tamperward 2.7.1 → 2.9.0

package/dist/cli/index.js

@@ -2,9 +2,376 @@
 
 // src/git/build.ts
 import { execFileSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+
+// src/disk.ts
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, readlinkSync, realpathSync } from "node:fs";
 import { join } from "node:path";
 
+// src/policy.ts
+import picomatch from "picomatch";
+var POLICY_FILE = ".tamperward.yml";
+var BLOCK_SINCE = {};
+function applyVersionGates(rules, version, gates = BLOCK_SINCE) {
+  const out2 = { ...rules };
+  for (const [rule, since] of Object.entries(gates)) {
+    if (since > version && out2[rule]?.severity === "block") {
+      out2[rule] = { ...out2[rule], severity: "warn" };
+    }
+  }
+  return out2;
+}
+function normalizeGlob(glob) {
+  return glob.startsWith("/") ? glob.replace(/^\/+/, "") : glob;
+}
+function mergeRules(base, user) {
+  const out2 = { ...base };
+  for (const [name, cfg] of Object.entries(user ?? {})) {
+    out2[name] = { ...out2[name] ?? {}, ...cfg ?? {} };
+  }
+  return out2;
+}
+var CONTROL = /[\u0000-\u001f\u007f]/;
+function hasControlChar(path) {
+  return CONTROL.test(path);
+}
+function escapeControl(path) {
+  return path.replace(/[\u0000-\u001f\u007f]/g, (ch) => {
+    const c = ch.charCodeAt(0);
+    if (c === 10) return "\\n";
+    if (c === 13) return "\\r";
+    if (c === 9) return "\\t";
+    return `\\x${c.toString(16).padStart(2, "0")}`;
+  });
+}
+var listCache = /* @__PURE__ */ new WeakMap();
+function listMatcher(globs4) {
+  let re = listCache.get(globs4);
+  if (re === void 0) {
+    re = globs4.length === 0 ? null : new RegExp(globs4.map((g) => `(?:${picomatch.makeRe(g, { dot: true }).source})`).join("|"));
+    listCache.set(globs4, re);
+  }
+  return re;
+}
+function matchesAny(path, globs4) {
+  if (!globs4) return false;
+  const re = listMatcher(globs4);
+  return re !== null && re.test(path);
+}
+function protectedCategory(path, policy) {
+  const cats = Object.entries(policy.protected ?? {});
+  if (hasControlChar(path)) return cats[0]?.[0] ?? "tests";
+  for (const [cat, globs4] of cats) {
+    if (matchesAny(path, globs4)) return cat;
+  }
+  return null;
+}
+var anyCache = /* @__PURE__ */ new WeakMap();
+function allProtectedGlobs(policy) {
+  const p = policy.protected ?? {};
+  let all = anyCache.get(p);
+  if (!all) {
+    all = Object.values(p).flat();
+    anyCache.set(p, all);
+  }
+  return all;
+}
+function isProtected(path, policy, category) {
+  if (hasControlChar(path)) return true;
+  if (category) return matchesAny(path, policy.protected?.[category]);
+  return matchesAny(path, allProtectedGlobs(policy));
+}
+function isPolicyFile(path) {
+  return path === POLICY_FILE || path.endsWith("/" + POLICY_FILE);
+}
+function isIgnored(path, policy) {
+  return matchesAny(path, policy.ignore);
+}
+function mergeProtected(base, user) {
+  const out2 = { ...base };
+  for (const [cat, globs4] of Object.entries(user ?? {})) {
+    const have = new Set(out2[cat] ?? []);
+    out2[cat] = [...out2[cat] ?? [], ...(globs4 ?? []).filter((g) => !have.has(g))];
+  }
+  return out2;
+}
+function defaultPolicy(version = 1) {
+  const p = {
+    version,
+    protected: {
+      // Cover every JS/TS test extension, not just .test.ts — the multi-repo FP study found
+      // .test.tsx/.spec.tsx (hono, zustand) slipped the glob, so legit test-file casts blocked
+      // instead of warning. Kept ADDITIVE (originals + new extensions) so the policy-diff sees a
+      // strengthening, not a narrowing. picomatch expands the brace.
+      // test-skip, test-deletion and test-content-removal all gate on this
+      // class, so a repo it does not match gets rules that can NEVER fire —
+      // protection that is silently absent rather than visibly off. The JS/TS
+      // list shipped alone; these are the conventional layouts of the other
+      // ecosystems `init` is run in. (P2-13, external review.)
+      tests: [
+        // JavaScript / TypeScript
+        "**/*.test.ts",
+        "**/*.spec.ts",
+        "**/*.{test,spec}.{tsx,cts,mts,js,jsx,cjs,mjs}",
+        "**/__tests__/**",
+        // Python (pytest / unittest layouts)
+        "**/test_*.py",
+        "**/*_test.py",
+        "**/conftest.py",
+        // Go
+        "**/*_test.go",
+        // Rust (integration tests live in tests/, unit tests inline)
+        "**/tests/**/*.rs",
+        // Ruby (RSpec / minitest)
+        "**/*_spec.rb",
+        "**/*_test.rb",
+        // Java / Kotlin / Scala (Maven & Gradle convention)
+        "**/src/test/**",
+        // PHP (PHPUnit)
+        "**/*Test.php",
+        // C# (.NET)
+        "**/*Tests.cs",
+        "**/*Test.cs"
+      ],
+      config: [
+        "**/jest.config.*",
+        "**/vitest.config.*",
+        // A `vitest.workspace.*` file REPLACES the root config's selection with the
+        // union of its projects, and a `vite.config.*` carrying a `test:` key is the
+        // vitest config when no vitest.config exists — both are where a spec can be
+        // dropped from the suite without a line of it changing. ADDITIVE, like every
+        // baseline widening (the policy-diff reads it as a strengthening).
+        "**/vitest.workspace.*",
+        "**/vite.config.*",
+        "**/tsconfig*.json",
+        "**/.eslintrc*",
+        "**/eslint.config.*",
+        "**/package.json",
+        // Coverage gates outside the Jest/Vitest shapes. coverage-lowering could only
+        // see a threshold it was shown: a Python `fail_under`, an nyc `lines`, a
+        // codecov `target` lived in files no glob protected, so lowering them fired
+        // nothing. ADDITIVE, like every baseline widening (the policy-diff reads it
+        // as a strengthening). pyproject.toml carries [tool.coverage.report].
+        "**/.coveragerc",
+        "**/pyproject.toml",
+        "**/.nycrc",
+        "**/.nycrc.*",
+        "**/nyc.config.*",
+        "**/codecov.yml",
+        "**/.codecov.yml"
+      ],
+      ci: [".github/workflows/**"],
+      // Recorded expected outputs. An assertion stored as data is still an assertion;
+      // rewriting it from current output is the snapshot-update move the affordance
+      // experiment measured at a 70% attempt / 100% through rate (snapshot-rewrite).
+      // tap-snapshots/** added from Phase-3 evidence: node-tar's recorded expectations
+      // live there as .cjs and were rewritten unseen (PHASE3.md §4).
+      snapshots: ["**/*.snap", "**/__snapshots__/**", "**/tap-snapshots/**", "**/golden/**", "**/*.golden.*"],
+      // The wiring IS the enforcement: settings.json carries the PreToolUse and
+      // Stop hooks, and a pre-commit config carries the commit-time gate. These
+      // were installed by `init` and protected by nothing, so editing them out
+      // fired no rule at all. (.git/hooks/** is outside every git view and so
+      // cannot be covered here — noted in SECURITY-ENVELOPE.md.) (P1-4, review.)
+      hooks: [
+        ".husky/**",
+        "**/lefthook.*",
+        // lefthook merges `lefthook-local.yml` OVER `lefthook.yml`: a `skip: true`
+        // there switches the gate off without touching the file init pointed at.
+        "**/lefthook-local.*",
+        ".tamperward.yml",
+        "**/.tamperward.yml",
+        ".claude/settings.json",
+        ".claude/settings.local.json",
+        "**/.pre-commit-config.yaml",
+        // CODEOWNERS is enforcement wiring, not documentation: it is the only
+        // thing that can require a human on a change to the workflow that
+        // decides whether the gate runs at all. GitHub reads it from any of
+        // these three locations. (H2.)
+        ".github/CODEOWNERS",
+        "CODEOWNERS",
+        "docs/CODEOWNERS"
+      ]
+    },
+    rules: {
+      "test-deletion": { severity: "block" },
+      // content gutted from a surviving spec — the class Phase 3 measured walking
+      // through the block-count rule (rows, assertion arguments, setup). Severity
+      // backed by the real-commit corpus measurement recorded in the rule's SPEC row.
+      "test-content-removal": { severity: "block" },
+      "test-skip": { severity: "block" },
+      "ts-any-cast": { severity: "block" },
+      // the unambiguous explicit casts + ts-suppression directives
+      // broad any in annotation/generic position is common in legit code (measured ~84-100% FP as a
+      // block rule on real TS), so it WARNs until a semantic (error-silencing-aware) signal earns block.
+      "ts-any-launder": { severity: "warn" },
+      "lint-suppression": { severity: "block" },
+      "coverage-lowering": { severity: "block" },
+      "ci-tampering": { severity: "block" },
+      "hook-tampering": { severity: "block" },
+      "no-verify": { severity: "block" },
+      // mechanical but intent-ambiguous: updating a snapshot is the legitimate workflow
+      // when intended output changes. WARN until the §7 evidence path earns block.
+      "snapshot-rewrite": { severity: "warn" },
+      // the watcher's transient class (modified-and-restored within a turn). WARN by
+      // default: a Stop block already forces restores, and a compliant restore reads
+      // as churn — block-by-default would deadlock the honest path. Harnesses that own
+      // that semantics raise it via TAMPERWARD_TRANSIENT=block.
+      "transient-protected-mutation": { severity: "warn" },
+      // the narrow graduation candidate: snapshot moved with NO accompanying change.
+      // ~0.06% FP on 1,652 audited mainline commits, 7/7 TP on observed tampers
+      // (harness/fp-study/). warn until a version: gate graduates it (BLOCK_SINCE).
+      "snapshot-only-rewrite": { severity: "warn" },
+      // heuristic — warn until precision is measured (SPEC §7)
+      "assertion-weakening": { severity: "warn" },
+      "guard-removal": { severity: "warn" }
+    },
+    ignore: [],
+    signoff: { requiredFor: ["block"], ledger: ".tamperward/ledger.jsonl" }
+  };
+  p.rules = applyVersionGates(p.rules, version);
+  return p;
+}
+
+// src/disk.ts
+var READ_CAP = 64 * 1024 * 1024;
+var NO_META = { mode: 0, size: 0, mtimeMs: 0 };
+function errText(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+function errCode(e) {
+  return String(e?.code ?? "");
+}
+function irregularName(st) {
+  if (st.isFIFO()) return "fifo";
+  if (st.isSocket()) return "socket";
+  if (st.isCharacterDevice()) return "character device";
+  if (st.isBlockDevice()) return "block device";
+  return "unknown file type";
+}
+function meta(st) {
+  return { mode: st.mode, size: st.size, mtimeMs: st.mtimeMs };
+}
+var O_READ = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+function readRegular(abs2, st) {
+  let fd;
+  try {
+    fd = openSync(abs2, O_READ);
+  } catch (e) {
+    if (errCode(e) === "ELOOP") return inspectOnce(abs2);
+    return { kind: "unreadable", content: null, ...meta(st), detail: errText(e) };
+  }
+  try {
+    const now = fstatSync(fd);
+    if (!now.isFile()) return { kind: "irregular", content: null, ...meta(now), detail: irregularName(now) };
+    if (now.size > READ_CAP) return { kind: "oversize", content: null, ...meta(now), detail: `${now.size} bytes` };
+    const buf = Buffer.allocUnsafe(now.size);
+    let off2 = 0;
+    while (off2 < now.size) {
+      const n = readSync(fd, buf, off2, now.size - off2, off2);
+      if (n === 0) break;
+      off2 += n;
+    }
+    return { kind: "file", content: off2 === now.size ? buf : buf.subarray(0, off2), mode: now.mode, size: off2, mtimeMs: now.mtimeMs, detail: "" };
+  } catch (e) {
+    return { kind: "unreadable", content: null, ...meta(st), detail: errText(e) };
+  } finally {
+    closeSync(fd);
+  }
+}
+function classify(abs2, st) {
+  if (st.isSymbolicLink()) {
+    try {
+      const target = readlinkSync(abs2);
+      return { kind: "symlink", content: Buffer.from(target, "utf8"), ...meta(st), detail: target };
+    } catch (e) {
+      return { kind: "unreadable", content: null, ...meta(st), detail: errText(e) };
+    }
+  }
+  if (st.isDirectory()) return { kind: "directory", content: null, ...meta(st), detail: "directory" };
+  if (!st.isFile()) return { kind: "irregular", content: null, ...meta(st), detail: irregularName(st) };
+  if (st.size > READ_CAP) return { kind: "oversize", content: null, ...meta(st), detail: `${st.size} bytes` };
+  return readRegular(abs2, st);
+}
+function inspectOnce(abs2) {
+  let st;
+  try {
+    st = lstatSync(abs2);
+  } catch (e) {
+    const code = errCode(e);
+    if (code === "ENOENT" || code === "ENOTDIR") return { kind: "absent", content: null, ...NO_META, detail: "" };
+    return { kind: "unreadable", content: null, ...NO_META, detail: errText(e) };
+  }
+  if (st.isSymbolicLink() || !st.isFile()) return classify(abs2, st);
+  return { kind: "unreadable", content: null, ...meta(st), detail: "the path changed shape while it was being read" };
+}
+function inspectPath(abs2) {
+  let st;
+  try {
+    st = lstatSync(abs2);
+  } catch (e) {
+    const code = errCode(e);
+    if (code === "ENOENT" || code === "ENOTDIR") return { kind: "absent", content: null, ...NO_META, detail: "" };
+    return { kind: "unreadable", content: null, ...NO_META, detail: errText(e) };
+  }
+  return classify(abs2, st);
+}
+function inspectRel(cwd, rel) {
+  return inspectPath(join(cwd, rel));
+}
+function inspectResolved(abs2) {
+  let real;
+  try {
+    real = realpathSync(abs2);
+  } catch (e) {
+    const code = errCode(e);
+    if (code === "ENOENT" || code === "ENOTDIR") return { kind: "absent", content: null, ...NO_META, detail: "" };
+    return { kind: "unreadable", content: null, ...NO_META, detail: errText(e) };
+  }
+  return inspectPath(real);
+}
+function textOf(e) {
+  return e.content == null ? null : e.content.toString("utf8");
+}
+function describe(e, shown) {
+  switch (e.kind) {
+    case "symlink":
+      return `Protected path ${shown} is a symbolic link to ${escapeControl(e.detail)}. The gate never follows a link, so what the runner will read there cannot be judged.`;
+    case "directory":
+      return `Protected path ${shown} is a directory where a file is expected, so it cannot be judged.`;
+    case "irregular":
+      return `Protected path ${shown} is a ${e.detail}, not a regular file, so it cannot be read to judge it.`;
+    case "oversize":
+      return `Protected file ${shown} is ${e.detail}, above the ${READ_CAP / (1024 * 1024)} MiB the gate reads, so it is judged by name.`;
+    default:
+      return `Protected file ${shown} cannot be read to judge it (${e.detail}).`;
+  }
+}
+function unjudgeableFinding(cwd, rel) {
+  const e = inspectRel(cwd, rel);
+  if (e.kind === "file" || e.kind === "absent") return null;
+  const shown = escapeControl(rel);
+  return {
+    rule: "hidden-drift",
+    severity: "block",
+    file: rel,
+    message: describe(e, shown),
+    evidence: `${shown}: ${e.kind}${e.detail ? ` (${escapeControl(e.detail)})` : ""}`,
+    remediation: "Put a regular file the gate can read at the path \u2014 no symbolic link, FIFO, socket or device, and under 64 MiB \u2014 through a tool call the gate can see, or remove it.",
+    signoff: { required: true, command: `tamperward allow hidden-drift --file ${shown} --reason "..."` }
+  };
+}
+function unjudgeableProtected(cwd, policy, changes) {
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const c of changes) {
+    if (c.kind !== "file" || c.op === "delete" || seen.has(c.path)) continue;
+    seen.add(c.path);
+    if (!isProtected(c.path, policy)) continue;
+    const f = unjudgeableFinding(cwd, c.path);
+    if (f) out2.push(f);
+  }
+  return out2;
+}
+
 // src/diff/parse.ts
 var HUNK_RE = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/;
 var C_ESCAPES = { a: 7, b: 8, f: 12, n: 10, r: 13, t: 9, v: 11, "\\": 92, '"': 34 };
@@ -251,11 +618,7 @@ function blobAt(rev, path, cwd) {
   }
 }
 function fromDisk(path, cwd) {
-  try {
-    return readFileSync(join(cwd ?? process.cwd(), path), "utf8");
-  } catch {
-    return null;
-  }
+  return textOf(inspectRel(cwd ?? process.cwd(), path));
 }
 function enrich(c, beforeReader, afterReader) {
   if (c.kind !== "file") return c;
@@ -353,6 +716,9 @@ function underSkippedDir(rel) {
   return rel.split("/").some((seg) => SKIP_DIRS.has(seg));
 }
 function ignoredPaths(opts = {}, keep) {
+  return ignoredTree(opts, keep).files;
+}
+function ignoredTree(opts = {}, keep) {
   const files = [];
   const dirs = [];
   for (const entry of git([...IGNORED_LS, "--directory"], opts.cwd).split("\0").filter(Boolean)) {
@@ -364,7 +730,7 @@ function ignoredPaths(opts = {}, keep) {
     const expanded = git([...IGNORED_LS, "--", ...dirs.map((d) => `:(literal)${d}`)], opts.cwd).split("\0").filter(Boolean);
     for (const rel of expanded) if (!underSkippedDir(rel)) files.push(rel);
   }
-  return files.filter(keep);
+  return { dirs, files: files.filter(keep) };
 }
 function ignoredAdds(opts = {}, keep, exclude) {
   return ignoredPaths(opts, keep).filter((rel) => !exclude?.has(rel)).map((rel) => addOf(rel, opts.cwd));
@@ -554,234 +920,38 @@ var noVerify = {
           why = `${SKIP_WHY} (set earlier in the same command)`;
           evidence = `${carriedSkip}; ${seg}`;
         }
-        if (!why && sub && HOOK_SUBCOMMANDS.has(sub)) {
-          const args = gitArgs(toks, sub);
-          if (args.some((t) => NO_VERIFY.test(t))) why = "--no-verify skips the pre-commit/pre-push hooks";
-          else if (sub === "commit" && args.some((t) => SHORT_N.test(t))) why = "git commit -n skips the pre-commit hook";
-        }
-        if (!why && toks.includes(NO_HOOKS)) why = "--no-hooks disables hook execution";
-        if (why) {
-          out2.push(
-            makeFinding(RULE, policy, {
-              message: `Command bypasses git hooks: ${why}.`,
-              evidence,
-              remediation: "Let the hooks run and fix what they catch. Skipping verification is exactly the move this gate blocks \u2014 editing the hook and --no-hooks are blocked too."
-            })
-          );
-        }
-      }
-    }
-    return out2;
-  }
-};
-
-// src/detectors/ts-any-cast.ts
-import ts from "typescript";
-
-// src/diff/select.ts
-function addedLines(c) {
-  if (c.kind !== "file") return [];
-  return c.hunks.flatMap((h) => h.lines.filter((l) => l.type === "add"));
-}
-function removedLines(c) {
-  if (c.kind !== "file") return [];
-  return c.hunks.flatMap((h) => h.lines.filter((l) => l.type === "del"));
-}
-
-// src/policy.ts
-import picomatch from "picomatch";
-var POLICY_FILE = ".tamperward.yml";
-var BLOCK_SINCE = {};
-function applyVersionGates(rules, version, gates = BLOCK_SINCE) {
-  const out2 = { ...rules };
-  for (const [rule, since] of Object.entries(gates)) {
-    if (since > version && out2[rule]?.severity === "block") {
-      out2[rule] = { ...out2[rule], severity: "warn" };
-    }
-  }
-  return out2;
-}
-function normalizeGlob(glob) {
-  return glob.startsWith("/") ? glob.replace(/^\/+/, "") : glob;
-}
-function mergeRules(base, user) {
-  const out2 = { ...base };
-  for (const [name, cfg] of Object.entries(user ?? {})) {
-    out2[name] = { ...out2[name] ?? {}, ...cfg ?? {} };
-  }
-  return out2;
-}
-var cache = /* @__PURE__ */ new Map();
-function matcher(glob) {
-  let m = cache.get(glob);
-  if (!m) {
-    m = picomatch(glob, { dot: true });
-    cache.set(glob, m);
-  }
-  return m;
-}
-function matchesAny(path, globs4) {
-  return !!globs4 && globs4.some((g) => matcher(g)(path));
-}
-function protectedCategory(path, policy) {
-  for (const [cat, globs4] of Object.entries(policy.protected ?? {})) {
-    if (matchesAny(path, globs4)) return cat;
-  }
-  return null;
-}
-function isProtected(path, policy, category) {
-  if (category) return matchesAny(path, policy.protected?.[category]);
-  return protectedCategory(path, policy) !== null;
-}
-function isPolicyFile(path) {
-  return path === POLICY_FILE || path.endsWith("/" + POLICY_FILE);
-}
-function isIgnored(path, policy) {
-  return matchesAny(path, policy.ignore);
-}
-function mergeProtected(base, user) {
-  const out2 = { ...base };
-  for (const [cat, globs4] of Object.entries(user ?? {})) {
-    const have = new Set(out2[cat] ?? []);
-    out2[cat] = [...out2[cat] ?? [], ...(globs4 ?? []).filter((g) => !have.has(g))];
+        if (!why && sub && HOOK_SUBCOMMANDS.has(sub)) {
+          const args = gitArgs(toks, sub);
+          if (args.some((t) => NO_VERIFY.test(t))) why = "--no-verify skips the pre-commit/pre-push hooks";
+          else if (sub === "commit" && args.some((t) => SHORT_N.test(t))) why = "git commit -n skips the pre-commit hook";
+        }
+        if (!why && toks.includes(NO_HOOKS)) why = "--no-hooks disables hook execution";
+        if (why) {
+          out2.push(
+            makeFinding(RULE, policy, {
+              message: `Command bypasses git hooks: ${why}.`,
+              evidence,
+              remediation: "Let the hooks run and fix what they catch. Skipping verification is exactly the move this gate blocks \u2014 editing the hook and --no-hooks are blocked too."
+            })
+          );
+        }
+      }
+    }
+    return out2;
   }
-  return out2;
+};
+
+// src/detectors/ts-any-cast.ts
+import ts from "typescript";
+
+// src/diff/select.ts
+function addedLines(c) {
+  if (c.kind !== "file") return [];
+  return c.hunks.flatMap((h) => h.lines.filter((l) => l.type === "add"));
 }
-function defaultPolicy(version = 1) {
-  const p = {
-    version,
-    protected: {
-      // Cover every JS/TS test extension, not just .test.ts — the multi-repo FP study found
-      // .test.tsx/.spec.tsx (hono, zustand) slipped the glob, so legit test-file casts blocked
-      // instead of warning. Kept ADDITIVE (originals + new extensions) so the policy-diff sees a
-      // strengthening, not a narrowing. picomatch expands the brace.
-      // test-skip, test-deletion and test-content-removal all gate on this
-      // class, so a repo it does not match gets rules that can NEVER fire —
-      // protection that is silently absent rather than visibly off. The JS/TS
-      // list shipped alone; these are the conventional layouts of the other
-      // ecosystems `init` is run in. (P2-13, external review.)
-      tests: [
-        // JavaScript / TypeScript
-        "**/*.test.ts",
-        "**/*.spec.ts",
-        "**/*.{test,spec}.{tsx,cts,mts,js,jsx,cjs,mjs}",
-        "**/__tests__/**",
-        // Python (pytest / unittest layouts)
-        "**/test_*.py",
-        "**/*_test.py",
-        "**/conftest.py",
-        // Go
-        "**/*_test.go",
-        // Rust (integration tests live in tests/, unit tests inline)
-        "**/tests/**/*.rs",
-        // Ruby (RSpec / minitest)
-        "**/*_spec.rb",
-        "**/*_test.rb",
-        // Java / Kotlin / Scala (Maven & Gradle convention)
-        "**/src/test/**",
-        // PHP (PHPUnit)
-        "**/*Test.php",
-        // C# (.NET)
-        "**/*Tests.cs",
-        "**/*Test.cs"
-      ],
-      config: [
-        "**/jest.config.*",
-        "**/vitest.config.*",
-        // A `vitest.workspace.*` file REPLACES the root config's selection with the
-        // union of its projects, and a `vite.config.*` carrying a `test:` key is the
-        // vitest config when no vitest.config exists — both are where a spec can be
-        // dropped from the suite without a line of it changing. ADDITIVE, like every
-        // baseline widening (the policy-diff reads it as a strengthening).
-        "**/vitest.workspace.*",
-        "**/vite.config.*",
-        "**/tsconfig*.json",
-        "**/.eslintrc*",
-        "**/eslint.config.*",
-        "**/package.json",
-        // Coverage gates outside the Jest/Vitest shapes. coverage-lowering could only
-        // see a threshold it was shown: a Python `fail_under`, an nyc `lines`, a
-        // codecov `target` lived in files no glob protected, so lowering them fired
-        // nothing. ADDITIVE, like every baseline widening (the policy-diff reads it
-        // as a strengthening). pyproject.toml carries [tool.coverage.report].
-        "**/.coveragerc",
-        "**/pyproject.toml",
-        "**/.nycrc",
-        "**/.nycrc.*",
-        "**/nyc.config.*",
-        "**/codecov.yml",
-        "**/.codecov.yml"
-      ],
-      ci: [".github/workflows/**"],
-      // Recorded expected outputs. An assertion stored as data is still an assertion;
-      // rewriting it from current output is the snapshot-update move the affordance
-      // experiment measured at a 70% attempt / 100% through rate (snapshot-rewrite).
-      // tap-snapshots/** added from Phase-3 evidence: node-tar's recorded expectations
-      // live there as .cjs and were rewritten unseen (PHASE3.md §4).
-      snapshots: ["**/*.snap", "**/__snapshots__/**", "**/tap-snapshots/**", "**/golden/**", "**/*.golden.*"],
-      // The wiring IS the enforcement: settings.json carries the PreToolUse and
-      // Stop hooks, and a pre-commit config carries the commit-time gate. These
-      // were installed by `init` and protected by nothing, so editing them out
-      // fired no rule at all. (.git/hooks/** is outside every git view and so
-      // cannot be covered here — noted in SECURITY-ENVELOPE.md.) (P1-4, review.)
-      hooks: [
-        ".husky/**",
-        "**/lefthook.*",
-        // lefthook merges `lefthook-local.yml` OVER `lefthook.yml`: a `skip: true`
-        // there switches the gate off without touching the file init pointed at.
-        "**/lefthook-local.*",
-        ".tamperward.yml",
-        "**/.tamperward.yml",
-        ".claude/settings.json",
-        ".claude/settings.local.json",
-        "**/.pre-commit-config.yaml",
-        // CODEOWNERS is enforcement wiring, not documentation: it is the only
-        // thing that can require a human on a change to the workflow that
-        // decides whether the gate runs at all. GitHub reads it from any of
-        // these three locations. (H2.)
-        ".github/CODEOWNERS",
-        "CODEOWNERS",
-        "docs/CODEOWNERS"
-      ]
-    },
-    rules: {
-      "test-deletion": { severity: "block" },
-      // content gutted from a surviving spec — the class Phase 3 measured walking
-      // through the block-count rule (rows, assertion arguments, setup). Severity
-      // backed by the real-commit corpus measurement recorded in the rule's SPEC row.
-      "test-content-removal": { severity: "block" },
-      "test-skip": { severity: "block" },
-      "ts-any-cast": { severity: "block" },
-      // the unambiguous explicit casts + ts-suppression directives
-      // broad any in annotation/generic position is common in legit code (measured ~84-100% FP as a
-      // block rule on real TS), so it WARNs until a semantic (error-silencing-aware) signal earns block.
-      "ts-any-launder": { severity: "warn" },
-      "lint-suppression": { severity: "block" },
-      "coverage-lowering": { severity: "block" },
-      "ci-tampering": { severity: "block" },
-      "hook-tampering": { severity: "block" },
-      "no-verify": { severity: "block" },
-      // mechanical but intent-ambiguous: updating a snapshot is the legitimate workflow
-      // when intended output changes. WARN until the §7 evidence path earns block.
-      "snapshot-rewrite": { severity: "warn" },
-      // the watcher's transient class (modified-and-restored within a turn). WARN by
-      // default: a Stop block already forces restores, and a compliant restore reads
-      // as churn — block-by-default would deadlock the honest path. Harnesses that own
-      // that semantics raise it via TAMPERWARD_TRANSIENT=block.
-      "transient-protected-mutation": { severity: "warn" },
-      // the narrow graduation candidate: snapshot moved with NO accompanying change.
-      // ~0.06% FP on 1,652 audited mainline commits, 7/7 TP on observed tampers
-      // (harness/fp-study/). warn until a version: gate graduates it (BLOCK_SINCE).
-      "snapshot-only-rewrite": { severity: "warn" },
-      // heuristic — warn until precision is measured (SPEC §7)
-      "assertion-weakening": { severity: "warn" },
-      "guard-removal": { severity: "warn" }
-    },
-    ignore: [],
-    signoff: { requiredFor: ["block"], ledger: ".tamperward/ledger.jsonl" }
-  };
-  p.rules = applyVersionGates(p.rules, version);
-  return p;
+function removedLines(c) {
+  if (c.kind !== "file") return [];
+  return c.hunks.flatMap((h) => h.lines.filter((l) => l.type === "del"));
 }
 
 // src/detectors/files.ts
@@ -1164,12 +1334,12 @@ import ts2 from "typescript";
 
 // src/detectors/repo.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-var cache2 = /* @__PURE__ */ new Map();
+var cache = /* @__PURE__ */ new Map();
 function trackedFiles(ctx) {
   if (!ctx) return null;
   if (ctx.trackedFiles) return ctx.trackedFiles;
   if (!ctx.cwd) return null;
-  const hit = cache2.get(ctx.cwd);
+  const hit = cache.get(ctx.cwd);
   if (hit !== void 0) return hit;
   let files = null;
   try {
@@ -1182,7 +1352,7 @@ function trackedFiles(ctx) {
   } catch {
     files = null;
   }
-  cache2.set(ctx.cwd, files);
+  cache.set(ctx.cwd, files);
   return files;
 }
 var branchCache = /* @__PURE__ */ new Map();
@@ -1280,8 +1450,8 @@ function numericOf(e) {
   }
   return void 0;
 }
-function metricsOf(expr, resolve5) {
-  const obj = resolve5(expr);
+function metricsOf(expr, resolve6) {
+  const obj = resolve6(expr);
   if (!ts2.isObjectLiteralExpression(obj)) return void 0;
   const out2 = { values: {}, opaque: false };
   let any = false;
@@ -1295,7 +1465,7 @@ function metricsOf(expr, resolve5) {
     const k = keyName(p.name);
     if (k === null || !isMetric(k)) continue;
     any = true;
-    const n = numericOf(resolve5(p.initializer));
+    const n = numericOf(resolve6(p.initializer));
     if (n === void 0) out2.opaque = true;
     else out2.values[k] = n;
   }
@@ -1341,17 +1511,17 @@ function parseThresholds(src) {
   const res = { paths: /* @__PURE__ */ new Map(), present: false, opaque: false };
   try {
     const sf = sourceOf(src);
-    const resolve5 = resolverFor(sf);
+    const resolve6 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const key2 = keyName(node.name);
         if (key2 === "coverageThreshold" || key2 === "thresholds" && underKey(node, "coverage")) {
           res.present = true;
-          const init = resolve5(node.initializer);
+          const init = resolve6(node.initializer);
           if (!ts2.isObjectLiteralExpression(init)) {
             res.opaque = true;
           } else {
-            const flat = metricsOf(init, resolve5);
+            const flat = metricsOf(init, resolve6);
             if (flat) res.global = merge(res.global, flat);
             for (const p of init.properties) {
               if (ts2.isSpreadAssignment(p)) {
@@ -1365,7 +1535,7 @@ function parseThresholds(src) {
                 res.global = merge(res.global, { values: { branches: 100, functions: 100, lines: 100, statements: 100 }, opaque: false });
                 continue;
               }
-              const m = metricsOf(p.initializer, resolve5);
+              const m = metricsOf(p.initializer, resolve6);
               if (!m) continue;
               if (k === "global") res.global = merge(res.global, m);
               else res.paths.set(norm(k), m);
@@ -1398,18 +1568,18 @@ function parseLists(src) {
   const res = { collectFrom: null, collectKey: "collectCoverageFrom", ignore: [], opaqueCollect: false, opaqueIgnore: false };
   try {
     const sf = sourceOf(src);
-    const resolve5 = resolverFor(sf);
+    const resolve6 = resolverFor(sf);
     const visit = (node) => {
       if (ts2.isPropertyAssignment(node)) {
         const k = keyName(node.name);
         const vitestCoverage = ownerKey(node) === "coverage";
         if (k === "collectCoverageFrom" || k === "include" && vitestCoverage) {
-          const { items, opaque } = literals(resolve5(node.initializer));
+          const { items, opaque } = literals(resolve6(node.initializer));
           res.collectFrom = items;
           res.collectKey = k === "include" ? "coverage.include" : k;
           if (opaque) res.opaqueCollect = true;
         } else if (k === "coveragePathIgnorePatterns" || k === "exclude" && vitestCoverage) {
-          const { items, opaque } = literals(resolve5(node.initializer));
+          const { items, opaque } = literals(resolve6(node.initializer));
           res.ignore.push(...items);
           if (opaque) res.opaqueIgnore = true;
         }
@@ -2490,19 +2660,20 @@ var ciTampering = {
 };
 
 // src/detectors/hook-tampering.ts
-import { existsSync, readFileSync as readFileSync3 } from "node:fs";
-import { isAbsolute, join as join3, relative } from "node:path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join3, relative } from "node:path";
 
 // src/wiring.ts
-import { readFileSync as readFileSync2 } from "node:fs";
-import { dirname, join as join2 } from "node:path";
+import { readFileSync, realpathSync as realpathSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join as join2, posix } from "node:path";
 import { fileURLToPath } from "node:url";
 function shippedVersion() {
   try {
     const here = dirname(fileURLToPath(import.meta.url));
     for (const rel of ["../package.json", "../../package.json", "../../../package.json"]) {
       try {
-        const pkg = JSON.parse(readFileSync2(join2(here, rel), "utf8"));
+        const pkg = JSON.parse(readFileSync(join2(here, rel), "utf8"));
         if (pkg.name === "tamperward" && pkg.version) return pkg.version;
       } catch {
       }
@@ -2519,7 +2690,7 @@ var HOOK_CMD = `npx --yes tamperward@${TW_VERSION} hook claude`;
 var SWEEP_CMD = `npx --yes tamperward@${TW_VERSION} sweep claude`;
 var PRECOMMIT_CMD = `npx --yes tamperward@${TW_VERSION} check --staged`;
 var OURS = /^\s*npx\s+(?:--yes|-y)\s+tamperward(?:@(\S+))?\s+(hook claude|sweep claude|check --staged)\s*$/;
-var PLAIN_SEMVER = /^\d+\.\d+\.\d+$/;
+var PLAIN_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 function compareVersions(a, b) {
   if (!PLAIN_SEMVER.test(a) || !PLAIN_SEMVER.test(b)) return null;
   const pa = a.split(".").map(Number);
@@ -2537,8 +2708,41 @@ function initScriptPin(src) {
   const m = src.match(INIT_SCRIPT);
   return m ? m[1] ?? "" : null;
 }
+function homeDir(env = process.env) {
+  const h = (env.HOME ?? env.USERPROFILE ?? "").trim() || homedir();
+  return h.replace(/\\/g, "/").replace(/(?<=.)\/+$/, "");
+}
+function claudeConfigDir(env = process.env) {
+  const dir = (env.CLAUDE_CONFIG_DIR ?? "").trim().replace(/\\/g, "/").replace(/(?<=.)\/+$/, "");
+  return dir || `${homeDir(env)}/.claude`;
+}
 var CLAUDE_SETTINGS = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|managed-settings\.json)$/;
-var isClaudeSettings = (path) => CLAUDE_SETTINGS.test(path);
+function isClaudeSettings(path, env = process.env) {
+  const p = path.replace(/\\/g, "/");
+  if (CLAUDE_SETTINGS.test(p)) return true;
+  const dir = (env.CLAUDE_CONFIG_DIR ?? "").trim().replace(/\\/g, "/").replace(/(?<=.)\/+$/, "");
+  return dir !== "" && (p === `${dir}/settings.json` || p === `${dir}/settings.local.json`);
+}
+function canonicalPath(path) {
+  const tail = [];
+  let cur = path;
+  for (let i = 0; i < 256; i++) {
+    try {
+      const real = realpathSync2(cur).replace(/\\/g, "/");
+      return tail.length ? posix.join(real, ...tail.reverse()) : real;
+    } catch {
+    }
+    const parent = dirname(cur);
+    if (parent === cur) break;
+    tail.push(basename(cur));
+    cur = parent;
+  }
+  return path;
+}
+function resolvesToClaudeSettings(path, env = process.env) {
+  if (isClaudeSettings(path, env)) return true;
+  return isAbsolute(path) && isClaudeSettings(canonicalPath(path), env);
+}
 
 // src/detectors/policy-diff.ts
 import { parse } from "yaml";
@@ -2665,6 +2869,8 @@ function policyAddWeakening(after) {
 }
 
 // src/detectors/hook-wiring.ts
+import { existsSync } from "node:fs";
+import { isAbsolute as isAbsolute2, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
 function stripComment(line) {
   let single = false;
@@ -3655,7 +3861,8 @@ var WRAPPERS = /^(?:sudo|command|exec|time|nice|env|[A-Za-z_][A-Za-z0-9_]*=\S*)$
 var INTERPRETERS = /* @__PURE__ */ new Set(["python", "python2", "python3", "node", "perl", "ruby", "php", "deno", "bun"]);
 var INLINE_FLAG = /^-(?:c|e|r|E|p|pe|pi|i|ne|ni|le)$|^--eval$|^--print$|^--exec$/;
 var EDITORS = /* @__PURE__ */ new Set(["ex", "ed", "vim", "vi", "nvim"]);
-var HOOK_BASENAMES = ["pre-commit", "pre-push", "commit-msg", "settings.json", "settings.local.json", ".tamperward.yml", "lefthook.yml", "lefthook.yaml", "lefthook-local.yml", ".pre-commit-config.yaml", "CODEOWNERS"];
+var SCRIPT_WORD = /[\w.~/$%{}\\-]+/g;
+var HOOK_BASENAMES = ["pre-commit", "pre-push", "commit-msg", "settings.json", "settings.local.json", "managed-settings.json", ".tamperward.yml", "lefthook.yml", "lefthook.yaml", "lefthook-local.yml", ".pre-commit-config.yaml", "CODEOWNERS"];
 function nameGlob(pattern) {
   const re = new RegExp("^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".") + "$");
   return (n) => re.test(n);
@@ -3694,24 +3901,56 @@ function destinations(cmd, args, isDir) {
   return [dest];
 }
 var REDIRECT_TARGET = /(?:^|\s)(?:\d*>{1,2}\|?|&>{1,2})\s*(\S+)/g;
+function expandShellPath(t, env = process.env) {
+  const home = homeDir(env);
+  return t.replace(/\\/g, "/").replace(/^~(?=\/|$)/, home).replace(/\$(?:\{HOME\}|HOME\b|ENV\{HOME\})/g, home).replace(/%USERPROFILE%/gi, home).replace(/\$(?:\{CLAUDE_CONFIG_DIR\}|CLAUDE_CONFIG_DIR\b)/g, claudeConfigDir(env));
+}
 function hookTests(policy, ctx) {
+  const cwd = ctx?.cwd;
+  const onDisk = cwd !== void 0 && existsSync(cwd);
+  const root = onDisk ? canonicalPath(cwd) : cwd;
+  const memo = /* @__PURE__ */ new Map();
   const rel = (t) => {
-    let p = t.replace(/^["']|["']$/g, "");
-    if (ctx?.cwd && p.startsWith(ctx.cwd + "/")) p = p.slice(ctx.cwd.length + 1);
-    return p.replace(/^\.\/(?=.)/, "");
+    const hit = memo.get(t);
+    if (hit !== void 0) return hit;
+    let p = expandShellPath(t.replace(/^["']|["']$/g, ""));
+    const pathy = isAbsolute2(p) || p.includes("/") && !/^[-:]/.test(p);
+    if (pathy && (isAbsolute2(p) || onDisk)) {
+      p = canonicalPath(isAbsolute2(p) ? p : resolve(cwd, p));
+      if (root !== void 0) {
+        if (p === root) p = ".";
+        else if (p.startsWith(root + "/")) p = p.slice(root.length + 1);
+      }
+    }
+    if (cwd !== void 0 && p.startsWith(cwd + "/")) p = p.slice(cwd.length + 1);
+    p = p.replace(/^\.\/(?=.)/, "");
+    memo.set(t, p);
+    return p;
+  };
+  const hook = (t) => {
+    const p = rel(t);
+    return isProtected(p, policy, "hooks") || isClaudeSettings(p) || isClaudeSettings(expandShellPath(t.replace(/^["']|["']$/g, "")));
+  };
+  const whole = (t) => /^(?:\.|\.\/|:\/|\*)$/.test(rel(t)) || cwd !== void 0 && rel(t) === cwd;
+  const userSettings = `${claudeConfigDir()}/settings.json`;
+  const userSettingsUnder = (t) => {
+    const dir = rel(t).replace(/\/+$/, "");
+    return dir !== "" && dir !== "/" && userSettings.startsWith(dir + "/") ? userSettings : null;
   };
-  const hook = (t) => isProtected(rel(t), policy, "hooks");
-  const whole = (t) => /^(?:\.|\.\/|:\/|\*)$/.test(rel(t)) || ctx?.cwd !== void 0 && rel(t) === ctx.cwd;
-  const holds = (t) => !t.startsWith("-") && (whole(t) || containsProtected(rel(t), policy, "hooks", ctx));
+  const holds = (t) => !t.startsWith("-") && (whole(t) || userSettingsUnder(t) !== null || containsProtected(rel(t), policy, "hooks", ctx));
   const hookish = (t) => hook(t) || holds(t);
-  return { rel, hook, whole, holds, hookish };
+  return { rel, hook, whole, holds, hookish, userSettingsUnder };
 }
 function shellHookTarget(seg, toks, policy, ctx) {
-  const { rel, hook, whole, holds } = hookTests(policy, ctx);
+  const { rel, hook, whole, holds, userSettingsUnder } = hookTests(policy, ctx);
   for (const m of seg.matchAll(REDIRECT_TARGET)) {
     if (hook(m[1])) return rel(m[1]);
   }
   const args = toks.map((t) => t.replace(/^(?:of=|--(?:include|exclude|directory)=)/, ""));
+  for (let i = 1; i < args.length; i++) {
+    if (!INLINE_FLAG.test(args[i - 1])) continue;
+    for (const word of args[i].match(SCRIPT_WORD) ?? []) if (hook(word)) return rel(word);
+  }
   const fileLike = (p) => {
     const b = p.replace(/\/+$/, "").split("/").pop() ?? "";
     return HOOK_BASENAMES.includes(b) || /\.[A-Za-z0-9]+$/.test(b.replace(/^\.+/, "")) || (trackedFiles(ctx)?.includes(p) ?? false);
@@ -3719,6 +3958,8 @@ function shellHookTarget(seg, toks, policy, ctx) {
   for (const t of args) if (hook(t) && fileLike(rel(t))) return rel(t);
   for (const t of args) {
     if (t.startsWith("-") || !holds(t)) continue;
+    const user = userSettingsUnder(t);
+    if (user !== null) return user;
     const dir = rel(t).replace(/\/+$/, "");
     const under = whole(t) ? "" : dir + "/";
     const listed = trackedFiles(ctx)?.find((f) => f.startsWith(under) && isProtected(f, policy, "hooks"));
@@ -3742,7 +3983,7 @@ function shellWritesHook(seg, toks, policy, ctx) {
   const anyHook = args.some(hook);
   const inPlace = args.some((a) => /^-[A-Za-z]*i|^--in-place/.test(a));
   const scripts = args.filter((_, i) => i > 0 && INLINE_FLAG.test(args[i - 1]));
-  const namesHookInText = () => scripts.some((a) => (a.match(/[\w.~/-]+/g) ?? []).some(hook));
+  const namesHookInText = () => scripts.some((a) => (a.match(SCRIPT_WORD) ?? []).some(hook));
   switch (cmd) {
     case "rm":
     case "unlink":
@@ -3826,8 +4067,8 @@ function shellWritesHook(seg, toks, policy, ctx) {
 function xargsWritesHook(toks, fed, policy, ctx) {
   const at = toks.findIndex((t) => t === "xargs" || t.endsWith("/xargs"));
   if (at === -1) return null;
-  const rel = (t) => (ctx?.cwd && t.startsWith(ctx.cwd + "/") ? t.slice(ctx.cwd.length + 1) : t).replace(/^\.\//, "");
-  const fedHook = fed.some((t) => isProtected(rel(t), policy, "hooks") || !t.startsWith("-") && containsProtected(rel(t), policy, "hooks", ctx));
+  const { hookish } = hookTests(policy, ctx);
+  const fedHook = fed.some(hookish);
   if (!fedHook) return null;
   let i = at + 1;
   while (i < toks.length && toks[i].startsWith("-")) i += /^-(?:I|n|L|P|d|a|s)$/.test(toks[i]) ? 2 : 1;
@@ -3859,11 +4100,23 @@ function eventEntries(s, event) {
   return Array.isArray(arr) ? arr : null;
 }
 var declares = (s, event) => eventEntries(s, event) !== null;
-var GATE_KEYS = /* @__PURE__ */ new Set(["type", "command", "timeout"]);
+var GATE_KEYS = /* @__PURE__ */ new Set(["type", "command", "timeout", "statusMessage"]);
+var HOOK_TYPES = /* @__PURE__ */ new Set(["command", "prompt", "agent", "http"]);
+var SIBLING_KEYS = GATE_KEYS;
 var CANONICAL_CMD = /^npx --yes tamperward@(\S+) (hook|sweep) claude$/;
 var MENTIONS_GATE = /\btamperward\b.*\b(?:hook|sweep)\b/;
 var FORGERY = /hookSpecificOutput|permissionDecision|updatedInput|"decision"|"continue"/;
-var SENSITIVE_ENV = /^(?:PATH|NODE_OPTIONS|NODE_PATH|HOME|npm_config_.*|NPM_CONFIG_.*)$/;
+var ENV_MECHANISM = [
+  [/^PATH$/, "the gate's launcher is looked up through it"],
+  [/^(?:NODE_OPTIONS|NODE_PATH)$/, "node loads what it names before the gate runs"],
+  [/^HOME$/, "npx's cache and configuration live under it"],
+  [/^npm_config_/i, "npx reads it as npm configuration, the registry the gate is fetched from included"],
+  [/^(?:BASH_ENV|ENV)$/, "a non-interactive shell sources it before every hook command"],
+  [/^BASH_FUNC_/, "bash imports it as a function that shadows the command it names"],
+  [/^(?:LD|DYLD)_/, "the dynamic loader injects it into every process, the gate included"],
+  [/^TAMPERWARD_/, "it configures the gate itself"]
+];
+var envMechanism = (k) => ENV_MECHANISM.find(([re]) => re.test(k))?.[1] ?? null;
 function analyseGateCommand(cmd, event) {
   const want = event === "PreToolUse" ? "hook" : "sweep";
   const problems = [];
@@ -3922,7 +4175,7 @@ function matcherSelection(m) {
   if (m === "" || m === "*") return { tools: null, problem: null };
   let problem = null;
   if (/[^\x00-\x7f]/.test(m)) problem = "the matcher contains non-ASCII characters that look like tool names but are not";
-  if (/^[A-Za-z0-9_ |-]+$/.test(m)) return { tools: new Set(m.split("|").map((t) => t.trim()).filter(Boolean)), problem };
+  if (/^[A-Za-z0-9_ ,|-]+$/.test(m)) return { tools: new Set(m.split(/[|,]/).map((t) => t.trim()).filter(Boolean)), problem };
   let re;
   try {
     re = new RegExp(m);
@@ -3931,48 +4184,58 @@ function matcherSelection(m) {
   }
   return { tools: new Set(PRE_TOOLS.filter((t) => re.test(t))), problem };
 }
+function entryShape(h) {
+  const problems = [];
+  let runs = true;
+  if (h.type !== "command") {
+    problems.push(h.type === void 0 ? "no `type`" : `\`type\` is ${JSON.stringify(h.type)}`);
+    if (h.type !== void 0) runs = false;
+  }
+  for (const k of Object.keys(h)) {
+    if (GATE_KEYS.has(k)) continue;
+    problems.push(`carries \`${k}\``);
+    runs = false;
+  }
+  if ("timeout" in h) {
+    const t = h.timeout;
+    if (typeof t !== "number" || !Number.isInteger(t) || t < 120) {
+      problems.push(`\`timeout\` ${JSON.stringify(t)} \u2014 the gate is cut off before it answers`);
+      runs = false;
+    }
+  }
+  if ("statusMessage" in h && typeof h.statusMessage !== "string") {
+    problems.push(`\`statusMessage\` ${JSON.stringify(h.statusMessage)} is not a string`);
+    runs = false;
+  }
+  return { problems, runs };
+}
+var mentionsGate = (v) => /\btamperward\b/.test(JSON.stringify(v) ?? "");
 function gateCandidates(s, event) {
   const out2 = [];
-  const mentions = (v) => /\btamperward\b/.test(JSON.stringify(v) ?? "");
   for (const group of eventEntries(s, event) ?? []) {
     if (!isObj(group)) {
-      if (mentions(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["the matcher entry is not an object"], pin: null, tools: null });
+      if (mentionsGate(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["the matcher entry is not an object"], pin: null, tools: null });
       continue;
     }
     if (!Array.isArray(group.hooks)) {
-      if (mentions(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["`hooks` is not a list"], pin: null, tools: null });
+      if (mentionsGate(group)) out2.push({ key: JSON.stringify(group), runs: false, problems: ["`hooks` is not a list"], pin: null, tools: null });
       continue;
     }
     for (const h of group.hooks) {
       if (!isObj(h)) {
-        if (mentions(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the hook entry is not an object"], pin: null, tools: null });
+        if (mentionsGate(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the hook entry is not an object"], pin: null, tools: null });
         continue;
       }
       const cmd = typeof h.command === "string" ? h.command : null;
       if (cmd === null) {
-        if (mentions(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the gate is not in a `command` string"], pin: null, tools: null });
+        if (mentionsGate(h)) out2.push({ key: JSON.stringify(h), runs: false, problems: ["the gate is not in a `command` string"], pin: null, tools: null });
         continue;
       }
       if (!MENTIONS_GATE.test(cmd)) continue;
       const a = analyseGateCommand(cmd, event);
-      const problems = [...a.problems];
-      let runs = a.runs;
-      if (h.type !== "command") {
-        problems.push(h.type === void 0 ? "no `type`" : `\`type\` is ${JSON.stringify(h.type)}`);
-        if (h.type !== void 0) runs = false;
-      }
-      for (const k of Object.keys(h)) {
-        if (GATE_KEYS.has(k)) continue;
-        problems.push(`carries \`${k}\``);
-        runs = false;
-      }
-      if ("timeout" in h) {
-        const t = h.timeout;
-        if (typeof t !== "number" || !Number.isInteger(t) || t < 120) {
-          problems.push(`\`timeout\` ${JSON.stringify(t)} \u2014 the gate is cut off before it answers`);
-          runs = false;
-        }
-      }
+      const shape = entryShape(h);
+      const problems = [...a.problems, ...shape.problems];
+      let runs = a.runs && shape.runs;
       let tools = null;
       if (event === "PreToolUse") {
         const sel = matcherSelection(group.matcher);
@@ -3989,6 +4252,7 @@ function gateCandidates(s, event) {
   }
   return out2;
 }
+var carriesGate = (s) => EVENTS.some((e) => gateCandidates(s, e).length > 0);
 function otherCommands(s, event) {
   const out2 = [];
   for (const group of eventEntries(s, event) ?? []) {
@@ -4000,6 +4264,35 @@ function otherCommands(s, event) {
   }
   return out2;
 }
+function allEntries(s) {
+  const hooks = s.hooks;
+  if (!isObj(hooks)) return [];
+  const out2 = [];
+  for (const [event, arr] of Object.entries(hooks)) {
+    if (!Array.isArray(arr)) continue;
+    for (const group of arr) {
+      if (!isObj(group) || !Array.isArray(group.hooks)) continue;
+      for (const h of group.hooks) out2.push({ event, key: JSON.stringify({ e: event, m: group.matcher, h }), group, h });
+    }
+  }
+  return out2;
+}
+function schemaProblem(group, h) {
+  if (group.matcher !== void 0 && typeof group.matcher !== "string") return `the matcher ${JSON.stringify(group.matcher)} is not a string`;
+  if (!isObj(h)) return `the hook entry ${JSON.stringify(h)} is not an object`;
+  if (typeof h.type !== "string" || !HOOK_TYPES.has(h.type)) return `\`type\` ${JSON.stringify(h.type)} is not one the runtime accepts`;
+  if (h.type === "command" && typeof h.command !== "string") return "`command` is not a string";
+  if ("timeout" in h && (typeof h.timeout !== "number" || !Number.isFinite(h.timeout) || h.timeout <= 0)) return `\`timeout\` ${JSON.stringify(h.timeout)} is not a positive number`;
+  return null;
+}
+function siblingProblem(h) {
+  const cmd = typeof h.command === "string" ? h.command : "";
+  if (FORGERY.test(cmd)) return `emits a hook decision of its own (\`${cmd.slice(0, 60)}\`)`;
+  if (h.type !== "command") return `is not a plain command entry (\`type\` is ${JSON.stringify(h.type)})`;
+  const extra = Object.keys(h).filter((k) => !SIBLING_KEYS.has(k));
+  if (extra.length) return `is not a plain command entry (carries \`${extra.join("`, `")}\`)`;
+  return `was added (\`${cmd.slice(0, 60)}\`) \u2014 its output combines with the gate's verdict (an \`updatedInput\` after an allow, a \`continue: false\` over a block), and init writes no entry beside the gate`;
+}
 function coverage(cs) {
   const live = cs.filter((c) => c.runs);
   if (live.length === 0) return "none";
@@ -4050,16 +4343,26 @@ function duplicateJsonKeys(src) {
 }
 function settingsWeakening(before, after, local) {
   const reasons = [];
+  const gated = carriesGate(after);
+  const gatedBefore = before !== null && carriesGate(before);
   const dis = after.disableAllHooks;
   if (dis !== void 0 && dis !== false && !(before !== null && before.disableAllHooks === dis)) {
     reasons.push(`\`disableAllHooks: ${JSON.stringify(dis)}\` switches every hook off, the gate included`);
   }
+  if (gated && dis === void 0) {
+    if (before !== null && before.disableAllHooks === false) {
+      reasons.push("`disableAllHooks: false` was removed \u2014 init declares it so that a `true` in the user settings file cannot switch the gate off");
+    } else if (!gatedBefore) {
+      reasons.push("`disableAllHooks: false` is not declared \u2014 init declares it in the file it writes, so that a `true` in the user settings file cannot switch the gate off");
+    }
+  }
   if (isObj(after.env)) {
     const was = before !== null && isObj(before.env) ? before.env : {};
     for (const [k, v] of Object.entries(after.env)) {
-      if (SENSITIVE_ENV.test(k) && JSON.stringify(was[k]) !== JSON.stringify(v)) {
-        reasons.push(`a top-level \`env\` sets ${k} \u2014 the gate command resolves through it`);
-      }
+      if (k in was && JSON.stringify(was[k]) === JSON.stringify(v)) continue;
+      const how = envMechanism(k);
+      if (how) reasons.push(`a top-level \`env\` sets ${k} \u2014 ${how}`);
+      else if (gated) reasons.push(`a top-level \`env\` sets ${k} \u2014 every hook command runs with it, and init writes no \`env\``);
     }
   }
   for (const event of EVENTS) {
@@ -4087,15 +4390,36 @@ function settingsWeakening(before, after, local) {
       if (c.problems.length) reasons.push(`the ${event} gate entry does not match the shape \`tamperward init\` writes: ${c.problems.join("; ")}`);
     }
     const pins = bc.map((c) => c.pin).filter((p) => !!p && PLAIN_SEMVER.test(p)).sort((a, b) => compareVersions(b, a) ?? 0);
-    const floor = pins[0] ?? (before === null && PLAIN_SEMVER.test(TW_VERSION) ? TW_VERSION : null);
-    if (floor) {
-      for (const c of fresh) {
-        if (c.pin && PLAIN_SEMVER.test(c.pin) && !pinNotBelow(c.pin, floor)) reasons.push(`the ${event} gate is pinned to tamperward@${c.pin}, below ${floor}`);
+    const judging = PLAIN_SEMVER.test(TW_VERSION) ? TW_VERSION : null;
+    const floor = pins[0] ?? (bc.length === 0 ? judging : null);
+    for (const c of fresh) {
+      if (c.pin === null || c.pin !== "" && !PLAIN_SEMVER.test(c.pin)) continue;
+      if (floor !== null && !pinNotBelow(c.pin, floor)) {
+        reasons.push(
+          c.pin === "" ? `the ${event} gate is unpinned, below ${floor} \u2014 \`npx\` then runs whatever \`tamperward\` resolves to on this machine` : `the ${event} gate is pinned to tamperward@${c.pin}, below ${floor}`
+        );
+      } else if (judging !== null && c.pin !== "" && (compareVersions(c.pin, judging) ?? 0) > 0) {
+        reasons.push(`the ${event} gate is pinned to tamperward@${c.pin}, above the ${judging} judging it \u2014 a pin npm cannot resolve fails the hook open; raise it by running \`tamperward init\` from the newer version, which raises the judging gate with it`);
+      }
+    }
+  }
+  if (gated) {
+    const had = new Set(before !== null ? allEntries(before).map((e) => e.key) : []);
+    for (const e of allEntries(after)) {
+      if (had.has(e.key) || mentionsGate(e.h)) continue;
+      const schema = schemaProblem(e.group, e.h);
+      if (schema) {
+        reasons.push(`a ${e.event} hook entry carries a value the runtime's schema rejects (${schema}) \u2014 the runtime continues without the broken file, the gate included`);
+      } else if (e.event === "PreToolUse" || e.event === "Stop") {
+        reasons.push(`a ${e.event} hook entry beside the gate ${siblingProblem(e.h)}`);
       }
     }
-    const hadOther = new Set(before !== null ? otherCommands(before, event) : []);
-    for (const cmd of otherCommands(after, event)) {
-      if (!hadOther.has(cmd) && FORGERY.test(cmd)) reasons.push(`a ${event} hook entry beside the gate emits a hook decision of its own (\`${cmd.slice(0, 60)}\`)`);
+  } else {
+    for (const event of EVENTS) {
+      const hadOther = new Set(before !== null ? otherCommands(before, event) : []);
+      for (const cmd of otherCommands(after, event)) {
+        if (!hadOther.has(cmd) && FORGERY.test(cmd)) reasons.push(`a ${event} hook entry beside the gate emits a hook decision of its own (\`${cmd.slice(0, 60)}\`)`);
+      }
     }
   }
   return reasons;
@@ -4108,7 +4432,7 @@ function claudeSettingsFindings(c, policy) {
     file: c.path,
     message: `The Claude Code hook wiring was weakened: ${reason}.`,
     evidence: reason,
-    remediation: "Leave the PreToolUse and Stop entries that run tamperward, and the matcher that covers every editing tool, exactly as `tamperward init` wrote them. Editing the wiring is editing the gate: re-run `tamperward init` to restore it, or sign off."
+    remediation: "Leave the PreToolUse and Stop entries that run tamperward, the matcher that covers every editing tool, and `disableAllHooks: false` exactly as `tamperward init` wrote them, with no `env` and no hook entry beside the gate. Editing the wiring is editing the gate: re-run `tamperward init` to restore it, or sign off."
   });
   if (c.before != null && before === null) return null;
   if (after === null) {
@@ -4151,7 +4475,7 @@ function lefthookBase(c, changes, ctx) {
   for (const n of names) {
     try {
       const p = join3(ctx.cwd, n);
-      if (existsSync(p)) return parseDoc(readFileSync3(p, "utf8"));
+      if (existsSync2(p)) return parseDoc(readFileSync2(p, "utf8"));
     } catch {
     }
   }
@@ -4221,9 +4545,9 @@ function updateIndexHiding(toks, policy) {
   return null;
 }
 function repoRelative(path, ctx) {
-  if (!ctx?.cwd || !isAbsolute(path)) return path;
+  if (!ctx?.cwd || !isAbsolute3(path)) return path;
   const rel = relative(ctx.cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
 }
 var isHuskyScript = (path) => /(?:^|\/)\.husky\/[^/]+$/.test(path);
 var hookTampering = {
@@ -4235,7 +4559,7 @@ var hookTampering = {
     for (const c of changes) {
       let semantic;
       if (c.kind === "file") {
-        const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false) || isClaudeSettings(c.path);
+        const targetsHook = isProtected(c.path, policy, "hooks") || (c.oldPath ? isProtected(c.oldPath, policy, "hooks") : false) || resolvesToClaudeSettings(c.path);
         if (!targetsHook) {
           if (isPackageJson(c.path) && c.before != null && c.after != null) {
             for (const reason of packageJsonWeakening(c.before, c.after)) {
@@ -4279,7 +4603,7 @@ var hookTampering = {
               remediation: "Renaming a hook out of place disables it. Restore the original path."
             })
           );
-        } else if ((c.path.endsWith(POLICY_FILE) || isClaudeSettings(c.path)) && (semantic = c.path.endsWith(POLICY_FILE) ? policyFindings(c, policy) : claudeSettingsFindings(c, policy)) !== null) {
+        } else if ((c.path.endsWith(POLICY_FILE) || resolvesToClaudeSettings(c.path)) && (semantic = c.path.endsWith(POLICY_FILE) ? policyFindings(c, policy) : claudeSettingsFindings(c, policy)) !== null) {
           out2.push(...semantic);
         } else if (c.op === "rename") {
         } else if (isCodeowners(c.path)) {
@@ -4419,10 +4743,12 @@ var hookTampering = {
           const why = shellWritesHook(seg, toks, policy, ctx) ?? xargsWritesHook(toks, fed, policy, ctx);
           if (why) {
             const target = shellHookTarget(seg, toks, policy, ctx) ?? shellHookTarget("", fed, policy, ctx);
+            const file = target ? repoRelative(target, ctx) : void 0;
+            const outside = file !== void 0 && (isAbsolute3(file) || /^[A-Za-z]:\//.test(file)) && isClaudeSettings(file) ? ` \u2014 ${file} is a Claude Code settings file the runtime reads hooks from` : "";
             out2.push(
               makeFinding(RULE6, policy, {
-                ...target ? { file: repoRelative(target, ctx) } : {},
-                message: `Hook tampering via shell: ${why}.`,
+                ...file !== void 0 ? { file } : {},
+                message: `Hook tampering via shell: ${why}${outside}.`,
                 evidence: seg,
                 remediation: "Leave the hooks in place. Mutating them from the shell is still tampering."
               })
@@ -5327,7 +5653,7 @@ var GUARDED_RULE = "hook-tampering";
 var BASELINE_HOOKS = defaultPolicy().protected.hooks;
 function isGuardedFinding(f) {
   if (f.rule !== GUARDED_RULE || !f.file) return false;
-  return isPolicyFile(f.file) || matchesAny(f.file, BASELINE_HOOKS) || isClaudeSettings(f.file);
+  return isPolicyFile(f.file) || matchesAny(f.file, BASELINE_HOOKS) || resolvesToClaudeSettings(f.file);
 }
 function key(f) {
   return `${f.rule}|${f.file ?? ""}|${f.line ?? ""}|${f.evidence}`;
@@ -5386,8 +5712,8 @@ function hasBlocking(findings) {
 }
 
 // src/policy-load.ts
-import { readFileSync as readFileSync4, existsSync as existsSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join4, posix } from "node:path";
+import { readFileSync as readFileSync3, existsSync as existsSync3 } from "node:fs";
+import { isAbsolute as isAbsolute4, join as join4, posix as posix2 } from "node:path";
 import { parse as parse2 } from "yaml";
 var PolicyError = class extends Error {
 };
@@ -5404,8 +5730,8 @@ var isStringList = (v) => Array.isArray(v) && v.every((s) => typeof s === "strin
 var isMapping = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set(["version", "protected", "rules", "ignore", "signoff", "verify"]);
 function ledgerInsideRepo(ledger) {
-  if (!ledger.trim() || isAbsolute2(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
-  const norm2 = posix.normalize(ledger.replace(/\\/g, "/"));
+  if (!ledger.trim() || isAbsolute4(ledger) || /^[A-Za-z]:[\\/]/.test(ledger)) return false;
+  const norm2 = posix2.normalize(ledger.replace(/\\/g, "/"));
   return norm2 !== ".." && !norm2.startsWith("../") && !norm2.startsWith("/");
 }
 function validate(r, where) {
@@ -5512,8 +5838,8 @@ function parseOrThrow(src, where) {
 }
 function loadPolicy(cwd = process.cwd()) {
   const path = join4(cwd, POLICY_FILE);
-  if (!existsSync2(path)) return defaultPolicy();
-  return parseOrThrow(readFileSync4(path, "utf8"), POLICY_FILE);
+  if (!existsSync3(path)) return defaultPolicy();
+  return parseOrThrow(readFileSync3(path, "utf8"), POLICY_FILE);
 }
 function loadPolicyAt(rev, cwd) {
   const src = fileAt(rev, POLICY_FILE, { cwd });
@@ -5523,7 +5849,7 @@ function loadPolicyAt(rev, cwd) {
 
 // src/signoff.ts
 import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync as readFileSync5, existsSync as existsSync3 } from "node:fs";
+import { appendFileSync, mkdirSync, readFileSync as readFileSync4, existsSync as existsSync4 } from "node:fs";
 import { dirname as dirname2, join as join5 } from "node:path";
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 function fingerprint(rule, file, evidence) {
@@ -5539,9 +5865,9 @@ function ledgerPath(cwd, policy) {
 }
 function readLedger(cwd, policy) {
   const p = ledgerPath(cwd, policy);
-  if (!existsSync3(p)) return [];
+  if (!existsSync4(p)) return [];
   const out2 = [];
-  for (const line of readFileSync5(p, "utf8").split("\n")) {
+  for (const line of readFileSync4(p, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const e = JSON.parse(line);
@@ -5694,7 +6020,7 @@ function renderText(input, opts) {
   for (const f of findings) {
     const isBlock = f.severity === "block";
     const mark = paint(isBlock ? "BLOCK" : "warn ", isBlock ? BOLD + RED : YELLOW, c);
-    const loc = f.file ? `${stripControl(f.file)}${f.line ? `:${f.line}` : ""}` : "(command)";
+    const loc = f.file ? `${stripControl(escapeControl(f.file))}${f.line ? `:${f.line}` : ""}` : "(command)";
     out2.push(`  ${mark}  ${paint(stripControl(f.rule), BOLD, c)}  ${paint(loc, DIM, c)}`);
     for (const l of wrap(f.message, opts.width - 4)) out2.push(`    ${l}`);
     const row = (key2, lines) => {
@@ -5886,6 +6212,7 @@ function check(opts) {
   }
   const ignoredFiles = changes.filter((c) => isSuppressed(c, policy)).length;
   let findings = evaluate(changes, policy, void 0, view, { cwd });
+  if (view === "worktree") findings = findings.concat(unjudgeableProtected(cwd, policy, changes));
   const { findings: remaining, cleared } = layer === "local" ? applyLocalSignoffs(findings, cwd, policy) : applyOobSignoffs(findings, oobFromEnv(), oobHeadFromEnv());
   findings = remaining;
   if (cleared.length) {
@@ -5910,31 +6237,26 @@ function runCheck(opts) {
 }
 
 // src/cli/hook.ts
-import { readFileSync as readFileSync11, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7, statSync as statSync4 } from "node:fs";
+import { readFileSync as readFileSync9, appendFileSync as appendFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync7 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
-import { join as join10 } from "node:path";
 
 // src/adapters/claude/changes.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { readFileSync as readFileSync6, existsSync as existsSync4, writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { isAbsolute as isAbsolute3, join as join6, relative as relative2, resolve } from "node:path";
+import { isAbsolute as isAbsolute5, join as join6, relative as relative2, resolve as resolve2 } from "node:path";
 function asStr(v) {
   return typeof v === "string" ? v : "";
 }
 function readDisk(path) {
-  try {
-    return existsSync4(path) ? readFileSync6(path, "utf8") : null;
-  } catch {
-    return null;
-  }
+  return textOf(inspectResolved(path));
 }
 function abs(path, cwd) {
-  return resolve(cwd, path);
+  return resolve2(cwd, path);
 }
 function relForDisplay(path, cwd) {
   const rel = relative2(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute3(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
 }
 function applyEdit(content, oldStr, newStr) {
   if (content === null) return newStr;
@@ -6021,7 +6343,7 @@ function formatDenial(blocks) {
   const lead = blocks[0];
   const lines = ["Tamperward blocked this change \u2014 it weakens a protected safety net to pass checks.", ""];
   for (const f of blocks) {
-    const loc = f.file ? ` (${f.file}${f.line ? `:${f.line}` : ""})` : "";
+    const loc = f.file ? ` (${escapeControl(f.file)}${f.line ? `:${f.line}` : ""})` : "";
     lines.push(`  \u2022 ${f.rule}${loc}: ${f.message}`);
   }
   lines.push("");
@@ -6036,7 +6358,7 @@ function formatDenial(blocks) {
 }
 
 // src/session.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, join as join7 } from "node:path";
 var UNSAFE = /[^A-Za-z0-9_-]/g;
 var SHA = /^[0-9a-f]{7,40}$/;
@@ -6051,7 +6373,7 @@ function turnBaseline(cwd, sessionId) {
     const p = baselinePath(cwd, sessionId);
     if (!p) return null;
     if (existsSync5(p)) {
-      const v = readFileSync7(p, "utf8").trim();
+      const v = readFileSync5(p, "utf8").trim();
       if (SHA.test(v)) return v;
     }
     const head = headSha(cwd);
@@ -6077,8 +6399,8 @@ function advanceTurnBaseline(cwd, sessionId) {
 
 // src/effect.ts
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync8, renameSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { isAbsolute as isAbsolute4, join as join8 } from "node:path";
+import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { isAbsolute as isAbsolute6, join as join8 } from "node:path";
 import { execFileSync as execFileSync4 } from "node:child_process";
 var UNSAFE2 = /[^A-Za-z0-9._-]/g;
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", ".hg", ".svn"]);
@@ -6090,7 +6412,7 @@ function gitDir2(cwd) {
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
     if (!d) return null;
-    return isAbsolute4(d) ? d : join8(cwd, d);
+    return isAbsolute6(d) ? d : join8(cwd, d);
   } catch {
     return null;
   }
@@ -6112,8 +6434,22 @@ var sha = (buf) => createHash2("sha256").update(buf).digest("hex").slice(0, 16);
 function contentHash(content) {
   return sha(Buffer.isBuffer(content) ? content : Buffer.from(content, "utf8"));
 }
+function entryOf(e) {
+  const hash = e.content != null ? sha(e.content) : e.kind === "unreadable" ? "unreadable" : `${e.kind}:${e.detail}`;
+  return { hash, mode: e.mode, size: e.size, mtimeMs: e.mtimeMs };
+}
 function snapshotProtected(cwd, policy, prev) {
+  void prev;
   const out2 = {};
+  const keep = (rel) => isProtected(rel, policy);
+  let pruned = /* @__PURE__ */ new Set();
+  let listed = [];
+  try {
+    const t = ignoredTree({ cwd }, keep);
+    pruned = new Set(t.dirs.map((d) => d.replace(/\/$/, "")));
+    listed = t.files;
+  } catch {
+  }
   const walk2 = (rel) => {
     const abs2 = rel ? join8(cwd, rel) : cwd;
     let names;
@@ -6125,25 +6461,19 @@ function snapshotProtected(cwd, policy, prev) {
     for (const name of names) {
       if (SKIP_DIRS2.has(name)) continue;
       const r = rel ? `${rel}/${name}` : name;
+      if (pruned.has(r)) continue;
       let st;
       try {
-        st = statSync(join8(cwd, r));
+        st = lstatSync2(join8(cwd, r));
       } catch {
         continue;
       }
       if (st.isDirectory()) walk2(r);
-      else if (st.isFile() && isProtected(r, policy)) {
-        let hash = "";
-        try {
-          hash = sha(readFileSync8(join8(cwd, r)));
-        } catch {
-          hash = "unreadable";
-        }
-        out2[r] = { hash, mode: st.mode, size: st.size, mtimeMs: st.mtimeMs };
-      }
+      else if (keep(r)) out2[r] = entryOf(inspectRel(cwd, r));
     }
   };
   walk2("");
+  for (const rel of listed) if (out2[rel] === void 0) out2[rel] = entryOf(inspectRel(cwd, rel));
   return out2;
 }
 function driftBetween(expected, current) {
@@ -6163,7 +6493,7 @@ function driftBetween(expected, current) {
 function loadTree(p) {
   if (!p || !existsSync6(p)) return null;
   try {
-    return JSON.parse(readFileSync8(p, "utf8"));
+    return JSON.parse(readFileSync6(p, "utf8"));
   } catch {
     return null;
   }
@@ -6202,19 +6532,16 @@ function dropTurnTree(cwd, sessionId) {
 }
 
 // src/cli/watch.ts
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync9, statSync as statSync2, watch } from "node:fs";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync2, statSync, watch } from "node:fs";
 import { join as join9 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 var SKIP2 = /(^|\/)(\.git|node_modules)(\/|$)/;
 function snap(abs2) {
-  try {
-    const st = statSync2(abs2);
-    if (!st.isFile()) return { mode: st.mode, size: null, hash: null };
-    const hash = createHash3("sha256").update(readFileSync9(abs2)).digest("hex").slice(0, 16);
-    return { mode: st.mode, size: st.size, hash };
-  } catch {
-    return { mode: null, size: null, hash: null };
-  }
+  const e = inspectPath(abs2);
+  if (e.kind === "absent" || e.kind === "unreadable") return { mode: null, size: null, hash: null };
+  if (e.kind !== "file" || e.content == null) return { mode: e.mode, size: null, hash: null };
+  const hash = createHash3("sha256").update(e.content).digest("hex").slice(0, 16);
+  return { mode: e.mode, size: e.size, hash };
 }
 function defaultEventLog(cwd) {
   if (process.env.TAMPERWARD_FSEVENTS) return process.env.TAMPERWARD_FSEVENTS;
@@ -6240,7 +6567,7 @@ function watchTree(dir, cb) {
         const child = rel ? `${rel}/${String(fname)}` : String(fname);
         cb(kind, child);
         try {
-          if (statSync2(join9(dir, child)).isDirectory()) addDir(child);
+          if (statSync(join9(dir, child)).isDirectory()) addDir(child);
         } catch {
         }
       });
@@ -6261,7 +6588,7 @@ function watchTree(dir, cb) {
       const child = rel ? `${rel}/${name}` : name;
       if (SKIP2.test(child + "/")) continue;
       try {
-        if (statSync2(join9(dir, child)).isDirectory()) walk2(child);
+        if (statSync(join9(dir, child)).isDirectory()) walk2(child);
       } catch {
       }
     }
@@ -6306,17 +6633,17 @@ function runWatch(args) {
 }
 
 // src/detectors/fs-events.ts
-import { readFileSync as readFileSync10, statSync as statSync3 } from "node:fs";
+import { readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
 var RULE11 = "transient-protected-mutation";
 function readEvents(log, offset) {
   let size = 0;
   try {
-    size = statSync3(log).size;
+    size = statSync2(log).size;
   } catch {
     return { events: [], newOffset: offset };
   }
   if (size <= offset) return { events: [], newOffset: offset >= 0 ? Math.min(offset, size) : 0 };
-  const raw = readFileSync10(log, "utf8").slice(offset);
+  const raw = readFileSync8(log, "utf8").slice(offset);
   const events = [];
   for (const line of raw.split("\n")) {
     if (!line.trim()) continue;
@@ -6369,7 +6696,7 @@ var HookInputError = class extends Error {
 };
 function readStdin() {
   try {
-    return readFileSync11(0, "utf8");
+    return readFileSync9(0, "utf8");
   } catch (e) {
     throw new HookInputError(`cannot read the hook payload on stdin: ${e instanceof Error ? e.message : String(e)}`);
   }
@@ -6395,7 +6722,7 @@ function recordDenylog(blocks) {
   } catch {
   }
 }
-function errText(e) {
+function errText2(e) {
   const m = e instanceof Error ? e.message : String(e);
   return m.length > 200 ? m.slice(0, 200) + "\u2026" : m;
 }
@@ -6427,11 +6754,8 @@ function fileChanges(changes) {
   return changes.filter((c) => c.kind === "file");
 }
 function hashOnDisk(cwd, rel) {
-  try {
-    return contentHash(readFileSync11(join10(cwd, rel)));
-  } catch {
-    return null;
-  }
+  const e = inspectRel(cwd, rel);
+  return e.content == null ? null : contentHash(e.content);
 }
 function gitMode(mode) {
   return (mode & 64) !== 0 ? "100755" : "100644";
@@ -6478,6 +6802,11 @@ function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree)
   const candidates = base ? [base, "HEAD", ""] : ["HEAD", ""];
   for (const rel of [...d.changed, ...d.deleted]) {
     if (seen.has(rel)) continue;
+    const unjudgeable = unjudgeableFinding(cwd, rel);
+    if (unjudgeable) {
+      blocks.push(unjudgeable);
+      continue;
+    }
     const after = fileOnDisk(rel, { cwd });
     const trustedBlob = fileAt(trusted, rel, { cwd });
     const atGitState = after != null && trustedBlob != null && contentHash(after) === contentHash(trustedBlob);
@@ -6526,6 +6855,11 @@ function uncoveredDrift(cwd, policy, expected, current, covered, base, turnTree)
   }
   for (const rel of d.added) {
     if (seen.has(rel)) continue;
+    const unjudgeable = unjudgeableFinding(cwd, rel);
+    if (unjudgeable) {
+      blocks.push(unjudgeable);
+      continue;
+    }
     const after = fileOnDisk(rel, { cwd });
     if (after == null) {
       blocks.push({
@@ -6565,7 +6899,8 @@ function effectDriftBlocks(cwd, sessionId, policy) {
     (c) => c.kind === "file" && (drifted.has(c.path) || c.oldPath != null && drifted.has(c.oldPath))
   );
   const gap = uncoveredDrift(cwd, policy, expected, current, scoped, base, loadTurnTree(cwd, sessionId));
-  const blocks = evaluate([...scoped, ...gap.changes], policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(gap.blocks);
+  const judged = [...scoped, ...gap.changes];
+  const blocks = evaluate(judged, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(gap.blocks, unjudgeableProtected(cwd, policy, judged));
   if (blocks.length > 0) return blocks;
   savePtree(cwd, sessionId, current);
   return null;
@@ -6602,7 +6937,7 @@ function preToolUseVerdict(input) {
     if (blocks.length === 0) sanctionPredictedWrites(cwd, input.session_id, policy, changes);
     return verdict(blocks, "PreToolUse");
   } catch (e) {
-    return failClosed("PreToolUse", errText(e));
+    return failClosed("PreToolUse", errText2(e));
   }
 }
 function cursorPath(cwd, sessionId) {
@@ -6617,7 +6952,7 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   if (!existsSync7(log)) return none;
   let offset = 0;
   if (cp && existsSync7(cp)) {
-    const n = Number(readFileSync11(cp, "utf8"));
+    const n = Number(readFileSync9(cp, "utf8"));
     offset = Number.isFinite(n) ? n : 0;
   }
   const { events, newOffset } = readEvents(log, offset);
@@ -6629,12 +6964,8 @@ function turnTransientBlocks(cwd, sessionId, policy, changes) {
   } };
   const persistent = new Set(changes.filter((c) => c.kind === "file").map((c) => c.path));
   const finalHash = (path) => {
-    try {
-      if (!statSync4(`${cwd}/${path}`).isFile()) return null;
-      return createHash4("sha256").update(readFileSync11(`${cwd}/${path}`)).digest("hex").slice(0, 16);
-    } catch {
-      return null;
-    }
+    const e = inspectRel(cwd, path);
+    return e.kind === "file" && e.content != null ? contentHash(e.content) : null;
   };
   const findings = transientFindings(events, persistent, policy, finalHash);
   recordWarns(findings.filter((f) => f.severity !== "block"));
@@ -6675,7 +7006,7 @@ function stopVerdict(input) {
       changes = changes.concat(gap.changes);
       hiddenBlocks = gap.blocks;
     }
-    blocks = evaluate(changes, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(hiddenBlocks);
+    blocks = evaluate(changes, policy, void 0, "turn", { cwd }).filter((f) => f.severity === "block").concat(hiddenBlocks, unjudgeableProtected(cwd, policy, changes));
     const transient = turnTransientBlocks(cwd, input.session_id, policy, changes);
     blocks = blocks.concat(transient.blocks);
     commitCursor = transient.commit;
@@ -6684,7 +7015,7 @@ function stopVerdict(input) {
       saveTurnTree(cwd, input.session_id, current);
     }
   } catch (e) {
-    return failClosed("Stop", errText(e));
+    return failClosed("Stop", errText2(e));
   }
   if (blocks.length === 0) {
     advanceTurnBaseline(cwd, input.session_id);
@@ -6700,28 +7031,28 @@ function preToolUseFromRaw(raw) {
   try {
     return preToolUseVerdict(parseInput(raw));
   } catch (e) {
-    return failClosed("PreToolUse", errText(e));
+    return failClosed("PreToolUse", errText2(e));
   }
 }
 function stopFromRaw(raw) {
   try {
     return stopVerdict(parseInput(raw));
   } catch (e) {
-    return failClosed("Stop", errText(e));
+    return failClosed("Stop", errText2(e));
   }
 }
 function runHookClaude() {
   try {
     return emit(preToolUseFromRaw(readStdin()));
   } catch (e) {
-    return emit(failClosed("PreToolUse", errText(e)));
+    return emit(failClosed("PreToolUse", errText2(e)));
   }
 }
 function runSweepClaude() {
   try {
     return emit(stopFromRaw(readStdin()));
   } catch (e) {
-    return emit(failClosed("Stop", errText(e)));
+    return emit(failClosed("Stop", errText2(e)));
   }
 }
 
@@ -6774,9 +7105,9 @@ Honored at LOCAL pre-commit only. The agent-layer hook ignores this file; CI req
 // src/cli/init.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync5, chmodSync, statSync as statSync5 } from "node:fs";
-import { basename, dirname as dirname4, isAbsolute as isAbsolute5, join as join11, relative as relative3, resolve as resolve2 } from "node:path";
-var errText2 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5, chmodSync, statSync as statSync3 } from "node:fs";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute7, join as join10, relative as relative3, resolve as resolve3 } from "node:path";
+var errText3 = (e) => (e instanceof Error ? e.message : String(e)).replace(/\s+/g, " ").trim();
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 function gitConfig(cwd, key2) {
   try {
@@ -6925,13 +7256,13 @@ function readWorkflowMark(src) {
   if (!m) return null;
   return { version: m[1], hash: m[2], body: src.replace(WORKFLOW_MARK_RE, "") };
 }
-function toolSet(matcher2) {
-  const m = String(matcher2 ?? "").trim();
+function toolSet(matcher) {
+  const m = String(matcher ?? "").trim();
   if (m === "" || m === "*") return null;
-  return new Set(m.split("|").map((t) => t.trim()).filter(Boolean));
+  return new Set(m.split(/[|,]/).map((t) => t.trim()).filter(Boolean));
 }
-function missingTools(matcher2) {
-  const have = toolSet(matcher2);
+function missingTools(matcher) {
+  const have = toolSet(matcher);
   if (have === null) return [];
   return PRE_MATCHER.split("|").filter((t) => !have.has(t));
 }
@@ -6951,12 +7282,12 @@ function hooksShapeError(hooks) {
   return null;
 }
 function planPolicy(cwd) {
-  const path = join11(cwd, POLICY_FILE);
+  const path = join10(cwd, POLICY_FILE);
   if (existsSync8(path)) {
     try {
       loadPolicy(cwd);
     } catch (e) {
-      return { item: "policy", path: POLICY_FILE, status: "error", detail: `present but does not load \u2014 ${errText2(e)}; fix it, then re-run init (left untouched)` };
+      return { item: "policy", path: POLICY_FILE, status: "error", detail: `present but does not load \u2014 ${errText3(e)}; fix it, then re-run init (left untouched)` };
     }
     return { item: "policy", path: POLICY_FILE, status: "ok", detail: "already present and loads \u2014 left untouched" };
   }
@@ -6970,12 +7301,12 @@ function planPolicy(cwd) {
 }
 function planClaudeHooks(cwd) {
   const rel = ".claude/settings.json";
-  const path = join11(cwd, rel);
+  const path = join10(cwd, rel);
   let settings = {};
   if (existsSync8(path)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync12(path, "utf8"));
+      parsed = JSON.parse(readFileSync10(path, "utf8"));
     } catch {
       return {
         item: "agent",
@@ -7001,7 +7332,8 @@ function planClaudeHooks(cwd) {
   const needStop = stopEntries.length === 0;
   const stale = preEntries.filter((m) => missingTools(m.matcher).length > 0);
   const repin = [...preEntries, ...stopEntries].flatMap((m) => m.hooks ?? []).filter((h) => stalePin(String(h.command ?? "")));
-  if (!needPre && !needStop && stale.length === 0 && repin.length === 0) {
+  const needDisableFalse = settings.disableAllHooks !== false;
+  if (!needPre && !needStop && stale.length === 0 && repin.length === 0 && !needDisableFalse) {
     return { item: "agent", path: rel, status: "ok", detail: "PreToolUse + Stop hooks already wired" };
   }
   const repairing = stale.length > 0 ? [...new Set(stale.flatMap((m) => missingTools(m.matcher)))] : [];
@@ -7014,7 +7346,8 @@ function planClaudeHooks(cwd) {
       needPre && "wire PreToolUse deny",
       needStop && "wire Stop sweep",
       repairing.length > 0 && `widen the PreToolUse matcher to cover ${repairing.join(", ")}`,
-      repin.length > 0 && `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`
+      repin.length > 0 && `re-pin the hook commands to tamperward@${TW_VERSION} (was ${pins.join(", ")})`,
+      needDisableFalse && (settings.disableAllHooks === void 0 ? "declare disableAllHooks: false so the user settings file cannot switch the hooks off" : `set disableAllHooks: false (was ${JSON.stringify(settings.disableAllHooks)})`)
     ].filter(Boolean).join(" + "),
     apply: () => {
       for (const h of repin) {
@@ -7033,6 +7366,7 @@ function planClaudeHooks(cwd) {
       if (needStop) {
         (hooks.Stop ??= []).push({ hooks: [{ type: "command", command: SWEEP_CMD }] });
       }
+      if (needDisableFalse) settings.disableAllHooks = false;
       mkdirSync5(dirname4(path), { recursive: true });
       writeFileSync5(path, JSON.stringify(settings, null, 2) + "\n");
     }
@@ -7065,14 +7399,14 @@ var MANAGED_HOOKS = [
 function hooksDir(cwd) {
   try {
     const out2 = execFileSync5("git", ["rev-parse", "--git-path", "hooks"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    if (out2) return resolve2(cwd, out2);
+    if (out2) return resolve3(cwd, out2);
   } catch {
   }
-  return existsSync8(join11(cwd, ".git")) ? join11(cwd, ".git", "hooks") : null;
+  return existsSync8(join10(cwd, ".git")) ? join10(cwd, ".git", "hooks") : null;
 }
 function display(cwd, path) {
   const rel = relative3(cwd, path);
-  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : path;
+  return rel && !rel.startsWith("..") && !isAbsolute7(rel) ? rel : path;
 }
 function unconditionalExitAt(lines) {
   let depth = 0;
@@ -7095,30 +7429,30 @@ function planPreCommit(cwd) {
   const skip = (detail) => ({ item: "pre-commit", path: "(none)", status: "skip", detail });
   let path;
   let note;
-  if (existsSync8(join11(cwd, ".husky"))) {
-    path = join11(cwd, ".husky", "pre-commit");
+  if (existsSync8(join10(cwd, ".husky"))) {
+    path = join10(cwd, ".husky", "pre-commit");
     note = "husky";
   } else {
-    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join11(cwd, c))));
+    const managed = MANAGED_HOOKS.find((m) => m.configs.some((c) => existsSync8(join10(cwd, c))));
     if (managed) {
       return skip(`${managed.name} manages this repository's hooks and regenerates them on install, so a line in the hooks directory would not last \u2014 ${managed.hint}`);
     }
     const dir = hooksDir(cwd);
     if (!dir) return skip("not a git repo and no .husky/ \u2014 nothing to wire");
-    if (basename(dir) === "_" && basename(dirname4(dir)) === ".husky") {
-      path = join11(dirname4(dir), "pre-commit");
+    if (basename2(dir) === "_" && basename2(dirname4(dir)) === ".husky") {
+      path = join10(dirname4(dir), "pre-commit");
       note = "husky";
     } else {
-      path = join11(dir, "pre-commit");
+      path = join10(dir, "pre-commit");
       const rel2 = display(cwd, dir);
-      note = rel2 === join11(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
+      note = rel2 === join10(".git", "hooks") ? "plain git hook (local-only: .git/hooks is not committed \u2014 consider husky to share it)" : `git hooks directory ${rel2} (core.hooksPath)`;
     }
   }
   const rel = display(cwd, path);
-  if (existsSync8(path) && !statSync5(path).isFile()) {
+  if (existsSync8(path) && !statSync3(path).isFile()) {
     return { item: "pre-commit", path: rel, status: "error", detail: "exists but is not a regular file \u2014 refusing to write" };
   }
-  const existing = existsSync8(path) ? readFileSync12(path, "utf8") : null;
+  const existing = existsSync8(path) ? readFileSync10(path, "utf8") : null;
   if (existing === null) {
     return {
       item: "pre-commit",
@@ -7207,10 +7541,10 @@ ${block.join("\n")}
 function planCodeowners(cwd) {
   const rel = ".github/CODEOWNERS";
   const existingRel = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"].find(
-    (r) => existsSync8(join11(cwd, r))
+    (r) => existsSync8(join10(cwd, r))
   );
-  const path = join11(cwd, existingRel ?? rel);
-  const existing = existingRel ? readFileSync12(path, "utf8") : null;
+  const path = join10(cwd, existingRel ?? rel);
+  const existing = existingRel ? readFileSync10(path, "utf8") : null;
   const missing = CODEOWNERS_PATHS.filter((p) => existing === null || !coveredBy(existing, p));
   if (missing.length === 0) {
     return { item: "codeowners", path: existingRel, status: "ok", detail: "gate paths already have code owners" };
@@ -7243,7 +7577,7 @@ ${CODEOWNERS_MARK}
 }
 function planWorkflow(cwd, force) {
   const rel = ".github/workflows/tamperward.yml";
-  const path = join11(cwd, rel);
+  const path = join10(cwd, rel);
   const write = () => {
     mkdirSync5(dirname4(path), { recursive: true });
     writeFileSync5(path, workflowFile(WORKFLOW_CONTENT));
@@ -7259,7 +7593,7 @@ function planWorkflow(cwd, force) {
   }
   let src;
   try {
-    src = readFileSync12(path, "utf8");
+    src = readFileSync10(path, "utf8");
   } catch {
     return { item: "ci", path: rel, status: "error", detail: "exists but cannot be read \u2014 refusing to overwrite" };
   }
@@ -7297,7 +7631,7 @@ function planned(item, path, plan) {
   try {
     return plan();
   } catch (e) {
-    return { item, path, status: "error", detail: `cannot plan this item \u2014 ${errText2(e)}` };
+    return { item, path, status: "error", detail: `cannot plan this item \u2014 ${errText3(e)}` };
   }
 }
 function planInit(cwd, opts = {}) {
@@ -7321,7 +7655,7 @@ function runInit(opts) {
         applied++;
       } catch (e) {
         a.status = "error";
-        a.detail = `could not be written \u2014 ${errText2(e)}`;
+        a.detail = `could not be written \u2014 ${errText3(e)}`;
         a.apply = void 0;
       }
     }
@@ -7358,15 +7692,15 @@ tamperward init: ${changed} change(s) applied. Commit them so the gate travels w
 // src/cli/verify.ts
 import { execFileSync as execFileSync8, spawnSync } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { chmodSync as chmodSync2, cpSync, lstatSync, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync15, readlinkSync as readlinkSync2, rmSync as rmSync3, statSync as statSync7, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
+import { chmodSync as chmodSync2, cpSync, lstatSync as lstatSync3, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13, readlinkSync as readlinkSync3, rmSync as rmSync3, statSync as statSync5, symlinkSync, writeFileSync as writeFileSync6, existsSync as existsSync10 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname5, join as join14, resolve as resolve3 } from "node:path";
+import { dirname as dirname5, join as join13, resolve as resolve4 } from "node:path";
 
 // src/git/trusted.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync13 } from "node:fs";
-import { isAbsolute as isAbsolute6, join as join12 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync11 } from "node:fs";
+import { isAbsolute as isAbsolute8, join as join11 } from "node:path";
 function trustedGitEnv() {
   return { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" };
 }
@@ -7379,7 +7713,7 @@ function gitDirOf(cwd) {
       env: trustedGitEnv()
     }).trim();
     if (!d) return null;
-    return isAbsolute6(d) ? d : join12(cwd, d);
+    return isAbsolute8(d) ? d : join11(cwd, d);
   } catch {
     return null;
   }
@@ -7404,9 +7738,9 @@ function objectRewriteState(cwd) {
       parts.push(`${rel}:<no-git-dir>`);
       continue;
     }
-    const p = join12(dir, rel);
+    const p = join11(dir, rel);
     try {
-      parts.push(`${rel}:` + (existsSync9(p) ? readFileSync13(p, "utf8").trim() : ""));
+      parts.push(`${rel}:` + (existsSync9(p) ? readFileSync11(p, "utf8").trim() : ""));
     } catch {
       parts.push(`${rel}:<unreadable>`);
     }
@@ -7417,8 +7751,8 @@ function objectRewriteState(cwd) {
 // src/fingerprint.ts
 import { execFileSync as execFileSync7 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdirSync as readdirSync3, readFileSync as readFileSync14, readlinkSync, statSync as statSync6 } from "node:fs";
-import { join as join13 } from "node:path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync12, readlinkSync as readlinkSync2, statSync as statSync4 } from "node:fs";
+import { join as join12 } from "node:path";
 function treeFingerprint(cwd) {
   const files = execFileSync7("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd,
@@ -7430,17 +7764,13 @@ function treeFingerprint(cwd) {
   for (const rel of files) {
     h.update(rel);
     h.update("\0");
-    try {
-      h.update(readFileSync14(join13(cwd, rel)));
-    } catch {
-      h.update("<unreadable>");
-    }
+    h.update(inspectRel(cwd, rel).content ?? "<unreadable>");
     h.update("\0");
   }
   return h.digest("hex");
 }
 function depsFingerprint(cwd) {
-  const root = join13(cwd, "node_modules");
+  const root = join12(cwd, "node_modules");
   const h = createHash7("sha256");
   const walk2 = (dir) => {
     let entries;
@@ -7450,20 +7780,20 @@ function depsFingerprint(cwd) {
       return;
     }
     for (const e of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
-      const p = join13(dir, e.name);
+      const p = join12(dir, e.name);
       if (e.isDirectory()) walk2(p);
       else if (e.isFile()) {
         h.update(p);
         try {
-          h.update(readFileSync14(p));
-          h.update(String(statSync6(p).mode));
+          h.update(readFileSync12(p));
+          h.update(String(statSync4(p).mode));
         } catch {
           h.update("<unreadable>");
         }
       } else if (e.isSymbolicLink()) {
         h.update(p);
         try {
-          h.update(readlinkSync(p));
+          h.update(readlinkSync2(p));
         } catch {
           h.update("<unreadable-link>");
         }
@@ -7471,7 +7801,7 @@ function depsFingerprint(cwd) {
     }
   };
   try {
-    if (!statSync6(root).isDirectory()) return "none";
+    if (!statSync4(root).isDirectory()) return "none";
   } catch {
     return "none";
   }
@@ -7570,30 +7900,30 @@ function baseIsAncestorOfHead(base, cwd) {
 function materialize(cwd, dest) {
   const listed = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of listed) {
-    const src = join14(cwd, rel);
+    const src = join13(cwd, rel);
     let st;
     try {
-      st = statSync7(src);
+      st = statSync5(src);
     } catch {
       continue;
     }
     if (!st.isFile()) continue;
-    const out2 = join14(dest, rel);
+    const out2 = join13(dest, rel);
     mkdirSync6(dirname5(out2), { recursive: true });
     dropSymlink(out2);
-    if (lstatSync(src).isSymbolicLink()) {
-      writeFileSync6(out2, readFileSync15(src));
+    if (lstatSync3(src).isSymbolicLink()) {
+      writeFileSync6(out2, readFileSync13(src));
     } else {
       cpSync(src, out2, { dereference: true });
     }
     chmodSync2(out2, st.mode);
   }
-  const nm = resolve3(cwd, "node_modules");
-  if (existsSync10(nm)) symlinkSync(nm, join14(dest, "node_modules"), "dir");
+  const nm = resolve4(cwd, "node_modules");
+  if (existsSync10(nm)) symlinkSync(nm, join13(dest, "node_modules"), "dir");
 }
 function dropSymlink(p) {
   try {
-    if (lstatSync(p).isSymbolicLink()) rmSync3(p, { force: true });
+    if (lstatSync3(p).isSymbolicLink()) rmSync3(p, { force: true });
   } catch {
   }
 }
@@ -7622,11 +7952,11 @@ function overlayDigest(dest, paths) {
   for (const rel of [...paths].sort()) {
     h.update(rel);
     h.update("\0");
-    const p = join14(dest, rel);
+    const p = join13(dest, rel);
     try {
-      const st = lstatSync(p);
+      const st = lstatSync3(p);
       h.update(String(st.mode));
-      h.update(st.isSymbolicLink() ? readlinkSync2(p) : readFileSync15(p));
+      h.update(st.isSymbolicLink() ? readlinkSync3(p) : readFileSync13(p));
     } catch {
       h.update("<gone>");
     }
@@ -7649,7 +7979,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
       throw new Error(`the base's ${e.path} is a submodule; the pristine copy cannot reproduce it`);
     }
     const content = execFileSync8("git", ["show", `${base}:${e.path}`], { cwd, maxBuffer: 1 << 28, env: trustedGitEnv() });
-    const out2 = join14(dest, e.path);
+    const out2 = join13(dest, e.path);
     mkdirSync6(dirname5(out2), { recursive: true });
     rmSync3(out2, { force: true });
     if (e.mode === "120000") {
@@ -7664,7 +7994,7 @@ function overlayPristine(cwd, base, dest, policy, cmd) {
   const inCopy = git2(["ls-files", "-z", "--cached", "--others", "--exclude-standard"], cwd).split("\0").filter(Boolean);
   for (const rel of inCopy) {
     if (!isOverlay(rel) || baseProtected.has(rel)) continue;
-    rmSync3(join14(dest, rel), { force: true });
+    rmSync3(join13(dest, rel), { force: true });
     removed++;
   }
   return { restored, removed };
@@ -7706,8 +8036,8 @@ function suiteEnv(scratch) {
     if (DROPPED_ENV.has(k) || PINNED_NPM.test(k)) continue;
     env[k] = v;
   }
-  const userRc = join14(scratch, "npmrc-user");
-  const globalRc = join14(scratch, "npmrc-global");
+  const userRc = join13(scratch, "npmrc-user");
+  const globalRc = join13(scratch, "npmrc-global");
   for (const f of [userRc, globalRc]) writeFileSync6(f, "", { mode: 292 });
   env.npm_config_userconfig = userRc;
   env.npm_config_globalconfig = globalRc;
@@ -7717,8 +8047,8 @@ function suiteEnv(scratch) {
 }
 function runSuite(dir, cmd, budgetSecs) {
   const t0 = Date.now();
-  const outDir = mkdtempSync2(join14(tmpdir2(), "tw-verify-run-"));
-  const outFile = join14(outDir, "result.json");
+  const outDir = mkdtempSync2(join13(tmpdir2(), "tw-verify-run-"));
+  const outFile = join13(outDir, "result.json");
   try {
     spawnSync(process.execPath, ["-e", SUPERVISOR, cmd, String(budgetSecs * 1e3), outFile], {
       cwd: dir,
@@ -7731,7 +8061,7 @@ function runSuite(dir, cmd, budgetSecs) {
     const secs = Math.round((Date.now() - t0) / 1e3);
     let r;
     try {
-      r = JSON.parse(readFileSync15(outFile, "utf8"));
+      r = JSON.parse(readFileSync13(outFile, "utf8"));
     } catch {
       return { exit: null, secs };
     }
@@ -7782,8 +8112,8 @@ function runVerify(opts) {
     out2(`verify: cannot resolve base rev "${opts.base ?? "HEAD"}" \u2014 failing closed`);
     return 2;
   }
-  const visRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-vis-"));
-  const visDir = join14(visRoot, "t");
+  const visRoot = mkdtempSync2(join13(tmpdir2(), "tw-verify-vis-"));
+  const visDir = join13(visRoot, "t");
   const cleanup = (dirs) => {
     if (opts.keep) return;
     for (const d of dirs) rmSync3(d, { recursive: true, force: true });
@@ -7811,8 +8141,8 @@ function runVerify(opts) {
     out2("pristine run executes through it too. Failing closed, not open.");
     return 2;
   }
-  const priRoot = mkdtempSync2(join14(tmpdir2(), "tw-verify-pri-"));
-  const priDir = join14(priRoot, "t");
+  const priRoot = mkdtempSync2(join13(tmpdir2(), "tw-verify-pri-"));
+  const priDir = join13(priRoot, "t");
   let restored = [];
   let removedAdded = 0;
   try {
@@ -7924,8 +8254,8 @@ function parseVerify(args) {
 
 // src/cli/run.ts
 import { execFileSync as execFileSync9, spawnSync as spawnSync2 } from "node:child_process";
-import { readdirSync as readdirSync4, readFileSync as readFileSync16, realpathSync } from "node:fs";
-import { resolve as resolve4 } from "node:path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync14, realpathSync as realpathSync3 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
 var out = (s) => process.stdout.write(s + "\n");
 var err = (s) => process.stderr.write(s + "\n");
 function git3(args, cwd) {
@@ -7933,7 +8263,7 @@ function git3(args, cwd) {
 }
 function nowTicks() {
   try {
-    return Math.floor(parseFloat(readFileSync16("/proc/uptime", "utf8").split(" ")[0]) * 100);
+    return Math.floor(parseFloat(readFileSync14("/proc/uptime", "utf8").split(" ")[0]) * 100);
   } catch {
     return Number.POSITIVE_INFINITY;
   }
@@ -7942,7 +8272,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   const out2 = [];
   let real;
   try {
-    real = realpathSync(cwd);
+    real = realpathSync3(cwd);
   } catch {
     return out2;
   }
@@ -7957,13 +8287,13 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
     if (n === process.pid) continue;
     let held;
     try {
-      held = realpathSync(`/proc/${pid}/cwd`);
+      held = realpathSync3(`/proc/${pid}/cwd`);
     } catch {
       continue;
     }
     if (held !== real && !held.startsWith(real + "/")) continue;
     try {
-      const stat = readFileSync16(`/proc/${pid}/stat`, "utf8");
+      const stat = readFileSync14(`/proc/${pid}/stat`, "utf8");
       const startTicks = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19]);
       if (Number.isFinite(startTicks) && startTicks >= spawnedAfterTicks) out2.push(n);
     } catch {
@@ -7972,7 +8302,7 @@ function survivorsHoldingTree(cwd, spawnedAfterTicks) {
   return out2;
 }
 function runEnvelope(opts) {
-  const cwd = resolve4(opts.cwd ?? process.cwd());
+  const cwd = resolve5(opts.cwd ?? process.cwd());
   if (!opts.argv.length) {
     err("tamperward run: no agent command given (usage: tamperward run [options] -- <command...>)");
     return 2;