etymd 0.19.0 → 0.19.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # etymd
 
+## 0.19.1
+
+### Patch Changes
+
+- 51ecbc9: Generated pre-push hooks shellcheck every commit in the pushed range, each materialised from
+  git's object store, instead of reading the working tree. A push whose tip is clean but whose
+  earlier commits carry a broken script is now refused; the working tree no longer substitutes
+  for the pushed bytes; a push that creates a branch checks every commit no remote already has;
+  and a commit that cannot be materialised refuses the push rather than passing as unread.
+  Regenerate existing hooks with `etymd gates --yes` to apply the correction.
+
 ## 0.19.0
 
 ### Minor Changes

package/dist/{approve-Y36ZO6IL.js → approve-J6JU7MBX.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { section, theme, print, renderBaselineDrift, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-DLHC7QON.js';
-import { VERSION } from './chunk-L4KIIKXI.js';
+import { scanProject } from './chunk-6DJMKZGK.js';
+import { VERSION } from './chunk-KQFEKOON.js';
 import { readBaseline, summarizeBaselineDrift, isDriftEmpty, writeBaseline, deriveProfile } from './chunk-P6ATKV2R.js';
-import { PACK_VERSION } from './chunk-U7BCBJIH.js';
+import { PACK_VERSION } from './chunk-2DRA7S67.js';
 import './chunk-4VPBP6K6.js';
 
 // src/commands/approve.ts

package/dist/audit-5N2TU2X7.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+export { run } from './chunk-GFUDKTC5.js';
+import './chunk-UMKC3OWQ.js';
+import './chunk-WKP72Z3J.js';
+import './chunk-3E2IPCRY.js';
+import './chunk-HI7NWPRA.js';
+import './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
+import './chunk-P6ATKV2R.js';
+import './chunk-2DRA7S67.js';
+import './chunk-4VPBP6K6.js';

package/dist/{brief-ILB6RMSQ.js → brief-NHHILXIH.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { print, theme } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-DLHC7QON.js';
-import './chunk-L4KIIKXI.js';
+import { scanProject } from './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
 import { ETYMD_DIR } from './chunk-P6ATKV2R.js';
-import './chunk-U7BCBJIH.js';
+import './chunk-2DRA7S67.js';
 import './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';

package/dist/{chunk-U7BCBJIH.js → chunk-2DRA7S67.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
 // src/pack/version.ts
-var PACK_VERSION = "14";
+var PACK_VERSION = "15";
 
 export { PACK_VERSION };

package/dist/{chunk-DLHC7QON.js → chunk-6DJMKZGK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-L4KIIKXI.js';
-import { PACK_VERSION } from './chunk-U7BCBJIH.js';
+import { VERSION } from './chunk-KQFEKOON.js';
+import { PACK_VERSION } from './chunk-2DRA7S67.js';
 import { normalizeRelPath, isDirectory, pathExists, readText, readJson, git, matchesAnyGlob } from './chunk-4VPBP6K6.js';
 import path from 'path';
 import { execFile } from 'child_process';

package/dist/{chunk-EZRK4MV3.js → chunk-7N5JDXQG.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { isSafeGateCommand, generateAgentsMd, generateClaudePointerMd, isSelfBuildRepo, generatePreCommitHook, generateCommitMsgHook, generatePrePushHook, generateShellDiscoveryScript, generateArtifactCheckScript, fileOrigin } from './chunk-HSRHOVII.js';
+import { isSafeGateCommand, generateAgentsMd, generateClaudePointerMd, isSelfBuildRepo, generatePreCommitHook, generateCommitMsgHook, generatePrePushHook, generateShellDiscoveryScript, generateArtifactCheckScript, fileOrigin } from './chunk-PQISPOB2.js';
 import { DEFAULT_CONFIG } from './chunk-P6ATKV2R.js';
 import { readText, pathExists } from './chunk-4VPBP6K6.js';
 import path from 'path';

package/dist/{chunk-4IESOWHQ.js → chunk-GFUDKTC5.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { runAudit } from './chunk-KIPD3N77.js';
-import { parseFailOnTier, meetsFailOn } from './chunk-EYUW3UJU.js';
+import { runAudit } from './chunk-UMKC3OWQ.js';
+import { parseFailOnTier, meetsFailOn } from './chunk-WKP72Z3J.js';
 import { print, section, theme, renderLensCoverage, renderFindings, renderLedgerDiff } from './chunk-HI7NWPRA.js';
 
 // src/commands/audit.ts

package/dist/{chunk-L4KIIKXI.js → chunk-KQFEKOON.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // package.json
 var package_default = {
-  version: "0.19.0"};
+  version: "0.19.1"};
 
 // src/version.ts
 var VERSION = package_default.version;

package/dist/{chunk-ZCOIZVSM.js → chunk-M7XDP6FT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { runAudit } from './chunk-KIPD3N77.js';
+import { runAudit } from './chunk-UMKC3OWQ.js';
 import { readLedger } from './chunk-3E2IPCRY.js';
-import { checkClaudePointer, CLAUDE_AGENTS_FALLBACK_VERSION } from './chunk-DLHC7QON.js';
+import { checkClaudePointer, CLAUDE_AGENTS_FALLBACK_VERSION } from './chunk-6DJMKZGK.js';
 import { DEFAULT_CONFIG, ETYMD_DIR } from './chunk-P6ATKV2R.js';
 import { readText, isDirectory, git, pathExists } from './chunk-4VPBP6K6.js';
 import os from 'os';
@@ -1006,8 +1006,8 @@ async function checkGuardedEmails(manifest, findings, disclosures) {
   }
 }
 async function checkGateDrift(manifest, findings, disclosures) {
-  const { planWorkflow } = await import('./generate-6IPTCLYG.js');
-  const { scanProject } = await import('./scan-V53PGAQ6.js');
+  const { planWorkflow } = await import('./generate-62GQSCKH.js');
+  const { scanProject } = await import('./scan-F6OW4ANK.js');
   const { readConfig } = await import('./config-724Y3IOB.js');
   for (const entry of manifest.entries) {
     const root = entry.resolvedRoot;

package/dist/{chunk-HSRHOVII.js → chunk-PQISPOB2.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { PACK_VERSION } from './chunk-U7BCBJIH.js';
+import { PACK_VERSION } from './chunk-2DRA7S67.js';
 import { createHash } from 'crypto';
 
 var GENERATION_MARKER_RE = /^(?:# |<!-- )etymd:generated pack-v\S+ ([0-9a-f]{16})(?: -->)?$/;
@@ -161,15 +161,21 @@ function contentScreenCall(opts) {
     `${indent}fi`
   ].join("\n");
 }
-function localHookCall(hook) {
+function localHookCall(hook, feedRefs = false) {
+  const refsCapture = feedRefs ? `# git hands the pushed refs to pre-push ONCE, on stdin \u2014 one line per ref:
+# "<local ref> <local sha> <remote ref> <remote sha>". The shell gate below reads them too, so
+# they are captured here and fed to each.
+refs=$(cat)
+` : "";
+  const call = feedRefs ? `printf '%s\\n' "$refs" | "$LOCAL" "$@" || exit 1` : `"$LOCAL" "$@" || exit 1`;
   return `# Repo-owned checks. This file is generated and will be overwritten; \`.githooks/${hook}.local\`
 # is yours \u2014 etymd never reads, writes, or regenerates it. Put project-specific guards there.
 # A guard running tests that build fixture repositories should scrub git's exported GIT_* names
 # first \u2014 a child git inherits them and ignores its cwd, so the suite would hit the real repo:
 #   env $(env | grep -o '^GIT_[A-Za-z0-9_]*' | sed 's/^/-u /') <your command>
 LOCAL="$(dirname "$0")/${hook}.local"
-if [ -x "$LOCAL" ]; then
-  "$LOCAL" "$@" || exit 1
+${refsCapture}if [ -x "$LOCAL" ]; then
+  ${call}
 fi`;
 }
 function generatePreCommitHook(selfBuild = false) {
@@ -178,10 +184,10 @@ function generatePreCommitHook(selfBuild = false) {
 
 ${localHookCall("pre-commit")}
 
-# Content screen \u2014 staged file bytes. Refuses to commit environment, guarded-side or identity
-# detail into a repo whose history is (or could become) public. The checker and its patterns
-# are machine-local by design, so this is a NO-OP wherever no checker is installed: safe to
-# commit anywhere, active only where you opted in.
+# Content screen \u2014 staged file bytes. Refuses to commit detail about your environment, work
+# or identity into a repo whose history is (or could become) public. The checker and its
+# patterns are machine-local by design, so this is a NO-OP wherever no checker is installed:
+# safe to commit anywhere, active only where you opted in.
 #
 # Bypass, with a reason: git commit --no-verify
 ${contentGateResolution(selfBuild)}
@@ -256,9 +262,10 @@ function generateShellDiscoveryScript() {
 # side, positional here). Verdicts land in the scratch: scripts (NUL-delimited matches) and one
 # dot per decision into count / zsh-count / skip-count, tallied by the hook after the pipeline.
 #
-# A path with nothing readable behind it \u2014 a submodule entry, a dangling symlink, a file
-# deleted from the worktree while still tracked \u2014 cannot lie about its contents, so it is a
-# disclosed skip, never a block: an absent worktree file is routine dirty state. A regular file
+# The hook runs it from inside a commit materialised from git's object store, so paths resolve
+# against that tree, never the working tree. A path with nothing readable behind it \u2014 a
+# submodule entry, a dangling symlink \u2014 cannot lie about its contents, so it is a disclosed
+# skip, never a block. A regular file
 # that EXISTS but cannot be read is the other branch \u2014 coverage would silently shrink, so it
 # fails, naming the path.
 #
@@ -299,16 +306,20 @@ done
 function shellcheckStep() {
   return `
 # Shell correctness. Scripts are discovered by shebang over TRACKED files at push time, so a
-# script added later is covered without regenerating this hook. The classifier is
-# discover-shell-scripts.sh beside this hook \u2014 tracked and shebanged like what it classifies,
+# script added later is covered without regenerating this hook. The commits BEING PUSHED are
+# the bytes that ship, so each one is materialised from git's object store and checked there \u2014
+# never the working tree (wrong in both directions: a fixed tree let an unfixed commit ship, and
+# a dirty tree shared by several sessions blocked an unrelated push) and never the tip alone (a
+# bad commit under a clean tip shipped while the gate read only the tip's fix). The classifier
+# is discover-shell-scripts.sh beside this hook \u2014 tracked and shebanged like what it classifies,
 # so the scan it implements finds and checks it too. zsh is NOT in the checked set:
 # the checker cannot parse it (SC1071 is a parser-level error no inline directive can silence),
 # so checking it would fail every push on the parser, not on the script. Excluded \u2014 and said so
 # at run time below, because a coverage hole that is silent is indistinguishable from coverage.
 # The same honesty splits the unreadable: a regular file that exists but cannot be read blocks
 # the push (coverage would otherwise silently shrink), while a tracked path with nothing readable
-# behind it \u2014 a submodule entry, a dangling symlink, a file deleted from the worktree while
-# still tracked \u2014 is counted and said so below as skipped, never a block.
+# behind it \u2014 a submodule entry, a dangling symlink \u2014 is counted and said so below as skipped,
+# never a block.
 #
 # "the checker", not its name, on purpose: a comment whose first word is that name is read as
 # a DIRECTIVE, and an unparseable directive is itself an error (SC1072/SC1073). A hook that
@@ -327,39 +338,97 @@ if command -v shellcheck >/dev/null 2>&1; then
     shellcheck_tmp=$(mktemp -d) || exit 1
     trap 'rm -rf "$shellcheck_tmp"' 0
     trap 'exit 1' 1 2 3 15
-    git ls-files -z > "$shellcheck_tmp/tracked" || {
-      echo "etymd: cannot enumerate tracked files for shellcheck" >&2
-      exit 1
-    }
-    : > "$shellcheck_tmp/scripts" && : > "$shellcheck_tmp/count" && : > "$shellcheck_tmp/zsh-count" && : > "$shellcheck_tmp/skip-count" || exit 1
-    xargs -0 "$(dirname "$0")/discover-shell-scripts.sh" "$shellcheck_tmp" < "$shellcheck_tmp/tracked" || {
-      echo "etymd: shell script discovery failed; shellcheck coverage is incomplete" >&2
+    # Every commit in each pushed range, never the tip alone: pushing two commits \u2014 a bad
+    # script, then its fix \u2014 passed a tip-only read while the bad commit landed on the remote.
+    # An all-zero local sha is a delete (nothing to check). An all-zero REMOTE sha is a new
+    # branch: everything no remote already has is being pushed, so the range is the local sha
+    # minus every remote-tracking ref \u2014 commits a remote already received were gated when they
+    # landed there, and the residue is exactly this push's new commits. A remote sha this clone
+    # has never seen (the remote moved on since the last fetch) cannot bound a range, so it takes
+    # the same new-branch rule instead of refusing a push the gate could have read. Enumeration
+    # failure refuses the push: a range the gate could not list is a range it did not read.
+    # (pattern) with both parens: bash 3.2 (macOS /bin/sh) cannot parse an unbalanced )
+    # in a case pattern.
+    : > "$shellcheck_tmp/shas" || exit 1
+    printf '%s\\n' "$refs" | while read -r _lref lsha _rref rsha; do
+      case "$lsha" in
+        (*[!0]*) ;;
+        (*) continue ;;
+      esac
+      case "$rsha" in
+        (*[!0]*)
+          if git cat-file -e "\${rsha}^{commit}" 2>/dev/null; then
+            git rev-list "$rsha..$lsha"
+          else
+            git rev-list "$lsha" --not --remotes
+          fi ;;
+        (*) git rev-list "$lsha" --not --remotes ;;
+      esac >> "$shellcheck_tmp/shas" || exit 1
+    done || {
+      echo "etymd: could not enumerate the commits being pushed for shellcheck" >&2
       exit 1
     }
-    count=$(wc -c < "$shellcheck_tmp/count") || exit 1
-    zsh_count=$(wc -c < "$shellcheck_tmp/zsh-count") || exit 1
-    skip_count=$(wc -c < "$shellcheck_tmp/skip-count") || exit 1
-    if [ "$skip_count" -gt 0 ]; then
-      echo "\u203A shellcheck: $((skip_count)) tracked path(s) with nothing readable behind them (submodule, dangling symlink, or deleted from the worktree) \u2014 not checked, not failed"
-    fi
-    if [ "$zsh_count" -gt 0 ]; then
-      echo "\u203A shellcheck: $((zsh_count)) zsh script(s) excluded \u2014 shellcheck cannot parse zsh (SC1071); not checked, not failed"
-    fi
-    if [ "$count" -gt 0 ]; then
-      echo "\u203A shellcheck ($((count)) scripts, blocking at severity=warning)"
-      xargs -0 shellcheck -S warning -- < "$shellcheck_tmp/scripts" || {
-        echo "  fix, or justify inline with '# shellcheck disable=SCxxxx  # why'"
+    shas=$(sort -u "$shellcheck_tmp/shas") || exit 1
+    [ -n "$shas" ] || echo "\u203A shellcheck: no commit in the pushed refs (deletes only, or nothing on stdin) \u2014 nothing to check"
+    # Resolved once, before any cd: the classifier runs inside each materialised tree, and a
+    # relative hook path would no longer point at it from there.
+    discover="$(cd "$(dirname "$0")" && pwd)/discover-shell-scripts.sh" || exit 1
+    for sha in $shas; do
+      # A fresh directory per commit, removed once that commit is checked so a long push does
+      # not pile up one full tree per commit; the subshell trap above still cleans the root on
+      # every early exit.
+      tree=$(mktemp -d "$shellcheck_tmp/commit.XXXXXX") || exit 1
+      # Checked out through a scratch index, never \`git archive\`: archive honours the
+      # export-ignore and export-subst attributes, so a script marked export-ignore would leave
+      # the checked set without a word. read-tree + checkout-index writes every tracked blob.
+      # Large-file pointers stay pointers \u2014 they are never shell, and a push must not need the
+      # network to be checked.
+      if ! git cat-file -e "\${sha}^{commit}" 2>/dev/null \\
+         || ! GIT_INDEX_FILE="$shellcheck_tmp/index" git read-tree "$sha" 2>/dev/null \\
+         || ! GIT_INDEX_FILE="$shellcheck_tmp/index" GIT_LFS_SKIP_SMUDGE=1 \\
+              git checkout-index -a -f --prefix="$tree/" 2>/dev/null; then
+        echo "\u2717 shellcheck: could not materialise $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha") \u2014 refusing the push rather than certifying bytes this gate did not read" >&2
+        exit 1
+      fi
+      if [ -n "$(git ls-tree -r --name-only "$sha")" ] && [ -z "$(ls -A "$tree")" ]; then
+        echo "\u2717 shellcheck: $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha") extracted to an empty tree \u2014 refusing the push" >&2
+        exit 1
+      fi
+      : > "$shellcheck_tmp/scripts" && : > "$shellcheck_tmp/count" && : > "$shellcheck_tmp/zsh-count" && : > "$shellcheck_tmp/skip-count" || exit 1
+      git ls-tree -r -z --name-only "$sha" > "$shellcheck_tmp/tracked" || {
+        echo "etymd: cannot enumerate the tree of $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha") for shellcheck" >&2
+        exit 1
+      }
+      ( cd "$tree" && xargs -0 "$discover" "$shellcheck_tmp" ) < "$shellcheck_tmp/tracked" || {
+        echo "etymd: shell script discovery failed; shellcheck coverage is incomplete" >&2
         exit 1
       }
-      # Everything below the blocking bar, shown once the push is already cleared. Never affects
-      # the exit code \u2014 advice that can fail a push is not advice.
-      advice=$(xargs -0 shellcheck -S style -f gcc -- < "$shellcheck_tmp/scripts" 2>/dev/null \\
-        | grep -v ': warning:\\|: error:' || true)
-      if [ -n "$advice" ]; then
-        echo "  \xB7 style/info (not blocking):"
-        printf '%s\\n' "$advice" | sed 's/^/    /'
+      count=$(wc -c < "$shellcheck_tmp/count") || exit 1
+      zsh_count=$(wc -c < "$shellcheck_tmp/zsh-count") || exit 1
+      skip_count=$(wc -c < "$shellcheck_tmp/skip-count") || exit 1
+      if [ "$skip_count" -gt 0 ]; then
+        echo "\u203A shellcheck: $((skip_count)) tracked path(s) with nothing readable behind them (submodule or dangling symlink) \u2014 not checked, not failed"
       fi
-    fi
+      if [ "$zsh_count" -gt 0 ]; then
+        echo "\u203A shellcheck: $((zsh_count)) zsh script(s) excluded \u2014 shellcheck cannot parse zsh (SC1071); not checked, not failed"
+      fi
+      if [ "$count" -gt 0 ]; then
+        echo "\u203A shellcheck ($((count)) scripts in $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha"), blocking at severity=warning)"
+        ( cd "$tree" && xargs -0 shellcheck -S warning -- < "$shellcheck_tmp/scripts" ) || {
+          echo "  fix, or justify inline with '# shellcheck disable=SCxxxx  # why'"
+          exit 1
+        }
+        # Everything below the blocking bar, shown once the push is already cleared. Never affects
+        # the exit code \u2014 advice that can fail a push is not advice.
+        advice=$( ( cd "$tree" && xargs -0 shellcheck -S style -f gcc -- < "$shellcheck_tmp/scripts" 2>/dev/null ) \\
+          | grep -v ': warning:\\|: error:' || true)
+        if [ -n "$advice" ]; then
+          echo "  \xB7 style/info (not blocking):"
+          printf '%s\\n' "$advice" | sed 's/^/    /'
+        fi
+      fi
+      rm -rf "$tree" || exit 1
+    done
   ) || exit 1
 else
   echo "\u203A shellcheck skipped (not on PATH) \u2014 install it to gate this repo's shell scripts"
@@ -401,7 +470,7 @@ fi`;
   return stampGenerated(`#!/usr/bin/env sh
 # etymd: correctness gate. Mirrors CI cheapest-first; blocks the push on any failure.
 
-${localHookCall("pre-push")}${runner}
+${localHookCall("pre-push", true)}${runner}
 ${body}${shellStep}
 ${auditStep}
 

package/dist/{chunk-KIPD3N77.js → chunk-UMKC3OWQ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { stateFreshnessLens, rankFindings, listInstructionFiles, buildTruthEnv, emptyCounters, packageManagerUsage, checkDocRefs, listStateDocuments, loadDecisionLedger, checkDecisionRefs, checkTextClaims } from './chunk-EYUW3UJU.js';
+import { stateFreshnessLens, rankFindings, listInstructionFiles, buildTruthEnv, emptyCounters, packageManagerUsage, checkDocRefs, listStateDocuments, loadDecisionLedger, checkDecisionRefs, checkTextClaims } from './chunk-WKP72Z3J.js';
 import { readLedger, reconcileLedger, writeLedger, visibleFindings } from './chunk-3E2IPCRY.js';
 import { measureContext, contextFileLabel } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-DLHC7QON.js';
+import { scanProject } from './chunk-6DJMKZGK.js';
 import { DEFAULT_CONFIG, ETYMD_DIR, writeCachedFacts, readBaseline, readConfig, deriveProfile, baselineCarriesMachinePath, BASELINE_FILE, CONFIG_FILE } from './chunk-P6ATKV2R.js';
-import { PACK_VERSION } from './chunk-U7BCBJIH.js';
+import { PACK_VERSION } from './chunk-2DRA7S67.js';
 import { pathExists, readText, readJson, isCiEnvironment, isExecutable } from './chunk-4VPBP6K6.js';
 import path from 'path';
 import YAML from 'yaml';

package/dist/{chunk-EYUW3UJU.js → chunk-WKP72Z3J.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { expandFileGlobs } from './chunk-DLHC7QON.js';
+import { expandFileGlobs } from './chunk-6DJMKZGK.js';
 import { DEFAULT_CONFIG, CONFIG_FILE } from './chunk-P6ATKV2R.js';
 import { readText, isDirectory, matchesAnyGlob, normalizeRelPath, readJson, pathExists, git } from './chunk-4VPBP6K6.js';
 import path3 from 'path';

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { VERSION } from './chunk-L4KIIKXI.js';
+import { VERSION } from './chunk-KQFEKOON.js';
 import path from 'path';
 import { Command } from 'commander';
 import pc from 'picocolors';
@@ -31,7 +31,7 @@ program.command("audit").description("Verify every instruction claim against the
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./audit-RONSEYFS.js');
+    const { run } = await import('./audit-5N2TU2X7.js');
     await run({
       cwd: resolveCwd(cmd),
       json: opts.json,
@@ -44,7 +44,7 @@ program.command("audit").description("Verify every instruction claim against the
 );
 program.command("init").description("Onboard the truth guard: approve the baseline; scaffold AGENTS.md only if asked").option("-y, --yes", "accept defaults without prompting (never overwrites)").option("--with-agents", "also scaffold a minimal AGENTS.md where none exists (off by default)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./init-7HWVHZMF.js');
+    const { run } = await import('./init-G4XXFXVD.js');
     await run({ cwd: resolveCwd(cmd), yes: opts.yes, withAgents: opts.withAgents });
   })
 );
@@ -52,19 +52,19 @@ program.command("approve").description(
   "Re-approve the committed baseline after intentional structural changes (non-interactive)"
 ).action(
   (_opts, cmd) => action(async () => {
-    const { run } = await import('./approve-Y36ZO6IL.js');
+    const { run } = await import('./approve-J6JU7MBX.js');
     await run({ cwd: resolveCwd(cmd) });
   })
 );
 program.command("scan").description("Deterministically reckon the project into a facts index").option("--json", "print the raw facts as JSON").option("--no-save", "do not write the .etymd cache").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./scan-DLKYG5BB.js');
+    const { run } = await import('./scan-PJH32H7C.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json, save: opts.save });
   })
 );
 program.command("doctor").description('Alias for `audit --truth` \u2014 "are the recorded instructions still true?"').option("--json", "print findings as JSON").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./doctor-EHRADIUZ.js');
+    const { run } = await import('./doctor-264Q5PLY.js');
     await run({ cwd: resolveCwd(cmd), json: opts.json });
   })
 );
@@ -76,7 +76,7 @@ program.command("context").description("Measure the always-loaded context footpr
 );
 program.command("brief").description("Emit a grounded briefing for the in-repo agent to complete the semantic layer").option("--human", "write a human onboarding brief instead of the agent briefing").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./brief-ILB6RMSQ.js');
+    const { run } = await import('./brief-NHHILXIH.js');
     await run({ cwd: resolveCwd(cmd), human: opts.human });
   })
 );
@@ -90,7 +90,7 @@ program.command("premise").argument("[task]", "the task you are about to hand an
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (task, opts, cmd) => action(async () => {
-    const { run } = await import('./premise-U6JIB2QG.js');
+    const { run } = await import('./premise-RNMAKMVA.js');
     await run({
       cwd: resolveCwd(cmd),
       task,
@@ -132,7 +132,7 @@ var fleet = program.command("fleet").description(
   "exit non-zero when findings at/above this tier exist (risk|gap|polish)"
 ).action(
   (opts, cmd) => action(async () => {
-    const { sweep } = await import('./fleet-KFF3N2O7.js');
+    const { sweep } = await import('./fleet-VT625Q2J.js');
     await sweep({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -147,7 +147,7 @@ var fleet = program.command("fleet").description(
 );
 fleet.command("check").description("Validate the manifest pair only \u2014 no lenses: dangling mappings, duplicates, leaks").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--json", "print the findings as JSON (EXPERIMENTAL through 0.2.x)").action(
   (_opts, cmd) => action(async () => {
-    const { check } = await import('./fleet-KFF3N2O7.js');
+    const { check } = await import('./fleet-VT625Q2J.js');
     const opts = cmd.optsWithGlobals();
     await check({ cwd: resolveCwd(cmd), manifest: opts.manifest, json: opts.json });
   })
@@ -156,7 +156,7 @@ fleet.command("board").description(
   "Render the fleet board: every project's milestones (contract key `milestones`) plus a ranked initiatives table"
 ).option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").option("--initiatives <file>", "the hand-edited initiatives table (rank | id | initiative | \u2026)").option("--out <file>", "write the Markdown board here instead of printing it").option("--json", "print the board as JSON (EXPERIMENTAL)").action(
   (opts, cmd) => action(async () => {
-    const { board } = await import('./fleet-KFF3N2O7.js');
+    const { board } = await import('./fleet-VT625Q2J.js');
     const shared = cmd.optsWithGlobals();
     await board({
       cwd: resolveCwd(cmd),
@@ -172,7 +172,7 @@ fleet.command("add").argument("<dir>", "directory of the project to register").d
   "public-repo | public-bound | private \u2014 mandatory for personal entries"
 ).option("-y, --yes", "skip prompts; every mandatory value must be passed as a flag").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (dir, opts, cmd) => action(async () => {
-    const { add } = await import('./fleet-KFF3N2O7.js');
+    const { add } = await import('./fleet-VT625Q2J.js');
     const shared = cmd.optsWithGlobals();
     await add({
       cwd: resolveCwd(cmd),
@@ -195,7 +195,7 @@ fleet.command("dismiss").argument("<name>", "the registered project name").argum
   "Dismiss a project's finding from any cwd \u2014 guarded ledgers persist beside the manifest"
 ).requiredOption("--reason <text>", "why it is dismissed \u2014 recorded so the decision survives").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { dismiss } = await import('./fleet-KFF3N2O7.js');
+    const { dismiss } = await import('./fleet-VT625Q2J.js');
     const opts = cmd.optsWithGlobals();
     await dismiss({
       cwd: resolveCwd(cmd),
@@ -210,7 +210,7 @@ fleet.command("accept").argument("<name>", "the registered project name").argume
   "Accept a project's finding as a known trade-off \u2014 guarded ledgers persist beside the manifest"
 ).option("--reason <text>", "optional note on why the trade-off is accepted").option("--manifest <file>", "the fleet manifest \u2014 required unless the cwd holds registry.json").action(
   (name, id, _opts, cmd) => action(async () => {
-    const { accept } = await import('./fleet-KFF3N2O7.js');
+    const { accept } = await import('./fleet-VT625Q2J.js');
     const opts = cmd.optsWithGlobals();
     await accept({ cwd: resolveCwd(cmd), manifest: opts.manifest, name, id, reason: opts.reason });
   })
@@ -225,7 +225,7 @@ program.command("propose").description(
   "the fleet manifest \u2014 runs a read-only sweep now (no delta baseline move)"
 ).option("--from <file>", "read a stored `etymd fleet --json` output instead of sweeping").option("--json", "print the proposal/1 records as JSON (EXPERIMENTAL)").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./propose-NZMEPZIL.js');
+    const { run } = await import('./propose-35JXMEPH.js');
     await run({
       cwd: resolveCwd(cmd),
       manifest: opts.manifest,
@@ -256,7 +256,7 @@ program.command("screen").description(
 );
 program.command("gates").description("Install the local git-hook gates (process \u2192 pre-commit, correctness \u2192 pre-push)").option("--ci", "note about the CI review gate (ships later; local gates install now)").option("-y, --yes", "skip prompts; never overwrites a hand-edited hook").action(
   (opts, cmd) => action(async () => {
-    const { run } = await import('./gates-UJ23THID.js');
+    const { run } = await import('./gates-YUMSTKUG.js');
     await run({ cwd: resolveCwd(cmd), ci: opts.ci, yes: opts.yes });
   })
 );

package/dist/{doctor-EHRADIUZ.js → doctor-264Q5PLY.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { run } from './chunk-4IESOWHQ.js';
-import './chunk-KIPD3N77.js';
-import './chunk-EYUW3UJU.js';
+import { run } from './chunk-GFUDKTC5.js';
+import './chunk-UMKC3OWQ.js';
+import './chunk-WKP72Z3J.js';
 import './chunk-3E2IPCRY.js';
 import './chunk-HI7NWPRA.js';
-import './chunk-DLHC7QON.js';
-import './chunk-L4KIIKXI.js';
+import './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
 import './chunk-P6ATKV2R.js';
-import './chunk-U7BCBJIH.js';
+import './chunk-2DRA7S67.js';
 import './chunk-4VPBP6K6.js';
 
 // src/commands/doctor.ts

package/dist/{fleet-KFF3N2O7.js → fleet-VT625Q2J.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { dismiss, accept } from './chunk-HOR4M6EC.js';
-import { sweepFleet, FLEET_JSON_SCHEMA, checkManifest, FLEET_TRUST_VALUES, isFleetTrust, MILESTONES_FILE, parseMilestones, parseInitiatives, BOARD_JSON_SCHEMA, renderBoard, loadFleetManifest, fleetLedgerTarget, ensureFindingRecorded } from './chunk-ZCOIZVSM.js';
-import './chunk-KIPD3N77.js';
-import { parseFailOnTier, meetsFailOn } from './chunk-EYUW3UJU.js';
+import { sweepFleet, FLEET_JSON_SCHEMA, checkManifest, FLEET_TRUST_VALUES, isFleetTrust, MILESTONES_FILE, parseMilestones, parseInitiatives, BOARD_JSON_SCHEMA, renderBoard, loadFleetManifest, fleetLedgerTarget, ensureFindingRecorded } from './chunk-M7XDP6FT.js';
+import './chunk-UMKC3OWQ.js';
+import { parseFailOnTier, meetsFailOn } from './chunk-WKP72Z3J.js';
 import './chunk-3E2IPCRY.js';
-import { generateClaudePointerMd } from './chunk-HSRHOVII.js';
+import { generateClaudePointerMd } from './chunk-PQISPOB2.js';
 import { print, theme, section, renderFleetRows, renderFleetNotes, renderFindings, TIER_BADGE, glyph } from './chunk-HI7NWPRA.js';
-import { checkClaudePointer, scanProject } from './chunk-DLHC7QON.js';
-import './chunk-L4KIIKXI.js';
+import { checkClaudePointer, scanProject } from './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
 import './chunk-P6ATKV2R.js';
-import './chunk-U7BCBJIH.js';
+import './chunk-2DRA7S67.js';
 import { readText, pathExists, git } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import os from 'os';

package/dist/{gates-UJ23THID.js → gates-YUMSTKUG.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-GWGKEPRX.js';
-import { deriveFailOn, derivedCommands, planWorkflow } from './chunk-EZRK4MV3.js';
-import { runPrefix, isSafeGateCommand } from './chunk-HSRHOVII.js';
+import { deriveFailOn, derivedCommands, planWorkflow } from './chunk-7N5JDXQG.js';
+import { runPrefix, isSafeGateCommand } from './chunk-PQISPOB2.js';
 import { section, print, glyph, theme, renderPlan } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-DLHC7QON.js';
-import './chunk-L4KIIKXI.js';
+import { scanProject } from './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
 import { readConfig, CONFIG_FILE, configPath } from './chunk-P6ATKV2R.js';
-import './chunk-U7BCBJIH.js';
+import './chunk-2DRA7S67.js';
 import { readText, git } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';

package/dist/{generate-6IPTCLYG.js → generate-62GQSCKH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-EZRK4MV3.js';
-import './chunk-HSRHOVII.js';
+export { deriveFailOn, derivedCommands, planWorkflow, riskReachability } from './chunk-7N5JDXQG.js';
+import './chunk-PQISPOB2.js';
 import './chunk-P6ATKV2R.js';
-import './chunk-U7BCBJIH.js';
+import './chunk-2DRA7S67.js';
 import './chunk-4VPBP6K6.js';

package/dist/index.d.ts

@@ -1127,7 +1127,7 @@ declare const gateIntegrityLens: Lens;
  * Gaps in the sequence are deliberate: a number stays retired even when the change that took it
  * never shipped, so a version cited in a baseline or a record means exactly one pack, ever.
  */
-declare const PACK_VERSION = "14";
+declare const PACK_VERSION = "15";
 
 declare const VERSION: string;
 declare const NAME: string;

package/dist/index.js

@@ -20,7 +20,7 @@ var __export = (target, all) => {
 var PACK_VERSION;
 var init_version = __esm({
   "src/pack/version.ts"() {
-    PACK_VERSION = "14";
+    PACK_VERSION = "15";
   }
 });
 
@@ -30,7 +30,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "etymd",
-      version: "0.19.0",
+      version: "0.19.1",
       description: "Keep your agent instructions true \u2014 verify AGENTS.md, CLAUDE.md, rules, skills, and the task you hand an agent against the actual repo, with drift caught over time and a regression ledger.",
       keywords: [
         "cli",
@@ -1237,15 +1237,21 @@ function contentScreenCall(opts) {
     `${indent}fi`
   ].join("\n");
 }
-function localHookCall(hook) {
+function localHookCall(hook, feedRefs = false) {
+  const refsCapture = feedRefs ? `# git hands the pushed refs to pre-push ONCE, on stdin \u2014 one line per ref:
+# "<local ref> <local sha> <remote ref> <remote sha>". The shell gate below reads them too, so
+# they are captured here and fed to each.
+refs=$(cat)
+` : "";
+  const call = feedRefs ? `printf '%s\\n' "$refs" | "$LOCAL" "$@" || exit 1` : `"$LOCAL" "$@" || exit 1`;
   return `# Repo-owned checks. This file is generated and will be overwritten; \`.githooks/${hook}.local\`
 # is yours \u2014 etymd never reads, writes, or regenerates it. Put project-specific guards there.
 # A guard running tests that build fixture repositories should scrub git's exported GIT_* names
 # first \u2014 a child git inherits them and ignores its cwd, so the suite would hit the real repo:
 #   env $(env | grep -o '^GIT_[A-Za-z0-9_]*' | sed 's/^/-u /') <your command>
 LOCAL="$(dirname "$0")/${hook}.local"
-if [ -x "$LOCAL" ]; then
-  "$LOCAL" "$@" || exit 1
+${refsCapture}if [ -x "$LOCAL" ]; then
+  ${call}
 fi`;
 }
 function generatePreCommitHook(selfBuild = false) {
@@ -1254,10 +1260,10 @@ function generatePreCommitHook(selfBuild = false) {
 
 ${localHookCall("pre-commit")}
 
-# Content screen \u2014 staged file bytes. Refuses to commit environment, guarded-side or identity
-# detail into a repo whose history is (or could become) public. The checker and its patterns
-# are machine-local by design, so this is a NO-OP wherever no checker is installed: safe to
-# commit anywhere, active only where you opted in.
+# Content screen \u2014 staged file bytes. Refuses to commit detail about your environment, work
+# or identity into a repo whose history is (or could become) public. The checker and its
+# patterns are machine-local by design, so this is a NO-OP wherever no checker is installed:
+# safe to commit anywhere, active only where you opted in.
 #
 # Bypass, with a reason: git commit --no-verify
 ${contentGateResolution(selfBuild)}
@@ -1318,9 +1324,10 @@ function generateShellDiscoveryScript() {
 # side, positional here). Verdicts land in the scratch: scripts (NUL-delimited matches) and one
 # dot per decision into count / zsh-count / skip-count, tallied by the hook after the pipeline.
 #
-# A path with nothing readable behind it \u2014 a submodule entry, a dangling symlink, a file
-# deleted from the worktree while still tracked \u2014 cannot lie about its contents, so it is a
-# disclosed skip, never a block: an absent worktree file is routine dirty state. A regular file
+# The hook runs it from inside a commit materialised from git's object store, so paths resolve
+# against that tree, never the working tree. A path with nothing readable behind it \u2014 a
+# submodule entry, a dangling symlink \u2014 cannot lie about its contents, so it is a disclosed
+# skip, never a block. A regular file
 # that EXISTS but cannot be read is the other branch \u2014 coverage would silently shrink, so it
 # fails, naming the path.
 #
@@ -1361,16 +1368,20 @@ done
 function shellcheckStep() {
   return `
 # Shell correctness. Scripts are discovered by shebang over TRACKED files at push time, so a
-# script added later is covered without regenerating this hook. The classifier is
-# discover-shell-scripts.sh beside this hook \u2014 tracked and shebanged like what it classifies,
+# script added later is covered without regenerating this hook. The commits BEING PUSHED are
+# the bytes that ship, so each one is materialised from git's object store and checked there \u2014
+# never the working tree (wrong in both directions: a fixed tree let an unfixed commit ship, and
+# a dirty tree shared by several sessions blocked an unrelated push) and never the tip alone (a
+# bad commit under a clean tip shipped while the gate read only the tip's fix). The classifier
+# is discover-shell-scripts.sh beside this hook \u2014 tracked and shebanged like what it classifies,
 # so the scan it implements finds and checks it too. zsh is NOT in the checked set:
 # the checker cannot parse it (SC1071 is a parser-level error no inline directive can silence),
 # so checking it would fail every push on the parser, not on the script. Excluded \u2014 and said so
 # at run time below, because a coverage hole that is silent is indistinguishable from coverage.
 # The same honesty splits the unreadable: a regular file that exists but cannot be read blocks
 # the push (coverage would otherwise silently shrink), while a tracked path with nothing readable
-# behind it \u2014 a submodule entry, a dangling symlink, a file deleted from the worktree while
-# still tracked \u2014 is counted and said so below as skipped, never a block.
+# behind it \u2014 a submodule entry, a dangling symlink \u2014 is counted and said so below as skipped,
+# never a block.
 #
 # "the checker", not its name, on purpose: a comment whose first word is that name is read as
 # a DIRECTIVE, and an unparseable directive is itself an error (SC1072/SC1073). A hook that
@@ -1389,39 +1400,97 @@ if command -v shellcheck >/dev/null 2>&1; then
     shellcheck_tmp=$(mktemp -d) || exit 1
     trap 'rm -rf "$shellcheck_tmp"' 0
     trap 'exit 1' 1 2 3 15
-    git ls-files -z > "$shellcheck_tmp/tracked" || {
-      echo "etymd: cannot enumerate tracked files for shellcheck" >&2
-      exit 1
-    }
-    : > "$shellcheck_tmp/scripts" && : > "$shellcheck_tmp/count" && : > "$shellcheck_tmp/zsh-count" && : > "$shellcheck_tmp/skip-count" || exit 1
-    xargs -0 "$(dirname "$0")/discover-shell-scripts.sh" "$shellcheck_tmp" < "$shellcheck_tmp/tracked" || {
-      echo "etymd: shell script discovery failed; shellcheck coverage is incomplete" >&2
+    # Every commit in each pushed range, never the tip alone: pushing two commits \u2014 a bad
+    # script, then its fix \u2014 passed a tip-only read while the bad commit landed on the remote.
+    # An all-zero local sha is a delete (nothing to check). An all-zero REMOTE sha is a new
+    # branch: everything no remote already has is being pushed, so the range is the local sha
+    # minus every remote-tracking ref \u2014 commits a remote already received were gated when they
+    # landed there, and the residue is exactly this push's new commits. A remote sha this clone
+    # has never seen (the remote moved on since the last fetch) cannot bound a range, so it takes
+    # the same new-branch rule instead of refusing a push the gate could have read. Enumeration
+    # failure refuses the push: a range the gate could not list is a range it did not read.
+    # (pattern) with both parens: bash 3.2 (macOS /bin/sh) cannot parse an unbalanced )
+    # in a case pattern.
+    : > "$shellcheck_tmp/shas" || exit 1
+    printf '%s\\n' "$refs" | while read -r _lref lsha _rref rsha; do
+      case "$lsha" in
+        (*[!0]*) ;;
+        (*) continue ;;
+      esac
+      case "$rsha" in
+        (*[!0]*)
+          if git cat-file -e "\${rsha}^{commit}" 2>/dev/null; then
+            git rev-list "$rsha..$lsha"
+          else
+            git rev-list "$lsha" --not --remotes
+          fi ;;
+        (*) git rev-list "$lsha" --not --remotes ;;
+      esac >> "$shellcheck_tmp/shas" || exit 1
+    done || {
+      echo "etymd: could not enumerate the commits being pushed for shellcheck" >&2
       exit 1
     }
-    count=$(wc -c < "$shellcheck_tmp/count") || exit 1
-    zsh_count=$(wc -c < "$shellcheck_tmp/zsh-count") || exit 1
-    skip_count=$(wc -c < "$shellcheck_tmp/skip-count") || exit 1
-    if [ "$skip_count" -gt 0 ]; then
-      echo "\u203A shellcheck: $((skip_count)) tracked path(s) with nothing readable behind them (submodule, dangling symlink, or deleted from the worktree) \u2014 not checked, not failed"
-    fi
-    if [ "$zsh_count" -gt 0 ]; then
-      echo "\u203A shellcheck: $((zsh_count)) zsh script(s) excluded \u2014 shellcheck cannot parse zsh (SC1071); not checked, not failed"
-    fi
-    if [ "$count" -gt 0 ]; then
-      echo "\u203A shellcheck ($((count)) scripts, blocking at severity=warning)"
-      xargs -0 shellcheck -S warning -- < "$shellcheck_tmp/scripts" || {
-        echo "  fix, or justify inline with '# shellcheck disable=SCxxxx  # why'"
+    shas=$(sort -u "$shellcheck_tmp/shas") || exit 1
+    [ -n "$shas" ] || echo "\u203A shellcheck: no commit in the pushed refs (deletes only, or nothing on stdin) \u2014 nothing to check"
+    # Resolved once, before any cd: the classifier runs inside each materialised tree, and a
+    # relative hook path would no longer point at it from there.
+    discover="$(cd "$(dirname "$0")" && pwd)/discover-shell-scripts.sh" || exit 1
+    for sha in $shas; do
+      # A fresh directory per commit, removed once that commit is checked so a long push does
+      # not pile up one full tree per commit; the subshell trap above still cleans the root on
+      # every early exit.
+      tree=$(mktemp -d "$shellcheck_tmp/commit.XXXXXX") || exit 1
+      # Checked out through a scratch index, never \`git archive\`: archive honours the
+      # export-ignore and export-subst attributes, so a script marked export-ignore would leave
+      # the checked set without a word. read-tree + checkout-index writes every tracked blob.
+      # Large-file pointers stay pointers \u2014 they are never shell, and a push must not need the
+      # network to be checked.
+      if ! git cat-file -e "\${sha}^{commit}" 2>/dev/null \\
+         || ! GIT_INDEX_FILE="$shellcheck_tmp/index" git read-tree "$sha" 2>/dev/null \\
+         || ! GIT_INDEX_FILE="$shellcheck_tmp/index" GIT_LFS_SKIP_SMUDGE=1 \\
+              git checkout-index -a -f --prefix="$tree/" 2>/dev/null; then
+        echo "\u2717 shellcheck: could not materialise $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha") \u2014 refusing the push rather than certifying bytes this gate did not read" >&2
+        exit 1
+      fi
+      if [ -n "$(git ls-tree -r --name-only "$sha")" ] && [ -z "$(ls -A "$tree")" ]; then
+        echo "\u2717 shellcheck: $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha") extracted to an empty tree \u2014 refusing the push" >&2
+        exit 1
+      fi
+      : > "$shellcheck_tmp/scripts" && : > "$shellcheck_tmp/count" && : > "$shellcheck_tmp/zsh-count" && : > "$shellcheck_tmp/skip-count" || exit 1
+      git ls-tree -r -z --name-only "$sha" > "$shellcheck_tmp/tracked" || {
+        echo "etymd: cannot enumerate the tree of $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha") for shellcheck" >&2
+        exit 1
+      }
+      ( cd "$tree" && xargs -0 "$discover" "$shellcheck_tmp" ) < "$shellcheck_tmp/tracked" || {
+        echo "etymd: shell script discovery failed; shellcheck coverage is incomplete" >&2
         exit 1
       }
-      # Everything below the blocking bar, shown once the push is already cleared. Never affects
-      # the exit code \u2014 advice that can fail a push is not advice.
-      advice=$(xargs -0 shellcheck -S style -f gcc -- < "$shellcheck_tmp/scripts" 2>/dev/null \\
-        | grep -v ': warning:\\|: error:' || true)
-      if [ -n "$advice" ]; then
-        echo "  \xB7 style/info (not blocking):"
-        printf '%s\\n' "$advice" | sed 's/^/    /'
+      count=$(wc -c < "$shellcheck_tmp/count") || exit 1
+      zsh_count=$(wc -c < "$shellcheck_tmp/zsh-count") || exit 1
+      skip_count=$(wc -c < "$shellcheck_tmp/skip-count") || exit 1
+      if [ "$skip_count" -gt 0 ]; then
+        echo "\u203A shellcheck: $((skip_count)) tracked path(s) with nothing readable behind them (submodule or dangling symlink) \u2014 not checked, not failed"
       fi
-    fi
+      if [ "$zsh_count" -gt 0 ]; then
+        echo "\u203A shellcheck: $((zsh_count)) zsh script(s) excluded \u2014 shellcheck cannot parse zsh (SC1071); not checked, not failed"
+      fi
+      if [ "$count" -gt 0 ]; then
+        echo "\u203A shellcheck ($((count)) scripts in $(git rev-parse --short "$sha" 2>/dev/null || echo "$sha"), blocking at severity=warning)"
+        ( cd "$tree" && xargs -0 shellcheck -S warning -- < "$shellcheck_tmp/scripts" ) || {
+          echo "  fix, or justify inline with '# shellcheck disable=SCxxxx  # why'"
+          exit 1
+        }
+        # Everything below the blocking bar, shown once the push is already cleared. Never affects
+        # the exit code \u2014 advice that can fail a push is not advice.
+        advice=$( ( cd "$tree" && xargs -0 shellcheck -S style -f gcc -- < "$shellcheck_tmp/scripts" 2>/dev/null ) \\
+          | grep -v ': warning:\\|: error:' || true)
+        if [ -n "$advice" ]; then
+          echo "  \xB7 style/info (not blocking):"
+          printf '%s\\n' "$advice" | sed 's/^/    /'
+        fi
+      fi
+      rm -rf "$tree" || exit 1
+    done
   ) || exit 1
 else
   echo "\u203A shellcheck skipped (not on PATH) \u2014 install it to gate this repo's shell scripts"
@@ -1455,7 +1524,7 @@ fi`;
   return stampGenerated(`#!/usr/bin/env sh
 # etymd: correctness gate. Mirrors CI cheapest-first; blocks the push on any failure.
 
-${localHookCall("pre-push")}${runner}
+${localHookCall("pre-push", true)}${runner}
 ${body}${shellStep}
 ${auditStep}
 

package/dist/{init-7HWVHZMF.js → init-G4XXFXVD.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { applyFiles } from './chunk-GWGKEPRX.js';
-import { planWorkflow } from './chunk-EZRK4MV3.js';
-import './chunk-HSRHOVII.js';
+import { planWorkflow } from './chunk-7N5JDXQG.js';
+import './chunk-PQISPOB2.js';
 import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-DLHC7QON.js';
-import { VERSION } from './chunk-L4KIIKXI.js';
+import { scanProject } from './chunk-6DJMKZGK.js';
+import { VERSION } from './chunk-KQFEKOON.js';
 import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-P6ATKV2R.js';
-import { PACK_VERSION } from './chunk-U7BCBJIH.js';
+import { PACK_VERSION } from './chunk-2DRA7S67.js';
 import { git, readText } from './chunk-4VPBP6K6.js';
 import { promises } from 'fs';
 import path from 'path';

package/dist/{premise-U6JIB2QG.js → premise-RNMAKMVA.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { parseFailOnTier, meetsFailOn, buildTruthEnv, emptyCounters, checkTextClaims, checkDocRefs, loadDecisionLedger, checkDecisionRefs, rankFindings, PATH_TOKEN_RE, HOSTNAME_RE, KNOWN_EXTENSIONS, NAMESPACE_IDENT, NAMESPACE_STOP } from './chunk-EYUW3UJU.js';
+import { parseFailOnTier, meetsFailOn, buildTruthEnv, emptyCounters, checkTextClaims, checkDocRefs, loadDecisionLedger, checkDecisionRefs, rankFindings, PATH_TOKEN_RE, HOSTNAME_RE, KNOWN_EXTENSIONS, NAMESPACE_IDENT, NAMESPACE_STOP } from './chunk-WKP72Z3J.js';
 import { print, section, theme, renderFindings } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-DLHC7QON.js';
-import './chunk-L4KIIKXI.js';
+import { scanProject } from './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
 import { ETYMD_DIR } from './chunk-P6ATKV2R.js';
-import './chunk-U7BCBJIH.js';
+import './chunk-2DRA7S67.js';
 import { readText, pathExists } from './chunk-4VPBP6K6.js';
 import path from 'path';
 import { promises } from 'fs';

package/dist/{propose-NZMEPZIL.js → propose-35JXMEPH.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { sweepFleet, loadFleetManifest, FLEET_JSON_SCHEMA } from './chunk-ZCOIZVSM.js';
-import './chunk-KIPD3N77.js';
-import './chunk-EYUW3UJU.js';
+import { sweepFleet, loadFleetManifest, FLEET_JSON_SCHEMA } from './chunk-M7XDP6FT.js';
+import './chunk-UMKC3OWQ.js';
+import './chunk-WKP72Z3J.js';
 import './chunk-3E2IPCRY.js';
 import { print, section, theme, renderFleetNotes } from './chunk-HI7NWPRA.js';
-import './chunk-DLHC7QON.js';
-import './chunk-L4KIIKXI.js';
+import './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
 import './chunk-P6ATKV2R.js';
-import './chunk-U7BCBJIH.js';
+import './chunk-2DRA7S67.js';
 import { readText } from './chunk-4VPBP6K6.js';
 import path from 'path';
 

package/dist/scan-F6OW4ANK.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
+import './chunk-2DRA7S67.js';
+import './chunk-4VPBP6K6.js';

package/dist/{scan-DLKYG5BB.js → scan-PJH32H7C.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { print, renderFacts, theme } from './chunk-HI7NWPRA.js';
-import { scanProject } from './chunk-DLHC7QON.js';
-import './chunk-L4KIIKXI.js';
+import { scanProject } from './chunk-6DJMKZGK.js';
+import './chunk-KQFEKOON.js';
 import { writeCachedFacts } from './chunk-P6ATKV2R.js';
-import './chunk-U7BCBJIH.js';
+import './chunk-2DRA7S67.js';
 import './chunk-4VPBP6K6.js';
 
 // src/commands/scan.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules, skills, and the task you hand an agent against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",

package/dist/audit-RONSEYFS.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-export { run } from './chunk-4IESOWHQ.js';
-import './chunk-KIPD3N77.js';
-import './chunk-EYUW3UJU.js';
-import './chunk-3E2IPCRY.js';
-import './chunk-HI7NWPRA.js';
-import './chunk-DLHC7QON.js';
-import './chunk-L4KIIKXI.js';
-import './chunk-P6ATKV2R.js';
-import './chunk-U7BCBJIH.js';
-import './chunk-4VPBP6K6.js';

package/dist/scan-V53PGAQ6.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-export { scanProject } from './chunk-DLHC7QON.js';
-import './chunk-L4KIIKXI.js';
-import './chunk-U7BCBJIH.js';
-import './chunk-4VPBP6K6.js';