@event4u/agent-config 14.17.0 → 14.18.0

package/dist/hooks/dispatch.js

@@ -22673,11 +22673,137 @@ if (_isCliEntry18()) {
   process.exit(main22());
 }
 
-// src/scripts/session_canary_hook.ts
+// src/scripts/hooks/push_settle_hook.ts
 import fs40 from "node:fs";
 import path40 from "node:path";
+import { execFileSync as execFileSync3 } from "node:child_process";
 import { fileURLToPath as fileURLToPath27, pathToFileURL as pathToFileURL20 } from "node:url";
 var EXIT_ALLOW4 = 0;
+var EXIT_WARN3 = 2;
+var COMMAND_TOOLS4 = /* @__PURE__ */ new Set([
+  "launch-process",
+  "launch_process",
+  "Bash",
+  "BashTool",
+  "run-process",
+  "runProcess",
+  "shell",
+  "execute_shell",
+  "RunShellCommand"
+]);
+var DRY_RUN = /(?:^|\s)(?:--dry-run|-n)(?:\s|$)/;
+var REF_ADVANCED = /(?:\[new branch\]|\[new tag\]|[0-9a-f]{7,}\.\.[0-9a-f]{7,})\s+(\S+)\s+->\s+(\S+)/;
+var REJECTED = /^\s*!\s*\[(?:rejected|remote rejected)\]/m;
+function isObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function unwrap2(envelope) {
+  const inner = envelope["payload"];
+  return isObject2(inner) ? inner : envelope;
+}
+function extractCommand(payload) {
+  const toolRaw = payload["tool_name"] ?? payload["toolName"] ?? payload["tool"];
+  const tool = typeof toolRaw === "string" ? toolRaw : null;
+  if (tool === null || !COMMAND_TOOLS4.has(tool)) return null;
+  const ti = payload["tool_input"];
+  if (isObject2(ti)) {
+    for (const key of ["command", "cmd", "shell_command"]) {
+      const v = ti[key];
+      if (typeof v === "string" && v) return v;
+    }
+  }
+  for (const key of ["command", "cmd"]) {
+    const v = payload[key];
+    if (typeof v === "string" && v) return v;
+  }
+  return null;
+}
+function toolOutput(payload) {
+  for (const key of ["tool_response", "tool_result", "toolResponse", "output", "result", "stdout"]) {
+    const v = payload[key];
+    if (typeof v === "string") return v;
+    if (isObject2(v) || Array.isArray(v)) return JSON.stringify(v);
+  }
+  return JSON.stringify(payload);
+}
+function pushedBranch(output) {
+  if (REJECTED.test(output)) return null;
+  const m = REF_ADVANCED.exec(output);
+  if (m === null) return null;
+  const remote = m[2];
+  if (remote === void 0) return null;
+  return remote.replace(/^refs\/heads\//, "") || null;
+}
+function resolvePr(branch, run12 = (cmd, args) => execFileSync3(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15e3 })) {
+  try {
+    const out = run12("gh", ["pr", "view", branch, "--json", "number", "-q", ".number"]).trim();
+    const n = Number.parseInt(out, 10);
+    return Number.isInteger(n) && n > 0 ? n : null;
+  } catch {
+    return null;
+  }
+}
+function buildReminder(branch, pr) {
+  const settle = pr === null ? `gh pr view ${branch} --json number -q .number   # then:
+./scripts-run src/scripts/ci_settle <that number>` : `./scripts-run src/scripts/ci_settle ${pr}`;
+  const subject = pr === null ? `branch ${branch}` : `PR #${pr} (${branch})`;
+  const reason = `Pushed ${subject} \u2014 the turn is not finished until its CI has settled green (verify-before-complete). Run ci_settle before you report this as done.`;
+  const additional_context = `You just advanced a remote ref: ${subject}.
+
+A push is not a delivery. Per verify-before-complete, a completion claim needs fresh evidence, and the evidence for a push is the CI verdict \u2014 not the push's own exit code.
+
+Before this turn ends:
+  1. Settle it:
+     ${settle}
+     Exit 0 = settled green \xB7 1 = settled, something failed \xB7 2 = NOT a verdict (timed out or unreadable \u2014 never report 2 as green).
+  2. Red? Read only the failing part:
+     gh run view --job <id> --log-failed | grep -E '\xD7|FAIL|Error'
+     then fix it and push again (fix-what-you-see: the author is irrelevant).
+  3. Still red after 3 attempts on the same target, or blocked on something only the user can decide \u2014 stop and say so, with the three attempts named (autonomous-execution N=3).
+
+Handing the user a red PR with its cause named and unfixed is not a delivery either. If you are deliberately leaving this WIP, say that in the reply \u2014 silence is what this hook exists to stop.`;
+  return { reason, additional_context };
+}
+function main23() {
+  let envelope;
+  try {
+    const raw = readHookStdin();
+    envelope = raw.trim() ? JSON.parse(raw) : {};
+  } catch {
+    return EXIT_ALLOW4;
+  }
+  if (!isObject2(envelope)) return EXIT_ALLOW4;
+  const inner = unwrap2(envelope);
+  const command = extractCommand(inner);
+  if (command === null) return EXIT_ALLOW4;
+  if (DRY_RUN.test(command)) return EXIT_ALLOW4;
+  const branch = pushedBranch(toolOutput(inner));
+  if (branch === null) return EXIT_ALLOW4;
+  const { reason, additional_context } = buildReminder(branch, resolvePr(branch));
+  process.stdout.write(`${JSON.stringify({ decision: "warn", reason, additional_context })}
+`);
+  return EXIT_WARN3;
+}
+function isCliEntry9() {
+  if (true) return false;
+  if (process.argv[1] === void 0) return false;
+  const argvUrl = pathToFileURL20(path40.resolve(process.argv[1])).href;
+  if (import.meta.url === argvUrl) return true;
+  try {
+    return fs40.realpathSync(fileURLToPath27(import.meta.url)) === fs40.realpathSync(path40.resolve(process.argv[1]));
+  } catch {
+    return false;
+  }
+}
+if (isCliEntry9()) {
+  process.exit(main23());
+}
+
+// src/scripts/session_canary_hook.ts
+import fs41 from "node:fs";
+import path41 from "node:path";
+import { fileURLToPath as fileURLToPath28, pathToFileURL as pathToFileURL21 } from "node:url";
+var EXIT_ALLOW5 = 0;
 var SETTINGS_FILE5 = ".agent-settings.yml";
 function _isObject6(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -22685,10 +22811,10 @@ function _isObject6(v) {
 function read_canary_name(settings_path) {
   let text;
   try {
-    if (!fs40.statSync(settings_path).isFile()) {
+    if (!fs41.statSync(settings_path).isFile()) {
       return null;
     }
-    text = fs40.readFileSync(settings_path, "utf-8");
+    text = fs41.readFileSync(settings_path, "utf-8");
   } catch {
     return null;
   }
@@ -22713,10 +22839,10 @@ function read_canary_name(settings_path) {
 function read_identity_name(user_yml_path) {
   let text;
   try {
-    if (!fs40.statSync(user_yml_path).isFile()) {
+    if (!fs41.statSync(user_yml_path).isFile()) {
       return null;
     }
-    text = fs40.readFileSync(user_yml_path, "utf-8");
+    text = fs41.readFileSync(user_yml_path, "utf-8");
   } catch {
     return null;
   }
@@ -22740,13 +22866,13 @@ function read_identity_name(user_yml_path) {
 }
 function resolve_canary_name(workspace_root) {
   const project = sanitize_name(
-    read_canary_name(path40.join(workspace_root, SETTINGS_FILE5))
+    read_canary_name(path41.join(workspace_root, SETTINGS_FILE5))
   );
   if (project) {
     return { name: project, layer: "project override" };
   }
   const global_settings = resolve_with_fallback(
-    path40.join("settings", ".agent-settings.yml")
+    path41.join("settings", ".agent-settings.yml")
   );
   if (global_settings) {
     const name = sanitize_name(read_canary_name(global_settings));
@@ -22754,7 +22880,7 @@ function resolve_canary_name(workspace_root) {
       return { name, layer: "user-global settings" };
     }
   }
-  const global_user = resolve_with_fallback(path40.join("settings", ".agent-user.yml"));
+  const global_user = resolve_with_fallback(path41.join("settings", ".agent-user.yml"));
   if (global_user) {
     const name = sanitize_name(read_identity_name(global_user));
     if (name) {
@@ -22794,7 +22920,7 @@ function _workspaceRoot2(envelope) {
   }
   return process.cwd();
 }
-function main23() {
+function main24() {
   let envelope = {};
   try {
     const raw = _readStdin10();
@@ -22805,12 +22931,12 @@ function main23() {
   const event = env["event"];
   const slot = typeof event === "string" && event !== "" ? event : "session_start";
   if (slot !== "session_start" && slot !== "user_prompt_submit") {
-    return EXIT_ALLOW4;
+    return EXIT_ALLOW5;
   }
   const root = _workspaceRoot2(env);
   const { name, layer } = resolve_canary_name(root);
   if (!name) {
-    return EXIT_ALLOW4;
+    return EXIT_ALLOW5;
   }
   process.stdout.write(
     `${JSON.stringify({
@@ -22820,7 +22946,7 @@ function main23() {
     })}
 `
   );
-  return EXIT_ALLOW4;
+  return EXIT_ALLOW5;
 }
 function _readStdin10() {
   return readHookStdin();
@@ -22832,27 +22958,27 @@ function _isCliEntry19() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL20(path40.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL21(path41.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs40.realpathSync(fileURLToPath27(import.meta.url));
-    const argv = fs40.realpathSync(path40.resolve(process.argv[1]));
+    const here = fs41.realpathSync(fileURLToPath28(import.meta.url));
+    const argv = fs41.realpathSync(path41.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
 if (_isCliEntry19()) {
-  process.exit(main23());
+  process.exit(main24());
 }
 
 // src/scripts/council_availability_hook.ts
-import * as fs41 from "node:fs";
-import * as path41 from "node:path";
-import { fileURLToPath as fileURLToPath28, pathToFileURL as pathToFileURL21 } from "node:url";
-var EXIT_ALLOW5 = 0;
+import * as fs42 from "node:fs";
+import * as path42 from "node:path";
+import { fileURLToPath as fileURLToPath29, pathToFileURL as pathToFileURL22 } from "node:url";
+var EXIT_ALLOW6 = 0;
 function resolveAvailability(cwd, env) {
   let p;
   try {
@@ -22860,7 +22986,7 @@ function resolveAvailability(cwd, env) {
   } catch {
     return null;
   }
-  const exists = fs41.existsSync(p);
+  const exists = fs42.existsSync(p);
   const provenance2 = env[COUNCIL_CONFIG_ENV] ? "env-override" : "user-global";
   if (!exists) {
     return { configured: false, path: p, exists: false, provenance: provenance2, membersEnabled: 0, memberNames: [] };
@@ -22913,17 +23039,17 @@ function run7(stdin, options = {}) {
         envelope = parsed;
       }
     } catch {
-      return EXIT_ALLOW5;
+      return EXIT_ALLOW6;
     }
   }
   const event = envelope["event"];
   const slot = typeof event === "string" && event !== "" ? event : "session_start";
   if (slot !== "session_start") {
-    return EXIT_ALLOW5;
+    return EXIT_ALLOW6;
   }
   const a = resolveAvailability(_workspaceRoot3(envelope), options.env ?? process.env);
   if (a === null) {
-    return EXIT_ALLOW5;
+    return EXIT_ALLOW6;
   }
   process.stdout.write(
     `${JSON.stringify({
@@ -22933,9 +23059,9 @@ function run7(stdin, options = {}) {
     })}
 `
   );
-  return EXIT_ALLOW5;
+  return EXIT_ALLOW6;
 }
-function main24(argv) {
+function main25(argv) {
   const args = argv ?? process.argv.slice(2);
   let env = process.env;
   void args;
@@ -22948,26 +23074,26 @@ function _isCliEntry20() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  return import.meta.url === pathToFileURL21(path41.resolve(process.argv[1])).href;
+  return import.meta.url === pathToFileURL22(path42.resolve(process.argv[1])).href;
 }
 if (_isCliEntry20()) {
-  process.exit(main24());
+  process.exit(main25());
 }
 
 // src/scripts/telemetry_disclosure_hook.ts
-import * as fs46 from "node:fs";
-import * as path45 from "node:path";
-import { pathToFileURL as pathToFileURL23 } from "node:url";
+import * as fs47 from "node:fs";
+import * as path46 from "node:path";
+import { pathToFileURL as pathToFileURL24 } from "node:url";
 
 // src/scripts/hooks/telemetry_usage_hook.ts
 import * as os7 from "node:os";
-import * as path44 from "node:path";
-import { fileURLToPath as fileURLToPath29, pathToFileURL as pathToFileURL22 } from "node:url";
-import * as fs45 from "node:fs";
+import * as path45 from "node:path";
+import { fileURLToPath as fileURLToPath30, pathToFileURL as pathToFileURL23 } from "node:url";
+import * as fs46 from "node:fs";
 
 // src/agent-src/templates/scripts/telemetry/settings.ts
 import { createRequire as createRequire5 } from "node:module";
-import * as fs42 from "node:fs";
+import * as fs43 from "node:fs";
 var YAML3 = createRequire5(import.meta.url)("yaml");
 function _isPlainObject7(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v) && !(v instanceof Date);
@@ -23005,7 +23131,7 @@ function _coerce_path(value, def) {
 }
 function _isFile7(p) {
   try {
-    return fs42.statSync(p).isFile();
+    return fs43.statSync(p).isFile();
   } catch {
     return false;
   }
@@ -23016,7 +23142,7 @@ function _read_telemetry_section(p, key) {
   }
   let raw = {};
   try {
-    raw = YAML3.parse(fs42.readFileSync(p, "utf-8"), { version: "1.1" });
+    raw = YAML3.parse(fs43.readFileSync(p, "utf-8"), { version: "1.1" });
     if (raw === null || raw === void 0) {
       raw = {};
     }
@@ -23127,8 +23253,8 @@ function read_remote_settings(p) {
 
 // src/agent-src/templates/scripts/telemetry/remote.ts
 import * as crypto4 from "node:crypto";
-import * as fs43 from "node:fs";
-import * as path42 from "node:path";
+import * as fs44 from "node:fs";
+import * as path43 from "node:path";
 
 // src/agent-src/templates/scripts/telemetry/engagement.ts
 var MAX_ID_LEN = 200;
@@ -23426,13 +23552,13 @@ var RETENTION_HEAD_WINDOW_BYTES = 8192;
 function _oldest_datable_ms(log_path) {
   let fd;
   try {
-    fd = fs43.openSync(log_path, "r");
+    fd = fs44.openSync(log_path, "r");
   } catch {
     return null;
   }
   try {
     const buf = Buffer.alloc(RETENTION_HEAD_WINDOW_BYTES);
-    const read = fs43.readSync(fd, buf, 0, buf.length, 0);
+    const read = fs44.readSync(fd, buf, 0, buf.length, 0);
     if (read <= 0) {
       return null;
     }
@@ -23449,13 +23575,13 @@ function _oldest_datable_ms(log_path) {
   } catch {
     return null;
   } finally {
-    fs43.closeSync(fd);
+    fs44.closeSync(fd);
   }
 }
 function retention_due(log_path, policy = DEFAULT_RETENTION_POLICY, now = /* @__PURE__ */ new Date()) {
   let size;
   try {
-    size = fs43.statSync(log_path).size;
+    size = fs44.statSync(log_path).size;
   } catch {
     return false;
   }
@@ -23474,7 +23600,7 @@ function retention_due(log_path, policy = DEFAULT_RETENTION_POLICY, now = /* @__
 function enforce_retention(log_path, policy = DEFAULT_RETENTION_POLICY, now = /* @__PURE__ */ new Date()) {
   let raw;
   try {
-    raw = fs43.readFileSync(log_path, "utf-8");
+    raw = fs44.readFileSync(log_path, "utf-8");
   } catch {
     return { kept: 0, dropped_by_age: 0, dropped_by_size: 0 };
   }
@@ -23506,13 +23632,13 @@ function enforce_retention(log_path, policy = DEFAULT_RETENTION_POLICY, now = /*
   const payload = kept_lines.length === 0 ? "" : `${kept_lines.join("\n")}
 `;
   const tmp = `${log_path}.retention.${process.pid}.tmp`;
-  fs43.writeFileSync(tmp, payload, { encoding: "utf-8" });
-  fs43.renameSync(tmp, log_path);
+  fs44.writeFileSync(tmp, payload, { encoding: "utf-8" });
+  fs44.renameSync(tmp, log_path);
   return { kept: kept_lines.length, dropped_by_age, dropped_by_size };
 }
 function _append_and_bound(target, payload, policy, now) {
-  fs43.mkdirSync(path42.dirname(target) || ".", { recursive: true });
-  fs43.appendFileSync(target, payload, { encoding: "utf-8" });
+  fs44.mkdirSync(path43.dirname(target) || ".", { recursive: true });
+  fs44.appendFileSync(target, payload, { encoding: "utf-8" });
   if (retention_due(target, policy, now)) {
     enforce_retention(target, policy, now);
   }
@@ -23528,14 +23654,14 @@ function append_class_a_record(log_path, record, policy = DEFAULT_RETENTION_POLI
 
 // src/agent-src/templates/scripts/telemetry/transport.ts
 import { spawn } from "node:child_process";
-import * as fs44 from "node:fs";
-import * as path43 from "node:path";
+import * as fs45 from "node:fs";
+import * as path44 from "node:path";
 var DEFAULT_FLUSH_TIMEOUT_MS = 1e3;
 var FLUSH_SESSION_END = "session-end";
 function spool_path_for(log_path) {
-  const dir = path43.dirname(log_path);
-  const base = path43.basename(log_path).replace(/\.jsonl$/u, "");
-  return path43.join(dir, `${base}.spool.jsonl`);
+  const dir = path44.dirname(log_path);
+  const base = path44.basename(log_path).replace(/\.jsonl$/u, "");
+  return path44.join(dir, `${base}.spool.jsonl`);
 }
 function spawn_detached_sender(input) {
   try {
@@ -23560,22 +23686,22 @@ function spawn_detached_sender(input) {
 }
 function spool_has_work(spool_path) {
   try {
-    return fs44.statSync(spool_path).size > 0;
+    return fs45.statSync(spool_path).size > 0;
   } catch {
     return false;
   }
 }
 
 // src/scripts/hooks/telemetry_usage_hook.ts
-var EXIT_ALLOW6 = 0;
+var EXIT_ALLOW7 = 0;
 var SKILL_TOOL_NAME = "Skill";
 var SETTINGS_FILENAME = ".agent-settings.yml";
-function isObject2(v) {
+function isObject3(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function unwrapPayload(envelope) {
   const inner = envelope["payload"];
-  return isObject2(inner) ? inner : envelope;
+  return isObject3(inner) ? inner : envelope;
 }
 function extractToolName(payload) {
   const v = payload["tool_name"] ?? payload["toolName"] ?? payload["tool"];
@@ -23583,7 +23709,7 @@ function extractToolName(payload) {
 }
 function extractSkillName(payload) {
   const input = payload["tool_input"] ?? payload["toolInput"];
-  if (!isObject2(input)) return null;
+  if (!isObject3(input)) return null;
   const v = input["skill"] ?? input["skill_name"] ?? input["name"];
   return typeof v === "string" && v ? v : null;
 }
@@ -23622,15 +23748,15 @@ function extractPackageVersion(env) {
 }
 var _settingsCache = /* @__PURE__ */ new Map();
 function resolveSettingsPath(start) {
-  let dir = path44.resolve(start);
+  let dir = path45.resolve(start);
   for (; ; ) {
-    const candidate = path44.join(dir, SETTINGS_FILENAME);
+    const candidate = path45.join(dir, SETTINGS_FILENAME);
     try {
-      if (fs45.statSync(candidate).isFile()) return candidate;
+      if (fs46.statSync(candidate).isFile()) return candidate;
     } catch {
     }
-    const parent = path44.dirname(dir);
-    if (parent === dir) return path44.join(path44.resolve(start), SETTINGS_FILENAME);
+    const parent = path45.dirname(dir);
+    if (parent === dir) return path45.join(path45.resolve(start), SETTINGS_FILENAME);
     dir = parent;
   }
 }
@@ -23640,24 +23766,24 @@ function readSettingsFor(consumerRoot) {
   if (cached !== void 0) return cached;
   let text = "";
   try {
-    text = fs45.readFileSync(p, "utf-8");
+    text = fs46.readFileSync(p, "utf-8");
   } catch {
     text = "";
   }
-  const read = { settings: read_remote_settings(p), text, root: path44.dirname(p) };
+  const read = { settings: read_remote_settings(p), text, root: path45.dirname(p) };
   _settingsCache.set(p, read);
   return read;
 }
 function processEnvelope(envelope, consumer_root) {
   try {
-    if (!isObject2(envelope)) return EXIT_ALLOW6;
+    if (!isObject3(envelope)) return EXIT_ALLOW7;
     const payload = unwrapPayload(envelope);
-    if (extractToolName(payload) !== SKILL_TOOL_NAME) return EXIT_ALLOW6;
+    if (extractToolName(payload) !== SKILL_TOOL_NAME) return EXIT_ALLOW7;
     const { settings, text, root } = readSettingsFor(consumer_root);
-    if (!settings.active) return EXIT_ALLOW6;
-    if (is_replay_mode()) return EXIT_ALLOW6;
+    if (!settings.active) return EXIT_ALLOW7;
+    if (is_replay_mode()) return EXIT_ALLOW7;
     const skill = extractSkillName(payload);
-    if (skill === null) return EXIT_ALLOW6;
+    if (skill === null) return EXIT_ALLOW7;
     const record = build_class_a_record({
       skill,
       host: extractHost(envelope),
@@ -23669,7 +23795,7 @@ function processEnvelope(envelope, consumer_root) {
       package_version: extractPackageVersion(process.env),
       discipline_profile: extractDisciplineProfile(text)
     });
-    const logPath = path44.isAbsolute(settings.log_path) ? settings.log_path : path44.join(root, settings.log_path);
+    const logPath = path45.isAbsolute(settings.log_path) ? settings.log_path : path45.join(root, settings.log_path);
     const spool = settings.flush === FLUSH_SESSION_END ? spool_path_for(logPath) : null;
     append_class_a_record(
       logPath,
@@ -23682,12 +23808,12 @@ function processEnvelope(envelope, consumer_root) {
       spool
     );
   } catch {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW7;
   }
-  return EXIT_ALLOW6;
+  return EXIT_ALLOW7;
 }
 function _resolveRoot(envelope) {
-  if (isObject2(envelope)) {
+  if (isObject3(envelope)) {
     const cwd = envelope["cwd"];
     if (typeof cwd === "string" && cwd) return cwd;
     const pr = envelope["workspace_root"] ?? envelope["project_root"];
@@ -23695,13 +23821,13 @@ function _resolveRoot(envelope) {
   }
   return process.cwd();
 }
-function main25() {
+function main26() {
   const raw = readHookStdin();
   let envelope = {};
   try {
     envelope = raw.trim() ? JSON.parse(raw) : {};
   } catch {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW7;
   }
   return processEnvelope(envelope, _resolveRoot(envelope));
 }
@@ -23710,18 +23836,18 @@ function _isCliEntry21() {
     return false;
   }
   if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL22(path44.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL23(path45.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) return true;
   try {
-    return fs45.realpathSync(fileURLToPath29(import.meta.url)) === fs45.realpathSync(path44.resolve(process.argv[1]));
+    return fs46.realpathSync(fileURLToPath30(import.meta.url)) === fs46.realpathSync(path45.resolve(process.argv[1]));
   } catch {
     return false;
   }
 }
-if (_isCliEntry21()) process.exit(main25());
+if (_isCliEntry21()) process.exit(main26());
 
 // src/scripts/telemetry_disclosure_hook.ts
-var EXIT_ALLOW7 = 0;
+var EXIT_ALLOW8 = 0;
 var MAX_FIELD_CHARS3 = 120;
 function _clamp(value) {
   return value.length <= MAX_FIELD_CHARS3 ? value : `${value.slice(0, MAX_FIELD_CHARS3 - 1)}\u2026`;
@@ -23739,7 +23865,7 @@ function disclosureKey(facts) {
 }
 function alreadyDisclosed(root, facts) {
   try {
-    const raw = fs46.readFileSync(path45.join(root, DISCLOSURE_STATE_REL), "utf-8");
+    const raw = fs47.readFileSync(path46.join(root, DISCLOSURE_STATE_REL), "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed === null || typeof parsed !== "object") {
       return false;
@@ -23751,9 +23877,9 @@ function alreadyDisclosed(root, facts) {
 }
 function recordDisclosure(root, facts, at) {
   try {
-    const p = path45.join(root, DISCLOSURE_STATE_REL);
-    fs46.mkdirSync(path45.dirname(p), { recursive: true });
-    fs46.writeFileSync(
+    const p = path46.join(root, DISCLOSURE_STATE_REL);
+    fs47.mkdirSync(path46.dirname(p), { recursive: true });
+    fs47.writeFileSync(
       p,
       `${JSON.stringify({ disclosed: disclosureKey(facts), at }, null, 2)}
 `,
@@ -23783,25 +23909,25 @@ function run8(stdin, options = {}) {
         envelope = parsed;
       }
     } catch {
-      return EXIT_ALLOW7;
+      return EXIT_ALLOW8;
     }
   }
   if (envelope["event"] !== "session_start") {
-    return EXIT_ALLOW7;
+    return EXIT_ALLOW8;
   }
   if (is_replay_mode()) {
-    return EXIT_ALLOW7;
+    return EXIT_ALLOW8;
   }
   const settingsFile = options.settingsFile ?? resolveSettingsPath(_resolveRoot(envelope));
-  const root = path45.dirname(settingsFile);
+  const root = path46.dirname(settingsFile);
   let settings;
   try {
     settings = read_remote_settings(settingsFile);
   } catch {
-    return EXIT_ALLOW7;
+    return EXIT_ALLOW8;
   }
   if (!settings.active) {
-    return EXIT_ALLOW7;
+    return EXIT_ALLOW8;
   }
   const facts = {
     org_id: settings.org_id,
@@ -23809,7 +23935,7 @@ function run8(stdin, options = {}) {
     log_path: settings.log_path
   };
   if (alreadyDisclosed(root, facts)) {
-    return EXIT_ALLOW7;
+    return EXIT_ALLOW8;
   }
   process.stdout.write(
     `${JSON.stringify({
@@ -23820,9 +23946,9 @@ function run8(stdin, options = {}) {
 `
   );
   recordDisclosure(root, facts, options.now ?? (/* @__PURE__ */ new Date()).toISOString());
-  return EXIT_ALLOW7;
+  return EXIT_ALLOW8;
 }
-function main26(argv) {
+function main27(argv) {
   const args = argv ?? process.argv.slice(2);
   void args;
   return run8(readHookStdin());
@@ -23834,16 +23960,16 @@ function _isCliEntry22() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  return import.meta.url === pathToFileURL23(path45.resolve(process.argv[1])).href;
+  return import.meta.url === pathToFileURL24(path46.resolve(process.argv[1])).href;
 }
 if (_isCliEntry22()) {
-  process.exit(main26());
+  process.exit(main27());
 }
 
 // src/scripts/self_repair_hook.ts
-import * as fs48 from "node:fs";
-import * as path48 from "node:path";
-import { fileURLToPath as fileURLToPath30, pathToFileURL as pathToFileURL24 } from "node:url";
+import * as fs49 from "node:fs";
+import * as path49 from "node:path";
+import { fileURLToPath as fileURLToPath31, pathToFileURL as pathToFileURL25 } from "node:url";
 
 // src/scripts/_lib/self_repair.ts
 import { createHash as createHash8 } from "node:crypto";
@@ -24080,14 +24206,14 @@ function mergeRecord(existing, finding, now) {
 }
 
 // src/scripts/_lib/self_repair_store.ts
-import * as fs47 from "node:fs";
-import * as path46 from "node:path";
-var STORE_REL = path46.join("agents", "runtime", "self-repair");
+import * as fs48 from "node:fs";
+import * as path47 from "node:path";
+var STORE_REL = path47.join("agents", "runtime", "self-repair");
 function storeDir(root) {
-  return path46.join(root, STORE_REL);
+  return path47.join(root, STORE_REL);
 }
 function recordPath(root, fp) {
-  return path46.join(storeDir(root), `${fp}.json`);
+  return path47.join(storeDir(root), `${fp}.json`);
 }
 function isRecord(v) {
   if (typeof v !== "object" || v === null) {
@@ -24098,7 +24224,7 @@ function isRecord(v) {
 }
 function readRecord(root, fp) {
   try {
-    const parsed = JSON.parse(fs47.readFileSync(recordPath(root, fp), "utf-8"));
+    const parsed = JSON.parse(fs48.readFileSync(recordPath(root, fp), "utf-8"));
     return isRecord(parsed) ? parsed : null;
   } catch {
     return null;
@@ -24106,8 +24232,8 @@ function readRecord(root, fp) {
 }
 function writeRecord(root, record) {
   const dir = storeDir(root);
-  fs47.mkdirSync(dir, { recursive: true });
-  fs47.writeFileSync(
+  fs48.mkdirSync(dir, { recursive: true });
+  fs48.writeFileSync(
     recordPath(root, record.fingerprint),
     `${JSON.stringify(record, null, 2)}
 `,
@@ -24117,7 +24243,7 @@ function writeRecord(root, record) {
 function listRecords(root) {
   let names;
   try {
-    names = fs47.readdirSync(storeDir(root));
+    names = fs48.readdirSync(storeDir(root));
   } catch {
     return [];
   }
@@ -24139,11 +24265,11 @@ function openRecords(root) {
 }
 var OVERFLOW_FILE = "_overflow.json";
 function overflowPath(root) {
-  return path46.join(storeDir(root), OVERFLOW_FILE);
+  return path47.join(storeDir(root), OVERFLOW_FILE);
 }
 function readOverflow(root) {
   try {
-    const parsed = JSON.parse(fs47.readFileSync(overflowPath(root), "utf-8"));
+    const parsed = JSON.parse(fs48.readFileSync(overflowPath(root), "utf-8"));
     return typeof parsed === "object" && parsed !== null ? parsed : {};
   } catch {
     return {};
@@ -24154,8 +24280,8 @@ function bumpOverflow(root, source, now) {
   const prev = counts[source]?.dropped ?? 0;
   counts[source] = { dropped: prev + 1, last_seen: now };
   const dir = storeDir(root);
-  fs47.mkdirSync(dir, { recursive: true });
-  fs47.writeFileSync(overflowPath(root), `${JSON.stringify(counts, null, 2)}
+  fs48.mkdirSync(dir, { recursive: true });
+  fs48.writeFileSync(overflowPath(root), `${JSON.stringify(counts, null, 2)}
 `, "utf-8");
 }
 function upsertFinding(root, finding, now) {
@@ -24172,7 +24298,7 @@ function upsertFinding(root, finding, now) {
 
 // src/scripts/hooks/telemetry_self_repair.ts
 import * as os8 from "node:os";
-import * as path47 from "node:path";
+import * as path48 from "node:path";
 function str(v) {
   return typeof v === "string" ? v : "";
 }
@@ -24204,7 +24330,7 @@ function emitDefectShadow(root, rec, env) {
       package_version: extractPackageVersion(process.env),
       discipline_profile: extractDisciplineProfile(text)
     });
-    const logPath = path47.isAbsolute(settings.log_path) ? settings.log_path : path47.join(projectRoot, settings.log_path);
+    const logPath = path48.isAbsolute(settings.log_path) ? settings.log_path : path48.join(projectRoot, settings.log_path);
     const spool = settings.flush === FLUSH_SESSION_END ? spool_path_for(logPath) : null;
     append_class_a_record(
       logPath,
@@ -24223,8 +24349,8 @@ function emitDefectShadow(root, rec, env) {
 }
 
 // src/scripts/self_repair_hook.ts
-var EXIT_ALLOW8 = 0;
-function isObject3(v) {
+var EXIT_ALLOW9 = 0;
+function isObject4(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function str2(v) {
@@ -24241,7 +24367,7 @@ function readTurn(transcriptPath, pinned) {
   }
   let lines;
   try {
-    lines = fs48.readFileSync(transcriptPath, "utf-8").split("\n");
+    lines = fs49.readFileSync(transcriptPath, "utf-8").split("\n");
   } catch {
     return empty;
   }
@@ -24259,11 +24385,11 @@ function readTurn(transcriptPath, pinned) {
     } catch {
       continue;
     }
-    if (!isObject3(obj)) {
+    if (!isObject4(obj)) {
       continue;
     }
     const msg = obj["message"];
-    if (!isObject3(msg)) {
+    if (!isObject4(msg)) {
       continue;
     }
     const content = msg["content"];
@@ -24282,7 +24408,7 @@ function readTurn(transcriptPath, pinned) {
     }
     const parts = [];
     for (const blk of content) {
-      if (!isObject3(blk)) {
+      if (!isObject4(blk)) {
         continue;
       }
       if (blk["type"] === "text" && typeof blk["text"] === "string") {
@@ -24291,7 +24417,7 @@ function readTurn(transcriptPath, pinned) {
       if (blk["type"] === "tool_use") {
         const input = blk["input"];
         const name = str2(blk["name"]);
-        const cmd = isObject3(input) ? str2(input["command"]) : "";
+        const cmd = isObject4(input) ? str2(input["command"]) : "";
         toolCommands.push(`${name} ${cmd}`.trim());
       }
     }
@@ -24315,17 +24441,17 @@ function pinnedLanguage(env) {
   }
   return null;
 }
-function main27() {
+function main28() {
   let env = {};
   try {
     const raw = readHookStdin();
     const parsed = raw.trim() ? JSON.parse(raw) : {};
-    env = isObject3(parsed) ? parsed : {};
+    env = isObject4(parsed) ? parsed : {};
   } catch {
   }
   const slot = str2(env["event"]) || "session_start";
   if (slot !== "user_prompt_submit" && slot !== "stop") {
-    return EXIT_ALLOW8;
+    return EXIT_ALLOW9;
   }
   const root = workspaceRoot(env);
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -24350,16 +24476,16 @@ function main27() {
     }
   }
   if (slot !== "user_prompt_submit") {
-    return EXIT_ALLOW8;
+    return EXIT_ALLOW9;
   }
   let open;
   try {
     open = openRecords(root);
   } catch {
-    return EXIT_ALLOW8;
+    return EXIT_ALLOW9;
   }
   if (open.length === 0) {
-    return EXIT_ALLOW8;
+    return EXIT_ALLOW9;
   }
   process.stdout.write(
     `${JSON.stringify({
@@ -24373,42 +24499,42 @@ function main27() {
     })}
 `
   );
-  return EXIT_ALLOW8;
+  return EXIT_ALLOW9;
 }
-function isCliEntry9() {
+function isCliEntry10() {
   if (true) {
     return false;
   }
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL24(path48.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL25(path49.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    return fs48.realpathSync(fileURLToPath30(import.meta.url)) === fs48.realpathSync(path48.resolve(process.argv[1]));
+    return fs49.realpathSync(fileURLToPath31(import.meta.url)) === fs49.realpathSync(path49.resolve(process.argv[1]));
   } catch {
     return false;
   }
 }
-if (isCliEntry9()) {
-  process.exit(main27());
+if (isCliEntry10()) {
+  process.exit(main28());
 }
 
 // src/scripts/session_register_hook.ts
-import * as fs53 from "node:fs";
-import * as path53 from "node:path";
+import * as fs54 from "node:fs";
+import * as path54 from "node:path";
 import process10 from "node:process";
-import { fileURLToPath as fileURLToPath31 } from "node:url";
+import { fileURLToPath as fileURLToPath32 } from "node:url";
 
 // src/scripts/_lib/session_register.ts
-import fs50 from "node:fs";
-import path50 from "node:path";
+import fs51 from "node:fs";
+import path51 from "node:path";
 
 // src/scripts/_lib/fs_atomic.ts
-import fs49 from "node:fs";
-import path49 from "node:path";
+import fs50 from "node:fs";
+import path50 from "node:path";
 import { randomBytes } from "node:crypto";
 function _normalize_encoding(encoding) {
   const compact = encoding.toLowerCase().replace(/[-_\s]/g, "");
@@ -24424,9 +24550,9 @@ function _normalize_encoding(encoding) {
 }
 function write_atomic(p, data, options = {}) {
   const encoding = options.encoding ?? "utf-8";
-  const target = path49.normalize(p);
-  const parent = path49.dirname(target);
-  fs49.mkdirSync(parent, { recursive: true });
+  const target = path50.normalize(p);
+  const parent = path50.dirname(target);
+  fs50.mkdirSync(parent, { recursive: true });
   let payload;
   if (typeof data === "string") {
     payload = Buffer.from(data, _normalize_encoding(encoding));
@@ -24440,12 +24566,12 @@ function write_atomic(p, data, options = {}) {
   let fd = null;
   let tmp_path = "";
   for (let attempt = 0; attempt < 32; attempt += 1) {
-    tmp_path = path49.join(
+    tmp_path = path50.join(
       parent,
-      `.${path49.basename(target)}.tmp.${randomBytes(6).toString("hex")}`
+      `.${path50.basename(target)}.tmp.${randomBytes(6).toString("hex")}`
     );
     try {
-      fd = fs49.openSync(tmp_path, "wx", 384);
+      fd = fs50.openSync(tmp_path, "wx", 384);
       break;
     } catch (err) {
       if (err.code === "EEXIST") continue;
@@ -24459,24 +24585,24 @@ function write_atomic(p, data, options = {}) {
   try {
     let offset = 0;
     while (offset < payload.length) {
-      offset += fs49.writeSync(fd, payload, offset, payload.length - offset);
+      offset += fs50.writeSync(fd, payload, offset, payload.length - offset);
     }
     try {
-      fs49.fsyncSync(fd);
+      fs50.fsyncSync(fd);
     } catch {
     }
-    fs49.closeSync(fd);
+    fs50.closeSync(fd);
     closed = true;
-    fs49.renameSync(tmp_path, target);
+    fs50.renameSync(tmp_path, target);
   } catch (err) {
     if (!closed) {
       try {
-        fs49.closeSync(fd);
+        fs50.closeSync(fd);
       } catch {
       }
     }
     try {
-      fs49.unlinkSync(tmp_path);
+      fs50.unlinkSync(tmp_path);
     } catch {
     }
     throw err;
@@ -24487,17 +24613,17 @@ function write_atomic(p, data, options = {}) {
 function _fsync_dir(directory) {
   let dir_fd;
   try {
-    dir_fd = fs49.openSync(directory, fs49.constants.O_RDONLY);
+    dir_fd = fs50.openSync(directory, fs50.constants.O_RDONLY);
   } catch {
     return;
   }
   try {
     try {
-      fs49.fsyncSync(dir_fd);
+      fs50.fsyncSync(dir_fd);
     } catch {
     }
   } finally {
-    fs49.closeSync(dir_fd);
+    fs50.closeSync(dir_fd);
   }
 }
 
@@ -24535,7 +24661,7 @@ function safe_stem(session_id) {
 }
 function register_dir(workspace_root) {
   const common = git_common_dir(workspace_root);
-  return common === null ? null : path50.join(common, REGISTER_DIRNAME);
+  return common === null ? null : path51.join(common, REGISTER_DIRNAME);
 }
 function iso_now(now = /* @__PURE__ */ new Date()) {
   return now.toISOString().replace(/\.\d{3}Z$/, "+00:00");
@@ -24558,7 +24684,7 @@ function is_record(v) {
 }
 function write_record(dir, rec) {
   try {
-    const target = path50.join(dir, `${safe_stem(rec.session_id)}.json`);
+    const target = path51.join(dir, `${safe_stem(rec.session_id)}.json`);
     write_atomic(target, `${JSON.stringify(rec, null, 2)}
 `);
     return true;
@@ -24568,8 +24694,8 @@ function write_record(dir, rec) {
 }
 function read_own_record(dir, session_id) {
   try {
-    const target = path50.join(dir, `${safe_stem(session_id)}.json`);
-    const parsed = JSON.parse(fs50.readFileSync(target, "utf-8"));
+    const target = path51.join(dir, `${safe_stem(session_id)}.json`);
+    const parsed = JSON.parse(fs51.readFileSync(target, "utf-8"));
     return is_record(parsed) ? parsed : null;
   } catch {
     return null;
@@ -24577,7 +24703,7 @@ function read_own_record(dir, session_id) {
 }
 function delete_record(dir, session_id) {
   try {
-    fs50.unlinkSync(path50.join(dir, `${safe_stem(session_id)}.json`));
+    fs51.unlinkSync(path51.join(dir, `${safe_stem(session_id)}.json`));
     return true;
   } catch {
     return false;
@@ -24590,16 +24716,16 @@ function read_live_records(dir, options = {}) {
   const grace = options.prune_grace_ms ?? PRUNE_GRACE_MS;
   let names;
   try {
-    names = fs50.readdirSync(dir).filter((n) => n.endsWith(".json"));
+    names = fs51.readdirSync(dir).filter((n) => n.endsWith(".json"));
   } catch {
     return [];
   }
   const live = [];
   for (const name of names) {
-    const full = path50.join(dir, name);
+    const full = path51.join(dir, name);
     let rec = null;
     try {
-      const parsed = JSON.parse(fs50.readFileSync(full, "utf-8"));
+      const parsed = JSON.parse(fs51.readFileSync(full, "utf-8"));
       rec = is_record(parsed) ? parsed : null;
     } catch {
       rec = null;
@@ -24607,7 +24733,7 @@ function read_live_records(dir, options = {}) {
     if (rec === null || is_expired(rec, now)) {
       if (prune && (rec === null || is_expired(rec, new Date(now.getTime() - grace)))) {
         try {
-          fs50.unlinkSync(full);
+          fs51.unlinkSync(full);
         } catch {
         }
       }
@@ -24647,13 +24773,13 @@ function classify_collisions(others, here) {
 
 // src/scripts/_lib/turn_end_refusals.ts
 import * as crypto5 from "node:crypto";
-import * as fs52 from "node:fs";
-import * as path52 from "node:path";
+import * as fs53 from "node:fs";
+import * as path53 from "node:path";
 
 // src/scripts/_lib/installed_lock.ts
-import * as fs51 from "node:fs";
+import * as fs52 from "node:fs";
 import * as os9 from "node:os";
-import * as path51 from "node:path";
+import * as path52 from "node:path";
 var LOCKFILE_ENV = "AGENT_CONFIG_INSTALLED_LOCK";
 function _default_lockfile() {
   return write_target("installed.lock");
@@ -24670,7 +24796,7 @@ function expanduser2(p) {
     return os9.homedir();
   }
   if (p.startsWith("~/") || process.platform === "win32" && p.startsWith("~\\")) {
-    return path51.join(os9.homedir(), p.slice(2));
+    return path52.join(os9.homedir(), p.slice(2));
   }
   return p;
 }
@@ -24690,7 +24816,7 @@ function read_lockfile(path106) {
   const target = path106 ?? lockfile_path();
   let text;
   try {
-    text = fs51.readFileSync(target, { encoding: "utf-8" });
+    text = fs52.readFileSync(target, { encoding: "utf-8" });
   } catch {
     return null;
   }
@@ -24757,19 +24883,19 @@ var DETECTOR_IDS = [
   "verification",
   "completion"
 ];
-var REFUSAL_STATE_REL = path52.join("agents", "runtime", "state", "turn-end-gate");
+var REFUSAL_STATE_REL = path53.join("agents", "runtime", "state", "turn-end-gate");
 function refusalStateDir(workspaceRoot3) {
-  return path52.join(workspaceRoot3, REFUSAL_STATE_REL);
+  return path53.join(workspaceRoot3, REFUSAL_STATE_REL);
 }
 function deriveSessionKey(sessionId2) {
   return crypto5.createHash("sha256").update(sessionId2).digest("hex").slice(0, 32);
 }
 function sessionRefusalFile(workspaceRoot3, sessionKey) {
-  return path52.join(refusalStateDir(workspaceRoot3), `${sessionKey}.json`);
+  return path53.join(refusalStateDir(workspaceRoot3), `${sessionKey}.json`);
 }
 function readSessionCounts(workspaceRoot3, sessionId2) {
   try {
-    const raw = fs52.readFileSync(
+    const raw = fs53.readFileSync(
       sessionRefusalFile(workspaceRoot3, deriveSessionKey(sessionId2)),
       "utf-8"
     );
@@ -24871,7 +24997,7 @@ function pruneAgedRefusalState(workspaceRoot3, opts = {}) {
   const result = { scanned: 0, pruned: 0, kept: 0 };
   let entries;
   try {
-    entries = fs52.readdirSync(dir);
+    entries = fs53.readdirSync(dir);
   } catch {
     return result;
   }
@@ -24879,10 +25005,10 @@ function pruneAgedRefusalState(workspaceRoot3, opts = {}) {
   for (const name of entries) {
     if (!name.endsWith(".json")) continue;
     result.scanned += 1;
-    const file = path52.join(dir, name);
+    const file = path53.join(dir, name);
     let rec = null;
     try {
-      rec = parseRecord(fs52.readFileSync(file, "utf-8"));
+      rec = parseRecord(fs53.readFileSync(file, "utf-8"));
     } catch {
       rec = null;
     }
@@ -24896,7 +25022,7 @@ function pruneAgedRefusalState(workspaceRoot3, opts = {}) {
       continue;
     }
     try {
-      fs52.unlinkSync(file);
+      fs53.unlinkSync(file);
       result.pruned += 1;
     } catch {
       result.kept += 1;
@@ -24907,16 +25033,16 @@ function pruneAgedRefusalState(workspaceRoot3, opts = {}) {
 
 // src/scripts/session_register_hook.ts
 var REPLAY_ENV_VAR6 = "AGENT_CONFIG_REPLAY";
-var _STATE_REL = path53.join("agents", "runtime", "state");
-var ROADMAP_CLAIM_REL = path53.join(_STATE_REL, "roadmap-claim.json");
+var _STATE_REL = path54.join("agents", "runtime", "state");
+var ROADMAP_CLAIM_REL = path54.join(_STATE_REL, "roadmap-claim.json");
 function roadmap_claim_rel(session_id) {
   const id = String(session_id ?? "").trim();
   if (id === "") {
     return ROADMAP_CLAIM_REL;
   }
-  const rel = path53.join(_STATE_REL, `roadmap-claim-${safe_stem(id)}.json`);
-  const norm = path53.normalize(rel);
-  if (!norm.startsWith(`${_STATE_REL}${path53.sep}`) || norm.includes("..")) {
+  const rel = path54.join(_STATE_REL, `roadmap-claim-${safe_stem(id)}.json`);
+  const norm = path54.normalize(rel);
+  if (!norm.startsWith(`${_STATE_REL}${path54.sep}`) || norm.includes("..")) {
     return ROADMAP_CLAIM_REL;
   }
   return norm;
@@ -24924,21 +25050,21 @@ function roadmap_claim_rel(session_id) {
 var CLAIM_DIRNAME = "agent-claims";
 function claim_dir(workspace_root) {
   const common = git_common_dir(workspace_root);
-  return common === null ? null : path53.join(common, CLAIM_DIRNAME);
+  return common === null ? null : path54.join(common, CLAIM_DIRNAME);
 }
 function claim_read_paths(workspace_root, session_id) {
   const rel = roadmap_claim_rel(session_id);
   const dir = claim_dir(workspace_root);
   const out = [];
   if (dir !== null) {
-    out.push(path53.join(dir, path53.basename(rel)));
+    out.push(path54.join(dir, path54.basename(rel)));
     if (rel !== ROADMAP_CLAIM_REL) {
-      out.push(path53.join(dir, path53.basename(ROADMAP_CLAIM_REL)));
+      out.push(path54.join(dir, path54.basename(ROADMAP_CLAIM_REL)));
     }
   }
-  out.push(path53.join(workspace_root, rel));
+  out.push(path54.join(workspace_root, rel));
   if (rel !== ROADMAP_CLAIM_REL) {
-    out.push(path53.join(workspace_root, ROADMAP_CLAIM_REL));
+    out.push(path54.join(workspace_root, ROADMAP_CLAIM_REL));
   }
   return out;
 }
@@ -24947,7 +25073,7 @@ function _is_replay_mode4() {
 }
 function _read_claim_file(file) {
   try {
-    const parsed = JSON.parse(fs53.readFileSync(file, "utf-8"));
+    const parsed = JSON.parse(fs54.readFileSync(file, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       return null;
     }
@@ -24972,7 +25098,7 @@ function resolve_claim(workspace_root, session_id) {
   const own = roadmap_claim_rel(session_id);
   if (own !== ROADMAP_CLAIM_REL) {
     for (const p of claim_read_paths(workspace_root, session_id)) {
-      if (path53.basename(p) === path53.basename(ROADMAP_CLAIM_REL)) continue;
+      if (path54.basename(p) === path54.basename(ROADMAP_CLAIM_REL)) continue;
       const mine = _read_claim_file(p);
       if (mine !== null) {
         return {
@@ -24986,7 +25112,7 @@ function resolve_claim(workspace_root, session_id) {
   let legacy = null;
   let legacy_path = "";
   for (const p of claim_read_paths(workspace_root, session_id)) {
-    if (path53.basename(p) !== path53.basename(ROADMAP_CLAIM_REL)) continue;
+    if (path54.basename(p) !== path54.basename(ROADMAP_CLAIM_REL)) continue;
     legacy = _read_claim_file(p);
     if (legacy !== null) {
       legacy_path = p;
@@ -25014,9 +25140,9 @@ function claim_is_stale(workspace_root, slug, peer_worktree) {
     return false;
   }
   const base = slug.trim().replace(/\.md$/, "");
-  const rel = path53.normalize(path53.join("agents", "roadmaps", `${base}.md`));
-  const inside = path53.dirname(rel) === path53.join("agents", "roadmaps");
-  if (!inside || path53.isAbsolute(base)) {
+  const rel = path54.normalize(path54.join("agents", "roadmaps", `${base}.md`));
+  const inside = path54.dirname(rel) === path54.join("agents", "roadmaps");
+  if (!inside || path54.isAbsolute(base)) {
     return true;
   }
   const roots = [peer_worktree, workspace_root].filter(
@@ -25024,7 +25150,7 @@ function claim_is_stale(workspace_root, slug, peer_worktree) {
   );
   for (const root of roots) {
     try {
-      if (fs53.existsSync(path53.join(root, rel))) {
+      if (fs54.existsSync(path54.join(root, rel))) {
         return false;
       }
     } catch {
@@ -25039,8 +25165,8 @@ function session_checkout(workspace_root, payload_cwd) {
   if (cwd === "") return fallback;
   let start;
   try {
-    if (!fs53.statSync(cwd).isDirectory()) return fallback;
-    start = fs53.realpathSync(cwd);
+    if (!fs54.statSync(cwd).isDirectory()) return fallback;
+    start = fs54.realpathSync(cwd);
   } catch {
     return fallback;
   }
@@ -25052,9 +25178,9 @@ function session_checkout(workspace_root, payload_cwd) {
   return root;
 }
 function canonical(p) {
-  const abs = path53.resolve(p);
+  const abs = path54.resolve(p);
   try {
-    return fs53.realpathSync(abs);
+    return fs54.realpathSync(abs);
   } catch {
     return abs;
   }
@@ -25063,7 +25189,7 @@ function nearest_checkout_root(start) {
   let dir = start;
   for (let i = 0; i < 64; i++) {
     if (git_dir(dir) !== null) return dir;
-    const up = path53.dirname(dir);
+    const up = path54.dirname(dir);
     if (up === dir) return null;
     dir = up;
   }
@@ -25200,7 +25326,7 @@ function foreign_sessions_block(workspace_root, session_id, now = /* @__PURE__ *
   );
   return parts.join("\n");
 }
-function main28() {
+function main29() {
   let envelope = {};
   try {
     const raw = readHookStdin().trim();
@@ -25229,9 +25355,9 @@ function main28() {
       const dir = register_dir(root);
       if (dir !== null) delete_record(dir, session_id);
       for (const p of claim_read_paths(root, session_id)) {
-        if (path53.basename(p) !== path53.basename(roadmap_claim_rel(session_id))) continue;
+        if (path54.basename(p) !== path54.basename(roadmap_claim_rel(session_id))) continue;
         try {
-          fs53.unlinkSync(p);
+          fs54.unlinkSync(p);
         } catch {
         }
       }
@@ -25279,14 +25405,14 @@ function main28() {
   return 0;
 }
 var _bundled4 = true;
-if (!_bundled4 && fileURLToPath31(import.meta.url) === path53.resolve(process10.argv[1] ?? "")) {
-  process10.exit(main28());
+if (!_bundled4 && fileURLToPath32(import.meta.url) === path54.resolve(process10.argv[1] ?? "")) {
+  process10.exit(main29());
 }
 
 // src/scripts/language_mirror_hook.ts
-import fs54 from "node:fs";
-import path54 from "node:path";
-import { fileURLToPath as fileURLToPath32, pathToFileURL as pathToFileURL25 } from "node:url";
+import fs55 from "node:fs";
+import path55 from "node:path";
+import { fileURLToPath as fileURLToPath33, pathToFileURL as pathToFileURL26 } from "node:url";
 
 // src/scripts/_lib/prompt_shape.ts
 function isSyntheticPrompt(prompt) {
@@ -25343,10 +25469,10 @@ function stripInjectedRegions(text) {
 }
 
 // src/scripts/language_mirror_hook.ts
-var EXIT_ALLOW9 = 0;
-var EXIT_WARN3 = 2;
-var STATE_FILE6 = path54.join("agents", "state", "language-mirror.json");
-var STATE_DIR4 = path54.join("agents", "state", "language-mirror");
+var EXIT_ALLOW10 = 0;
+var EXIT_WARN4 = 2;
+var STATE_FILE6 = path55.join("agents", "state", "language-mirror.json");
+var STATE_DIR4 = path55.join("agents", "state", "language-mirror");
 var STATE_RETENTION_DAYS2 = 7;
 function hasStableSessionId(session_id) {
   return has_stable_session_id(session_id);
@@ -25354,10 +25480,10 @@ function hasStableSessionId(session_id) {
 function statePathFor2(session_id) {
   return session_state_file(STATE_DIR4, session_id);
 }
-var PIN_LOST_DIR = path54.join("agents", "state", "language-mirror.pin-lost");
+var PIN_LOST_DIR = path55.join("agents", "state", "language-mirror.pin-lost");
 function pinLostMarker(session_id) {
   const safe = (session_id || "unknown-session").replace(/[^A-Za-z0-9._-]/g, "_");
-  return path54.join(PIN_LOST_DIR, `${safe}.marker`);
+  return path55.join(PIN_LOST_DIR, `${safe}.marker`);
 }
 function _isObject7(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -25453,7 +25579,7 @@ This pin exists because the trigger is not observable from the transcript alone:
 }
 function _loadState(target) {
   try {
-    const raw = fs54.readFileSync(target, "utf8");
+    const raw = fs55.readFileSync(target, "utf8");
     const decoded = JSON.parse(raw);
     return _isObject7(decoded) ? decoded : {};
   } catch {
@@ -25508,10 +25634,10 @@ function _sessionId(envelope) {
   return typeof v === "string" && v.trim() !== "" ? v : "unknown-session";
 }
 function _migrateLegacyMarker(consumer_root) {
-  const legacy = path54.join(consumer_root, PIN_LOST_DIR);
+  const legacy = path55.join(consumer_root, PIN_LOST_DIR);
   try {
-    if (fs54.statSync(legacy).isFile()) {
-      fs54.rmSync(legacy, { force: true });
+    if (fs55.statSync(legacy).isFile()) {
+      fs55.rmSync(legacy, { force: true });
     }
   } catch {
   }
@@ -25520,13 +25646,17 @@ function _setPinLost(consumer_root, session_id) {
   if (is_replay_mode()) return;
   _migrateLegacyMarker(consumer_root);
   try {
-    atomic_write_text(path54.join(consumer_root, pinLostMarker(session_id)), (/* @__PURE__ */ new Date()).toISOString());
-  } catch {
+    atomic_write_text(path55.join(consumer_root, pinLostMarker(session_id)), (/* @__PURE__ */ new Date()).toISOString());
+  } catch (err) {
+    process.stderr.write(
+      `language-mirror: pin-lost marker write failed (${_errText(err)}) \u2014 the pin will NOT be re-emitted after this compaction. Turn outcome unchanged.
+`
+    );
   }
 }
 function _pinLost(consumer_root, session_id) {
   try {
-    return fs54.existsSync(path54.join(consumer_root, pinLostMarker(session_id)));
+    return fs55.existsSync(path55.join(consumer_root, pinLostMarker(session_id)));
   } catch {
     return false;
   }
@@ -25534,30 +25664,30 @@ function _pinLost(consumer_root, session_id) {
 function _clearPinLost(consumer_root, session_id) {
   if (is_replay_mode()) return;
   try {
-    fs54.rmSync(path54.join(consumer_root, pinLostMarker(session_id)), { force: true });
+    fs55.rmSync(path55.join(consumer_root, pinLostMarker(session_id)), { force: true });
   } catch {
   }
 }
 function _reEmitAfterCompaction(consumer_root, session_id, write_json = atomic_write_json) {
   if (!hasStableSessionId(session_id)) {
-    return EXIT_ALLOW9;
+    return EXIT_ALLOW10;
   }
   if (!_pinLost(consumer_root, session_id)) {
-    return EXIT_ALLOW9;
+    return EXIT_ALLOW10;
   }
-  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW9, () => {
-    const previous = _loadState(path54.join(consumer_root, statePathFor2(session_id)));
+  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW10, () => {
+    const previous = _loadState(path55.join(consumer_root, statePathFor2(session_id)));
     const language = previous.language;
     const source = previous.source === "system-locale" ? "system-locale" : "prompt";
     _clearPinLost(consumer_root, session_id);
     if (language !== "de" && language !== "en") {
-      return EXIT_ALLOW9;
+      return EXIT_ALLOW10;
     }
     if (!_ownsPin(previous, session_id)) {
-      return EXIT_ALLOW9;
+      return EXIT_ALLOW10;
     }
     if (!_resetDistance(consumer_root, previous, session_id, write_json)) {
-      return EXIT_ALLOW9;
+      return EXIT_ALLOW10;
     }
     process.stdout.write(
       `${JSON.stringify({
@@ -25567,15 +25697,15 @@ function _reEmitAfterCompaction(consumer_root, session_id, write_json = atomic_w
       })}
 `
     );
-    return EXIT_WARN3;
+    return EXIT_WARN4;
   });
 }
 function _pruneLegacyState(consumer_root) {
-  prune_legacy_state_file(path54.join(consumer_root, STATE_FILE6));
+  prune_legacy_state_file(path55.join(consumer_root, STATE_FILE6));
 }
-function _pruneStaleSessions(consumer_root, now_ms, mtimeOf = (target) => fs54.statSync(target).mtimeMs) {
+function _pruneStaleSessions(consumer_root, now_ms, mtimeOf = (target) => fs55.statSync(target).mtimeMs) {
   return prune_stale_session_states(
-    path54.join(consumer_root, STATE_DIR4),
+    path55.join(consumer_root, STATE_DIR4),
     now_ms,
     STATE_RETENTION_DAYS2,
     mtimeOf
@@ -25583,24 +25713,24 @@ function _pruneStaleSessions(consumer_root, now_ms, mtimeOf = (target) => fs54.s
 }
 var LOCK_STALE_MS2 = 3e4;
 function _withToolWriteLock(consumer_root, session_id, when_busy, body, now_ms = Date.now()) {
-  const lock = `${path54.join(consumer_root, statePathFor2(session_id))}.lock`;
+  const lock = `${path55.join(consumer_root, statePathFor2(session_id))}.lock`;
   let fd;
   const acquire = () => {
     try {
-      fs54.mkdirSync(path54.dirname(lock), { recursive: true });
-      return fs54.openSync(lock, "wx");
+      fs55.mkdirSync(path55.dirname(lock), { recursive: true });
+      return fs55.openSync(lock, "wx");
     } catch (err) {
       if (err.code !== "EEXIST") return null;
       let age;
       try {
-        age = now_ms - fs54.statSync(lock).mtimeMs;
+        age = now_ms - fs55.statSync(lock).mtimeMs;
       } catch {
         return null;
       }
       if (age < LOCK_STALE_MS2) return null;
       try {
-        fs54.rmSync(lock, { force: true });
-        return fs54.openSync(lock, "wx");
+        fs55.rmSync(lock, { force: true });
+        return fs55.openSync(lock, "wx");
       } catch {
         return null;
       }
@@ -25613,11 +25743,11 @@ function _withToolWriteLock(consumer_root, session_id, when_busy, body, now_ms =
     return body();
   } finally {
     try {
-      fs54.closeSync(fd);
+      fs55.closeSync(fd);
     } catch {
     }
     try {
-      fs54.rmSync(lock, { force: true });
+      fs55.rmSync(lock, { force: true });
     } catch {
     }
   }
@@ -25625,7 +25755,7 @@ function _withToolWriteLock(consumer_root, session_id, when_busy, body, now_ms =
 function _writeDistance(consumer_root, expected, session_id, value, write_json = atomic_write_json) {
   if (is_replay_mode()) return false;
   if (!hasStableSessionId(session_id)) return false;
-  const target = path54.join(consumer_root, statePathFor2(session_id));
+  const target = path55.join(consumer_root, statePathFor2(session_id));
   const current = _loadState(target);
   if (!_ownsPin(current, session_id)) return false;
   if (current.detected_at !== expected.detected_at || current.language !== expected.language || current.source !== expected.source) {
@@ -25647,19 +25777,19 @@ function _resetDistance(consumer_root, expected, session_id, write_json = atomic
 }
 function _reEmitAfterDistance(consumer_root, session_id, write_json = atomic_write_json) {
   if (is_replay_mode()) {
-    return EXIT_ALLOW9;
+    return EXIT_ALLOW10;
   }
   if (!hasStableSessionId(session_id)) {
-    return EXIT_ALLOW9;
+    return EXIT_ALLOW10;
   }
-  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW9, () => {
-    const previous = _loadState(path54.join(consumer_root, statePathFor2(session_id)));
+  return _withToolWriteLock(consumer_root, session_id, EXIT_ALLOW10, () => {
+    const previous = _loadState(path55.join(consumer_root, statePathFor2(session_id)));
     const language = previous.language;
     if (language !== "de" && language !== "en") {
-      return EXIT_ALLOW9;
+      return EXIT_ALLOW10;
     }
     if (!_ownsPin(previous, session_id)) {
-      return EXIT_ALLOW9;
+      return EXIT_ALLOW10;
     }
     const seen = typeof previous.tool_calls_since_pin === "number" && previous.tool_calls_since_pin >= 0 ? previous.tool_calls_since_pin : 0;
     const advanced = seen + 1;
@@ -25672,10 +25802,10 @@ function _reEmitAfterDistance(consumer_root, session_id, write_json = atomic_wri
       write_json
     );
     if (!due) {
-      return EXIT_ALLOW9;
+      return EXIT_ALLOW10;
     }
     if (!written) {
-      return EXIT_ALLOW9;
+      return EXIT_ALLOW10;
     }
     const source = previous.source === "system-locale" ? "system-locale" : "prompt";
     process.stdout.write(
@@ -25686,7 +25816,7 @@ function _reEmitAfterDistance(consumer_root, session_id, write_json = atomic_wri
       })}
 `
     );
-    return EXIT_WARN3;
+    return EXIT_WARN4;
   });
 }
 function _onToolUse(consumer_root, session_id, write_json = atomic_write_json) {
@@ -25704,28 +25834,28 @@ function run9(stdin_text, options) {
         envelope = decoded;
       }
     } catch {
-      return EXIT_ALLOW9;
+      return EXIT_ALLOW10;
     }
   }
   const payload = _isObject7(envelope["payload"]) ? envelope["payload"] : envelope;
   const event = typeof envelope["event"] === "string" ? envelope["event"] : "";
   if (event === "pre_compact") {
     _setPinLost(options.consumer_root, _sessionId(envelope));
-    return EXIT_ALLOW9;
+    return EXIT_ALLOW10;
   }
   if (event === "post_tool_use") {
     return _onToolUse(options.consumer_root, _sessionId(envelope), options.write_json);
   }
   const prompt = _extractPrompt(payload);
   if (!prompt) {
-    return EXIT_ALLOW9;
+    return EXIT_ALLOW10;
   }
   if (isSyntheticPrompt(prompt)) {
-    return EXIT_ALLOW9;
+    return EXIT_ALLOW10;
   }
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
   const stateful = hasStableSessionId(session_id);
-  const target = stateful ? path54.join(options.consumer_root, statePathFor2(session_id)) : "";
+  const target = stateful ? path55.join(options.consumer_root, statePathFor2(session_id)) : "";
   const previous = stateful ? _loadState(target) : {};
   const classification = classify(prompt);
   const next = nextState(
@@ -25747,7 +25877,11 @@ function run9(stdin_text, options) {
       atomic_write_json(target, next);
       _pruneLegacyState(options.consumer_root);
       _pruneStaleSessions(options.consumer_root, Date.now());
-    } catch {
+    } catch (err) {
+      process.stderr.write(
+        `language-mirror: pin-state write failed (${_errText(err)}) \u2014 the language pin did NOT persist and the next turn re-derives it. This turn's notice is unchanged.
+`
+      );
     }
   }
   if (effective === "de" || effective === "en") {
@@ -25755,11 +25889,15 @@ function run9(stdin_text, options) {
       `${JSON.stringify({ decision: "warn", reason: noticeText(effective, effectiveSource), additional_context: pinText(effective, effectiveSource) })}
 `
     );
-    return EXIT_WARN3;
+    return EXIT_WARN4;
   }
-  return EXIT_ALLOW9;
+  return EXIT_ALLOW10;
 }
-function main29(argv) {
+function _errText(err) {
+  const t = err instanceof Error ? err.message : String(err);
+  return t.replace(/\s+/g, " ").trim().slice(0, 200);
+}
+function main30(argv) {
   const args = argv ?? process.argv.slice(2);
   let consumer_root = process.cwd();
   for (let i = 0; i < args.length; i += 1) {
@@ -25780,26 +25918,26 @@ function _isCliEntry23() {
   if (process.argv[1] === void 0) {
     return false;
   }
-  const argvUrl = pathToFileURL25(path54.resolve(process.argv[1])).href;
+  const argvUrl = pathToFileURL26(path55.resolve(process.argv[1])).href;
   if (import.meta.url === argvUrl) {
     return true;
   }
   try {
-    const here = fs54.realpathSync(fileURLToPath32(import.meta.url));
-    const argv = fs54.realpathSync(path54.resolve(process.argv[1]));
+    const here = fs55.realpathSync(fileURLToPath33(import.meta.url));
+    const argv = fs55.realpathSync(path55.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
   }
 }
 if (_isCliEntry23()) {
-  process.exit(main29());
+  process.exit(main30());
 }
 
 // src/scripts/git_authorization_hook.ts
-import fs55 from "node:fs";
-import path55 from "node:path";
-import { fileURLToPath as fileURLToPath33, pathToFileURL as pathToFileURL26 } from "node:url";
+import fs56 from "node:fs";
+import path56 from "node:path";
+import { fileURLToPath as fileURLToPath34, pathToFileURL as pathToFileURL27 } from "node:url";
 
 // src/scripts/_lib/machine_wake.ts
 var MACHINE_WAKE_PREFIXES = [
@@ -25817,10 +25955,10 @@ function humanTypedThisTurn(prompt) {
 }
 
 // src/scripts/git_authorization_hook.ts
-var EXIT_ALLOW10 = 0;
-var STATE_FILE7 = path55.join("agents", "state", "git-authorization.json");
-var STATE_DIR5 = path55.join("agents", "state", "git-authorization");
-var PENDING_DIR = path55.join("agents", "state", "git-authorization-pending");
+var EXIT_ALLOW11 = 0;
+var STATE_FILE7 = path56.join("agents", "state", "git-authorization.json");
+var STATE_DIR5 = path56.join("agents", "state", "git-authorization");
+var PENDING_DIR = path56.join("agents", "state", "git-authorization-pending");
 function sessionSlug(session_id) {
   return session_id.replace(/[^A-Za-z0-9._-]/gu, "_").slice(0, 80);
 }
@@ -25828,15 +25966,15 @@ function ledgerFileFor(session_id) {
   if (!session_id) {
     return STATE_FILE7;
   }
-  return path55.join(STATE_DIR5, `${sessionSlug(session_id)}.json`);
+  return path56.join(STATE_DIR5, `${sessionSlug(session_id)}.json`);
 }
 function pendingFileFor(session_id) {
   if (!session_id) {
     return PENDING_FILE;
   }
-  return path55.join(PENDING_DIR, `${sessionSlug(session_id)}.json`);
+  return path56.join(PENDING_DIR, `${sessionSlug(session_id)}.json`);
 }
-var PENDING_FILE = path55.join("agents", "state", "git-authorization-pending.json");
+var PENDING_FILE = path56.join("agents", "state", "git-authorization-pending.json");
 var PENDING_MAX_AGE_MS = 10 * 60 * 1e3;
 function _isObject8(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -26089,7 +26227,7 @@ function splitFences(prompt) {
 function _commandLines(fence) {
   return fence.split("\n").map((l) => l.trim()).filter((l) => l.length > 0).filter((l) => !/^(remote:|error:|hint:|fatal:|warning:|To |!\s|\s*\^)/i.test(l)).map((l) => l.replace(/^[$>#]\s*/, "")).filter((l) => /^(git|gh|npm|pnpm|yarn|task)\b/.test(l));
 }
-function _errText(err) {
+function _errText2(err) {
   const t = err instanceof Error ? err.message : String(err);
   return t.replace(/\s+/g, " ").trim().slice(0, 200);
 }
@@ -26106,9 +26244,20 @@ function extractMergeTargets(prompt) {
   }
   return [...out].sort((a, b) => a - b);
 }
-var REVOKE_RE = /\b(stop|stopp|halt|abbrechen|abbruch|cancel|revoke|widerruf(en)?|zur(ü|ue)ck(nehmen|ziehen)|hold\s+(everything|on|the\s+merge)|warte|wait)\b|(?:\b(nicht|kein(e|en)?|no|not|dont|don't|never|niemals|nie)\b[^.!?\n]{0,30}\b(merg(e|en|ing)|zusammenf(ü|ue)hren)\b)/iu;
+var REVOKE_STOP_WORD = /\b(stop|stopp|halt|abbrechen|abbruch|cancel|revoke|widerruf(en)?|zur(ü|ue)ck(nehmen|ziehen)|hold\s+(everything|on|the\s+merge)|warte|wait)\b/iu;
+var MERGE_VERB = /\b(merg(e|en|ing)|zusammenf(ü|ue)hren)\b/giu;
 function isRevocation(prompt) {
-  return REVOKE_RE.test(prompt);
+  if (REVOKE_STOP_WORD.test(prompt) || isBareRefusal(prompt)) {
+    return true;
+  }
+  MERGE_VERB.lastIndex = 0;
+  let m;
+  while ((m = MERGE_VERB.exec(prompt)) !== null) {
+    if (negatedBefore(prompt, m.index, m[0])) {
+      return true;
+    }
+  }
+  return false;
 }
 function _grantId(session_id, at, targets) {
   return `${sessionSlug(session_id) || "nosession"}:${at}:${targets.join(",")}`;
@@ -26143,8 +26292,12 @@ function foldGrants(prior, prompt, authorized, session_id, now) {
     }
   ];
 }
-var NEGATION_WORD = /\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b/i;
-var CONTRAST_CUE = /\b(aber|sondern|jedoch|but|however|instead)\b/gi;
+var APOSTROPHE = "'\u2019\u2018\u02BC";
+var NEGATION_ALTERNATION = `nicht|nichts|kein(?:e|en|em|er|es)?|niemals|nie|no|not|don[${APOSTROPHE}]?t|never|without|ohne`;
+var NEGATION_WORD = new RegExp(`\\b(${NEGATION_ALTERNATION})\\b`, "i");
+var NEGATION_TOKEN = new RegExp(`^(?:${NEGATION_ALTERNATION})$`, "i");
+var CONTRAST_ALTERNATION = "aber|sondern|jedoch|but|however|instead";
+var CONTRAST_CUE = new RegExp(`\\b(${CONTRAST_ALTERNATION})\\b`, "gi");
 var ABBREVIATION_BEFORE_DOT = /(?:^|[\s("'\u2018\u201c])(?:[a-z]|z\.b|bzw|ca|usw|d\.h|u\.a|evtl|ggf|inkl|max|min|nr|abb|e\.g|i\.e|etc|vs|approx|fig|no|st|dr|prof)\.$/i;
 function isSentenceBoundary(text, at) {
   const mark = text[at];
@@ -26231,6 +26384,19 @@ function negatedBefore(text, index, matched = "") {
   const after = afterFrom < end ? text.slice(afterFrom, clauseEnd(text, afterFrom, end)) : "";
   return NEGATION_WORD.test(before) || NEGATION_WORD.test(matched) || NEGATION_WORD.test(after);
 }
+var WORD_TOKEN = new RegExp(`[\\p{L}\\p{N}${APOSTROPHE}]+`, "gu");
+var CLAUSE_SPLIT = new RegExp(`[,;:]|\\b(?:${CONTRAST_ALTERNATION})\\b`, "iu");
+function isBareRefusal(text) {
+  for (const sentence of _sentences(text)) {
+    for (const clause of sentence.split(CLAUSE_SPLIT)) {
+      const tokens = (clause ?? "").match(WORD_TOKEN) ?? [];
+      if (tokens.length > 0 && tokens.every((t) => NEGATION_TOKEN.test(t))) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 function classifyAuthorization(prompt) {
   const { prose, fences } = splitFences(prompt);
   const authorized = /* @__PURE__ */ new Set();
@@ -26268,7 +26434,7 @@ function classifyAuthorization(prompt) {
 }
 function readGrants(consumer_root, session_id) {
   try {
-    const raw = fs55.readFileSync(path55.join(consumer_root, ledgerFileFor(session_id)), "utf8");
+    const raw = fs56.readFileSync(path56.join(consumer_root, ledgerFileFor(session_id)), "utf8");
     const decoded = JSON.parse(raw);
     if (!_isObject8(decoded) || !Array.isArray(decoded["grants"])) {
       return [];
@@ -26298,50 +26464,16 @@ function readGrants(consumer_root, session_id) {
     return [];
   }
 }
-function consumeGrantTarget(consumer_root, session_id, target) {
-  const file = path55.join(consumer_root, ledgerFileFor(session_id));
-  let decoded;
-  try {
-    decoded = JSON.parse(fs55.readFileSync(file, "utf8"));
-  } catch {
-    return;
-  }
-  if (!_isObject8(decoded) || !Array.isArray(decoded["grants"])) {
-    return;
-  }
-  let touched = false;
-  for (const g of decoded["grants"]) {
-    if (!_isObject8(g) || !Array.isArray(g["targets"]) || !Array.isArray(g["consumed"])) {
-      continue;
-    }
-    const targets = g["targets"];
-    const consumed = g["consumed"];
-    if (targets.includes(target) && !consumed.includes(target)) {
-      consumed.push(target);
-      touched = true;
-    }
-  }
-  if (touched) {
-    try {
-      atomic_write_json(file, decoded);
-    } catch (err) {
-      process.stderr.write(
-        `git-authorization: grant-consumption write failed (${_errText(err)}) \u2014 the target stays UNSPENT, so one further merge of a PR the user named will still be authorized. Authorization outcome unchanged.
-`
-      );
-    }
-  }
-}
 function takePending(consumer_root, session_id, now) {
-  const file = path55.join(consumer_root, pendingFileFor(session_id));
+  const file = path56.join(consumer_root, pendingFileFor(session_id));
   let raw;
   try {
-    raw = fs55.readFileSync(file, "utf8");
+    raw = fs56.readFileSync(file, "utf8");
   } catch {
     return null;
   }
   try {
-    fs55.rmSync(file, { force: true });
+    fs56.rmSync(file, { force: true });
   } catch {
   }
   try {
@@ -26351,731 +26483,83 @@ function takePending(consumer_root, session_id, now) {
     }
     const op = decoded["op"];
     if (typeof op !== "string" || !ALL_OPS.includes(op)) {
-      return null;
-    }
-    const recorded = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
-    if (session_id && recorded && recorded !== session_id) {
-      return null;
-    }
-    const at = Date.parse(String(decoded["refused_at"] ?? ""));
-    if (!Number.isFinite(at) || now - at > PENDING_MAX_AGE_MS) {
-      return null;
-    }
-    return { op, session_id: recorded, refused_at: String(decoded["refused_at"]) };
-  } catch {
-    return null;
-  }
-}
-function run10(stdin_text, options) {
-  let envelope = {};
-  if (stdin_text.trim()) {
-    try {
-      const decoded = JSON.parse(stdin_text);
-      if (_isObject8(decoded)) {
-        envelope = decoded;
-      }
-    } catch {
-      return EXIT_ALLOW10;
-    }
-  }
-  const payload = _isObject8(envelope["payload"]) ? envelope["payload"] : envelope;
-  let prompt = "";
-  for (const key of ["prompt", "userPrompt", "user_prompt", "message", "text"]) {
-    const v = payload[key];
-    if (typeof v === "string" && v.trim()) {
-      prompt = v;
-      break;
-    }
-  }
-  if (!prompt) {
-    return EXIT_ALLOW10;
-  }
-  const session = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
-  if (!humanTypedThisTurn(prompt)) {
-    return EXIT_ALLOW10;
-  }
-  const { authorized, evidence } = classifyAuthorization(prompt);
-  const pending = takePending(options.consumer_root, session, Date.now());
-  if (pending && !authorized.includes(pending.op) && isAffirmative(prompt)) {
-    authorized.push(pending.op);
-    evidence[pending.op] = `confirmation of the refused \`${pending.op}\` (refused ${pending.refused_at}): "${prompt.trim().slice(0, 40)}"`;
-  }
-  const now = /* @__PURE__ */ new Date();
-  const ledger = {
-    session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
-    detected_at: now.toISOString(),
-    authorized,
-    evidence,
-    prompt_chars: prompt.length,
-    // Grants survive this write; `authorized` does not. That asymmetry IS the
-    // decision. A bare operation name stays one-shot exactly as `commit-policy`
-    // requires, and only an authorization that also froze its objects earns a
-    // life longer than the turn. See ADR-252.
-    grants: foldGrants(
-      readGrants(options.consumer_root, session),
-      prompt,
-      authorized,
-      session,
-      now
-    )
-  };
-  try {
-    atomic_write_json(path55.join(options.consumer_root, ledgerFileFor(session)), ledger);
-  } catch (err) {
-    process.stderr.write(
-      `git-authorization: session-ledger write failed (${_errText(err)}) \u2014 the gate degrades to "no ledger" for this session, which denies the irreversible subset and warns on the rest. Authorization outcome unchanged.
-`
-    );
-  }
-  return EXIT_ALLOW10;
-}
-function main30(argv) {
-  const args = argv ?? process.argv.slice(2);
-  let consumer_root = process.cwd();
-  for (let i = 0; i < args.length; i += 1) {
-    const a = args[i];
-    if (a === "--project-dir" && args[i + 1] !== void 0) {
-      consumer_root = args[i + 1];
-      i += 1;
-    } else if (a !== void 0 && a.startsWith("--project-dir=")) {
-      consumer_root = a.slice("--project-dir=".length);
-    }
-  }
-  return run10(readHookStdin(), { consumer_root });
-}
-function _isCliEntry24() {
-  if (true) {
-    return false;
-  }
-  if (process.argv[1] === void 0) {
-    return false;
-  }
-  const argvUrl = pathToFileURL26(path55.resolve(process.argv[1])).href;
-  if (import.meta.url === argvUrl) {
-    return true;
-  }
-  try {
-    const here = fs55.realpathSync(fileURLToPath33(import.meta.url));
-    const argv = fs55.realpathSync(path55.resolve(process.argv[1]));
-    return here === argv;
-  } catch {
-    return false;
-  }
-}
-if (_isCliEntry24()) {
-  process.exit(main30());
-}
-
-// src/scripts/hooks/block_unauthorized_git.ts
-import fs56 from "node:fs";
-import path56 from "node:path";
-import { fileURLToPath as fileURLToPath34, pathToFileURL as pathToFileURL27 } from "node:url";
-
-// src/scripts/hooks/merge_impact.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-var DESTRUCTIVE_MARKERS = [
-  // Schema removal. Matched on ADDED lines only — a migration that *removes* a
-  // dropColumn call is the opposite of destructive, and matching the raw patch
-  // would score it the same way.
-  { label: "migration drops a column or table", re: /^\+.*\b(dropColumn|dropTable|dropIfExists|removeColumn|drop_column|drop_table)\b/im },
-  { label: "raw DROP or TRUNCATE in a migration", re: /^\+.*\b(DROP\s+(TABLE|COLUMN|INDEX|CONSTRAINT)|TRUNCATE\s+TABLE)\b/im },
-  // The author said so themselves. Conventional Commits marks a breaking change
-  // with a `!` before the colon or a body trailer.
-  { label: "author marked a BREAKING CHANGE", re: /^\+.*BREAKING[ -]CHANGE/m },
-  // A removed export is the shape most likely to break an importer.
-  { label: "an exported symbol was removed", re: /^-\s*export\s+(default\s+|const\s+|function\s+|class\s+|interface\s+|type\s+|async\s+)/m },
-  { label: "a public PHP or Python symbol was removed", re: /^-\s*(public\s+function|def\s+[a-z_]+\s*\()/m },
-  // Route removal breaks callers that never imported anything.
-  { label: "a route or endpoint was removed", re: /^-.*\b(Route::(get|post|put|patch|delete)|@(Get|Post|Put|Patch|Delete)Mapping|app\.(get|post|put|patch|delete)\s*\()/m },
-  { label: "a whole file was deleted", re: /^deleted file mode /m }
-];
-var SCHEMA_REMOVAL_BODY = /\b(dropColumn|dropTable|dropIfExists|removeColumn|drop_column|drop_table|DROP\s+(TABLE|COLUMN|INDEX|CONSTRAINT)|TRUNCATE\s+TABLE)\b/i;
-var RENAME_METADATA = /^rename (?:from|to) /m;
-function fileBlocks(patch) {
-  return patch.split(/^(?=diff --git )/m).filter((b) => b.startsWith("diff --git "));
-}
-function renamedSchemaRemoval(patch) {
-  for (const block of fileBlocks(patch)) {
-    if (!RENAME_METADATA.test(block)) {
-      continue;
-    }
-    for (const line of block.split("\n")) {
-      if (line.startsWith("-") && !line.startsWith("---") && SCHEMA_REMOVAL_BODY.test(line)) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-var MAJOR_BUMP = /^-\s*"version"\s*:\s*"(\d+)\.[^"]*"[\s\S]{0,200}?^\+\s*"version"\s*:\s*"(\d+)\./m;
-function classifyDiff(patch) {
-  if (patch.trim() === "") {
-    return { verdict: "undecidable", markers: [], reason: "empty diff" };
-  }
-  const markers = [];
-  for (const { label, re } of DESTRUCTIVE_MARKERS) {
-    if (re.test(patch)) {
-      markers.push(label);
-    }
-  }
-  if (renamedSchemaRemoval(patch)) {
-    markers.push("a renamed file drops a column or table");
-  }
-  const bump = MAJOR_BUMP.exec(patch);
-  if (bump && bump[1] !== bump[2]) {
-    markers.push(`major version bump ${bump[1]}.x to ${bump[2]}.x`);
-  }
-  const filesChanged = (patch.match(/^diff --git /gm) ?? []).length;
-  if (markers.length > 0) {
-    return { verdict: "destructive", markers, filesChanged };
-  }
-  return { verdict: "additive", markers: [], filesChanged };
-}
-function fetchPatch(pr, opts = {}) {
-  const run13 = opts.exec ?? execFileSync3;
-  const cwd = opts.cwd ?? process.cwd();
-  const capture = (file, args) => run13(file, args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 15e3 });
-  for (const ref of [`refs/pull/${pr}/head`, `pull/${pr}/head`]) {
-    try {
-      const base = capture("git", ["merge-base", "HEAD", ref]).trim();
-      if (base) {
-        const patch = capture("git", ["diff", `${base}...${ref}`]);
-        if (patch.trim() !== "") {
-          return { patch, source: "local" };
-        }
-      }
-    } catch {
-    }
-  }
-  if (opts.allowNetwork === false) {
-    return { patch: "", source: "none", reason: "no local ref and network reads disabled" };
-  }
-  try {
-    const patch = capture("gh", ["pr", "diff", String(pr), "--patch"]);
-    if (patch.trim() !== "") {
-      return { patch, source: "gh" };
-    }
-    return { patch: "", source: "none", reason: "gh returned an empty diff" };
-  } catch {
-    return { patch: "", source: "none", reason: "no local ref, and gh pr diff failed" };
-  }
-}
-function analyseMergeImpact(pr, opts = {}) {
-  const got = fetchPatch(pr, opts);
-  if (got.source === "none") {
-    return { verdict: "undecidable", markers: [], ...got.reason ? { reason: got.reason } : {} };
-  }
-  return classifyDiff(got.patch);
-}
-function describeImpact(pr, impact) {
-  const say = `Say "merge #${pr}" to authorize it.`;
-  switch (impact.verdict) {
-    case "additive":
-      return `Impact scan: PR #${pr} touches ${impact.filesChanged ?? 0} file(s) and trips no destructive marker \u2014 no schema drop, no removed export or route, no major bump, no BREAKING CHANGE. Additive as far as the diff can show, which is not the same as safe to merge: the base has moved since review and merging may trigger a deploy. ${say}`;
-    case "destructive":
-      return `Impact scan: PR #${pr} is NOT additive \u2014 ${impact.markers.join("; ")}. Read the diff before authorizing. ${say}`;
-    default:
-      return `Impact scan: could not read the diff for PR #${pr} (${impact.reason ?? "unknown"}), so nothing is known about what it changes. ${say}`;
-  }
-}
-
-// src/scripts/hooks/block_unauthorized_git.ts
-var EXIT_ALLOW11 = 0;
-var EXIT_BLOCK = 1;
-function _isObject9(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-var BLOCK_OPS = /* @__PURE__ */ new Set([
-  "publish",
-  "tag",
-  "release",
-  "pr-merge",
-  // Enabling auto-merge commits the outcome to a condition the agent does not
-  // control, so it is blocked on the same terms as the merge it schedules.
-  "pr-merge-auto",
-  // ── Added 2026-09-03. Every one is already never-autonomous in the
-  // `non-destructive-by-default` prose; the measurement that drove it is in the
-  // `GitOp` union's own note — 17 of 25 borderline operations classified as
-  // NOTHING, including three worse than anything the guard already caught.
-  /** The undo that is more destructive than the act: lockfiles break. */
-  "unpublish",
-  /** Metadata only, and every install on earth starts warning. */
-  "deprecate",
-  /** Replaces bytes consumers already hold a checksum for. */
-  "release-asset",
-  /** Deletes the guard rather than the data — everything after is unguarded. */
-  "protection",
-  /** No data lost; the gate that protects everything downstream is off. */
-  "workflow-toggle",
-  /** Reach outside the repository, and mostly one-way. */
-  "repo-lifecycle",
-  /** No code moves, and an armed auto-merge is released. */
-  "review-approve",
-  /** Discards commits that landed after the last fetch, on a shared ref. */
-  "force-push",
-  /** Destroys uncommitted work belonging to a session this one cannot see. */
-  "worktree-remove",
-  /** `-x` is the flag that takes `.env` and local certificates. */
-  "clean-ignored"
-]);
-var WARN_OPS = /* @__PURE__ */ new Set([
-  "commit",
-  "push",
-  "pr-create",
-  "branch",
-  // ── Added 2026-09-03, deliberately at warn rather than block.
-  //
-  // Each is destructive in some reading, and each is also routine enough that
-  // blocking it would be the friction that gets the whole guard routed around —
-  // the failure mode this estate has already recorded twice. `reset-hard` is the
-  // sharpest case and stays here for a decidable reason: the Hard Floor's
-  // qualifier is "past unpushed work", and the command text cannot say whether
-  // the work was pushed.
-  "tag-force",
-  "rebase",
-  "reset-hard",
-  "clean",
-  "stash-drop",
-  "branch-delete",
-  "close"
-]);
-var G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
-var P = "^(?:\\S*\\/)?";
-function ghApiWrite(pathRe) {
-  return new RegExp(
-    `${P}gh\\s+api\\b(?=[^\\n]*${pathRe})(?=[^\\n]*(?:-X|--method)\\s+(?:POST|PATCH|PUT|DELETE)\\b)`,
-    "i"
-  );
-}
-var COMMAND_OPS = [
-  { op: "publish", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}publish\\b`, "i") },
-  {
-    op: "release",
-    re: new RegExp(`${P}gh\\s+release\\s+create\\b|${ghApiWrite("\\/releases\\b").source}`, "i")
-  },
-  {
-    op: "tag",
-    re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--tags|--follow-tags|refs\\/tags\\/)`, "i")
-  },
-  // ORDER IS LOAD-BEARING, per this table's own rule that the most specific
-  // pattern wins: `gh pr merge 12 --auto` matches the plain merge pattern too.
-  //
-  // The GraphQL mutation needs its OWN pattern rather than a widening of
-  // `ghApiWrite()`. That helper requires BOTH a REST-shaped path and an
-  // explicit write method, and `gh api graphql -f query='mutation{...}'` has
-  // neither — widening it to reach this would loosen every other op that uses
-  // it, which is a bigger change than the defect.
-  {
-    op: "pr-merge-auto",
-    re: new RegExp(
-      `${P}gh\\s+pr\\s+merge\\b(?=[^\\n]*--auto\\b)|${P}gh\\s+api\\b(?=[^\\n]*enablePullRequestAutoMerge\\b)`,
-      "i"
-    )
-  },
-  {
-    op: "pr-merge",
-    re: new RegExp(
-      `${P}gh\\s+pr\\s+merge\\b(?![^\\n]*--(auto|disable-auto)\\b)|${ghApiWrite("\\/pulls\\/\\d+\\/merge\\b").source}`,
-      "i"
-    )
-  },
-  {
-    op: "pr-create",
-    re: new RegExp(`${P}gh\\s+pr\\s+create\\b|${ghApiWrite("\\/pulls\\b").source}`, "i")
-  },
-  // ── Added 2026-09-03. Placement inside this table is as load-bearing as the
-  // patterns: the loop takes the MOST SEVERE match per segment, but within one
-  // op the first pattern wins, so anything more specific than a plain `git push`
-  // has to sit above it.
-  // `npm unpublish` is NOT reached by the publish pattern — `\bpublish\b` needs
-  // a word boundary that `unpublish` does not provide between `n` and `p`. That
-  // is why it classified as nothing for as long as it did.
-  { op: "unpublish", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}unpublish\\b`, "i") },
-  { op: "deprecate", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}deprecate\\b`, "i") },
-  {
-    op: "release-asset",
-    re: new RegExp(`${P}gh\\s+release\\s+(upload|edit|delete)\\b`, "i")
-  },
-  {
-    op: "protection",
-    re: new RegExp(
-      `${P}gh\\s+api\\b(?=[^\\n]*(?:protection|rulesets?)\\b)(?=[^\\n]*(?:-X|--method)\\s+(?:DELETE|PUT|PATCH|POST)\\b)|${P}gh\\s+ruleset\\s+delete\\b`,
-      "i"
-    )
-  },
-  {
-    op: "workflow-toggle",
-    re: new RegExp(`${P}gh\\s+workflow\\s+(disable|enable)\\b`, "i")
-  },
-  {
-    op: "repo-lifecycle",
-    re: new RegExp(
-      `${P}gh\\s+repo\\s+(archive|delete|unarchive)\\b|${P}gh\\s+repo\\s+edit\\b(?=[^\\n]*--visibility\\b)`,
-      "i"
-    )
-  },
-  {
-    op: "review-approve",
-    re: new RegExp(`${P}gh\\s+pr\\s+review\\b(?=[^\\n]*--approve\\b)`, "i")
-  },
-  // Above `push`, and both spellings: `--force` and `--force-with-lease`. The
-  // "safe force" is in the same class here because what it is safe against is a
-  // stale local view, not a collaborator who pushed after your fetch.
-  {
-    op: "force-push",
-    re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)`, "i")
-  },
-  {
-    op: "worktree-remove",
-    re: new RegExp(`${P}git\\s+worktree\\s+remove\\b[^\\n;|&]*(--force\\b|\\s-f\\b)`, "i")
-  },
-  // `-x` (or `-X`) anywhere in the flag cluster is what reaches ignored files.
-  {
-    op: "clean-ignored",
-    re: new RegExp(`${P}git\\s+clean\\b[^\\n;|&]*-[A-Za-z]*x`, "i")
-  },
-  { op: "tag-force", re: new RegExp(`${P}git\\s+tag\\b[^\\n;|&]*(-f\\b|--force\\b)`, "i") },
-  { op: "rebase", re: new RegExp(`${P}git\\s+${G}rebase\\b`, "i") },
-  { op: "reset-hard", re: new RegExp(`${P}git\\s+${G}reset\\b[^\\n;|&]*--hard\\b`, "i") },
-  { op: "clean", re: new RegExp(`${P}git\\s+clean\\b`, "i") },
-  { op: "stash-drop", re: new RegExp(`${P}git\\s+stash\\s+(drop|clear)\\b`, "i") },
-  // Remote deletion and the local `-D` are one op: both remove a ref, and the
-  // remote form additionally closes any open PR pointing at it.
-  {
-    op: "branch-delete",
-    re: new RegExp(
-      `${P}git\\s+branch\\b[^\\n;|&]*(-D\\b|--delete\\b)|${P}git\\s+${G}push\\b[^\\n;|&]*(--delete\\b|\\s:\\S)`,
-      "i"
-    )
-  },
-  { op: "close", re: new RegExp(`${P}gh\\s+(pr|issue)\\s+close\\b`, "i") },
-  { op: "push", re: new RegExp(`${P}git\\s+${G}push\\b`, "i") },
-  { op: "commit", re: new RegExp(`${P}git\\s+${G}commit\\b`, "i") },
-  { op: "branch", re: new RegExp(`${P}git\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") }
-];
-var COMMAND_TOOLS4 = /* @__PURE__ */ new Set([
-  "launch-process",
-  "launch_process",
-  "Bash",
-  "BashTool",
-  "run-process",
-  "runProcess",
-  "shell",
-  "execute_shell",
-  "RunShellCommand"
-]);
-function extractCommand(envelope) {
-  const payload = _isObject9(envelope["payload"]) ? envelope["payload"] : envelope;
-  const toolRaw = payload["tool_name"] ?? payload["toolName"] ?? payload["tool"];
-  const tool = typeof toolRaw === "string" ? toolRaw : null;
-  if (tool !== null && !COMMAND_TOOLS4.has(tool)) {
-    return null;
-  }
-  const input = _isObject9(payload["tool_input"]) ? payload["tool_input"] : _isObject9(payload["toolInput"]) ? payload["toolInput"] : payload;
-  for (const key of ["command", "cmd", "script"]) {
-    const v = input[key];
-    if (typeof v === "string" && v.trim()) {
-      return v;
-    }
-  }
-  return null;
-}
-function splitOutsideQuotes(command) {
-  const parts = [];
-  let cur = "";
-  let quote = null;
-  for (let i = 0; i < command.length; i += 1) {
-    const ch = command[i];
-    if (quote !== null) {
-      if (quote === "$'" && ch === "\\" && i + 1 < command.length) {
-        cur += ch + command[i + 1];
-        i += 1;
-        continue;
-      }
-      cur += ch;
-      if (ch === (quote === "$'" ? "'" : quote)) {
-        quote = null;
-      } else if (ch === "\\" && quote === '"' && i + 1 < command.length) {
-        cur += command[i + 1];
-        i += 1;
-      }
-      continue;
-    }
-    if (ch === "$" && (command[i + 1] === "'" || command[i + 1] === '"')) {
-      quote = command[i + 1] === "'" ? "$'" : '"';
-      cur += ch + command[i + 1];
-      i += 1;
-      continue;
-    }
-    if (ch === '"' || ch === "'") {
-      quote = ch;
-      cur += ch;
-      continue;
-    }
-    if (ch === "\\" && i + 1 < command.length) {
-      cur += ch + command[i + 1];
-      i += 1;
-      continue;
-    }
-    if (ch === "\n" || ch === ";" || ch === "|" || ch === "&") {
-      if ((ch === "|" || ch === "&") && command[i + 1] === ch) {
-        i += 1;
-      }
-      parts.push(cur);
-      cur = "";
-      continue;
-    }
-    cur += ch;
-  }
-  if (quote !== null) {
-    parts.push(...splitIgnoringQuotes(cur));
-    return parts;
-  }
-  parts.push(cur);
-  return parts;
-}
-function splitIgnoringQuotes(fragment) {
-  const parts = [];
-  let cur = "";
-  for (let i = 0; i < fragment.length; i += 1) {
-    const ch = fragment[i];
-    if (ch === "\\" && i + 1 < fragment.length) {
-      cur += ch + fragment[i + 1];
-      i += 1;
-      continue;
-    }
-    if (ch === "\n" || ch === ";" || ch === "|" || ch === "&") {
-      if ((ch === "|" || ch === "&") && fragment[i + 1] === ch) {
-        i += 1;
-      }
-      parts.push(cur);
-      cur = "";
-      continue;
-    }
-    cur += ch;
-  }
-  parts.push(cur);
-  return parts;
-}
-function substitutionPayloads(segment) {
-  const out = [];
-  for (let i = 0; i < segment.length; i += 1) {
-    const ch = segment[i];
-    if (ch === "\\") {
-      i += 1;
-      continue;
-    }
-    if ((ch === "$" || ch === "<" || ch === ">") && segment[i + 1] === "(") {
-      let open = 1;
-      let j = i + 2;
-      const start = j;
-      for (; j < segment.length && open > 0; j += 1) {
-        const c = segment[j];
-        if (c === "\\") {
-          j += 1;
-        } else if (c === "(") {
-          open += 1;
-        } else if (c === ")") {
-          open -= 1;
-        }
-      }
-      out.push(segment.slice(start, open === 0 ? j - 1 : segment.length));
-      i = j - 1;
-      continue;
-    }
-    if (ch === "`") {
-      const end = segment.indexOf("`", i + 1);
-      out.push(segment.slice(i + 1, end === -1 ? segment.length : end));
-      i = end === -1 ? segment.length : end;
-    }
-  }
-  return out;
-}
-function invokedSegments(command, depth = 0) {
-  if (depth > 3) {
-    return [];
-  }
-  const out = [];
-  const withoutHeredocs = command.replace(
-    /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1[\s\S]*?^\s*\2\s*$/gm,
-    "<<HEREDOC"
-  );
-  for (const raw of splitOutsideQuotes(withoutHeredocs)) {
-    let seg = raw.trim();
-    if (!seg) {
-      continue;
-    }
-    seg = seg.replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|\S*)\s+)+/, "");
-    for (const payload of substitutionPayloads(seg)) {
-      out.push(...invokedSegments(payload, depth + 1));
-    }
-    const wrapped = /^(?:\S*\/)?(?:ba|z|k)?sh\s+-[a-z]*c\s+(?:"([^"]*)"|'([^']*)'|(\S+))/.exec(seg);
-    if (wrapped) {
-      out.push(...invokedSegments(wrapped[1] ?? wrapped[2] ?? wrapped[3] ?? "", depth + 1));
-      continue;
-    }
-    const evaled = /^eval\s+(?:"([^"]*)"|'([^']*)'|(.+))$/.exec(seg);
-    if (evaled) {
-      out.push(...invokedSegments(evaled[1] ?? evaled[2] ?? evaled[3] ?? "", depth + 1));
-      continue;
-    }
-    out.push(seg.replace(/^(\S+)/, (w) => w.replace(/['"]/g, "")));
-  }
-  return out;
-}
-function commandOp(command) {
-  let found = null;
-  for (const seg of invokedSegments(command)) {
-    if (!/^(?:\S*\/)?(git|gh|npm|pnpm|yarn)\b/.test(seg)) {
-      continue;
-    }
-    for (const { op, re } of COMMAND_OPS) {
-      if (re.test(seg)) {
-        if (BLOCK_OPS.has(op)) {
-          return op;
-        }
-        found ??= op;
-        break;
-      }
-    }
-  }
-  return found;
-}
-function mergeTargetOf(command) {
-  const gh = /\bgh\s+pr\s+merge\s+(?:-{1,2}\S+\s+)*?(\d{1,10})\b/i.exec(command);
-  if (gh) {
-    return _boundedTarget(gh[1]);
-  }
-  const api = /\/pulls\/(\d{1,10})\/merge\b/i.exec(command);
-  return api ? _boundedTarget(api[1]) : null;
-}
-function _boundedTarget(digits) {
-  const n = Number.parseInt(digits, 10);
-  return Number.isSafeInteger(n) && n > 0 && n <= PR_NUMBER_MAX ? n : null;
-}
-function grantCovers(grants, op, target) {
-  if (op !== "pr-merge" || target === null) {
-    return null;
-  }
-  return grants.find(
-    (g) => g.op === "pr-merge" && g.targets.includes(target) && !g.consumed.includes(target)
-  ) ?? null;
-}
-var LEDGER_MAX_AGE_MS = 30 * 60 * 1e3;
-function _loadLedger(consumer_root, session_id, now) {
-  const grants = readGrants(consumer_root, session_id);
-  const candidates = [ledgerFileFor(session_id)];
-  if (!candidates.includes(STATE_FILE7)) {
-    candidates.push(STATE_FILE7);
-  }
-  for (const rel of candidates) {
-    const found = _readLedgerFile(path56.join(consumer_root, rel), session_id, now);
-    if (found !== null) {
-      return { ...found, grants };
+      return null;
     }
-  }
-  return { authorized: /* @__PURE__ */ new Set(), present: false, grants };
-}
-function _readLedgerFile(file, session_id, now) {
-  try {
-    const raw = fs56.readFileSync(file, "utf8");
-    const decoded = JSON.parse(raw);
-    if (_isObject9(decoded) && Array.isArray(decoded["authorized"])) {
-      const ledgerSession = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
-      if (session_id && ledgerSession && ledgerSession !== session_id) {
-        return null;
-      }
-      const at = Date.parse(String(decoded["detected_at"] ?? ""));
-      if (Number.isFinite(at) && now - at > LEDGER_MAX_AGE_MS) {
-        return null;
-      }
-      return {
-        authorized: new Set(decoded["authorized"].filter(Boolean)),
-        present: true
-      };
+    const recorded = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
+    if (session_id && recorded && recorded !== session_id) {
+      return null;
+    }
+    const at = Date.parse(String(decoded["refused_at"] ?? ""));
+    if (!Number.isFinite(at) || now - at > PENDING_MAX_AGE_MS) {
+      return null;
     }
+    return { op, session_id: recorded, refused_at: String(decoded["refused_at"]) };
   } catch {
+    return null;
   }
-  return null;
-}
-function decide(command, ledger, impact) {
-  if (command === null) {
-    return { exit: EXIT_ALLOW11, stdout: "", stderr: "" };
-  }
-  const op = commandOp(command);
-  if (op === null || ledger.authorized.has(op)) {
-    return { exit: EXIT_ALLOW11, stdout: "", stderr: "" };
-  }
-  const target = mergeTargetOf(command);
-  if (grantCovers(ledger.grants ?? [], op, target) && target !== null) {
-    return { exit: EXIT_ALLOW11, stdout: "", stderr: "", consumedTarget: target };
-  }
-  const shown = command.length > 120 ? `${command.slice(0, 117)}\u2026` : command;
-  if (BLOCK_OPS.has(op)) {
-    const scan = op === "pr-merge" && target !== null && impact ? ` ${impact}` : "";
-    const reason = `Blocked: \`${op}\` with no authorization in this turn's prompt. This operation is irreversible and non-destructive-by-default already declares it never-autonomous. Command: ${shown}.${scan} Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
-    return { exit: EXIT_BLOCK, stdout: "", stderr: `${reason}
-`, blockedOp: op };
-  }
-  if (WARN_OPS.has(op)) {
-    const reason = `No \`${op}\` authorization found in this turn's prompt (commit-policy: a one-shot authorization is spent on the operation it named). If the user did authorize it this turn, proceed; otherwise stop and ask. Command: ${shown}`;
-    return {
-      exit: EXIT_ALLOW11,
-      stdout: `${JSON.stringify({ decision: "warn", reason })}
-`,
-      stderr: ""
-    };
-  }
-  return { exit: EXIT_ALLOW11, stdout: "", stderr: "" };
 }
-function run11(stdin_text, options) {
+function run10(stdin_text, options) {
   let envelope = {};
   if (stdin_text.trim()) {
     try {
       const decoded = JSON.parse(stdin_text);
-      if (_isObject9(decoded)) {
+      if (_isObject8(decoded)) {
         envelope = decoded;
       }
     } catch {
       return EXIT_ALLOW11;
     }
   }
-  const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
-  const command = extractCommand(envelope);
-  const ledger = _loadLedger(options.consumer_root, session_id, Date.now());
-  let impact;
-  const stage1 = command === null ? null : commandOp(command);
-  const stage2Target = command === null ? null : mergeTargetOf(command);
-  if (stage1 === "pr-merge" && stage2Target !== null && !ledger.authorized.has("pr-merge") && !grantCovers(ledger.grants ?? [], "pr-merge", stage2Target)) {
-    try {
-      impact = describeImpact(
-        stage2Target,
-        analyseMergeImpact(stage2Target, { cwd: options.consumer_root })
-      );
-    } catch {
+  const payload = _isObject8(envelope["payload"]) ? envelope["payload"] : envelope;
+  let prompt = "";
+  for (const key of ["prompt", "userPrompt", "user_prompt", "message", "text"]) {
+    const v = payload[key];
+    if (typeof v === "string" && v.trim()) {
+      prompt = v;
+      break;
     }
   }
-  const decision = decide(command, ledger, impact);
-  if (decision.consumedTarget !== void 0) {
-    consumeGrantTarget(options.consumer_root, session_id, decision.consumedTarget);
+  if (!prompt) {
+    return EXIT_ALLOW11;
   }
-  if (decision.blockedOp) {
-    try {
-      atomic_write_json(path56.join(options.consumer_root, pendingFileFor(session_id)), {
-        op: decision.blockedOp,
-        session_id,
-        refused_at: (/* @__PURE__ */ new Date()).toISOString()
-      });
-    } catch {
-    }
+  const session = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
+  if (!humanTypedThisTurn(prompt)) {
+    return EXIT_ALLOW11;
   }
-  if (decision.stdout) {
-    process.stdout.write(decision.stdout);
+  const { authorized, evidence } = classifyAuthorization(prompt);
+  const pending = takePending(options.consumer_root, session, Date.now());
+  if (pending && !authorized.includes(pending.op) && isAffirmative(prompt)) {
+    authorized.push(pending.op);
+    evidence[pending.op] = `confirmation of the refused \`${pending.op}\` (refused ${pending.refused_at}): "${prompt.trim().slice(0, 40)}"`;
   }
-  if (decision.stderr) {
-    process.stderr.write(decision.stderr);
+  const now = /* @__PURE__ */ new Date();
+  const ledger = {
+    session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
+    detected_at: now.toISOString(),
+    authorized,
+    evidence,
+    prompt_chars: prompt.length,
+    // Grants survive this write; `authorized` does not. That asymmetry IS the
+    // decision. A bare operation name stays one-shot exactly as `commit-policy`
+    // requires, and only an authorization that also froze its objects earns a
+    // life longer than the turn. See ADR-252.
+    grants: foldGrants(
+      readGrants(options.consumer_root, session),
+      prompt,
+      authorized,
+      session,
+      now
+    )
+  };
+  try {
+    atomic_write_json(path56.join(options.consumer_root, ledgerFileFor(session)), ledger);
+  } catch (err) {
+    process.stderr.write(
+      `git-authorization: session-ledger write failed (${_errText2(err)}) \u2014 the gate degrades to "no ledger" for this session, which denies the irreversible subset and warns on the rest. Authorization outcome unchanged.
+`
+    );
   }
-  return decision.exit;
+  return EXIT_ALLOW11;
 }
 function main31(argv) {
   const args = argv ?? process.argv.slice(2);
@@ -27089,9 +26573,9 @@ function main31(argv) {
       consumer_root = a.slice("--project-dir=".length);
     }
   }
-  return run11(readHookStdin(), { consumer_root });
+  return run10(readHookStdin(), { consumer_root });
 }
-function _isCliEntry25() {
+function _isCliEntry24() {
   if (true) {
     return false;
   }
@@ -27110,7 +26594,7 @@ function _isCliEntry25() {
     return false;
   }
 }
-if (_isCliEntry25()) {
+if (_isCliEntry24()) {
   process.exit(main31());
 }
 
@@ -27120,9 +26604,9 @@ import fs57 from "node:fs";
 import path57 from "node:path";
 import { fileURLToPath as fileURLToPath35, pathToFileURL as pathToFileURL28 } from "node:url";
 var EXIT_ALLOW12 = 0;
-var EXIT_BLOCK2 = 1;
+var EXIT_BLOCK = 1;
 var STATE_FILE8 = path57.join("agents", "state", "evidence-dispatch.json");
-function _isObject10(v) {
+function _isObject9(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 var DISPATCH_TOOLS = /* @__PURE__ */ new Set([
@@ -27175,10 +26659,10 @@ function preloadedVerdict(prompt) {
   return null;
 }
 function extractDispatch(envelope) {
-  const payload = _isObject10(envelope["payload"]) ? envelope["payload"] : envelope;
+  const payload = _isObject9(envelope["payload"]) ? envelope["payload"] : envelope;
   const toolRaw = payload["tool_name"] ?? payload["toolName"] ?? payload["tool"];
   const tool = typeof toolRaw === "string" ? toolRaw : null;
-  const input = _isObject10(payload["tool_input"]) ? payload["tool_input"] : _isObject10(payload["toolInput"]) ? payload["toolInput"] : payload;
+  const input = _isObject9(payload["tool_input"]) ? payload["tool_input"] : _isObject9(payload["toolInput"]) ? payload["toolInput"] : payload;
   for (const key of ["prompt", "instructions", "task", "description"]) {
     const v = input[key];
     if (typeof v === "string" && v.trim()) {
@@ -27202,7 +26686,7 @@ function _ledgerStamp(consumer_root) {
 function _load(target) {
   try {
     const decoded = JSON.parse(fs57.readFileSync(target, "utf8"));
-    if (_isObject10(decoded) && Array.isArray(decoded["evaluations"])) {
+    if (_isObject9(decoded) && Array.isArray(decoded["evaluations"])) {
       return decoded;
     }
   } catch {
@@ -27210,14 +26694,14 @@ function _load(target) {
   return { session_id: "", turn_started_at: "", evaluations: [] };
 }
 var WARN_TEXT = "First evaluation dispatch this turn. Two shapes fabricated a binding honest-null in the audited sessions \u2014 check your prompt for both before it goes out: (1) a verdict pre-loaded into the prompt, and (2) a scope narrowed to files you chose. A review you commissioned on your own work is admissible as gate evidence only when the prompt is recorded alongside the verdict.";
-function decide2(tool, prompt, priorEvaluations) {
+function decide(tool, prompt, priorEvaluations) {
   if (!isDispatchTool(tool) || !isEvaluationPrompt(prompt)) {
     return { exit: EXIT_ALLOW12, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
   const preloaded = preloadedVerdict(prompt);
   if (preloaded !== null) {
     return {
-      exit: EXIT_BLOCK2,
+      exit: EXIT_BLOCK,
       stdout: "",
       stderr: `Blocked: this evaluation prompt pre-loads its verdict ("${preloaded}"). That is the construct that produced a fabricated NO-FINDINGS committed as binding gate evidence, over a delta an unsteered pass then found a live critical in. Remove the expectation from the prompt and let the evaluator reach its own verdict.
 `,
@@ -27247,12 +26731,12 @@ function decide2(tool, prompt, priorEvaluations) {
     evaluations: priorEvaluations + 1
   };
 }
-function run12(stdin_text, options) {
+function run11(stdin_text, options) {
   let envelope = {};
   if (stdin_text.trim()) {
     try {
       const decoded = JSON.parse(stdin_text);
-      if (_isObject10(decoded)) {
+      if (_isObject9(decoded)) {
         envelope = decoded;
       }
     } catch {
@@ -27269,7 +26753,7 @@ function run12(stdin_text, options) {
     state.evaluations = [];
   }
   const [tool, prompt] = extractDispatch(envelope);
-  const decision = decide2(tool, prompt, state.evaluations.length);
+  const decision = decide(tool, prompt, state.evaluations.length);
   if (decision.evaluations > state.evaluations.length) {
     state.evaluations.push({
       at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -27278,7 +26762,11 @@ function run12(stdin_text, options) {
     });
     try {
       atomic_write_json(target, state);
-    } catch {
+    } catch (err) {
+      process.stderr.write(
+        `evidence-independence: evaluation-count write failed (${_errText3(err)}) \u2014 this turn's count did NOT advance, so a second self-scoped evaluation will not be warned about. The pre-loaded-verdict block is unaffected.
+`
+      );
     }
   }
   if (decision.stdout) {
@@ -27289,6 +26777,10 @@ function run12(stdin_text, options) {
   }
   return decision.exit;
 }
+function _errText3(err) {
+  const t = err instanceof Error ? err.message : String(err);
+  return t.replace(/\s+/g, " ").trim().slice(0, 200);
+}
 function main32(argv) {
   const args = argv ?? process.argv.slice(2);
   let consumer_root = process.cwd();
@@ -27297,39 +26789,191 @@ function main32(argv) {
     if (a === "--project-dir" && args[i + 1] !== void 0) {
       consumer_root = args[i + 1];
       i += 1;
-    } else if (a !== void 0 && a.startsWith("--project-dir=")) {
-      consumer_root = a.slice("--project-dir=".length);
+    } else if (a !== void 0 && a.startsWith("--project-dir=")) {
+      consumer_root = a.slice("--project-dir=".length);
+    }
+  }
+  return run11(readHookStdin(), { consumer_root });
+}
+function _isCliEntry25() {
+  if (true) {
+    return false;
+  }
+  if (process.argv[1] === void 0) {
+    return false;
+  }
+  const argvUrl = pathToFileURL28(path57.resolve(process.argv[1])).href;
+  if (import.meta.url === argvUrl) {
+    return true;
+  }
+  try {
+    const here = fs57.realpathSync(fileURLToPath35(import.meta.url));
+    const argv = fs57.realpathSync(path57.resolve(process.argv[1]));
+    return here === argv;
+  } catch {
+    return false;
+  }
+}
+if (_isCliEntry25()) {
+  process.exit(main32());
+}
+
+// src/scripts/hooks/block_no_verify.ts
+import * as fs58 from "node:fs";
+import { fileURLToPath as fileURLToPath36, pathToFileURL as pathToFileURL29 } from "node:url";
+import * as path58 from "node:path";
+
+// src/scripts/hooks/git_command_classifier.ts
+var G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
+var P = "^(?:\\S*\\/)?";
+function ghApiWrite(pathRe) {
+  return new RegExp(
+    `${P}gh\\s+api\\b(?=[^\\n]*${pathRe})(?=[^\\n]*(?:-X|--method)\\s+(?:POST|PATCH|PUT|DELETE)\\b)`,
+    "i"
+  );
+}
+var COMMAND_OPS = [
+  { op: "publish", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}publish\\b`, "i") },
+  {
+    op: "release",
+    re: new RegExp(`${P}gh\\s+release\\s+create\\b|${ghApiWrite("\\/releases\\b").source}`, "i")
+  },
+  {
+    op: "tag",
+    re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--tags|--follow-tags|refs\\/tags\\/)`, "i")
+  },
+  // ORDER IS LOAD-BEARING, per this table's own rule that the most specific
+  // pattern wins: `gh pr merge 12 --auto` matches the plain merge pattern too.
+  //
+  // The GraphQL mutation needs its OWN pattern rather than a widening of
+  // `ghApiWrite()`. That helper requires BOTH a REST-shaped path and an
+  // explicit write method, and `gh api graphql -f query='mutation{...}'` has
+  // neither — widening it to reach this would loosen every other op that uses
+  // it, which is a bigger change than the defect.
+  {
+    op: "pr-merge-auto",
+    re: new RegExp(
+      `${P}gh\\s+pr\\s+merge\\b(?=[^\\n]*--auto\\b)|${P}gh\\s+api\\b(?=[^\\n]*enablePullRequestAutoMerge\\b)`,
+      "i"
+    )
+  },
+  {
+    op: "pr-merge",
+    re: new RegExp(
+      `${P}gh\\s+pr\\s+merge\\b(?![^\\n]*--(auto|disable-auto)\\b)|${ghApiWrite("\\/pulls\\/\\d+\\/merge\\b").source}`,
+      "i"
+    )
+  },
+  {
+    op: "pr-create",
+    re: new RegExp(`${P}gh\\s+pr\\s+create\\b|${ghApiWrite("\\/pulls\\b").source}`, "i")
+  },
+  // ── Added 2026-09-03. Placement inside this table is as load-bearing as the
+  // patterns: the loop takes the MOST SEVERE match per segment, but within one
+  // op the first pattern wins, so anything more specific than a plain `git push`
+  // has to sit above it.
+  // `npm unpublish` is NOT reached by the publish pattern — `\bpublish\b` needs
+  // a word boundary that `unpublish` does not provide between `n` and `p`. That
+  // is why it classified as nothing for as long as it did.
+  { op: "unpublish", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}unpublish\\b`, "i") },
+  { op: "deprecate", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}deprecate\\b`, "i") },
+  {
+    op: "release-asset",
+    re: new RegExp(`${P}gh\\s+release\\s+(upload|edit|delete)\\b`, "i")
+  },
+  {
+    op: "protection",
+    re: new RegExp(
+      `${P}gh\\s+api\\b(?=[^\\n]*(?:protection|rulesets?)\\b)(?=[^\\n]*(?:-X|--method)\\s+(?:DELETE|PUT|PATCH|POST)\\b)|${P}gh\\s+ruleset\\s+delete\\b`,
+      "i"
+    )
+  },
+  {
+    op: "workflow-toggle",
+    re: new RegExp(`${P}gh\\s+workflow\\s+(disable|enable)\\b`, "i")
+  },
+  {
+    op: "repo-lifecycle",
+    re: new RegExp(
+      `${P}gh\\s+repo\\s+(archive|delete|unarchive)\\b|${P}gh\\s+repo\\s+edit\\b(?=[^\\n]*--visibility\\b)`,
+      "i"
+    )
+  },
+  {
+    op: "review-approve",
+    re: new RegExp(`${P}gh\\s+pr\\s+review\\b(?=[^\\n]*--approve\\b)`, "i")
+  },
+  // Above `push`, and both spellings: `--force` and `--force-with-lease`. The
+  // "safe force" is in the same class here because what it is safe against is a
+  // stale local view, not a collaborator who pushed after your fetch.
+  {
+    op: "force-push",
+    re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)`, "i")
+  },
+  {
+    op: "worktree-remove",
+    re: new RegExp(`${P}git\\s+worktree\\s+remove\\b[^\\n;|&]*(--force\\b|\\s-f\\b)`, "i")
+  },
+  // `-x` (or `-X`) anywhere in the flag cluster is what reaches ignored files.
+  {
+    op: "clean-ignored",
+    re: new RegExp(`${P}git\\s+clean\\b[^\\n;|&]*-[A-Za-z]*x`, "i")
+  },
+  { op: "tag-force", re: new RegExp(`${P}git\\s+tag\\b[^\\n;|&]*(-f\\b|--force\\b)`, "i") },
+  { op: "rebase", re: new RegExp(`${P}git\\s+${G}rebase\\b`, "i") },
+  { op: "reset-hard", re: new RegExp(`${P}git\\s+${G}reset\\b[^\\n;|&]*--hard\\b`, "i") },
+  { op: "clean", re: new RegExp(`${P}git\\s+clean\\b`, "i") },
+  { op: "stash-drop", re: new RegExp(`${P}git\\s+stash\\s+(drop|clear)\\b`, "i") },
+  // Remote deletion and the local `-D` are one op: both remove a ref, and the
+  // remote form additionally closes any open PR pointing at it.
+  {
+    op: "branch-delete",
+    re: new RegExp(
+      `${P}git\\s+branch\\b[^\\n;|&]*(-D\\b|--delete\\b)|${P}git\\s+${G}push\\b[^\\n;|&]*(--delete\\b|\\s:\\S)`,
+      "i"
+    )
+  },
+  { op: "close", re: new RegExp(`${P}gh\\s+(pr|issue)\\s+close\\b`, "i") },
+  { op: "push", re: new RegExp(`${P}git\\s+${G}push\\b`, "i") },
+  { op: "commit", re: new RegExp(`${P}git\\s+${G}commit\\b`, "i") },
+  { op: "branch", re: new RegExp(`${P}git\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") }
+];
+function substitutionPayloads(segment) {
+  const out = [];
+  for (let i = 0; i < segment.length; i += 1) {
+    const ch = segment[i];
+    if (ch === "\\") {
+      i += 1;
+      continue;
+    }
+    if ((ch === "$" || ch === "<" || ch === ">") && segment[i + 1] === "(") {
+      let open = 1;
+      let j = i + 2;
+      const start = j;
+      for (; j < segment.length && open > 0; j += 1) {
+        const c = segment[j];
+        if (c === "\\") {
+          j += 1;
+        } else if (c === "(") {
+          open += 1;
+        } else if (c === ")") {
+          open -= 1;
+        }
+      }
+      out.push(segment.slice(start, open === 0 ? j - 1 : segment.length));
+      i = j - 1;
+      continue;
+    }
+    if (ch === "`") {
+      const end = segment.indexOf("`", i + 1);
+      out.push(segment.slice(i + 1, end === -1 ? segment.length : end));
+      i = end === -1 ? segment.length : end;
     }
   }
-  return run12(readHookStdin(), { consumer_root });
-}
-function _isCliEntry26() {
-  if (true) {
-    return false;
-  }
-  if (process.argv[1] === void 0) {
-    return false;
-  }
-  const argvUrl = pathToFileURL28(path57.resolve(process.argv[1])).href;
-  if (import.meta.url === argvUrl) {
-    return true;
-  }
-  try {
-    const here = fs57.realpathSync(fileURLToPath35(import.meta.url));
-    const argv = fs57.realpathSync(path57.resolve(process.argv[1]));
-    return here === argv;
-  } catch {
-    return false;
-  }
-}
-if (_isCliEntry26()) {
-  process.exit(main32());
+  return out;
 }
 
 // src/scripts/hooks/block_no_verify.ts
-import * as fs58 from "node:fs";
-import { fileURLToPath as fileURLToPath36, pathToFileURL as pathToFileURL29 } from "node:url";
-import * as path58 from "node:path";
 var _HERE4 = fileURLToPath36(import.meta.url);
 var _SHELL_SEPARATORS = /* @__PURE__ */ new Set(["&&", "||", ";", "|", "&"]);
 var _OPERATOR_CHARS = ";|&";
@@ -27766,7 +27410,7 @@ function main33(argv) {
   }
   return 0;
 }
-function _isCliEntry27() {
+function _isCliEntry26() {
   if (true) {
     return false;
   }
@@ -27785,7 +27429,7 @@ function _isCliEntry27() {
     return false;
   }
 }
-if (_isCliEntry27() || false) {
+if (_isCliEntry26() || false) {
   process.exitCode = main33();
 }
 
@@ -27794,7 +27438,7 @@ import * as fs59 from "node:fs";
 import { fileURLToPath as fileURLToPath37, pathToFileURL as pathToFileURL30 } from "node:url";
 import * as path59 from "node:path";
 var _HERE5 = fileURLToPath37(import.meta.url);
-function _isObject11(v) {
+function _isObject10(v) {
   return v !== null && v !== void 0 && typeof v === "object" && !Array.isArray(v);
 }
 var _PATH_KEYS = [
@@ -27806,10 +27450,10 @@ var _PATH_KEYS = [
   "notebook_path"
 ];
 function _extract(envelope) {
-  const payload = _isObject11(envelope["payload"]) ? envelope["payload"] : envelope;
+  const payload = _isObject10(envelope["payload"]) ? envelope["payload"] : envelope;
   const nameVal = payload["tool_name"] ?? payload["toolName"] ?? payload["tool"] ?? envelope["tool_name"] ?? envelope["tool"];
   const tool = typeof nameVal === "string" ? nameVal : "";
-  const ti = _isObject11(payload["tool_input"]) ? payload["tool_input"] : _isObject11(envelope["tool_input"]) ? envelope["tool_input"] : null;
+  const ti = _isObject10(payload["tool_input"]) ? payload["tool_input"] : _isObject10(envelope["tool_input"]) ? envelope["tool_input"] : null;
   const paths = [];
   if (ti !== null) {
     for (const key of _PATH_KEYS) {
@@ -27940,8 +27584,8 @@ function check_envelope(envelope) {
   return [false, ""];
 }
 function _extract_command3(envelope) {
-  const payload = _isObject11(envelope["payload"]) ? envelope["payload"] : envelope;
-  const ti = _isObject11(payload["tool_input"]) ? payload["tool_input"] : _isObject11(envelope["tool_input"]) ? envelope["tool_input"] : null;
+  const payload = _isObject10(envelope["payload"]) ? envelope["payload"] : envelope;
+  const ti = _isObject10(payload["tool_input"]) ? payload["tool_input"] : _isObject10(envelope["tool_input"]) ? envelope["tool_input"] : null;
   for (const src of [ti, payload]) {
     if (src === null) {
       continue;
@@ -27954,7 +27598,7 @@ function _extract_command3(envelope) {
   return null;
 }
 function _asObject2(v) {
-  return _isObject11(v) ? v : null;
+  return _isObject10(v) ? v : null;
 }
 function _readStdin12() {
   return readHookStdin();
@@ -27984,7 +27628,7 @@ function main34() {
   }
   return 0;
 }
-function _isCliEntry28() {
+function _isCliEntry27() {
   if (true) {
     return false;
   }
@@ -28003,7 +27647,7 @@ function _isCliEntry28() {
     return false;
   }
 }
-if (_isCliEntry28() || false) {
+if (_isCliEntry27() || false) {
   process.exitCode = main34();
 }
 
@@ -28013,11 +27657,11 @@ import * as path60 from "node:path";
 import { fileURLToPath as fileURLToPath38, pathToFileURL as pathToFileURL31 } from "node:url";
 var _HERE6 = fileURLToPath38(import.meta.url);
 var EXIT_ALLOW13 = 0;
-var EXIT_BLOCK3 = 1;
-var EXIT_WARN4 = 2;
+var EXIT_BLOCK2 = 1;
+var EXIT_WARN5 = 2;
 var SESSION_ENTRY_CAP = 20;
 var SESSION_WARN_AT = 5;
-function _isObject12(v) {
+function _isObject11(v) {
   return v !== null && v !== void 0 && typeof v === "object" && !Array.isArray(v);
 }
 var _PATH_KEYS2 = ["file_path", "path", "target_file", "filePath", "notebook_path"];
@@ -28070,7 +27714,7 @@ function added_entries(tool_input, on_disk) {
   }
   return 0;
 }
-function decide3(kind, rel_path, session_total, added) {
+function decide2(kind, rel_path, session_total, added) {
   if (kind === null || added <= 0) {
     return { action: "allow", reason: "" };
   }
@@ -28119,10 +27763,10 @@ function bump_session(root, session, key, added) {
   return total;
 }
 function _extract2(envelope) {
-  const payload = _isObject12(envelope["payload"]) ? envelope["payload"] : envelope;
+  const payload = _isObject11(envelope["payload"]) ? envelope["payload"] : envelope;
   const nameVal = payload["tool_name"] ?? payload["toolName"] ?? payload["tool"] ?? envelope["tool_name"] ?? envelope["tool"];
   const tool = typeof nameVal === "string" ? nameVal : "";
-  const ti = _isObject12(payload["tool_input"]) ? payload["tool_input"] : _isObject12(envelope["tool_input"]) ? envelope["tool_input"] : null;
+  const ti = _isObject11(payload["tool_input"]) ? payload["tool_input"] : _isObject11(envelope["tool_input"]) ? envelope["tool_input"] : null;
   const paths = [];
   if (ti !== null) {
     for (const key of _PATH_KEYS2) {
@@ -28142,7 +27786,7 @@ function main35() {
   } catch {
     return EXIT_ALLOW13;
   }
-  if (!_isObject12(envelope)) {
+  if (!_isObject11(envelope)) {
     return EXIT_ALLOW13;
   }
   const { tool, paths, ti } = _extract2(envelope);
@@ -28172,21 +27816,21 @@ function main35() {
     }
     const rel = path60.relative(root, abs) || p;
     const total = kind === "allowlist" ? bump_session(root, session, rel, added) : added;
-    const d = decide3(kind, rel, total, added);
+    const d = decide2(kind, rel, total, added);
     if (d.action === "block") {
       process.stderr.write(`block-config-weakening: BLOCKED \u2014 ${d.reason}
 `);
-      return EXIT_BLOCK3;
+      return EXIT_BLOCK2;
     }
     if (d.action === "warn") {
       process.stdout.write(`${JSON.stringify({ decision: "warn", reason: d.reason })}
 `);
-      return EXIT_WARN4;
+      return EXIT_WARN5;
     }
   }
   return EXIT_ALLOW13;
 }
-function _isCliEntry29() {
+function _isCliEntry28() {
   if (true) {
     return false;
   }
@@ -28203,7 +27847,7 @@ function _isCliEntry29() {
     return false;
   }
 }
-if (_isCliEntry29() || process.argv[1] === _HERE6) {
+if (_isCliEntry28() || process.argv[1] === _HERE6) {
   process.exit(main35());
 }
 
@@ -28236,7 +27880,7 @@ var _PATH_KEYS3 = [
   "filePath",
   "notebook_path"
 ];
-function _isObject13(v) {
+function _isObject12(v) {
   return v !== null && v !== void 0 && typeof v === "object" && !Array.isArray(v);
 }
 var INBOX_RE = /(?:^|\/)agents\/tmp(?:\.old)?\/([^/]+)\/./;
@@ -28309,8 +27953,8 @@ function main36() {
     return 0;
   }
   try {
-    const payload = _isObject13(envelope["payload"]) ? envelope["payload"] : envelope;
-    const ti = _isObject13(payload["tool_input"]) ? payload["tool_input"] : _isObject13(envelope["tool_input"]) ? envelope["tool_input"] : null;
+    const payload = _isObject12(envelope["payload"]) ? envelope["payload"] : envelope;
+    const ti = _isObject12(payload["tool_input"]) ? payload["tool_input"] : _isObject12(envelope["tool_input"]) ? envelope["tool_input"] : null;
     if (ti === null) {
       return 0;
     }
@@ -28322,7 +27966,7 @@ function main36() {
         candidates.push(v);
       }
     }
-    const cmd = ti["command"] ?? (_isObject13(envelope["payload"]) ? envelope["payload"]["command"] : void 0);
+    const cmd = ti["command"] ?? (_isObject12(envelope["payload"]) ? envelope["payload"]["command"] : void 0);
     if (typeof cmd === "string" && cmd) {
       for (const tok of cmd.split(/[\s"'`(){};|&<>]+/)) {
         if (tok) {
@@ -28342,7 +27986,7 @@ function main36() {
   }
   return 0;
 }
-function _isCliEntry30() {
+function _isCliEntry29() {
   if (process.argv[1] === void 0) {
     return false;
   }
@@ -28355,7 +27999,7 @@ function _isCliEntry30() {
     return false;
   }
 }
-if (_isCliEntry30()) {
+if (_isCliEntry29()) {
   process.exit(main36());
 }
 
@@ -28475,7 +28119,7 @@ function detectRtkCached(options = {}) {
 // src/scripts/hooks/rtk_wrap_hook.ts
 var SETTINGS_FILE6 = ".agent-settings.yml";
 var EXIT_ALLOW14 = 0;
-var EXIT_WARN5 = 2;
+var EXIT_WARN6 = 2;
 var _RTK_PROGRAMS = /* @__PURE__ */ new Set([
   "git",
   "phpstan",
@@ -28500,7 +28144,7 @@ var _RTK_PROGRAMS = /* @__PURE__ */ new Set([
   "kubectl",
   "terraform"
 ]);
-function _isObject14(v) {
+function _isObject13(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function _enabled2(root) {
@@ -28559,8 +28203,8 @@ function rtk_available(env = process.env) {
   return false;
 }
 function _extract_command4(envelope) {
-  const payload = _isObject14(envelope["payload"]) ? envelope["payload"] : {};
-  const tool_input = _isObject14(payload["tool_input"]) ? payload["tool_input"] : {};
+  const payload = _isObject13(envelope["payload"]) ? envelope["payload"] : {};
+  const tool_input = _isObject13(payload["tool_input"]) ? payload["tool_input"] : {};
   for (const src of [tool_input["command"], payload["command"], envelope["command"]]) {
     if (typeof src === "string") return src;
   }
@@ -28663,7 +28307,7 @@ function main37() {
   } catch {
     return EXIT_ALLOW14;
   }
-  if (!_isObject14(envelope)) return EXIT_ALLOW14;
+  if (!_isObject13(envelope)) return EXIT_ALLOW14;
   const cwd = envelope["cwd"];
   const projectRoot = envelope["workspace_root"] ?? envelope["project_root"];
   const root = typeof cwd === "string" && cwd ? cwd : typeof projectRoot === "string" && projectRoot ? projectRoot : ".";
@@ -28676,7 +28320,7 @@ function main37() {
       const reason = `rtk is installed and wraps verbose CLI output (upstream reports 60\u201390% fewer output tokens). Re-run wrapped: \`rtk ${command.trim()}\`. (Skip for completeness-critical output like \`git diff\`.)`;
       process.stdout.write(`${_jsonReason(reason)}
 `);
-      return EXIT_WARN5;
+      return EXIT_WARN6;
     }
   }
   const cap = classifyCap(command);
@@ -28684,11 +28328,11 @@ function main37() {
     const reason = `Unbounded \`${cap.program}\` output: a tree-wide search can return hundreds of KB into context (measured here: 302 KB raw vs 21 KB bounded \u2014 internal/bench/rtk-savings/RESULTS.md). Prefer a bounded form \u2014 ${cap.hint}. Re-running unbounded is fine when completeness is required.`;
     process.stdout.write(`${_jsonReason(reason)}
 `);
-    return EXIT_WARN5;
+    return EXIT_WARN6;
   }
   return EXIT_ALLOW14;
 }
-function _isCliEntry31() {
+function _isCliEntry30() {
   if (true) {
     return false;
   }
@@ -28707,7 +28351,7 @@ function _isCliEntry31() {
     return false;
   }
 }
-if (_isCliEntry31()) {
+if (_isCliEntry30()) {
   process.exit(main37());
 }
 
@@ -29165,14 +28809,14 @@ var SLOP_RULES = [
     gated: (ctx) => ctx.has("brutalist", "uniform grid", "repetitive grid"),
     detect: ({ content }) => {
       const bodies = sectionBodies(content);
-      let run13 = 0;
+      let run12 = 0;
       let maxRun = 0;
       for (const b of bodies) {
         if (sectionSignature(b).mediaText) {
-          run13 += 1;
-          maxRun = Math.max(maxRun, run13);
+          run12 += 1;
+          maxRun = Math.max(maxRun, run12);
         } else {
-          run13 = 0;
+          run12 = 0;
         }
       }
       if (maxRun > 2) return [{ line: 1, snippet: `${maxRun} consecutive media+text sections` }];
@@ -29470,7 +29114,7 @@ if (invokedDirectly) main38();
 
 // src/scripts/hooks/design_pass_hook.ts
 var EXIT_ALLOW15 = 0;
-var EXIT_WARN6 = 2;
+var EXIT_WARN7 = 2;
 var SETTINGS_FILE7 = ".agent-settings.yml";
 var STATE_REL2 = path64.join("agents", "runtime", "state", "design-pass-hook.json");
 var AUDIT_REL = path64.join("agents", "runtime", "state", "ui-audit.json");
@@ -29514,7 +29158,7 @@ function auditIsFresh(root, target) {
     return false;
   }
 }
-function decide4(slot, findings, auditMissing, already, renderAvailable2) {
+function decide3(slot, findings, auditMissing, already, renderAvailable2) {
   const sig = (f) => `${f.file}::${f.rule}::${f.line}`;
   const fresh = findings.filter((f) => !already.has(sig(f)));
   const blocked = slot === "stop" ? fresh.filter((f) => f.severity === "P0") : [];
@@ -29630,7 +29274,7 @@ function main39() {
     scanFailed = String(err);
   }
   const auditMissing = targets.filter((t) => !auditIsFresh(root, t));
-  let result = decide4(slot, findings, auditMissing, new Set(state.surfaced), renderAvailable(root));
+  let result = decide3(slot, findings, auditMissing, new Set(state.surfaced), renderAvailable(root));
   if (scanFailed) {
     result = { ...result, verification: "unverified", degradation_reason: `detector unavailable: ${scanFailed}` };
   }
@@ -29642,7 +29286,7 @@ function main39() {
   }
   process.stdout.write(`${JSON.stringify({ reason: render(result) })}
 `);
-  return EXIT_WARN6;
+  return EXIT_WARN7;
 }
 if (process.argv[1] && pathToFileURL34(process.argv[1]).href === import.meta.url) {
   process.exit(main39());
@@ -29655,9 +29299,9 @@ import path65 from "node:path";
 import { fileURLToPath as fileURLToPath42, pathToFileURL as pathToFileURL35 } from "node:url";
 var SETTINGS_FILE8 = ".agent-settings.yml";
 var EXIT_ALLOW16 = 0;
-var EXIT_WARN7 = 2;
+var EXIT_WARN8 = 2;
 var DEGRADE_AFTER = 3;
-function isObject4(v) {
+function isObject5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function enabled3(root) {
@@ -29692,12 +29336,12 @@ function enabled3(root) {
 }
 function _unwrap2(envelope) {
   const inner = envelope["payload"];
-  return isObject4(inner) ? inner : envelope;
+  return isObject5(inner) ? inner : envelope;
 }
 function extract(outer) {
   const envelope = _unwrap2(outer);
   const ti = envelope["tool_input"] ?? envelope["toolInput"] ?? envelope["input"];
-  if (!isObject4(ti)) return null;
+  if (!isObject5(ti)) return null;
   const fileVal = ti["file_path"] ?? ti["path"] ?? ti["filePath"];
   const file = typeof fileVal === "string" ? fileVal : "";
   for (const key of ["content", "new_string", "new_str", "text", "newText"]) {
@@ -29713,7 +29357,7 @@ function readState2(root) {
   try {
     const t = fs65.readFileSync(stateFile(root), "utf-8");
     const parsed = JSON.parse(t);
-    return isObject4(parsed) ? parsed : {};
+    return isObject5(parsed) ? parsed : {};
   } catch {
     return {};
   }
@@ -29737,7 +29381,7 @@ function main40() {
   } catch {
     return EXIT_ALLOW16;
   }
-  if (!isObject4(envelope)) return EXIT_ALLOW16;
+  if (!isObject5(envelope)) return EXIT_ALLOW16;
   const rootVal = envelope["cwd"] ?? envelope["project_root"] ?? ".";
   const root = typeof rootVal === "string" && rootVal ? rootVal : ".";
   if (!enabled3(root)) return EXIT_ALLOW16;
@@ -29771,9 +29415,9 @@ function main40() {
   const lines = surfaced.map((f) => `${f.catalogId} (${f.rule}) ${f.file}:${f.line} \u2014 ${f.message}`).join("; ");
   const reason = "\u26A0\uFE0F Anti-slop: high-severity aesthetic tell(s) in the proposed UI \u2014 " + lines + ". Rebuttable: declare intent in DESIGN.md, add design-slop-disable-next-line, or proceed if deliberate (this is a flag, not a block).";
   process.stdout.write(JSON.stringify({ decision: "warn", reason }) + "\n");
-  return EXIT_WARN7;
+  return EXIT_WARN8;
 }
-function _isCliEntry32() {
+function _isCliEntry31() {
   if (true) {
     return false;
   }
@@ -29792,8 +29436,8 @@ function _isCliEntry32() {
     return false;
   }
 }
-var isCliEntry10 = _isCliEntry32();
-if (isCliEntry10) process.exit(main40());
+var isCliEntry11 = _isCliEntry31();
+if (isCliEntry11) process.exit(main40());
 
 // src/scripts/hooks/code_graph_nudge_hook.ts
 import fs67 from "node:fs";
@@ -29808,7 +29452,18 @@ import * as path66 from "node:path";
 // src/scripts/code_graph/validate.ts
 var RELATIONS = /* @__PURE__ */ new Set(["calls", "imports", "uses", "inherits", "member"]);
 var CONFIDENCES = /* @__PURE__ */ new Set(["EXTRACTED", "INFERRED", "AMBIGUOUS"]);
-var KINDS = /* @__PURE__ */ new Set(["file", "class", "interface", "trait", "function", "method", "skipped"]);
+var KINDS = /* @__PURE__ */ new Set([
+  "file",
+  "class",
+  "interface",
+  "trait",
+  "function",
+  "method",
+  "constant",
+  "type",
+  "enum",
+  "skipped"
+]);
 function validateGraph(g) {
   const errors = [];
   const push = (m) => {
@@ -29933,9 +29588,9 @@ function pickSource(verdicts) {
 // src/scripts/hooks/code_graph_nudge_hook.ts
 var SETTINGS_FILE9 = ".agent-settings.yml";
 var EXIT_ALLOW17 = 0;
-var EXIT_WARN8 = 2;
+var EXIT_WARN9 = 2;
 var CODE_EXT = /\.(php|ts|tsx|mts|cts|js|jsx|mjs|cjs)$/i;
-function isObject5(v) {
+function isObject6(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function enabled4(root) {
@@ -29969,13 +29624,13 @@ function enabled4(root) {
   return false;
 }
 function classifyTool(envelope) {
-  const payload = isObject5(envelope["payload"]) ? envelope["payload"] : envelope;
+  const payload = isObject6(envelope["payload"]) ? envelope["payload"] : envelope;
   const nameVal = payload["tool_name"] ?? payload["toolName"] ?? payload["tool"] ?? envelope["tool_name"] ?? envelope["tool"];
   const name = typeof nameVal === "string" ? nameVal : "";
-  const ti = isObject5(payload["tool_input"]) ? payload["tool_input"] : envelope["tool_input"];
+  const ti = isObject6(payload["tool_input"]) ? payload["tool_input"] : envelope["tool_input"];
   const isSearch = name === "Grep" || name === "Glob";
   let isCodeRead = false;
-  if (name === "Read" && isObject5(ti)) {
+  if (name === "Read" && isObject6(ti)) {
     const fp = ti["file_path"] ?? ti["path"];
     if (typeof fp === "string") isCodeRead = CODE_EXT.test(fp);
   }
@@ -30030,7 +29685,7 @@ function main41() {
   } catch {
     return EXIT_ALLOW17;
   }
-  if (!isObject5(envelope)) return EXIT_ALLOW17;
+  if (!isObject6(envelope)) return EXIT_ALLOW17;
   const cwd = envelope["cwd"];
   const pr = envelope["workspace_root"] ?? envelope["project_root"];
   const root = typeof cwd === "string" && cwd ? cwd : typeof pr === "string" && pr ? pr : ".";
@@ -30048,9 +29703,9 @@ function main41() {
   latch(root, session);
   process.stdout.write(`${JSON.stringify({ decision: "warn", reason })}
 `);
-  return EXIT_WARN8;
+  return EXIT_WARN9;
 }
-function isCliEntry11() {
+function isCliEntry12() {
   if (true) {
     return false;
   }
@@ -30063,7 +29718,7 @@ function isCliEntry11() {
     return false;
   }
 }
-if (isCliEntry11()) process.exit(main41());
+if (isCliEntry12()) process.exit(main41());
 
 // src/scripts/hooks/suggestion_capture_hook.ts
 import fs68 from "node:fs";
@@ -30074,7 +29729,7 @@ var SETTINGS_FILE10 = ".agent-settings.yml";
 var SINK_REL = path68.join("agents", "runtime", "state", "audit", "suggestion-capture.jsonl");
 var LATCH_REL = path68.join("agents", "runtime", "state", "suggestion-latch.json");
 var LATCH_TTL_MS = 15 * 60 * 1e3;
-var isObject6 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isObject7 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var str3 = (v) => typeof v === "string" ? v : "";
 function detectBlock(text) {
   if (text === "") return { emitted: false, optionsCount: 0 };
@@ -30153,7 +29808,7 @@ function consumeLatch(root) {
   }
   try {
     const v = JSON.parse(raw);
-    if (!isObject6(v)) return null;
+    if (!isObject7(v)) return null;
     const at = v["at"];
     const oc = v["options_count"];
     const pid = v["prompt_id"];
@@ -30256,7 +29911,7 @@ function main42(_argv = [], now = /* @__PURE__ */ new Date()) {
   }
   return EXIT_ALLOW18;
 }
-function isCliEntry12() {
+function isCliEntry13() {
   if (true) return false;
   if (process.argv[1] === void 0) return false;
   const argvUrl = pathToFileURL37(path68.resolve(process.argv[1])).href;
@@ -30267,7 +29922,7 @@ function isCliEntry12() {
     return false;
   }
 }
-if (isCliEntry12()) process.exit(main42());
+if (isCliEntry13()) process.exit(main42());
 
 // src/scripts/hooks/ui_route_nudge_hook.ts
 import * as fs70 from "node:fs";
@@ -30340,7 +29995,7 @@ function leanProjectionModeRaw(root) {
 
 // src/scripts/hooks/ui_route_nudge_hook.ts
 var EXIT_ALLOW19 = 0;
-var EXIT_WARN9 = 2;
+var EXIT_WARN10 = 2;
 var MAX_NUDGES = 2;
 var DESIGN_SURFACES = [
   "fe-design",
@@ -30348,17 +30003,17 @@ var DESIGN_SURFACES = [
   "design-review",
   "design-intelligence"
 ];
-function isObject7(v) {
+function isObject8(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-function unwrap2(envelope) {
+function unwrap3(envelope) {
   const inner = envelope["payload"];
-  return isObject7(inner) ? inner : envelope;
+  return isObject8(inner) ? inner : envelope;
 }
 function extractEvent(outer) {
-  const envelope = unwrap2(outer);
+  const envelope = unwrap3(outer);
   const ti = envelope["tool_input"] ?? envelope["toolInput"] ?? envelope["input"];
-  if (!isObject7(ti)) return null;
+  if (!isObject8(ti)) return null;
   const fileVal = ti["file_path"] ?? ti["path"] ?? ti["filePath"];
   const file = typeof fileVal === "string" ? fileVal : "";
   let isWrite = false;
@@ -30414,7 +30069,7 @@ function writeState3(root, session, state) {
   } catch {
   }
 }
-function decide5(event, state) {
+function decide4(event, state) {
   if (isConsultation(event)) {
     return { state: { ...state, consulted: true }, warn: false };
   }
@@ -30438,7 +30093,7 @@ function main43() {
   } catch {
     return EXIT_ALLOW19;
   }
-  if (!isObject7(envelope)) return EXIT_ALLOW19;
+  if (!isObject8(envelope)) return EXIT_ALLOW19;
   const rootVal = envelope["workspace_root"];
   const root = typeof rootVal === "string" && rootVal ? rootVal : process.cwd();
   if (!hookSectionEnabled(root, "ui_route_nudge")) return EXIT_ALLOW19;
@@ -30447,21 +30102,21 @@ function main43() {
   const event = extractEvent(envelope);
   if (!event) return EXIT_ALLOW19;
   const before = readState3(root, session);
-  const { state, warn } = decide5(event, before);
+  const { state, warn } = decide4(event, before);
   if (stateChanged(before, state)) {
     writeState3(root, session, state);
   }
   if (!warn) return EXIT_ALLOW19;
   process.stdout.write(`${JSON.stringify({ reason: nudgeReason2(event.file) })}
 `);
-  return EXIT_WARN9;
+  return EXIT_WARN10;
 }
-function isCliEntry13() {
+function isCliEntry14() {
   const entry = process.argv[1];
   if (!entry) return false;
   return pathToFileURL38(path70.resolve(entry)).href === import.meta.url;
 }
-if (isCliEntry13()) process.exit(main43());
+if (isCliEntry14()) process.exit(main43());
 var _HOOK_FILE = fileURLToPath45(import.meta.url);
 
 // src/scripts/hooks/orchestration_record_hook.ts
@@ -30854,13 +30509,13 @@ if (process.argv[1] !== void 0) {
 
 // src/scripts/hooks/orchestration_record_hook.ts
 var EXIT_ALLOW20 = 0;
-function isObject8(v) {
+function isObject9(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 var DISPATCH_TOOL_NAMES = /* @__PURE__ */ new Set(["Agent", "Task"]);
 function unwrapPayload2(envelope) {
   const inner = envelope["payload"];
-  return isObject8(inner) ? inner : envelope;
+  return isObject9(inner) ? inner : envelope;
 }
 function extractToolName2(payload) {
   const v = payload["tool_name"] ?? payload["toolName"] ?? payload["tool"];
@@ -30868,12 +30523,12 @@ function extractToolName2(payload) {
 }
 function extractToolInput(payload) {
   const v = payload["tool_input"] ?? payload["toolInput"];
-  return isObject8(v) ? v : null;
+  return isObject9(v) ? v : null;
 }
 function extractToolResult(payload) {
   for (const key of ["tool_response", "toolResponse", "tool_result", "toolUseResult"]) {
     const v = payload[key];
-    if (isObject8(v)) return v;
+    if (isObject9(v)) return v;
   }
   return null;
 }
@@ -30894,7 +30549,7 @@ function extractDispatchFacts(payload) {
   const result = extractToolResult(payload);
   const resolvedModel = result && typeof result["resolvedModel"] === "string" ? result["resolvedModel"] : null;
   let totalTokens = result ? numOrNull(result["totalTokens"]) : null;
-  if (totalTokens === null && result && isObject8(result["usage"])) {
+  if (totalTokens === null && result && isObject9(result["usage"])) {
     const usage = result["usage"];
     const inTok = numOrNull(usage["input_tokens"]);
     const outTok = numOrNull(usage["output_tokens"]);
@@ -30955,7 +30610,7 @@ function appendLine(consumerRoot, ts, line) {
 }
 function processEnvelope2(envelope, consumer_root) {
   try {
-    if (!isObject8(envelope)) return EXIT_ALLOW20;
+    if (!isObject9(envelope)) return EXIT_ALLOW20;
     const payload = unwrapPayload2(envelope);
     const toolName2 = extractToolName2(payload);
     if (toolName2 === null || !DISPATCH_TOOL_NAMES.has(toolName2)) return EXIT_ALLOW20;
@@ -30972,7 +30627,7 @@ function processEnvelope2(envelope, consumer_root) {
   return EXIT_ALLOW20;
 }
 function _resolveRoot2(envelope) {
-  if (isObject8(envelope)) {
+  if (isObject9(envelope)) {
     const cwd = envelope["cwd"];
     if (typeof cwd === "string" && cwd) return cwd;
     const pr = envelope["workspace_root"] ?? envelope["project_root"];
@@ -30990,7 +30645,7 @@ function main45() {
   }
   return processEnvelope2(envelope, _resolveRoot2(envelope));
 }
-function _isCliEntry33() {
+function _isCliEntry32() {
   if (true) {
     return false;
   }
@@ -31003,7 +30658,7 @@ function _isCliEntry33() {
     return false;
   }
 }
-if (_isCliEntry33()) process.exit(main45());
+if (_isCliEntry32()) process.exit(main45());
 
 // src/scripts/hooks/telemetry_flush_hook.ts
 import * as fs73 from "node:fs";
@@ -31052,7 +30707,7 @@ function main46() {
   flushFor(_resolveRoot(envelope));
   return EXIT_ALLOW21;
 }
-function _isCliEntry34() {
+function _isCliEntry33() {
   if (true) {
     return false;
   }
@@ -31065,7 +30720,7 @@ function _isCliEntry34() {
     return false;
   }
 }
-if (_isCliEntry34()) process.exit(main46());
+if (_isCliEntry33()) process.exit(main46());
 
 // src/scripts/hooks/delegation_nudge_hook.ts
 import fs74 from "node:fs";
@@ -31400,8 +31055,8 @@ function resolveSubagentRouting(inp) {
 
 // src/scripts/hooks/delegation_nudge_hook.ts
 var EXIT_ALLOW22 = 0;
-var EXIT_WARN10 = 2;
-function _isObject15(v) {
+var EXIT_WARN11 = 2;
+function _isObject14(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 var FILE_TOKEN_RE = /`?\b[\w][\w.\-]{0,80}\.(ts|tsx|js|jsx|mjs|cjs|py|php|rb|go|rs|java|kt|swift|md|mdx|json|ya?ml|css|scss|less|html|vue|svelte|sql|sh|bash|c|cpp|h|hpp|cs|toml|xml)\b`?/gi;
@@ -31568,13 +31223,13 @@ function main47() {
   } catch {
     return EXIT_ALLOW22;
   }
-  const env = _isObject15(envelope) ? envelope : {};
+  const env = _isObject14(envelope) ? envelope : {};
   const event = env["event"];
   const slot = typeof event === "string" && event !== "" ? event : "user_prompt_submit";
   if (slot !== "user_prompt_submit") {
     return EXIT_ALLOW22;
   }
-  const payload = _isObject15(env["payload"]) ? env["payload"] : env;
+  const payload = _isObject14(env["payload"]) ? env["payload"] : env;
   const prompt = _extractPrompt2(payload);
   if (!prompt) {
     return EXIT_ALLOW22;
@@ -31597,9 +31252,9 @@ function main47() {
     })}
 `
   );
-  return EXIT_WARN10;
+  return EXIT_WARN11;
 }
-function _isCliEntry35() {
+function _isCliEntry34() {
   if (true) {
     return false;
   }
@@ -31618,7 +31273,7 @@ function _isCliEntry35() {
     return false;
   }
 }
-if (_isCliEntry35()) {
+if (_isCliEntry34()) {
   process.exit(main47());
 }
 
@@ -32191,7 +31846,7 @@ This is NOT "no skill matches": nothing was read, so no conclusion about skill c
   }
   return 0;
 }
-function _isCliEntry36() {
+function _isCliEntry35() {
   if (process.argv[1] === void 0) {
     return false;
   }
@@ -32207,18 +31862,18 @@ function _isCliEntry36() {
     return false;
   }
 }
-var _isMain5 = _isCliEntry36();
+var _isMain5 = _isCliEntry35();
 if (_isMain5) {
   process.exitCode = main48();
 }
 
 // src/scripts/hooks/skill_route_hook.ts
 var EXIT_ALLOW23 = 0;
-var EXIT_WARN11 = 2;
+var EXIT_WARN12 = 2;
 var MIN_TOP_SCORE = 31;
 var MIN_TASK_TERMS = 3;
 var TOP_K = 3;
-function _isObject16(v) {
+function _isObject15(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function knownBareForHost(workspaceRoot3, host) {
@@ -32284,11 +31939,11 @@ function main49() {
   } catch {
     return EXIT_ALLOW23;
   }
-  const env = _isObject16(envelope) ? envelope : {};
+  const env = _isObject15(envelope) ? envelope : {};
   const event = env["event"];
   const slot = typeof event === "string" && event !== "" ? event : "user_prompt_submit";
   if (slot !== "user_prompt_submit") return EXIT_ALLOW23;
-  const payload = _isObject16(env["payload"]) ? env["payload"] : env;
+  const payload = _isObject15(env["payload"]) ? env["payload"] : env;
   const prompt = _extractPrompt3(payload);
   if (!prompt) return EXIT_ALLOW23;
   if (isSyntheticPrompt(prompt)) return EXIT_ALLOW23;
@@ -32311,9 +31966,9 @@ function main49() {
     })}
 `
   );
-  return EXIT_WARN11;
+  return EXIT_WARN12;
 }
-function _isCliEntry37() {
+function _isCliEntry36() {
   if (true) return false;
   if (process.argv[1] === void 0) return false;
   const argvUrl = pathToFileURL44(path77.resolve(process.argv[1])).href;
@@ -32326,7 +31981,7 @@ function _isCliEntry37() {
     return false;
   }
 }
-if (_isCliEntry37()) {
+if (_isCliEntry36()) {
   process.exit(main49());
 }
 
@@ -32617,10 +32272,10 @@ function selectForInjection(repoRoot, matches, capBytes, shortlist) {
 
 // src/scripts/hooks/rule_inject_hook.ts
 var EXIT_ALLOW24 = 0;
-var EXIT_WARN12 = 2;
+var EXIT_WARN13 = 2;
 var CAP_BYTES = 20480;
 var FILE_TOOLS = /* @__PURE__ */ new Set(["Write", "Edit", "NotebookEdit", "Read", "MultiEdit"]);
-function isObject9(v) {
+function isObject10(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function str5(o, ...keys) {
@@ -32668,7 +32323,7 @@ function extractPrompt(payload) {
 }
 function extractFilePath(payload) {
   const ti = payload["tool_input"] ?? payload["toolInput"] ?? payload["input"];
-  if (!isObject9(ti)) return null;
+  if (!isObject10(ti)) return null;
   return str5(ti, "file_path", "path", "filePath", "notebook_path");
 }
 function buildInjection(root, prompt, openFiles, command, seen) {
@@ -32713,12 +32368,12 @@ function main50(argv = process12.argv.slice(2)) {
   try {
     const raw = readHookStdin();
     const parsed = raw.trim() ? JSON.parse(raw) : {};
-    env = isObject9(parsed) ? parsed : {};
+    env = isObject10(parsed) ? parsed : {};
   } catch {
     return EXIT_ALLOW24;
   }
   const root = workspaceRoot2(env);
-  const payload = isObject9(env["payload"]) ? env["payload"] : env;
+  const payload = isObject10(env["payload"]) ? env["payload"] : env;
   const slot = eventOverride ?? str5(env, "event") ?? "user_prompt_submit";
   const session = str5(env, "session_id", "sessionId") ?? str5(payload, "session_id", "sessionId") ?? "unknown";
   if (slot === "pre_compact") {
@@ -32726,7 +32381,7 @@ function main50(argv = process12.argv.slice(2)) {
     return EXIT_ALLOW24;
   }
   if (slot !== "user_prompt_submit" && slot !== "pre_tool_use") return EXIT_ALLOW24;
-  if (!gateOpen(root, _isCliEntry38())) return EXIT_ALLOW24;
+  if (!gateOpen(root, _isCliEntry37())) return EXIT_ALLOW24;
   let prompt = "";
   let openFiles = null;
   let command = null;
@@ -32755,9 +32410,9 @@ function main50(argv = process12.argv.slice(2)) {
     })}
 `
   );
-  return EXIT_WARN12;
+  return EXIT_WARN13;
 }
-function _isCliEntry38() {
+function _isCliEntry37() {
   if (true) return false;
   if (process12.argv[1] === void 0) return false;
   const argvUrl = pathToFileURL45(path79.resolve(process12.argv[1])).href;
@@ -32768,7 +32423,7 @@ function _isCliEntry38() {
     return false;
   }
 }
-if (_isCliEntry38()) {
+if (_isCliEntry37()) {
   process12.exit(main50());
 }
 
@@ -32847,7 +32502,7 @@ function isSafeTranscriptPath(rawPath, opts = {}) {
     return false;
   }
 }
-var EXIT_WARN13 = 2;
+var EXIT_WARN14 = 2;
 function parseNumstat(raw) {
   const rows = [];
   for (const line of raw.split("\n")) {
@@ -32932,7 +32587,7 @@ function totalNonDocMutatedLinesWithMeasure(cwd) {
   );
   return { lines: trackedLines + untrackedLines, measure: "exact" };
 }
-function isObject10(v) {
+function isObject11(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function str6(v) {
@@ -32952,16 +32607,16 @@ function scanTranscriptForReviewer(transcriptText) {
     } catch {
       continue;
     }
-    if (!isObject10(obj) || obj["type"] !== "assistant") continue;
+    if (!isObject11(obj) || obj["type"] !== "assistant") continue;
     const msg = obj["message"];
-    if (!isObject10(msg)) continue;
+    if (!isObject11(msg)) continue;
     const content = msg["content"];
     if (!Array.isArray(content)) continue;
     for (const blk of content) {
-      if (!isObject10(blk) || blk["type"] !== "tool_use") continue;
+      if (!isObject11(blk) || blk["type"] !== "tool_use") continue;
       const name = str6(blk["name"]);
       const input = blk["input"];
-      const inputObj = isObject10(input) ? input : {};
+      const inputObj = isObject11(input) ? input : {};
       if (DISPATCH_TOOL_RE.test(name)) {
         const label = [
           str6(inputObj["description"]),
@@ -33081,9 +32736,9 @@ function main51() {
     })}
 `
   );
-  return EXIT_WARN13;
+  return EXIT_WARN14;
 }
-function _isCliEntry39() {
+function _isCliEntry38() {
   if (true) {
     return false;
   }
@@ -33102,7 +32757,7 @@ function _isCliEntry39() {
     return false;
   }
 }
-if (_isCliEntry39()) {
+if (_isCliEntry38()) {
   process.exit(main51());
 }
 
@@ -33218,7 +32873,7 @@ function validateResponse(input) {
 
 // src/scripts/hooks/subagent_ledger_hook.ts
 var EXIT_ALLOW25 = 0;
-function isObject11(v) {
+function isObject12(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 var LEDGER_DIR = path81.join("agents", "runtime", "state", "subagent-ledger");
@@ -33229,7 +32884,7 @@ function refFor(agentId) {
 }
 function unwrapPayload3(envelope) {
   const inner = envelope["payload"];
-  return isObject11(inner) ? inner : envelope;
+  return isObject12(inner) ? inner : envelope;
 }
 function str7(payload, ...keys) {
   for (const k of keys) {
@@ -33242,7 +32897,7 @@ function extractParentId(payload, ownId) {
   const explicit = str7(payload, "parent_agent_id", "parentAgentId");
   if (explicit) return explicit;
   const session = payload["session"];
-  if (isObject11(session)) {
+  if (isObject12(session)) {
     const sessionAgent = str7(session, "agent_id", "agentId");
     if (sessionAgent && sessionAgent !== ownId) return sessionAgent;
   }
@@ -33318,7 +32973,7 @@ function openFile(root, ref) {
 }
 var DEPTH_BASES = /* @__PURE__ */ new Set(["observed", "asserted-parent", "assumed-root"]);
 function _asOpenRecord(value, expectedRef) {
-  if (!isObject11(value)) return null;
+  if (!isObject12(value)) return null;
   const ref = value["ref"];
   if (typeof ref !== "string" || ref !== expectedRef) return null;
   if (typeof value["started_at"] !== "string") return null;
@@ -33545,7 +33200,7 @@ function handleStop(root, payload, nowIso, sessionId2) {
 }
 function processEnvelope3(envelope, consumerRoot) {
   try {
-    if (!isObject11(envelope)) return EXIT_ALLOW25;
+    if (!isObject12(envelope)) return EXIT_ALLOW25;
     const event = envelope["event"];
     if (event !== "subagent_start" && event !== "subagent_stop") return EXIT_ALLOW25;
     const payload = unwrapPayload3(envelope);
@@ -33560,7 +33215,7 @@ function processEnvelope3(envelope, consumerRoot) {
   return EXIT_ALLOW25;
 }
 function resolveConsumerRoot(envelope) {
-  if (isObject11(envelope)) {
+  if (isObject12(envelope)) {
     const pr = str7(envelope, "workspace_root", "project_root");
     if (pr) return pr;
     const payload = unwrapPayload3(envelope);
@@ -33579,7 +33234,7 @@ function main52() {
   }
   return processEnvelope3(envelope, resolveConsumerRoot(envelope));
 }
-function _isCliEntry40() {
+function _isCliEntry39() {
   if (true) {
     return false;
   }
@@ -33592,10 +33247,10 @@ function _isCliEntry40() {
     return false;
   }
 }
-if (_isCliEntry40()) process.exit(main52());
+if (_isCliEntry39()) process.exit(main52());
 
 // src/scripts/hooks/turn_end_gate_hook.ts
-var EXIT_BLOCK4 = 1;
+var EXIT_BLOCK3 = 1;
 var EXIT_ALLOW26 = 0;
 var TRANSCRIPT_READ_MAX_BYTES = 8 * 1024 * 1024;
 function stripFencedBlocks(text) {
@@ -33979,9 +33634,9 @@ ${lines.join("\n")}
   This turn will not be refused a second time.
 `
   );
-  return EXIT_BLOCK4;
+  return EXIT_BLOCK3;
 }
-function _isCliEntry41() {
+function _isCliEntry40() {
   if (true) {
     return false;
   }
@@ -34000,7 +33655,7 @@ function _isCliEntry41() {
     return false;
   }
 }
-if (_isCliEntry41()) {
+if (_isCliEntry40()) {
   process.exit(main53());
 }
 
@@ -34011,7 +33666,7 @@ import * as fs83 from "node:fs";
 import * as path83 from "node:path";
 import { fileURLToPath as fileURLToPath55, pathToFileURL as pathToFileURL49 } from "node:url";
 var EXIT_ALLOW27 = 0;
-var EXIT_WARN14 = 2;
+var EXIT_WARN15 = 2;
 var MIN_FILE_LINES = 50;
 var MAX_DIFF_RATIO = 0.2;
 var EXEMPT_PATH_PATTERNS = [
@@ -34026,7 +33681,7 @@ var EXEMPT_PATH_PATTERNS = [
   /(^|\/)agents\/runtime\//i
   // agents/runtime/**
 ];
-function isObject12(v) {
+function isObject13(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function str9(v) {
@@ -34101,7 +33756,7 @@ function extractToolName3(payload) {
 }
 function extractFilePath2(payload) {
   const ti = payload["tool_input"] ?? payload["toolInput"] ?? payload["input"];
-  if (!isObject12(ti)) return "";
+  if (!isObject13(ti)) return "";
   return str9(ti["file_path"] ?? ti["path"] ?? ti["filePath"]);
 }
 function main54() {
@@ -34133,12 +33788,12 @@ function main54() {
       })}
 `
     );
-    return EXIT_WARN14;
+    return EXIT_WARN15;
   } catch {
     return EXIT_ALLOW27;
   }
 }
-function _isCliEntry42() {
+function _isCliEntry41() {
   if (true) {
     return false;
   }
@@ -34157,7 +33812,7 @@ function _isCliEntry42() {
     return false;
   }
 }
-if (_isCliEntry42()) {
+if (_isCliEntry41()) {
   process.exit(main54());
 }
 
@@ -34825,12 +34480,12 @@ if (_isMain6) process14.exit(main55(process14.argv.slice(2)));
 
 // src/scripts/hooks/comment_discipline_hook.ts
 var EXIT_ALLOW28 = 0;
-var EXIT_WARN15 = 2;
+var EXIT_WARN16 = 2;
 var MAX_REPORTED = 3;
 function str10(v) {
   return typeof v === "string" ? v : "";
 }
-function isObject13(v) {
+function isObject14(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function writtenText(toolName2, toolInput) {
@@ -34858,7 +34513,7 @@ function main56() {
     );
     if (toolName2 !== "Write" && toolName2 !== "Edit") return EXIT_ALLOW28;
     const ti = payload["tool_input"] ?? payload["toolInput"] ?? payload["input"];
-    if (!isObject13(ti)) return EXIT_ALLOW28;
+    if (!isObject14(ti)) return EXIT_ALLOW28;
     const filePath = str10(ti["file_path"] ?? ti["path"] ?? ti["filePath"]);
     if (!filePath || !isScannable(filePath)) return EXIT_ALLOW28;
     const text = writtenText(toolName2, ti);
@@ -34877,12 +34532,12 @@ function main56() {
       })}
 `
     );
-    return EXIT_WARN15;
+    return EXIT_WARN16;
   } catch {
     return EXIT_ALLOW28;
   }
 }
-function _isCliEntry43() {
+function _isCliEntry42() {
   if (true) return false;
   if (process.argv[1] === void 0) return false;
   const argvUrl = pathToFileURL50(path86.resolve(process.argv[1])).href;
@@ -34893,7 +34548,7 @@ function _isCliEntry43() {
     return false;
   }
 }
-if (_isCliEntry43()) process.exit(main56());
+if (_isCliEntry42()) process.exit(main56());
 
 // src/scripts/hooks/reread_guard_hook.ts
 import * as crypto12 from "node:crypto";
@@ -34901,7 +34556,7 @@ import * as fs86 from "node:fs";
 import * as path87 from "node:path";
 import { fileURLToPath as fileURLToPath58, pathToFileURL as pathToFileURL51 } from "node:url";
 var EXIT_ALLOW29 = 0;
-var EXIT_WARN16 = 2;
+var EXIT_WARN17 = 2;
 var EXEMPT_PATH_PATTERNS2 = [
   /(^|\/)dist\//i,
   // dist/**
@@ -34916,7 +34571,7 @@ var EXEMPT_PATH_PATTERNS2 = [
 ];
 var READ_TOOLS = /* @__PURE__ */ new Set(["Read"]);
 var WRITE_TOOLS2 = /* @__PURE__ */ new Set(["Edit", "Write"]);
-function isObject14(v) {
+function isObject15(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function str11(v) {
@@ -34940,11 +34595,11 @@ function ledgerFile(workspaceRoot3, sessionKey) {
 function readLedger(workspaceRoot3, sessionKey) {
   try {
     const parsed = JSON.parse(fs86.readFileSync(ledgerFile(workspaceRoot3, sessionKey), "utf8"));
-    if (!isObject14(parsed)) return emptyLedger();
+    if (!isObject15(parsed)) return emptyLedger();
     return {
-      reads: isObject14(parsed["reads"]) ? parsed["reads"] : {},
-      writes: isObject14(parsed["writes"]) ? parsed["writes"] : {},
-      fired: isObject14(parsed["fired"]) ? parsed["fired"] : {}
+      reads: isObject15(parsed["reads"]) ? parsed["reads"] : {},
+      writes: isObject15(parsed["writes"]) ? parsed["writes"] : {},
+      fired: isObject15(parsed["fired"]) ? parsed["fired"] : {}
     };
   } catch {
     return emptyLedger();
@@ -34961,7 +34616,7 @@ function extractToolName4(payload) {
 }
 function extractToolInput2(payload) {
   const ti = payload["tool_input"] ?? payload["toolInput"] ?? payload["input"];
-  return isObject14(ti) ? ti : {};
+  return isObject15(ti) ? ti : {};
 }
 function extractFilePath3(toolInput) {
   return str11(toolInput["file_path"] ?? toolInput["path"] ?? toolInput["filePath"]);
@@ -35038,12 +34693,12 @@ function main57() {
       })}
 `
     );
-    return EXIT_WARN16;
+    return EXIT_WARN17;
   } catch {
     return EXIT_ALLOW29;
   }
 }
-function _isCliEntry44() {
+function _isCliEntry43() {
   if (true) {
     return false;
   }
@@ -35062,7 +34717,7 @@ function _isCliEntry44() {
     return false;
   }
 }
-if (_isCliEntry44()) {
+if (_isCliEntry43()) {
   process.exit(main57());
 }
 
@@ -35473,7 +35128,7 @@ function writeCheckpoint(repoRoot, cp) {
 }
 
 // src/scripts/hooks/session_eol_hook.ts
-var EXIT_WARN17 = 2;
+var EXIT_WARN18 = 2;
 var THRESHOLD_OVERRIDE_ENV = "AGENT_RECYCLE_THRESHOLD_TOKENS";
 var CONTEXT_FILL_REL = path93.join("agents", "runtime", "state", "context-fill.json");
 function str12(value) {
@@ -35625,7 +35280,7 @@ function main58() {
       })}
 `
     );
-    return EXIT_WARN17;
+    return EXIT_WARN18;
   }
   if (shouldWarnMissing) {
     process15.stdout.write(
@@ -35636,11 +35291,11 @@ function main58() {
       })}
 `
     );
-    return EXIT_WARN17;
+    return EXIT_WARN18;
   }
   return 0;
 }
-function _isCliEntry45() {
+function _isCliEntry44() {
   if (true) {
     return false;
   }
@@ -35659,7 +35314,7 @@ function _isCliEntry45() {
     return false;
   }
 }
-if (_isCliEntry45()) {
+if (_isCliEntry44()) {
   process15.exit(main58());
 }
 
@@ -35668,7 +35323,7 @@ import * as fs92 from "node:fs";
 import * as path94 from "node:path";
 import { fileURLToPath as fileURLToPath60, pathToFileURL as pathToFileURL53 } from "node:url";
 var EXIT_ALLOW30 = 0;
-function isObject15(v) {
+function isObject16(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 var CENSUS_FILE = path94.join("agents", "runtime", "state", "tool-result-census.jsonl");
@@ -35703,7 +35358,7 @@ function _toolName(payload, envelope) {
 }
 function unwrapPayload4(envelope) {
   const inner = envelope["payload"];
-  return isObject15(inner) ? inner : envelope;
+  return isObject16(inner) ? inner : envelope;
 }
 function censusFile(consumerRoot) {
   return path94.join(consumerRoot, CENSUS_FILE);
@@ -35717,7 +35372,7 @@ function _appendCensusLine(consumerRoot, line) {
 }
 function processEnvelope4(envelope, consumerRoot) {
   try {
-    if (!isObject15(envelope)) return EXIT_ALLOW30;
+    if (!isObject16(envelope)) return EXIT_ALLOW30;
     if (envelope["event"] !== "post_tool_use") return EXIT_ALLOW30;
     const payload = unwrapPayload4(envelope);
     const bytes = _resultBytes(payload);
@@ -35733,7 +35388,7 @@ function processEnvelope4(envelope, consumerRoot) {
   return EXIT_ALLOW30;
 }
 function resolveConsumerRoot2(envelope) {
-  if (isObject15(envelope)) {
+  if (isObject16(envelope)) {
     for (const key of ["workspace_root", "project_root"]) {
       const v = envelope[key];
       if (typeof v === "string" && v) return v;
@@ -35753,7 +35408,7 @@ function main59() {
   }
   return processEnvelope4(envelope, resolveConsumerRoot2(envelope));
 }
-function _isCliEntry46() {
+function _isCliEntry45() {
   if (true) {
     return false;
   }
@@ -35766,14 +35421,14 @@ function _isCliEntry46() {
     return false;
   }
 }
-if (_isCliEntry46()) process.exit(main59());
+if (_isCliEntry45()) process.exit(main59());
 
 // src/scripts/hooks/spawn_guard_shadow_hook.ts
 import * as fs93 from "node:fs";
 import * as path95 from "node:path";
 import { fileURLToPath as fileURLToPath61, pathToFileURL as pathToFileURL54 } from "node:url";
 var EXIT_ALLOW31 = 0;
-function isObject16(v) {
+function isObject17(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 var DISPATCH_TOOL_NAMES2 = /* @__PURE__ */ new Set(["Agent", "Task"]);
@@ -35792,7 +35447,7 @@ function evaluateCandidates(depthEstimate, concurrentOpen) {
 }
 function unwrapPayload5(envelope) {
   const inner = envelope["payload"];
-  return isObject16(inner) ? inner : envelope;
+  return isObject17(inner) ? inner : envelope;
 }
 function extractToolName5(payload) {
   const v = payload["tool_name"] ?? payload["toolName"] ?? payload["tool"];
@@ -35800,7 +35455,7 @@ function extractToolName5(payload) {
 }
 function processEnvelope5(envelope, consumerRoot) {
   try {
-    if (!isObject16(envelope)) return EXIT_ALLOW31;
+    if (!isObject17(envelope)) return EXIT_ALLOW31;
     const payload = unwrapPayload5(envelope);
     const toolName2 = extractToolName5(payload);
     if (toolName2 === null || !DISPATCH_TOOL_NAMES2.has(toolName2)) return EXIT_ALLOW31;
@@ -35845,7 +35500,7 @@ function main60() {
   }
   return processEnvelope5(envelope, resolveConsumerRoot(envelope));
 }
-function _isCliEntry47() {
+function _isCliEntry46() {
   if (true) return false;
   if (process.argv[1] === void 0) return false;
   const argvUrl = pathToFileURL54(path95.resolve(process.argv[1])).href;
@@ -35856,7 +35511,7 @@ function _isCliEntry47() {
     return false;
   }
 }
-if (_isCliEntry47()) process.exit(main60());
+if (_isCliEntry46()) process.exit(main60());
 
 // src/scripts/hooks/source_first_gate_hook.ts
 import * as fs94 from "node:fs";
@@ -35866,12 +35521,12 @@ var EXIT_ALLOW32 = 0;
 var MAX_SHADOW_WARNS = 2;
 var SHADOW_LOG = path96.join("agents", "runtime", "state", "source-first-gate.jsonl");
 var STATE_FILE9 = path96.join("agents", "runtime", "state", "source-first-gate.json");
-function isObject17(v) {
+function isObject18(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function unwrapPayload6(envelope) {
   const inner = envelope["payload"];
-  return isObject17(inner) ? inner : envelope;
+  return isObject18(inner) ? inner : envelope;
 }
 var TOOL_MATCHERS = [
   { pattern: /^browser_take_screenshot$/i, hit: { label: "playwright-mcp", capture_kind: "page" } },
@@ -35899,11 +35554,11 @@ function str13(o, ...keys) {
   return null;
 }
 function extractEvent2(outer) {
-  if (!isObject17(outer)) return null;
+  if (!isObject18(outer)) return null;
   const payload = unwrapPayload6(outer);
   const toolName2 = str13(payload, "tool_name", "toolName", "tool");
   const ti = payload["tool_input"] ?? payload["toolInput"] ?? payload["input"];
-  const input = isObject17(ti) ? ti : {};
+  const input = isObject18(ti) ? ti : {};
   const file = str13(input, "file_path", "path", "filePath") ?? "";
   let isWrite = false;
   for (const key of ["content", "new_string", "new_str", "text", "newText"]) {
@@ -35957,7 +35612,7 @@ function writeState4(root, session, state) {
       all = JSON.parse(fs94.readFileSync(file, "utf-8"));
     } catch {
     }
-    if (!isObject17(all)) all = {};
+    if (!isObject18(all)) all = {};
     all[session] = state;
     const keys = Object.keys(all);
     if (keys.length > MAX_SESSIONS2) {
@@ -36066,11 +35721,11 @@ function main61() {
   } catch {
     return EXIT_ALLOW32;
   }
-  const sessionVal = isObject17(envelope) ? envelope["session_id"] : null;
+  const sessionVal = isObject18(envelope) ? envelope["session_id"] : null;
   const session = typeof sessionVal === "string" && sessionVal ? sessionVal : "unknown";
   return processEnvelope6(envelope, resolveConsumerRoot(envelope), session);
 }
-function _isCliEntry48() {
+function _isCliEntry47() {
   if (true) return false;
   if (process.argv[1] === void 0) return false;
   const argvUrl = pathToFileURL55(path96.resolve(process.argv[1])).href;
@@ -36081,7 +35736,7 @@ function _isCliEntry48() {
     return false;
   }
 }
-if (_isCliEntry48()) process.exit(main61());
+if (_isCliEntry47()) process.exit(main61());
 
 // src/scripts/hooks/interruption_ledger_hook.ts
 import * as fs95 from "node:fs";
@@ -36194,7 +35849,7 @@ function main62() {
   }
   return EXIT_OK2;
 }
-function _isCliEntry49() {
+function _isCliEntry48() {
   if (process.argv[1] === void 0) {
     return false;
   }
@@ -36210,7 +35865,7 @@ function _isCliEntry49() {
     return false;
   }
 }
-if (_isCliEntry49()) {
+if (_isCliEntry48()) {
   process.exit(main62());
 }
 
@@ -36325,7 +35980,7 @@ function parseHaltStamp(v) {
 
 // src/scripts/hooks/run_continuation_hook.ts
 var EXIT_ALLOW33 = 0;
-var EXIT_BLOCK5 = 1;
+var EXIT_BLOCK4 = 1;
 var BLOCKED_BY_MARKER = /<!--\s*blocked-by:\s*\S[^>]*-->/;
 var LEDGER_TAIL_MAX_BYTES = 512 * 1024;
 var EVENTS_RELPATH = path99.join(
@@ -36739,7 +36394,7 @@ function main63() {
   const scan = scanOpenSteps(roadmapText);
   if (isDuplicateFire(prev, turnOrdinal, scan.open, Date.now(), roadmapFile)) {
     process.stderr.write(_continuationText(slug, scan, state.iterations));
-    return EXIT_BLOCK5;
+    return EXIT_BLOCK4;
   }
   if (state.history_source !== roadmapFile) {
     state.history = [];
@@ -36816,7 +36471,7 @@ function main63() {
     ...roots
   });
   process.stderr.write(_continuationText(slug, scan, state.iterations));
-  return EXIT_BLOCK5;
+  return EXIT_BLOCK4;
 }
 function _continuationText(slug, scan, iteration) {
   const stepLine = scan.next ? `Next step: ${scan.next.text}` + (scan.next.verify ? `
@@ -36826,7 +36481,7 @@ ${stepLine}
 Continue with this step now: do the work, run its verify line, flip the box, then end the turn. Escalate instead of continuing ONLY for a locked decision class (high_impact / user_required) or a halt your contract names.
 `;
 }
-function _isCliEntry50() {
+function _isCliEntry49() {
   if (true) {
     return false;
   }
@@ -36841,7 +36496,7 @@ function _isCliEntry50() {
     return false;
   }
 }
-if (_isCliEntry50()) {
+if (_isCliEntry49()) {
   process.exit(main63());
 }
 
@@ -37216,12 +36871,12 @@ function recordEvent(h, input) {
 // src/scripts/hooks/journal_record_hook.ts
 var EXIT_ALLOW34 = 0;
 var SETTINGS_SECTION = "runtime_journal";
-function isObject18(v) {
+function isObject19(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function unwrapPayload7(envelope) {
   const inner = envelope["payload"];
-  return isObject18(inner) ? inner : envelope;
+  return isObject19(inner) ? inner : envelope;
 }
 function firstString(envelope, payload, keys) {
   for (const source of [envelope, payload]) {
@@ -37264,7 +36919,7 @@ function reduceEnvelope(envelope) {
   };
 }
 function resolveConsumerRoot3(envelope) {
-  if (isObject18(envelope)) {
+  if (isObject19(envelope)) {
     for (const key of ["workspace_root", "project_root"]) {
       const v = envelope[key];
       if (typeof v === "string" && v) return v;
@@ -37276,7 +36931,7 @@ function resolveConsumerRoot3(envelope) {
 }
 function processEnvelope7(envelope, consumerRoot) {
   try {
-    if (!isObject18(envelope)) return EXIT_ALLOW34;
+    if (!isObject19(envelope)) return EXIT_ALLOW34;
     if (is_replay_mode()) return EXIT_ALLOW34;
     if (!hookSectionEnabled(consumerRoot, SETTINGS_SECTION)) return EXIT_ALLOW34;
     if (!isJournalAvailable()) return EXIT_ALLOW34;
@@ -37306,7 +36961,7 @@ function main64() {
   }
   return processEnvelope7(envelope, resolveConsumerRoot3(envelope));
 }
-function _isCliEntry51() {
+function _isCliEntry50() {
   if (true) {
     return false;
   }
@@ -37319,7 +36974,7 @@ function _isCliEntry51() {
     return false;
   }
 }
-if (_isCliEntry51()) process.exit(main64());
+if (_isCliEntry50()) process.exit(main64());
 
 // src/scripts/hooks/concern_registry.ts
 var CONCERN_REGISTRY = {
@@ -37340,14 +36995,14 @@ var CONCERN_REGISTRY = {
   "src/scripts/surface_probe_hook.ts": main20,
   "src/scripts/team_review_gate_hook.ts": main21,
   "src/scripts/pr_url_reminder_hook.ts": main22,
-  "src/scripts/session_canary_hook.ts": main23,
-  "src/scripts/council_availability_hook.ts": main24,
-  "src/scripts/telemetry_disclosure_hook.ts": main26,
-  "src/scripts/self_repair_hook.ts": main27,
-  "src/scripts/session_register_hook.ts": main28,
-  "src/scripts/language_mirror_hook.ts": main29,
-  "src/scripts/git_authorization_hook.ts": main30,
-  "src/scripts/hooks/block_unauthorized_git.ts": main31,
+  "src/scripts/hooks/push_settle_hook.ts": main23,
+  "src/scripts/session_canary_hook.ts": main24,
+  "src/scripts/council_availability_hook.ts": main25,
+  "src/scripts/telemetry_disclosure_hook.ts": main27,
+  "src/scripts/self_repair_hook.ts": main28,
+  "src/scripts/session_register_hook.ts": main29,
+  "src/scripts/language_mirror_hook.ts": main30,
+  "src/scripts/git_authorization_hook.ts": main31,
   "src/scripts/hooks/evidence_independence.ts": main32,
   "src/scripts/hooks/block_no_verify.ts": main33,
   "src/scripts/hooks/block_kernel_rule_writes.ts": main34,
@@ -37360,7 +37015,7 @@ var CONCERN_REGISTRY = {
   "src/scripts/hooks/suggestion_capture_hook.ts": main42,
   "src/scripts/hooks/ui_route_nudge_hook.ts": main43,
   "src/scripts/hooks/orchestration_record_hook.ts": main45,
-  "src/scripts/hooks/telemetry_usage_hook.ts": main25,
+  "src/scripts/hooks/telemetry_usage_hook.ts": main26,
   "src/scripts/hooks/telemetry_flush_hook.ts": main46,
   "src/scripts/hooks/delegation_nudge_hook.ts": main47,
   "src/scripts/hooks/skill_route_hook.ts": main49,
@@ -37745,8 +37400,8 @@ var REPO_ROOT = path104.resolve(
 );
 var MANIFEST_PATH = path104.join(REPO_ROOT, "src", "scripts", "hook_manifest.yaml");
 var EXIT_ALLOW35 = 0;
-var EXIT_BLOCK6 = 1;
-var EXIT_WARN18 = 2;
+var EXIT_BLOCK5 = 1;
+var EXIT_WARN19 = 2;
 var EVENT_VOCABULARY = /* @__PURE__ */ new Set([
   "session_start",
   "session_end",
@@ -37761,10 +37416,10 @@ var EVENT_VOCABULARY = /* @__PURE__ */ new Set([
 ]);
 var _SEVERITY_BY_EXIT = {
   [EXIT_ALLOW35]: "allow",
-  [EXIT_BLOCK6]: "block",
-  [EXIT_WARN18]: "warn"
+  [EXIT_BLOCK5]: "block",
+  [EXIT_WARN19]: "warn"
 };
-function _isObject17(v) {
+function _isObject16(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 function _severity_for(rc) {
@@ -37794,7 +37449,7 @@ function _parse_concern_stdout(stdout_text) {
   } catch {
     return { _raw_stdout: text.slice(0, 500) };
   }
-  return _isObject17(parsed) ? parsed : { _raw: parsed };
+  return _isObject16(parsed) ? parsed : { _raw: parsed };
 }
 function _manifest_fingerprint(text) {
   let h = 2166136261;
@@ -37810,18 +37465,18 @@ function _load_yaml3(p) {
   if (compiled !== p) {
     try {
       const raw = JSON.parse(fs102.readFileSync(compiled, "utf-8"));
-      if (_isObject17(raw) && raw["fingerprint"] === _manifest_fingerprint(text) && _isObject17(raw["manifest"])) {
+      if (_isObject16(raw) && raw["fingerprint"] === _manifest_fingerprint(text) && _isObject16(raw["manifest"])) {
         return raw["manifest"];
       }
     } catch {
     }
   }
   const data = (0, import_yaml6.parse)(text, { version: "1.1" });
-  return _isObject17(data) ? data : {};
+  return _isObject16(data) ? data : {};
 }
 function _payload_tool_name(envelope) {
   const payload = envelope["payload"];
-  if (!_isObject17(payload)) {
+  if (!_isObject16(payload)) {
     return "";
   }
   const raw = payload["tool_name"];
@@ -37849,8 +37504,8 @@ function _role_drop_set(manifest, role, event) {
     return /* @__PURE__ */ new Set();
   }
   const rolesRaw = manifest["roles"];
-  const roleSpec = _isObject17(rolesRaw) ? rolesRaw[role] : void 0;
-  if (!_isObject17(roleSpec)) {
+  const roleSpec = _isObject16(rolesRaw) ? rolesRaw[role] : void 0;
+  if (!_isObject16(roleSpec)) {
     return /* @__PURE__ */ new Set();
   }
   const drop = roleSpec["drop"];
@@ -37863,9 +37518,9 @@ function _is_refusal_retry(event, payload_text) {
   if (event !== "stop") return false;
   try {
     const parsed = JSON.parse(payload_text);
-    if (!_isObject17(parsed)) return false;
+    if (!_isObject16(parsed)) return false;
     const payload = parsed["payload"];
-    const source = _isObject17(payload) ? payload : parsed;
+    const source = _isObject16(payload) ? payload : parsed;
     return source["stop_hook_active"] === true;
   } catch {
     return false;
@@ -37873,28 +37528,28 @@ function _is_refusal_retry(event, payload_text) {
 }
 function _resolve_concerns(manifest, platform, event, role = "orchestrator", opts = {}) {
   const platformsRaw = manifest["platforms"];
-  const platforms = _isObject17(platformsRaw) ? platformsRaw : {};
+  const platforms = _isObject16(platformsRaw) ? platformsRaw : {};
   const block = platforms[platform];
   if (!block) {
     return [];
   }
-  if (_isObject17(block) && block["fallback_only"]) {
+  if (_isObject16(block) && block["fallback_only"]) {
     return [];
   }
-  const names = _isObject17(block) ? block[event] : null;
+  const names = _isObject16(block) ? block[event] : null;
   if (!Array.isArray(names)) {
     return [];
   }
   const dropped = _role_drop_set(manifest, role, event);
   const concernsRaw = manifest["concerns"];
-  const concerns_def = _isObject17(concernsRaw) ? concernsRaw : {};
+  const concerns_def = _isObject16(concernsRaw) ? concernsRaw : {};
   const out = [];
   for (const name of names) {
     if (typeof name === "string" && dropped.has(name)) {
       continue;
     }
     const spec = typeof name === "string" ? concerns_def[name] : void 0;
-    if (!spec || !_isObject17(spec)) {
+    if (!spec || !_isObject16(spec)) {
       process.stderr.write(
         `dispatch_hook: unknown concern '${String(name)}' in manifest
 `
@@ -37952,7 +37607,7 @@ function _build_envelope(args, payload_text) {
   let payload;
   try {
     payload = payload_text.trim() ? JSON.parse(payload_text) : {};
-    if (!_isObject17(payload)) {
+    if (!_isObject16(payload)) {
       payload = { _raw: payload };
     }
   } catch {
@@ -38137,11 +37792,11 @@ function _compactJsonDumps(value) {
   return JSON.stringify(value);
 }
 function _reduce(rcs) {
-  if (rcs.some((rc) => rc === EXIT_BLOCK6)) {
-    return EXIT_BLOCK6;
+  if (rcs.some((rc) => rc === EXIT_BLOCK5)) {
+    return EXIT_BLOCK5;
   }
-  if (rcs.some((rc) => rc === EXIT_WARN18)) {
-    return EXIT_WARN18;
+  if (rcs.some((rc) => rc === EXIT_WARN19)) {
+    return EXIT_WARN19;
   }
   return EXIT_ALLOW35;
 }
@@ -38232,7 +37887,7 @@ var SUMMARY_INVOCATION_CAP = 20;
 function _record_rule_trips(envelope, entries) {
   if (is_replay_mode()) return;
   const tripped = entries.filter(
-    (e) => e["exit_code"] === EXIT_BLOCK6 || e["exit_code"] === EXIT_WARN18
+    (e) => e["exit_code"] === EXIT_BLOCK5 || e["exit_code"] === EXIT_WARN19
   );
   if (tripped.length === 0) return;
   try {
@@ -38243,14 +37898,14 @@ function _record_rule_trips(envelope, entries) {
     update_json_under_lock(target, (loaded) => {
       const doc = { schema_version: 1, concerns: {}, ...loaded };
       const concernsRaw = doc["concerns"];
-      const concerns = _isObject17(concernsRaw) ? concernsRaw : {};
+      const concerns = _isObject16(concernsRaw) ? concernsRaw : {};
       for (const e of tripped) {
         const name = String(e["concern"]);
         const prevRaw = concerns[name];
-        const prev = _isObject17(prevRaw) ? prevRaw : { block: 0, warn: 0 };
+        const prev = _isObject16(prevRaw) ? prevRaw : { block: 0, warn: 0 };
         concerns[name] = {
-          block: (Number(prev["block"]) || 0) + (e["exit_code"] === EXIT_BLOCK6 ? 1 : 0),
-          warn: (Number(prev["warn"]) || 0) + (e["exit_code"] === EXIT_WARN18 ? 1 : 0),
+          block: (Number(prev["block"]) || 0) + (e["exit_code"] === EXIT_BLOCK5 ? 1 : 0),
+          warn: (Number(prev["warn"]) || 0) + (e["exit_code"] === EXIT_WARN19 ? 1 : 0),
           last_trip: today
         };
       }
@@ -38365,7 +38020,7 @@ function main65(argv) {
     }
     const envelope2 = _build_envelope(args, probe.text);
     process.stderr.write(
-      `dispatch_hook: --read-exit ok (${probe.text.length} chars, ${Object.keys(_isObject17(envelope2["payload"]) ? envelope2["payload"] : {}).length} payload keys)
+      `dispatch_hook: --read-exit ok (${probe.text.length} chars, ${Object.keys(_isObject16(envelope2["payload"]) ? envelope2["payload"] : {}).length} payload keys)
 `
     );
     return EXIT_ALLOW35;
@@ -38437,7 +38092,7 @@ function main65(argv) {
   if (_stdin_read_failed !== null) {
     const deny = denyOnStdinFailure(args.platform, args.event, concerns, _stdin_read_failed);
     if (deny !== null) {
-      const emission2 = emitFor(args.platform, args.event, "block", [deny.reason], EXIT_BLOCK6);
+      const emission2 = emitFor(args.platform, args.event, "block", [deny.reason], EXIT_BLOCK5);
       if (emission2.stdout) process.stdout.write(emission2.stdout);
       if (emission2.stderr) process.stderr.write(emission2.stderr);
       return emission2.exit;
@@ -38473,18 +38128,18 @@ function main65(argv) {
       if (!concern["fail_closed"]) {
         rc = EXIT_ALLOW35;
       } else {
-        rc = EXIT_BLOCK6;
+        rc = EXIT_BLOCK5;
       }
       if (stderr_text) {
         process.stderr.write(stderr_text);
       }
     }
-    if (rc === EXIT_BLOCK6 && _is_advisory(concern)) {
+    if (rc === EXIT_BLOCK5 && _is_advisory(concern)) {
       process.stderr.write(
         `dispatch_hook: concern '${String(concern["name"])}' is declared severity: advisory but returned BLOCK \u2014 downgraded to warn.
 `
       );
-      rc = EXIT_WARN18;
+      rc = EXIT_WARN19;
     }
     rcs.push(rc);
     const reply = _parse_concern_stdout(stdout_text);
@@ -38557,7 +38212,7 @@ function _sortedRepr(s) {
   return `[${items.map((x) => `'${x}'`).join(", ")}]`;
 }
 var _stdin_read_failed = null;
-function _isCliEntry52() {
+function _isCliEntry51() {
   if (true) {
     return false;
   }
@@ -38576,8 +38231,8 @@ function _isCliEntry52() {
     return false;
   }
 }
-var isCliEntry14 = _isCliEntry52();
-if (isCliEntry14) {
+var isCliEntry15 = _isCliEntry51();
+if (isCliEntry15) {
   process.exit(main65(process.argv.slice(2)));
 }