@event4u/agent-config 9.30.0 → 9.31.0

package/src/scripts/_lib/carrier_divergence.ts

@@ -81,6 +81,53 @@ export function comparePair(a: Buffer, b: Buffer): PairVerdict {
     return 'body-diff';
 }
 
+/**
+ * Drop a leading YAML frontmatter block, returning the prose the host actually
+ * delivers.
+ *
+ * A file with no `---` fence, or an unterminated one, is returned unchanged —
+ * the same tolerance `report_carrier_divergence`'s own `type:` reader applies,
+ * because a malformed fence must not silently swallow a rule's whole text.
+ */
+export function stripFrontmatter(text: string): string {
+    if (!text.startsWith('---')) return text;
+    const end = text.indexOf('\n---', 3);
+    if (end === -1) return text;
+    const afterFence = text.indexOf('\n', end + 1);
+    return afterFence === -1 ? '' : text.slice(afterFence + 1);
+}
+
+/**
+ * Do the two copies carry the same governed PROSE, ignoring frontmatter?
+ *
+ * WHY THIS IS SEPARATE FROM `comparePair`, AND MUST STAY SEPARATE
+ * --------------------------------------------------------------
+ * `comparePair` answers *can a byte-identity dedup skip this pair* — it is the
+ * dedup predicate, and a frontmatter difference is a real byte difference, so
+ * folding this in would relax the predicate that
+ * `agents/settings/contexts/dedup-reachability-refusal.md` deliberately keeps
+ * strict. `measure_scope_dedup` asks exactly that question and its arithmetic
+ * stays untouched.
+ *
+ * This answers the different, reader-facing question `report_carrier_divergence`
+ * asks: *must a human act on this pair*. Measured 2026-08-10 over the live
+ * carriers at commit `a5b2f4cb7`: 109 shared rules, **0** byte-identical, **109**
+ * classified `body-diff` — and after this strip, **0** of the 109 differ in
+ * prose. The whole divergence was the metadata block. Reporting that as body
+ * divergence manufactures the one class the report tells a reader to act on,
+ * which is precisely the failure `compareCarriers` already refuses to commit for
+ * an unreadable copy.
+ *
+ * Edge trimming only, on purpose: the frontmatter fence leaves the two sides one
+ * leading newline apart, and that is not a content difference. Internal
+ * whitespace and line endings are NOT normalized — a CRLF-vs-LF body stays a
+ * prose difference, so this stays no softer than the dedup predicate on the text
+ * the host reads.
+ */
+export function proseEqual(a: string, b: string): boolean {
+    return stripFrontmatter(a).trim() === stripFrontmatter(b).trim();
+}
+
 export interface RuleDirCensus {
     files: number;
     /**

package/src/scripts/hooks/turn_end_gate_hook.ts

@@ -27,16 +27,30 @@
  *      Nothing else in `src/` reads this field today; it is the host's own
  *      answer to the question above.
  *
- *   2. A state marker keyed on the LAST USER MESSAGE, never on the reply.
- *      After a refusal the model writes a *new* reply, so a reply-keyed
- *      marker would let the same turn be refused again, and again. The
- *      user prompt does not change within a turn, so the same turn yields
- *      the same key and is refused at most once; the next genuine prompt
- *      yields a new key and the gate re-arms itself with no cleanup.
+ *   2. A per-session state file holding the ORDINAL of the last refused turn —
+ *      never the prompt's text, and never the reply. One file per session, not
+ *      one per refused turn.
+ *
+ *      The first version keyed on sha256(session_id + last user text) with a
+ *      file per turn, and R2 found that wrong in three directions at once: a
+ *      REPEATED prompt ("weiter", "ok", "1") collided with the earlier refused
+ *      turn and was allowed unconditionally; the key drifted WITHIN a turn
+ *      because a compaction summary, a `<system-reminder>` and a sidechain
+ *      prompt all arrive in the user role; and the files accumulated with no
+ *      TTL. The ordinal — a count of `isSyntheticPrompt`-filtered,
+ *      non-sidechain user entries — is distinct for every real turn whatever
+ *      the user typed, and stable across harness injections.
+ *
+ *      Still true and still worth stating: per-session files are bounded per
+ *      session but not pruned, so a long-lived workspace accumulates one small
+ *      file per session. No TTL ships here.
  *
  * The failure this ordering prevents is not a loop but a wedge: a turn that
  * can never end. Layer 2 also covers the host that does not send
- * `stop_hook_active` at all.
+ * `stop_hook_active` at all — with one honest limit: a host that sends no
+ * `session_id` either falls into a shared bucket where an unrelated session's
+ * matching ordinal reads as already-refused, so on such a host layer 2
+ * degrades to "may under-refuse" and layer 1 is the real guard.
  *
  * ## Default OFF — and why, given the roadmap says otherwise
  *
@@ -49,7 +63,7 @@
  * (`hooks.turn_end_gate.enabled`) is default OFF, and WITHIN it both
  * detectors are default ON. A maintainer who opts in gets both without
  * further configuration; until then this concern is a no-op that costs one
- * settings read.
+ * settings-cascade read per turn-end.
  *
  * CONTRACT: dispatcher-internal exit is 1 (EXIT_BLOCK) on a fire, 0
  * otherwise. `fail_closed: false` — deliberately. A crash in a turn-end
@@ -63,7 +77,13 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-import { classify, STATE_FILE as LANGUAGE_STATE_FILE, type Verdict } from '../language_mirror_hook.js';
+import { load_agent_settings } from '../_lib/agent_settings.js';
+import {
+    classify,
+    isSyntheticPrompt,
+    STATE_FILE as LANGUAGE_STATE_FILE,
+    type Verdict,
+} from '../language_mirror_hook.js';
 import { isSafeTranscriptPath } from './end_review_nudge_hook.js';
 import { unwrap, type JsonObject, type JsonValue } from './envelope.js';
 import { readHookStdin } from './hook_stdin.js';
@@ -73,6 +93,16 @@ import { atomic_write_json, is_replay_mode } from './state_io.js';
 const EXIT_BLOCK = 1;
 const EXIT_ALLOW = 0;
 
+/**
+ * Transcript-read ceiling for this hook, passed at the call site in `main()`.
+ * Deliberately well under `isSafeTranscriptPath`'s own 50 MB refusal: the
+ * ordinal is a count over every entry, so the whole file is walked once per
+ * turn-end, and a session file grows for the life of the session. Past this the
+ * gate lets the turn end rather than pay an unbounded read — fail-open, like
+ * every other unreadable-transcript case here.
+ */
+export const TRANSCRIPT_READ_MAX_BYTES = 8 * 1024 * 1024; // 8 MB
+
 /** Detector identity, used in the state marker and the refusal text. */
 export type DetectorId = 'promissory' | 'language';
 
@@ -97,12 +127,56 @@ export interface Finding {
  * under-stripping costs a false refusal, and a blocking guard with a false
  * positive rate teaches users to bypass it.
  */
+/**
+ * Remove fenced code blocks, line by line, tracking open/close state.
+ *
+ * This is deliberately NOT a regex, and the reason is a measured regression.
+ * Two regex attempts each dropped a reply's whole tail on a different valid
+ * shape: a `\1` backreference misses CommonMark's longer closing fence (R2
+ * round 1, finding 5), and the character-matching replacement that fixed THAT
+ * stopped at the first closer-shaped line — so on a `~~~` block containing a
+ * ``` block, the inner line was taken for the closer, the replacer declined it
+ * on the character mismatch, and the greedy tail-drop then deleted everything
+ * from the opener onward (R2 round 2, finding 1). That mixed-character nesting
+ * is the shape `markdown-safe-codeblocks` prescribes as its DEFAULT, so the
+ * second attempt was worse than the first on the more common input.
+ *
+ * A scanner has the state a regex lacks. CommonMark, applied here:
+ *   · an opener may carry an info string; a closer may not;
+ *   · only a fence of the SAME character and at least the opener's length
+ *     closes the block — anything else inside it is content;
+ *   · an unterminated opener runs to end of input, so a truncated reply loses
+ *     its tail, which is the correct reading of a truncated reply.
+ */
+export function stripFencedBlocks(text: string): string {
+    const out: string[] = [];
+    let open: { ch: string; len: number } | null = null;
+    for (const line of text.split('\n')) {
+        const m = /^[ \t]{0,3}([`~]{3,})(.*)$/.exec(line);
+        if (open === null) {
+            if (m) {
+                open = { ch: m[1]![0]!, len: m[1]!.length };
+                out.push(' ');
+                continue;
+            }
+            out.push(line);
+            continue;
+        }
+        if (
+            m &&
+            m[1]![0] === open.ch &&
+            m[1]!.length >= open.len &&
+            (m[2] ?? '').trim() === ''
+        ) {
+            open = null;
+        }
+        // Everything between opener and closer is dropped, closer included.
+    }
+    return out.join('\n');
+}
+
 export function visibleProse(reply: string): string {
-    let text = reply;
-    // Fenced blocks, both ``` and ~~~ (markdown-safe-codeblocks ships both).
-    text = text.replace(/^[ \t]*(`{3,}|~{3,})[\s\S]*?^[ \t]*\1[ \t]*$/gm, ' ');
-    // An unterminated fence at the end of a reply — drop the tail.
-    text = text.replace(/^[ \t]*(`{3,}|~{3,})[\s\S]*$/m, ' ');
+    let text = stripFencedBlocks(reply);
     // Inline code.
     text = text.replace(/`[^`\n]*`/g, ' ');
     // Block quotes — the shape quoted tool output takes.
@@ -146,10 +220,28 @@ const PROMISSORY = [
     /\bals n(ä|ae)chstes (werde|mache|baue|pr(ü|ue)fe) ich\b/i,
     // German puts the infinitive at the END of the clause ("ich werde jetzt
     // die Tests schreiben"), so the verb cannot be matched adjacent to
-    // "werde" — it has to be looked for across the rest of the sentence. The
-    // negative lookahead keeps a stated REFUSAL to act ("ich werde das nicht
-    // anfassen") out: declining to do something is not a promise to do it.
-    /\bich werde\b(?![^.!?\n]*\bnicht\b)[^.!?\n]*\b\w{3,}en\b/i,
+    // "werde" — it has to be looked for across the rest of the sentence.
+    //
+    // The lookahead excludes a stated REFUSAL to act: declining to do
+    // something is not a promise to do it. R2 finding 4 reproduced four live
+    // false refusals against the old `\bnicht\b`-only version — "Ich werde
+    // nichts anfassen" (no word boundary after `nicht`), "keine Tests
+    // schreiben", "niemals raten", and the passive non-promise "Ich werde
+    // gefragt, ob …". Each was a false refusal on a BLOCKING guard, which is
+    // the precision failure the council warning is about.
+    // `\p{L}` with the `u` flag, NOT `\w`: R2 round 2, finding 15 verified that
+    // `\b\w{3,}en\b` cannot reach an infinitive whose post-umlaut fragment is
+    // short, because `ü`/`ö`/`ä` are not `\w` and create a word boundary — so
+    // "prüfen" and "lösen" were silent while the comment above claimed the
+    // verb-final construction was handled.
+    //
+    // Honest about what this proxy matches: any word of 3+ letters ending in
+    // "en" within the clause, which is the infinitive in practice but also hits
+    // a plural noun ("die Zeilen zählen" matches on "Zeilen"). That is
+    // acceptable here — the clause already requires "ich werde" and excludes
+    // negations and passives, so a forward commitment is what remains — but it
+    // is a proxy for the infinitive, not a parse of one.
+    /\bich werde\b(?![^.!?\n]*\b(?:nicht|nichts|kein(?:e|en|em|er|es)?|niemals|nie)\b)(?![^.!?\n]*\b(?:gefragt|gebeten|informiert|benachrichtigt)\b)[^.!?\n]*(?<!\p{L})\p{L}{3,}en(?!\p{L})/iu,
     /\bI(?:'| wi)ll (report|let you know|update you|follow up)\b/i,
     /\bI(?:'| wi)ll (now |then )?\w+ (it|that|this|next)\b/i,
     /\bnext,? I(?:'| wi)ll\b/i,
@@ -182,8 +274,13 @@ export function detectPromissory(reply: string): Finding | null {
     const tail = finalParagraph(reply);
     if (!tail) return null;
 
-    // A blocking question IS the stop condition — never refuse one.
-    if (tail.includes('?')) return null;
+    // A blocking question IS the stop condition — never refuse one. But only a
+    // question that ENDS the paragraph is that: R2 round 2, finding 16 called
+    // `includes('?')` a one-character, trivially learnable bypass, since a
+    // rhetorical or quoted question anywhere alongside a promise disabled a
+    // blocking guard. The hand-back list below still covers the phrasings that
+    // yield without a question mark.
+    if (/\?["'’)\]]*\s*$/.test(tail)) return null;
     if (HANDBACK.some((re) => re.test(tail))) return null;
 
     for (const re of PROMISSORY) {
@@ -228,6 +325,23 @@ export function readLanguagePin(workspaceRoot: string): Verdict {
  * Fires only when the classifier is CONFIDENT the prose is the other
  * language. `classify` returns `und` below its marker floor, and `und`
  * never fires — a short reply is not evidence of drift.
+ *
+ * WHAT IS ACTUALLY CLASSIFIED, stated accurately because R2 finding 9 caught
+ * this file claiming otherwise in three places. `visibleProse` strips code,
+ * quotes, tables, URLs and paths from the whole reply — but `classify` then
+ * applies `instructionText` (which drops output-shaped lines and their
+ * followers) and `humanAuthoredLead`, and RETURNS ON THE LEAD ALONE when the
+ * lead is determined. So in the common case the verdict comes from the reply's
+ * opening chunk, not from all of it, and indented prose is discarded before
+ * scoring.
+ *
+ * That is deliberately left as-is rather than swapped for a full-text scorer:
+ * sharing one classifier with `language_mirror_hook` is what stops the pin and
+ * the detector disagreeing about what language a turn is in, and changing the
+ * scoring surface would change the measured rate, which needs its own
+ * measurement rather than a quiet edit. What is fixed here is the CLAIM —
+ * including the one this function used to put in its own refusal text, where an
+ * inflated description of the evidence is worst.
  */
 export function detectLanguage(reply: string, pinned: Verdict): Finding | null {
     if (pinned !== 'de' && pinned !== 'en') return null;
@@ -239,9 +353,10 @@ export function detectLanguage(reply: string, pinned: Verdict): Finding | null {
         detector: 'language',
         evidence: prose.trim().slice(0, 120),
         reason:
-            `the pinned reply language is "${pinned}" but the user-visible prose classifies as ` +
-            `"${verdict.language}" (${verdict.de_markers} de / ${verdict.en_markers} en markers, ` +
-            'code, quotes, paths and identifiers already excluded)',
+            `the pinned reply language is "${pinned}" but the reply classifies as ` +
+            `"${verdict.language}" (${verdict.de_markers} de / ${verdict.en_markers} en markers; ` +
+            'code, quotes, tables, URLs and paths excluded, then scored lead-first ' +
+            'by the same classifier that sets the pin)',
     };
 }
 
@@ -253,35 +368,75 @@ function stateDir(workspaceRoot: string): string {
     return path.join(workspaceRoot, 'agents', 'runtime', 'state', 'turn-end-gate');
 }
 
-function stateFile(workspaceRoot: string, turnKey: string): string {
-    return path.join(stateDir(workspaceRoot), `${turnKey}.json`);
-}
-
 /**
- * The turn's identity. Session id plus the last USER message — see the file
- * header for why the reply must not be part of it.
+ * ONE file per session, not one per refused turn. R2 round 1, finding 17:
+ * per-turn files accumulated without bound and without a TTL, because "re-arms
+ * itself with no cleanup" described the key rotating, not the files being
+ * removed.
+ *
+ * HALF of that is fixed and half is not, stated rather than implied (R2 round 2,
+ * finding 12): the per-turn MULTIPLICITY is gone, so a session no longer leaves
+ * one file per refused turn. There is still no TTL and no pruning, so a
+ * long-lived workspace accumulates one small file per session that ever had a
+ * turn refused. Adding expiry is new behaviour and belongs with its own test.
  */
-export function deriveTurnKey(sessionId: string, lastUserText: string): string {
-    return crypto
-        .createHash('sha256')
-        .update(`${sessionId}\n${lastUserText}`)
-        .digest('hex')
-        .slice(0, 32);
+function sessionStateFile(workspaceRoot: string, sessionKey: string): string {
+    return path.join(stateDir(workspaceRoot), `${sessionKey}.json`);
+}
+
+export function deriveSessionKey(sessionId: string): string {
+    return crypto.createHash('sha256').update(sessionId).digest('hex').slice(0, 32);
 }
 
-export function alreadyRefusedThisTurn(workspaceRoot: string, turnKey: string): boolean {
+/**
+ * A turn's identity is its ORDINAL — how many genuine user prompts the
+ * transcript has carried — never the prompt's text.
+ *
+ * R2 findings 2 and 3 killed the text-keyed version, in both directions:
+ *
+ *   · keying on sha256(session + last user text) made every REPEAT of a prompt
+ *     collide with the earlier refused turn, so the second "weiter" / "ok" /
+ *     "1" was allowed unconditionally. Repeated short continuations are the
+ *     dominant prompt shape in the corpus this gate was built from, so the
+ *     gate disabled itself exactly where it was needed;
+ *   · taking the last user-role entry made the key drift WITHIN one turn,
+ *     because a compaction summary and a `<system-reminder>` both arrive in the
+ *     user role. A new key mid-turn re-arms the marker, which is the wedge
+ *     layer 2 exists to prevent on hosts that send no `stop_hook_active`.
+ *
+ * An ordinal over `isSyntheticPrompt`-filtered entries fixes both at once: it
+ * is distinct for every real turn regardless of what the user typed, and it
+ * does not move when the harness injects a user-role entry.
+ */
+export function alreadyRefusedTurn(
+    workspaceRoot: string,
+    sessionKey: string,
+    turnOrdinal: number,
+): boolean {
     try {
-        return fs.existsSync(stateFile(workspaceRoot, turnKey));
+        const raw = fs.readFileSync(sessionStateFile(workspaceRoot, sessionKey), 'utf-8');
+        const decoded: unknown = JSON.parse(raw);
+        if (typeof decoded === 'object' && decoded !== null && !Array.isArray(decoded)) {
+            return (decoded as Record<string, unknown>)['refused_turn'] === turnOrdinal;
+        }
     } catch {
-        return false;
+        // absent, unreadable, or malformed state means "not refused yet" —
+        // fail-open, per this hook's contract.
     }
+    return false;
 }
 
-function markRefusedThisTurn(workspaceRoot: string, turnKey: string, detector: DetectorId): void {
+function markRefusedTurn(
+    workspaceRoot: string,
+    sessionKey: string,
+    turnOrdinal: number,
+    detector: DetectorId,
+): void {
     if (is_replay_mode()) return;
     try {
-        atomic_write_json(stateFile(workspaceRoot, turnKey), {
+        atomic_write_json(sessionStateFile(workspaceRoot, sessionKey), {
             refused_at: new Date().toISOString(),
+            refused_turn: turnOrdinal,
             detector,
         });
     } catch {
@@ -297,28 +452,48 @@ function markRefusedThisTurn(workspaceRoot: string, turnKey: string, detector: D
 
 export interface TranscriptTail {
     lastAssistant: string;
-    lastUser: string;
+    /**
+     * How many GENUINE user prompts the transcript carries — harness-injected
+     * user-role entries excluded via `isSyntheticPrompt`. This is the turn's
+     * identity; see `alreadyRefusedTurn` for why the prompt's text is not.
+     */
+    turnOrdinal: number;
 }
 
 /**
- * Last assistant text and last user text from a Claude JSONL transcript.
- * Mirrors `chat_history._extract_claude_transcript_response` for the
- * assistant half and adds the user half the turn key needs.
+ * The last assistant text, plus the turn ordinal, from a Claude JSONL
+ * transcript. Mirrors `chat_history._extract_claude_transcript_response` for
+ * the assistant half.
+ *
+ * `isSyntheticPrompt` is applied to every user-role entry — the same filter
+ * `language_mirror_hook` uses, and for the same reason it was added there
+ * (round-5 § 6.5): a background-task notification and a `<system-reminder>`
+ * both occupy the user role without being chat messages. Counting them would
+ * move the turn ordinal mid-turn, which is R2 finding 3.
  */
 export function readTranscriptTail(
     transcriptPath: string,
     opts: { homeDir?: string; maxBytes?: number } = {},
 ): TranscriptTail {
-    const empty: TranscriptTail = { lastAssistant: '', lastUser: '' };
+    const empty: TranscriptTail = { lastAssistant: '', turnOrdinal: 0 };
     if (!transcriptPath || !isSafeTranscriptPath(transcriptPath, opts)) return empty;
     let lines: string[];
     try {
+        // R2 finding 12: `maxBytes` was accepted in the options type and never
+        // used, so the declared cap was decoration. It is enforced here as well
+        // as inside `isSafeTranscriptPath`, because this is the read it bounds.
+        // The whole file still has to be walked — the turn ordinal is a count
+        // over all entries, not something a tail can answer — so the cap is the
+        // guard, not an optimisation.
+        if (opts.maxBytes !== undefined && fs.statSync(transcriptPath).size > opts.maxBytes) {
+            return empty;
+        }
         lines = fs.readFileSync(transcriptPath, 'utf-8').split('\n');
     } catch {
         return empty;
     }
     let lastAssistant = '';
-    let lastUser = '';
+    let turnOrdinal = 0;
     for (const rawLine of lines) {
         const line = rawLine.trim();
         if (!line) continue;
@@ -330,16 +505,24 @@ export function readTranscriptTail(
         }
         if (typeof obj !== 'object' || obj === null || Array.isArray(obj)) continue;
         const entry = obj as Record<string, unknown>;
+        // Sidechain entries are a SUBAGENT's conversation recorded in the same
+        // JSONL. A subagent prompt is a genuine-looking user-role text entry
+        // appended mid-turn, so counting it moves the ordinal within the turn —
+        // finding 3's failure class in a new shape (R2 round 2, finding 3).
+        if (entry['isSidechain'] === true) continue;
         const role = entry['type'];
         if (role !== 'assistant' && role !== 'user') continue;
         const msg = entry['message'];
         if (typeof msg !== 'object' || msg === null || Array.isArray(msg)) continue;
         const text = _messageText((msg as Record<string, unknown>)['content']);
         if (text === null) continue;
-        if (role === 'assistant') lastAssistant = text;
-        else lastUser = text;
+        if (role === 'assistant') {
+            lastAssistant = text;
+        } else if (!isSyntheticPrompt(text)) {
+            turnOrdinal += 1;
+        }
     }
-    return { lastAssistant: lastAssistant.trim(), lastUser: lastUser.trim() };
+    return { lastAssistant: lastAssistant.trim(), turnOrdinal };
 }
 
 function _messageText(content: unknown): string | null {
@@ -367,39 +550,52 @@ export interface GateSettings {
 }
 
 /**
- * Read the three switches with a line walker rather than the full settings
- * cascade: this concern runs on EVERY turn-end and is default-off, so the
- * common path must not pay for a cascade load it will discard.
+ * YAML spellings a human writes for "on". The `yaml` package parses to the 1.2
+ * core schema, where `yes` is the STRING "yes" rather than a boolean — so a
+ * maintainer who writes `enabled: yes` means it, and a reader that silently
+ * treats it as off is the R2 finding-6b defect wearing a parser instead of a
+ * regex. Anything not in this set is off; there is no truthiness guessing.
+ */
+function _isOn(v: unknown): boolean | null {
+    if (typeof v === 'boolean') return v;
+    if (typeof v !== 'string') return null;
+    const s = v.trim().toLowerCase();
+    if (s === 'true' || s === 'yes' || s === 'on') return true;
+    if (s === 'false' || s === 'no' || s === 'off') return false;
+    return null;
+}
+
+/**
+ * Read the three switches through the real settings cascade.
+ *
+ * The previous version hand-walked `<workspaceRoot>/.agent-settings.yml` for
+ * speed, and R2 finding 6 found three defects in that trade: it ignored the
+ * user-global layer entirely (so a maintainer who opts in globally got no gate
+ * AND no diagnostic), its end-of-line-anchored regex read
+ * `enabled: true  # soak opt-in` as FALSE, and it accepted a `turn_end_gate:`
+ * block under ANY parent as ON because a text walker has no notion of a parent.
+ *
+ * The stated reason for skipping the cascade does not survive contact with the
+ * sibling concerns: `delegation-nudge` calls `load_agent_settings` on
+ * `user_prompt_submit`, i.e. every turn. Correctness on a gate that can refuse
+ * a turn-end outranks one settings read per turn-end.
  */
 export function readGateSettings(workspaceRoot: string): GateSettings {
     const off: GateSettings = { enabled: false, promissory: true, language: true };
-    let raw: string;
+    let settings: Record<string, unknown>;
     try {
-        raw = fs.readFileSync(path.join(workspaceRoot, '.agent-settings.yml'), 'utf-8');
+        settings = load_agent_settings({ cwd: workspaceRoot }) as Record<string, unknown>;
     } catch {
         return off;
     }
-    // Indent-aware: the block ends at the first line indented no deeper than
-    // the header. A width-agnostic `^\S` terminator would swallow the next
-    // sibling key and read ITS `enabled:` as ours.
-    const lines = raw.split('\n');
-    const headerIdx = lines.findIndex((l) => /^\s*turn_end_gate:\s*$/.test(l));
-    if (headerIdx === -1) return off;
-    const headerIndent = (lines[headerIdx]!.match(/^\s*/) ?? [''])[0].length;
-    const body: string[] = [];
-    for (const line of lines.slice(headerIdx + 1)) {
-        if (line.trim() === '' || line.trimStart().startsWith('#')) continue;
-        const indent = (line.match(/^\s*/) ?? [''])[0].length;
-        if (indent <= headerIndent) break;
-        body.push(line);
-    }
+    const hooks = settings['hooks'];
+    if (typeof hooks !== 'object' || hooks === null || Array.isArray(hooks)) return off;
+    const block = (hooks as Record<string, unknown>)['turn_end_gate'];
+    if (typeof block !== 'object' || block === null || Array.isArray(block)) return off;
+    const gate = block as Record<string, unknown>;
     const flag = (name: string, dflt: boolean): boolean => {
-        const re = new RegExp(`^\\s+${name}:\\s*(true|false)\\s*$`);
-        for (const line of body) {
-            const m = line.match(re);
-            if (m) return m[1] === 'true';
-        }
-        return dflt;
+        const v = _isOn(gate[name]);
+        return v === null ? dflt : v;
     };
     return {
         enabled: flag('enabled', false),
@@ -436,23 +632,35 @@ export function main(): number {
     const transcriptPath = str(
         (payload['transcript_path'] ?? payload['transcriptPath']) as JsonValue | undefined,
     );
-    // `AGENT_CONFIG_TRANSCRIPT_HOME` exists for the test harness only: real
-    // transcripts live under `~/.claude/projects/**` and production never sets
-    // it. Without it a test cannot exercise the path-safety check at all,
-    // which would leave the one security-relevant branch unmeasured.
-    const homeOverride = process.env['AGENT_CONFIG_TRANSCRIPT_HOME'];
-    const { lastAssistant, lastUser } = readTranscriptTail(
-        transcriptPath,
-        homeOverride ? { homeDir: homeOverride } : {},
-    );
+    // No override of the home-confinement check on the production path. R2
+    // finding 13: the previous `AGENT_CONFIG_TRANSCRIPT_HOME` widened the one
+    // security-relevant predicate in this hook, and an env var that relaxes a
+    // path-confinement check IS a bypass of it, whatever the comment says. The
+    // tests set `HOME` on the spawned process instead — `os.homedir()` honours
+    // it — so the branch is still exercised with no product-code seam.
+    // The cap is passed HERE, at the only production call site. R2 round 2,
+    // finding 7: enforcing it inside the function while `main()` called
+    // `readTranscriptTail(transcriptPath)` with no options left the guard dead
+    // in production while its comment claimed it was enforced — the same
+    // fixed-the-definition-not-the-caller shape as two other findings in that
+    // round, which is why this line exists rather than a default parameter.
+    const { lastAssistant, turnOrdinal } = readTranscriptTail(transcriptPath, {
+        maxBytes: TRANSCRIPT_READ_MAX_BYTES,
+    });
     if (!lastAssistant) return EXIT_ALLOW;
 
-    // Layer 2 — the turn-keyed marker. Reply-independent by construction.
-    const turnKey = deriveTurnKey(
+    // Layer 2 — keyed on the turn's ORDINAL, never on the prompt's text.
+    // A host that sends no `session_id` shares one bucket AND one small-integer
+    // ordinal namespace, so an unrelated session whose ordinal matches a stored
+    // `refused_turn` reads as already-refused and goes unguarded. R2 round 2,
+    // finding 16: the sibling hook documents its own bucket as degrading rather
+    // than colliding, and this one collides. It is named here rather than
+    // papered over — the degradation is toward UNDER-refusing, which is the safe
+    // direction, and layer 1 still covers the host that sends the flag.
+    const sessionKey = deriveSessionKey(
         str(envelope['session_id'] as JsonValue | undefined) || 'unknown-session',
-        lastUser,
     );
-    if (alreadyRefusedThisTurn(workspaceRoot, turnKey)) return EXIT_ALLOW;
+    if (alreadyRefusedTurn(workspaceRoot, sessionKey, turnOrdinal)) return EXIT_ALLOW;
 
     const findings: Finding[] = [];
     if (settings.promissory) {
@@ -465,7 +673,7 @@ export function main(): number {
     }
     if (findings.length === 0) return EXIT_ALLOW;
 
-    markRefusedThisTurn(workspaceRoot, turnKey, findings[0]!.detector);
+    markRefusedTurn(workspaceRoot, sessionKey, turnOrdinal, findings[0]!.detector);
 
     const lines = findings.map(
         (f) => `  · ${f.detector}: ${f.reason}\n    evidence: ${JSON.stringify(f.evidence)}`,