot) {
-  const dir = path102.join(resolveCollectorStore(userRoot).root, EPISODE_DIR_NAME);
-  const target = path102.join(dir, `${episode}.seq`);
+  const dir = path103.join(resolveCollectorStore(userRoot).root, EPISODE_DIR_NAME);
+  const target = path103.join(dir, `${episode}.seq`);
   try {
-    fs100.mkdirSync(dir, { recursive: true });
+    fs101.mkdirSync(dir, { recursive: true });
     let current = 0;
     try {
-      const raw = Number.parseInt(fs100.readFileSync(target, "utf8").trim(), 10);
+      const raw = Number.parseInt(fs101.readFileSync(target, "utf8").trim(), 10);
       if (Number.isInteger(raw) && raw >= 0) current = raw + 1;
     } catch {
     }
-    fs100.writeFileSync(target, `${current}
+    fs101.writeFileSync(target, `${current}
 `);
     return current;
   } catch {
@@ -36943,12 +37596,12 @@ function spoolRecord(record, userRoot) {
   try {
     if (!isCollectorEnabled(userRoot)) return false;
     const target = spoolPendingPath(userRoot);
-    fs100.mkdirSync(path102.dirname(target), { recursive: true });
+    fs101.mkdirSync(path103.dirname(target), { recursive: true });
     try {
-      if (fs100.statSync(target).size >= SPOOL_MAX_BYTES) return false;
+      if (fs101.statSync(target).size >= SPOOL_MAX_BYTES) return false;
     } catch {
     }
-    fs100.appendFileSync(target, `${JSON.stringify(record)}
+    fs101.appendFileSync(target, `${JSON.stringify(record)}
 `);
     return true;
   } catch {
@@ -36958,11 +37611,11 @@ function spoolRecord(record, userRoot) {
 
 // src/scripts/hooks/dispatch_hook.ts
 var _IN_BUNDLE = true;
-var REPO_ROOT = path103.resolve(
-  path103.dirname(fileURLToPath66(import.meta.url)),
+var REPO_ROOT = path104.resolve(
+  path104.dirname(fileURLToPath66(import.meta.url)),
   ..._IN_BUNDLE ? ["..", ".."] : ["..", "..", ".."]
 );
-var MANIFEST_PATH = path103.join(REPO_ROOT, "src", "scripts", "hook_manifest.yaml");
+var MANIFEST_PATH = path104.join(REPO_ROOT, "src", "scripts", "hook_manifest.yaml");
 var EXIT_ALLOW35 = 0;
 var EXIT_BLOCK6 = 1;
 var EXIT_WARN18 = 2;
@@ -37024,11 +37677,11 @@ function _manifest_fingerprint(text) {
   return `${h.toString(16)}:${String(text.length)}`;
 }
 function _load_yaml3(p) {
-  const text = fs101.readFileSync(p, "utf-8");
+  const text = fs102.readFileSync(p, "utf-8");
   const compiled = p.replace(/\.ya?ml$/u, ".json");
   if (compiled !== p) {
     try {
-      const raw = JSON.parse(fs101.readFileSync(compiled, "utf-8"));
+      const raw = JSON.parse(fs102.readFileSync(compiled, "utf-8"));
       if (_isObject17(raw) && raw["fingerprint"] === _manifest_fingerprint(text) && _isObject17(raw["manifest"])) {
         return raw["manifest"];
       }
@@ -37134,7 +37787,7 @@ function _maybe_capture_payload(args, payload_text) {
   }
   try {
     const target = _expanduser3(capture_dir);
-    fs101.mkdirSync(target, { recursive: true });
+    fs102.mkdirSync(target, { recursive: true });
     let payload;
     try {
       payload = payload_text.trim() ? JSON.parse(payload_text) : {};
@@ -37151,8 +37804,8 @@ function _maybe_capture_payload(args, payload_text) {
     const ts = Date.now();
     const native = (args.native_event || args.event).replace(/\//g, "_");
     const fname = `${args.platform}__${native}__${ts}__${process.pid}.json`;
-    fs101.writeFileSync(
-      path103.join(target, fname),
+    fs102.writeFileSync(
+      path104.join(target, fname),
       _py_json_dumps2(record, 2) + "\n",
       { encoding: "utf-8" }
     );
@@ -37163,7 +37816,7 @@ function _maybe_capture_payload(args, payload_text) {
 function _expanduser3(p) {
   if (p === "~" || p.startsWith("~/")) {
     const home = process.env["HOME"] || process.env["USERPROFILE"] || "";
-    return path103.join(home, p.slice(1));
+    return path104.join(home, p.slice(1));
   }
   return p;
 }
@@ -37195,25 +37848,25 @@ function _resolve_tsx_invocation2(scriptPath, scriptArgs) {
   const walkUp = (start) => {
     let dir = start;
     for (; ; ) {
-      const candidate = path103.join(dir, "node_modules", ".bin", binName);
+      const candidate = path104.join(dir, "node_modules", ".bin", binName);
       if (_isFile8(candidate)) {
         return candidate;
       }
-      const parent = path103.dirname(dir);
+      const parent = path104.dirname(dir);
       if (parent === dir) {
         return null;
       }
       dir = parent;
     }
   };
-  const tsx = walkUp(path103.dirname(scriptPath)) ?? walkUp(path103.dirname(fileURLToPath66(import.meta.url)));
+  const tsx = walkUp(path104.dirname(scriptPath)) ?? walkUp(path104.dirname(fileURLToPath66(import.meta.url)));
   if (tsx !== null) {
     return { command: tsx, args: [scriptPath, ...scriptArgs] };
   }
   return { command: "npx", args: ["tsx", scriptPath, ...scriptArgs] };
 }
 function _run_concern_inproc(main_fn, concern, envelope) {
-  const scriptAbs = path103.join(REPO_ROOT, String(concern["script"]));
+  const scriptAbs = path104.join(REPO_ROOT, String(concern["script"]));
   const argsList = Array.isArray(concern["args"]) ? concern["args"].map((a) => String(a)) : [];
   argsList.push("--platform", String(envelope["platform"] || "generic"));
   const workspace = String(envelope["workspace_root"] || process.cwd());
@@ -37290,7 +37943,7 @@ function _run_concern(concern, envelope) {
       return _run_concern_inproc(inproc, concern, envelope);
     }
   }
-  const script = path103.join(REPO_ROOT, String(concern["script"]));
+  const script = path104.join(REPO_ROOT, String(concern["script"]));
   const argsList = Array.isArray(concern["args"]) ? concern["args"].map((a) => String(a)) : [];
   const cmd = [script, ...argsList];
   cmd.push("--platform", String(envelope["platform"] || "generic"));
@@ -37347,7 +38000,7 @@ function _run_concern(concern, envelope) {
 }
 function _isFile8(p) {
   try {
-    return fs101.statSync(p).isFile();
+    return fs102.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -37369,10 +38022,10 @@ function _write_feedback(envelope, session_id, entries, final_rc, started_at) {
     return;
   }
   const workspace = String(envelope["workspace_root"] || process.cwd());
-  const state_root = path103.join(workspace, "agents", "runtime", "state");
+  const state_root = path104.join(workspace, "agents", "runtime", "state");
   const fb_dir = feedback_dir(state_root, session_id);
   try {
-    fs101.mkdirSync(fb_dir, { recursive: true });
+    fs102.mkdirSync(fb_dir, { recursive: true });
   } catch (exc) {
     const msg = exc instanceof Error ? exc.message : String(exc);
     process.stderr.write(`dispatch_hook: feedback dir unavailable: ${msg}
@@ -37380,7 +38033,7 @@ function _write_feedback(envelope, session_id, entries, final_rc, started_at) {
     return;
   }
   for (const entry of entries) {
-    const target = path103.join(fb_dir, `${entry["concern"]}.json`);
+    const target = path104.join(fb_dir, `${entry["concern"]}.json`);
     try {
       atomic_write_json(target, entry);
     } catch (exc) {
@@ -37429,7 +38082,7 @@ function _write_feedback(envelope, session_id, entries, final_rc, started_at) {
   };
   try {
     const invocation = `${String(process.pid)}-${process.hrtime.bigint().toString()}`;
-    update_json_under_lock(path103.join(fb_dir, "summary.json"), (loaded) => {
+    update_json_under_lock(path104.join(fb_dir, "summary.json"), (loaded) => {
       const priorRaw = loaded["invocations"];
       const prior = Array.isArray(priorRaw) ? priorRaw : [];
       const next = [...prior, { invocation, ...summary }];
@@ -37456,8 +38109,8 @@ function _record_rule_trips(envelope, entries) {
   if (tripped.length === 0) return;
   try {
     const workspace = String(envelope["workspace_root"] || process.cwd());
-    const state_dir = path103.join(workspace, "agents", "runtime", "state");
-    const target = path103.join(state_dir, "rule-trips.json");
+    const state_dir = path104.join(workspace, "agents", "runtime", "state");
+    const target = path104.join(state_dir, "rule-trips.json");
     const today = _now_iso3().slice(0, 10);
     update_json_under_lock(target, (loaded) => {
       const doc = { schema_version: 1, concerns: {}, ...loaded };
@@ -37599,7 +38252,7 @@ function main65(argv) {
   recordOpportunity(args.event, args.platform);
   recordCapture(args.event, args.platform);
   const manifest_path = args.manifest;
-  if (!fs101.existsSync(manifest_path)) {
+  if (!fs102.existsSync(manifest_path)) {
     process.stderr.write(`dispatch_hook: manifest missing at ${manifest_path}
 `);
     return EXIT_ALLOW35;
@@ -37766,7 +38419,7 @@ function main65(argv) {
 }
 function _isDir4(p) {
   try {
-    return fs101.statSync(p).isDirectory();
+    return fs102.statSync(p).isDirectory();
   } catch {
     return false;
   }
@@ -37783,13 +38436,13 @@ function _isCliEntry52() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL59(path103.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL59(path104.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs101.realpathSync(fileURLToPath66(import.meta.url));
-    const argv = fs101.realpathSync(path103.resolve(process.argv[1]));
+    const here = fs102.realpathSync(fileURLToPath66(import.meta.url));
+    const argv = fs102.realpathSync(path104.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -37802,7 +38455,7 @@ if (isCliEntry14) {
 
 // src/scripts/hooks/dispatch_entry.ts
 var _selfPath = fileURLToPath67(import.meta.url);
-var _invokedDirectly2 = globalThis.__AC_HOOKS_BUNDLE_DIRECT === true || process.argv[1] !== void 0 && path104.resolve(process.argv[1]) === path104.resolve(_selfPath);
+var _invokedDirectly2 = globalThis.__AC_HOOKS_BUNDLE_DIRECT === true || process.argv[1] !== void 0 && path105.resolve(process.argv[1]) === path105.resolve(_selfPath);
 if (_invokedDirectly2) {
   process.exitCode = main65(process.argv.slice(2));
 }