session-orchestrator 5.1.0 → 5.2.0

package/hooks/_lib/vcs-create-matcher.mjs

@@ -96,28 +96,25 @@
  *     triage of a per-session counter file
  *     (`.orchestrator/runtime/issue-budget/<hash>.json`, #1141) or in a
  *     transcript census of real create calls.
- *   - An `xargs`-driven create is NOT matched, and `xargs` is deliberately not
- *     a transparent wrapper: `command-blocker.mjs` classes it as an INTERPRETER
- *     (`SHELL_EXEC_INTERPRETERS`), because unwrapping it there would LOOSEN the
- *     destructive-command guard that shares this lexer. Measured 2026-09-09
- *     against this file — all four shapes yield 0 statements, so neither the
- *     cap nor the loop-deny sees them:
- *
- *         xargs glab issue create --title X                          → 0
- *         echo X | xargs -I% glab issue create --title %             → 0
- *         seq 1 50 | xargs -I% gh api -X POST …/issues -f title=%    → 0
- *         xargs -n1 glab issue create                                → 0
- *
- *     Widening this one shape means changing what `resolveSegmentVerb` reports
- *     for `xargs` — read by the four OTHER consumers of that resolver
- *     (`grep -rln resolveSegmentVerb scripts/ hooks/`, 2026-09-09:
- *     `scripts/lib/project-hygiene.mjs`, `scripts/lib/scope-gate.mjs`,
- *     `hooks/pre-bash-sessions-ledger-guard.mjs`,
- *     `hooks/pre-bash-destructive-guard.mjs`) — so it is a deliberate
- *     cross-consumer change, never a local patch here.
- *     Pinned by `tests/hooks/vcs-create-matcher.test.mjs`. Revisit when an
- *     `xargs`-driven create shows up in a transcript census or in the overflow
- *     triage of a per-session counter file.
+ *   - An `xargs`-driven create IS matched since #1289 — but LOCALLY, in
+ *     {@link xargsDrivenRemainder}, never by changing what `resolveSegmentVerb`
+ *     reports for `xargs`. That resolver still answers `verb: 'xargs'`, because
+ *     `command-blocker.mjs` classes `xargs` as an INTERPRETER
+ *     (`SHELL_EXEC_INTERPRETERS`) and unwrapping it there would LOOSEN the
+ *     destructive-command guard the five positional consumers of that resolver
+ *     share. Measured 2026-09-16 against this file — the four shapes that
+ *     yielded 0 statements before now yield 1 each, flagged `bulk: true`:
+ *
+ *         xargs glab issue create --title X                          → 1
+ *         echo X | xargs -I% glab issue create --title %             → 1
+ *         seq 1 50 | xargs -I% gh api -X POST …/issues -f title=%    → 1
+ *         xargs -n1 glab issue create                                → 1
+ *
+ *     A `bulk` statement is never CHARGED: the multiplicity comes from the
+ *     stdin word list and is unknowable before the shell runs, so
+ *     `hooks/pre-bash-issue-budget.mjs` treats it exactly like a loop body —
+ *     deny in `strict`, report the undercount in `warn`. The remaining ceiling
+ *     is the option grammar, named at {@link xargsDrivenRemainder}.
  *   - A paren glued to the verb (`(glab issue create …)`) is not reached: it
  *     lexes as the single word `(glab`. This is `command-blocker.mjs`'s own
  *     named ceiling on `COMMAND_POSITION_KEYWORDS` (#1145), inherited here
@@ -164,7 +161,14 @@ export const CREATE_REGEX = /^\s*(gh|glab)\s+(pr|mr|issue)\s+(create|new)\b/;
 function statementsOf(command) {
   if (typeof command !== 'string' || command.length === 0) return [];
   try {
-    return splitChainSegments(tokenizeCommand(command));
+    const segments = splitChainSegments(tokenizeCommand(command));
+    const out = [];
+    for (const segment of segments) {
+      out.push(segment);
+      const rest = xargsDrivenRemainder(segment);
+      if (rest !== null) out.push(rest);
+    }
+    return out;
   } catch {
     // Fail OPEN, matching every other error path in the two consuming hooks:
     // a lexer that throws must not wedge every Bash call. Worst case is a
@@ -173,6 +177,64 @@ function statementsOf(command) {
   }
 }
 
+/**
+ * xargs' own options, split by whether they consume a SEPARATE next token.
+ * Both the separated (`-n 1`) and the attached (`-n1`, `-I%`) spellings are
+ * handled — the attached form is what agents actually write.
+ */
+const XARGS_VALUE_FLAGS = new Set(['-I', '-i', '-n', '-P', '-L', '-s', '-E', '-d', '-a']);
+
+/**
+ * The UTILITY xargs drives, as an additional statement — or `null` when the
+ * segment is not an `xargs` call, or nothing follows its options (#1289).
+ *
+ * ## Why here and not in the shared lexer
+ *
+ * `command-blocker.mjs` classes `xargs` as an INTERPRETER, deliberately NOT a
+ * transparent wrapper: unwrapping it there would resolve past it for the FIVE
+ * positional consumers of `resolveSegmentVerb` and LOOSEN the destructive-command
+ * guard. So the widening stays local to this matcher, where the only question is
+ * "does this command file issues?" — the shared verb resolution is untouched,
+ * and `resolveSegmentVerb` still reports `verb: 'xargs'`.
+ *
+ * The returned array carries a non-index `xargsDriven` marker so
+ * {@link findIssueCreateStatements} can flag the statement `bulk: true`: the
+ * multiplicity is set by the STDIN word list, which does not exist at hook time,
+ * so such a create can never be charged — only denied or reported.
+ *
+ * NAMED CEILING (BV-004): only the option spellings in `XARGS_VALUE_FLAGS` plus
+ * bare boolean/unknown short flags are skipped. A SEPARATED long form
+ * (`--max-args 5`) leaves its operand in verb position, so the remainder does not
+ * match a create shape and the call is missed — the pre-#1289 behaviour, i.e. an
+ * under-report, never a false deny. REVISIT TRIGGER: a separated-long-form xargs
+ * create in a transcript census.
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} segment
+ * @returns {Array<{ text: string, quoted: boolean }>|null}
+ */
+function xargsDrivenRemainder(segment) {
+  if (segment.length === 0) return null;
+  const head = segment[0];
+  if (head.quoted || head.text.replace(/^.*\//, '') !== 'xargs') return null;
+
+  let i = 1;
+  while (i < segment.length) {
+    const tok = segment[i];
+    if (tok.quoted) break; // a quoted word is the utility, never an option
+    const text = tok.text;
+    if (text === '--') { i++; break; }
+    if (!text.startsWith('-') || text === '-') break;
+    if (XARGS_VALUE_FLAGS.has(text)) { i += 2; continue; } // separated: `-n 1`
+    if (XARGS_VALUE_FLAGS.has(text.slice(0, 2))) { i += 1; continue; } // attached: `-I%`
+    i += 1; // boolean (`-0`, `-r`, `-t`) or an unknown flag
+  }
+
+  const rest = segment.slice(i);
+  if (rest.length === 0) return null;
+  rest.xargsDriven = true;
+  return rest;
+}
+
 /**
  * `--help` short-circuits a cobra command (both `gh` and `glab` are cobra
  * CLIs): the help text is printed and the command body never runs, so
@@ -609,13 +671,19 @@ export function findIssueCreateStatements(command) {
       continue;
     }
     literalCatPaths ??= singleQuotedCatPaths(command);
-    out.push({
+    const statement = {
       shape,
       tokens,
       text: tokens.map((t) => t.text).join(' '),
       ...fieldsFromTokens(tokens, shape, literalCatPaths),
       cwdChanged,
-    });
+    };
+    // `bulk` — the create files an UNKNOWN number of issues (#1289). Today the
+    // only source is an `xargs`-driven statement, whose multiplicity is the
+    // stdin word list; the key is present ONLY when true, so every existing
+    // consumer of this shape is unaffected.
+    if (tokens.xargsDriven === true) statement.bulk = true;
+    out.push(statement);
   }
   return out;
 }
@@ -689,6 +757,124 @@ export function isIssueCreate(command) {
   return matchVcsCreate(command)?.kind === 'issue';
 }
 
+/**
+ * EVERY issue-create STATEMENT that sits inside a LOOP BODY — one token array
+ * per implicated loop, `[]` when none (#1145, #1379).
+ *
+ * Returning the statements rather than a boolean is what lets the consuming hook
+ * bind the CAP EXEMPTION to the statement that CAUSED the bulk classification.
+ * Measured 2026-09-16 against `hooks/pre-bash-issue-budget.mjs` before this
+ * change, which classified the exemption on `statements[0]`:
+ *
+ *     for i in 1 2 3; do glab issue create --title junk$i; done
+ *       → DENY
+ *     glab issue create --title "[Carryover] real"; for i in 1 2 3; do \
+ *       glab issue create --title junk$i; done
+ *       → ALLOW
+ *
+ * The second command files an unknowable number of UNTEMPLATED issues, lifted
+ * by an unrelated neighbour's exemption. That is `.claude/rules/guard-design.md`
+ * § "Widening a matcher without narrowing its bypass" (#1106 class) in the
+ * exemption lane instead of the bypass lane — same shape, same fix: judge the
+ * exemption on the statement the gate fired on, never on a sibling.
+ *
+ * Each element is the segment the loop-depth scan implicated, so the caller can
+ * rebuild its classification text exactly as {@link findIssueCreateStatements}
+ * does (`tokens.map((t) => t.text).join(' ')`).
+ *
+ * ## Why ALL of them, not the first (#1379)
+ *
+ * The 2026-09-16 scan below collected every candidate head but `return`ed on
+ * the first one found at `depth > 0`. Since the consuming hook classifies the
+ * cap exemption PER bulk statement, reporting one loop for a two-loop command
+ * means an EXEMPT first loop is the only loop judged and every later loop goes
+ * unexamined. Reproduced 2026-09-17 @ `9e8146b4` against the live hook in a
+ * strict-mode throwaway repo:
+ *
+ *     for i in 1 2 3; do glab issue create --label carryover --title x$i; done;
+ *     for j in 1 2 3; do glab issue create --title junk$j; done
+ *       → ALLOW, ledger count=1 exempt=1   (must DENY)
+ *
+ * Same class as the exemption-binding fix this docblock already describes, one
+ * level up: judging the exemption on ONE of several bulk statements is the same
+ * defect as judging it on a sibling.
+ *
+ * @param {string} command
+ * @returns {Array<Array<{ text: string, quoted: boolean }>>} one entry per loop
+ */
+export function findLoopedIssueCreates(command) {
+  if (typeof command !== 'string' || command.length === 0) return [];
+
+  let tokens;
+  let segments;
+  try {
+    tokens = tokenizeCommand(command);
+    segments = splitChainSegments(tokens);
+  } catch {
+    return []; // fail OPEN, same posture as statementsOf
+  }
+
+  // EVERY issue-create statement is a candidate, keyed by its HEAD token's
+  // object identity — the position in the raw stream at which the loop depth
+  // must be read.
+  //
+  // Until 2026-09-16 this considered only the FIRST create statement of ANY
+  // kind and then checked its `kind`, mirroring the pre-#1163 hook whose G3 was
+  // a single `isIssueCreate(command)` boolean. That mirror is obsolete and was
+  // a MISS: since #1163 the hook judges EVERY statement via
+  // {@link findIssueCreateStatements}, and the old first-only scan reported
+  // `false` for any command whose first create sits outside the loop. Measured
+  // 2026-09-16 against HEAD:
+  //
+  //     glab issue create --title "[Carryover] real"; for i in 1 2 3; do \
+  //       glab issue create --title junk$i; done          → false (should be true)
+  //     glab mr create --title m; for i in 1 2; do \
+  //       glab issue create --title j; done               → false (should be true)
+  //     for i in 1 2 3; do glab issue create --title j; done → true
+  //
+  // The first shape files an unknowable number of issues and was ALLOWED by the
+  // budget gate. Scanning all candidates is the fail-CLOSED direction and no
+  // longer disagrees with the hook about which statements exist.
+  const createHeads = new Map();
+  for (const seg of segments) {
+    const shape = matchStatement(seg);
+    if (shape && shape.kind === 'issue') createHeads.set(seg[0], seg);
+  }
+  if (createHeads.size === 0) return [];
+
+  const kept = new Set(segments.flat());
+  const found = [];
+  let depth = 0;
+  for (const tok of tokens) {
+    // A create head at depth 0 is a create AFTER (or BEFORE) a loop, not inside
+    // one: `while x; do echo a; done; glab issue create` stays unimplicated.
+    if (createHeads.has(tok)) {
+      if (depth > 0) found.push(createHeads.get(tok));
+      continue;
+    }
+    if (tok.quoted || kept.has(tok)) continue; // an argument, or a separator
+    if (tok.text === 'do') depth += 1;
+    else if (tok.text === 'done' && depth > 0) depth -= 1;
+  }
+  return found;
+}
+
+/**
+ * The FIRST looped issue-create statement, or `null`.
+ *
+ * @deprecated since #1379 — use {@link findLoopedIssueCreates}, which reports
+ * EVERY implicated loop. A caller that classifies anything per loop (a cap
+ * exemption, a per-loop deny reason) is WRONG on this API for a command with
+ * two loops; kept only because this module has no `exports` map, so every
+ * export is a public entrypoint a consumer may already import.
+ *
+ * @param {string} command
+ * @returns {Array<{ text: string, quoted: boolean }>|null}
+ */
+export function findLoopedIssueCreate(command) {
+  return findLoopedIssueCreates(command)[0] ?? null;
+}
+
 /**
  * True when the matched issue-create statement sits inside a LOOP BODY, i.e.
  * the command creates an unknown number of issues (#1145).
@@ -730,47 +916,16 @@ export function isIssueCreate(command) {
  * to charging 1 for N. The unit test `tests/hooks/vcs-create-matcher.test.mjs`
  * pins the coupling directly. Revisit if that set is ever narrowed.
  *
+ * Boolean wrapper over {@link findLoopedIssueCreates} — kept as the named
+ * question for callers that only need the FACT (and for the sibling suites that
+ * pin it). A caller that must classify the cap exemption asks for the STATEMENT
+ * instead; see that function's docblock for why the distinction is load-bearing.
+ *
  * @param {string} command
  * @returns {boolean} false when the command has no issue-create statement at all
  */
 export function isLoopedIssueCreate(command) {
-  if (typeof command !== 'string' || command.length === 0) return false;
-
-  let tokens;
-  let segments;
-  try {
-    tokens = tokenizeCommand(command);
-    segments = splitChainSegments(tokens);
-  } catch {
-    return false; // fail OPEN, same posture as statementsOf
-  }
-
-  // The create statement's HEAD token, by object identity — the position in the
-  // raw stream at which the loop depth must be read.
-  //
-  // Deliberately the FIRST create statement of any kind, then a kind check —
-  // exactly what isIssueCreate() does via matchVcsCreate(). Searching for the
-  // first ISSUE create instead would diverge on `glab mr create … ; glab issue
-  // create …`: the hook's G3 would look at the mr, this at the issue, and the
-  // two would disagree about which statement they are judging.
-  let headTok = null;
-  for (const seg of segments) {
-    const shape = matchStatement(seg);
-    if (!shape) continue;
-    if (shape.kind === 'issue') headTok = seg[0];
-    break;
-  }
-  if (!headTok) return false;
-
-  const kept = new Set(segments.flat());
-  let depth = 0;
-  for (const tok of tokens) {
-    if (tok === headTok) return depth > 0;
-    if (tok.quoted || kept.has(tok)) continue; // an argument, or a separator
-    if (tok.text === 'do') depth += 1;
-    else if (tok.text === 'done' && depth > 0) depth -= 1;
-  }
-  return false;
+  return findLoopedIssueCreates(command).length > 0;
 }
 
 /**

package/hooks/hooks-codex.json

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '🎯 Session Orchestrator v5.1.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
+            "command": "echo '🎯 Session Orchestrator v5.2.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
             "async": false
           },
           {

package/hooks/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '🎯 Session Orchestrator v5.1.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
+            "command": "echo '🎯 Session Orchestrator v5.2.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
             "async": false
           },
           {

package/hooks/on-session-end.mjs

@@ -618,8 +618,20 @@ async function main() {
   //     Dead-by-age relaxation (relaxDeadByAge/assumeDeadBeforeMs, #731 — used by the
   //     historical migration CLI) is NEVER passed here: a foreign lock that is live
   //     at hook-time is, by definition, a real active session, not stale history.
+  //     `ownSessionIsEnding` (#1376) rides the SAME `isRecordedSession`
+  //     attestation as `duration_ms` / `semantic_session_id` above, for the
+  //     same reason: it is a claim made ON BEHALF of the recorded session, and
+  //     a foreign terminating window that inherited this repo's
+  //     `current-session.json` identity (#863 defect (b)) must never make it.
+  //     With the attestation false the core keeps its blanket own-live-lock
+  //     skip, so the #863 behaviour is preserved exactly where #863 applied.
   try {
-    const res = await backfillAbandonedSession({ repoRoot: projectRoot, sessionId, semanticSessionId });
+    const res = await backfillAbandonedSession({
+      repoRoot: projectRoot,
+      sessionId,
+      semanticSessionId,
+      ownSessionIsEnding: isRecordedSession,
+    });
     await emitBackfillOutcome('abandoned', res, { sessionId, semanticSessionId });
   } catch { /* best-effort — never block teardown */ }
 
@@ -627,7 +639,7 @@ async function main() {
   //      above and to THIS session's own id: it reads STATE.md directly and
   //      repairs a PAST session whose `status: completed` was set (by hand or
   //      otherwise) without session-end's Phase 3.7 ever writing the matching
-  //      sessions.jsonl record — the exact state `commands/close.md`'s
+  //      sessions.jsonl record — the exact state `skills/close/SKILL.md`'s
   //      Pre-Check then reads as "already finalized" forever after. Cheap
   //      no-op on the overwhelmingly common path (STATE.md status is
   //      'active'/'paused'/'idle', or the record already exists).

package/hooks/on-stop.mjs

@@ -551,6 +551,39 @@ async function handleSubagentStop(input) {
     } catch { /* probe failed — omit rather than assert `false` */ }
 
     try {
+      // `sidecar_missing` — the DENOMINATOR for every meta-derived field below
+      // (#1289 Befund 2). `agent_type_meta` and `tool_use_id` come from the same
+      // read, so they co-occur perfectly (measured 2026-09-16 over
+      // `.orchestrator/metrics/events.jsonl`: 15.291 `orchestrator.agent.stopped`
+      // records, 542 with `agent_type_meta`, 542 with `tool_use_id`,
+      // both/only-meta/only-tool = 542/0/0). That made the low presence rate look
+      // like a producer defect in the KEY, when 1000/1000 sidecars on this host
+      // carry `agentType`. This flag makes "no sidecar found" visible in the
+      // record instead of indistinguishable from "sidecar found, field absent".
+      //
+      // WHAT THIS KEY IS NOT: a sidecar-LOOKUP failure rate. Re-measured
+      // 2026-09-16 over 15.457 `orchestrator.agent.stopped` records (5086
+      // `transcript_found:false` vs 553 `true`), the false mass is the #939/#949
+      // PHANTOM-STOP class — no subagent ever existed, so there is nothing for
+      // the lookup to find:
+      //   - 0 of 5077 distinct false `agent_id`s have a sidecar ANYWHERE on this
+      //     host (`find ~/.claude/projects -path '*/subagents/agent-*.jsonl'` →
+      //     8626 ids), and 0 have a `SubagentStart` record (2176 starts in
+      //     `.orchestrator/metrics/subagents.jsonl`);
+      //   - 0 records carrying a valid `agent_id` got a null resolver result;
+      //   - the two classes are perfectly bimodal on the type field:
+      //     `false` + no `agent` 5086, `true` + typed 553, off-diagonal 0.
+      // `agent` (the harness `agent_type`) is therefore the ready-made
+      // discriminator — no further key is needed. Do NOT "repair" the derivation
+      // in hooks/_lib/subagent-paths.mjs to chase this rate: it already resolves
+      // 553/553 of the real stops, and a widened one would only start resolving
+      // onto a FOREIGN agent's sidecar. This misreading has now cost three
+      // investigations (#939, the 2026-08-11 ledger re-run, #1289 Befund 2).
+      //
+      // Present ONLY when true, like every other optional key in this payload;
+      // its own probe is inside this try, so a failed `existsSync` omits it and
+      // nothing else (a telemetry fault must never change a decision).
+      if (!existsSync(metaPath)) payload.sidecar_missing = true;
       // One small read, one parse, two fields. `description` is operator prose
       // and is deliberately NOT carried: this payload also travels over the
       // optional Clank webhook unredacted.
@@ -565,7 +598,16 @@ async function handleSubagentStop(input) {
         payload.tool_use_id = meta.toolUseId.trim();
       }
       // A SECOND witness for the type — never merged into `agent`, so the
-      // empty-`agent_type` rate stays measurable.
+      // empty-`agent_type` rate stays measurable. NO FALLBACK MERGE, deliberately:
+      // `payload.agent` already carries the harness's `input.agent_type`, and
+      // filling one from the other would erase exactly the signal this pair
+      // exists to produce.
+      //
+      // REPORTING RULE: the presence rate of this key is only meaningful against
+      // the events whose SIDECAR WAS FOUND — "present on N of M events without
+      // `sidecar_missing`", never N of all `orchestrator.agent.stopped` records.
+      // Measured against all events the rate reads as a producer defect in this
+      // block; against its real denominator it is a lookup-failure rate.
       if (typeof meta?.agentType === 'string' && AGENT_TYPE_META_RE.test(meta.agentType.trim())) {
         payload.agent_type_meta = meta.agentType.trim();
       }

package/hooks/post-bash-write-verify.mjs

@@ -1120,6 +1120,9 @@ async function main() {
 // string compare then reads false and silently no-ops the whole scope-detector
 // under a symlinked `$CLAUDE_PLUGIN_ROOT`. realpath'ing both sides also survives
 // `--preserve-symlinks` (where import.meta.url stays symlinked instead).
+// BV-004 ceiling: kept inline — hooks avoid importing scripts/lib on the hot
+// path; the canonical predicate is scripts/lib/is-main-module.mjs. Revisit if the
+// hook-import-set (hooks/_lib/hook-import-set.json) ever admits scripts/lib here.
 function invokedAsScript() {
   const entry = process.argv[1];
   if (!entry) return false;

package/hooks/pre-auq-clarity.mjs

@@ -778,6 +778,9 @@ async function main() {
 // under a symlinked plugin install) while `import.meta.url` is realpath-resolved
 // by node's default loader, so BOTH sides are realpath'd.
 // ---------------------------------------------------------------------------
+// BV-004 ceiling: kept inline — hooks avoid importing scripts/lib on the hot
+// path; the canonical predicate is scripts/lib/is-main-module.mjs. Revisit if the
+// hook-import-set (hooks/_lib/hook-import-set.json) ever admits scripts/lib here.
 function invokedAsScript() {
   const entry = process.argv[1];
   if (!entry) return false;

package/hooks/pre-bash-issue-budget.mjs

@@ -53,7 +53,7 @@
 import { readStdin, emitAllow, emitDeny, emitWarn } from '../scripts/lib/io.mjs';
 import { resolveProjectDir } from '../scripts/lib/platform.mjs';
 import { readJson } from '../scripts/lib/common.mjs';
-import { findIssueCreateStatements, isLoopedIssueCreate } from './_lib/vcs-create-matcher.mjs';
+import { findIssueCreateStatements, findLoopedIssueCreates } from './_lib/vcs-create-matcher.mjs';
 import {
   loadIssueBudgetConfig,
   resolveIssueBudgetSessionId,
@@ -187,15 +187,39 @@ function resolveToolCallId(input) {
  * entry #N … nothing is lost", which would be false here — an uncountable bulk
  * request is not parked, it is handed back whole.
  *
+ * ## Why the lane is a parameter (#1379)
+ *
+ * Until 2026-09-17 this text said "sits inside a shell loop body (`do … done`)"
+ * on BOTH lanes, so the `xargs` deny (`echo b | xargs -I% glab issue create
+ * --title junk%` — no loop anywhere) sent the operator looking for a loop the
+ * command does not have. Only the lane SENTENCE varies; every other line is
+ * byte-identical across lanes, and tests pin them.
+ *
  * @param {{ "max-per-session": number }} config
+ * @param {{ lane?: "loop"|"xargs"|"mixed" }} [opts]
  * @returns {string}
  */
-function formatLoopDenyReason(config) {
+function formatLoopDenyReason(config, { lane = 'loop' } = {}) {
+  const LANE_SENTENCES = {
+    loop: [
+      'The `issue create` call sits inside a shell loop body (`do … done`), so the cap cannot',
+      'charge it honestly: the word list is expanded by the shell AFTER this hook runs, so',
+      '`for i in $(seq 1 50)` would file 50 issues against a count of 1.',
+    ],
+    xargs: [
+      'The `issue create` call is driven by `xargs`, so the cap cannot charge it honestly: the',
+      'word list arrives on stdin AFTER this hook runs, so `seq 1 50 | xargs` would file 50',
+      'issues against a count of 1.',
+    ],
+    mixed: [
+      'The `issue create` calls are driven by a shell loop body (`do … done`) AND by `xargs`,',
+      'so the cap cannot charge them honestly: both word lists are produced AFTER this hook',
+      'runs, so `seq 1 50 | xargs` would file 50 issues against a count of 1.',
+    ],
+  };
   return [
     'issue-budget: this command creates an UNKNOWN number of issues — refusing to guess.',
-    'The `issue create` call sits inside a shell loop body (`do … done`), so the cap cannot',
-    'charge it honestly: the word list is expanded by the shell AFTER this hook runs, so',
-    '`for i in $(seq 1 50)` would file 50 issues against a count of 1.',
+    ...(LANE_SENTENCES[lane] ?? LANE_SENTENCES.loop),
     '',
     'Nothing was parked as overflow, because nothing is lost: re-issue the create calls as',
     'SEPARATE commands and each one is counted normally against the cap',
@@ -302,18 +326,59 @@ async function main() {
   const config = loadIssueBudgetConfig(projectDir);
   if (config.mode === 'off') return emitAllow();
 
-  // G3b — bulk creation whose multiplicity is not computable (#1145). The
-  // exemption is asked FIRST, through the same classifier chargeIssueBudget
-  // uses, so a looped carryover sweep keeps its unconditional pass. It is asked
-  // on the FIRST issue-create statement's text, which is the very statement
-  // `isLoopedIssueCreate` judges — classifying it on the whole command would
-  // let an exempt NEIGHBOUR statement lift the loop deny.
-  const uncountableBulk =
-    isLoopedIssueCreate(command) && !classifyExemption(statements[0].text).exempt;
+  // G3b — bulk creation whose multiplicity is not computable (#1145). Two
+  // sources, one policy: a LOOP BODY (#1145) and an `xargs`-driven create
+  // (#1289), where the word list arrives on stdin. Both file N issues for one
+  // statement, so both are denied rather than charged 1 — the fix had to land
+  // here and not only in `isLoopedIssueCreate`, because G3 above short-circuits
+  // on `statements.length === 0` and an xargs create used to produce zero
+  // statements, so no loop-side fix could ever run.
+  //
+  // THE INVARIANT (rewritten 2026-09-16): the exemption is classified on the
+  // statement that CAUSED the bulk classification — never on `statements[0]`,
+  // and never on the whole command. A `[Carryover]` create standing NEXT TO an
+  // uncountable one is an unrelated neighbour and must not lift the deny; a
+  // `[Carryover]` create that IS the bulk statement keeps its documented
+  // unconditional pass (session-end's "those are never deferred" promise, which
+  // holds inside a loop too). Measured 2026-09-16 against the previous
+  // `statements[0]` binding, both lanes ALLOW where they must DENY:
+  //   glab issue create --title "[Carryover] real"; echo X | xargs -I% glab issue create --title %
+  //   glab issue create --title "[Carryover] real"; for i in 1 2 3; do glab issue create --title junk$i; done
+  // Same class as the bypass-scoping regression on `matchesBypass` — a matcher
+  // widened per statement while its exemption stayed whole-command
+  // (`.claude/rules/guard-design.md` § "Widening a matcher without narrowing
+  // its bypass", #1106).
+  //
+  // Fail-CLOSED when a command carries SEVERAL bulk statements and only some are
+  // exempt: `some()` over the non-exempt ones denies, because the command as a
+  // whole still files an uncountable number of untemplated issues.
+  //
+  // EVERY loop, not the first (#1379): the loop lane used to contribute at most
+  // ONE entry here, so an exempt FIRST loop was the only loop classified and
+  // every later loop went unjudged. Reproduced 2026-09-17 @ `9e8146b4`:
+  //   for i in 1 2 3; do glab issue create --label carryover --title x$i; done;
+  //   for j in 1 2 3; do glab issue create --title junk$j; done  → ALLOW (count=1)
+  const bulkEntries = [
+    ...findLoopedIssueCreates(command).map((tokens) => ({
+      lane: 'loop',
+      text: tokens.map((t) => t.text).join(' '),
+    })),
+    ...statements.filter((s) => s.bulk).map((s) => ({ lane: 'xargs', text: s.text })),
+  ];
+  const uncountableEntries = bulkEntries.filter((e) => !classifyExemption(e.text).exempt);
+  const uncountableBulk = uncountableEntries.length > 0;
+  // ONE lane resolution for BOTH reports (#1379 follow-up). The deny already
+  // named the lane it fired on; the `warn` undercount notice at the bottom of
+  // main() said "inside a loop body" unconditionally, so the xargs lane — where
+  // no loop exists anywhere in the command — sent the operator looking for one.
+  // Resolved here rather than twice, so the two reports can never disagree.
+  const uncountableLanes = new Set(uncountableEntries.map((e) => e.lane));
+  const uncountableLane =
+    uncountableLanes.size > 1 ? 'mixed' : ([...uncountableLanes][0] ?? 'loop');
   if (uncountableBulk && config.mode === 'strict') {
     // Nothing is charged and nothing is parked — the command is handed back
     // whole, which is what makes unrolling it the correct next action.
-    return emitDeny(formatLoopDenyReason(config));
+    return emitDeny(formatLoopDenyReason(config, { lane: uncountableLane }));
   }
 
   const sessionId = await resolveSessionId(input, projectDir);
@@ -401,11 +466,32 @@ async function main() {
   // to name the undercount out loud — a silent 1-for-N is the exact failure the
   // deny above exists to prevent, and `warn` must not reintroduce it quietly.
   // emitWarn, not stderr: under exit 0 stderr reaches only the debug log (#916).
-  if (uncountableBulk && verdict.decision === 'allow') {
+  //
+  // GATED ON THE BULK STATEMENTS, NEVER ON THE LAST VERDICT (2026-09-17). The
+  // condition used to read `verdict.decision === 'allow'`, i.e. the verdict of
+  // the LAST statement of the chain — so one exempt statement written AFTER an
+  // uncountable one silenced the notice the two paragraphs above declare
+  // mandatory. Reproduced through this hook binary in `mode: warn`:
+  //   for i in 1 2; do glab issue create --title j$i; done; \
+  //     glab issue create --title "[Carryover] z"
+  //   → stdout EMPTY, ledger count=1 exempt=1 (the trailing exempt statement is
+  //     an unrelated neighbour, exactly as in G3b's own invariant); without it,
+  //     the identical loop reported the UNDERCOUNT.
+  // Reaching this point already means no statement blocked and none warned
+  // (both branches above return), so the uncountable bulk statement — non-exempt
+  // by construction of `uncountableEntries` — was charged as 1. The two negated
+  // conditions are kept explicit so a future reordering of those branches cannot
+  // turn this back into a report about the wrong statement.
+  if (uncountableBulk && !blocked && !verdicts.some((v) => v.decision === 'warn')) {
+    const LANE_PHRASES = {
+      loop: 'inside a loop body',
+      xargs: 'driven by `xargs`',
+      mixed: 'inside a loop body and by `xargs`',
+    };
     return emitWarn(
-      `pre-bash-issue-budget: bulk create inside a loop body charged as 1 ` +
+      `pre-bash-issue-budget: bulk create ${LANE_PHRASES[uncountableLane]} charged as 1 ` +
         `(${verdict.count}/${verdict.max}) — the real number of issues this files is not ` +
-        `knowable before the shell expands the word list, so the count is an UNDERCOUNT. ` +
+        `knowable before the word list is expanded, so the count is an UNDERCOUNT. ` +
         `Set \`issue-budget.mode: strict\` to deny this shape instead.`,
     );
   }