@event4u/agent-config 14.14.0 → 14.15.0

package/dist/mcp/server.mjs

@@ -33747,6 +33747,115 @@ var init_rule_scope = __esm({
   }
 });
 
+// src/scripts/_cli/_doctor_strict.ts
+function eprint(msg) {
+  process.stderr.write(`${msg}
+`);
+}
+function strictTripping(level) {
+  return level === "warn" ? /* @__PURE__ */ new Set(["fail", "warn"]) : /* @__PURE__ */ new Set(["fail"]);
+}
+function canProceed(driftPresent, checks) {
+  return !driftPresent && !checks.some((c) => c["status"] === "fail");
+}
+function validateStrictLevel(level) {
+  if (!STRICT_LEVELS.has(level)) {
+    throw new StrictLevelError(
+      `argument --strict-level: invalid choice: '${level}' (choose from 'fail', 'warn')`
+    );
+  }
+}
+function strictExit(opts, checks, driftPresent) {
+  if (!opts.strict) {
+    return null;
+  }
+  const tripping = strictTripping(opts.strict_level);
+  const tripped = checks.filter((c) => tripping.has(c["status"]));
+  if (!driftPresent && tripped.length === 0) {
+    return 0;
+  }
+  if (process.env[STRICT_KILL_SWITCH] === "1") {
+    eprint(
+      `\u26A0\uFE0F  doctor --strict: ${String(tripped.length)} finding(s) at or above '${opts.strict_level}'` + (driftPresent ? " plus manifest drift" : "") + `, but ${STRICT_KILL_SWITCH}=1 suppressed the failing exit. The findings above still stand; unset it to restore the gate.`
+    );
+    return 0;
+  }
+  return 1;
+}
+function attachProceedFields(payload, driftPresent, checks) {
+  const proceed = canProceed(driftPresent, checks);
+  payload["can_proceed"] = proceed;
+  payload["status"] = proceed ? checks.some((c) => c["status"] === "warn") ? "warn" : "ok" : "fail";
+}
+function validateStrictLevelOr(level, onError) {
+  try {
+    validateStrictLevel(level);
+  } catch (e) {
+    if (e instanceof StrictLevelError) onError(e.message);
+    throw e;
+  }
+}
+var StrictLevelError, STRICT_DEFAULT_LEVEL, STRICT_LEVELS, STRICT_KILL_SWITCH, STRICT_STORE_TRUE, STRICT_VALUE_FLAGS, STRICT_DEFAULTS, STRICT_USAGE;
+var init_doctor_strict = __esm({
+  "src/scripts/_cli/_doctor_strict.ts"() {
+    "use strict";
+    StrictLevelError = class extends Error {
+    };
+    STRICT_DEFAULT_LEVEL = "fail";
+    STRICT_LEVELS = /* @__PURE__ */ new Set(["fail", "warn"]);
+    STRICT_KILL_SWITCH = "AGENT_CONFIG_DOCTOR_NO_FAIL";
+    STRICT_STORE_TRUE = { "--strict": "strict" };
+    STRICT_VALUE_FLAGS = { "--strict-level": "strict_level" };
+    STRICT_DEFAULTS = { strict: false, strict_level: STRICT_DEFAULT_LEVEL };
+    STRICT_USAGE = "                           [--strict] [--strict-level {fail,warn}]\n";
+  }
+});
+
+// src/scripts/_cli/_doctor_emit.ts
+function print(line = "") {
+  process.stdout.write(`${line}
+`);
+}
+function _emit_text(project_root, missing, modified, foreign, tag_drift) {
+  const total = missing.length + modified.length + foreign.length + tag_drift.length;
+  if (total === 0) {
+    print(`\u2705  doctor: manifest matches filesystem under ${project_root}`);
+    return;
+  }
+  print(`\u26A0\uFE0F   doctor: ${total} drift item(s) under ${project_root}`);
+  const groups = [
+    ["missing", missing],
+    ["modified", modified],
+    ["foreign", foreign],
+    ["tag-drift", tag_drift]
+  ];
+  for (const [label, items] of groups) {
+    if (items.length === 0) {
+      continue;
+    }
+    print(`
+  ${label} (${items.length}):`);
+    for (const it of items) {
+      const tool = it["tool"] || "?";
+      print(`    \xB7 [${tool}] ${it["path"]}`);
+      if (label === "tag-drift") {
+        const found = it["found"] || "(missing)";
+        const expected = "expected" in it ? it["expected"] : PACKAGE_TAG_ID;
+        print(`        expected: ${expected}`);
+        print(`        found:    ${found}`);
+      }
+      print(`        fix: ${it["fix"]}`);
+    }
+  }
+}
+var PACKAGE_TAG_ID;
+var init_doctor_emit = __esm({
+  "src/scripts/_cli/_doctor_emit.ts"() {
+    "use strict";
+    PACKAGE_TAG_ID = "event4u/agent-config";
+  }
+});
+
 // src/scripts/_cli/cmd_doctor.ts
 var cmd_doctor_exports = {};
 __export(cmd_doctor_exports, {
@@ -33758,7 +33867,7 @@ __export(cmd_doctor_exports, {
   MCP_BETA_GATES: () => MCP_BETA_GATES,
   MIN_PYTHON: () => MIN_PYTHON,
   NO_FRONTMATTER: () => NO_FRONTMATTER,
-  PACKAGE_TAG_ID: () => PACKAGE_TAG_ID,
+  PACKAGE_TAG_ID: () => PACKAGE_TAG_ID2,
   REPAIR_IDS: () => REPAIR_IDS,
   STATUS_SYMBOLS: () => STATUS_SYMBOLS,
   _check_bridge_drift: () => _check_bridge_drift,
@@ -33956,10 +34065,10 @@ function yamlSafeLoad2(text) {
     return void 0;
   }
 }
-function print(line = "") {
+function print2(line = "") {
   process16.stdout.write(line + "\n");
 }
-function eprint(line = "") {
+function eprint2(line = "") {
   process16.stderr.write(line + "\n");
 }
 function _resolve_project_root(arg) {
@@ -34011,22 +34120,22 @@ function _detect_wrapper(project_root) {
   };
 }
 function _emit_trace_text(root, anchor, trace, origin) {
-  print(`  \u{1F4CD}  start: ${process16.cwd()}`);
-  print(`  \u{1F4CD}  origin: ${origin}`);
+  print2(`  \u{1F4CD}  start: ${process16.cwd()}`);
+  print2(`  \u{1F4CD}  origin: ${origin}`);
   if (trace.length > 0) {
-    print("  trace:");
+    print2("  trace:");
     for (const record of trace) {
       const hit = record.hit;
       const symbol = hit ? "\u2705" : "\xB7";
       const tag = `[${record.pass}]`;
       const anchor_str = hit ? ` \u2192 ${hit}` : "";
-      print(`    ${symbol} ${tag} ${record.ancestor}${anchor_str}  (${record.reason})`);
+      print2(`    ${symbol} ${tag} ${record.ancestor}${anchor_str}  (${record.reason})`);
     }
   }
   if (root !== null) {
-    print(`  \u{1F4CD}  resolved root: ${root} (anchor: ${anchor || "n/a"})`);
+    print2(`  \u{1F4CD}  resolved root: ${root} (anchor: ${anchor || "n/a"})`);
   } else {
-    print("  \u26A0\uFE0F   no anchor found in chain");
+    print2("  \u26A0\uFE0F   no anchor found in chain");
   }
 }
 function _emit_trace_json(root, anchor, trace, origin) {
@@ -34037,32 +34146,32 @@ function _emit_trace_json(root, anchor, trace, origin) {
     anchor,
     trace
   };
-  print(_jsonDumpsIndentAscii(payload, 2));
+  print2(_jsonDumpsIndentAscii(payload, 2));
 }
 function _emit_context_text(ctx) {
-  print(`  \u{1F4CD}  project_root: ${ctx["project_root"]}  (origin: ${ctx["origin"]})`);
-  print(`  \u{1F4E6}  install_mode: ${ctx["install_mode"]}  (source: ${ctx["install_mode_source"]})`);
+  print2(`  \u{1F4CD}  project_root: ${ctx["project_root"]}  (origin: ${ctx["origin"]})`);
+  print2(`  \u{1F4E6}  install_mode: ${ctx["install_mode"]}  (source: ${ctx["install_mode_source"]})`);
   const env_pin = ctx["env_pin"];
   if (env_pin) {
     const marker = ctx["root_override"] ? " (--root override)" : "";
-    print(`  \u{1F512}  env_pin: ${env_pin}${marker}`);
+    print2(`  \u{1F512}  env_pin: ${env_pin}${marker}`);
   } else {
-    print("  \u{1F512}  env_pin: (unset)");
+    print2("  \u{1F512}  env_pin: (unset)");
   }
   const layers = ctx["settings_layers"] || [];
   if (layers.length > 0) {
-    print(`  \u{1F4D1}  settings layers (${layers.length}):`);
+    print2(`  \u{1F4D1}  settings layers (${layers.length}):`);
     for (const layer of layers) {
-      print(`        - ${layer}`);
+      print2(`        - ${layer}`);
     }
   } else {
-    print("  \u{1F4D1}  settings layers: (none)");
+    print2("  \u{1F4D1}  settings layers: (none)");
   }
   const wrapper = ctx["wrapper"] || {};
   if (wrapper["exists"]) {
-    print(`  \u{1F9E9}  wrapper: ${wrapper["path"]}  (embedded root: ${wrapper["embedded_root"]})`);
+    print2(`  \u{1F9E9}  wrapper: ${wrapper["path"]}  (embedded root: ${wrapper["embedded_root"]})`);
   } else {
-    print(`  \u{1F9E9}  wrapper: (not present at ${wrapper["path"]})`);
+    print2(`  \u{1F9E9}  wrapper: (not present at ${wrapper["path"]})`);
   }
 }
 function _resolve_path(project_root, raw) {
@@ -34245,12 +34354,12 @@ function _classify2(records) {
       continue;
     }
     const tag = _read_inline_package_tag(target);
-    if (!(tag instanceof _Sentinel) && tag !== PACKAGE_TAG_ID) {
+    if (!(tag instanceof _Sentinel) && tag !== PACKAGE_TAG_ID2) {
       tag_drift.push({
         tool: tool_id,
         path: String(target),
         kind,
-        expected: PACKAGE_TAG_ID,
+        expected: PACKAGE_TAG_ID2,
         found: tag === null ? "" : tag,
         fix: _fix_hint("tag-drift", kind)
       });
@@ -34857,7 +34966,7 @@ function _check_stale_orphans() {
           continue;
         }
         const tag = _read_inline_package_tag(md);
-        if (tag instanceof _Sentinel || tag !== PACKAGE_TAG_ID) {
+        if (tag instanceof _Sentinel || tag !== PACKAGE_TAG_ID2) {
           continue;
         }
         orphan_count += 1;
@@ -35885,17 +35994,17 @@ function _run_no_manifest(opts, project_root, origin, bridge_present) {
   if (opts.json) {
     _emit_json(project_root, [], [], [], [], checks, origin);
   } else if (opts.check === null) {
-    print(`  \u{1F4CD}  project_root: ${project_root} (origin: ${origin})`);
+    print2(`  \u{1F4CD}  project_root: ${project_root} (origin: ${origin})`);
     if (bridge_present) {
-      print(
+      print2(
         "  \u2139\uFE0F   global-only consumer: install marker present, no project lockfile (expected under ADR-020)"
       );
-      print(
+      print2(
         "      project-manifest checks are skipped \u2014 they apply only to project-local distributed tools"
       );
     } else {
-      eprint(`  \u26A0\uFE0F   no project lockfile and no consumer install marker at ${project_root}`);
-      eprint(
+      eprint2(`  \u26A0\uFE0F   no project lockfile and no consumer install marker at ${project_root}`);
+      eprint2(
         "      run `agent-config init` (project install) or `agent-config refresh --project` (global-only consumer)"
       );
     }
@@ -35911,6 +36020,8 @@ function _run_no_manifest(opts, project_root, origin, bridge_present) {
     }
     return fail_check ? 1 : 0;
   }
+  const sx = strictExit(opts, checks, false);
+  if (sx !== null) return bridge_present ? sx : 2;
   if (opts.ci && bridge_present) {
     return fail_check ? 1 : 0;
   }
@@ -35929,66 +36040,36 @@ function _emit_json(project_root, missing, modified, foreign, tag_drift, checks
   }
   if (checks !== null) {
     payload["checks"] = checks;
+    const drift = missing.length + modified.length + foreign.length + tag_drift.length;
+    attachProceedFields(payload, drift > 0, checks);
     if (checks.some((c) => c["id"] === "detection")) {
       payload["detection"] = detectionJson(_detection_report(project_root));
     }
   }
-  print(_jsonDumpsIndentAscii(payload, 2));
+  print2(_jsonDumpsIndentAscii(payload, 2));
 }
 function _emit_checks_text(checks) {
   if (checks.length === 0) {
     return;
   }
-  print("checks:");
+  print2("checks:");
   for (const c of checks) {
     const sym = STATUS_SYMBOLS[c["status"]] ?? "?";
-    print(`  ${sym} ${c["id"]}: ${c["message"]}`);
+    print2(`  ${sym} ${c["id"]}: ${c["message"]}`);
     if (c["status"] !== "ok" && c["remedy"]) {
-      print(`      fix: ${c["remedy"]}`);
+      print2(`      fix: ${c["remedy"]}`);
     }
   }
-  print("");
+  print2("");
 }
 function _emit_detection_text(project_root, checks) {
   if (!checks.some((c) => c["id"] === "detection")) {
     return;
   }
   for (const line of renderDetectionLines(_detection_report(project_root))) {
-    print(line);
-  }
-  print("");
-}
-function _emit_text(project_root, missing, modified, foreign, tag_drift) {
-  const total = missing.length + modified.length + foreign.length + tag_drift.length;
-  if (total === 0) {
-    print(`\u2705  doctor: manifest matches filesystem under ${project_root}`);
-    return;
-  }
-  print(`\u26A0\uFE0F   doctor: ${total} drift item(s) under ${project_root}`);
-  const groups = [
-    ["missing", missing],
-    ["modified", modified],
-    ["foreign", foreign],
-    ["tag-drift", tag_drift]
-  ];
-  for (const [label, items] of groups) {
-    if (items.length === 0) {
-      continue;
-    }
-    print(`
-  ${label} (${items.length}):`);
-    for (const it of items) {
-      const tool = it["tool"] || "?";
-      print(`    \xB7 [${tool}] ${it["path"]}`);
-      if (label === "tag-drift") {
-        const found = it["found"] || "(missing)";
-        const expected = "expected" in it ? it["expected"] : PACKAGE_TAG_ID;
-        print(`        expected: ${expected}`);
-        print(`        found:    ${found}`);
-      }
-      print(`        fix: ${it["fix"]}`);
-    }
+    print2(line);
   }
+  print2("");
 }
 function _argError9(msg) {
   process16.stderr.write(USAGE2);
@@ -36001,6 +36082,7 @@ function _parse3(argv) {
     project: null,
     json: false,
     ci: false,
+    ...STRICT_DEFAULTS,
     check: null,
     trace_root: false,
     context: false,
@@ -36098,7 +36180,7 @@ function _run_context(opts) {
     [project_root, origin] = _resolve_project_root(opts.project);
   } catch (exc) {
     if (exc instanceof ProjectRootError) {
-      eprint(`\u274C  doctor: ${exc.message}`);
+      eprint2(`\u274C  doctor: ${exc.message}`);
       return 2;
     }
     throw exc;
@@ -36115,7 +36197,7 @@ function _run_context(opts) {
     wrapper: _detect_wrapper(project_root)
   };
   if (opts.json) {
-    print(_jsonDumpsIndentAscii(ctx, 2));
+    print2(_jsonDumpsIndentAscii(ctx, 2));
   } else {
     _emit_context_text(ctx);
   }
@@ -36137,7 +36219,7 @@ function _run_anatomy(opts) {
     economyError = err instanceof Error ? err.message : String(err);
   }
   if (opts.json) {
-    print(
+    print2(
       _jsonDumpsIndentAscii(
         {
           preamble_byte_census: byteCensus,
@@ -36149,10 +36231,10 @@ function _run_anatomy(opts) {
     );
     return 0;
   }
-  print("\u2500\u2500 injection anatomy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  print(census.renderText(byteCensus));
-  print("");
-  print(
+  print2("\u2500\u2500 injection anatomy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  print2(census.renderText(byteCensus));
+  print2("");
+  print2(
     economyReport !== null ? economy.renderText(economyReport) : `dispatch-economy report unavailable: ${economyError}`
   );
   return 0;
@@ -36174,29 +36256,30 @@ function _run_repair(opts) {
         payload["action"] = "error";
         payload["error"] = osErrorStr2(exc);
         if (opts.json) {
-          print(_jsonDumpsIndentAscii(payload, 2));
+          print2(_jsonDumpsIndentAscii(payload, 2));
         } else {
-          eprint(`\u274C  doctor: could not remove ${state_pth}: ${osErrorStr2(exc)}`);
+          eprint2(`\u274C  doctor: could not remove ${state_pth}: ${osErrorStr2(exc)}`);
         }
         return 2;
       }
     }
     if (opts.json) {
-      print(_jsonDumpsIndentAscii(payload, 2));
+      print2(_jsonDumpsIndentAscii(payload, 2));
     } else {
       if (payload["action"] === "remove") {
-        print(`\u2705  doctor: reset wizard-state (${state_pth})`);
+        print2(`\u2705  doctor: reset wizard-state (${state_pth})`);
       } else {
-        print(`\u2705  doctor: nothing to repair (no wizard-state at ${state_pth})`);
+        print2(`\u2705  doctor: nothing to repair (no wizard-state at ${state_pth})`);
       }
     }
     return 0;
   }
-  eprint(`\u274C  doctor: unknown repair target ${pyRepr2(target)}`);
+  eprint2(`\u274C  doctor: unknown repair target ${pyRepr2(target)}`);
   return 2;
 }
 function main21(argv = null) {
   const opts = _parse3(argv !== null ? Array.from(argv) : process16.argv.slice(2));
+  validateStrictLevelOr(opts.strict_level, _argError9);
   if (opts.ci) {
     opts.json = true;
   }
@@ -36218,7 +36301,7 @@ function main21(argv = null) {
     [project_root, origin] = _resolve_project_root(opts.project);
   } catch (exc) {
     if (exc instanceof ProjectRootError) {
-      eprint(`\u274C  doctor: ${exc.message}`);
+      eprint2(`\u274C  doctor: ${exc.message}`);
       return 2;
     }
     throw exc;
@@ -36244,7 +36327,7 @@ function main21(argv = null) {
     _emit_json(project_root, missing, modified, foreign, tag_drift, checks, origin);
   } else {
     if (opts.check === null) {
-      print(`  \u{1F4CD}  project_root: ${project_root} (origin: ${origin})`);
+      print2(`  \u{1F4CD}  project_root: ${project_root} (origin: ${origin})`);
     }
     _emit_checks_text(checks);
     _emit_detection_text(project_root, checks);
@@ -36261,6 +36344,8 @@ function main21(argv = null) {
   if (opts.ci) {
     return drift_present || fail_check ? 1 : 0;
   }
+  const strict = strictExit(opts, checks, drift_present);
+  if (strict !== null) return strict;
   return drift_present ? 1 : 0;
 }
 function _isCliEntry17() {
@@ -36289,7 +36374,7 @@ function _isCliEntry17() {
     return false;
   }
 }
-var YAML6, _HERE18, ArgparseExit4, _Sentinel, NO_FRONTMATTER, _INSTALL_MODE_MARKER_REL, PACKAGE_TAG_ID, _FRONTMATTER_PACKAGE_RE, CHECK_IDS, GLOBAL_CHECK_IDS, MANIFEST_REQUIRED_CHECK_IDS, REPAIR_IDS, MCP_BETA_GATES, STATUS_SYMBOLS, MIN_PYTHON, _PLACEHOLDER_EMAIL_RE, _PLACEHOLDER_NAME_RE, _RULE_PROJECTION_DIRS, _check_python_runtime, _check_humanizer_runtime, _CLI_PROVIDER_META, _detection_memo, PROG4, USAGE2, _STORE_TRUE_FLAGS, _VALUE_FLAGS;
+var YAML6, _HERE18, ArgparseExit4, _Sentinel, NO_FRONTMATTER, _INSTALL_MODE_MARKER_REL, PACKAGE_TAG_ID2, _FRONTMATTER_PACKAGE_RE, CHECK_IDS, GLOBAL_CHECK_IDS, MANIFEST_REQUIRED_CHECK_IDS, REPAIR_IDS, MCP_BETA_GATES, STATUS_SYMBOLS, MIN_PYTHON, _PLACEHOLDER_EMAIL_RE, _PLACEHOLDER_NAME_RE, _RULE_PROJECTION_DIRS, _check_python_runtime, _check_humanizer_runtime, _CLI_PROVIDER_META, _detection_memo, PROG4, USAGE2, _STORE_TRUE_FLAGS, _VALUE_FLAGS;
 var init_cmd_doctor = __esm({
   "src/scripts/_cli/cmd_doctor.ts"() {
     "use strict";
@@ -36320,6 +36405,8 @@ var init_cmd_doctor = __esm({
     init_review_gate();
     init_package_root();
     init_rule_scope();
+    init_doctor_strict();
+    init_doctor_emit();
     _HERE18 = fileURLToPath31(import.meta.url);
     ArgparseExit4 = class extends Error {
       constructor(code) {
@@ -36332,7 +36419,7 @@ var init_cmd_doctor = __esm({
     };
     NO_FRONTMATTER = new _Sentinel();
     _INSTALL_MODE_MARKER_REL = "agents/.agent-state/install-mode.txt";
-    PACKAGE_TAG_ID = "event4u/agent-config";
+    PACKAGE_TAG_ID2 = "event4u/agent-config";
     _FRONTMATTER_PACKAGE_RE = /^package:\s*(.+?)\s*$/m;
     CHECK_IDS = [
       "scope",
@@ -36427,17 +36514,17 @@ var init_cmd_doctor = __esm({
     _detection_memo = null;
     PROG4 = "agent-config doctor";
     USAGE2 = `usage: ${PROG4} [-h] [--project PROJECT] [--json] [--ci] [--check ID]
-                           [--trace-root] [--context] [--anatomy]
-                           [--repair ID]
-`;
+` + STRICT_USAGE + "                           [--trace-root] [--context] [--anatomy]\n                           [--repair ID]\n";
     _STORE_TRUE_FLAGS = {
       "--json": "json",
       "--ci": "ci",
+      ...STRICT_STORE_TRUE,
       "--trace-root": "trace_root",
       "--context": "context",
       "--anatomy": "anatomy"
     };
     _VALUE_FLAGS = {
+      ...STRICT_VALUE_FLAGS,
       "--project": "project",
       "--check": "check",
       "--repair": "repair"
@@ -37202,6 +37289,65 @@ function splitFences(prompt) {
 function _commandLines(fence) {
   return fence.split("\n").map((l) => l.trim()).filter((l) => l.length > 0).filter((l) => !/^(remote:|error:|hint:|fatal:|warning:|To |!\s|\s*\^)/i.test(l)).map((l) => l.replace(/^[$>#]\s*/, "")).filter((l) => /^(git|gh|npm|pnpm|yarn|task)\b/.test(l));
 }
+function extractMergeTargets(prompt) {
+  const out = /* @__PURE__ */ new Set();
+  const re = /(?:#|\bpr[- ]?|\bpull[- ]request\s+#?)(\d{1,7})\b/giu;
+  let m;
+  while ((m = re.exec(prompt)) !== null) {
+    const n = Number.parseInt(m[1], 10);
+    if (Number.isSafeInteger(n) && n > 0) {
+      out.add(n);
+    }
+  }
+  return [...out].sort((a, b) => a - b);
+}
+function isRevocation(prompt) {
+  return REVOKE_RE.test(prompt);
+}
+function _grantId(session_id, at, targets) {
+  return `${sessionSlug(session_id) || "nosession"}:${at}:${targets.join(",")}`;
+}
+function foldGrants(prior, prompt, authorized, session_id, now) {
+  if (isRevocation(prompt)) {
+    return [];
+  }
+  const carried = prior.filter((g) => g.consumed.length < g.targets.length);
+  if (!authorized.includes("pr-merge")) {
+    return carried;
+  }
+  const targets = extractMergeTargets(prompt);
+  if (targets.length === 0) {
+    return carried;
+  }
+  const at = now.toISOString();
+  const already = new Set(carried.flatMap((g) => g.targets));
+  const fresh = targets.filter((t) => !already.has(t));
+  if (fresh.length === 0) {
+    return carried;
+  }
+  return [
+    ...carried,
+    {
+      id: _grantId(session_id, at, fresh),
+      op: "pr-merge",
+      targets: fresh,
+      consumed: [],
+      granted_at: at,
+      evidence: prompt.trim().slice(0, 120)
+    }
+  ];
+}
+function negatedBefore(text, index, matched = "") {
+  let start = 0;
+  for (const mark of [".", "!", "?", "\n"]) {
+    const at = text.lastIndexOf(mark, index - 1);
+    if (at + 1 > start) {
+      start = at + 1;
+    }
+  }
+  const before = text.slice(Math.max(start, index - 30), index);
+  return NEGATION_WORD.test(before) || NEGATION_WORD.test(matched);
+}
 function classifyAuthorization(prompt) {
   const { prose, fences } = splitFences(prompt);
   const authorized = /* @__PURE__ */ new Set();
@@ -37209,7 +37355,7 @@ function classifyAuthorization(prompt) {
   const instruction = prose.split("\n").filter((l) => !OUTPUT_LINE.test(l)).join("\n");
   for (const { op, re } of isInterrogative(instruction) ? [] : PHRASES) {
     const m = re.exec(instruction);
-    if (m) {
+    if (m && !negatedBefore(instruction, m.index, m[0])) {
       authorized.add(op);
       evidence[op] = `prose: "${m[0]}"`;
     }
@@ -37231,6 +37377,68 @@ function classifyAuthorization(prompt) {
   }
   return { authorized: [...authorized], evidence };
 }
+function readGrants(consumer_root, session_id) {
+  try {
+    const raw = fs65.readFileSync(path66.join(consumer_root, ledgerFileFor(session_id)), "utf8");
+    const decoded = JSON.parse(raw);
+    if (!_isObject4(decoded) || !Array.isArray(decoded["grants"])) {
+      return [];
+    }
+    const owner = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
+    if (session_id && owner && owner !== session_id) {
+      return [];
+    }
+    return decoded["grants"].flatMap((g) => {
+      if (!_isObject4(g)) return [];
+      const op = g["op"];
+      if (typeof op !== "string" || !ALL_OPS.includes(op)) return [];
+      const targets = Array.isArray(g["targets"]) ? g["targets"] : [];
+      const consumed = Array.isArray(g["consumed"]) ? g["consumed"] : [];
+      return [
+        {
+          id: String(g["id"] ?? ""),
+          op,
+          targets: targets.filter((t) => typeof t === "number"),
+          consumed: consumed.filter((t) => typeof t === "number"),
+          granted_at: String(g["granted_at"] ?? ""),
+          evidence: String(g["evidence"] ?? "")
+        }
+      ];
+    });
+  } catch {
+    return [];
+  }
+}
+function consumeGrantTarget(consumer_root, session_id, target) {
+  const file = path66.join(consumer_root, ledgerFileFor(session_id));
+  let decoded;
+  try {
+    decoded = JSON.parse(fs65.readFileSync(file, "utf8"));
+  } catch {
+    return;
+  }
+  if (!_isObject4(decoded) || !Array.isArray(decoded["grants"])) {
+    return;
+  }
+  let touched = false;
+  for (const g of decoded["grants"]) {
+    if (!_isObject4(g) || !Array.isArray(g["targets"]) || !Array.isArray(g["consumed"])) {
+      continue;
+    }
+    const targets = g["targets"];
+    const consumed = g["consumed"];
+    if (targets.includes(target) && !consumed.includes(target)) {
+      consumed.push(target);
+      touched = true;
+    }
+  }
+  if (touched) {
+    try {
+      atomic_write_json(file, decoded);
+    } catch {
+    }
+  }
+}
 function takePending(consumer_root, session_id, now) {
   const file = path66.join(consumer_root, pendingFileFor(session_id));
   let raw;
@@ -37299,12 +37507,24 @@ function run2(stdin_text, options) {
     authorized.push(pending.op);
     evidence[pending.op] = `confirmation of the refused \`${pending.op}\` (refused ${pending.refused_at}): "${prompt.trim().slice(0, 40)}"`;
   }
+  const now = /* @__PURE__ */ new Date();
   const ledger = {
     session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
-    detected_at: (/* @__PURE__ */ new Date()).toISOString(),
+    detected_at: now.toISOString(),
     authorized,
     evidence,
-    prompt_chars: prompt.length
+    prompt_chars: prompt.length,
+    // Grants survive this write; `authorized` does not. That asymmetry IS the
+    // decision. A bare operation name stays one-shot exactly as `commit-policy`
+    // requires, and only an authorization that also froze its objects earns a
+    // life longer than the turn. See ADR-252.
+    grants: foldGrants(
+      readGrants(options.consumer_root, session),
+      prompt,
+      authorized,
+      session,
+      now
+    )
   };
   try {
     atomic_write_json(path66.join(options.consumer_root, ledgerFileFor(session)), ledger);
@@ -37345,7 +37565,7 @@ function _isCliEntry19() {
     return false;
   }
 }
-var EXIT_ALLOW2, STATE_FILE2, STATE_DIR2, PENDING_DIR, PENDING_FILE, PENDING_MAX_AGE_MS, ALL_OPS, PHRASES, OUTPUT_LINE, PASTED_COMMANDS;
+var EXIT_ALLOW2, STATE_FILE2, STATE_DIR2, PENDING_DIR, PENDING_FILE, PENDING_MAX_AGE_MS, ALL_OPS, PHRASES, OUTPUT_LINE, PASTED_COMMANDS, REVOKE_RE, NEGATION_WORD;
 var init_git_authorization_hook = __esm({
   "src/scripts/git_authorization_hook.ts"() {
     "use strict";
@@ -37368,12 +37588,39 @@ var init_git_authorization_hook = __esm({
       "pr-merge-auto",
       "tag",
       "release",
-      "publish"
+      "publish",
+      "unpublish",
+      "deprecate",
+      "release-asset",
+      "protection",
+      "workflow-toggle",
+      "repo-lifecycle",
+      "review-approve",
+      "force-push",
+      "worktree-remove",
+      "clean-ignored",
+      "tag-force",
+      "rebase",
+      "reset-hard",
+      "clean",
+      "stash-drop",
+      "branch-delete",
+      "close"
     ];
     PHRASES = [
       { op: "commit", re: /\b(commit(e|et|te|ten)?|committe|einchecken)\b/i },
       { op: "push", re: /\b(push(e|en|t)?|hochladen|hochschieben|raufschieben)\b/i },
-      { op: "branch", re: /\b(branch|feature-branch|zweig)\b/i },
+      // A CREATION VERB IS REQUIRED, as for `pr-create` above and for the same
+      // reason. The bare noun could not tell an authorization from a mention, and
+      // the mention is the dangerous half: "den branch nicht löschen" names the
+      // object precisely in order to forbid acting on it, yet authorized branch
+      // creation — the negation trails a bare-noun match, so neither the
+      // look-behind nor the span check in `negatedBefore` can reach it. Widened
+      // 2026-09-03 alongside the destructive-coverage work that measured it.
+      {
+        op: "branch",
+        re: /\b(erstell(e|en)?|mach(e|en)?|leg(e|en)?\s+an|anleg(e|en)?|(er|be)?(ö|oe)ffne|open|create|new|neuer?|starte?|checkout|wechsl?e|switch)\b[^.\n]{0,30}\b(branch|feature-branch|zweig)\b|\b(branch|feature-branch|zweig)\b[^.\n]{0,25}\b(erstellen|anlegen|aufmachen|(ö|oe)ffnen|starten)\b/i
+      },
       // A creation verb is required — "schau dir den PR an" is not "open a PR".
       {
         op: "pr-create",
@@ -37410,7 +37657,111 @@ var init_git_authorization_hook = __esm({
         op: "release",
         re: /\b(releasen?|ver(ö|oe)ffentlich(e|en))\b(?!\s*[- ]?(notes?|branch|candidate|pr\b|datum|date|zweig))/i
       },
-      { op: "publish", re: /\b(publish(e|en)?|publiziere[n]?)\b/i }
+      { op: "publish", re: /\b(publish(e|en)?|publiziere[n]?)\b/i },
+      // ── Authorization vocabulary for the ops added 2026-09-03.
+      //
+      // NON-NEGOTIABLE, and the reason it ships in the same change as the new BLOCK
+      // ops: a blocked operation with no phrase that authorizes it is a dead end.
+      // The guard refuses, the user says "doch, mach das", the classifier records
+      // nothing, and the refusal repeats forever. Every op the guard can block must
+      // have a sentence that unblocks it, or the user's override is a claim rather
+      // than a mechanism.
+      //
+      // Tight on purpose. Under-matching costs one confirmation; over-matching
+      // authorizes something the user did not ask for, so each pattern demands the
+      // object noun rather than a bare verb wherever the verb is ordinary German.
+      //
+      // `unpublish` before nothing in particular — `\bpublish\b` does not match
+      // inside "unpublish" (no word boundary between `n` and `p`), so the two never
+      // collide.
+      // TWO SHAPES EVERY GERMAN PATTERN BELOW MUST CARRY, both learned from tests
+      // that went red rather than from inspection:
+      //
+      //   1. THE IMPERATIVE DROPS ITS `-e`. "entfern die worktree", "archivier das
+      //      repo", "deaktivier den workflow" are what people type; `entfern(e|en)`
+      //      matches none of them. Every verb ending is therefore `(e|en)?`.
+      //   2. WORD ORDER GOES BOTH WAYS. "archivier das repo" and "das repo
+      //      archivieren" are one instruction, and a pattern anchored on the noun
+      //      first sees only the second.
+      //
+      // The object noun stays REQUIRED in every pattern that has one. That is what
+      // keeps the loosened verb endings from over-authorizing: "lösch" alone
+      // authorizes nothing, "lösch den branch" authorizes a branch deletion.
+      { op: "unpublish", re: /\bunpublish(e|en)?\b/i },
+      {
+        op: "deprecate",
+        re: /\bdeprecate(d|n)?\b|\bals\s+veraltet\s+markier(e|en)?\b/i
+      },
+      {
+        op: "release-asset",
+        re: /\brelease[-\s]?asset\b|\b(clobber|(ü|ue)berschreib(e|en)?|ersetz(e|en)?|replace|austausch(e|en)?)\b[^.\n]{0,25}\b(asset|artefakt|artifact|tarball|binary)\b|\b(asset|artefakt|artifact)\b[^.\n]{0,25}\b((ü|ue)berschreiben|ersetzen|austauschen|replace)\b/i
+      },
+      // A VERB IS REQUIRED, like `tag` and `release` above and for the same reason.
+      // A bare noun cannot tell an authorization from a mention, and here the
+      // mention is the dangerous half: "die branch-protection nicht anfassen" names
+      // the object precisely in order to forbid touching it. Measured — this was the
+      // one row of the negation corpus that neither the look-behind nor the
+      // span check could reach, because the negation trails a bare-noun match.
+      {
+        op: "protection",
+        re: /\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|deaktivier(e|en)?|nimm|weg|remove|delete|disable|drop|lift)\b[^.\n]{0,30}\b(branch[-\s]?protection|protection[-\s]?rule|schutzregel|ruleset)\b|\b(branch[-\s]?protection|protection[-\s]?rule|schutzregel|ruleset)\b[^.\n]{0,30}\b(entfernen|l(ö|oe)schen|deaktivieren|abschalten|remove|delete|disable|drop|lift|weg)\b/i
+      },
+      {
+        op: "workflow-toggle",
+        re: /\bworkflow\b[^.\n]{0,25}\b(deaktivier(e|en)?|aktivier(e|en)?|disable|enable|abschalt(e|en)?|ausschalt(e|en)?)\b|\b(deaktivier(e|en)?|aktivier(e|en)?|disable|enable|abschalt(e|en)?|ausschalt(e|en)?)\b[^.\n]{0,25}\bworkflow\b/i
+      },
+      {
+        op: "repo-lifecycle",
+        re: /\b(repo|repository)\b[^.\n]{0,30}\b(archivier(e|en)?|archive|l(ö|oe)sch(e|en)?|delete)\b|\b(archivier(e|en)?|archive|l(ö|oe)sch(e|en)?|delete)\b[^.\n]{0,25}\b(repo|repository)\b|\b(repo|repository)\b[^.\n]{0,30}\bauf\s+(privat|public|öffentlich|private)\b/i
+      },
+      {
+        op: "review-approve",
+        re: /\b(approve|genehmig(e|en)?|freigeb(e|en)?|abnehm(e|en)?)\b[^.\n]{0,30}\b(review|pr|pull[-\s]request)\b|\b(review|pr|pull[-\s]request)\b[^.\n]{0,20}\b(approve|approven|genehmigen|freigeben)\b/i
+      },
+      {
+        op: "force-push",
+        re: /\bforce[-\s]?push(e|en|st)?\b|--force(-with-lease)?\b|\bmit\s+gewalt\s+push(e|en)?\b/i
+      },
+      {
+        op: "worktree-remove",
+        re: /\bworktree\b[^.\n]{0,25}\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|remove|delete|weg(werfen|r(ä|ae)umen))\b|\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|remove|delete)\b[^.\n]{0,25}\bworktree\b/i
+      },
+      // The `-x` flag is the whole distinction: without it `git clean` spares
+      // ignored files, with it `.env` and local certificates go too.
+      {
+        op: "clean-ignored",
+        re: /\bgit\s+clean\b[^.\n]{0,20}-[A-Za-z]*x|\b(ignorierte|ignored)\b[^.\n]{0,25}\b(dateien|files)\b[^.\n]{0,25}\b(l(ö|oe)sch(e|en)?|entfern(e|en)?|remove|delete)\b/i
+      },
+      {
+        op: "tag-force",
+        re: /\btag\b[^.\n]{0,25}\b(verschieb(e|en)?|(ü|ue)berschreib(e|en)?|umh(ä|ae)ng(e|en)?|force|move)\b|\b(verschieb(e|en)?|(ü|ue)berschreib(e|en)?)\b[^.\n]{0,20}\btag\b/i
+      },
+      { op: "rebase", re: /\brebase(n|st|d)?\b/i },
+      {
+        op: "reset-hard",
+        re: /\breset\s+--hard\b|\bhard\s+reset\b|\bhart\s+zur(ü|ue)cksetz(e|en)?\b/i
+      },
+      { op: "clean", re: /\bgit\s+clean\b/i },
+      {
+        op: "stash-drop",
+        re: /\bstash\b[^.\n]{0,25}\b(drop|clear|verwerf(e|en)?|l(ö|oe)sch(e|en)?)\b|\b(verwerf(e|en)?|l(ö|oe)sch(e|en)?|drop)\b[^.\n]{0,20}\bstash\b/i
+      },
+      {
+        op: "branch-delete",
+        re: /\b(l(ö|oe)sch(e|en)?|entfern(e|en)?|delete|remove)\b[^.\n]{0,25}\b(branch|branches|zweig)\b|\b(branch|branches|zweig)\b[^.\n]{0,25}\b(l(ö|oe)schen|entfernen|delete|remove)\b/i
+      },
+      {
+        op: "close",
+        re: /\b(schlie(ß|ss)(e|en)?|close)\b[^.\n]{0,30}\b(pr|pull[-\s]request|issue|ticket)\b|\b(pr|pull[-\s]request|issue|ticket)\b[^.\n]{0,20}\b(schlie(ß|ss)en|close)\b/i
+      },
+      // Enabling auto-merge is its own op on the guard side, so it needs its own
+      // sentence. Without one it is the dead end this block exists to prevent: the
+      // plain merge phrase authorizes `pr-merge` and never `pr-merge-auto`, so the
+      // refusal would have repeated forever.
+      {
+        op: "pr-merge-auto",
+        re: /\bauto[-\s]?merge\b|\bmerge\b[^.\n]{0,20}\bautomatisch\b|\bautomatisch\b[^.\n]{0,20}\bmerg(e|en)\b/i
+      }
     ];
     OUTPUT_LINE = /^\s*(To\s+\S+|remote:|error:|fatal:|hint:|warning:|!\s|\?\?\s|\s*\^|[-+]{3}\s|@@\s|\$\s|>\s|\d+\s+(pass|fail)|npm ERR!|Error:|Traceback|at\s+\S+:\d+)/i;
     PASTED_COMMANDS = [
@@ -37433,12 +37784,107 @@ var init_git_authorization_hook = __esm({
       { op: "commit", re: /\bgit\s+commit\b/i },
       { op: "branch", re: /\bgit\s+(checkout\s+-b|switch\s+-c|branch)\b/i }
     ];
+    REVOKE_RE = /\b(stop|stopp|halt|abbrechen|abbruch|cancel|revoke|widerruf(en)?|zur(ü|ue)ck(nehmen|ziehen)|hold\s+(everything|on|the\s+merge)|warte|wait)\b|(?:\b(nicht|kein(e|en)?|no|not|dont|don't|never|niemals|nie)\b[^.!?\n]{0,30}\b(merg(e|en|ing)|zusammenf(ü|ue)hren)\b)/iu;
+    NEGATION_WORD = /\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b/i;
     if (_isCliEntry19()) {
       process.exit(main23());
     }
   }
 });
 
+// src/scripts/hooks/merge_impact.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+function classifyDiff(patch) {
+  if (patch.trim() === "") {
+    return { verdict: "undecidable", markers: [], reason: "empty diff" };
+  }
+  const markers = [];
+  for (const { label, re } of DESTRUCTIVE_MARKERS) {
+    if (re.test(patch)) {
+      markers.push(label);
+    }
+  }
+  const bump = MAJOR_BUMP.exec(patch);
+  if (bump && bump[1] !== bump[2]) {
+    markers.push(`major version bump ${bump[1]}.x to ${bump[2]}.x`);
+  }
+  const filesChanged = (patch.match(/^diff --git /gm) ?? []).length;
+  if (markers.length > 0) {
+    return { verdict: "destructive", markers, filesChanged };
+  }
+  return { verdict: "additive", markers: [], filesChanged };
+}
+function fetchPatch(pr, opts = {}) {
+  const run6 = opts.exec ?? execFileSync2;
+  const cwd = opts.cwd ?? process.cwd();
+  const capture = (file, args) => run6(file, args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 15e3 });
+  for (const ref of [`refs/pull/${pr}/head`, `pull/${pr}/head`]) {
+    try {
+      const base = capture("git", ["merge-base", "HEAD", ref]).trim();
+      if (base) {
+        const patch = capture("git", ["diff", `${base}...${ref}`]);
+        if (patch.trim() !== "") {
+          return { patch, source: "local" };
+        }
+      }
+    } catch {
+    }
+  }
+  if (opts.allowNetwork === false) {
+    return { patch: "", source: "none", reason: "no local ref and network reads disabled" };
+  }
+  try {
+    const patch = capture("gh", ["pr", "diff", String(pr), "--patch"]);
+    if (patch.trim() !== "") {
+      return { patch, source: "gh" };
+    }
+    return { patch: "", source: "none", reason: "gh returned an empty diff" };
+  } catch {
+    return { patch: "", source: "none", reason: "no local ref, and gh pr diff failed" };
+  }
+}
+function analyseMergeImpact(pr, opts = {}) {
+  const got = fetchPatch(pr, opts);
+  if (got.source === "none") {
+    return { verdict: "undecidable", markers: [], ...got.reason ? { reason: got.reason } : {} };
+  }
+  return classifyDiff(got.patch);
+}
+function describeImpact(pr, impact) {
+  const say = `Say "merge #${pr}" to authorize it.`;
+  switch (impact.verdict) {
+    case "additive":
+      return `Impact scan: PR #${pr} touches ${impact.filesChanged ?? 0} file(s) and trips no destructive marker \u2014 no schema drop, no removed export or route, no major bump, no BREAKING CHANGE. Additive as far as the diff can show, which is not the same as safe to merge: the base has moved since review and merging may trigger a deploy. ${say}`;
+    case "destructive":
+      return `Impact scan: PR #${pr} is NOT additive \u2014 ${impact.markers.join("; ")}. Read the diff before authorizing. ${say}`;
+    default:
+      return `Impact scan: could not read the diff for PR #${pr} (${impact.reason ?? "unknown"}), so nothing is known about what it changes. ${say}`;
+  }
+}
+var DESTRUCTIVE_MARKERS, MAJOR_BUMP;
+var init_merge_impact = __esm({
+  "src/scripts/hooks/merge_impact.ts"() {
+    "use strict";
+    DESTRUCTIVE_MARKERS = [
+      // Schema removal. Matched on ADDED lines only — a migration that *removes* a
+      // dropColumn call is the opposite of destructive, and matching the raw patch
+      // would score it the same way.
+      { label: "migration drops a column or table", re: /^\+.*\b(dropColumn|dropTable|dropIfExists|removeColumn|drop_column|drop_table)\b/im },
+      { label: "raw DROP or TRUNCATE in a migration", re: /^\+.*\b(DROP\s+(TABLE|COLUMN|INDEX|CONSTRAINT)|TRUNCATE\s+TABLE)\b/im },
+      // The author said so themselves. Conventional Commits marks a breaking change
+      // with a `!` before the colon or a body trailer.
+      { label: "author marked a BREAKING CHANGE", re: /^\+.*BREAKING[ -]CHANGE/m },
+      // A removed export is the shape most likely to break an importer.
+      { label: "an exported symbol was removed", re: /^-\s*export\s+(default\s+|const\s+|function\s+|class\s+|interface\s+|type\s+|async\s+)/m },
+      { label: "a public PHP or Python symbol was removed", re: /^-\s*(public\s+function|def\s+[a-z_]+\s*\()/m },
+      // Route removal breaks callers that never imported anything.
+      { label: "a route or endpoint was removed", re: /^-.*\b(Route::(get|post|put|patch|delete)|@(Get|Post|Put|Patch|Delete)Mapping|app\.(get|post|put|patch|delete)\s*\()/m },
+      { label: "a whole file was deleted", re: /^deleted file mode /m }
+    ];
+    MAJOR_BUMP = /^-\s*"version"\s*:\s*"(\d+)\.[^"]*"[\s\S]{0,200}?^\+\s*"version"\s*:\s*"(\d+)\./m;
+  }
+});
+
 // src/scripts/hooks/block_unauthorized_git.ts
 import fs66 from "node:fs";
 import path67 from "node:path";
@@ -37629,7 +38075,24 @@ function commandOp(command) {
   }
   return found;
 }
+function mergeTargetOf(command) {
+  const gh = /\bgh\s+pr\s+merge\s+(?:-{1,2}\S+\s+)*?(\d{1,7})\b/i.exec(command);
+  if (gh) {
+    return Number.parseInt(gh[1], 10);
+  }
+  const api = /\/pulls\/(\d{1,7})\/merge\b/i.exec(command);
+  return api ? Number.parseInt(api[1], 10) : null;
+}
+function grantCovers(grants, op, target) {
+  if (op !== "pr-merge" || target === null) {
+    return null;
+  }
+  return grants.find(
+    (g) => g.op === "pr-merge" && g.targets.includes(target) && !g.consumed.includes(target)
+  ) ?? null;
+}
 function _loadLedger(consumer_root, session_id, now) {
+  const grants = readGrants(consumer_root, session_id);
   const candidates = [ledgerFileFor(session_id)];
   if (!candidates.includes(STATE_FILE2)) {
     candidates.push(STATE_FILE2);
@@ -37637,10 +38100,10 @@ function _loadLedger(consumer_root, session_id, now) {
   for (const rel of candidates) {
     const found = _readLedgerFile(path67.join(consumer_root, rel), session_id, now);
     if (found !== null) {
-      return found;
+      return { ...found, grants };
     }
   }
-  return { authorized: /* @__PURE__ */ new Set(), present: false };
+  return { authorized: /* @__PURE__ */ new Set(), present: false, grants };
 }
 function _readLedgerFile(file, session_id, now) {
   try {
@@ -37664,7 +38127,7 @@ function _readLedgerFile(file, session_id, now) {
   }
   return null;
 }
-function decide(command, ledger) {
+function decide(command, ledger, impact) {
   if (command === null) {
     return { exit: EXIT_ALLOW3, stdout: "", stderr: "" };
   }
@@ -37672,9 +38135,14 @@ function decide(command, ledger) {
   if (op === null || ledger.authorized.has(op)) {
     return { exit: EXIT_ALLOW3, stdout: "", stderr: "" };
   }
+  const target = mergeTargetOf(command);
+  if (grantCovers(ledger.grants ?? [], op, target) && target !== null) {
+    return { exit: EXIT_ALLOW3, stdout: "", stderr: "", consumedTarget: target };
+  }
   const shown = command.length > 120 ? `${command.slice(0, 117)}\u2026` : command;
   if (BLOCK_OPS.has(op)) {
-    const reason = `Blocked: \`${op}\` with no authorization in this turn's prompt. This operation is irreversible and non-destructive-by-default already declares it never-autonomous. Command: ${shown}. Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
+    const scan2 = op === "pr-merge" && target !== null && impact ? ` ${impact}` : "";
+    const reason = `Blocked: \`${op}\` with no authorization in this turn's prompt. This operation is irreversible and non-destructive-by-default already declares it never-autonomous. Command: ${shown}.${scan2} Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
     return { exit: EXIT_BLOCK, stdout: "", stderr: `${reason}
 `, blockedOp: op };
   }
@@ -37702,10 +38170,24 @@ function run3(stdin_text, options) {
     }
   }
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
-  const decision = decide(
-    extractCommand(envelope),
-    _loadLedger(options.consumer_root, session_id, Date.now())
-  );
+  const command = extractCommand(envelope);
+  const ledger = _loadLedger(options.consumer_root, session_id, Date.now());
+  let impact;
+  const stage1 = command === null ? null : commandOp(command);
+  const stage2Target = command === null ? null : mergeTargetOf(command);
+  if (stage1 === "pr-merge" && stage2Target !== null && !ledger.authorized.has("pr-merge") && !grantCovers(ledger.grants ?? [], "pr-merge", stage2Target)) {
+    try {
+      impact = describeImpact(
+        stage2Target,
+        analyseMergeImpact(stage2Target, { cwd: options.consumer_root })
+      );
+    } catch {
+    }
+  }
+  const decision = decide(command, ledger, impact);
+  if (decision.consumedTarget !== void 0) {
+    consumeGrantTarget(options.consumer_root, session_id, decision.consumedTarget);
+  }
   if (decision.blockedOp) {
     try {
       atomic_write_json(path67.join(options.consumer_root, pendingFileFor(session_id)), {
@@ -37762,6 +38244,7 @@ var init_block_unauthorized_git = __esm({
   "src/scripts/hooks/block_unauthorized_git.ts"() {
     "use strict";
     init_hook_stdin();
+    init_merge_impact();
     init_state_io();
     init_git_authorization_hook();
     EXIT_ALLOW3 = 0;
@@ -37773,13 +38256,52 @@ var init_block_unauthorized_git = __esm({
       "pr-merge",
       // Enabling auto-merge commits the outcome to a condition the agent does not
       // control, so it is blocked on the same terms as the merge it schedules.
-      "pr-merge-auto"
+      "pr-merge-auto",
+      // ── Added 2026-09-03. Every one is already never-autonomous in the
+      // `non-destructive-by-default` prose; the measurement that drove it is in the
+      // `GitOp` union's own note — 17 of 25 borderline operations classified as
+      // NOTHING, including three worse than anything the guard already caught.
+      /** The undo that is more destructive than the act: lockfiles break. */
+      "unpublish",
+      /** Metadata only, and every install on earth starts warning. */
+      "deprecate",
+      /** Replaces bytes consumers already hold a checksum for. */
+      "release-asset",
+      /** Deletes the guard rather than the data — everything after is unguarded. */
+      "protection",
+      /** No data lost; the gate that protects everything downstream is off. */
+      "workflow-toggle",
+      /** Reach outside the repository, and mostly one-way. */
+      "repo-lifecycle",
+      /** No code moves, and an armed auto-merge is released. */
+      "review-approve",
+      /** Discards commits that landed after the last fetch, on a shared ref. */
+      "force-push",
+      /** Destroys uncommitted work belonging to a session this one cannot see. */
+      "worktree-remove",
+      /** `-x` is the flag that takes `.env` and local certificates. */
+      "clean-ignored"
     ]);
     WARN_OPS = /* @__PURE__ */ new Set([
       "commit",
       "push",
       "pr-create",
-      "branch"
+      "branch",
+      // ── Added 2026-09-03, deliberately at warn rather than block.
+      //
+      // Each is destructive in some reading, and each is also routine enough that
+      // blocking it would be the friction that gets the whole guard routed around —
+      // the failure mode this estate has already recorded twice. `reset-hard` is the
+      // sharpest case and stays here for a decidable reason: the Hard Floor's
+      // qualifier is "past unpushed work", and the command text cannot say whether
+      // the work was pushed.
+      "tag-force",
+      "rebase",
+      "reset-hard",
+      "clean",
+      "stash-drop",
+      "branch-delete",
+      "close"
     ]);
     G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
     P = "^(?:\\S*\\/)?";
@@ -37819,6 +38341,72 @@ var init_block_unauthorized_git = __esm({
         op: "pr-create",
         re: new RegExp(`${P}gh\\s+pr\\s+create\\b|${ghApiWrite("\\/pulls\\b").source}`, "i")
       },
+      // ── Added 2026-09-03. Placement inside this table is as load-bearing as the
+      // patterns: the loop takes the MOST SEVERE match per segment, but within one
+      // op the first pattern wins, so anything more specific than a plain `git push`
+      // has to sit above it.
+      // `npm unpublish` is NOT reached by the publish pattern — `\bpublish\b` needs
+      // a word boundary that `unpublish` does not provide between `n` and `p`. That
+      // is why it classified as nothing for as long as it did.
+      { op: "unpublish", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}unpublish\\b`, "i") },
+      { op: "deprecate", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}deprecate\\b`, "i") },
+      {
+        op: "release-asset",
+        re: new RegExp(`${P}gh\\s+release\\s+(upload|edit|delete)\\b`, "i")
+      },
+      {
+        op: "protection",
+        re: new RegExp(
+          `${P}gh\\s+api\\b(?=[^\\n]*(?:protection|rulesets?)\\b)(?=[^\\n]*(?:-X|--method)\\s+(?:DELETE|PUT|PATCH|POST)\\b)|${P}gh\\s+ruleset\\s+delete\\b`,
+          "i"
+        )
+      },
+      {
+        op: "workflow-toggle",
+        re: new RegExp(`${P}gh\\s+workflow\\s+(disable|enable)\\b`, "i")
+      },
+      {
+        op: "repo-lifecycle",
+        re: new RegExp(
+          `${P}gh\\s+repo\\s+(archive|delete|unarchive)\\b|${P}gh\\s+repo\\s+edit\\b(?=[^\\n]*--visibility\\b)`,
+          "i"
+        )
+      },
+      {
+        op: "review-approve",
+        re: new RegExp(`${P}gh\\s+pr\\s+review\\b(?=[^\\n]*--approve\\b)`, "i")
+      },
+      // Above `push`, and both spellings: `--force` and `--force-with-lease`. The
+      // "safe force" is in the same class here because what it is safe against is a
+      // stale local view, not a collaborator who pushed after your fetch.
+      {
+        op: "force-push",
+        re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)`, "i")
+      },
+      {
+        op: "worktree-remove",
+        re: new RegExp(`${P}git\\s+worktree\\s+remove\\b[^\\n;|&]*(--force\\b|\\s-f\\b)`, "i")
+      },
+      // `-x` (or `-X`) anywhere in the flag cluster is what reaches ignored files.
+      {
+        op: "clean-ignored",
+        re: new RegExp(`${P}git\\s+clean\\b[^\\n;|&]*-[A-Za-z]*x`, "i")
+      },
+      { op: "tag-force", re: new RegExp(`${P}git\\s+tag\\b[^\\n;|&]*(-f\\b|--force\\b)`, "i") },
+      { op: "rebase", re: new RegExp(`${P}git\\s+${G}rebase\\b`, "i") },
+      { op: "reset-hard", re: new RegExp(`${P}git\\s+${G}reset\\b[^\\n;|&]*--hard\\b`, "i") },
+      { op: "clean", re: new RegExp(`${P}git\\s+clean\\b`, "i") },
+      { op: "stash-drop", re: new RegExp(`${P}git\\s+stash\\s+(drop|clear)\\b`, "i") },
+      // Remote deletion and the local `-D` are one op: both remove a ref, and the
+      // remote form additionally closes any open PR pointing at it.
+      {
+        op: "branch-delete",
+        re: new RegExp(
+          `${P}git\\s+branch\\b[^\\n;|&]*(-D\\b|--delete\\b)|${P}git\\s+${G}push\\b[^\\n;|&]*(--delete\\b|\\s:\\S)`,
+          "i"
+        )
+      },
+      { op: "close", re: new RegExp(`${P}gh\\s+(pr|issue)\\s+close\\b`, "i") },
       { op: "push", re: new RegExp(`${P}git\\s+${G}push\\b`, "i") },
       { op: "commit", re: new RegExp(`${P}git\\s+${G}commit\\b`, "i") },
       { op: "branch", re: new RegExp(`${P}git\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") }
@@ -42161,11 +42749,11 @@ import * as path80 from "node:path";
 import process21 from "node:process";
 import { spawnSync as spawnSync12 } from "node:child_process";
 import { fileURLToPath as fileURLToPath46, pathToFileURL as pathToFileURL36 } from "node:url";
-function print2(s = "") {
+function print3(s = "") {
   process21.stdout.write(`${s}
 `);
 }
-function eprint2(s = "") {
+function eprint3(s = "") {
   process21.stderr.write(`${s}
 `);
 }
@@ -42549,14 +43137,14 @@ function _parse4(argv) {
 function main36(argv = null) {
   const opts = _parse4(argv !== null ? Array.from(argv) : process21.argv.slice(2));
   if (opts.funnel) {
-    print2(render6(buildFunnel()));
+    print3(render6(buildFunnel()));
     return 0;
   }
   let project_root;
   try {
     [project_root] = _resolve_project_root(opts.project);
   } catch (exc) {
-    eprint2(`\u274C  conformance: ${exc.message}`);
+    eprint3(`\u274C  conformance: ${exc.message}`);
     return 2;
   }
   const manifest_pth = manifest_path(project_root);
@@ -42585,7 +43173,7 @@ function main36(argv = null) {
   const failed = allChecks.some((c) => c["status"] === "fail") || driftCount > 0;
   appendConformanceReport(conformanceChecks, project_root);
   if (opts.json) {
-    print2(
+    print3(
       _jsonDumpsIndentAscii(
         {
           project_root,
@@ -42598,20 +43186,20 @@ function main36(argv = null) {
       )
     );
   } else {
-    print2(`  \u{1F4CD}  project_root: ${project_root}`);
-    print2("conformance:");
+    print3(`  \u{1F4CD}  project_root: ${project_root}`);
+    print3("conformance:");
     for (const c of allChecks) {
       const sym = STATUS_SYMBOLS[c["status"]] ?? "?";
-      print2(`  ${sym} ${c["id"]}: ${c["message"]}`);
+      print3(`  ${sym} ${c["id"]}: ${c["message"]}`);
       if (c["status"] !== "ok" && c["remedy"]) {
-        print2(`      fix: ${c["remedy"]}`);
+        print3(`      fix: ${c["remedy"]}`);
       }
     }
     if (driftCount > 0) {
-      print2(`  \u274C drift: ${driftCount} drifted file(s) \u2014 run \`agent-config doctor\` for detail`);
+      print3(`  \u274C drift: ${driftCount} drifted file(s) \u2014 run \`agent-config doctor\` for detail`);
     }
-    print2("");
-    print2(
+    print3("");
+    print3(
       failed ? "\u274C  conformance: red \u2014 the OS is not fully installed/firing here" : "\u2705  conformance: green \u2014 installed and firing"
     );
   }