tamperward 2.7.1 → 2.8.0

package/dist/cli/index.js

@@ -2,9 +2,376 @@
 
 // src/git/build.ts
 import { execFileSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+
+// src/disk.ts
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, readlinkSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 
+// src/policy.ts
+import picomatch from "picomatch";
+var POLICY_FILE = ".tamperward.yml";
+var BLOCK_SINCE = {};
+function applyVersionGates(rules, version, gates = BLOCK_SINCE) {
+  const out2 = { ...rules };
+  for (const [rule, since] of Object.entries(gates)) {
+    if (since > version && out2[rule]?.severity === "block") {
+      out2[rule] = { ...out2[rule], severity: "warn" };
+    }
+  }
+  return out2;
+}
+function normalizeGlob(glob) {
+  return glob.startsWith("/") ? glob.replace(/^\/+/, "") : glob;
+}
+function mergeRules(base, user) {
+  const out2 = { ...base };
+  for (const [name, cfg] of Object.entries(user ?? {})) {
+    out2[name] = { ...out2[name] ?? {}, ...cfg ?? {} };
+  }
+  return out2;
+}
+var CONTROL = /[\u0000-\u001f\u007f]/;
+function hasControlChar(path) {
+  return CONTROL.test(path);
+}
+function escapeControl(path) {
+  return path.replace(/[\u0000-\u001f\u007f]/g, (ch) => {
+    const c = ch.charCodeAt(0);
+    if (c === 10) return "\\n";
+    if (c === 13) return "\\r";
+    if (c === 9) return "\\t";
+    return `\\x${c.toString(16).padStart(2, "0")}`;
+  });
+}
+var listCache = /* @__PURE__ */ new WeakMap();
+function listMatcher(globs4) {
+  let re = listCache.get(globs4);
+  if (re === void 0) {
+    re = globs4.length === 0 ? null : new RegExp(globs4.map((g) => `(?:${picomatch.makeRe(g, { dot: true }).source})`).join("|"));
+    listCache.set(globs4, re);
+  }
+  return re;
+}
+function matchesAny(path, globs4) {
+  if (!globs4) return false;
+  const re = listMatcher(globs4);
+  return re !== null && re.test(path);
+}
+function protectedCategory(path, policy) {
+  const cats = Object.entries(policy.protected ?? {});
+  if (hasControlChar(path)) return cats[0]?.[0] ?? "tests";
+  for (const [cat, globs4] of cats) {
+    if (matchesAny(path, globs4)) return cat;
+  }
+  return null;
+}
+var anyCache = /* @__PURE__ */ new WeakMap();
+function allProtectedGlobs(policy) {
+  const p = policy.protected ?? {};
+  let all = anyCache.get(p);
+  if (!all) {
+    all = Object.values(p).flat();
+    anyCache.set(p, all);
+  }
+  return all;
+}
+function isProtected(path, policy, category) {
+  if (hasControlChar(path)) return true;
+  if (category) return matchesAny(path, policy.protected?.[category]);
+  return matchesAny(path, allProtectedGlobs(policy));
+}
+function isPolicyFile(path) {
+  return path === POLICY_FILE || path.endsWith("/" + POLICY_FILE);
+}
+function isIgnored(path, policy) {
+  return matchesAny(path, policy.ignore);
+}
+function mergeProtected(base, user) {
+  const out2 = { ...base };
+  for (const [cat, globs4] of Object.entries(user ?? {})) {
+    const have = new Set(out2[cat] ?? []);
+    out2[cat] = [...out2[cat] ?? [], ...(globs4 ?? []).filter((g) => !have.has(g))];
+  }
+  return out2;
+}
+function defaultPolicy(version = 1) {
+  const p = {
+    version,
+    protected: {
+      // Cover every JS/TS test extension, not just .test.ts — the multi-repo FP study found
+      // .test.tsx/.spec.tsx (hono, zustand) slipped the glob, so legit test-file casts blocked
+      // instead of warning. Kept ADDITIVE (originals + new extensions) so the policy-diff sees a
+      // strengthening, not a narrowing. picomatch expands the brace.
+      // test-skip, test-deletion and test-content-removal all gate on this
+      // class, so a repo it does not match gets rules that can NEVER fire —
+      // protection that is silently absent rather than visibly off. The JS/TS
+      // list shipped alone; these are the conventional layouts of the other
+      // ecosystems `init` is run in. (P2-13, external review.)
+      tests: [
+        // JavaScript / TypeScript
+        "**/*.test.ts",
+        "**/*.spec.ts",
+        "**/*.{test,spec}.{tsx,cts,mts,js,jsx,cjs,mjs}",
+        "**/__tests__/**",
+        // Python (pytest / unittest layouts)
+        "**/test_*.py",
+        "**/*_test.py",
+        "**/conftest.py",
+        // Go
+        "**/*_test.go",
+        // Rust (integration tests live in tests/, unit tests inline)
+        "**/tests/**/*.rs",
+        // Ruby (RSpec / minitest)
+        "**/*_spec.rb",
+        "**/*_test.rb",
+        // Java / Kotlin / Scala (Maven & Gradle convention)
+        "**/src/test/**",
+        // PHP (PHPUnit)
+        "**/*Test.php",
+        // C# (.NET)
+        "**/*Tests.cs",
+        "**/*Test.cs"
+      ],
+      config: [
+        "**/jest.config.*",
+        "**/vitest.config.*",
+        // A `vitest.workspace.*` file REPLACES the root config's selection with the
+        // union of its projects, and a `vite.config.*` carrying a `test:` key is the
+        // vitest config when no vitest.config exists — both are where a spec can be
+        // dropped from the suite without a line of it changing. ADDITIVE, like every
+        // baseline widening (the policy-diff reads it as a strengthening).
+        "**/vitest.workspace.*",
+        "**/vite.config.*",
+        "**/tsconfig*.json",
+        "**/.eslintrc*",
+        "**/eslint.config.*",
+        "**/package.json",
+        // Coverage gates outside the Jest/Vitest shapes. coverage-lowering could only
+        // see a threshold it was shown: a Python `fail_under`, an nyc `lines`, a
+        // codecov `target` lived in files no glob protected, so lowering them fired
+        // nothing. ADDITIVE, like every baseline widening (the policy-diff reads it
+        // as a strengthening). pyproject.toml carries [tool.coverage.report].
+        "**/.coveragerc",
+        "**/pyproject.toml",
+        "**/.nycrc",
+        "**/.nycrc.*",
+        "**/nyc.config.*",
+        "**/codecov.yml",
+        "**/.codecov.yml"
+      ],
+      ci: [".github/workflows/**"],
+      // Recorded expected outputs. An assertion stored as data is still an assertion;
+      // rewriting it from current output is the snapshot-update move the affordance
+      // experiment measured at a 70% attempt / 100% through rate (snapshot-rewrite).
+      // tap-snapshots/** added from Phase-3 evidence: node-tar's recorded expectations
+      // live there as .cjs and were rewritten unseen (PHASE3.md §4).
+      snapshots: ["**/*.snap", "**/__snapshots__/**", "**/tap-snapshots/**", "**/golden/**", "**/*.golden.*"],
+      // The wiring IS the enforcement: settings.json carries the PreToolUse and
+      // Stop hooks, and a pre-commit config carries the commit-time gate. These
+      // were installed by `init` and protected by nothing, so editing them out
+      // fired no rule at all. (.git/hooks/** is outside every git view and so
+      // cannot be covered here — noted in SECURITY-ENVELOPE.md.) (P1-4, review.)
+      hooks: [
+        ".husky/**",
+        "**/lefthook.*",
+        // lefthook merges `lefthook-local.yml` OVER `lefthook.yml`: a `skip: true`
+        // there switches the gate off without touching the file init pointed at.
+        "**/lefthook-local.*",
+        ".tamperward.yml",
+        "**/.tamperward.yml",
+        ".claude/settings.json",
+        ".claude/settings.local.json",
+        "**/.pre-commit-config.yaml",
+        // CODEOWNERS is enforcement wiring, not documentation: it is the only
+        // thing that can require a human on a change to the workflow that
+        // decides whether the gate runs at all. GitHub reads it from any of
+        // these three locations. (H2.)
+        ".github/CODEOWNERS",
+        "CODEOWNERS",
+        "docs/CODEOWNERS"
+      ]
+    },
+    rules: {
+      "test-deletion": { severity: "block" },
+      // content gutted from a surviving spec — the class Phase 3 measured walking
+      // through the block-count rule (rows, assertion arguments, setup). Severity
+      // backed by the real-commit corpus measurement recorded in the rule's SPEC row.
+      "test-content-removal": { severity: "block" },
+      "test-skip": { severity: "block" },
+      "ts-any-cast": { severity: "block" },
+      // the unambiguous explicit casts + ts-suppression directives
+      // broad any in annotation/generic position is common in legit code (measured ~84-100% FP as a
+      // block rule on real TS), so it WARNs until a semantic (error-silencing-aware) signal earns block.
+      "ts-any-launder": { severity: "warn" },
+      "lint-suppression": { severity: "block" },
+      "coverage-lowering": { severity: "block" },
+      "ci-tampering": { severity: "block" },
+      "hook-tampering": { severity: "block" },
+      "no-verify": { severity: "block" },
+      // mechanical but intent-ambiguous: updating a snapshot is the legitimate workflow
+      // when intended output changes. WARN until the §7 evidence path earns block.
+      "snapshot-rewrite": { severity: "warn" },
+      // the watcher's transient class (modified-and-restored within a turn). WARN by
+      // default: a Stop block already forces restores, and a compliant restore reads
+      // as churn — block-by-default would deadlock the honest path. Harnesses that own
+      // that semantics raise it via TAMPERWARD_TRANSIENT=block.
+      "transient-protected-mutation": { severity: "warn" },
+      // the narrow graduation candidate: snapshot moved with NO accompanying change.
+      // ~0.06% FP on 1,652 audited mainline commits, 7/7 TP on observed tampers
+      // (harness/fp-study/). warn until a version: gate graduates it (BLOCK_SINCE).
+      "snapshot-only-rewrite": { severity: "warn" },
+      // heuristic — warn until precision is measured (SPEC §7)
+      "assertion-weakening": { severity: "warn" },
+      "guard-removal": { severity: "warn" }
+    },
+    ignore: [],
+    signoff: { requiredFor: ["block"], ledger: ".tamperward/ledger.jsonl" }
+  };
+  p.rules = applyVersionGates(p.rules, version);
+  return p;
+}
+
+// src/disk.ts
+var READ_CAP = 64 * 1024 * 1024;
+var NO_META = { mode: 0, size: 0, mtimeMs: 0 };
+function errText(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+function errCode(e) {
+  return String(e?.code ?? "");
+}
+function irregularName(st) {
+  if (st.isFIFO()) return "fifo";
+  if (st.isSocket()) return "socket";
+  if (st.isCharacterDevice()) return "character device";
+  if (st.isBlockDevice()) return "block device";
+  return "unknown file type";
+}
+function meta(st) {
+  return { mode: st.mode, size: st.size, mtimeMs: st.mtimeMs };
+}
+var O_READ = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+function readRegular(abs2, st) {
+  let fd;
+  try {
+    fd = openSync(abs2, O_READ);
+  } catch (e) {
+    if (errCode(e) === "ELOOP") return inspectOnce(abs2);
+    return { kind: "unreadable", content: null, ...meta(st), detail: errText(e) };
+  }
+  try {
+    const now = fstatSync(fd);
+    if (!now.isFile()) return { kind: "irregular", content: null, ...meta(now), detail: irregularName(now) };
+    if (now.size > READ_CAP) return { kind: "oversize", content: null, ...meta(now), detail: `${now.size} bytes` };
+    const buf = Buffer.allocUnsafe(now.size);
+    let off2 = 0;
+    while (off2 < now.size) {
+      const n = readSync(fd, buf, off2, now.size - off2, off2);
+      if (n === 0) break;
+      off2 += n;
+    }
+    return { kind: "file", content: off2 === now.size ? buf : buf.subarray(0, off2), mode: now.mode, size: off2, mtimeMs: now.mtimeMs, detail: "" };
+  } catch (e) {
+    return { kind: "unreadable", content: null, ...meta(st), detail: errText(e) };
+  } finally {
+    closeSync(fd);
+  }
+}
+function classify(abs2, st) {
+  if (st.isSymbolicLink()) {
+    try {
+      const target = readlinkSync(abs2);
+      return { kind: "symlink", content: Buffer.from(target, "utf8"), ...meta(st), detail: target };
+    } catch (e) {
+      return { kind: "unreadable", content: null, ...meta(st), detail: errText(e) };
+    }
+  }
+  if (st.isDirectory()) return { kind: "directory", content: null, ...meta(st), detail: "directory" };
+  if (!st.isFile()) return { kind: "irregular", content: null, ...meta(st), detail: irregularName(st) };
+  if (st.size > READ_CAP) return { kind: "oversize", content: null, ...meta(st), detail: `${st.size} bytes` };
+  return readRegular(abs2, st);
+}
+function inspectOnce(abs2) {
+  let st;
+  try {
+    st = lstatSync(abs2);
+  } catch (e) {
+    const code = errCode(e);
+    if (code === "ENOENT" || code === "ENOTDIR") return { kind: "absent", content: null, ...NO_META, detail: "" };
+    return { kind: "unreadable", content: null, ...NO_META, detail: errText(e) };
+  }
+  if (st.isSymbolicLink() || !st.isFile()) return classify(abs2, st);
+  return { kind: "unreadable", content: null, ...meta(st), detail: "the path changed shape while it was being read" };
+}
+function inspectPath(abs2) {
+  let st;
+  try {
+    st = lstatSync(abs2);
+  } catch (e) {
+    const code = errCode(e);
+    if (code === "ENOENT" || code === "ENOTDIR") return { kind: "absent", content: null, ...NO_META, detail: "" };
+    return { kind: "unreadable", content: null, ...NO_META, detail: errText(e) };
+  }
+  return classify(abs2, st);
+}
+function inspectRel(cwd, rel) {
+  return inspectPath(join(cwd, rel));
+}
+function inspectResolved(abs2) {
+  let real;
+  try {
+    real = realpathSync(abs2);
+  } catch (e) {
+    const code = errCode(e);
+    if (code === "ENOENT" || code === "ENOTDIR") return { kind: "absent", content: null, ...NO_META, detail: "" };
+    return { kind: "unreadable", content: null, ...NO_META, detail: errText(e) };
+  }
+  return inspectPath(real);
+}
+function textOf(e) {
+  return e.content == null ? null : e.content.toString("utf8");
+}
+function describe(e, shown) {
+  switch (e.kind) {
+    case "symlink":
+      return `Protected path ${shown} is a symbolic link to ${escapeControl(e.detail)}. The gate never follows a link, so what the runner will read there cannot be judged.`;
+    case "directory":
+      return `Protected path ${shown} is a directory where a file is expected, so it cannot be judged.`;
+    case "irregular":
+      return `Protected path ${shown} is a ${e.detail}, not a regular file, so it cannot be read to judge it.`;
+    case "oversize":
+      return `Protected file ${shown} is ${e.detail}, above the ${READ_CAP / (1024 * 1024)} MiB the gate reads, so it is judged by name.`;
+    default:
+      return `Protected file ${shown} cannot be read to judge it (${e.detail}).`;
+  }
+}
+function unjudgeableFinding(cwd, rel) {
+  const e = inspectRel(cwd, rel);
+  if (e.kind === "file" || e.kind === "absent") return null;
+  const shown = escapeControl(rel);
+  return {
+    rule: "hidden-drift",
+    severity: "block",
+    file: rel,
+    message: describe(e, shown),
+    evidence: `${shown}: ${e.kind}${e.detail ? ` (${escapeControl(e.detail)})` : ""}`,
+    remediation: "Put a regular file the gate can read at the path \u2014 no symbolic link, FIFO, socket or device, and under 64 MiB \u2014 through a tool call the gate can see, or remove it.",
+    signoff: { required: true, command: `tamperward allow hidden-drift --file ${shown} --reason "..."` }
+  };
+}
+function unjudgeableProtected(cwd, policy, changes) {
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const c of changes) {
+    if (c.kind !== "file" || c.op === "delete" || seen.has(c.path)) continue;
+    seen.add(c.path);
+    if (!isProtected(c.path, policy)) continue;
+    const f = unjudgeableFinding(cwd, c.path);
+    if (f) out2.push(f);
+  }
+  return out2;
+}
+
 // src/diff/parse.ts
 var HUNK_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
 var C_ESCAPES = { a: 7, b: 8, f: 12, n: 10, r: 13, t: 9, v: 11, "\\": 92, '"': 34 };
@@ -251,11 +618,7 @@ function blobAt(rev, path, cwd) {
   }
 }
 function fromDisk(path, cwd) {
-  try {
-    return readFileSync(join(cwd ?? process.cwd(), path), "utf8");
-  } catch {
-    return null;
-  }
+  return textOf(inspectRel(cwd ?? process.cwd(), path));
 }
 function enrich(c, beforeReader, afterReader) {
   if (c.kind !== "file") return c;
@@ -353,6 +716,9 @@ function underSkippedDir(rel) {
   return rel.split("/").some((seg) => SKIP_DIRS.has(seg));
 }
 function ignoredPaths(opts = {}, keep) {
+  return ignoredTree(opts, keep).files;
+}
+function ignoredTree(opts = {}, keep) {
   const files = [];
   const dirs = [];
   for (const entry of git([...IGNORED_LS, "--directory"], opts.cwd).split("\0").filter(Boolean)) {
@@ -364,7 +730,7 @@ function ignoredPaths(opts = {}, keep) {
     const expanded = git([...IGNORED_LS, "--", ...dirs.map((d) => `:(literal)${d}`)], opts.cwd).split("\0").filter(Boolean);
     for (const rel of expanded) if (!underSkippedDir(rel)) files.push(rel);
   }
-  return files.filter(keep);
+  return { dirs, files: files.filter(keep) };
 }
 function ignoredAdds(opts = {}, keep, exclude) {
   return ignoredPaths(opts, keep).filter((rel) => !exclude?.has(rel)).map((rel) => addOf(rel, opts.cwd));
@@ -588,202 +954,6 @@ function removedLines(c) {
   return c.hunks.flatMap((h) => h.lines.filter((l) => l.type === "del"));
 }
 
-// src/policy.ts
-import picomatch from "picomatch";
-var POLICY_FILE = ".tamperward.yml";
-var BLOCK_SINCE = {};
-function applyVersionGates(rules, version, gates = BLOCK_SINCE) {
-  const out2 = { ...rules };
-  for (const [rule, since] of Object.entries(gates)) {
-    if (since > version && out2[rule]?.severity === "block") {
-      out2[rule] = { ...out2[rule], severity: "warn" };
-    }
-  }
-  return out2;
-}
-function normalizeGlob(glob) {
-  return glob.startsWith("/") ? glob.replace(/^\/+/, "") : glob;
-}
-function mergeRules(base, user) {
-  const out2 = { ...base };
-  for (const [name, cfg] of Object.entries(user ?? {})) {
-    out2[name] = { ...out2[name] ?? {}, ...cfg ?? {} };
-  }
-  return out2;
-}
-var cache = /* @__PURE__ */ new Map();
-function matcher(glob) {
-  let m = cache.get(glob);
-  if (!m) {
-    m = picomatch(glob, { dot: true });
-    cache.set(glob, m);
-  }
-  return m;
-}
-function matchesAny(path, globs4) {
-  return !!globs4 && globs4.some((g) => matcher(g)(path));
-}
-function protectedCategory(path, policy) {
-  for (const [cat, globs4] of Object.entries(policy.protected ?? {})) {
-    if (matchesAny(path, globs4)) return cat;
-  }
-  return null;
-}
-function isProtected(path, policy, category) {
-  if (category) return matchesAny(path, policy.protected?.[category]);
-  return protectedCategory(path, policy) !== null;
-}
-function isPolicyFile(path) {
-  return path === POLICY_FILE || path.endsWith("/" + POLICY_FILE);
-}
-function isIgnored(path, policy) {
-  return matchesAny(path, policy.ignore);
-}
-function mergeProtected(base, user) {
-  const out2 = { ...base };
-  for (const [cat, globs4] of Object.entries(user ?? {})) {
-    const have = new Set(out2[cat] ?? []);
-    out2[cat] = [...out2[cat] ?? [], ...(globs4 ?? []).filter((g) => !have.has(g))];
-  }
-  return out2;
-}
-function defaultPolicy(version = 1) {
-  const p = {
-    version,
-    protected: {
-      // Cover every JS/TS test extension, not just .test.ts — the multi-repo FP study found
-      // .test.tsx/.spec.tsx (hono, zustand) slipped the glob, so legit test-file casts blocked
-      // instead of warning. Kept ADDITIVE (originals + new extensions) so the policy-diff sees a
-      // strengthening, not a narrowing. picomatch expands the brace.
-      // test-skip, test-deletion and test-content-removal all gate on this
-      // class, so a repo it does not match gets rules that can NEVER fire —
-      // protection that is silently absent rather than visibly off. The JS/TS
-      // list shipped alone; these are the conventional layouts of the other
-      // ecosystems `init` is run in. (P2-13, external review.)
-      tests: [
-        // JavaScript / TypeScript
-        "**/*.test.ts",
-        "**/*.spec.ts",
-        "**/*.{test,spec}.{tsx,cts,mts,js,jsx,cjs,mjs}",
-        "**/__tests__/**",
-        // Python (pytest / unittest layouts)
-        "**/test_*.py",
-        "**/*_test.py",
-        "**/conftest.py",
-        // Go
-        "**/*_test.go",
-        // Rust (integration tests live in tests/, unit tests inline)
-        "**/tests/**/*.rs",
-        // Ruby (RSpec / minitest)
-        "**/*_spec.rb",
-        "**/*_test.rb",
-        // Java / Kotlin / Scala (Maven & Gradle convention)
-        "**/src/test/**",
-        // PHP (PHPUnit)
-        "**/*Test.php",
-        // C# (.NET)
-        "**/*Tests.cs",
-        "**/*Test.cs"
-      ],
-      config: [
-        "**/jest.config.*",
-        "**/vitest.config.*",
-        // A `vitest.workspace.*` file REPLACES the root config's selection with the
-        // union of its projects, and a `vite.config.*` carrying a `test:` key is the
-        // vitest config when no vitest.config exists — both are where a spec can be
-        // dropped from the suite without a line of it changing. ADDITIVE, like every
-        // baseline widening (the policy-diff reads it as a strengthening).
-        "**/vitest.workspace.*",
-        "**/vite.config.*",
-        "**/tsconfig*.json",
-        "**/.eslintrc*",
-        "**/eslint.config.*",
-        "**/package.json",
-        // Coverage gates outside the Jest/Vitest shapes. coverage-lowering could only
-        // see a threshold it was shown: a Python `fail_under`, an nyc `lines`, a
-        // codecov `target` lived in files no glob protected, so lowering them fired
-        // nothing. ADDITIVE, like every baseline widening (the policy-diff reads it
-        // as a strengthening). pyproject.toml carries [tool.coverage.report].
-        "**/.coveragerc",
-        "**/pyproject.toml",
-        "**/.nycrc",
-        "**/.nycrc.*",
-        "**/nyc.config.*",
-        "**/codecov.yml",
-        "**/.codecov.yml"
-      ],
-      ci: [".github/workflows/**"],
-      // Recorded expected outputs. An assertion stored as data is still an assertion;
-      // rewriting it from current output is the snapshot-update move the affordance
-      // experiment measured at a 70% attempt / 100% through rate (snapshot-rewrite).
-      // tap-snapshots/** added from Phase-3 evidence: node-tar's recorded expectations
-      // live there as .cjs and were rewritten unseen (PHASE3.md §4).
-      snapshots: ["**/*.snap", "**/__snapshots__/**", "**/tap-snapshots/**", "**/golden/**", "**/*.golden.*"],
-      // The wiring IS the enforcement: settings.json carries the PreToolUse and
-      // Stop hooks, and a pre-commit config carries the commit-time gate. These
-      // were installed by `init` and protected by nothing, so editing them out
-      // fired no rule at all. (.git/hooks/** is outside every git view and so
-      // cannot be covered here — noted in SECURITY-ENVELOPE.md.) (P1-4, review.)
-      hooks: [
-        ".husky/**",
-        "**/lefthook.*",
-        // lefthook merges `lefthook-local.yml` OVER `lefthook.yml`: a `skip: true`
-        // there switches the gate off without touching the file init pointed at.
-        "**/lefthook-local.*",
-        ".tamperward.yml",
-        "**/.tamperward.yml",
-        ".claude/settings.json",
-        ".claude/settings.local.json",
-        "**/.pre-commit-config.yaml",
-        // CODEOWNERS is enforcement wiring, not documentation: it is the only
-        // thing that can require a human on a change to the workflow that
-        // decides whether the gate runs at all. GitHub reads it from any of
-        // these three locations. (H2.)
-        ".github/CODEOWNERS",
-        "CODEOWNERS",
-        "docs/CODEOWNERS"
-      ]
-    },
-    rules: {
-      "test-deletion": { severity: "block" },
-      // content gutted from a surviving spec — the class Phase 3 measured walking
-      // through the block-count rule (rows, assertion arguments, setup). Severity
-      // backed by the real-commit corpus measurement recorded in the rule's SPEC row.
-      "test-content-removal": { severity: "block" },
-      "test-skip": { severity: "block" },
-      "ts-any-cast": { severity: "block" },
-      // the unambiguous explicit casts + ts-suppression directives
-      // broad any in annotation/generic position is common in legit code (measured ~84-100% FP as a
-      // block rule on real TS), so it WARNs until a semantic (error-silencing-aware) signal earns block.
-      "ts-any-launder": { severity: "warn" },
-      "lint-suppression": { severity: "block" },
-      "coverage-lowering": { severity: "block" },
-      "ci-tampering": { severity: "block" },
-      "hook-tampering": { severity: "block" },
-      "no-verify": { severity: "block" },
-      // mechanical but intent-ambiguous: updating a snapshot is the legitimate workflow
-      // when intended output changes. WARN until the §7 evidence path earns block.
-      "snapshot-rewrite": { severity: "warn" },
-      // the watcher's transient class (modified-and-restored within a turn). WARN by
-      // default: a Stop block already forces restores, and a compliant restore reads
-      // as churn — block-by-default would deadlock the honest path. Harnesses that own
-      // that semantics raise it via TAMPERWARD_TRANSIENT=block.
-      "transient-protected-mutation": { severity: "warn" },
-      // the narrow graduation candidate: snapshot moved with NO accompanying change.
-      // ~0.06% FP on 1,652 audited mainline commits, 7/7 TP on observed tampers
-      // (harness/fp-study/). warn until a version: gate graduates it (BLOCK_SINCE).
-      "snapshot-only-rewrite": { severity: "warn" },
-      // heuristic — warn until precision is measured (SPEC §7)
-      "assertion-weakening": { severity: "warn" },
-      "guard-removal": { severity: "warn" }
-    },
-    ignore: [],
-    signoff: { requiredFor: ["block"], ledger: ".tamperward/ledger.jsonl" }
-  };
-  p.rules = applyVersionGates(p.rules, version);
-  return p;
-}
-
 // src/detectors/files.ts
 var CODE = /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
 function isCodeFile(path) {
@@ -1164,12 +1334,12 @@ import ts2 from "typescript";
 
 // src/detectors/repo.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-var cache2 = /* @__PURE__ */ new Map();
+var cache = /* @__PURE__ */ new Map();
 function trackedFiles(ctx) {
   if (!ctx) return null;
   if (ctx.trackedFiles) return ctx.trackedFiles;
   if (!ctx.cwd) return null;
-  const hit = cache2.get(ctx.cwd);
+  const hit = cache.get(ctx.cwd);
   if (hit !== void 0) return hit;
   let files = null;
   try {
@@ -1182,7 +1352,7 @@ function trackedFiles(ctx) {
   } catch {
     files = null;
   }
-  cache2.set(ctx.cwd, files);
+  cache.set(ctx.cwd, files);
   return files;
 }
 var branchCache = /* @__PURE__ */ new Map();
@@ -2490,11 +2660,11 @@ var ciTampering = {
 };
 
 // src/detectors/hook-tampering.ts
-import { existsSync, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync, readFileSync as readFileSync2 } from "node:fs";
 import { isAbsolute, join as join3, relative } from "node:path";
 
 // src/wiring.ts
-import { readFileSync as readFileSync2 } from "node:fs";
+import { readFileSync } from "node:fs";
 import { dirname, join as join2 } from "node:path";
 import { fileURLToPath } from "node:url";
 function shippedVersion() {
@@ -2502,7 +2672,7 @@ function shippedVersion() {
     const here = dirname(fileURLToPath(import.meta.url));
     for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
       try {
-        const pkg = JSON.parse(readFileSync2(join2(here, rel), "utf8"));
+        const pkg = JSON.parse(readFileSync(join2(here, rel), "utf8"));
         if (pkg.name === "tamperward" && pkg.version) return pkg.version;
       } catch {
       }
@@ -4151,7 +4321,7 @@ function lefthookBase(c, changes, ctx) {
   for (const n of names) {
     try {
       const p = join3(ctx.cwd, n);
-      if (existsSync(p)) return parseDoc(readFileSync3(p, "utf8"));
+      if (existsSync(p)) return parseDoc(readFileSync2(p, "utf8"));
     } catch {
     }
   }
@@ -5386,7 +5556,7 @@ function hasBlocking(findings) {
 }
 
 // src/policy-load.ts
-import { readFileSync as readFileSync4, existsSync as existsSync2 } from "node:fs";
+import { readFileSync as readFileSync3, existsSync as existsSync2 } from "node:fs";
 import { isAbsolute as isAbsolute2, join as join4, posix } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
@@ -5513,7 +5683,7 @@ function parseOrThrow(src, where) {
 function loadPolicy(cwd = process.cwd()) {
   const path = join4(cwd, POLICY_FILE);
   if (!existsSync2(path)) return defaultPolicy();
-  return parseOrThrow(readFileSync4(path, "utf8"), POLICY_FILE);
+  return parseOrThrow(readFileSync3(path, "utf8"), POLICY_FILE);
 }
 function loadPolicyAt(rev, cwd) {
   const src = fileAt(rev, POLICY_FILE, { cwd });
@@ -5523,7 +5693,7 @@ function loadPolicyAt(rev, cwd) {
 
 // src/signoff.ts
 import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync as readFileSync5, existsSync as existsSync3 } from "node:fs";
+import { appendFileSync, mkdirSync, readFileSync as readFileSync4, existsSync as existsSync3 } from "node:fs";
 import { dirname as dirname2, join as join5 } from "node:path";
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function fingerprint(rule, file, evidence) {
@@ -5541,7 +5711,7 @@ function readLedger(cwd, policy) {
   const p = ledgerPath(cwd, policy);
   if (!existsSync3(p)) return [];
   const out2 = [];
-  for (const line of readFileSync5(p, "utf8").split("\n")) {
+  for (const line of readFileSync4(p, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const e = JSON.parse(line);
@@ -5694,7 +5864,7 @@ function renderText(input, opts) {
   for (const f of findings) {
     const isBlock = f.severity === "block";
     const mark = paint(isBlock ? "BLOCK" : "warn ", isBlock ? BOLD + RED : YELLOW, c);
-    const loc = f.file ? `${stripControl(f.file)}${f.line ? `:${f.line}` : ""}` : "(command)";
+    const loc = f.file ? `${stripControl(escapeControl(f.file))}${f.line ? `:${f.line}` : ""}` : "(command)";
     out2.push(`  ${mark}  ${paint(stripControl(f.rule), BOLD, c)}  ${paint(loc, DIM, c)}`);
     for (const l of wrap(f.message, opts.width - 4)) out2.push(`    ${l}`);
     const row = (key2, lines) => {
@@ -5886,6 +6056,7 @@ function check(opts) {
   }
   const ignoredFiles = changes.filter((c) => isSuppressed(c, policy)).length;
   let findings = evaluate(changes, policy, void 0, view, { cwd });
+  if (view === "worktree") findings = findings.concat(unjudgeableProtected(cwd, policy, changes));
   const { findings: remaining, cleared } = layer === "local" ? applyLocalSignoffs(findings, cwd, policy) : applyOobSignoffs(findings, oobFromEnv(), oobHeadFromEnv());
   findings = remaining;
   if (cleared.length) {
@@ -5910,24 +6081,19 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync11, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7, statSync as statSync4 } from "node:fs";
+import { readFileSync as readFileSync9, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
-import { join as join10 } from "node:path";
 
 // src/adapters/claude/changes.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { readFileSync as readFileSync6, existsSync as existsSync4, writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { isAbsolute as isAbsolute3, join as join6, relative as relative2, resolve } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
 function readDisk(path) {
-  try {
-    return existsSync4(path) ? readFileSync6(path, "utf8") : null;
-  } catch {
-    return null;
-  }
+  return textOf(inspectResolved(path));
 }
 function abs(path, cwd) {
   return resolve(cwd, path);
@@ -6021,7 +6187,7 @@ function formatDenial(blocks) {
   const lead = blocks[0];
   const lines = ["Tamperward blocked this change \u2014 it weakens a protected safety net to pass checks.", ""];
   for (const f of blocks) {
-    const loc = f.file ? ` (${f.file}${f.line ? `:${f.line}` : ""})` : "";
+    const loc = f.file ? ` (${escapeControl(f.file)}${f.line ? `:${f.line}` : ""})` : "";
     lines.push(`  \u2022 ${f.rule}${loc}: ${f.message}`);
   }
   lines.push("");
@@ -6036,7 +6202,7 @@ function formatDenial(blocks) {
 }
 
 // src/session.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, join as join7 } from "node:path";
 var UNSAFE = /[^A-Za-z0-9_-]/g;
 var SHA = /^[0-9a-f]{7,40}$/;
@@ -6050,8 +6216,8 @@ function turnBaseline(cwd, sessionId) {
   try {
     const p = baselinePath(cwd, sessionId);
     if (!p) return null;
-    if (existsSync5(p)) {
-      const v = readFileSync7(p, "utf8").trim();
+    if (existsSync4(p)) {
+      const v = readFileSync5(p, "utf8").trim();
       if (SHA.test(v)) return v;
     }
     const head = headSha(cwd);
@@ -6077,7 +6243,7 @@ function advanceTurnBaseline(cwd, sessionId) {
 
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync8, renameSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync5, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { isAbsolute as isAbsolute4, join as join8 } from "node:path";
 import { execFileSync as execFileSync4 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
@@ -6112,8 +6278,22 @@ var sha = (buf) => createHash2("sha256").update(buf).digest("hex").slice(0, 16);
 function contentHash(content) {
   return sha(Buffer.isBuffer(content) ? content : Buffer.from(content, "utf8"));
 }
+function entryOf(e) {
+  const hash = e.content != null ? sha(e.content) : e.kind === "unreadable" ? "unreadable" : `${e.kind}:${e.detail}`;
+  return { hash, mode: e.mode, size: e.size, mtimeMs: e.mtimeMs };
+}
 function snapshotProtected(cwd, policy, prev) {
+  void prev;
   const out2 = {};
+  const keep = (rel) => isProtected(rel, policy);
+  let pruned = /* @__PURE__ */ new Set();
+  let listed = [];
+  try {
+    const t = ignoredTree({ cwd }, keep);
+    pruned = new Set(t.dirs.map((d) => d.replace(/\/$/, "")));
+    listed = t.files;
+  } catch {
+  }
   const walk2 = (rel) => {
     const abs2 = rel ? join8(cwd, rel) : cwd;
     let names;
@@ -6125,25 +6305,19 @@ function snapshotProtected(cwd, policy, prev) {
     for (const name of names) {
       if (SKIP_DIRS2.has(name)) continue;
       const r = rel ? `${rel}/${name}` : name;
+      if (pruned.has(r)) continue;
       let st;
       try {
-        st = statSync(join8(cwd, r));
+        st = lstatSync2(join8(cwd, r));
       } catch {
         continue;
       }
       if (st.isDirectory()) walk2(r);
-      else if (st.isFile() && isProtected(r, policy)) {
-        let hash = "";
-        try {
-          hash = sha(readFileSync8(join8(cwd, r)));
-        } catch {
-          hash = "unreadable";
-        }
-        out2[r] = { hash, mode: st.mode, size: st.size, mtimeMs: st.mtimeMs };
-      }
+      else if (keep(r)) out2[r] = entryOf(inspectRel(cwd, r));
     }
   };
   walk2("");
+  for (const rel of listed) if (out2[rel] === void 0) out2[rel] = entryOf(inspectRel(cwd, rel));
   return out2;
 }
 function driftBetween(expected, current) {
@@ -6161,9 +6335,9 @@ function driftBetween(expected, current) {
   return { changed, deleted, added };
 }
 function loadTree(p) {
-  if (!p || !existsSync6(p)) return null;
+  if (!p || !existsSync5(p)) return null;
   try {
-    return JSON.parse(readFileSync8(p, "utf8"));
+    return JSON.parse(readFileSync6(p, "utf8"));
   } catch {
     return null;
   }
@@ -6202,19 +6376,16 @@ function dropTurnTree(cwd, sessionId) {
 }
 
 // src/cli/watch.ts
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync9, statSync as statSync2, watch } from "node:fs";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync, watch } from "node:fs";
 import { join as join9 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 var SKIP2 = /(^|\/)(\.git|node_modules)(\/|$)/;
 function snap(abs2) {
-  try {
-    const st = statSync2(abs2);
-    if (!st.isFile()) return { mode: st.mode, size: null, hash: null };
-    const hash = createHash3("sha256").update(readFileSync9(abs2)).digest("hex").slice(0, 16);
-    return { mode: st.mode, size: st.size, hash };
-  } catch {
-    return { mode: null, size: null, hash: null };
-  }
+  const e = inspectPath(abs2);
+  if (e.kind === "absent" || e.kind === "unreadable") return { mode: null, size: null, hash: null };
+  if (e.kind !== "file" || e.content == null) return { mode: e.mode, size: null, hash: null };
+  const hash = createHash3("sha256").update(e.content).digest("hex").slice(0, 16);
+  return { mode: e.mode, size: e.size, hash };
 }
 function defaultEventLog(cwd) {
   if (process.env.TAMPERWARD_FSEVENTS) return process.env.TAMPERWARD_FSEVENTS;
@@ -6240,7 +6411,7 @@ function watchTree(dir, cb) {
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
-          if (statSync2(join9(dir, child)).isDirectory()) addDir(child);
+          if (statSync(join9(dir, child)).isDirectory()) addDir(child);
         } catch {
         }
       });
@@ -6261,7 +6432,7 @@ function watchTree(dir, cb) {
       const child = rel ? `${rel}/${name}` : name;
       if (SKIP2.test(child + "/")) continue;
       try {
-        if (statSync2(join9(dir, child)).isDirectory()) walk2(child);
+        if (statSync(join9(dir, child)).isDirectory()) walk2(child);
       } catch {
       }
     }
@@ -6306,17 +6477,17 @@ function runWatch(args) {
 }
 
 // src/detectors/fs-events.ts
-import { readFileSync as readFileSync10, statSync as statSync3 } from "node:fs";
+import { readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
 var RULE11 = "transient-protected-mutation";
 function readEvents(log, offset) {
   let size = 0;
   try {
-    size = statSync3(log).size;
+    size = statSync2(log).size;
   } catch {
     return { events: [], newOffset: offset };
   }
   if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
-  const raw = readFileSync10(log, "utf8").slice(offset);
+  const raw = readFileSync8(log, "utf8").slice(offset);
   const events = [];
   for (const line of raw.split("\n")) {
     if (!line.trim()) continue;
@@ -6369,7 +6540,7 @@ var HookInputError = class extends Error {
 };
 function readStdin() {
   try {
-    return readFileSync11(0, "utf8");
+    return readFileSync9(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -6395,7 +6566,7 @@ function recordDenylog(blocks) {
   } catch {
   }
 }
-function errText(e) {
+function errText2(e) {
   const m = e instanceof Error ? e.message : String(e);
   return m.length > 200 ? m.slice(0, 200) + "\u2026" : m;
 }
@@ -6427,11 +6598,8 @@ function fileChanges(changes) {
   return changes.filter((c) => c.kind === "file");
 }
 function hashOnDisk(cwd, rel) {
-  try {
-    return contentHash(readFileSync11(join10(cwd, rel)));
-  } catch {
-    return null;
-  }
+  const e = inspectRel(cwd, rel);
+  return e.content == null ? null : contentHash(e.content);
 }
 function gitMode(mode) {
   return (mode & 64) !== 0 ? "100755" : "100644";
@@ -6478,6 +6646,11 @@ function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree)
   const candidates = base ? [base, "HEAD", ""] : ["HEAD", ""];
   for (const rel of [...d.changed, ...d.deleted]) {
     if (seen.has(rel)) continue;
+    const unjudgeable = unjudgeableFinding(cwd, rel);
+    if (unjudgeable) {
+      blocks.push(unjudgeable);
+      continue;
+    }
     const after = fileOnDisk(rel, { cwd });
     const trustedBlob = fileAt(trusted, rel, { cwd });
     const atGitState = after != null && trustedBlob != null && contentHash(after) === contentHash(trustedBlob);
@@ -6526,6 +6699,11 @@ function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree)
   }
   for (const rel of d.added) {
     if (seen.has(rel)) continue;
+    const unjudgeable = unjudgeableFinding(cwd, rel);
+    if (unjudgeable) {
+      blocks.push(unjudgeable);
+      continue;
+    }
     const after = fileOnDisk(rel, { cwd });
     if (after == null) {
       blocks.push({
@@ -6565,7 +6743,8 @@ function effectDriftBlocks(cwd, sessionId, policy) {
     (c) => c.kind === "file" && (drifted.has(c.path) || c.oldPath != null && drifted.has(c.oldPath))
   );
   const gap = uncoveredDrift(cwd, policy, expected, current, scoped, base, loadTurnTree(cwd, sessionId));
-  const blocks = evaluate([...scoped, ...gap.changes], policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(gap.blocks);
+  const judged = [...scoped, ...gap.changes];
+  const blocks = evaluate(judged, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(gap.blocks, unjudgeableProtected(cwd, policy, judged));
   if (blocks.length > 0) return blocks;
   savePtree(cwd, sessionId, current);
   return null;
@@ -6602,7 +6781,7 @@ function preToolUseVerdict(input) {
     if (blocks.length === 0) sanctionPredictedWrites(cwd, input.session_id, policy, changes);
     return verdict(blocks, "PreToolUse");
   } catch (e) {
-    return failClosed("PreToolUse", errText(e));
+    return failClosed("PreToolUse", errText2(e));
   }
 }
 function cursorPath(cwd, sessionId) {
@@ -6614,10 +6793,10 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   } };
   const log = defaultEventLog(cwd);
   const cp = cursorPath(cwd, sessionId);
-  if (!existsSync7(log)) return none;
+  if (!existsSync6(log)) return none;
   let offset = 0;
-  if (cp && existsSync7(cp)) {
-    const n = Number(readFileSync11(cp, "utf8"));
+  if (cp && existsSync6(cp)) {
+    const n = Number(readFileSync9(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
   const { events, newOffset } = readEvents(log, offset);
@@ -6629,12 +6808,8 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   } };
   const persistent = new Set(changes.filter((c) => c.kind === "file").map((c) => c.path));
   const finalHash = (path) => {
-    try {
-      if (!statSync4(`${cwd}/${path}`).isFile()) return null;
-      return createHash4("sha256").update(readFileSync11(`${cwd}/${path}`)).digest("hex").slice(0, 16);
-    } catch {
-      return null;
-    }
+    const e = inspectRel(cwd, path);
+    return e.kind === "file" && e.content != null ? contentHash(e.content) : null;
   };
   const findings = transientFindings(events, persistent, policy, finalHash);
   recordWarns(findings.filter((f) => f.severity !== "block"));
@@ -6675,7 +6850,7 @@ function stopVerdict(input) {
       changes = changes.concat(gap.changes);
       hiddenBlocks = gap.blocks;
     }
-    blocks = evaluate(changes, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(hiddenBlocks);
+    blocks = evaluate(changes, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(hiddenBlocks, unjudgeableProtected(cwd, policy, changes));
     const transient = turnTransientBlocks(cwd, input.session_id, policy, changes);
     blocks = blocks.concat(transient.blocks);
     commitCursor = transient.commit;
@@ -6684,7 +6859,7 @@ function stopVerdict(input) {
       saveTurnTree(cwd, input.session_id, current);
     }
   } catch (e) {
-    return failClosed("Stop", errText(e));
+    return failClosed("Stop", errText2(e));
   }
   if (blocks.length === 0) {
     advanceTurnBaseline(cwd, input.session_id);
@@ -6700,28 +6875,28 @@ function preToolUseFromRaw(raw) {
   try {
     return preToolUseVerdict(parseInput(raw));
   } catch (e) {
-    return failClosed("PreToolUse", errText(e));
+    return failClosed("PreToolUse", errText2(e));
   }
 }
 function stopFromRaw(raw) {
   try {
     return stopVerdict(parseInput(raw));
   } catch (e) {
-    return failClosed("Stop", errText(e));
+    return failClosed("Stop", errText2(e));
   }
 }
 function runHookClaude() {
   try {
     return emit(preToolUseFromRaw(readStdin()));
   } catch (e) {
-    return emit(failClosed("PreToolUse", errText(e)));
+    return emit(failClosed("PreToolUse", errText2(e)));
   }
 }
 function runSweepClaude() {
   try {
     return emit(stopFromRaw(readStdin()));
   } catch (e) {
-    return emit(failClosed("Stop", errText(e)));
+    return emit(failClosed("Stop", errText2(e)));
   }
 }
 
@@ -6774,9 +6949,9 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync5, chmodSync, statSync as statSync5 } from "node:fs";
-import { basename, dirname as dirname4, isAbsolute as isAbsolute5, join as join11, relative as relative3, resolve as resolve2 } from "node:path";
-var errText2 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
+import { basename, dirname as dirname4, isAbsolute as isAbsolute5, join as join10, relative as relative3, resolve as resolve2 } from "node:path";
+var errText3 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function gitConfig(cwd, key2) {
   try {
@@ -6925,13 +7100,13 @@ function readWorkflowMark(src) {
   if (!m) return null;
   return { version: m[1], hash: m[2], body: src.replace(WORKFLOW_MARK_RE, "") };
 }
-function toolSet(matcher2) {
-  const m = String(matcher2 ?? "").trim();
+function toolSet(matcher) {
+  const m = String(matcher ?? "").trim();
   if (m === "" || m === "*") return null;
   return new Set(m.split("|").map((t) => t.trim()).filter(Boolean));
 }
-function missingTools(matcher2) {
-  const have = toolSet(matcher2);
+function missingTools(matcher) {
+  const have = toolSet(matcher);
   if (have === null) return [];
   return PRE_MATCHER.split("|").filter((t) => !have.has(t));
 }
@@ -6951,12 +7126,12 @@ function hooksShapeError(hooks) {
   return null;
 }
 function planPolicy(cwd) {
-  const path = join11(cwd, POLICY_FILE);
-  if (existsSync8(path)) {
+  const path = join10(cwd, POLICY_FILE);
+  if (existsSync7(path)) {
     try {
       loadPolicy(cwd);
     } catch (e) {
-      return { item: "policy", path: POLICY_FILE, status: "error", detail: `present but does not load \u2014 ${errText2(e)}; fix it, then re-run init (left untouched)` };
+      return { item: "policy", path: POLICY_FILE, status: "error", detail: `present but does not load \u2014 ${errText3(e)}; fix it, then re-run init (left untouched)` };
     }
     return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present and loads \u2014 left untouched" };
   }
@@ -6970,12 +7145,12 @@ function planPolicy(cwd) {
 }
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
-  const path = join11(cwd, rel);
+  const path = join10(cwd, rel);
   let settings = {};
-  if (existsSync8(path)) {
+  if (existsSync7(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync12(path, "utf8"));
+      parsed = JSON.parse(readFileSync10(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -7009,7 +7184,7 @@ function planClaudeHooks(cwd) {
   return {
     item: "agent",
     path: rel,
-    status: existsSync8(path) ? "update" : "create",
+    status: existsSync7(path) ? "update" : "create",
     detail: [
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
@@ -7068,7 +7243,7 @@ function hooksDir(cwd) {
     if (out2) return resolve2(cwd, out2);
   } catch {
   }
-  return existsSync8(join11(cwd, ".git")) ? join11(cwd, ".git", "hooks") : null;
+  return existsSync7(join10(cwd, ".git")) ? join10(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative3(cwd, path);
@@ -7095,30 +7270,30 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync8(join11(cwd, ".husky"))) {
-    path = join11(cwd, ".husky", "pre-commit");
+  if (existsSync7(join10(cwd, ".husky"))) {
+    path = join10(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join11(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync7(join10(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
     if (basename(dir) === "_" && basename(dirname4(dir)) === ".husky") {
-      path = join11(dirname4(dir), "pre-commit");
+      path = join10(dirname4(dir), "pre-commit");
       note = "husky";
     } else {
-      path = join11(dir, "pre-commit");
+      path = join10(dir, "pre-commit");
       const rel2 = display(cwd, dir);
-      note = rel2 === join11(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
+      note = rel2 === join10(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
     }
   }
   const rel = display(cwd, path);
-  if (existsSync8(path) && !statSync5(path).isFile()) {
+  if (existsSync7(path) && !statSync3(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync8(path) ? readFileSync12(path, "utf8") : null;
+  const existing = existsSync7(path) ? readFileSync10(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -7207,10 +7382,10 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => existsSync8(join11(cwd, r))
+    (r) => existsSync7(join10(cwd, r))
   );
-  const path = join11(cwd, existingRel ?? rel);
-  const existing = existingRel ? readFileSync12(path, "utf8") : null;
+  const path = join10(cwd, existingRel ?? rel);
+  const existing = existingRel ? readFileSync10(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -7243,12 +7418,12 @@ ${CODEOWNERS_MARK}
 }
 function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
-  const path = join11(cwd, rel);
+  const path = join10(cwd, rel);
   const write = () => {
     mkdirSync5(dirname4(path), { recursive: true });
     writeFileSync5(path, workflowFile(WORKFLOW_CONTENT));
   };
-  if (!existsSync8(path)) {
+  if (!existsSync7(path)) {
     return {
       item: "ci",
       path: rel,
@@ -7259,7 +7434,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync12(path, "utf8");
+    src = readFileSync10(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -7297,7 +7472,7 @@ function planned(item, path, plan) {
   try {
     return plan();
   } catch (e) {
-    return { item, path, status: "error", detail: `cannot plan this item \u2014 ${errText2(e)}` };
+    return { item, path, status: "error", detail: `cannot plan this item \u2014 ${errText3(e)}` };
   }
 }
 function planInit(cwd, opts = {}) {
@@ -7321,7 +7496,7 @@ function runInit(opts) {
         applied++;
       } catch (e) {
         a.status = "error";
-        a.detail = `could not be written \u2014 ${errText2(e)}`;
+        a.detail = `could not be written \u2014 ${errText3(e)}`;
         a.apply = void 0;
       }
     }
@@ -7358,15 +7533,15 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync15, readlinkSync as readlinkSync2, rmSync as rmSync3, statSync as statSync7, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync9 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join14, resolve as resolve3 } from "node:path";
+import { dirname as dirname5, join as join13, resolve as resolve3 } from "node:path";
 
 // src/git/trusted.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync13 } from "node:fs";
-import { isAbsolute as isAbsolute6, join as join12 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "node:fs";
+import { isAbsolute as isAbsolute6, join as join11 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
@@ -7379,7 +7554,7 @@ function gitDirOf(cwd) {
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute6(d) ? d : join12(cwd, d);
+    return isAbsolute6(d) ? d : join11(cwd, d);
   } catch {
     return null;
   }
@@ -7404,9 +7579,9 @@ function objectRewriteState(cwd) {
       parts.push(`${rel}:<no-git-dir>`);
       continue;
     }
-    const p = join12(dir, rel);
+    const p = join11(dir, rel);
     try {
-      parts.push(`${rel}:` + (existsSync9(p) ? readFileSync13(p, "utf8").trim() : ""));
+      parts.push(`${rel}:` + (existsSync8(p) ? readFileSync11(p, "utf8").trim() : ""));
     } catch {
       parts.push(`${rel}:<unreadable>`);
     }
@@ -7417,8 +7592,8 @@ function objectRewriteState(cwd) {
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync14, readlinkSync, statSync as statSync6 } from "node:fs";
-import { join as join13 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync as readlinkSync2, statSync as statSync4 } from "node:fs";
+import { join as join12 } from "node:path";
 function treeFingerprint(cwd) {
   const files = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
@@ -7430,17 +7605,13 @@ function treeFingerprint(cwd) {
   for (const rel of files) {
     h.update(rel);
     h.update("\0");
-    try {
-      h.update(readFileSync14(join13(cwd, rel)));
-    } catch {
-      h.update("<unreadable>");
-    }
+    h.update(inspectRel(cwd, rel).content ?? "<unreadable>");
     h.update("\0");
   }
   return h.digest("hex");
 }
 function depsFingerprint(cwd) {
-  const root = join13(cwd, "node_modules");
+  const root = join12(cwd, "node_modules");
   const h = createHash7("sha256");
   const walk2 = (dir) => {
     let entries;
@@ -7450,20 +7621,20 @@ function depsFingerprint(cwd) {
       return;
     }
     for (const e of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
-      const p = join13(dir, e.name);
+      const p = join12(dir, e.name);
       if (e.isDirectory()) walk2(p);
       else if (e.isFile()) {
         h.update(p);
         try {
-          h.update(readFileSync14(p));
-          h.update(String(statSync6(p).mode));
+          h.update(readFileSync12(p));
+          h.update(String(statSync4(p).mode));
         } catch {
           h.update("<unreadable>");
         }
       } else if (e.isSymbolicLink()) {
         h.update(p);
         try {
-          h.update(readlinkSync(p));
+          h.update(readlinkSync2(p));
         } catch {
           h.update("<unreadable-link>");
         }
@@ -7471,7 +7642,7 @@ function depsFingerprint(cwd) {
     }
   };
   try {
-    if (!statSync6(root).isDirectory()) return "none";
+    if (!statSync4(root).isDirectory()) return "none";
   } catch {
     return "none";
   }
@@ -7570,30 +7741,30 @@ function baseIsAncestorOfHead(base, cwd) {
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of listed) {
-    const src = join14(cwd, rel);
+    const src = join13(cwd, rel);
     let st;
     try {
-      st = statSync7(src);
+      st = statSync5(src);
     } catch {
       continue;
     }
     if (!st.isFile()) continue;
-    const out2 = join14(dest, rel);
+    const out2 = join13(dest, rel);
     mkdirSync6(dirname5(out2), { recursive: true });
     dropSymlink(out2);
-    if (lstatSync(src).isSymbolicLink()) {
-      writeFileSync6(out2, readFileSync15(src));
+    if (lstatSync3(src).isSymbolicLink()) {
+      writeFileSync6(out2, readFileSync13(src));
     } else {
       cpSync(src, out2, { dereference: true });
     }
     chmodSync2(out2, st.mode);
   }
   const nm = resolve3(cwd, "node_modules");
-  if (existsSync10(nm)) symlinkSync(nm, join14(dest, "node_modules"), "dir");
+  if (existsSync9(nm)) symlinkSync(nm, join13(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync(p).isSymbolicLink()) rmSync3(p, { force: true });
+    if (lstatSync3(p).isSymbolicLink()) rmSync3(p, { force: true });
   } catch {
   }
 }
@@ -7622,11 +7793,11 @@ function overlayDigest(dest, paths) {
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join14(dest, rel);
+    const p = join13(dest, rel);
     try {
-      const st = lstatSync(p);
+      const st = lstatSync3(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync2(p) : readFileSync15(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync13(p));
     } catch {
       h.update("<gone>");
     }
@@ -7649,7 +7820,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out2 = join14(dest, e.path);
+    const out2 = join13(dest, e.path);
     mkdirSync6(dirname5(out2), { recursive: true });
     rmSync3(out2, { force: true });
     if (e.mode === "120000") {
@@ -7664,7 +7835,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync3(join14(dest, rel), { force: true });
+    rmSync3(join13(dest, rel), { force: true });
     removed++;
   }
   return { restored, removed };
@@ -7706,8 +7877,8 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join14(scratch, "npmrc-user");
-  const globalRc = join14(scratch, "npmrc-global");
+  const userRc = join13(scratch, "npmrc-user");
+  const globalRc = join13(scratch, "npmrc-global");
   for (const f of [userRc, globalRc]) writeFileSync6(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
@@ -7717,8 +7888,8 @@ function suiteEnv(scratch) {
 }
 function runSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
-  const outDir = mkdtempSync2(join14(tmpdir2(), "tw-verify-run-"));
-  const outFile = join14(outDir, "result.json");
+  const outDir = mkdtempSync2(join13(tmpdir2(), "tw-verify-run-"));
+  const outFile = join13(outDir, "result.json");
   try {
     spawnSync(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
       cwd: dir,
@@ -7731,7 +7902,7 @@ function runSuite(dir, cmd, budgetSecs) {
     const secs = Math.round((Date.now() - t0) / 1e3);
     let r;
     try {
-      r = JSON.parse(readFileSync15(outFile, "utf8"));
+      r = JSON.parse(readFileSync13(outFile, "utf8"));
     } catch {
       return { exit: null, secs };
     }
@@ -7782,8 +7953,8 @@ function runVerify(opts) {
     out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
     return 2;
   }
-  const visRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-vis-"));
-  const visDir = join14(visRoot, "t");
+  const visRoot = mkdtempSync2(join13(tmpdir2(), "tw-verify-vis-"));
+  const visDir = join13(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
     for (const d of dirs) rmSync3(d, { recursive: true, force: true });
@@ -7811,8 +7982,8 @@ function runVerify(opts) {
     out2("pristine run executes through it too. Failing closed, not open.");
     return 2;
   }
-  const priRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-pri-"));
-  const priDir = join14(priRoot, "t");
+  const priRoot = mkdtempSync2(join13(tmpdir2(), "tw-verify-pri-"));
+  const priDir = join13(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
@@ -7924,7 +8095,7 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync16, realpathSync } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync as realpathSync2 } from "node:fs";
 import { resolve as resolve4 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
@@ -7933,7 +8104,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync16("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync14("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -7942,7 +8113,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out2 = [];
   let real;
   try {
-    real = realpathSync(cwd);
+    real = realpathSync2(cwd);
   } catch {
     return out2;
   }
@@ -7957,13 +8128,13 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     if (n === process.pid) continue;
     let held;
     try {
-      held = realpathSync(`/proc/${pid}/cwd`);
+      held = realpathSync2(`/proc/${pid}/cwd`);
     } catch {
       continue;
     }
     if (held !== real && !held.startsWith(real + "/")) continue;
     try {
-      const stat = readFileSync16(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync14(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (Number.isFinite(startTicks) && startTicks >= spawnedAfterTicks) out2.push(n);
     } catch {