@event4u/agent-config 14.22.0 → 14.23.0

package/src/scripts/handoff_context_hook.ts

@@ -157,6 +157,12 @@ export function consume_handoff_context(root: string, now: Date = new Date()): C
  *   - drift (Phase 3.2): the envelope's recorded repo identity + branch +
  *     HEAD are compared against the tree it lands in, and any mismatch LEADS
  *     the injected block. Never a silent stale resume;
+ *   - the BRANCH GATE (2026-09-09): a branch mismatch is a refusal rather than
+ *     an annotation, and the refusal is `absent` so the record is left for a
+ *     session on the right branch instead of consumed. It is the half of the
+ *     resolution rule that keeps an unrelated session in the same checkout from
+ *     resuming an ended peer, now that the resolver admits any record that is
+ *     not the reader's own. Unknown on either side is not a mismatch;
  *   - focus (Phase 3.4): `AGENT_RESUME_FOCUS` narrows what the successor
  *     attacks first — the consumer-side mirror of `next_task`.
  */
@@ -262,7 +268,39 @@ export function consume_recycle_envelope(
 
     // Drift first: a stale resume against the wrong tree is the failure the
     // reader must see before anything else in the block.
-    const drift = describeDrift(envelope, collectRepoAnchor(root));
+    const anchor = collectRepoAnchor(root);
+
+    // The branch gate — an ADMISSION check, not an annotation, and the half of
+    // the 2026-09-09 resolution rule that lives outside the resolver.
+    //
+    // Why it is needed at all: the resolver now admits the unique record that is
+    // not the reader's own, so peer isolation no longer comes from the filename.
+    // Without this, an unrelated session in the same checkout would resume an
+    // ended peer's work simply by being the next one to start. AI council
+    // 2026-09-09 was explicit that (d) is acceptable WITH this gate and not
+    // without it.
+    //
+    // `absent`, deliberately, and this is the one place the invariant matters:
+    // every other outcome consumes the record (moved, not copied), and consuming
+    // here would destroy state the rightful successor could still use. `absent`
+    // is the only outcome that leaves the file alone, and the 48-hour staleness
+    // guard bounds how long it can sit unclaimed.
+    //
+    // Unknown on either side is NOT a mismatch. An envelope written before the
+    // field existed, or a tree whose branch cannot be read, must not be refused
+    // on a comparison neither side can make — that would turn a missing field
+    // into a broken resume. `describeDrift` still annotates those.
+    const envelopeBranch = String((envelope as Record<string, unknown>)['branch'] ?? '').trim();
+    if (envelopeBranch !== '' && anchor.branch !== null && envelopeBranch !== anchor.branch) {
+        return {
+            action: 'absent',
+            reason:
+                `recycle envelope is for branch "${envelopeBranch}" and this tree is on ` +
+                `"${anchor.branch}" — left unclaimed for a session on that branch rather than consumed`,
+        };
+    }
+
+    const drift = describeDrift(envelope, anchor);
     // Proposal fields carrying an imperative LEAD the block as a stop
     // notice — surfaced, never executed, never silently stripped.
     const warnings = scanEnvelopeDirectives(envelope);

package/src/scripts/hook_manifest.json

@@ -1 +1 @@
-{"fingerprint":"5d55db9c:88593","manifest":{"schema_version":1,"concerns":{"chat-history":{"script":"src/scripts/chat_history.ts","args":["hook-dispatch"],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["result"]},"hot-context":{"script":"src/scripts/hot_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"handoff-context":{"script":"src/scripts/handoff_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"roadmap-progress":{"script":"src/scripts/roadmap_progress_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"onboarding-gate":{"script":"src/scripts/onboarding_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"context-hygiene":{"script":"src/scripts/context_hygiene_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"verify-before-complete":{"script":"src/scripts/before_complete_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"ship-diff-volume":{"script":"src/scripts/hooks/ship_diff_volume_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"minimal-safe-diff":{"script":"src/scripts/minimal_safe_diff_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"injection-scan":{"script":"src/scripts/injection_scan_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"block-no-verify":{"script":"src/scripts/hooks/block_no_verify.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"block-kernel-rule-writes":{"script":"src/scripts/hooks/block_kernel_rule_writes.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"one-question-per-ask":{"script":"src/scripts/hooks/one_question_per_ask_hook.ts","args":[],"fail_closed":false,"severity":"blocking","tools":["AskUserQuestion","AskQuestion","UserQuestion","ask_user_question","ask_question","user_question"],"needs_payload_bodies":["input"]},"block-speaking-inbox-dir":{"script":"src/scripts/hooks/block_speaking_inbox_dir.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"block-config-weakening":{"script":"src/scripts/hooks/block_config_weakening.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"rtk-wrap":{"script":"src/scripts/hooks/rtk_wrap_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-slop":{"script":"src/scripts/hooks/design_slop_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-pass":{"script":"src/scripts/hooks/design_pass_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-pass-stop":{"script":"src/scripts/hooks/design_pass_hook.ts","args":["--slot","stop"],"fail_closed":false,"severity":"advisory"},"ui-route-nudge":{"script":"src/scripts/hooks/ui_route_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"suggestion-capture":{"script":"src/scripts/hooks/suggestion_capture_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"chain-nudge":{"script":"src/scripts/hooks/chain_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"code-graph-context":{"script":"src/scripts/hooks/code_graph_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Grep","Glob","Read"],"needs_payload_bodies":["input"]},"memory-learn":{"script":"src/scripts/memory_learn_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"first-run-gate":{"script":"src/scripts/first_run_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"profile-staleness":{"script":"src/scripts/profile_staleness_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"wrapper-freshness":{"script":"src/scripts/wrapper_freshness_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"surface-probe":{"script":"src/scripts/surface_probe_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"team-review-gate":{"script":"src/scripts/team_review_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"pr-url-reminder":{"script":"src/scripts/pr_url_reminder_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"push-settle":{"script":"src/scripts/hooks/push_settle_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"language-mirror":{"script":"src/scripts/language_mirror_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"git-authorization":{"script":"src/scripts/git_authorization_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"evidence-independence":{"script":"src/scripts/hooks/evidence_independence.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"session-canary":{"script":"src/scripts/session_canary_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"council-availability":{"script":"src/scripts/council_availability_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"telemetry-disclosure":{"script":"src/scripts/telemetry_disclosure_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"telemetry-flush":{"script":"src/scripts/hooks/telemetry_flush_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"self-repair":{"script":"src/scripts/self_repair_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"session-register":{"script":"src/scripts/session_register_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"orchestration-record":{"script":"src/scripts/hooks/orchestration_record_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Agent","Task"],"needs_payload_bodies":["input","result"]},"telemetry-usage":{"script":"src/scripts/hooks/telemetry_usage_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Skill"],"needs_payload_bodies":["input"]},"delegation-nudge":{"script":"src/scripts/hooks/delegation_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","nudge_rank":1},"skill-route":{"script":"src/scripts/hooks/skill_route_hook.ts","args":[],"fail_closed":false,"severity":"advisory","nudge_rank":2},"rule-inject":{"script":"src/scripts/hooks/rule_inject_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"end-review-nudge":{"script":"src/scripts/hooks/end_review_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","skip_on_refusal_retry":true},"turn-end-gate":{"script":"src/scripts/hooks/turn_end_gate_hook.ts","args":[],"fail_closed":false,"severity":"blocking"},"comment-discipline":{"script":"src/scripts/hooks/comment_discipline_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Write","Edit"],"needs_payload_bodies":["input"]},"edit-shape":{"script":"src/scripts/hooks/edit_shape_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Write"],"needs_payload_bodies":["input"]},"reread-guard":{"script":"src/scripts/hooks/reread_guard_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Read","Edit","Write"],"needs_payload_bodies":["input"]},"session-eol":{"script":"src/scripts/hooks/session_eol_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"run-continuation":{"script":"src/scripts/hooks/run_continuation_hook.ts","args":[],"fail_closed":false,"severity":"blocking"},"interruption-ledger":{"script":"src/scripts/hooks/interruption_ledger_hook.ts","args":[],"fail_closed":false,"severity":"advisory","skip_on_refusal_retry":true},"subagent-ledger":{"script":"src/scripts/hooks/subagent_ledger_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"tool-result-bytes":{"script":"src/scripts/hooks/tool_result_bytes_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"spawn-guard-shadow":{"script":"src/scripts/hooks/spawn_guard_shadow_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Agent","Task"]},"source-first-gate":{"script":"src/scripts/hooks/source_first_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"journal-record":{"script":"src/scripts/hooks/journal_record_hook.ts","args":[],"fail_closed":false,"severity":"advisory"}},"roles":{"worker":{"drop":["delegation-nudge","skill-route","end-review-nudge","council-availability","team-review-gate","self-repair","session-eol","interruption-ledger"]}},"platforms":{"augment":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","rtk-wrap","design-slop","ui-route-nudge","code-graph-context","chain-nudge","ship-diff-volume","reread-guard"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"claude":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register","journal-record"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush","journal-record"],"stop":["chat-history","hot-context","verify-before-complete","team-review-gate","end-review-nudge","turn-end-gate","self-repair","session-register","session-eol","interruption-ledger","roadmap-progress","design-pass-stop","suggestion-capture","journal-record","run-continuation"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","delegation-nudge","skill-route","git-authorization","session-canary","self-repair","session-register","rule-inject","suggestion-capture","journal-record"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","one-question-per-ask","rtk-wrap","design-slop","ui-route-nudge","code-graph-context","chain-nudge","ship-diff-volume","reread-guard","spawn-guard-shadow","source-first-gate","rule-inject"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","language-mirror","design-pass","journal-record"],"pre_compact":["language-mirror","hot-context","rule-inject","journal-record"],"subagent_start":["subagent-ledger","journal-record"],"subagent_stop":["subagent-ledger","journal-record"]},"cowork":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","rtk-wrap","design-slop","ui-route-nudge","code-graph-context","chain-nudge","ship-diff-volume","reread-guard","spawn-guard-shadow","source-first-gate"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"],"subagent_start":["subagent-ledger"],"subagent_stop":["subagent-ledger"]},"cursor":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"cline":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"windsurf":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","profile-staleness","wrapper-freshness","surface-probe","session-register"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","language-mirror","git-authorization","session-canary","self-repair","session-register"]},"gemini":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"copilot":{"fallback_only":true}},"native_event_aliases":{"augment":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use"},"claude":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact","SubagentStart":"subagent_start","SubagentStop":"subagent_stop"},"cowork":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact","SubagentStart":"subagent_start","SubagentStop":"subagent_stop"},"cursor":{"sessionStart":"session_start","sessionEnd":"session_end","stop":"stop","beforeSubmitPrompt":"user_prompt_submit","postToolUse":"post_tool_use","preToolUse":"pre_tool_use","preCompact":"pre_compact"},"cline":{"TaskStart":"session_start","TaskResume":"session_start","TaskComplete":"session_end","TaskCancel":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact"},"windsurf":{"pre_user_prompt":"user_prompt_submit","post_cascade_response":"stop","post_setup_worktree":"session_start"},"gemini":{"SessionStart":"session_start","SessionEnd":"session_end","BeforeAgent":"user_prompt_submit","AfterAgent":"stop","BeforeTool":"pre_tool_use","AfterTool":"post_tool_use"}}}}
+{"fingerprint":"ebf09730:90278","manifest":{"schema_version":1,"concerns":{"chat-history":{"script":"src/scripts/chat_history.ts","args":["hook-dispatch"],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["result"]},"hot-context":{"script":"src/scripts/hot_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"handoff-context":{"script":"src/scripts/handoff_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"roadmap-progress":{"script":"src/scripts/roadmap_progress_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"onboarding-gate":{"script":"src/scripts/onboarding_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"context-hygiene":{"script":"src/scripts/context_hygiene_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"verify-before-complete":{"script":"src/scripts/before_complete_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"ship-diff-volume":{"script":"src/scripts/hooks/ship_diff_volume_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"minimal-safe-diff":{"script":"src/scripts/minimal_safe_diff_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"injection-scan":{"script":"src/scripts/injection_scan_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"block-no-verify":{"script":"src/scripts/hooks/block_no_verify.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"block-kernel-rule-writes":{"script":"src/scripts/hooks/block_kernel_rule_writes.ts","args":[],"fail_closed":true,"severity":"blocking","needs_payload_bodies":["input"]},"one-question-per-ask":{"script":"src/scripts/hooks/one_question_per_ask_hook.ts","args":[],"fail_closed":false,"severity":"blocking","tools":["AskUserQuestion","AskQuestion","UserQuestion","ask_user_question","ask_question","user_question"],"needs_payload_bodies":["input"]},"block-speaking-inbox-dir":{"script":"src/scripts/hooks/block_speaking_inbox_dir.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"block-config-weakening":{"script":"src/scripts/hooks/block_config_weakening.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"rtk-wrap":{"script":"src/scripts/hooks/rtk_wrap_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-slop":{"script":"src/scripts/hooks/design_slop_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-pass":{"script":"src/scripts/hooks/design_pass_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"design-pass-stop":{"script":"src/scripts/hooks/design_pass_hook.ts","args":["--slot","stop"],"fail_closed":false,"severity":"advisory"},"ui-route-nudge":{"script":"src/scripts/hooks/ui_route_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"suggestion-capture":{"script":"src/scripts/hooks/suggestion_capture_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"chain-nudge":{"script":"src/scripts/hooks/chain_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"code-graph-context":{"script":"src/scripts/hooks/code_graph_context_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Grep","Glob","Read"],"needs_payload_bodies":["input"]},"memory-learn":{"script":"src/scripts/memory_learn_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"first-run-gate":{"script":"src/scripts/first_run_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"profile-staleness":{"script":"src/scripts/profile_staleness_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"wrapper-freshness":{"script":"src/scripts/wrapper_freshness_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"surface-probe":{"script":"src/scripts/surface_probe_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"team-review-gate":{"script":"src/scripts/team_review_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"pr-url-reminder":{"script":"src/scripts/pr_url_reminder_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"push-settle":{"script":"src/scripts/hooks/push_settle_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input","result"]},"language-mirror":{"script":"src/scripts/language_mirror_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"git-authorization":{"script":"src/scripts/git_authorization_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"evidence-independence":{"script":"src/scripts/hooks/evidence_independence.ts","args":[],"fail_closed":false,"severity":"blocking","needs_payload_bodies":["input"]},"session-canary":{"script":"src/scripts/session_canary_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"council-availability":{"script":"src/scripts/council_availability_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"telemetry-disclosure":{"script":"src/scripts/telemetry_disclosure_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"telemetry-flush":{"script":"src/scripts/hooks/telemetry_flush_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"self-repair":{"script":"src/scripts/self_repair_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"session-register":{"script":"src/scripts/session_register_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"orchestration-record":{"script":"src/scripts/hooks/orchestration_record_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Agent","Task"],"needs_payload_bodies":["input","result"]},"telemetry-usage":{"script":"src/scripts/hooks/telemetry_usage_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Skill"],"needs_payload_bodies":["input"]},"delegation-nudge":{"script":"src/scripts/hooks/delegation_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","nudge_rank":1},"skill-route":{"script":"src/scripts/hooks/skill_route_hook.ts","args":[],"fail_closed":false,"severity":"advisory","nudge_rank":2},"rule-inject":{"script":"src/scripts/hooks/rule_inject_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"end-review-nudge":{"script":"src/scripts/hooks/end_review_nudge_hook.ts","args":[],"fail_closed":false,"severity":"advisory","skip_on_refusal_retry":true},"turn-end-gate":{"script":"src/scripts/hooks/turn_end_gate_hook.ts","args":[],"fail_closed":false,"severity":"blocking"},"comment-discipline":{"script":"src/scripts/hooks/comment_discipline_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Write","Edit"],"needs_payload_bodies":["input"]},"edit-shape":{"script":"src/scripts/hooks/edit_shape_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Write"],"needs_payload_bodies":["input"]},"reread-guard":{"script":"src/scripts/hooks/reread_guard_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Read","Edit","Write"],"needs_payload_bodies":["input"]},"session-eol":{"script":"src/scripts/hooks/session_eol_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"run-continuation":{"script":"src/scripts/hooks/run_continuation_hook.ts","args":[],"fail_closed":false,"severity":"blocking"},"interruption-ledger":{"script":"src/scripts/hooks/interruption_ledger_hook.ts","args":[],"fail_closed":false,"severity":"advisory","skip_on_refusal_retry":true},"subagent-ledger":{"script":"src/scripts/hooks/subagent_ledger_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"tool-result-bytes":{"script":"src/scripts/hooks/tool_result_bytes_hook.ts","args":[],"fail_closed":false,"severity":"advisory"},"spawn-guard-shadow":{"script":"src/scripts/hooks/spawn_guard_shadow_hook.ts","args":[],"fail_closed":false,"severity":"advisory","tools":["Agent","Task"]},"source-first-gate":{"script":"src/scripts/hooks/source_first_gate_hook.ts","args":[],"fail_closed":false,"severity":"advisory","needs_payload_bodies":["input"]},"journal-record":{"script":"src/scripts/hooks/journal_record_hook.ts","args":[],"fail_closed":false,"severity":"advisory"}},"roles":{"worker":{"drop":["delegation-nudge","skill-route","end-review-nudge","council-availability","team-review-gate","self-repair","session-eol","interruption-ledger"]}},"platforms":{"augment":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","rtk-wrap","design-slop","ui-route-nudge","code-graph-context","chain-nudge","ship-diff-volume","reread-guard"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"claude":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register","journal-record"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush","journal-record"],"stop":["chat-history","hot-context","verify-before-complete","team-review-gate","end-review-nudge","turn-end-gate","self-repair","session-register","session-eol","interruption-ledger","roadmap-progress","design-pass-stop","suggestion-capture","journal-record","run-continuation"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","delegation-nudge","skill-route","git-authorization","session-canary","self-repair","session-register","rule-inject","suggestion-capture","journal-record"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","one-question-per-ask","rtk-wrap","design-slop","ui-route-nudge","code-graph-context","chain-nudge","ship-diff-volume","reread-guard","spawn-guard-shadow","source-first-gate"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","language-mirror","design-pass","journal-record"],"pre_compact":["language-mirror","hot-context","rule-inject","journal-record"],"subagent_start":["subagent-ledger","journal-record"],"subagent_stop":["subagent-ledger","journal-record"]},"cowork":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"pre_tool_use":["block-no-verify","evidence-independence","block-kernel-rule-writes","block-config-weakening","block-speaking-inbox-dir","rtk-wrap","design-slop","ui-route-nudge","code-graph-context","chain-nudge","ship-diff-volume","reread-guard","spawn-guard-shadow","source-first-gate"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"],"subagent_start":["subagent-ledger"],"subagent_stop":["subagent-ledger"]},"cursor":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"cline":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"windsurf":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","profile-staleness","wrapper-freshness","surface-probe","session-register"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","language-mirror","git-authorization","session-canary","self-repair","session-register"]},"gemini":{"session_start":["chat-history","hot-context","handoff-context","session-canary","council-availability","telemetry-disclosure","first-run-gate","onboarding-gate","verify-before-complete","minimal-safe-diff","profile-staleness","wrapper-freshness","surface-probe","session-register"],"session_end":["chat-history","memory-learn","session-register","roadmap-progress","telemetry-flush"],"stop":["chat-history","hot-context","verify-before-complete","self-repair","session-register","roadmap-progress","design-pass-stop"],"user_prompt_submit":["chat-history","verify-before-complete","minimal-safe-diff","language-mirror","git-authorization","session-canary","self-repair","session-register"],"post_tool_use":["chat-history","roadmap-progress","context-hygiene","verify-before-complete","minimal-safe-diff","injection-scan","pr-url-reminder","push-settle","orchestration-record","telemetry-usage","tool-result-bytes","edit-shape","comment-discipline","design-pass"]},"copilot":{"fallback_only":true}},"native_event_aliases":{"augment":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use"},"claude":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact","SubagentStart":"subagent_start","SubagentStop":"subagent_stop"},"cowork":{"SessionStart":"session_start","SessionEnd":"session_end","Stop":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact","SubagentStart":"subagent_start","SubagentStop":"subagent_stop"},"cursor":{"sessionStart":"session_start","sessionEnd":"session_end","stop":"stop","beforeSubmitPrompt":"user_prompt_submit","postToolUse":"post_tool_use","preToolUse":"pre_tool_use","preCompact":"pre_compact"},"cline":{"TaskStart":"session_start","TaskResume":"session_start","TaskComplete":"session_end","TaskCancel":"stop","UserPromptSubmit":"user_prompt_submit","PostToolUse":"post_tool_use","PreToolUse":"pre_tool_use","PreCompact":"pre_compact"},"windsurf":{"pre_user_prompt":"user_prompt_submit","post_cascade_response":"stop","post_setup_worktree":"session_start"},"gemini":{"SessionStart":"session_start","SessionEnd":"session_end","BeforeAgent":"user_prompt_submit","AfterAgent":"stop","BeforeTool":"pre_tool_use","AfterTool":"post_tool_use"}}}}

package/src/scripts/hook_manifest.yaml

@@ -1271,7 +1271,30 @@ platforms:
     session_end:      [chat-history, memory-learn, session-register, roadmap-progress, telemetry-flush, journal-record]
     stop:             [chat-history, hot-context, verify-before-complete, team-review-gate, end-review-nudge, turn-end-gate, self-repair, session-register, session-eol, interruption-ledger, roadmap-progress, design-pass-stop, suggestion-capture, journal-record, run-continuation]
     user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, delegation-nudge, skill-route, git-authorization, session-canary, self-repair, session-register, rule-inject, suggestion-capture, journal-record]
-    pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-config-weakening, block-speaking-inbox-dir, one-question-per-ask, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate, rule-inject]
+    # `rule-inject` was bound here and is not any more
+    # (road-to-delivery-for-every-host 3.2, owner ruling E2). E2's strategy is
+    # `user_prompt_submit` + `pre_compact`; this slot is the hottest one in the
+    # manifest and its measured gate-open p90 for the concern is 19,649 B against
+    # a 2,048-byte slot sum cap E2 keeps unchanged. The three rules that were
+    # reachable ONLY from this slot — design-review-after-ui-write,
+    # source-of-truth, ui-audit-gate — lose nothing: `project_thin_rules.path_only_ids`
+    # keeps a path-only rule full-bodied, the same exemption a trigger-less rule
+    # already had, so they are projected eagerly instead of delivered.
+    #
+    # WHAT "LOSE NOTHING" DOES NOT COVER, added 2026-09-08 after R2 finding 1 read
+    # the sentence above as covering more than those three. It is accurate for the
+    # three and silent about the class next to them: 18 rules carry BOTH path and
+    # non-path triggers, `path_only_ids` uses `every`, so all 18 are THINNED and
+    # their path-shaped half has no carrier once this binding is gone. They keep
+    # every keyword / phrase / command route through the concern, and on this host
+    # they never had a separate host-native path route — `_claude_paths_plan` emits
+    # no `paths:` for a mixed-trigger rule on purpose — so what is lost is the
+    # difference between loading unconditionally and being delivered on a prompt
+    # match. The names, the measurement and the reason the exemption is not widened
+    # (+16,329 GPT tok, +69 % on the thin rule layer) are in
+    # `project_thin_rules.path_only_ids`; the receiver is
+    # `agents/roadmaps/stubs/road-to-a-path-route-under-delivery.md`.
+    pre_tool_use:     [block-no-verify, evidence-independence, block-kernel-rule-writes, block-config-weakening, block-speaking-inbox-dir, one-question-per-ask, rtk-wrap, design-slop, ui-route-nudge, code-graph-context, chain-nudge, ship-diff-volume, reread-guard, spawn-guard-shadow, source-first-gate]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder, push-settle, orchestration-record, telemetry-usage, tool-result-bytes, edit-shape, comment-discipline, language-mirror, design-pass, journal-record]
     # `language-mirror` — round-5 § 6.1. `pre_compact` sets a pin-lost marker;
     # the `post_tool_use` entry above re-emits the pin exactly once while that

package/src/scripts/hooks/block_speaking_inbox_dir.ts

@@ -22,7 +22,13 @@
  *
  * Refuses: a Write/Edit/NotebookEdit (or cross-platform equivalent) whose
  * target path introduces a **new** first-level directory under `agents/tmp/`
- * or `agents/tmp.old/` whose name is not an opaque round identifier.
+ * or `agents/tmp.old/` whose name is not an opaque round identifier — and a
+ * shell command carrying its path. Two narrowings bring the code closer to
+ * that sentence without classifying commands: a read tool's `file_path` is
+ * filtered by `_READ_ONLY_TOOLS`, and a directory name that is a GLOB over an
+ * acceptable one is not a creatable literal
+ * ({@link isGlobOverAcceptableInboxDir}). Both were judged unconditionally
+ * before, which is what refused a read command in this guard's own workflow.
  *
  * Allowed, deliberately:
  *
@@ -62,6 +68,7 @@ import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { isNonHarvestTmpDir, isOpaqueRoundId } from '../_lib/source_shape.js';
+import { invokedSegments } from './git_command_classifier.js';
 import { readHookStdin } from './hook_stdin.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -76,10 +83,146 @@ const _PATH_KEYS: readonly string[] = [
     'file_path', 'path', 'target_file', 'filename', 'filePath', 'notebook_path',
 ];
 
+/**
+ * Tools whose `file_path` names something to READ, never something to write.
+ *
+ * `_PATH_KEYS` covers `file_path` and `path`, which is exactly what a Read,
+ * Grep or Glob call carries — so a search under a speaking round that does not
+ * exist yet was refused by a guard whose own docstring scopes itself to
+ * `Write/Edit/NotebookEdit`. Filtering here rather than through the manifest's
+ * `tools:` key on purpose: that key is an exact match on the host's own tool
+ * name, so an allowlist written in Claude's vocabulary would silence this
+ * guard on every host that spells its write tools differently. A DENY-list of
+ * read tools fails the other way — an unrecognised tool is still judged.
+ *
+ * An envelope with no tool name is judged too, for the same reason
+ * `_concern_matches_tool` runs a concern when the field is absent: a key that
+ * cannot decide must not be what silences a blocking guard.
+ */
+const _READ_ONLY_TOOLS: ReadonlySet<string> = new Set([
+    'read', 'grep', 'glob', 'notebookread', 'ls', 'view', 'search',
+    'codebase-retrieval', 'codebase_retrieval', 'file_search', 'grep_search',
+    'read_file', 'list_dir', 'semantic_search',
+]);
+
 function _isObject(v: JsonValue | undefined): v is JsonObject {
     return v !== null && v !== undefined && typeof v === 'object' && !Array.isArray(v);
 }
 
+/**
+ * A directory name that is a GLOB over an already-acceptable name.
+ *
+ * READING IS NOT CREATING, AND THE COMMAND SCAN DID NOT KNOW IT. Measured
+ * twice in one session while running the inbox flow over a real round:
+ * `ls -d agents/tmp/inbox-2026-09-*` — the command the naming rule tells an
+ * operator to run to find a free round identifier — was refused, because the
+ * scan in `main` offered every whitespace token to the same verdict that judges
+ * a Write target and `inbox-2026-09-*` is not an opaque identifier: the `*`
+ * fails the 1-3 char disambiguator. So the guard stood between the operator and
+ * the rule it exists to enforce.
+ *
+ * WHY THIS AXIS AND NOT THE VERB. The first two attempts classified the
+ * COMMAND — an allowlist of read-only verbs, then per-verb writing markers.
+ * Two rounds of neutral review took that apart from both ends: round 1 found
+ * `sed -i`, `find -exec` and `awk system()` allowed where the plain token scan
+ * had blocked them; round 2 found the siblings the resulting deny-list did not
+ * reach (`sed`'s `s///w`, `awk`'s output pipe, `sort -o`, `yq -i`), a false
+ * positive the awk marker reintroduced by running past the program into a shell
+ * redirect, mention-blocking on heredoc bodies, and a fail-OPEN when the
+ * segmenter returned nothing. Its handoff named the shape of the problem:
+ * *"3 and 5 pull in opposite directions, so patching them one probe at a time
+ * will keep oscillating."*
+ *
+ * It was the wrong axis, and the measured defect never needed it. What is
+ * actually decidable from the token alone is whether the name could be created
+ * AS WRITTEN, and a glob cannot: the shell expands it against what exists. The
+ * one thing that could — `mkdir 'inbox-2026-09-*'`, creating a literal
+ * directory with a `*` in it — produces a name this predicate accepts anyway,
+ * because its non-glob part is opaque and carries no source. So the carve-out
+ * is safe by construction rather than by enumeration, and every writing form
+ * above is judged again by the unchanged token scan.
+ *
+ * A pattern over a SPEAKING name (`my-source-*`) is not accepted: the glob
+ * characters are removed and the remainder must itself pass.
+ */
+function isGlobOverAcceptableInboxDir(name: string): boolean {
+    if (!/[*?[\]]/.test(name)) {
+        return false;
+    }
+    const literal = name.replace(/[*?]|\[[^\]]*\]/g, '');
+    const trimmed = literal.replace(/-+$/, '');
+    return trimmed !== '' && isAcceptableInboxDir(trimmed);
+}
+
+/**
+ * The paths a redirect inside one segment would create.
+ *
+ * `splitOutsideQuotes` treats `;`, `|`, `&` and newline as separators and `>`
+ * as ordinary text, so a redirect target stays inside its segment. Collected
+ * separately from the token scan because the quotes matter: the token split
+ * removes them, this does not, and both inbox regexes need `agents` at a `/`
+ * or at the start — so `> "agents/tmp/<name>/x"` read as not-an-inbox-path
+ * until the strip below. Also run over the RAW command, because the heredoc
+ * regex in `invokedSegments` swallows a redirect that follows the delimiter.
+ */
+function _redirectTargets(segment: string): string[] {
+    const out: string[] = [];
+    const re = /(?:^|[^0-9<>&])[0-9]*>>?\s*([^\s|&;<>]+)/g;
+    let m: RegExpExecArray | null = re.exec(segment);
+    while (m !== null) {
+        // The character class stops at whitespace and separators but NOT at a
+        // quote, while both inbox regexes require `agents` at a `/` or at the
+        // start of the string. So `> "agents/tmp/<name>/x"` came back as
+        // `"agents/tmp/…` and read as not-an-inbox-path — allowed, where the
+        // unquoted form blocked. A neutral review probed it; stripping the
+        // quotes is the whole fix.
+        const target = (m[1] ?? '').replace(/^['"`]+|['"`]+$/g, '');
+        if (target) {
+            out.push(target);
+        }
+        m = re.exec(segment);
+    }
+    return out;
+}
+
+/**
+ * The tokens of a shell command whose CREATION this guard should judge.
+ *
+ * Every whitespace token, exactly as before this change — the classification
+ * that tried to be cleverer than this is gone, and the docstring on
+ * {@link isGlobOverAcceptableInboxDir} records why. The two things kept are
+ * the ones no review disputed: the RAW command is scanned as well, because
+ * `invokedSegments` strips heredoc bodies as data and a `python3 - <<PY` body
+ * calling `makedirs` is precisely this guard's input; and redirect targets are
+ * collected separately with their quotes stripped, because `>` is not a
+ * segment separator and `> "path"` otherwise read as not-a-path.
+ *
+ * Scanning the raw command in addition to the segments is deliberately
+ * redundant rather than conditional: a heredoc predicate is one more thing to
+ * get wrong, the extra tokens can only ever matter if one of them names a
+ * speaking inbox directory, and the mention-blocking a review found came from
+ * the read-only SKIP being dropped for heredocs — not from the extra scan.
+ *
+ * Exported so the harness can pin the polarity pair on the tokens themselves,
+ * without an envelope.
+ */
+export function creatableTokens(command: string): string[] {
+    const out: string[] = [];
+    const segments = invokedSegments(command);
+    for (const seg of segments) {
+        out.push(..._redirectTargets(seg));
+    }
+    out.push(..._redirectTargets(command));
+    for (const text of [...segments, command]) {
+        for (const tok of text.split(/[\s"'`(){};|&<>]+/)) {
+            if (tok) {
+                out.push(tok);
+            }
+        }
+    }
+    return out;
+}
+
 /** `agents/tmp/<name>/…` or `agents/tmp.old/<name>/…`, after normalisation. */
 const INBOX_RE = /(?:^|\/)agents\/tmp(?:\.old)?\/([^/]+)\/./;
 
@@ -145,6 +288,9 @@ export function verdictFor(
     if (isAcceptableInboxDir(dir)) {
         return { block: false, dir, reason: 'opaque round identifier or named working set' };
     }
+    if (isGlobOverAcceptableInboxDir(dir)) {
+        return { block: false, dir, reason: 'glob over an acceptable name — not a creatable literal' };
+    }
     // Already created — a rename is the fix, and refusing every later write
     // would wedge the round without removing the name.
     //
@@ -153,17 +299,36 @@ export function verdictFor(
     // `agents/tmp-notes/` and `agents/tmpfiles/`, and taking the FIRST
     // occurrence meant a path carrying a decoy earlier segment probed the wrong
     // directory — in either direction. Found by the R2 review of this branch.
+    // THE CAPTURE CARRIES THE PATH'S OWN PREFIX, and it did not. Anchoring the
+    // group at `agents/` discarded everything before it, so a nested inbox —
+    // `app/Modules/<m>/agents/tmp/<round>/…`, the shape a module-per-package
+    // tree produces — probed `<repoRoot>/agents/tmp/<round>`, a directory that
+    // does not exist. The already-exists carve-out could therefore never fire
+    // there, and every write into a nested speaking round was refused forever
+    // instead of once.
+    //
+    // The prefix group is `??` — optional AND preferring ABSENT — and that is
+    // the half a neutral review had to point out. A greedy `(?:.*\/)?`
+    // resolves to the LAST inbox segment in the path while `inboxDirName`
+    // reads the FIRST, so a path carrying two of them judged one directory and
+    // probed another, reporting "already exists" for a name that does not.
+    // Making only `.*` lazy is NOT enough: `(...)?` still prefers one
+    // repetition, so the engine grows the prefix rather than trying the
+    // no-prefix branch, and the long match wins anyway — the test for this
+    // caught exactly that. `??` tries no-prefix first, so both reads agree.
+    // The decoy case below still resolves: `agents/tmp-notes/` fails the `/`
+    // after `tmp`, so the no-prefix branch is rejected and the match advances.
     const normalized = filePath.replace(/\\/g, '/').replace(/^(\.\/)+/, '');
     const m =
-        /(?:^|\/)(agents\/tmp(?:\.old)?\/[^/]+)\//.exec(normalized) ??
-        /(?:^|\/)(agents\/tmp(?:\.old)?\/[^/.]+)\/?$/.exec(normalized);
+        /^((?:.*?\/)??agents\/tmp(?:\.old)?\/[^/]+)\//.exec(normalized) ??
+        /^((?:.*?\/)??agents\/tmp(?:\.old)?\/[^/.]+)\/?$/.exec(normalized);
     if (m === null) {
         // `inboxDirName` matched but this did not — treat as unattributable and
         // BLOCK, since the name is speaking and we cannot prove it pre-exists.
         return { block: true, dir, reason: 'new inbox directory with a speaking name (path not re-anchorable)' };
     }
     const upto = m[1] as string;
-    const probe = repoRoot === '' ? upto : path.join(repoRoot, upto);
+    const probe = repoRoot === '' || path.isAbsolute(upto) ? upto : path.join(repoRoot, upto);
     if (exists(probe)) {
         return { block: false, dir, reason: 'directory already exists — rename, do not re-refuse' };
     }
@@ -216,11 +381,15 @@ export function main(): number {
             return 0;
         }
         const repoRoot = typeof envelope['project_dir'] === 'string' ? envelope['project_dir'] : '';
+        const rawTool = payload['tool_name'] ?? envelope['tool_name'];
+        const toolName = typeof rawTool === 'string' ? rawTool.trim().toLowerCase() : '';
         const candidates: string[] = [];
-        for (const key of _PATH_KEYS) {
-            const v = ti[key];
-            if (typeof v === 'string' && v) {
-                candidates.push(v);
+        if (!_READ_ONLY_TOOLS.has(toolName)) {
+            for (const key of _PATH_KEYS) {
+                const v = ti[key];
+                if (typeof v === 'string' && v) {
+                    candidates.push(v);
+                }
             }
         }
         // A shell command creates the directory just as effectively as a Write,
@@ -228,16 +397,13 @@ export function main(): number {
         // agents/tmp/<speaking-name>`, a `git mv` into one, or a redirect
         // bypassed it entirely. Both siblings on this slot (`block_no_verify`,
         // `block_kernel_rule_writes`) parse the command string; this one did
-        // not, and the R2 review of this branch caught it. Every whitespace
-        // token of the command is offered to the same pure verdict, so the
-        // decision logic is shared rather than duplicated.
+        // not, and the R2 review of this branch caught it. The tokens that
+        // could CREATE something are offered to the same pure verdict, so the
+        // decision logic is shared rather than duplicated — see
+        // `creatableTokens` for why "every whitespace token" was too many.
         const cmd = ti['command'] ?? (_isObject(envelope['payload']) ? (envelope['payload'] as JsonObject)['command'] : undefined);
         if (typeof cmd === 'string' && cmd) {
-            for (const tok of cmd.split(/[\s"'`(){};|&<>]+/)) {
-                if (tok) {
-                    candidates.push(tok);
-                }
-            }
+            candidates.push(...creatableTokens(cmd));
         }
         for (const v of candidates) {
             const verdict = verdictFor(v, (p) => fs.existsSync(p), repoRoot);

package/src/scripts/hooks/code_graph_context_hook.ts

@@ -39,7 +39,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-import { detectSources, pickSource } from '../code_graph/detect.js';
+import { type GraphState, graphState } from '../code_graph/detect.js';
 import { readHookStdin } from './hook_stdin.js';
 
 const EXIT_ALLOW = 0;
@@ -114,26 +114,15 @@ function latch(root: string, session: string): void {
     }
 }
 
-const NATIVE_CACHE = path.join('agents', 'runtime', 'state', 'code-graph-v1.json');
-
-/** The three-state staleness token this hook reports. */
-export type GraphState = 'absent' | 'fresh' | `behind:${number}`;
-
 /**
- * Resolve the graph's state for `root`.
+ * The three-state staleness token this hook reports.
  *
- * `absent` means no source at all — the silent case. A picked source whose
- * staleness is UNKNOWN reads as `fresh`, mirroring `computeVerdict`'s own
- * `picked.stale ? STALE : FRESH`: unknown is not treated as stale, because
- * inventing a commit count would be worse than reporting none.
+ * Re-exported, not defined here: Phase 3's verbs must print the same token, and
+ * an engine module importing this hook to learn it would invert the dependency
+ * direction D9 measures. The definition lives in `code_graph/detect.ts`; this
+ * re-export keeps every existing importer of the hook working unchanged.
  */
-export function graphState(root: string): GraphState {
-    const picked = pickSource(detectSources(root, path.join(root, NATIVE_CACHE)));
-    if (!picked) return 'absent';
-    if (picked.stale !== true) return 'fresh';
-    const behind = picked.commits_behind;
-    return `behind:${typeof behind === 'number' ? behind : 0}`;
-}
+export { type GraphState, graphState };
 
 /**
  * The one line, ≤ ~45 tokens.

package/src/scripts/hooks/push_settle_hook.ts

@@ -191,8 +191,9 @@ export function buildReminder(branch: string, pr: number | null): { reason: stri
     `own exit code.\n\n` +
     `Before this turn ends:\n` +
     `  1. Settle it:\n     ${settle}\n` +
-    `     Exit 0 = settled green · 1 = settled, something failed · 2 = NOT a verdict ` +
-    `(timed out or unreadable — never report 2 as green).\n` +
+    `     Exit 0 = settled green, and the line names the head it is about · 1 = settled, ` +
+    `something failed · 2 = NOT a verdict (timed out, unreadable, or the PR is merged / ` +
+    `closed / head-diverged — never report 2 as green).\n` +
     `  2. Red? Read only the failing part:\n` +
     `     gh run view --job <id> --log-failed | grep -E '×|FAIL|Error'\n` +
     `     then fix it and push again (fix-what-you-see: the author is irrelevant).\n` +