crewforth 3.2.1 → 3.4.0

package/kit/hooks/context-usage.sh

@@ -262,9 +262,12 @@ PCT="$((PCT_T / 10)).$((PCT_T % 10))"
 # ago: the expression above rounds. A comment that describes a tool the code no longer calls is worse than
 # no comment, because the next reader trusts it instead of the line.
 PCTI="${PCT%%.*}"; case "$PCTI" in ''|*[!0-9]*) PCTI=0 ;; esac
-if   [ "$PCTI" -lt 50 ]; then LEVEL="continue"
-elif [ "$PCTI" -lt 75 ]; then LEVEL="medium"
-else                          LEVEL="handoff+clear"
+# The form the discipline's status line uses, word for word: `→ <low|medium|high> fill · Recommendation: <…>`.
+# It used to print the recommendation alone for two bands and the level for the third (`continue`, `medium`,
+# `handoff+clear`), which left the model to work the level word out of the thresholds itself.
+if   [ "$PCTI" -lt 50 ]; then LEVEL="low fill · Recommendation: continue"
+elif [ "$PCTI" -lt 75 ]; then LEVEL="medium fill · Recommendation: continue"
+else                          LEVEL="high fill · Recommendation: handoff+clear"
 fi
 # The '%<number>' shape is a contract: session-guard.sh reads the percentage back out of this line.
 if [ "$VERBOSE" = 1 ]; then

package/kit/hooks/guard-agent-model.sh

@@ -9,7 +9,8 @@
 #     change: text | feature | fix-known | fix-unknown | refactor | migration | security | architecture |
 #             test-run | test-write | audit
 #     verify: the command that says the work is right, or `none`
-# and this gate reads the card. What it holds, all of it by refusing and never by rewriting a call:
+# and this gate reads the card. What it holds, by refusing a call below its floor (and running one above it ON the
+# floor, unless the card says `above: <why>`):
 #   * the call names a model, and carries a card;
 #   * RISK CLASS. `critical` when the change is migration, security, architecture or fix-unknown, or a file is on a
 #     critical path (auth, payments, billing, migrations, security, crypto, secrets, *.sql, schema.prisma;
@@ -20,6 +21,8 @@
 #     that wants opus there says so in .claude/crew-model-rules (floor * text critical opus).
 #   * the referee is as strong as the risk: test-write and audit on sonnet or above (opus when critical, by the rule
 #     above); review, privacy, planner and database agents on sonnet or above; the security agent on opus.
+#   * feature, fix-known and refactor run on sonnet or above, the table's sonnet row (not the commit agent, whose
+#     work is the message).
 #   * work with no verify command runs on sonnet or above: haiku goes only to work a command can check. Not for
 #     change: text, nor for the commit agent: a reader is all prose ever has, and a commit message is checked by
 #     the commit-msg hook (seen on a real project: a commit message proposed on sonnet for that reason alone).
@@ -359,7 +362,8 @@ _am_tier(){  # $1 = a model as a call or a transcript names it -> _AMT haiku|son
 # of every file of the project (the scan in agent-outcome.sh). A path is critical when one of its parts is one of
 # these WORDS, standing as a word: after a separator or at a capital (`auth/`, `user_auth.py`, `AuthController.cs`,
 # `userAuth.ts`, `AUTH_KEYS`) and not running on in lower case (`author.md`, `cryptography/` are not). And by name:
-# a .sql file, schema.prisma. The path is read from the project's root down, so the name of the folder the project
+# a .sql file, schema.prisma. And the migration folders whose names carry no such word: alembic/versions/,
+# Rails' db/migrate/. The path is read from the project's root down, so the name of the folder the project
 # sits in decides nothing. .claude/crew-model-rules, which only the user writes, adds (`+ glob`) and removes
 # (`- glob`); the last line that matches wins.
 # Legal and personal-data texts are critical too (crew-docs-agent's work): legal, privacy, consent in every form, and
@@ -404,6 +408,7 @@ _am_crit_path(){  # $1 = a path or a glob -> 0 critical (_AMW says by what), 1 n
   _am_rel "$1"; p="$_AMRP"; _AMW=""
   if [[ "$p" =~ $_AM_RE_L ]] || [[ "$p" =~ $_AM_RE_C ]] || [[ "$p" =~ $_AM_RE_U ]]; then hit=0; _AMW="${BASH_REMATCH[2]}"
   else case "$p" in *.sql|*.SQL) hit=0; _AMW="a .sql file" ;; schema.prisma|*/schema.prisma) hit=0; _AMW="schema.prisma" ;;
+    alembic/versions/*|*/alembic/versions/*|db/migrate/*|*/db/migrate/*) hit=0; _AMW="migrations" ;;
     store/*|*/store/*|store-listing/*|*/store-listing/*|fastlane/metadata/*|*/fastlane/metadata/*|metadata/android/*|*/metadata/android/*|metadata/ios/*|*/metadata/ios/*)
       case "$p" in *.txt|*.md|*.xml|*.yml|*.yaml) hit=0; _AMW="a store listing text" ;; esac ;;
   esac; fi
@@ -822,6 +827,26 @@ _am_write_check(){  # $1 = the payload, $2 = the file about to be written -> ret
   echo "GUARD (agent model): $_AMRP is on a critical path ($_AMW) and this agent runs on ${tier:-a model that could not be read}; only an agent on opus writes there. Do not reach the file another way. Stop, and end your report with the two lines: escalate: $_AMRP / confidence: low" >&2
   exit 2
 }
+# THE FLOOR OF A CLASS, before any card, record or rule: the agent's own, then the card's change. One definition, for
+# the gate and for /crew-loosen (prompt-approval.sh), which must not report a lowering below it: a raise on record for
+# a class whose own floor is the same model is not lowered by anything (field review, 3.2.1).
+_am_agent_floor(){  # $1 = agent -> floor (rank) and why. The agent's own floor, whatever the card says.
+floor=0; why=""
+case "$1" in
+  crew-security-expert) floor=3; why="the security audit" ;;
+  crew-privacy-agent|crew-review-agent|crew-planner|crew-database-expert) floor=2; why="this agent's floor" ;;
+esac
+return 0
+}
+_am_change_floor(){  # $1 = change, $2 = agent -> raises floor and why
+case "$1" in test-write|audit) if [ "$floor" -lt 2 ]; then floor=2; why="change: $1, the referee of the work"; fi ;; esac
+# The table's sonnet row: feature, fix-known and refactor run on sonnet with a verify command too. They had no floor
+# here, so with the rule that a call runs ON its floor, a call that asked for sonnet or opus by the table ran on haiku
+# (field report, 3.2.1: a fix-known on a PII file, asked for opus, ran 106 turns on haiku and came back
+# `confidence: low`). haiku stays the floor of text, test-run and the commit agent, whose work is the message.
+[ "$2" != crew-commit-agent ] && case "$1" in feature|fix-known|refactor) if [ "$floor" -lt 2 ]; then floor=2; why="change: $1, the table's sonnet row"; fi ;; esac
+return 0
+}
 [ "$_AM_LIB" = 1 ] && return 0
 # ---- CREW-FAILCLOSED ---------------------------------------------------------------------------------------
 # A gate that stops on an error of its own must refuse the call, not let it through. Claude Code blocks a tool call
@@ -863,11 +888,7 @@ _json_keycount "$ti" model
 if [ "$_KC" -gt 1 ]; then echo "GUARD (agent model): this call names model more than once, so which model it asks for cannot be read and the call is refused. Send one." >&2; _am_log "an ambiguous call"; exit 2; fi
 _json_slice "$ti" model >/dev/null; _json_unescape "$_JS" >/dev/null; m="$_JU"
 if [ -z "$m" ]; then rank=0; else _am_tier "$m"; if [ -n "$_AMT" ]; then m="$_AMT"; _am_rank "$m"; rank="$_AMR"; else rank=-1; fi; fi
-# The agent's own floor, whatever the card says.
-case "$st" in
-  crew-security-expert) floor=3; why="the security audit" ;;
-  crew-privacy-agent|crew-review-agent|crew-planner|crew-database-expert) floor=2; why="this agent's floor" ;;
-esac
+_am_agent_floor "$st"
 _am_name "$floor"; fname="$_AMN"
 if [ "$rank" = 0 ]; then
   echo "GUARD (agent model): a call to $st has to name its model. Choose haiku, sonnet or opus by the table in CLAUDE.md (risk decides, not size) and repeat the same call with model set.${fname:+ $st runs on $fname or above.}" >&2
@@ -892,7 +913,7 @@ fi
 _am_state; _am_risk; _am_digest
 # ---- the floor of THIS card: the highest of what applies, and the reason that set it ----
 if [ "$CARD_VERIFY" = none ] && [ "$CARD_CHANGE" != text ] && [ "$st" != crew-commit-agent ] && [ "$floor" -lt 2 ]; then floor=2; why="no verify command, so nothing checks the work but a reader"; fi
-case "$CARD_CHANGE" in test-write|audit) if [ "$floor" -lt 2 ]; then floor=2; why="change: $CARD_CHANGE, the referee of the work"; fi ;; esac
+_am_change_floor "$CARD_CHANGE" "$st"
 if [ "$CARD_RISK" = critical ] && [ "$CARD_CHANGE" = text ] && _am_all_prose; then
   if [ "$floor" -lt 2 ]; then floor=2; why="a text change on a critical path: $CARD_RISKWHY"; fi
 elif [ "$CARD_RISK" = critical ] && [ "$CARD_CHANGE" != test-run ] && [ "$floor" -lt 3 ]; then floor=3; why="critical work: $CARD_RISKWHY"; fi

package/kit/hooks/guard-bash.sh

@@ -1996,7 +1996,10 @@ _mr_named(){ local nc=0 rc=1; shopt -q nocasematch && nc=1; shopt -s nocasematch
     [ "$unglob" = 1 ] && set +f
   fi
   [ "$nc" = 0 ] && shopt -u nocasematch; return "$rc"; }
-_mr_named && block "a model routing record named in a command (the user and Crewforth's hooks write it)" "4.5" tamper
+# Reading one is open through the Read tool, which no gate here matches: the rule is about a command, which cannot be
+# told reading from writing by its text. Said in the refusal, since a session that did not know it told the user it
+# could not even show them the file (field report, 3.2.1).
+_mr_named && block "a model routing record named in a command (the user and Crewforth's hooks write it; to show it to the user, read it with the Read tool)" "4.5" tamper
 # The refuter ledger (hooks/refuter-ledger.sh) by its file name: the agent's name alone is not refused, so a command
 # that greps for crew-refuter still runs. The same honest scope as the rule above.
 _rf_named(){ local nc=0 rc=1; shopt -q nocasematch && nc=1; shopt -s nocasematch
@@ -2436,6 +2439,29 @@ _p44_scan(){  # $1 = the collapsed `git push …` -> 0 when it is `git push [-u]
   [ "$npos" = 2 ] || { _P44_WHY="the remote and the branch are not both written out"; return 1; }
   return 0
 }
+# A PUSH NO APPROVAL CAN COVER: one that deletes or mirrors a remote ref (`--delete`, `-d`, `--mirror`, `--prune`,
+# `--all`, `:<ref>`). An approval records one form, `git push <remote> <branch>`, and the form was checked only after
+# the record was read, so with no record the refusal offered the approval question and /crew-approve for it; in the
+# field (3.2.1) the user approved twice and typed the command once, and each time it was refused again. Asked before
+# the record, so the refusal can say at once that this one is the user's to run.
+_p44_never(){  # 0 = this call is a push no approval covers; _P44N names the token that makes it so
+  # Read from the text with its quotes taken out (CMD_UQ), after the word push: `git -C . push origin :x` and
+  # `git push origin "":old` are deleting pushes too, and a reading that gave up on a form it could not collapse let
+  # them fall through to the approval offer (found in review).
+  local tok unglob=0 after=0
+  _P44N=""
+  git_has "$CMD_SEEN" 'push' || return 1
+  git_has "$CMD_SEEN" 'commit' && return 1
+  case "$-" in *f*) ;; *) unglob=1; set -f ;; esac
+  set -- ${CMD_UQ//[;&|]/ ; }
+  [ "$unglob" = 1 ] && set +f
+  for tok in "$@"; do
+    case "$tok" in \;) after=0; continue ;; push) after=1; continue ;; esac
+    [ "$after" = 1 ] || continue
+    case "$tok" in -d|--delete|--mirror|--prune|--all|:*|+:*) _P44N="$tok"; return 0 ;; esac
+  done
+  return 1
+}
 _approval_ok(){  # 0 = the user's recorded approval covers THIS call. Otherwise _APW says why not, for the message.
   local k v op="" tr="" h="" b="" r="" u="" sid="" ts="" now age dir="${_CWD:-.}" hc=1 hp=1 cur tool tag _h2
   _APW="no approval from the user is on record"
@@ -2565,6 +2591,13 @@ allow_approved(){
 _gate_written(){
   # No prompt reaches a person here, but their own message does: see _approval_ok above.
   _approval_ok && allow_approved
+  if _p44_never; then
+    gatelog BLOCK 4.4 "a push form no approval covers"
+    echo "GUARD (§4.4): this push ($_P44N) deletes or mirrors a remote ref, and no approval given in a session covers it: an approval records one form, git push <remote> <branch>." >&2
+    echo "Do not ask the user to approve it in this session, by question or by a typed command: they would approve and this command would be refused again." >&2
+    echo "Tell the user, in their language, that this one is theirs to run: in their own terminal, or on GitHub (a merged pull request's branch has a Delete branch button there)." >&2
+    exit 2
+  fi
   [ -n "${_PRF:-}" ] || { _PRF=0; _gb_prh && _PRF=1; }   # the default branch has already asked
   gatelog BLOCK 4.4 "commit/push with no matching approval from the user"
   case "$PERM_MODE" in
@@ -2765,13 +2798,14 @@ _c47_scan(){  # $1 = command. Sets: _C47_N (commits read) _C47_WT _C47_NV _C47_A
   _C47_VARS=" "
   _C47_SHRE='(^|[^A-Za-z0-9_-])git[[:space:]]+(-[^[:space:]]+[[:space:]]+)*commit([[:space:]]|$)'
   _C47_N=0; _C47_WT=""; _C47_NV=""; _C47_AM=""; _C47_UNK=""; _C47_EXP=""; _C47_ENV=""; _C47_SH=""; _C47_CFG=""; _C47_UNR=""; _C47_SUB=""; _C47_ARGS=""; _C47_CD=0; _C47_CDT=""
+  _C47_MK=""; _mk_sub=""
   _c47_read "$1"; m="$_C47_M"
   case "$-" in *f*) ;; *) unglob=1; set -f ;; esac
   set -- $_C47_T
   [ "$unglob" = 1 ] && set +f
   while [ $# -gt 0 ]; do
     raw="$1"; shift
-    [ "$raw" = ";" ] && { ph=cmd; wrapped=0; vc=0; continue; }
+    [ "$raw" = ";" ] && { [ "$ph" = mk ] && _c47_mk_close; ph=cmd; wrapped=0; vc=0; continue; }
     _WAT=0
     case "$raw" in "$m"*|*"$m"*) _c47_w "$raw" ;; *) _W="$raw"; _WQ=0; case "$raw" in *[\$\*\?\[\{]*) _WX=1 ;; *) _WX=0 ;; esac ;; esac
     tok="$_W"
@@ -2878,8 +2912,23 @@ _c47_scan(){  # $1 = command. Sets: _C47_N (commits read) _C47_WT _C47_NV _C47_A
                     _C47_SUB="${tok:0:40}"; ph=skip ;;
           commit) ph=commit; _C47_N=$((_C47_N+1))
                   if [ "$rcd" != 0 ] && [ "$_C47_CD" = 0 ]; then _C47_CD=$rcd; _C47_CDT="$rcdt"; fi ;;
+          merge|cherry-pick|revert|am|commit-tree|pull) ph=mk; _mk_sub="$tok"; _mk_nc=0; _mk_sq=0; _mk_ffo=0; _mk_ffs=0; _mk_rb=0; _mk_ctl=0 ;;
           *) ph=skip ;;
         esac ;;
+      mk)  # §4.4: a git command that makes a commit (see _c47_mk_close). The value of an option that takes one is
+           # skipped, so `-m --squash` is a message and not a flag; of two opposite flags git takes the last, and so
+           # does this (`--no-commit --commit` commits).
+        case "$tok" in
+          -m|-F|-s|-X|-o|-j|--message|--file|--strategy|--strategy-option|--into-name|--cleanup|--mainline|--server-option|--depth|--deepen|--shallow-since|--shallow-exclude|--upload-pack|--jobs|--whitespace|--directory|--exclude|--include|--resolvemsg)
+            case "${1:-}" in ''|\;) ;; *) shift ;; esac ;;
+          --no-commit) _mk_nc=1 ;;  --commit) _mk_nc=0 ;;
+          -n) case "$_mk_sub" in cherry-pick|revert) _mk_nc=1 ;; esac ;;
+          --squash) _mk_sq=1 ;;     --no-squash) _mk_sq=0 ;;
+          --ff-only) _mk_ffo=1; _mk_ffs=1 ;;  --ff|--no-ff) _mk_ffo=0; _mk_ffs=1 ;;
+          -r|--rebase|--rebase=*) _mk_rb=1 ;;  --no-rebase) _mk_rb=0 ;;
+          --abort|--quit|--skip|--show-current-patch|--show-current-patch=*) _mk_ctl=1 ;;
+          --continue) _mk_ctl=0 ;;
+        esac ;;
       commit)
         case "$raw" in
           '<<H') continue ;;                                                           # a here-document; arguments may follow it
@@ -2928,9 +2977,29 @@ _c47_scan(){  # $1 = command. Sets: _C47_N (commits read) _C47_WT _C47_NV _C47_A
         esac ;;
     esac
   done
+  [ "$ph" = mk ] && _c47_mk_close
   [ "$envf" = 1 ] && [ "$_C47_N" != 0 ] && _C47_ENV="a variable that changes what git reads"
   return 0
 }
+# The end of one `git merge|cherry-pick|revert|am|commit-tree|pull`: does it make a commit? The forms that make none
+# stay free. pull.ff=only frees a plain pull only when the command line overrides neither it nor pull.rebase.
+_c47_mk_close(){
+  local free=0
+  case "$_mk_sub" in
+    merge) { [ "$_mk_ctl" = 1 ] || [ "$_mk_nc" = 1 ] || [ "$_mk_sq" = 1 ] || [ "$_mk_ffo" = 1 ]; } && free=1 ;;
+    cherry-pick|revert) { [ "$_mk_ctl" = 1 ] || [ "$_mk_nc" = 1 ]; } && free=1 ;;
+    am) [ "$_mk_ctl" = 1 ] && free=1 ;;
+    pull)
+      if [ "$_mk_rb" = 0 ]; then
+        { [ "$_mk_nc" = 1 ] || [ "$_mk_sq" = 1 ] || [ "$_mk_ffo" = 1 ]; } && free=1
+        if [ "$free" = 0 ] && [ "$_mk_ffs" = 0 ] && [ "$(git -C "${_CWD:-.}" config --get pull.ff 2>/dev/null)" = only ]; then
+          case "$(git -C "${_CWD:-.}" config --get pull.rebase 2>/dev/null)" in ''|false) free=1 ;; esac
+        fi
+      fi ;;
+  esac
+  [ "$free" = 1 ] || _C47_MK="${_C47_MK:-git $_mk_sub}"
+  _mk_sub=""
+}
 
 # The §4.5 half of what that reading finds is judged HERE, before the pre-authorised branch below: with CLAUDE_GIT_OK
 # nobody is asked, so a commit that skips its hooks or rewrites the last commit must not reach that allow. (§4.6 is
@@ -3101,6 +3170,48 @@ if git_has "$CMD_SEEN" 'add|commit|push|checkout|switch'; then
     1|yes|true|on|YES|TRUE|ON) allow_preauthorised ;;   # pre-authorised session (headless/CI)
   esac
 fi
+# §4.4 — A COMMIT MADE BY ANOTHER COMMAND. `git merge`, `cherry-pick`, `revert`, `am`, `commit-tree` and `pull` make a
+# commit as surely as `git commit`, and none of them reached this gate: measured in auto mode, each ran with rc 0, and
+# in the field (3.2.1) a merge commit landed with nobody asked. The forms that make none stay free (_c47_mk_close). The
+# approval a session records is for a staged tree under `git commit`, which these do not commit, so where no prompt
+# reaches a person the call is refused and the user runs it; in default and acceptEdits the user is asked.
+# READ BY THE COMMIT GATE'S OWN READER (_c47_scan), not by a second one: the first version split the text itself, and
+# review found `'git' merge`, `(git merge …)`, `$(git merge …)`, `git -C "a b" merge` and `git merge -m --squash` all
+# passing. The reader pairs quotes as the shell does and skips an option's value. Run only when the text, with quotes
+# and backslashes taken out, holds git and one of the words: builtins up to there, so an ordinary call pays nothing.
+_mk_try=0
+# A quote or a backslash can split the word git itself (`g\it merge`, `"g"it merge`: found in review), so a call that
+# holds one is taken out of its quoting before either word is looked for. Builtins only.
+case "$CMD_SEEN" in *[Gg][Ii][Tt]*|*[\\\"\']*)
+  _gsub "$CMD_SEEN" '\\'$'\n' '' bs; _unquoted "$_GS"; _t="$_GS"
+  case "$_t" in *[Gg][Ii][Tt]*) ;; *) _t="" ;; esac
+  case "$_t" in *[Mm][Ee][Rr][Gg][Ee]*|*[Cc][Hh][Ee][Rr][Rr][Yy]-[Pp][Ii][Cc][Kk]*|*[Rr][Ee][Vv][Ee][Rr][Tt]*|*[Cc][Oo][Mm][Mm][Ii][Tt]-[Tt][Rr][Ee][Ee]*|*[Pp][Uu][Ll][Ll]*|*[[:space:]][Aa][Mm][[:space:]]*|*[[:space:]][Aa][Mm]|*[Aa][Ll][Ii][Aa][Ss].*) _mk_try=1 ;; esac ;;
+esac
+if [ "$_mk_try" = 1 ]; then
+  # The reader resets what the commit rules read from it; this call holds the same text, so they are put back as read.
+  _mk_s1="${_C47_N:-0}" _mk_s2="${_C47_WT:-}" _mk_s3="${_C47_CD:-0}" _mk_s4="${_C47_CDT:-}" _mk_s5="${_C47_CFG:-}"
+  _c47_scan "$CMD"
+  _MKC="$_C47_MK"
+  # An alias given for this one call can stand for any of them: `git -c alias.mg=merge mg` (found in review).
+  case "$_C47_CFG" in *[Aa][Ll][Ii][Aa][Ss].*) [ -z "$_MKC" ] && _MKC="a git alias given in the command ($_C47_CFG)" ;; esac
+  _C47_N="$_mk_s1"; _C47_WT="$_mk_s2"; _C47_CD="$_mk_s3"; _C47_CDT="$_mk_s4"; _C47_CFG="$_mk_s5"
+  if [ -n "$_MKC" ]; then
+    case "${CLAUDE_GIT_OK:-}" in 1|yes|true|on|YES|TRUE|ON) allow_preauthorised ;; esac
+    _mkp=0; case "$PERM_MODE" in default|acceptEdits) _gb_prh || _mkp=1 ;; esac
+    if [ "$_mkp" = 1 ]; then
+      SHORT="$CMD"; [ "${#SHORT}" -gt 300 ] && { _utf8_cut "$SHORT" 300; SHORT="$_UC…"; }
+      ask_user "§4.4 commit approval gate. Claude wants to run a command that makes a commit ($_MKC):
+
+$SHORT
+
+Approve only if you want that commit made. Approving lets Claude run the command itself."
+    fi
+    gatelog BLOCK 4.4 "a commit made by another git command with no approval"
+    echo "GUARD (§4.4): '$_MKC' makes a commit, and in '${PERM_MODE:-unknown}' no prompt reaches a person. The approval a session records is for a staged tree under git commit, and does not cover a commit this command makes." >&2
+    echo "Tell the user, in their language, that this one is theirs to run: in their own terminal, or after Shift+Tab to default mode, where this gate asks them. A form that makes no commit needs no approval (merge --ff-only, pull --ff-only, --no-commit, --squash)." >&2
+    exit 2
+  fi
+fi
 if git_has "$CMD_SEEN" 'commit|push'; then
   # §4.6 — A COMMIT NEEDS A CLEAN REVIEW OF THIS DIFF.
   # crew-review-agent records what it cleared in .claude/review-pass.json; this reads it back and compares two
@@ -3274,6 +3385,10 @@ if git_has "$CMD_SEEN" 'commit|push'; then
         echo "GUARD (§4.6): this call changes directory before it commits, and the commit would not run in the repository" >&2
         echo "this session is in — or the target cannot be read (a variable, 'cd -', more than one). The review record" >&2
         echo "describes what is staged HERE. Run the commit from this directory, or run it yourself in your terminal." >&2
+        # The way through, said (field report, 3.2.1: a session in the root tried `cd <worktree> && git commit` and stopped
+        # there). The gate stays closed to the cd; the session moves into the worktree instead.
+        echo "For another worktree: move the session into it first (EnterWorktree, or start the session there), have the" >&2
+        echo "review run there, and commit from it; or the user commits there in their own terminal." >&2
         exit 2
       fi
     fi
@@ -3297,6 +3412,16 @@ if git_has "$CMD_SEEN" 'commit|push'; then
     # git queries move too, not just the path: a staged diff read in the wrong worktree is the same defect
     # wearing different clothes. `_CWD` is "" when the payload carried none, and `-C .` is then a no-op.
     _RPD="${_CWD:-.}"
+    # ...and at the TOP of that work tree: a cwd that moved into a sub-folder (a subagent's run leaves the Bash tool
+    # in packages/api) looked for packages/api/.claude/review-pass.json and refused a commit whose record sat at the
+    # root (field report, 3.2.1). The top is the nearest folder above that holds `.git` (a directory, or a linked
+    # worktree's file), walked with builtins: a `git rev-parse` here cost the refusal path two processes over the
+    # gate's ceiling (smoke's cost table). Only when the record is not where the cwd is.
+    if [ ! -f "$_RPD/.claude/review-pass.json" ]; then
+      _RPT="$_RPD"
+      while [ ! -e "$_RPT/.git" ]; do case "$_RPT" in */*) _RPT="${_RPT%/*}" ;; *) _RPT=""; break ;; esac; done
+      [ -n "$_RPT" ] && _RPD="$_RPT"   # found or not, the record belongs there, and the refusal names that path
+    fi
     RP="$_RPD/.claude/review-pass.json"
     if [ ! -f "$RP" ]; then
       gatelog BLOCK 4.6 "no review-pass record"

package/kit/hooks/guard-schedule.sh

@@ -81,7 +81,10 @@ while IFS= read -r sv; do
   [ -n "$sv" ] || continue
   _json_unescape "$sv" >/dev/null; _crew_appr_op "$_JU"
   if [ -n "$OP" ]; then
-    if [ "$OP" = loosen ]; then
+    if [ "$OP" = allowverify ]; then
+      echo "GUARD (§4.4): this call schedules a prompt that allows a verify command. Only the user can type /crew-allow-verify; a prompt a tool schedules would grant the hook a command in their place, so the call is refused." >&2
+      echo "Schedule the work without it. If a verify command should run, say which: the user can type /crew-allow-verify <command> themselves." >&2
+    elif [ "$OP" = loosen ]; then
       echo "GUARD (§4.4): this call schedules a prompt that lowers a model floor. Only the user can type /crew-loosen; a prompt a tool schedules would lower the floor in their place, so the call is refused." >&2
       echo "Schedule the work without it. If a floor looks too high, say so: the user can type /crew-loosen $LO_AGENT $LO_CHANGE $LO_RISK themselves." >&2
     else

package/kit/hooks/pre-commit

@@ -471,6 +471,27 @@ fi
 #   escape     : .private-allowlist.txt, a term per full line, for the rare case a term is legitimately public.
 PRIV_F="$(mktemp)"; PTERM_F="$(mktemp)"
 PTF="";  [ -n "$GITROOT" ] && [ -f "$GITROOT/.private-terms.txt" ]     && PTF="$GITROOT/.private-terms.txt"
+# A linked worktree has no copy of a gitignored file, so its own root never holds the terms: committing from one
+# skipped them (measured: the same commit rc=1 in the checkout, rc=0 in its worktree). Read the checkout's list
+# then. Only this list falls back — it tightens; an allowlist missing there only makes the gate stricter.
+# Builtins only: `.git` is a file in a worktree ("gitdir: <dir>"), and <dir>/commondir names the shared .git.
+if [ -z "$PTF" ] && [ -n "$GITROOT" ] && [ -f "$GITROOT/.git" ]; then
+  _gd=""; IFS= read -r _gd < "$GITROOT/.git" || true; _gd="${_gd#gitdir: }"; _gd="${_gd%$'\r'}"
+  case "$_gd" in /*|[A-Za-z]:*) ;; *) _gd="$GITROOT/$_gd" ;; esac
+  _cd=""; [ -f "$_gd/commondir" ] && { IFS= read -r _cd < "$_gd/commondir" || true; _cd="${_cd%$'\r'}"; }
+  if [ -n "$_cd" ]; then
+    case "$_cd" in /*|[A-Za-z]:*) ;; *) _cd="$_gd/$_cd" ;; esac
+    # Only a shared dir named .git sits in its checkout; a bare or separate git dir's parent is not the checkout
+    # (found in review: it read whatever list happened to sit beside the git dir).
+    # A relative commondir reads <gitdir>/../..: drop each trailing "/<name>/.." before asking for the name.
+    _cd="${_cd%/}"; _up=0
+    while :; do case "$_cd" in */..) _cd="${_cd%/..}"; _up=$((_up+1)) ;; */.) _cd="${_cd%/.}" ;; *) break ;; esac; done
+    while [ "$_up" -gt 0 ]; do _cd="${_cd%/*}"; _up=$((_up-1)); done
+    case "$_cd" in */.git) [ -f "${_cd%/.git}/.private-terms.txt" ] && PTF="${_cd%/.git}/.private-terms.txt" ;; esac
+    unset _up
+  fi
+  unset _gd _cd
+fi
 PAL="";  [ -n "$GITROOT" ] && [ -f "$GITROOT/.private-allowlist.txt" ] && PAL="$GITROOT/.private-allowlist.txt"
 {
   # A home path shorter than this cannot be distinguishing (`/root`, `/`), and matching it would flag everything.

package/kit/hooks/prompt-approval.sh

@@ -376,15 +376,24 @@ _crew_appr_path(){  # $1 = a directory -> _AP: the record's path in that worktre
 
 # ---- WHICH TEXT IS AN APPROVAL: one function, asked here of the user's prompt and by guard-schedule.sh of a
 # prompt a tool is about to schedule ---------------------------------------------------------------------------
-_crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push | pending | loosen, or "" when the text is none
+_crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push | pending | loosen | allowverify, or "" when the text is none
   # `loosen` is the other thing only the user's own message does: `/crew-loosen <agent> <change> <risk>` lowers a
   # floor that model routing raised (3.1.0). It is matched HERE so that everything that refuses to hand a session
   # an approval (a scheduled prompt, a `claude -p` call) refuses to hand it this as well: one question, one answer.
   local P="$1" _k _v _vr LC_ALL=C
-  OP=""; LO_AGENT=""; LO_CHANGE=""; LO_RISK=""
+  OP=""; LO_AGENT=""; LO_CHANGE=""; LO_RISK=""; AV_CMD=""
   P="${P//$'\r'/}"
   while :; do case "$P" in [$' \t\n']*) P="${P:1}" ;; *) break ;; esac; done
   while :; do case "$P" in *[$' \t\n']) P="${P%?}" ;; *) break ;; esac; done
+  # `/crew-allow-verify [<command>]` (3.2.2): the user allows a verify command by name, the third thing only their own
+  # message does. The message is at most 120 bytes before it reaches this function (the limit every reader of an
+  # approval shares, guard-schedule.sh's included); a longer one is answered before that limit, not here.
+  _k="${P%%[$' \t']*}"
+  case "$_k" in /*) case "${_k##*[/:]}" in crew-allow-verify)
+    case "$P" in *$'\n'*) return 0 ;; esac
+    AV_CMD="${P:${#_k}}"; while :; do case "$AV_CMD" in [$' \t']*) AV_CMD="${AV_CMD:1}" ;; *) break ;; esac; done
+    OP=allowverify; return 0 ;; esac ;;
+  esac
   [ "${#P}" -le 90 ] || return 0
   _vr=""
   case "$P" in
@@ -664,7 +673,13 @@ _pa_record(){
     case "$TREE" in *[!0-9a-f]*|'') no "git could not write the tree of what is staged (an unresolved merge?)." ;; esac
     if [ "$HEAD_NOW" = NONE ]; then _ht=4b825dc642cb6eb9a060e54bf8d69288fbee4904      # the empty tree
     else _ht="$(git -C "$CWD" rev-parse --verify --quiet 'HEAD^{tree}' 2>/dev/null)"; fi
-    [ "$TREE" != "$_ht" ] || no "nothing is staged, so there is nothing to approve. Stage the change with git add, show the commit message, then ask again." ;;
+    # A commit+push with nothing staged is most often a push alone, answered with the option people pick first (field
+    # report, 3.2.1: twice in a row). It is not turned into a push approval, which the user did not give; the line
+    # names the one they can.
+    if [ "$TREE" = "$_ht" ]; then
+      [ "$OP" = commit+push ] && no "nothing is staged, so there is no commit to approve. For a push of the branch as it is, the answer is Push only (or the user can type /crew-approve push); for a commit, stage it with git add, show the commit message, then ask again."
+      no "nothing is staged, so there is nothing to approve. Stage the change with git add, show the commit message, then ask again."
+    fi ;;
   esac
   case "$OP" in *push)
     [ "$OP" = push ] && [ "$HEAD_NOW" = NONE ] && no "there is no commit to push yet."
@@ -817,6 +832,15 @@ _crew_q_dir "$CWD"; [ -s "$TRIED" ] && { : > "$TRIED"; } 2>/dev/null
 
 # ---- is this message an approval? ------------------------------------------------------------------------
 [ "$_n_prompt" = 1 ] || exit 0
+# A /crew-allow-verify longer than that is answered, not dropped in silence (found in review): it writes nothing, and
+# the limit stays the one guard-schedule.sh reads a scheduled prompt by, so a long one cannot be scheduled past it.
+if [ "${#RAW}" -gt 120 ]; then
+  _lk="${RAW%%[ \\]*}"
+  case "$_lk" in /*) case "${_lk##*[/:]}" in crew-allow-verify)
+    EVN=UserPromptSubmit
+    say "Crewforth: verify command NOT allowed - the message is longer than this command reads (120 characters). Write the line into .claude/crew-model-rules by hand, as verify <command>." "The user sent the command only the user can type, /crew-allow-verify, with a command longer than it reads, and Crewforth added no rule. Tell the user to write that line into .claude/crew-model-rules by hand, as verify <command>." ;; esac ;;
+  esac
+fi
 [ "${#RAW}" -le 120 ] || exit 0        # an approval is a few words; a pasted page is not decoded to find that out
 _json_unescape "$RAW" >/dev/null
 _crew_appr_op "$_JU"
@@ -848,6 +872,14 @@ if [ "$OP" = loosen ]; then
   [ "$_AMF_LOOSE" = 0 ] || nol "that floor was already lowered once ($_AMF_TIER to $_AMF_TO, $_AMF_LTS). It is lowered once for each time it is raised."
   _am_rank "$_AMF_TIER"; [ "$_AMR" -ge 2 ] || nol "the floor on record is $_AMF_TIER, and there is no model below it."
   _am_name $((_AMR-1)); LTO="$_AMN"
+  # Not below the class's own floor (the agent's, then the card's change): a lowering there would be written, read
+  # back as in force, and refused by the gate all the same (found in review: feature, raised to sonnet by the record
+  # of the haiku runs before its own floor was sonnet, was "lowered to haiku" and still refused on haiku).
+  if declare -F _am_change_floor >/dev/null 2>&1; then
+    floor=0; why=""; _am_agent_floor "$LO_AGENT"; _am_change_floor "$LO_CHANGE" "$LO_AGENT"
+    _am_rank "$LTO"
+    if [ "$_AMR" -lt "$floor" ]; then _am_name "$floor"; nol "the class's own floor is $_AMN ($why), which nothing lowers, so a lowering of the raise on record to $LTO would not be in force."; fi
+  fi
   LTS="$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"; case "$LTS" in [0-9][0-9][0-9][0-9]-*Z) ;; *) nol "the clock could not be read." ;; esac
   LF="$_AMS/crew-model-loosened.tsv"
   mkdir -p "$_AMS" 2>/dev/null || nol "the state folder could not be made."
@@ -862,6 +894,51 @@ if [ "$OP" = loosen ]; then
       "The user lowered the calibration floor of $LO_AGENT / $LO_CHANGE / $LO_RISK from $LFROM to $LTO with their own command. The card's own rules still hold (critical work on opus, no verify command on sonnet or above, the agent's floor). If the class fails its first try too often again, the floor rises again."
 fi
 
+# ---- /crew-allow-verify: a verify command the hook may run, allowed by the user and by nobody else --------------
+# .claude/crew-model-rules is closed to the session (guard-write.sh, guard-bash.sh), so doctor's advice "add its line"
+# left the user to find and edit the file by hand (field report, 3.2.1). With nothing after it the command lists the
+# verify commands refused for want of a rule (the reading doctor uses, eval/lib/verify-cmd.sh); with a command after
+# it, that command gets its `verify <command>` line. Only a plain one: one command in letters, digits and . _ / = : , @
+# + % - and spaces, so it can neither chain another (the gate would refuse a chain anyway) nor need escaping here.
+if [ "$OP" = allowverify ]; then
+  noa(){ say "Crewforth: verify command NOT allowed - $1" "The user sent the command only the user can type /crew-allow-verify, and Crewforth added no rule: $1 Tell the user exactly that."; }
+  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) noa "this session has nobody in front of it (it was started with -p, or by a program)." ;; esac
+  _json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
+  { [ -n "$TP" ] && [ -s "$TP" ]; } || noa "this is the first message of this session, or the session keeps no transcript."
+  _lh="${BASH_SOURCE%/*}"; [ "$_lh" = "${BASH_SOURCE}" ] && _lh=.
+  [ -f "$_lh/../eval/lib/verify-cmd.sh" ] || noa "Crewforth's verify reading is not installed beside this hook (eval/lib/verify-cmd.sh)."
+  . "$_lh/../eval/lib/verify-cmd.sh"
+  _avr="${CLAUDE_PROJECT_DIR:-$CWD}"; _avr="${_avr//\\//}"; _avr="${_avr%/}"
+  _avok(){ case "$1" in ''|*[!A-Za-z0-9\ ._/=:,@+%-]*|-*) return 1 ;; esac; return 0; }
+  if [ -z "$AV_CMD" ]; then
+    crew_verify_blocked "$_avr"
+    _avl=""; _avn=0; _avx=0; _avk='/crew-allow-verify'; _avwho='each is the whole message that allows it, and only the user can type it'
+    while IFS= read -r _avc; do [ -n "$_avc" ] || continue
+      if _avok "$_avc"; then _avn=$((_avn+1)); _avl="$_avl $_avk $_avc ·"; else _avx=$((_avx+1)); fi
+    done <<< "$_VB_CMDS"
+    _avl="${_avl% ·}"
+    [ "$_avn$_avx" = 00 ] && say "Crewforth: no verify command on record was refused for want of a rule." "The user sent the command only the user can type, /crew-allow-verify, with nothing after it, and no verify command on record was refused for want of a rule: tell them so, in one line."
+    _avm=""; [ "$_avx" -gt 0 ] && _avm=" $_avx more hold a character this command does not write; those lines go into .claude/crew-model-rules by hand, as verify <command>."
+    say "Crewforth: verify commands refused for want of a rule:${_avl:- none in a form this command writes}.$_avm" "The user sent the command only the user can type, /crew-allow-verify, with nothing after it. Show them, in their language, the lines in Crewforth's message, one per line, as they stand: $_avwho. Do not type one for them."
+  fi
+  case "$AV_CMD" in *[\;\&\|\<\>\`]*|*'$('*) noa "this is more than one command (a ; & | < > or a substitution): the hook runs a verify command alone, so no rule makes it run a chain. Give the card a single command, or a script that holds the chain." ;; esac
+  _avok "$AV_CMD" || noa "'${AV_CMD//[!A-Za-z0-9 ._\/=:,@+%-]/?}' is not one plain command (letters, digits, . _ / = : , @ + % - and spaces only, not starting with -). Write such a line into .claude/crew-model-rules by hand, as verify <command>."
+  case " $AV_CMD " in *" git commit "*|*" git push "*) noa "a git commit or push is never a verify command: the hook does not commit or push." ;; esac
+  crew_verify_open_ended "$AV_CMD" && noa "a rule '$AV_CMD' would let the hook run any command that begins with it (an interpreter, a shell, a wrapper or a package runner, with nothing after it that names the file or the task). Name the script or the test: bash tools/check.sh, npm test, pytest tests/."
+  _avf="$_avr/.claude/crew-model-rules"
+  { [ -L "$_avr/.claude" ] || [ -L "$_avf" ]; } && noa "the rules file, or the .claude folder, is a symbolic link: Crewforth writes the rules only into the project's own file."
+  if [ -f "$_avf" ]; then
+    while IFS= read -r _avl || [ -n "$_avl" ]; do [ "${_avl%$'\r'}" = "verify $AV_CMD" ] && say "Crewforth: verify $AV_CMD is already allowed." "The user sent the command only the user can type, /crew-allow-verify $AV_CMD, and .claude/crew-model-rules already holds that line: tell them so, in one line."; done < "$_avf"
+  fi
+  mkdir -p "$_avr/.claude" 2>/dev/null || noa "the .claude folder could not be made."
+  if [ -s "$_avf" ] && [ "$(tail -c 1 "$_avf" | od -An -tx1 | tr -d ' \n')" != 0a ]; then printf '\n' >> "$_avf" || noa "the rules file could not be written."; fi
+  { printf 'verify %s\n' "$AV_CMD" >> "$_avf"; } 2>/dev/null || noa "the rules file could not be written."
+  # Said only when it is TRUE: the line is read back from the file.
+  _avh=0; while IFS= read -r _avl || [ -n "$_avl" ]; do [ "${_avl%$'\r'}" = "verify $AV_CMD" ] && _avh=1; done < "$_avf"
+  [ "$_avh" = 1 ] || noa "the line was written but is not read back from .claude/crew-model-rules."
+  say "Crewforth: verify command allowed - the hook may now run: $AV_CMD (the line is in .claude/crew-model-rules)." "The user allowed the verify command $AV_CMD with their own command; Crewforth added the line verify $AV_CMD to .claude/crew-model-rules. From the next agent call, the hook runs it when a card names it, and judges the result. Tell the user that in one line. A deny rule of the settings still stops it, and it is still run alone, with no chain."
+fi
+
 # ---- `/crew-approve` with nothing after it: what this session was last refused ---------------------------------
 # guard-bash.sh, when it refuses a commit or a push in auto / dontAsk, writes down what it refused
 # (.claude/state/crew-approval-pending: the session, commit | push | commit+push, the second). The bare command

package/kit/hooks/route-hint.sh

@@ -133,7 +133,24 @@ function norm(s) {
   sub(/^ +/,"",s); sub(/ +$/,"",s)
   return s
 }
-BEGIN { np = " " norm(ENVIRON["CREW_PROMPT"]) " "; bestA=0; bestS=0; nameA=""; nameS="" }
+# A request to READ is not work for an owner. "read the notes at the end of the README" named crew-docs-agent, an
+# agent that writes docs, because the scorer saw `README` and never the verb (field report, 3.2.1). Such a prompt
+# is left to the main thread, and only when the read verb is the REQUEST: the first word of an English prompt
+# (after please / can you / could you), the last word of a Turkish one (before mısın / musun / lütfen), since
+# Turkish puts the verb last. Anywhere else it is a bug report or part of a larger task — "the button does not
+# show the spinner" routed to the frontend expert before this, and must still (found in review). A second clause
+# (and, then, ve, sonra) or one action word anywhere and the hint is scored as before. `show` and `göster` are not
+# on the list: "show the avatar in the navbar" asks for UI work, and routed to the frontend expert (found in review).
+function hasw(re) { return np ~ ("(^| )(" re ")( |$)") }
+function readonly(   w, n, f, l) {
+  n = split(np, w, " "); if (n == 0) return 0
+  f = 1; while (f < n && w[f] ~ /^(please|pls|can|could|would|you)$/) f++
+  l = n; while (l > 1 && w[l] ~ /^(misin|musun|misiniz|musunuz|lutfen|bakalim)$/) l--
+  if (w[f] !~ /^(read|explain|summari[sz]e|describe)$/ &&
+      w[l] !~ /^(oku|okur|okuyun|okuyabilir|anlat|anlatir|anlatin|acikla|aciklar|aciklayin|ozetle|ozetler|ozetleyin)$/) return 0
+  return !hasw("and|then|ve|sonra|(fix|add|updat|writ|wrote|chang|implement|creat|remov|delet|refactor|build|buil|mak|renam|edit|migrat|mov|deploy|ship|instal|upgrad|review|audit|check|test|debug|investigat|optimi[sz]|improv|translat|draft|generat|setup|set|harden|resolv|run|merg|publish|configur|propos|analy[sz])[a-z]?[a-z]?[a-z]?[a-z]?|why|bug|bugs|crash[a-z]*|fail[a-z]*|error[a-z]*|broken|duzelt[a-z]*|ekle[a-z]*|guncelle[a-z]*|yaz[a-z]*|degistir[a-z]*|olustur[a-z]*|sil[a-z]*|kaldir[a-z]*|yap[a-z]*|kur[a-z]*|tasi[a-z]*|incele[a-z]*|denetle[a-z]*|cevir[a-z]*|duzenle[a-z]*|iyilestir[a-z]*|yayinla[a-z]*|cikar[a-z]*|hizlandir[a-z]*|uygula[a-z]*|coz[a-z]*|gelistir[a-z]*|sadelestir[a-z]*|analiz[a-z]*|neden|hata[a-z]*|cokuyor|bozuk[a-z]*")
+}
+BEGIN { np = " " norm(ENVIRON["CREW_PROMPT"]) " "; bestA=0; bestS=0; nameA=""; nameS=""; if (readonly()) exit }
 seen[FILENAME] { next }                                    # one Trigger-phrases line per component, the first
 {
   if (tolower($0) !~ /trigger phrases:/) next

package/kit/hooks/session-guard.sh

@@ -117,6 +117,31 @@ if [ -z "$PCT" ]; then
   [ -n "$PCT" ] || exit 0
 fi
 
+# The reply's own 🔋 line, held against the reading. The discipline says that figure is copied from the hook's
+# line and never guessed, and nothing checked it: a session whose hook line had stopped arriving went on to print
+# 45, 51 … 86 while its transcript measured 30.3, and the user handed the session off on that number. A figure
+# more than CREW_FILL_TOLERANCE points (default 5) from the measurement is reported to the user, every turn it
+# happens. The tolerance covers the one honest gap: a slow-path reading is taken at the END of the turn, so it
+# includes output the model had not produced when it copied the start-of-turn line. No 🔋 line, or none with a
+# number after its '%' (a quoted template, `%NN`), says nothing. Pure expansion: no process.
+WRONG=""
+_said="${IN##*🔋}"
+if [ "$_said" != "$IN" ]; then
+  _said="${_said%%\\n*}"                           # that line only: the payload escapes a newline as \n
+  _num="${_said#*%}"
+  if [ "$_num" != "$_said" ]; then
+    _num="${_num%%[!0-9.,]*}"; _num="${_num/,/.}"  # a Turkish reply writes %30,3
+    _si="${_num%%.*}"; _sf="${_num#"$_si"}"; _sf="${_sf#.}"; _sf="${_sf:0:1}"
+    _mi="${PCT%%.*}"; _mf="${PCT#"$_mi"}"; _mf="${_mf#.}"; _mf="${_mf:0:1}"
+    case "$_si$_sf$_mi$_mf" in ''|*[!0-9]*) ;; *)
+      [ -n "$_si" ] && [ -n "$_mi" ] && {
+        _d=$(( (10#$_si * 10 + 10#${_sf:-0}) - (10#$_mi * 10 + 10#${_mf:-0}) )); [ "$_d" -lt 0 ] && _d=$(( -_d ))
+        [ "$_d" -gt $(( ${CREW_FILL_TOLERANCE:-5} * 10 )) ] && WRONG="%$_num"
+      } ;;
+    esac
+  fi
+fi
+
 # Highest threshold crossed. Compared under LC_ALL=C so '77.2' parses identically everywhere.
 # Compared on the integer part with shell arithmetic rather than two `awk` calls. Two spawns at the end of every
 # turn bought nothing here: the thresholds are whole numbers, so truncating is exactly equivalent — 89.9 is below
@@ -126,24 +151,26 @@ case "$INT" in ''|*[!0-9]*) exit 0 ;; esac
 TIER=""
 [ "$INT" -ge 90 ] && TIER=90
 [ -n "$TIER" ] || { [ "$INT" -ge 75 ] && TIER=75; }
-[ -n "$TIER" ] || exit 0
-
+MSG=""
 # Already warned at this tier this session? Stay silent — one alert per threshold, not one per turn.
-[ -e "$(marker "$TIER")" ] && exit 0
-# Stamp this tier AND every lower one: jumping 60 -> 92 in a single turn must not let the 75 warning fire
-# later (e.g. once /compact drops the fill back under 90).
-for t in 75 90; do
-  [ "$t" -le "$TIER" ] && { : > "$(marker "$t")" 2>/dev/null || true; }
-done
-
-if [ "$TIER" = 90 ]; then
-  MSG="CRITICAL >90% — hand off NOW: apply the handoff skill, write docs/SESSION_STATE.md, then /clear. Auto-compaction is close and it will cost you the handover."
-else
-  MSG=">75% threshold. Recommended: apply the handoff skill, write docs/SESSION_STATE.md, then /clear. Manual; your call."
+if [ -n "$TIER" ] && [ ! -e "$(marker "$TIER")" ]; then
+  # Stamp this tier AND every lower one: jumping 60 -> 92 in a single turn must not let the 75 warning fire
+  # later (e.g. once /compact drops the fill back under 90).
+  for t in 75 90; do
+    [ "$t" -le "$TIER" ] && { : > "$(marker "$t")" 2>/dev/null || true; }
+  done
+  if [ "$TIER" = 90 ]; then
+    MSG="CRITICAL >90% — hand off NOW: apply the handoff skill, write docs/SESSION_STATE.md, then /clear. Auto-compaction is close and it will cost you the handover."
+  else
+    MSG=">75% threshold. Recommended: apply the handoff skill, write docs/SESSION_STATE.md, then /clear. Manual; your call."
+  fi
 fi
+[ -n "$MSG$WRONG" ] || exit 0
 
 # JSON-escape backslash + double-quote in the measured line before embedding it.
 SAFE="$(printf '%s' "$LINE" | sed 's/\\/\\\\/g; s/"/\\"/g')"
+OUT="${MSG:+$SAFE | $MSG}"
+[ -n "$WRONG" ] && OUT="⚠️ The 🔋 line in this reply says $WRONG, but the fill measured from the transcript is: $SAFE. The reply's figure is not a measurement — do not decide a handoff on it.${OUT:+ · $OUT}"
 # exit 0 + systemMessage: a neutral, user-facing warning (NOT a hook error, does NOT force an extra turn).
-printf '{"systemMessage":"%s | %s"}\n' "$SAFE" "$MSG"
+printf '{"systemMessage":"%s"}\n' "$OUT"
 exit 0

package/kit/hooks/session-rehydrate.sh

@@ -62,8 +62,12 @@ HOOKMSG=""
 if [ -f "$ROOT/.claude/hooks/pre-commit" ] && git -C "$ROOT" rev-parse --git-dir >/dev/null 2>&1; then
   _hp="$(git -C "$ROOT" config --get core.hooksPath 2>/dev/null || true)"; _hp="${_hp%$'\r'}"; _hp="${_hp//\\//}"
   case "${_hp%/}" in
-    .claude/hooks|*/.claude/hooks|.claude/git-shim|*/.claude/git-shim) ;;
-    '') HOOKMSG="Crewforth's git hooks are not connected in this repository: core.hooksPath is not set, so a commit made outside Claude Code is not scanned for traces, secrets or size. Tell the user once, in one line. The fix is theirs to run in their own terminal, not yours: git config core.hooksPath .claude/hooks, or the Crewforth update when the repository has hooks of its own. /crew-doctor shows the state." ;;
+    .claude/hooks|.claude/git-shim) ;;
+    # Absolute, as the installers now write it (a relative one runs no hook in a linked worktree): it has to be THERE.
+    # A repository that was moved keeps the old path, and git then runs no hook at all, with nothing said.
+    */.claude/hooks|*/.claude/git-shim)
+        [ -d "$_hp" ] || HOOKMSG="Crewforth's git hooks are not connected in this repository: core.hooksPath points at a directory that does not exist (the repository was moved?), so no commit is scanned for traces, secrets or size. Tell the user once, in one line. The fix is theirs to run in their own terminal, not yours: the Crewforth update (npx crewforth update) writes the path again. /crew-doctor shows the state." ;;
+    '') HOOKMSG="Crewforth's git hooks are not connected in this repository: core.hooksPath is not set, so a commit made outside Claude Code is not scanned for traces, secrets or size. Tell the user once, in one line. The fix is theirs to run in their own terminal, not yours: the Crewforth update (npx crewforth update), which arms it and keeps any hooks the repository has of its own. /crew-doctor shows the state." ;;
     *)  HOOKMSG="Crewforth's git hooks are not connected in this repository: core.hooksPath points at another hook directory, so a commit made outside Claude Code is not scanned for traces, secrets or size. Tell the user once, in one line. The fix is theirs to run in their own terminal, not yours: the Crewforth update keeps that directory's hooks and runs Crewforth's before them. /crew-doctor shows the state." ;;
   esac
 fi