diff --git a/scripts/pm/check-governed-merges.mjs b/scripts/pm/check-governed-merges.mjs
index 954068278ab..c8fc32ab754 100644
--- a/scripts/pm/check-governed-merges.mjs
+++ b/scripts/pm/check-governed-merges.mjs
@@ -4516,7 +4516,7 @@ async function selfTest() {
   battery('the nested `ui/` workspace rows, on the register (#25712)');
   const UI_ROWS = GOVERNED_SURFACES.filter((s) => s.id.startsWith('ui-'));
   const ROOT_ROWS = Object.freeze(GOVERNED_SURFACES.filter((s) => !s.id.startsWith('ui-')));
-  const UI_SPECIMENS = { 'ui-adr': 'ui/docs/adr/0001-master-detail-subform.md', 'ui-claude-tree': 'ui/.claude/hooks/guard-main-checkout.sh', 'ui-skills-catalog': 'ui/skills/objectui/SKILL.md', 'ui-agents-md': 'ui/AGENTS.md', 'ui-claude-md': 'ui/CLAUDE.md', 'ui-workflows': 'ui/.github/workflows/ci.yml' };
+  const UI_SPECIMENS = { 'ui-adr': 'ui/docs/adr/0001-master-detail-subform.md', 'ui-claude-tree': 'ui/.claude/skills/verify/SKILL.md', 'ui-skills-catalog': 'ui/skills/objectui/SKILL.md', 'ui-agents-md': 'ui/AGENTS.md', 'ui-claude-md': 'ui/CLAUDE.md', 'ui-workflows': 'ui/.github/workflows/ci.yml' };
   assert('the-ui-rows-are-six-well-formed-register-rows', UI_ROWS.length === 6 && UI_ROWS.every((r) => (r.prefix ? r.prefix.endsWith('/') && r.glob === `${r.prefix}**` && r.exact === undefined : r.glob === r.exact) && r.tier === GOVERNED_TIER_H && r.tierRepos === undefined && surfaceRepos(r).join() === 'objectstack') && new Set(GOVERNED_SURFACES.map((r) => r.id)).size === GOVERNED_SURFACES.length, JSON.stringify(UI_ROWS.map((r) => r.id)));
   assert('the-ui-rows-mirror-the-six-rows-objectui-governs-each-under-ui', UI_ROWS.map((r) => r.glob).join() === ROOT_ROWS.filter((s) => s.id !== 'north-star').map((s) => `ui/${s.glob}`).join(), UI_ROWS.map((r) => r.glob).join());
   for (const row of UI_ROWS) {
diff --git a/ui/.claude/hooks/guard-main-checkout-bash.selftest.sh b/ui/.claude/hooks/guard-main-checkout-bash.selftest.sh
deleted file mode 100755
index faab1c69263..00000000000
--- a/ui/.claude/hooks/guard-main-checkout-bash.selftest.sh
+++ /dev/null
@@ -1,443 +0,0 @@
-#!/usr/bin/env bash
-# copied from objectstack@338297e46018ae96256262590a308c8be735f825
-# Self-test for guard-main-checkout-bash.sh — run it after touching that hook:
-#
-#   .claude/hooks/guard-main-checkout-bash.selftest.sh
-#
-# Feeds the hook the same JSON payload shape Claude Code delivers on PreToolUse and asserts
-# the block/allow verdict per command. Hermetic: it builds its OWN throwaway git repo, a
-# linked worktree of it, and a non-repo directory under $TMPDIR, so the matrix never depends
-# on which machine or which checkout it runs from. Needs jq and git and nothing else — no
-# install, no build, no network. Exit 0 = all cases hold.
-#
-# Mirrors .claude/hooks/guard-shared-stash.selftest.sh case-for-case in shape.
-
-set -uo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-hook="$here/guard-main-checkout-bash.sh"
-pass=0
-fail=0
-
-command -v jq >/dev/null 2>&1 || { echo "selftest needs jq to build payloads" >&2; exit 1; }
-command -v git >/dev/null 2>&1 || { echo "selftest needs git to build the fixture" >&2; exit 1; }
-
-# --- fixture: a shared primary checkout, a linked worktree of it, a plain directory -----
-tmp="$(mktemp -d)"
-trap 'rm -rf "$tmp"' EXIT
-MAIN="$tmp/mainrepo"
-WT="$tmp/wt"
-PLAIN="$tmp/plain"
-# ODD: a PRIMARY checkout whose own path carries a literal `worktrees` segment. Every write
-# into it must BLOCK — it is a primary checkout, and the verdict comes from the git-dir vs
-# git-common-dir structure, never from the spelling of the path (#7259). $WT is its positive
-# twin: a real linked worktree at a path with no such segment.
-ODD="$tmp/worktrees/oddrepo"
-mkdir -p "$MAIN/pkg" "$PLAIN" "$ODD/pkg"
-(
-  cd "$MAIN" || exit 1
-  git init -q .
-  git config user.email selftest@example.com
-  git config user.name selftest
-  : > README.md
-  : > pkg/x.ts
-  git add -A
-  git commit -qm init
-  git worktree add -q "$WT" -b selftest-wt
-  cd "$ODD" || exit 1
-  git init -q .
-  git config user.email selftest@example.com
-  git config user.name selftest
-  : > README.md
-  : > pkg/x.ts
-  git add -A
-  git commit -qm init
-) >/dev/null 2>&1 || { echo "could not build the git fixture" >&2; exit 1; }
-
-CWD="$MAIN"   # payload cwd for the cases that follow; reassigned per section
-
-# verdict <command> [env assignments…] -> prints "block" or "allow"
-verdict() {
-  local cmd="$1"; shift
-  local payload out rc
-  payload="$(jq -nc --arg c "$cmd" --arg w "$CWD" \
-    '{cwd:$w,tool_name:"Bash",tool_input:{command:$c}}')"
-  out="$(printf '%s' "$payload" | env "$@" "$hook" 2>/dev/null)"
-  rc=$?
-  case "$rc" in
-    0) printf 'allow' ;;
-    2) printf 'block' ;;
-    *) printf 'exit%s' "$rc" ;;
-  esac
-}
-
-expect() { # expect <block|allow> <command> [env…]
-  local want="$1" cmd="$2"; shift 2
-  local got; got="$(verdict "$cmd" "$@")"
-  local shown="${cmd//$'\n'/ ⏎ }"
-  shown="${shown//$MAIN/\$MAIN}"; shown="${shown//$WT/\$WT}"; shown="${shown//$PLAIN/\$PLAIN}"
-  shown="${shown//$ODD/\$ODD}"
-  if [ "$got" = "$want" ]; then
-    pass=$((pass + 1)); printf '  ok   %-5s  %s\n' "$got" "$shown"
-  else
-    fail=$((fail + 1)); printf '  FAIL want=%s got=%s  %s\n' "$want" "$got" "$shown"
-  fi
-}
-
-stderr_of() { # stderr_of <command> [env…] -> the refusal text an agent actually reads
-  local cmd="$1"; shift
-  local payload
-  payload="$(jq -nc --arg c "$cmd" --arg w "$CWD" \
-    '{cwd:$w,tool_name:"Bash",tool_input:{command:$c}}')"
-  printf '%s' "$payload" | env "$@" "$hook" 2>&1 >/dev/null
-}
-
-says() { # says <needle> <label> <command> [env…]
-  local needle="$1" label="$2" subject="$3"; shift 3
-  local out; out="$(stderr_of "$subject" "$@")"
-  case "$out" in
-    *"$needle"*) pass=$((pass + 1)); printf '  ok   says   %s\n' "$label" ;;
-    *) fail=$((fail + 1)); printf '  FAIL missing "%s"  %s\n' "$needle" "$label" ;;
-  esac
-}
-
-lacks() { # lacks <needle> <label> <command> [env…]
-  # The direction only an ABSENCE assertion can hold: a remedy that stopped being true stays
-  # in the text a reader acts on long after the thing it described stopped working.
-  local needle="$1" label="$2" subject="$3"; shift 3
-  local out; out="$(stderr_of "$subject" "$@")"
-  case "$out" in
-    *"$needle"*) fail=$((fail + 1)); printf '  FAIL still says "%s"  %s\n' "$needle" "$label" ;;
-    *) pass=$((pass + 1)); printf '  ok   lacks  %s\n' "$label" ;;
-  esac
-}
-
-echo "== writes into the shared PRIMARY checkout are blocked =="
-CWD="$MAIN"
-expect block "sed -i s/a/b/ $MAIN/pkg/x.ts"
-expect block 'sed -i "s/a/b/g" pkg/x.ts'
-expect block 'sed -i -e "s/a/b/" pkg/x.ts'
-expect block 'sed --in-place s/a/b/ pkg/x.ts'
-expect block 'sed -ri "s/a/b/" pkg/x.ts'
-expect block 'perl -pi -e "s/a/b/" pkg/x.ts'
-expect block "echo x > $MAIN/README.md"
-expect block 'echo x >> pkg/x.ts'
-expect block 'printf hi > pkg/new.ts'
-expect block 'pnpm build | tee build.log'
-expect block 'tee -a notes.txt'
-expect block 'cp /tmp/a.txt pkg/a.txt'
-expect block 'mv /tmp/a.txt pkg/a.txt'
-expect block "cp -t $MAIN/pkg /tmp/a.txt"
-expect block 'rm -rf pkg/x.ts'
-expect block 'touch pkg/new.ts'
-
-echo "== reached through separators, env prefixes, absolute argv0 and cd =="
-CWD="$PLAIN"
-expect block "cd $MAIN && tee pkg/a.ts"
-expect block "cd $MAIN; echo hi > README.md"
-expect block "git status && sed -i s/a/b/ $MAIN/pkg/x.ts; pnpm test"
-expect block "$(printf 'cd %s\npnpm install\nsed -i "s/a/b/" pkg/x.ts\n' "$MAIN")"
-CWD="$MAIN"
-expect block 'FOO=1 sed -i s/a/b/ pkg/x.ts'
-expect block '/usr/bin/sed -i s/a/b/ pkg/x.ts'
-
-echo "== the SAME writes into a linked worktree are fine =="
-CWD="$WT"
-expect allow "sed -i s/a/b/ $WT/pkg/x.ts"
-expect allow 'sed -i "s/a/b/g" pkg/x.ts'
-expect allow "echo x > $WT/README.md"
-expect allow 'pnpm build | tee build.log'
-expect allow 'rm -rf pkg/x.ts'
-expect allow 'touch pkg/new.ts'
-expect allow 'cp /tmp/a.txt pkg/a.txt'
-expect allow "cd $WT && tee pkg/a.ts"
-
-echo "== a PRIMARY checkout whose own path carries a 'worktrees' segment is BLOCKED =="
-# Every target here is ABSOLUTE, so the verdict can only have come from the path's own repo.
-# The two $ODD SUBDIRECTORY cases were `allow` under the `*/worktrees/*` substring test this
-# replaced — unguarded writes into a primary checkout — because git prints an ABSOLUTE
-# git-dir from a subdirectory and a RELATIVE one at the toplevel, so one checkout got
-# opposite verdicts by depth (#7259). The structural test is spelling-independent.
-CWD="$PLAIN"
-expect block "sed -i s/a/b/ $ODD/pkg/x.ts"   # a SUBDIRECTORY — the depth the substring test lost
-expect block "echo x > $ODD/pkg/x.ts"        # same depth, reached through redirection
-expect block "sed -i s/a/b/ $ODD/README.md"  # the toplevel, which blocked only by accident
-expect block "sed -i s/a/b/ $MAIN/pkg/x.ts"  # control: an ordinary shared primary checkout
-expect allow "sed -i s/a/b/ $WT/pkg/x.ts"    # control: a real linked worktree still allows
-
-echo "== writes outside any repo are fine (/tmp, scratchpad, \$HOME dotfiles) =="
-CWD="$MAIN"
-expect allow 'echo x > /tmp/os-selftest-out.log'
-expect allow "sed -i s/a/b/ $PLAIN/notes.md"
-expect allow "tee $PLAIN/x.log"
-expect allow 'echo hi > /dev/null'
-expect allow "rm -rf $PLAIN/scratch"
-
-echo "== reading the shared checkout is NEVER blocked =="
-CWD="$MAIN"
-expect allow "cat $MAIN/README.md"
-expect allow 'cat < README.md'
-expect allow "grep -rn worktree $MAIN"
-expect allow "ls -la $MAIN/pkg"
-expect allow "git -C $MAIN grep -n sed"
-expect allow 'sed -n "1,5p" README.md'
-expect allow 'sed "s/a/b/" README.md > /tmp/os-selftest-out'
-expect allow "cp $MAIN/README.md /tmp/copy.md"
-expect allow 'pnpm --filter @object-ui/app-shell test'
-expect allow 'git status'
-
-echo "== writing ABOUT the ban must not trip the ban =="
-CWD="$MAIN"
-expect allow 'grep -n "sed -i" .claude/'
-expect allow "grep -rn \"echo x > $MAIN/README.md\" .claude/"
-expect allow 'echo "never run sed -i inside the shared checkout"'
-expect allow 'git grep -n "cd main && tee packages/a.ts"'
-# a heredoc BODY is prose: its lines are documentation, not commands (the introducing
-# line's own redirect still counts — see the block case below)
-expect allow "$(printf "cat > /tmp/notes.md <<'EOF'\nsed -i 's/a/b/' %s/pkg/x.ts\necho x > %s/README.md\nEOF\n" "$MAIN" "$MAIN")"
-expect block "$(printf 'cat > %s/notes.md <<EOF\nhello\nEOF\n' "$MAIN")"
-expect allow 'grep -q worktree <<<"$AGENTS"'
-
-echo "== non-ASCII codepoints are never operators; ASCII redirects still are (objectstack#10247) =="
-CWD="$MAIN"
-# A pure-read `node -e` whose string literal carries U+2192. Nothing is redirected: the
-# arrow is a display separator. Every byte of a non-ASCII codepoint is >= 0x80 and `>` is
-# 0x3e, so no arrow can ever reach operator position.
-expect allow "node -e \"console.log(steps.map(st=>st.a).join(' $(printf '\xe2\x86\x92') '))\""
-expect allow "echo 'build $(printf '\xe2\x86\x92') test $(printf '\xe2\x86\x92') ship'"
-expect allow "grep -n '$(printf '\xe2\x86\x92') the URL' AGENTS.md"     # arrows fill this repo's prose
-expect allow "echo 'a $(printf '\xe2\x87\x92') b'"
-# The negative twins: an otherwise-similar command with a REAL ASCII redirect still blocks,
-# so the allow side above is widened for non-ASCII only and not for redirection at large.
-expect block "node -e \"console.log(1)\" > out.log"
-expect block "echo 'build $(printf '\xe2\x86\x92') ship' > steps.txt"
-expect block "echo 'a $(printf '\xe2\x86\x92') b' >> pkg/x.ts"
-
-echo "== \\\" inside a double-quoted word does not end the quote (objectstack#10247 real cause) =="
-CWD="$MAIN"
-# The shape from the card: an escaped \" used to close the string, after which the JS arrow
-# function `st=>` put a real `>` in operator position and the guard named the JS tail that
-# followed it as a write target. Pure read — must be allowed.
-expect allow 'node -e "const j=require(\"./a.json\"); console.log(j.x.map(st=>st.a).join(\" - \"))"'
-expect allow 'node -e "console.log(\"a\", x.map(s=>s.t))"'
-expect allow 'grep -rn "he said \"sed -i\" once" .claude/'
-# Negative twins: a real write is still caught even when an escaped quote precedes it.
-expect block 'node -e "console.log(\"hi\")" > pkg/out.json'
-expect block 'sed -i "s/\"a\"/\"b\"/" pkg/x.ts'
-
-echo "== an UNQUOTED \\\" opens no quote, so the write behind it is still seen (objectstack#11131) =="
-CWD="$MAIN"
-# The measured hole: segmentation read the escaped `"` as OPENING a quoted region that never
-# closed. Every separator behind it went inert, the command collapsed into one `echo`
-# segment, and the real in-place write was just another argument. tokenize() always had the
-# backslash branch; this is the pass agreement.
-expect block 'echo \" ; sed -i s/a/b/ pkg/x.ts'
-expect block 'echo \" ; rm -rf pkg/x.ts'
-expect block 'printf \" ; tee pkg/a.ts'
-expect block "$(printf 'echo \\"\nsed -i s/a/b/ pkg/x.ts\n')"
-# Precision twins: the escape must not manufacture a target where nothing is written, and
-# the same command aimed at a linked worktree stays allowed.
-expect allow 'echo \" ; echo hello'
-expect allow 'echo \" ; cat README.md'
-expect allow 'echo a\ b'
-expect allow 'echo \\ ; grep -n worktree README.md'
-# NOT a discriminating case for this fix, kept as a plain regression pin: a `>` target is
-# collected wherever it appears, so this blocked even while the passes disagreed. What the
-# disagreement lost was the COMMAND-NAME writers (sed -i / rm / tee) — once the command
-# collapsed into one segment the head word became `echo` and they were mere arguments.
-expect block 'echo \" && echo x > pkg/x.ts'
-CWD="$WT"
-expect allow 'echo \" ; sed -i s/a/b/ pkg/x.ts'
-
-echo "== a shell COMMENT is text, not a command (objectstack#10570) =="
-CWD="$MAIN"
-# The measured false blocks: prose in a comment put a real `>` in operator position and the
-# next word was named as a write target. Nothing in either command writes anything.
-expect allow "$(printf '# rename foo -> bar\necho hello\n')"
-expect allow "$(printf '# sitting 1 landed; card stays open for sitting 2 -> pm:dispatched goes, pm:queue returns\ncurl -s https://example.com/a\ncurl -s https://example.com/b\n')"
-expect allow 'echo hi   # then; tee pkg/x.ts would write it down'
-expect allow "$(printf '# step one; then a -> b\n# 2> is not a redirect here either\ngit status\n')"
-# Recall is untouched: a real redirect on a LATER line still blocks, and so does one on the
-# SAME line ahead of an inline comment.
-expect block "$(printf '# rename foo -> bar\necho x > pkg/x.ts\n')"
-expect block 'echo x > pkg/x.ts   # write it down'
-expect block "$(printf '# a comment; with a separator\nsed -i s/a/b/ pkg/x.ts\n')"
-# Word start is the whole rule: these `#`s are not comments and must not change a verdict.
-expect block 'touch foo#bar'
-expect block 'rm -rf pkg/x.ts#old'
-expect allow 'curl -s "https://example.com/docs#frag"'
-expect allow "curl -s https://example.com/docs#a-real-redirect-would-be > /dev/null"
-expect allow "grep -n '#' README.md"
-expect allow "sed 's/#//' README.md"
-expect allow 'echo "# not a comment > pkg/x.ts"'
-# `${x#y}` / `${#arr[@]}` — a parameter expansion, not a comment. Swallowing the line here
-# would drop the redirect behind it, so the negative twin is the load-bearing case.
-expect allow 'echo ${x#pkg/} '
-expect block 'echo ${#TOK[@]} > pkg/x.ts'
-expect block 'echo ${x#a} > pkg/x.ts'
-# an escaped `\#` outside quotes is a literal, not a comment opener
-expect allow 'echo \# not a comment'
-
-echo "== a heredoc introducer NAMED in a comment introduces nothing (objectstack#11133) =="
-CWD="$MAIN"
-# The measured hole: `<<EOF` inside prose registered as a real introducer. `EOF` never
-# appeared on a line of its own, so the pending heredoc was never satisfied and every
-# remaining line — including the real write — was dropped before analysis.
-expect block "$(printf '# use cat > /tmp/n <<EOF for notes\nsed -i s/a/b/ pkg/x.ts\n')"
-expect block "$(printf '# see the <<EOF trick\necho x >> pkg/x.ts\n')"
-expect block "$(printf 'git status   # cat <<MARKER writes notes\nrm -rf pkg/x.ts\n')"
-expect block "$(printf '# heredocs: <<-EOF and <<"Q" both introduce\ntouch pkg/new.ts\n')"
-# Real heredocs are untouched: a body is still prose, and the introducing line's own
-# redirect is still a write.
-expect allow "$(printf "cat > /tmp/notes.md <<'EOF'\nsed -i 's/a/b/' %s/pkg/x.ts\nEOF\n" "$MAIN")"
-expect block "$(printf 'cat > %s/notes.md <<EOF\nhello\nEOF\n' "$MAIN")"
-# An inline comment AFTER a real introducer must not cancel it — the body is still stripped,
-# and the negative twin shows a real write after the terminator is still caught.
-expect allow "$(printf 'cat > /tmp/n.md <<EOF   # notes\nsed -i s/a/b/ pkg/x.ts\nEOF\n')"
-expect block "$(printf 'cat > /tmp/n.md <<EOF   # notes\nhello\nEOF\nsed -i s/a/b/ pkg/x.ts\n')"
-# A QUOTED `#` on the introducing line is not a comment: truncating there would lose the
-# real introducer and expose the body as commands. This is the load-bearing precision case.
-expect allow "$(printf "grep '#' README.md <<EOF\nsed -i 's/a/b/' pkg/x.ts\nEOF\n")"
-# Ordering pin: an unbalanced apostrophe inside a heredoc BODY must not desynchronise the
-# comment rule for the lines that follow. Body lines never reach the comment scan, so the
-# real write after the terminator is still analysed.
-expect block "$(printf "cat > /tmp/n.md <<'EOF'\n# it's a note, don't strip me\nEOF\nsed -i s/a/b/ pkg/x.ts\n")"
-expect allow "$(printf "cat > /tmp/n.md <<'EOF'\n# it's a note, don't strip me\nEOF\ngit status\n")"
-
-echo "== a \$(…) inside \"…\" is its own quoting context (objectstack#24812) =="
-CWD="$MAIN"
-# The measured false blocks: a `"` inside the substitution was read as CLOSING the outer string,
-# so the `>` in a quoted JSON body became a redirect and the fragment after it a write target.
-# Pure reads — nothing is written.
-expect allow 'echo "a $(curl -d "{\"c\":\"x > 1\"}" http://h)"'
-expect allow "echo \"a \$(curl -d '{\"c\":\"x > 1\"}' http://h)\""
-expect allow 'echo "a `curl -d "{\"c\":\"x > 1\"}" http://h`"'      # the backtick spelling
-# Recall is untouched: a real write beside a quoted substitution still blocks — in the same
-# command, behind a separator, and inside a sed -i script — and so does the card's control.
-expect block 'echo hi > out.txt'
-expect block 'echo "a $(curl -d "{\"c\":\"x > 1\"}" http://h)" > pkg/x.ts'
-expect block 'X="$(git rev-parse HEAD)" ; sed -i s/a/b/ pkg/x.ts'
-expect block 'sed -i "s/a/$(date +%F)/" pkg/x.ts'
-# The fail-OPEN mirror: one `"` in the body used to leave the outer string hanging, so the
-# separator behind it went inert and the real write rode through as text.
-expect block "echo \"\$(printf '\"')\" ; sed -i s/a/b/ pkg/x.ts"
-expect block "echo \"\$(echo \"\$(printf '\"')\")\" ; sed -i s/a/b/ pkg/x.ts"   # nested
-# The heredoc scan reads the body the same way: the ` #` inside it is no comment, so the
-# introducer behind it is found and the body stays prose.
-expect allow "$(printf 'echo "$(echo " #")" <<EOF\nsed -i s/a/b/ pkg/x.ts\nEOF\n')"
-
-echo "== a \${…} inside \"…\" is its own quoting context too (objectstack#24901) =="
-CWD="$MAIN"
-# The measured false block: the `"` that opens the default was read as CLOSING the outer string,
-# so `b}` became a write target. Pure reads — nothing is written. Each one exercises a different
-# pass: tokenisation (the first two), segmentation (the `;`), nesting both ways (the third).
-expect allow 'echo "${x:-"a > b"}"'
-expect allow 'echo "${x#"a > b"}"'
-expect allow 'echo "${x:-"$(printf "a > b")"}"'
-expect allow 'echo "${x:-"a; sed -i s/a/b/ pkg/x.ts"}"'
-expect allow "echo \"\${x:-'a > b'}\""          # control: no nested `"`, allowed before and after
-# The heredoc scan agrees: the ` #` inside the expansion is no comment, so the introducer
-# behind it is found and the body stays prose.
-expect allow "$(printf 'echo "${x:-" #"}" <<EOF\nsed -i s/a/b/ pkg/x.ts\nEOF\n')"
-# Recall is untouched: a write behind, beside or inside the script of a quoted expansion. A
-# '…' run holding no character the shells disagree on is skipped, so the write behind it stays.
-expect block 'sed -i "s/a/${x:-"b"}/" pkg/x.ts'
-expect block 'sed -i "s/a/${x}/" pkg/x.ts'
-expect block 'echo "${HOME}" > pkg/x.ts'
-expect block 'echo "${x:-"a"}" ; sed -i s/a/b/ pkg/x.ts'
-expect block "echo \"\${x:-'a'}\" ; sed -i s/a/b/ pkg/x.ts"
-# A `$(…)` inside the expansion is read by the same function, quotes and all: the `"` inside
-# its single quotes closes nothing, so the separator behind the word still splits.
-expect block "echo \"\${x:-\$(printf '\"')}\" ; sed -i s/a/b/ pkg/x.ts"
-
-echo "== shapes this guard deliberately does NOT claim (documented fail-open) =="
-CWD="$MAIN"
-expect allow "bash -c \"sed -i s/a/b/ $MAIN/pkg/x.ts\""
-expect allow 'echo pkg/x.ts | xargs sed -i s/a/b/'
-expect allow 'node -e "fs.writeFileSync(\"pkg/x.ts\", \"y\")"'
-expect allow 'python3 -c "open(\"pkg/x.ts\",\"w\").write(\"y\")"'
-expect allow 'echo "$(sed -i s/a/b/ pkg/x.ts)"'      # a QUOTED $(…) body is one inert word
-expect allow 'echo "${x:-"$(sed -i s/a/b/ pkg/x.ts)"}"'   # …and so is a QUOTED ${…} body
-expect allow 'echo hi > "${x:-"a > b"}"'              # a target holding an expansion
-# A '…' run inside a quoted ${…} that holds `}` (or `"` `\` `$` and a backtick): bash 5.2 reads
-# it as quoted and POSIX shells as literal, so they end the expansion in different places and
-# everything after it is inert. Under bash the first is a pure read, under dash a real write.
-expect allow "echo \"\${x:-'}\"; sed -i s/a/b/ pkg/x.ts'}\""
-expect allow "echo \"\${x:-'}'}\" ; sed -i s/a/b/ pkg/x.ts"
-expect allow 'sed -i s/a/b/ $SOMEDIR/x.ts'
-expect allow 'sed -i s/a/b/ pkg/*.ts'
-
-echo "== escape hatch =="
-CWD="$MAIN"
-expect allow 'sed -i s/a/b/ pkg/x.ts' OS_ALLOW_MAIN_EDITS=1
-expect allow 'echo x > README.md' OS_ALLOW_MAIN_EDITS=1
-
-echo "== the hatch names WHERE it works: this hook's own environment, never a prefix =="
-# The refusal used to end by telling the reader to re-run the same thing with the variable
-# as a VAR=1 command prefix — an instruction that cannot work where it is printed. A VAR=1
-# prefix sets the variable in the environment of THAT COMMAND; this hook is not that
-# command, and it reads the variable from its own environment, so the prefix changes
-# nothing and the refusal repeats (#15971). An instruction that does not work is an
-# invitation to route around the guard, so both directions are pinned: the dead remedy is
-# gone, and the sentence names the environment the hook actually reads. The `allow` rows
-# next door — the variable really in the hook's environment — are this pair's other half.
-# The first row is the card's own reproduction, kept as a case: the prefix spelled exactly
-# as the old message told the reader to spell it must still BLOCK, because it never reaches
-# this hook. It is the twin of the `allow` rows above, where the same variable is really in
-# the hook's environment.
-CWD="$MAIN"
-expect block "OS_ALLOW_MAIN_EDITS=1 rm -f $MAIN/x"
-expect block 'OS_ALLOW_MAIN_EDITS=1 sed -i s/a/b/ pkg/x.ts'
-lacks 're-run with' 'the refusal no longer prints the prefix remedy' 'sed -i s/a/b/ pkg/x.ts'
-says 'hook itself runs in' 'the refusal names the environment this hook reads' 'sed -i s/a/b/ pkg/x.ts'
-
-echo "== unparseable / absent payload fails open =="
-for probe in '{"tool_name":"Bash","tool_input":{}}' 'not json at all' '{}'; do
-  if printf '%s' "$probe" | "$hook" >/dev/null 2>&1; then
-    pass=$((pass + 1)); printf '  ok   allow  (payload: %s)\n' "$probe"
-  else
-    fail=$((fail + 1)); printf '  FAIL should fail open  (payload: %s)\n' "$probe"
-  fi
-done
-
-echo "== a relative target with no cwd in the payload fails open; absolute still lands =="
-printf '%s' '{"tool_name":"Bash","tool_input":{"command":"sed -i s/a/b/ pkg/x.ts"}}' \
-  | "$hook" >/dev/null 2>&1
-if [ "$?" -eq 0 ]; then
-  pass=$((pass + 1)); printf '  ok   allow  (relative target, no cwd)\n'
-else
-  fail=$((fail + 1)); printf '  FAIL relative target with no cwd should fail open\n'
-fi
-printf '%s' "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"sed -i s/a/b/ $MAIN/pkg/x.ts\"}}" \
-  | "$hook" >/dev/null 2>&1
-if [ "$?" -eq 2 ]; then
-  pass=$((pass + 1)); printf '  ok   block  (absolute target, no cwd)\n'
-else
-  fail=$((fail + 1)); printf '  FAIL absolute target should still be judged without cwd\n'
-fi
-
-echo "== jq-less fallback still parses command and cwd =="
-nojq="$(mktemp -d)"
-for b in bash env cat sed head grep git dirname basename; do
-  p="$(command -v "$b")" && ln -s "$p" "$nojq/$b"
-done
-nojq_case() { # nojq_case <want> <cwd> <command>
-  local want="$1" w="$2" c="$3" got
-  printf '{"cwd":"%s","tool_name":"Bash","tool_input":{"command":"%s"}}' "$w" "$c" \
-    | PATH="$nojq" "$hook" >/dev/null 2>&1
-  case "$?" in 0) got=allow ;; 2) got=block ;; *) got=other ;; esac
-  if [ "$got" = "$want" ]; then
-    pass=$((pass + 1)); printf '  ok   %-5s  (no jq) %s\n' "$got" "$c"
-  else
-    fail=$((fail + 1)); printf '  FAIL want=%s got=%s  (no jq) %s\n' "$want" "$got" "$c"
-  fi
-}
-nojq_case block "$MAIN" 'sed -i s/a/b/ pkg/x.ts'
-nojq_case allow "$WT" 'sed -i s/a/b/ pkg/x.ts'
-nojq_case block "$MAIN" 'echo x > README.md'
-nojq_case block "$MAIN" 'cd /tmp\ntee '"$MAIN"'/pkg/a.ts'
-nojq_case allow "$MAIN" 'grep -n \"sed -i\" .claude/'
-rm -rf "$nojq"
-
-printf '\n%s passed, %s failed\n' "$pass" "$fail"
-[ "$fail" -eq 0 ]
diff --git a/ui/.claude/hooks/guard-main-checkout-bash.sh b/ui/.claude/hooks/guard-main-checkout-bash.sh
deleted file mode 100755
index e4df18b133b..00000000000
--- a/ui/.claude/hooks/guard-main-checkout-bash.sh
+++ /dev/null
@@ -1,665 +0,0 @@
-#!/usr/bin/env bash
-# copied from objectstack@338297e46018ae96256262590a308c8be735f825
-# guard-main-checkout-bash.sh — PreToolUse guard: the SAME worktree-first rule as
-# guard-main-checkout.sh, applied to file writes that arrive through Bash instead of
-# through the Edit / Write / NotebookEdit tools.
-#
-# Why: guard-main-checkout.sh is registered on the matcher "Edit|Write|NotebookEdit", so
-# it only ever sees tool-shaped file writes. The identical mutation expressed as a shell
-# command never reaches it — `sed -i 's/foo/bar/' packages/fields/src/x.tsx`,
-# `cat > path <<EOF`, `tee`, `printf ... > path` all edit the shared primary checkout in
-# silence, while CLAUDE.md and AGENTS.md tell every agent that "a PreToolUse hook enforces
-# this rule". Declared enforcement scope > actual enforcement scope (objectui#3435, same
-# family as #3430). This hook closes the Bash half.
-#
-# The rule and the escape hatch are deliberately the SAME as guard-main-checkout.sh's:
-# OS_ALLOW_MAIN_EDITS=1. One rule, one hatch — a second variable would just be another
-# thing to forget.
-#
-# Repo predicate — lifted verbatim from guard-main-checkout.sh so the two hooks can never
-# disagree about what "shared checkout" means:
-#   resolve the target's nearest EXISTING ancestor dir -> `git rev-parse`
-#     * not a git repo at all (/tmp, $HOME dotfiles, the scratchpad)  -> allow
-#     * git-dir differs from git-common-dir (a linked worktree)       -> allow
-#     * anything else (the shared PRIMARY checkout, any sibling repo) -> BLOCK
-#
-# PRECISION OVER RECALL. Recognising a write target inside an arbitrary shell command is
-# heuristic in a way that Edit's file_path is not, and a guard that blocks work it does not
-# understand gets switched off — after which it guards nothing. So this hook only claims
-# shapes it can read with confidence, and everything else fails OPEN:
-#   > / >> redirection (incl. fd-prefixed 2>), sed -i, perl -i, tee, cp, mv, rm, touch.
-# Reads are never touched: grep / cat FILE / ls / git grep produce no write target.
-#
-# Fails open, deliberately, on:
-#   - wrapped invocations: bash -c '…', xargs, ssh host '…', make, a shell script that
-#     writes, a command inside a QUOTED "$(…)" (same known boundary guard-shared-stash.sh
-#     documents for itself);
-#   - programs whose writes live inside their own source text: python -c "open(p,'w')",
-#     node -e, awk > (the target is not a shell token, so there is nothing to read);
-#   - any target containing an expansion or glob ($VAR, `…`, $(…), *, ?, ~) — unresolvable
-#     without running it;
-#   - everything after a `'` inside a QUOTED "${…}" unless the quoted run holds none of
-#     `"` `\` `$` `}` or a backtick: bash and POSIX shells disagree on where such an expansion
-#     ends (subst_end());
-#   - relative targets when the payload carries no cwd.
-# Each of those is a hole by choice, not by accident: OS_ALLOW_MAIN_EDITS=1 already exists
-# for anyone who means to write there, and the target of this guard is the reflexive
-# `sed -i` an agent reaches for mid-task, not a determined evader.
-#
-# Writing ABOUT the ban must never trip the ban (objectstack#4890's lesson). Four layers:
-#   1. quote-aware segmentation + tokenisation — a `>` or a `sed -i` inside '…' or "…" is
-#      literal text, so `grep -n "sed -i" .claude/` and `echo "never sed -i in main"` pass;
-#      a `$(…)`, a backtick or a `${…}` inside "…" is a quoting context of its own, so a `"` in
-#      its body nests instead of closing the outer string (subst_end(), shared by every pass);
-#   2. heredoc bodies are stripped before analysis — the LINES of a `cat > /tmp/notes <<EOF`
-#      body are documentation, not commands, and segmentation alone (which splits on
-#      newlines) would happily read them as such;
-#   3. a backslash-escaped `\"` inside a double-quoted word does NOT end the quote — POSIX
-#      says `\` keeps its meaning before `"`, `\`, `$` and a backtick there, and nowhere else.
-#      Layer 1 used to end the string at the `\"`, and everything after it — the rest of a
-#      `node -e "…"` program — was then read as bare shell. A JS arrow function `st=>st.x`
-#      in that tail put a REAL ASCII `>` in operator position, so the guard named the
-#      following JS fragment as a write "target" and blocked a pure-read command (objectstack#10247).
-#      Single quotes take no escapes: inside '…' a backslash is literal, as in a real shell.
-#      OUTSIDE quotes the same escape holds and both passes must agree that it does: a `\"`
-#      there opens no quoted region at all. Only tokenise() knew that, so segmentation read
-#      the `"` as opening a region that never closed, went inert for every separator behind
-#      it, and let a real `sed -i` through as a mere argument — the fail-OPEN mirror of the
-#      false block above (objectstack#11131). The two passes now share the rule in both directions.
-#   4. shell COMMENTS are text, not commands — both quote-aware passes stop at an unquoted
-#      `#` that starts a WORD and resume at the next newline (objectstack#10570). A comment cannot
-#      write anything, so reading one as a command is a false BLOCK: prose arrows (`->`,
-#      `=>`) put a real `>` in operator position and the word after it was named as a write
-#      target, while a `;` in the same comment first split it into its own "segment".
-#      The word-start condition is the whole rule — `foo#bar`, `${x#y}`, `curl 'url/#frag'`,
-#      `sed 's/#//'` and `grep '#'` are NOT comments and are left exactly as they were. A
-#      comment never begins inside '…' or "…" (layer 1 owns those) nor inside a heredoc body
-#      (layer 2 has already dropped those lines before this pass runs).
-#
-# Redirection is recognised on ASCII operators ONLY — `>` `>>` `<` `<<` and their fd-prefixed
-# forms. No non-ASCII codepoint is ever an operator or an operator boundary, and this is
-# structural rather than a list to maintain: every byte of a non-ASCII UTF-8 codepoint is
-# >= 0x80, while `>` is 0x3e and `<` is 0x3c, so `→` (e2 86 92), `⇒` (e2 87 92) and `➜`
-# (e2 9e 9c) cannot collide with an operator byte-wise or character-wise. That matters
-# because `→` runs all through this repo's own AGENTS.md — one per Prime Directive clause,
-# and again in the state-classification rules — so echoing or grepping that prose must stay
-# allowed. The self-test pins both directions.
-#
-# Exit-code contract, mirroring both sibling hooks: 0 = allow, 2 = block with the reason on
-# stderr.
-#
-# Self-test (block + allow + hatch + fail-open + no-jq matrix, no network, no build):
-#   .claude/hooks/guard-main-checkout-bash.selftest.sh
-
-set -uo pipefail
-
-[ "${OS_ALLOW_MAIN_EDITS:-}" = "1" ] && exit 0
-
-input="$(cat 2>/dev/null || true)"
-cmd=""
-cwd=""
-if command -v jq >/dev/null 2>&1; then
-  cmd="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
-  cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
-fi
-if [ -z "$cmd" ]; then
-  # jq-less fallback: lift the JSON string value honouring backslash escapes (so an
-  # embedded \" does not truncate the command), then unescape what matters for shell text.
-  # Identical to guard-shared-stash.sh's fallback.
-  cmd="$(printf '%s' "$input" \
-    | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(\(\\.\|[^"\\]\)*\)".*/\1/p' \
-    | head -1 \
-    | sed 's/\\n/\n/g; s/\\t/ /g; s/\\"/"/g; s/\\\\/\\/g')"
-fi
-if [ -z "$cwd" ]; then
-  cwd="$(printf '%s' "$input" \
-    | sed -n 's/.*"cwd"[[:space:]]*:[[:space:]]*"\(\(\\.\|[^"\\]\)*\)".*/\1/p' \
-    | head -1 \
-    | sed 's/\\"/"/g; s/\\\\/\\/g')"
-fi
-
-[ -n "$cmd" ] || exit 0
-
-# --- an expansion inside "…" is its own quoting context --------------------------------
-# Inside "…", `$(`, a backtick or `${` opens a NEW quoting context: a `"` in the body starts a
-# string of its own and does not close the outer one. Each scanner below used to read that `"`
-# as the closer, so the rest of the body became bare shell, and a `>` in a quoted curl body was
-# taken for a redirect whose "target" was the next fragment — a false BLOCK (objectstack#24812);
-# the same reading of `echo "${x:-"a > b"}"` named `b}` as a target (objectstack#24901). All
-# three quote-aware scanners hand such a body to this ONE function, so they agree on where it
-# ends. guard-shared-stash.sh and guard-tree-enum.sh segment commands the same way and carry a
-# byte-identical copy; their self-tests fail when a copy differs from this one. (objectstack's
-# guard-process-kill.sh carries one too; it has no twin in this repo.)
-#
-# subst_end S I: when S[I] opens such a context (the `$` of a `$(` or a `${`, or a backtick),
-# sets SUBST_END to the index of the character that closes it and returns 0; otherwise returns 1
-# and changes nothing. The body is read with its own quotes, escapes and nesting; when the input
-# ends first, SUBST_END is the last index — the rest is one inert run (bash refuses such a
-# command anyway). The body is kept verbatim as part of the word, so a target holding it still
-# fails open on its `$`.
-#
-# A `${…}` body reads like "…" with one more closer: `"`, `$(`, `${` and a backtick nest in it,
-# a backslash escapes, and `}` closes it. A `'` there is where shells part ways, measured: bash
-# 5.2 reads `'…'` as a quoted run while it looks for the `}` (`"${x:-'}'}"` prints `'}'`), and
-# `bash --posix` and dash read the `'` as a literal. The two readings agree only when the run
-# holds none of `"` `\` `$` `}` or a backtick, so such a run is skipped, and any other `'` makes
-# the rest one inert run: an extent that depends on the shell is not one this guard can read.
-#
-# Boundary: a `(` or `)` bash would not count (a `case` pattern, a comment, an unquoted `${…}`
-# holding one) moves the end — too early, and the rest is read as it was before this function
-# existed; too late, and the text swallowed with the body is inert, i.e. fails open.
-SUBST_END=0
-subst_end() {
-  local s="$1" i="$2" n=${#1} st ch top run
-  case "${s:i:2}" in
-    '$(') st=')' ; i=$((i + 1)) ;;
-    '${') st='}' ; i=$((i + 1)) ;;
-    '`'*) st='`' ;;
-    *) return 1 ;;
-  esac
-  for ((i = i + 1; i < n; i++)); do
-    ch="${s:i:1}" ; top="${st:${#st}-1:1}"
-    if [ "$top" = "'" ]; then [ "$ch" = "'" ] && st="${st%?}"; continue; fi
-    if [ "$ch" = '\' ]; then i=$((i + 1)); continue; fi
-    if [ "$top" = '"' ] || [ "$top" = '}' ]; then
-      case "$ch" in
-        '"') if [ "$top" = '"' ]; then st="${st%?}"; else st+='"'; fi ;;
-        '`') st+='`' ;;
-        '$')
-          case "${s:i+1:1}" in
-            '(') st+=')' ; i=$((i + 1)) ;;
-            '{') st+='}' ; i=$((i + 1)) ;;
-          esac ;;
-        '}') [ "$top" = '}' ] && st="${st%?}" ;;
-        "'")
-          if [ "$top" = '}' ]; then
-            run="${s:i+1}"
-            case "$run" in *"'"*) ;; *) SUBST_END=$((n - 1)); return 0 ;; esac
-            run="${run%%"'"*}"
-            case "$run" in *[\"\\\`\$\}]*) SUBST_END=$((n - 1)); return 0 ;; esac
-            i=$((i + ${#run} + 1))
-          fi ;;
-      esac
-      if [ -z "$st" ]; then SUBST_END=$i; return 0; fi
-      continue
-    fi
-    case "$ch" in
-      "'" | '"') st+="$ch" ;;
-      '(') st+=')' ;;
-      ')') [ "$top" = ')' ] && st="${st%?}" ;;
-      '`') if [ "$top" = '`' ]; then st="${st%?}"; else st+='`'; fi ;;
-    esac
-    if [ -z "$st" ]; then SUBST_END=$i; return 0; fi
-  done
-  SUBST_END=$((n - 1))
-  return 0
-}
-
-# --- heredoc bodies are text, not commands ---------------------------------------------
-# `cat > /tmp/notes.md <<EOF` … `EOF` carries prose over several lines. Segmentation splits
-# on newlines, so without this pass a documented example inside the body ("sed -i … main
-# checkout") would be analysed as if the agent had run it. Drop body lines (and their
-# terminator); the introducing line — which is where the real redirection lives — stays.
-#
-# A `<<WORD` that is merely NAMED inside a COMMENT introduces nothing — bash removes the
-# comment before it ever looks for a heredoc. Reading one as a real introducer was fail-OPEN
-# and badly so: the delimiter never appeared on a line of its own, so the pending heredoc
-# was never satisfied and EVERY remaining line — including real commands — was dropped
-# before either quote-aware pass could see it (objectstack#11133).
-#
-# Only the DELIMITER SCAN consults the comment rule; the line itself is passed through
-# untouched, because both quote-aware passes already own that rule (objectstack#10570) and a second
-# implementation of it here is exactly how the two would drift.
-#
-# This is why the fix is a narrow scan-side truncation rather than a comment-stripping pass
-# run BEFORE this one: a heredoc BODY may contain an unbalanced apostrophe, and a quote-aware
-# comment scanner run over the raw text would desynchronise on it for every following line.
-# Body lines never reach this scan — they are consumed by the `pending` branch below and
-# `continue` before it — so that hazard is structurally out of reach here.
-#
-# Word-start rule, identical to split_segments()/tokenize(): a `#` opens a comment only where
-# a WORD could start — at line start, after a blank, or after one of `; | & ( ) > <`.
-strip_line_comment() {
-  local s="$1" n=${#1} i ch q="" word=0
-  for ((i = 0; i < n; i++)); do
-    ch="${s:i:1}"
-    if [ -n "$q" ]; then
-      if [ "$q" = '"' ] && [ "$ch" = '\' ] && [ $((i + 1)) -lt "$n" ]; then i=$((i + 1)); continue; fi
-      if [ "$q" = '"' ] && { [ "$ch" = '$' ] || [ "$ch" = '`' ]; } && subst_end "$s" "$i"; then
-        i=$SUBST_END ; continue
-      fi
-      [ "$ch" = "$q" ] && q=""
-      continue
-    fi
-    case "$ch" in
-      '#')
-        if [ "$word" = 0 ]; then printf '%s' "${s:0:i}" ; return ; fi
-        ;;                                        # foo#bar, ${x#y}, url/#frag
-      '\') i=$((i + 1)) ; word=1 ;;
-      "'" | '"') q="$ch" ; word=1 ;;
-      ';' | '|' | '&' | '(' | ')' | ' ' | $'\t' | '>' | '<') word=0 ;;
-      *) word=1 ;;
-    esac
-  done
-  printf '%s' "$s"
-}
-
-strip_heredocs() {
-  local s="$1" out="" line scan d t
-  local -a pending=()
-  while IFS= read -r line; do
-    if [ "${#pending[@]}" -gt 0 ]; then
-      t="${line#"${line%%[![:space:]]*}"}"    # ltrim, for the <<- form
-      if [ "$t" = "${pending[0]}" ] || [ "$line" = "${pending[0]}" ]; then
-        pending=("${pending[@]:1}")
-      fi
-      continue
-    fi
-    out+="$line"$'\n'
-    # A `<<WORD` behind an unquoted word-start `#` is prose, not an introducer (objectstack#11133).
-    scan="$(strip_line_comment "$line")"
-    # `<<<` is a herestring, not a heredoc — mask it before hunting for delimiters.
-    scan="${scan//<<</__OS_HERESTRING__}"
-    case "$scan" in
-      *'<<'*)
-        while IFS= read -r d; do
-          [ -n "$d" ] && pending+=("$d")
-        done < <(printf '%s\n' "$scan" \
-          | grep -oE "<<-?[[:space:]]*(\"[^\"]*\"|'[^']*'|[A-Za-z_][A-Za-z0-9_]*)" 2>/dev/null \
-          | sed -E "s/^<<-?[[:space:]]*//; s/^[\"']//; s/[\"']$//")
-        ;;
-    esac
-  done <<<"$s"
-  printf '%s' "$out"
-}
-
-# --- split the command into shell segments, honouring quotes ---------------------------
-# Verbatim from guard-shared-stash.sh. A separator inside '…' or "…" does NOT split, so
-# writing *about* the ban is never caught by the ban. The same goes for a separator inside
-# a COMMENT: `word` tracks whether the next character would open a new WORD, which is the
-# only position where an unquoted `#` begins a comment — the comment then runs to the next
-# newline and never splits, tokenises or contributes a target (objectstack#10570).
-#
-# What resets `word` is exactly what delimits a word in the shell: start of input, blank,
-# and the metacharacters `; | & ( ) newline > <`. `{` and `}` do NOT — they are reserved
-# words rather than metacharacters, so `#` right after one continues the word. That is not
-# cosmetic: this pass splits on `{`/`}` anyway, and treating the `#` of `${#arr[@]}` as a
-# comment would swallow the rest of the line — including a real redirect behind it.
-segments=()
-split_segments() {
-  local s="$1" seg="" q="" ch i n=${#1} word=0
-  for ((i = 0; i < n; i++)); do
-    ch="${s:i:1}"
-    if [ -n "$q" ]; then
-      if [ "$q" = '"' ] && [ "$ch" = '\' ] && [ $((i + 1)) -lt "$n" ]; then
-        case "${s:i+1:1}" in
-          '"' | '\' | '$' | '`')
-            seg+="$ch" ; i=$((i + 1)) ; seg+="${s:i:1}" ; continue ;;
-        esac
-      fi
-      if [ "$q" = '"' ] && { [ "$ch" = '$' ] || [ "$ch" = '`' ]; } && subst_end "$s" "$i"; then
-        seg+="${s:i:SUBST_END-i+1}" ; i=$SUBST_END ; continue
-      fi
-      seg+="$ch"
-      [ "$ch" = "$q" ] && q=""
-      continue
-    fi
-    case "$ch" in
-      '#')
-        if [ "$word" = 0 ]; then
-          # comment: skip to (not past) the newline, which still separates as usual
-          while [ $((i + 1)) -lt "$n" ] && [ "${s:i+1:1}" != $'\n' ]; do i=$((i + 1)); done
-          continue
-        fi
-        seg+="$ch"                                   # foo#bar, ${x#y}, url/#frag
-        ;;
-      '\')
-        # Outside quotes a backslash escapes the NEXT character, so an escaped `\"` does NOT
-        # open a quoted region. tokenize() has always had this branch; this pass did not, and
-        # the disagreement was a fail-OPEN hole: the `"` after the backslash opened a quote
-        # here that never closed, every later separator went inert, the whole command
-        # collapsed into one `echo` segment, and a real `sed -i` behind it was just another
-        # argument (objectstack#11131). Both characters are kept verbatim — this pass only SPLITS, and
-        # tokenize() re-reads the escape when it strips quoting.
-        seg+="$ch"
-        if [ $((i + 1)) -lt "$n" ]; then i=$((i + 1)) ; seg+="${s:i:1}" ; fi
-        word=1
-        ;;
-      "'" | '"') q="$ch" ; seg+="$ch" ; word=1 ;;
-      ';' | '|' | '&' | '(' | ')' | $'\n') segments+=("$seg") ; seg="" ; word=0 ;;
-      '{' | '}') segments+=("$seg") ; seg="" ; word=1 ;;
-      ' ' | $'\t') seg+="$ch" ; word=0 ;;
-      '>' | '<') seg+="$ch" ; word=0 ;;
-      *) seg+="$ch" ; word=1 ;;
-    esac
-  done
-  segments+=("$seg")
-}
-
-# --- tokenise ONE segment, quote-aware -------------------------------------------------
-# guard-shared-stash.sh only ever reads a segment's first word, so plain word splitting is
-# enough there. Here the whole argument list matters, and `read -r -a` would promote a
-# QUOTED ">" or "sed -i" to a real operator/command — exactly the false positive that makes
-# a guard get disabled. So: quotes are stripped and their contents are inert.
-# A comment is inert here too: `have` is already the "a word is open" flag, so an unquoted
-# `#` with have=0 is at word start and begins a comment (objectstack#10570). `foo#bar` and
-# `${x#y}` reach this point with have=1 and stay part of the token.
-# TOK[] = token values (unquoted); TOP[] = "op" for an unquoted redirection operator.
-TOK=(); TOP=()
-tokenize() {
-  TOK=(); TOP=()
-  local s="$1" n=${#1} i ch q="" tok="" have=0 op
-  for ((i = 0; i < n; i++)); do
-    ch="${s:i:1}"
-    if [ -n "$q" ]; then
-      if [ "$q" = '"' ] && [ "$ch" = '\' ] && [ $((i + 1)) -lt "$n" ]; then
-        case "${s:i+1:1}" in
-          '"' | '\' | '$' | '`')
-            i=$((i + 1)) ; tok+="${s:i:1}" ; have=1 ; continue ;;
-        esac
-      fi
-      if [ "$q" = '"' ] && { [ "$ch" = '$' ] || [ "$ch" = '`' ]; } && subst_end "$s" "$i"; then
-        tok+="${s:i:SUBST_END-i+1}" ; i=$SUBST_END ; have=1 ; continue
-      fi
-      if [ "$ch" = "$q" ]; then q=""; else tok+="$ch"; fi
-      have=1
-      continue
-    fi
-    case "$ch" in
-      '#')
-        if [ "$have" = 0 ]; then
-          # word-start `#`: comment, inert to the next newline
-          while [ $((i + 1)) -lt "$n" ] && [ "${s:i+1:1}" != $'\n' ]; do i=$((i + 1)); done
-          continue
-        fi
-        tok+="$ch"
-        ;;
-      "'" | '"') q="$ch" ; have=1 ;;
-      '\')
-        i=$((i + 1))
-        if [ "$i" -lt "$n" ]; then tok+="${s:i:1}" ; have=1 ; fi
-        ;;
-      ' ' | $'\t')
-        if [ "$have" = 1 ]; then TOK+=("$tok") ; TOP+=("") ; tok="" ; have=0 ; fi
-        ;;
-      '>' | '<')
-        # a bare leading fd ("2>") belongs to the operator, not to the previous word
-        if [ "$have" = 1 ] && [[ ! "$tok" =~ ^[0-9]+$ ]]; then
-          TOK+=("$tok") ; TOP+=("")
-        fi
-        tok="" ; have=0
-        op="$ch"
-        while [ $((i + 1)) -lt "$n" ] && [ "${s:i+1:1}" = "$ch" ]; do op+="$ch" ; i=$((i + 1)) ; done
-        TOK+=("$op") ; TOP+=("op")
-        ;;
-      *) tok+="$ch" ; have=1 ;;
-    esac
-  done
-  if [ "$have" = 1 ]; then TOK+=("$tok") ; TOP+=("") ; fi
-}
-
-# --- the repo predicate, identical to guard-main-checkout.sh's ------------------------
-# Canonicalise an existing directory to its physical absolute path, so both sides of the
-# comparison below are spelled the same way: git prints the common-dir RELATIVE, and some
-# hosts hand out symlinked temp dirs.
-canon_dir() { ( cd "$1" 2>/dev/null && pwd -P ) || printf '%s' "$1"; }
-
-# 0 = this target lands in a shared primary checkout (block it), 1 = fine / unknowable.
-target_is_shared_checkout() {
-  local p="$1" d gitdir commondir
-  [ -n "$p" ] || return 1
-  [ "$p" = "-" ] && return 1                 # stdout, not a file
-
-  # Unresolvable without executing the command: expansions, command substitution, globs,
-  # tilde. Fail OPEN rather than guess a path.
-  case "$p" in
-    *'$'* | *'`'* | *'*'* | *'?'* | '~'* | *'['*) return 1 ;;
-  esac
-
-  if [ "${p#/}" = "$p" ]; then
-    # relative: needs a cwd we actually know
-    [ -n "$cwd" ] || return 1
-    p="$cwd/$p"
-  fi
-
-  d="$(dirname "$p")"
-  while [ -n "$d" ] && [ "$d" != "/" ] && [ ! -d "$d" ]; do d="$(dirname "$d")"; done
-  [ -d "$d" ] || return 1
-
-  # A linked worktree's git-dir (.git/worktrees/NAME) differs from its git-COMMON-dir
-  # (.git); a primary checkout has the two equal, and so does a submodule. Structural, so it
-  # holds whatever the path is spelled like — the `*/worktrees/*` substring match it replaces
-  # did not (#7259). --git-common-dir prints RELATIVE to $d, so resolve it against $d first or
-  # the guard fails open at EVERY depth.
-  gitdir="$(git -C "$d" rev-parse --absolute-git-dir 2>/dev/null)" || return 1
-  commondir="$(git -C "$d" rev-parse --git-common-dir 2>/dev/null)" || return 1
-  case "$commondir" in /*) ;; *) commondir="$d/$commondir" ;; esac
-  [ "$(canon_dir "$gitdir")" != "$(canon_dir "$commondir")" ] && return 1
-  return 0
-}
-
-# --- write-target extraction ------------------------------------------------------------
-# Fills TARGETS[] with the paths a segment would WRITE. Empty = nothing recognised.
-TARGETS=()
-
-is_opt() { case "$1" in -?*) return 0 ;; *) return 1 ;; esac; }
-
-# sed/perl in-place flag: `-i`, `-i.bak`, `--in-place[=SUF]`, or an all-lowercase short
-# cluster containing i (`-ri`, `-pi`). The all-lowercase rule keeps perl's `-Ilib` out.
-is_inplace_flag() {
-  case "$1" in
-    --in-place | --in-place=*) return 0 ;;
-    -i*) return 0 ;;
-  esac
-  [[ "$1" =~ ^-[a-z]+$ ]] && [[ "$1" == *i* ]] && return 0
-  return 1
-}
-
-collect_targets() {
-  TARGETS=()
-  local -a w=()
-  local i n j
-
-  # drop redirection operators and their targets, so w[] is the plain argv
-  n=${#TOK[@]}
-  for ((i = 0; i < n; i++)); do
-    if [ "${TOP[$i]}" = "op" ]; then
-      case "${TOK[$i]}" in
-        '>' | '>>')
-          # the redirection itself is a write; record its target
-          j=$((i + 1))
-          if [ "$j" -lt "$n" ] && [ "${TOP[$j]}" != "op" ]; then TARGETS+=("${TOK[$j]}"); fi
-          ;;
-      esac
-      # skip the operator and, when present, its filename/delimiter operand
-      j=$((i + 1))
-      if [ "$j" -lt "$n" ] && [ "${TOP[$j]}" != "op" ]; then i=$j; fi
-      continue
-    fi
-    w+=("${TOK[$i]}")
-  done
-
-  n=${#w[@]}
-  i=0
-  [ "$n" -gt 0 ] || return 0
-
-  # leading FOO=bar environment assignments
-  while [ "$i" -lt "$n" ]; do
-    case "${w[$i]}" in
-      [A-Za-z_][A-Za-z0-9_]*=*) i=$((i + 1)) ;;
-      *) break ;;
-    esac
-  done
-  [ "$i" -lt "$n" ] || return 0
-
-  local cmdname="${w[$i]##*/}"
-  i=$((i + 1))
-
-  case "$cmdname" in
-    sed | perl)
-      local inplace=0 explicit_script=0 script_taken=0 rest=0
-      local -a files=()
-      for ((j = i; j < n; j++)); do
-        local a="${w[$j]}"
-        if [ "$rest" = 0 ]; then
-          if [ "$a" = "--" ]; then rest=1; continue; fi
-          if is_opt "$a"; then
-            is_inplace_flag "$a" && inplace=1
-            case "$a" in
-              -e* | -f* | --expression* | --file*) explicit_script=1 ;;
-            esac
-            case "$a" in
-              -e | -f | -E | -I | -M | -m | -F | --expression | --file) j=$((j + 1)) ;;
-            esac
-            continue
-          fi
-        fi
-        if [ "$explicit_script" = 0 ] && [ "$script_taken" = 0 ]; then
-          script_taken=1                      # the s/// script itself, not a file
-          continue
-        fi
-        files+=("$a")
-      done
-      # without an in-place flag, sed/perl write to stdout — only a redirection writes, and
-      # that is already in TARGETS.
-      if [ "$inplace" = 1 ] && [ "${#files[@]}" -gt 0 ]; then TARGETS+=("${files[@]}"); fi
-      ;;
-
-    tee)
-      # every non-option operand is written to (-a only chooses append vs truncate)
-      for ((j = i; j < n; j++)); do
-        [ "${w[$j]}" = "--" ] && continue
-        is_opt "${w[$j]}" && continue
-        TARGETS+=("${w[$j]}")
-      done
-      ;;
-
-    cp | mv)
-      # destination = -t DIR when given, else the last operand
-      local -a ops=()
-      local tdir="" rest2=0
-      for ((j = i; j < n; j++)); do
-        local a="${w[$j]}"
-        if [ "$rest2" = 0 ]; then
-          if [ "$a" = "--" ]; then rest2=1; continue; fi
-          case "$a" in
-            -t | --target-directory)
-              j=$((j + 1)); [ "$j" -lt "$n" ] && tdir="${w[$j]}"; continue ;;
-            --target-directory=*) tdir="${a#*=}" ; continue ;;
-            -S | --suffix) j=$((j + 1)); continue ;;
-          esac
-          is_opt "$a" && continue
-        fi
-        ops+=("$a")
-      done
-      if [ -n "$tdir" ]; then
-        TARGETS+=("$tdir")
-      elif [ "${#ops[@]}" -ge 2 ]; then
-        TARGETS+=("${ops[$((${#ops[@]} - 1))]}")
-      fi
-      ;;
-
-    rm)
-      local rest3=0
-      for ((j = i; j < n; j++)); do
-        if [ "$rest3" = 0 ]; then
-          if [ "${w[$j]}" = "--" ]; then rest3=1; continue; fi
-          is_opt "${w[$j]}" && continue
-        fi
-        TARGETS+=("${w[$j]}")
-      done
-      ;;
-
-    touch)
-      local rest4=0
-      for ((j = i; j < n; j++)); do
-        local a="${w[$j]}"
-        if [ "$rest4" = 0 ]; then
-          if [ "$a" = "--" ]; then rest4=1; continue; fi
-          case "$a" in
-            -r | --reference | -d | --date | -t) j=$((j + 1)); continue ;;
-          esac
-          is_opt "$a" && continue
-        fi
-        TARGETS+=("$a")
-      done
-      ;;
-  esac
-}
-
-# --- track `cd` so relative targets resolve the way the shell would --------------------
-# `cd /home/user/objectui && tee packages/a.ts` writes to the shared checkout even though
-# the token is relative. Known boundary: a `cd` inside a subshell is treated as sticky,
-# because segmentation does not report WHICH separator it split on.
-maybe_cd() {
-  local i=0 n=${#TOK[@]}
-  local -a plain=()
-  for ((i = 0; i < n; i++)); do
-    [ "${TOP[$i]}" = "op" ] && continue
-    plain+=("${TOK[$i]}")
-  done
-  n=${#plain[@]}
-  [ "$n" -ge 2 ] || return 0
-  [ "${plain[0]##*/}" = "cd" ] || return 0
-  local d="${plain[1]}"
-  case "$d" in
-    -* ) return 0 ;;
-    *'$'* | *'`'* | *'*'* | '~'* ) cwd="" ; return 0 ;;   # unknowable from here on
-  esac
-  if [ "${d#/}" = "$d" ]; then
-    [ -n "$cwd" ] || return 0
-    d="$cwd/$d"
-  fi
-  cwd="$d"
-}
-
-# --- main -------------------------------------------------------------------------------
-split_segments "$(strip_heredocs "$cmd")"
-
-for seg in "${segments[@]}"; do
-  case "$seg" in *[![:space:]]*) ;; *) continue ;; esac
-  tokenize "$seg"
-  [ "${#TOK[@]}" -gt 0 ] || continue
-
-  collect_targets
-  [ "${#TARGETS[@]}" -gt 0 ] || { maybe_cd ; continue ; }
-  for t in "${TARGETS[@]}"; do
-    if target_is_shared_checkout "$t"; then
-      offending="${seg#"${seg%%[![:space:]]*}"}"
-      abs="$t"
-      [ "${abs#/}" = "$abs" ] && abs="$cwd/$t"
-      root="$(git -C "$(dirname "$abs")" rev-parse --show-toplevel 2>/dev/null || printf '%s' "$abs")"
-      name="$(basename "$root")"
-      cat >&2 <<EOF
-⛔ Blocked: this Bash command WRITES into the shared PRIMARY checkout, not a worktree.
-   command: $offending
-   target:  $t
-   repo:    $root
-
-Same rule as guard-main-checkout.sh — that hook is registered on Edit|Write|NotebookEdit
-only, so the identical edit expressed as a shell command used to slip through in silence
-(objectui#3435). This repo is edited by multiple agents at once: the shared checkout gets
-its HEAD switched and its tree reset under you, clobbering uncommitted work. A feature
-branch on the shared checkout is NOT enough; you need a dedicated worktree:
-
-  git fetch origin main && git worktree add --no-track ../${name}-<task> -b <branch> origin/main
-  cd ../${name}-<task> && pnpm install    # then re-run the command there
-
-Always fine, no flag needed:
-  reads of the shared checkout   grep / cat FILE / ls / git -C <main> grep …
-  writes into a linked worktree  sed -i … ../${name}-<task>/packages/…
-  writes outside any repo        /tmp/…, the scratchpad, \$HOME dotfiles
-
-Deliberate non-task exception: set OS_ALLOW_MAIN_EDITS=1 in the
-environment this hook itself runs in — a local settings "env" entry, or whatever this
-agent process was started with. A VAR=1 prefix on a command sets it for that command
-only, and this hook is not that command, so a prefix never reaches it.
-EOF
-      exit 2
-    fi
-  done
-
-  maybe_cd
-done
-
-exit 0
diff --git a/ui/.claude/hooks/guard-main-checkout.selftest.sh b/ui/.claude/hooks/guard-main-checkout.selftest.sh
deleted file mode 100755
index f5008b3b887..00000000000
--- a/ui/.claude/hooks/guard-main-checkout.selftest.sh
+++ /dev/null
@@ -1,473 +0,0 @@
-#!/usr/bin/env bash
-# copied from objectstack@70e77ec3b566b92d7c6551637d6bc746fb840bb6
-# Self-test for guard-main-checkout.sh — run it after touching that hook:
-#
-#   .claude/hooks/guard-main-checkout.selftest.sh
-#
-# Feeds the hook the same JSON payload shape Claude Code delivers on PreToolUse and asserts
-# the block/allow verdict per case. Hermetic: it builds its OWN throwaway git repos, a linked
-# worktree of each and a non-repo directory under $TMPDIR, so the matrix never depends on
-# which machine or which checkout it runs from. Needs jq and git and nothing else — no
-# install, no build, no network. Exit 0 = all cases hold.
-#
-# Companion to guard-main-checkout-bash.selftest.sh, which covers the Bash half of the same
-# worktree-first pair. That matrix is mostly SHELL SPLITTING; this hook parses no shell at
-# all — it picks the payload's path key from the tool that sent it and makes a
-# PATH-AND-WORKTREE decision — so these cases are derived from what this hook actually
-# decides, not ported from the sibling.
-# PORTED from objectstack's copy of this matrix (objectstack-ai/objectstack, .claude/hooks/
-# guard-main-checkout.selftest.sh @ d63c8a2) under objectui#6451, and the port is VERBATIM:
-# the two repos' guard-main-checkout.sh differ by 10 diff lines that are all inside comment
-# blocks, no executable line differs, and both settings.json route the identical
-# Edit|Write|NotebookEdit matcher — so the sibling file was first run here BYTE-FOR-BYTE
-# unmodified (via the two env vars below) and returned 87 passed, 0 failed. Not one case
-# needed adapting. The only edit below the header is the `worktrees`-segment section, whose
-# issue reference is re-pointed at this repo's own card for the same defect.
-# ⛔ Keep the two copies converged: a case that has to differ is evidence the HOOKS have
-# drifted, and that drift is the finding — not something to paper over here.
-#
-# Fail-open by default, on purpose: the process cwd AND CLAUDE_PROJECT_DIR both default to a
-# directory in no repo at all, which is the input on which this hook allows everything. A
-# case that expects `block` therefore cannot pass by accident — the verdict can only have
-# come from the path in the payload. Sections that need a different default say so.
-#
-# GUARD_MAIN_CHECKOUT_HOOK points the matrix at a scratch copy of the hook, and
-# GUARD_MAIN_CHECKOUT_SETTINGS at a scratch copy of settings.json; that is how the mutation
-# runs that prove these cases can fail are driven (see NON-VACUITY at the foot of this file).
-# Both default to the real files, so a plain invocation checks the real hook and real wiring.
-
-set -uo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-hook="${GUARD_MAIN_CHECKOUT_HOOK:-$here/guard-main-checkout.sh}"
-settings="${GUARD_MAIN_CHECKOUT_SETTINGS:-$here/../settings.json}"
-pass=0
-fail=0
-skip=0
-
-command -v jq >/dev/null 2>&1 || { echo "selftest needs jq to build payloads" >&2; exit 1; }
-command -v git >/dev/null 2>&1 || { echo "selftest needs git to build the fixture" >&2; exit 1; }
-[ -x "$hook" ] || { echo "hook not executable: $hook" >&2; exit 1; }
-
-# --- fixture ---------------------------------------------------------------------------
-# MAIN   a shared PRIMARY checkout            WT     a linked worktree of MAIN
-# SIB    a SECOND primary checkout            SIBWT  a linked worktree of SIB
-# PLAIN  a directory inside no repo at all    ODD    a PRIMARY checkout whose own path
-#                                                    carries a literal `worktrees` segment
-tmp="$(mktemp -d)"
-nojq=""
-trap 'rm -rf "$tmp" ${nojq:+"$nojq"}' EXIT INT TERM
-MAIN="$tmp/mainrepo"
-WT="$tmp/mainrepo-task"
-SIB="$tmp/siblingrepo"
-SIBWT="$tmp/siblingrepo-task"
-PLAIN="$tmp/plain"
-ODD="$tmp/worktrees/oddrepo"
-mkdir -p "$MAIN/pkg/deep" "$SIB/pkg" "$PLAIN" "$ODD/pkg"
-(
-  for r in "$MAIN" "$SIB" "$ODD"; do
-    cd "$r" || exit 1
-    git init -q .
-    git config user.email selftest@example.com
-    git config user.name selftest
-    : > README.md
-    mkdir -p pkg
-    : > pkg/x.ts
-    : > pkg/x.ipynb
-    git add -A
-    git commit -qm init
-  done
-  cd "$MAIN" && git worktree add -q "$WT" -b selftest-wt
-  cd "$SIB" && git worktree add -q "$SIBWT" -b selftest-sib-wt
-) >/dev/null 2>&1 || { echo "could not build the git fixture" >&2; exit 1; }
-
-CWD="$PLAIN"    # the hook's PROCESS cwd for the cases that follow; reassigned per section
-PROJ="$PLAIN"   # CLAUDE_PROJECT_DIR for the cases that follow; reassigned per section
-
-short() { # short <text> -> fixture paths rendered as their variable names
-  local s="$1"
-  # longest paths first: $WT and $SIBWT have $MAIN and $SIB as prefixes
-  s="${s//$SIBWT/\$SIBWT}"; s="${s//$WT/\$WT}"; s="${s//$SIB/\$SIB}"
-  s="${s//$MAIN/\$MAIN}"; s="${s//$PLAIN/\$PLAIN}"; s="${s//$ODD/\$ODD}"
-  s="${s//$tmp/\$tmp}"
-  printf '%s' "$s"
-}
-
-verdict() { # verdict <payload> [env…] -> block | allow | exitN
-  local payload="$1"; shift
-  local rc
-  ( cd "$CWD" && printf '%s' "$payload" | env CLAUDE_PROJECT_DIR="$PROJ" "$@" "$hook" >/dev/null 2>&1 )
-  rc=$?
-  case "$rc" in
-    0) printf 'allow' ;;
-    2) printf 'block' ;;
-    *) printf 'exit%s' "$rc" ;;
-  esac
-}
-
-check() { # check <block|allow> <label> <payload> [env…]
-  local want="$1" label="$2" payload="$3"; shift 3
-  local got; got="$(verdict "$payload" "$@")"
-  if [ "$got" = "$want" ]; then
-    pass=$((pass + 1)); printf '  ok   %-5s  %s\n' "$got" "$(short "$label")"
-  else
-    fail=$((fail + 1)); printf '  FAIL want=%s got=%s  %s\n' "$want" "$got" "$(short "$label")"
-  fi
-}
-
-payload() { # payload <file_path> [tool_name] -> the Edit/Write payload shape
-  jq -nc --arg f "$1" --arg t "${2:-Edit}" \
-    '{session_id:"selftest",cwd:"/payload-cwd-must-be-ignored",tool_name:$t,
-      tool_input:{file_path:$f,old_string:"a",new_string:"b"}}'
-}
-
-nbpay() { # nbpay <notebook_path> [tool_name] -> the NotebookEdit payload shape
-  # Matches the tool's documented input schema: notebook_path (absolute, required) and
-  # new_source, with no file_path key anywhere in the payload.
-  jq -nc --arg f "$1" --arg t "${2:-NotebookEdit}" \
-    '{session_id:"selftest",cwd:"/payload-cwd-must-be-ignored",tool_name:$t,
-      tool_input:{notebook_path:$f,new_source:"x",edit_mode:"replace"}}'
-}
-
-expect() { # expect <block|allow> <file_path> [env…] — the common case
-  local want="$1" f="$2"; shift 2
-  check "$want" "$f" "$(payload "$f")" "$@"
-}
-
-stderr_of() { # stderr_of <payload> [env…] -> the refusal text an agent actually reads
-  local payload="$1"; shift
-  ( cd "$CWD" && printf '%s' "$payload" | env CLAUDE_PROJECT_DIR="$PROJ" "$@" "$hook" 2>&1 >/dev/null )
-}
-
-says() { # says <needle> <label> <payload> [env…]
-  local needle="$1" label="$2" subject="$3"; shift 3
-  local out; out="$(stderr_of "$subject" "$@")"
-  case "$out" in
-    *"$needle"*) pass=$((pass + 1)); printf '  ok   says   %s\n' "$label" ;;
-    *) fail=$((fail + 1)); printf '  FAIL missing "%s"  %s\n' "$needle" "$label" ;;
-  esac
-}
-
-lacks() { # lacks <needle> <label> <payload> [env…]
-  # The direction only an ABSENCE assertion can hold: a remedy that stopped being true stays
-  # in the text a reader acts on long after the thing it described stopped working.
-  local needle="$1" label="$2" subject="$3"; shift 3
-  local out; out="$(stderr_of "$subject" "$@")"
-  case "$out" in
-    *"$needle"*) fail=$((fail + 1)); printf '  FAIL still says "%s"  %s\n' "$needle" "$label" ;;
-    *) pass=$((pass + 1)); printf '  ok   lacks  %s\n' "$label" ;;
-  esac
-}
-
-echo "== the core verdict: shared PRIMARY checkout is blocked =="
-expect block "$MAIN/pkg/x.ts"
-expect block "$MAIN/pkg/deep/y.ts"
-expect block "$MAIN/README.md"          # repo ROOT: git prints a RELATIVE git-dir here
-expect block "$MAIN/.changeset/x.md"
-expect block "$MAIN/pkg/x.ipynb"
-
-echo "== the SAME files inside a linked worktree are allowed =="
-# The POSITIVE twin of the `worktrees`-segment section below. $WT is a REAL linked worktree
-# (`git worktree add`) whose path carries NO `worktrees` segment, so these allows can only
-# come from the structural test and never from the path's spelling. Both depths are pinned
-# below — the repo toplevel and a subdirectory — because git answers them differently.
-expect allow "$WT/pkg/x.ts"
-expect allow "$WT/pkg/deep/y.ts"
-expect allow "$WT/README.md"
-expect allow "$WT/pkg/x.ipynb"
-
-echo "== files in no repo at all are allowed (scratchpad, /tmp, \$HOME dotfiles) =="
-expect allow "$PLAIN/notes.md"
-expect allow "$PLAIN/deep/er/still.md"
-expect allow "/tmp/os-selftest-scratch.log"
-
-echo "== new files in not-yet-created directories: judged by the nearest EXISTING ancestor =="
-# The hook walks up until it finds a directory that exists. Without that walk `git -C` would
-# fail on the missing directory and the guard would fail open past exactly the case that
-# matters most — writing a brand-new file into the shared checkout.
-expect block "$MAIN/brand/new/tree/file.ts"
-expect block "$MAIN/pkg/deep/brand/new/file.ts"
-expect allow "$WT/brand/new/tree/file.ts"
-expect allow "$PLAIN/brand/new/tree/file.ts"
-
-echo "== the EDITED FILE's own repo decides — sibling repos are guarded from any session =="
-# CLAUDE_PROJECT_DIR is pointed at the WRONG repo in every case here, so a hook that judged
-# the session instead of the file would get all four backwards.
-PROJ="$WT"
-expect block "$SIB/pkg/x.ts"
-expect block "$MAIN/pkg/x.ts"
-PROJ="$MAIN"
-expect allow "$SIBWT/pkg/x.ts"
-expect allow "$PLAIN/notes.md"
-PROJ="$SIB"
-expect block "$MAIN/pkg/x.ts"
-expect allow "$WT/pkg/x.ts"
-PROJ="$PLAIN"
-
-echo "== tool_name selects the path key — one row per tool, and the matcher is its pair =="
-# tool_name is consulted for exactly one thing: which key of tool_input holds the path. The
-# verdict itself still comes from the path alone. Tools the table names are read for their
-# own key; a tool it does not name is not routed here by the matcher, and keeps the
-# permissive read — any known key it happens to carry, else the session's dir.
-for t in Edit Write MultiEdit; do
-  check block "tool_name=$t (file_path) into \$MAIN"  "$(payload "$MAIN/pkg/x.ts" "$t")"
-  check allow "tool_name=$t (file_path) into \$WT"    "$(payload "$WT/pkg/x.ts" "$t")"
-done
-check block 'tool_name=NotebookEdit (notebook_path) into $MAIN' "$(nbpay "$MAIN/pkg/x.ipynb")"
-check allow 'tool_name=NotebookEdit (notebook_path) into $WT'   "$(nbpay "$WT/pkg/x.ipynb")"
-check block 'unrouted tool carrying file_path, into $MAIN'      "$(payload "$MAIN/pkg/x.ts" AnythingElse)"
-check allow 'unrouted tool carrying file_path, into $WT'        "$(payload "$WT/pkg/x.ts" AnythingElse)"
-check block 'unrouted tool carrying notebook_path, into $MAIN'  "$(nbpay "$MAIN/pkg/x.ipynb" AnythingElse)"
-check allow 'unrouted tool carrying notebook_path, into $WT'    "$(nbpay "$WT/pkg/x.ipynb" AnythingElse)"
-
-echo "== escape hatch: OS_ALLOW_MAIN_EDITS must be exactly 1 =="
-check allow 'OS_ALLOW_MAIN_EDITS=1  into $MAIN'    "$(payload "$MAIN/pkg/x.ts")" OS_ALLOW_MAIN_EDITS=1
-check allow 'OS_ALLOW_MAIN_EDITS=1  into $SIB'     "$(payload "$SIB/pkg/x.ts")"  OS_ALLOW_MAIN_EDITS=1
-check block 'OS_ALLOW_MAIN_EDITS=0'                "$(payload "$MAIN/pkg/x.ts")" OS_ALLOW_MAIN_EDITS=0
-check block 'OS_ALLOW_MAIN_EDITS=(empty)'          "$(payload "$MAIN/pkg/x.ts")" OS_ALLOW_MAIN_EDITS=
-check block 'OS_ALLOW_MAIN_EDITS=true'             "$(payload "$MAIN/pkg/x.ts")" OS_ALLOW_MAIN_EDITS=true
-check block 'OS_ALLOW_MAIN_EDITS=yes'              "$(payload "$MAIN/pkg/x.ts")" OS_ALLOW_MAIN_EDITS=yes
-check block 'OS_ALLOW_MAIN_EDITS=11'               "$(payload "$MAIN/pkg/x.ts")" OS_ALLOW_MAIN_EDITS=11
-check block 'OS_ALLOW_MAIN_EDITS=" 1" (padded)'    "$(payload "$MAIN/pkg/x.ts")" OS_ALLOW_MAIN_EDITS=" 1"
-
-echo "== the hatch names WHERE it works: this hook's own environment, never a prefix =="
-# The refusal used to end by telling the reader to re-run the same thing with the variable
-# as a VAR=1 command prefix — an instruction that cannot work where it is printed. A VAR=1
-# prefix sets the variable in the environment of THAT COMMAND; this hook is not that
-# command, and it reads the variable from its own environment, so the prefix changes
-# nothing and the refusal repeats (#15971). An instruction that does not work is an
-# invitation to route around the guard, so both directions are pinned: the dead remedy is
-# gone, and the sentence names the environment the hook actually reads. The `allow` rows
-# next door — the variable really in the hook's environment — are this pair's other half.
-# Both of this hook's message sites carry the sentence: the ordinary refusal and the
-# schema-drift refusal, which is why each is asserted separately here.
-CWD="$PLAIN"; PROJ="$PLAIN"
-lacks 're-run with' 'the block message no longer prints the prefix remedy' \
-  "$(payload "$MAIN/pkg/x.ts")"
-says 'hook itself runs in' 'the block message names the environment this hook reads' \
-  "$(payload "$MAIN/pkg/x.ts")"
-lacks 're-run with' 'the drift message no longer prints the prefix remedy' \
-  '{"tool_name":"Edit","tool_input":{}}'
-says 'hook itself runs in' 'the drift message names the environment this hook reads' \
-  '{"tool_name":"Edit","tool_input":{}}'
-
-echo "== a ROUTED tool whose payload lacks its own path key is drift — it blocks, never guesses =="
-# The dangerous branch is the one that turns an unreadable payload into a confident verdict.
-# For a tool this guard is routed, an absent path key is not "no path given", it is the
-# tool's schema moving under the guard — and judging the session's dir instead would answer
-# the same way all session long, right or wrong by where that session is rooted. Every row
-# here is run with CLAUDE_PROJECT_DIR pointed somewhere that would ALLOW under a fallback,
-# except the first of each trio, so a passing `block` can only have come from the drift arm.
-for probe in \
-  '{"tool_name":"Edit","tool_input":{}}' \
-  '{"tool_name":"Write","tool_input":{"content":"x"}}' \
-  '{"tool_name":"NotebookEdit","tool_input":{"new_source":"x","edit_mode":"replace"}}'
-do
-  PROJ="$MAIN";  check block "routed tool, no path key, CLAUDE_PROJECT_DIR=\$MAIN  [$probe]"  "$probe"
-  PROJ="$WT";    check block "routed tool, no path key, CLAUDE_PROJECT_DIR=\$WT    [$probe]"  "$probe"
-  PROJ="$PLAIN"; check block "routed tool, no path key, CLAUDE_PROJECT_DIR=\$PLAIN [$probe]"  "$probe"
-done
-PROJ="$PLAIN"
-# the cross-key pair: the right tool, the other tool's key. Drift in both directions.
-check block 'NotebookEdit carrying file_path (the wrong key), into $WT' "$(payload "$WT/pkg/x.ipynb" NotebookEdit)"
-check block 'Edit carrying notebook_path (the wrong key), into $WT'     "$(nbpay "$WT/pkg/x.ipynb" Edit)"
-
-echo "== an UNROUTED payload carrying no usable path is judged by CLAUDE_PROJECT_DIR — fails CLOSED =="
-# The remaining no-path branch: nothing in the payload names a tool this guard knows, so
-# there is no contract to have drifted. It is the opposite posture from the Bash sibling
-# (which fails open on an unparseable command): here an unreadable payload on the shared
-# checkout still BLOCKS. Safe direction, and deliberate — an explicit `else`, not a
-# fall-through.
-for probe in '{}' 'not json at all' '' '{"tool_input":{"file_path":""}}' '{"tool_name":"AnythingElse","tool_input":{}}'; do
-  PROJ="$MAIN"; check block "no usable path, CLAUDE_PROJECT_DIR=\$MAIN  [$probe]" "$probe"
-  PROJ="$WT";   check allow "no usable path, CLAUDE_PROJECT_DIR=\$WT    [$probe]" "$probe"
-  PROJ="$PLAIN"; check allow "no usable path, CLAUDE_PROJECT_DIR=\$PLAIN [$probe]" "$probe"
-done
-
-echo "== with CLAUDE_PROJECT_DIR unset the no-path branch falls back to the PROCESS cwd =="
-nopath='{"tool_name":"AnythingElse","tool_input":{}}'
-for pair in "$MAIN:block" "$WT:allow" "$PLAIN:allow"; do
-  CWD="${pair%:*}"
-  ( cd "$CWD" && printf '%s' "$nopath" | env -u CLAUDE_PROJECT_DIR "$hook" >/dev/null 2>&1 )
-  rc=$?; got=allow; [ "$rc" = 2 ] && got=block
-  if [ "$got" = "${pair#*:}" ]; then
-    pass=$((pass + 1)); printf '  ok   %-5s  no path, no CLAUDE_PROJECT_DIR, cwd=%s\n' "$got" "$(short "$CWD")"
-  else
-    fail=$((fail + 1)); printf '  FAIL want=%s got=%s  no path, no CLAUDE_PROJECT_DIR, cwd=%s\n' "${pair#*:}" "$got" "$(short "$CWD")"
-  fi
-done
-CWD="$PLAIN"; PROJ="$PLAIN"
-
-echo "== a RELATIVE file_path is judged by the PROCESS cwd; the payload's cwd field is ignored =="
-rel='{"cwd":"/payload-cwd-must-be-ignored","tool_name":"Edit","tool_input":{"file_path":"pkg/x.ts"}}'
-CWD="$MAIN";  check block 'relative "pkg/x.ts", process cwd=$MAIN'  "$rel"
-CWD="$WT";    check allow 'relative "pkg/x.ts", process cwd=$WT'    "$rel"
-CWD="$PLAIN"; check allow 'relative "pkg/x.ts", process cwd=$PLAIN' "$rel"
-# and the payload's own cwd field never overrides an absolute path
-CWD="$PLAIN"
-check allow 'payload cwd=$MAIN, absolute path in $WT' \
-  "$(jq -nc --arg f "$WT/pkg/x.ts" --arg w "$MAIN" '{cwd:$w,tool_name:"Edit",tool_input:{file_path:$f}}')"
-check block 'payload cwd=$WT, absolute path in $MAIN' \
-  "$(jq -nc --arg f "$MAIN/pkg/x.ts" --arg w "$WT" '{cwd:$w,tool_name:"Edit",tool_input:{file_path:$f}}')"
-
-echo "== a submodule of the shared checkout is not a linked worktree =="
-# git-dir is .git/modules/<name> there. It must not be mistaken for .git/worktrees/<name>.
-if ( cd "$MAIN" && git -c protocol.file.allow=always submodule add -q "$SIB" sub ) >/dev/null 2>&1; then
-  expect block "$MAIN/sub/README.md"
-  expect block "$MAIN/sub/pkg/x.ts"
-else
-  skip=$((skip + 2)); printf '  skip        submodule fixture unavailable in this git build\n'
-fi
-
-echo "== the jq-less fallback still reaches the same verdict on real payloads =="
-nojq="$(mktemp -d)"
-for b in bash env cat sed head grep git dirname basename; do
-  p="$(command -v "$b")" && ln -s "$p" "$nojq/$b"
-done
-check block 'no jq: into $MAIN'                "$(payload "$MAIN/pkg/x.ts")"    PATH="$nojq"
-check allow 'no jq: into $WT'                  "$(payload "$WT/pkg/x.ts")"      PATH="$nojq"
-check allow 'no jq: into $PLAIN'               "$(payload "$PLAIN/notes.md")"   PATH="$nojq"
-check block 'no jq: new file, new dir in $MAIN' "$(payload "$MAIN/brand/new/f.ts")" PATH="$nojq"
-mkdir -p "$MAIN/a b" "$WT/a b"
-check block 'no jq: path containing a space, $MAIN' "$(payload "$MAIN/a b/c.ts")" PATH="$nojq"
-check allow 'no jq: path containing a space, $WT'   "$(payload "$WT/a b/c.ts")"   PATH="$nojq"
-# a decoy "file_path" inside a Write payload's content is JSON-escaped, so the text scan
-# does not mistake it for the real key
-decoy="$(jq -nc --arg f "$MAIN/pkg/x.ts" --arg c "see \"file_path\": \"$PLAIN/decoy\" in the docs" \
-  '{tool_name:"Write",tool_input:{content:$c,file_path:$f}}')"
-check block 'no jq: escaped decoy file_path in content loses to the real key' "$decoy" PATH="$nojq"
-check block 'with jq: same decoy payload'                                     "$decoy"
-# the fallback mirrors the whole table, not just one key: it must read tool_name and the
-# notebook key too, or notebook edits silently rejoin the no-path branch whenever jq is away
-check block 'no jq: NotebookEdit into $MAIN'   "$(nbpay "$MAIN/pkg/x.ipynb")"  PATH="$nojq"
-check allow 'no jq: NotebookEdit into $WT'     "$(nbpay "$WT/pkg/x.ipynb")"    PATH="$nojq"
-check allow 'no jq: NotebookEdit into $PLAIN'  "$(nbpay "$PLAIN/x.ipynb")"     PATH="$nojq"
-check block 'no jq: NotebookEdit with no notebook_path is drift' \
-  '{"tool_name":"NotebookEdit","tool_input":{"new_source":"x"}}' PATH="$nojq"
-# tool_name gets the same decoy treatment as the path keys: quoted inside a string value its
-# quotes are escaped, so prose about a tool cannot re-key the scan
-decoy2="$(jq -nc --arg f "$MAIN/pkg/x.ts" --arg c 'prose mentioning "tool_name": "NotebookEdit" verbatim' \
-  '{tool_name:"Write",tool_input:{content:$c,file_path:$f}}')"
-check block 'no jq: escaped decoy tool_name in content loses to the real one' "$decoy2" PATH="$nojq"
-check block 'with jq: same tool_name decoy payload'                           "$decoy2"
-
-echo "== wiring: the matcher routes Edit, Write and NotebookEdit, and every routed tool has a row =="
-# The matcher is the ONLY thing that decides which tools this hook sees, and the hook's
-# known_path_keys table is the only thing that decides what it reads out of each one.
-# Nothing else in the repo checks either half, so both are pinned here: a removal from the
-# matcher, and a tool routed with no row to read it by. Additions to the matcher are fine
-# — provided they bring their row.
-if [ -f "$settings" ]; then
-  matcher="$(jq -r '[.hooks.PreToolUse[]? | select([.hooks[]?.command] | join(" ") | contains("guard-main-checkout.sh"))
-                     | .matcher] | join(" ")' "$settings" 2>/dev/null || printf '')"
-  for tool in Edit Write NotebookEdit; do
-    case "$matcher" in
-      *"$tool"*) pass=$((pass + 1)); printf '  ok   wired  %s -> guard-main-checkout.sh\n' "$tool" ;;
-      *) fail=$((fail + 1)); printf '  FAIL %s is not routed to guard-main-checkout.sh (matcher: %s)\n' "$tool" "$matcher" ;;
-    esac
-  done
-
-  # ── the pairing ───────────────────────────────────────────────────────────────────────
-  # "a tool the matcher routes here" and "a path key this hook knows" must be a CHECKABLE
-  # relation, not a convention: a tool routed here with no row is read for a key its payload
-  # never carries, and the guard silently goes back to judging the session. So: every name
-  # in the matcher must have a row in the hook's table. A row with no matcher entry is the
-  # harmless direction — a tool the hook is ready for that nothing routes yet — so it prints
-  # a note, not a failure.
-  table="$(sed -n "s/^known_path_keys='\(.*\)'\$/\1/p" "$hook" | head -1)"
-  if [ -z "$table" ]; then
-    fail=$((fail + 1)); printf '  FAIL the hook has no known_path_keys table for the matcher to pair with\n'
-  else
-    routed="$(printf '%s' "$matcher" | tr '|' ' ')"
-    for tool in $routed; do
-      row=""
-      for r in $table; do case "$r" in "$tool="*) row="${r#*=}" ;; esac; done
-      if [ -n "$row" ]; then
-        pass=$((pass + 1)); printf '  ok   pair   %-13s -> .tool_input.%s\n' "$tool" "$row"
-      else
-        fail=$((fail + 1)); printf '  FAIL %s is routed to this hook but has no row in known_path_keys (%s)\n' "$tool" "$table"
-      fi
-    done
-    for r in $table; do
-      t="${r%%=*}"
-      case " $routed " in
-        *" $t "*) ;;
-        *) printf '  note       %s has a row in known_path_keys; the matcher does not route it\n' "$t" ;;
-      esac
-    done
-  fi
-else
-  fail=$((fail + 1)); printf '  FAIL settings.json not found at %s\n' "$(short "$settings")"
-fi
-
-echo "== a notebook is judged by the NOTEBOOK's own path, exactly as a file edit is =="
-# The verdict must depend on where the notebook lives, never on where the session happens to
-# be rooted, so CLAUDE_PROJECT_DIR points at the WRONG place in every row here: a guard that
-# judged the session would answer the same way down each column instead of following the
-# path. The three `expect` rows are the same three notebooks through the Edit payload shape
-# — the two shapes must reach the same verdict, or the guard has one rule per tool.
-PROJ="$MAIN"
-check block 'NotebookEdit into $MAIN,  CLAUDE_PROJECT_DIR=$MAIN'  "$(nbpay "$MAIN/pkg/x.ipynb")"
-check allow 'NotebookEdit into $WT,    CLAUDE_PROJECT_DIR=$MAIN'  "$(nbpay "$WT/pkg/x.ipynb")"
-check allow 'NotebookEdit into $PLAIN, CLAUDE_PROJECT_DIR=$MAIN'  "$(nbpay "$PLAIN/x.ipynb")"
-PROJ="$WT"
-check block 'NotebookEdit into $MAIN,  CLAUDE_PROJECT_DIR=$WT'    "$(nbpay "$MAIN/pkg/x.ipynb")"
-check allow 'NotebookEdit into $WT,    CLAUDE_PROJECT_DIR=$WT'    "$(nbpay "$WT/pkg/x.ipynb")"
-PROJ="$PLAIN"
-check block 'NotebookEdit into $MAIN,  CLAUDE_PROJECT_DIR=$PLAIN' "$(nbpay "$MAIN/pkg/x.ipynb")"
-check allow 'NotebookEdit into $WT,    CLAUDE_PROJECT_DIR=$PLAIN' "$(nbpay "$WT/pkg/x.ipynb")"
-PROJ="$WT";   expect block "$MAIN/pkg/x.ipynb"
-PROJ="$MAIN"; expect allow "$WT/pkg/x.ipynb"
-PROJ="$MAIN"; expect allow "$PLAIN/x.ipynb"
-PROJ="$PLAIN"
-# and the ancestor walk reaches notebooks too: a new notebook in a not-yet-created directory
-check block 'NotebookEdit, new file in a new dir under $MAIN' "$(nbpay "$MAIN/brand/new/nb.ipynb")"
-check allow 'NotebookEdit, new file in a new dir under $WT'   "$(nbpay "$WT/brand/new/nb.ipynb")"
-
-echo "== a PRIMARY checkout whose own path carries a 'worktrees' segment is BLOCKED =="
-# $ODD is a PRIMARY checkout that merely lives under a directory named `worktrees`. The
-# verdict comes from the STRUCTURE — git-dir differs from git-common-dir in a linked
-# worktree, and only there — never from the spelling of the path, so all four block. The two
-# SUBDIRECTORY cases were `allow` under the `*/worktrees/*` substring test this replaced:
-# unguarded edits into a primary checkout, which is the exact failure worktree-first exists
-# to stop (#7259). The pair of DEPTHS is what makes the section discriminating, and the
-# deciding detail was measured rather than assumed: it is the NEAREST EXISTING ANCESTOR that
-# is handed to git, so a path resolving to the repo toplevel got a RELATIVE git-dir and
-# blocked by accident, while anything resolving to a subdirectory got the absolute one and
-# slipped through.
-expect block "$ODD/README.md"          # nearest existing ancestor = the repo toplevel
-expect block "$ODD/brand/new/f.ts"     # ditto — the ancestor walk climbs to the toplevel
-expect block "$ODD/pkg/x.ts"           # a SUBDIRECTORY — the depth the substring test lost
-expect block "$ODD/pkg/brand/new/f.ts" # same depth, reached through the ancestor walk
-
-echo "== BOUNDARY: the jq-less fallback is a text scan, not a JSON parser =="
-# Not filed as a defect: jq is present wherever this hook runs, and Claude Code emits plain
-# UTF-8 paths, never \u-escaped ones. Recorded so that the first thing to fix is known if the
-# fallback ever becomes load-bearing. With jq the same payload is judged correctly.
-esc="$(printf '%s' "$MAIN/pkg/x.ts" | sed 's/\//\\u002f/g')"
-uni="$(printf '{"tool_name":"Edit","tool_input":{"file_path":"%s"}}' "$esc")"
-check block 'with jq: /-escaped path into $MAIN'  "$uni"
-check allow 'no jq: /-escaped path yields no path' "$uni" PATH="$nojq"
-
-printf '\n%s passed, %s failed' "$pass" "$fail"
-[ "$skip" -gt 0 ] && printf ', %s skipped' "$skip"
-printf '\n'
-[ "$fail" -eq 0 ]
-
-# ── NON-VACUITY ─────────────────────────────────────────────────────────────────────────
-# Each class above was shown to fail against a mutated copy of the hook before being trusted
-# to pass against the real one. Reproduce any of them without touching the real hook:
-#
-#   cp .claude/hooks/guard-main-checkout.sh /tmp/mutant.sh
-#   # e.g. delete the linked-worktree escape, which should redden every `allow` in a worktree:
-#   perl -0pi -e 's{^\[ "\$\(canon_dir .*\n}{}m' /tmp/mutant.sh
-#   GUARD_MAIN_CHECKOUT_HOOK=/tmp/mutant.sh .claude/hooks/guard-main-checkout.selftest.sh
-#
-# The mutations used, one per class: drop the linked-worktree escape (core verdict) · drop
-# the nearest-existing-ancestor walk (new-file class) · replace dirname "$file" with
-# CLAUDE_PROJECT_DIR (the file's-own-repo class) · drop the OS_ALLOW_MAIN_EDITS line (escape
-# hatch) · turn the no-path else branch into exit 0 (the fails-closed class) · rename the key
-# in the grep fallback (the jq-less class) · change the final exit 2 to exit 0 (every block) ·
-# point NotebookEdit's row at file_path (the notebook class) · delete NotebookEdit's row
-# altogether (the wiring pair, which reds on the matcher relation and not on a verdict) ·
-# replace the drift block with the project-dir fallback (the schema-drift class).
diff --git a/ui/.claude/hooks/guard-main-checkout.sh b/ui/.claude/hooks/guard-main-checkout.sh
deleted file mode 100755
index 95c0671f0c0..00000000000
--- a/ui/.claude/hooks/guard-main-checkout.sh
+++ /dev/null
@@ -1,141 +0,0 @@
-#!/usr/bin/env bash
-# copied from objectstack@c2520416cff04575dd3def789dd04a5745e3912b
-# guard-main-checkout.sh — PreToolUse guard enforcing AGENTS.md worktree-first rule.
-# Blocks Edit / Write / NotebookEdit unless the file being edited lives in a dedicated
-# git WORKTREE — not the shared primary checkout.
-#
-# Why: this repo (and its sibling repos) are edited by MULTIPLE agents at once. The
-# shared primary checkout has its HEAD switched and its tree reset *under you*, silently
-# clobbering uncommitted work. A feature branch on the shared checkout is NOT enough —
-# it still gets switched under you. Only a dedicated per-task worktree is isolated.
-#
-# Hardened over the original guard (holes agents fell through):
-#   1. Checks "am I in a linked worktree?" — not merely "branch != default". A feature
-#      branch on the shared checkout no longer passes.
-#   2. Checks the EDITED FILE's repo — not just $CLAUDE_PROJECT_DIR — so sibling repos
-#      edited from this session are guarded too.
-#   3. Resolves the file's nearest EXISTING ancestor dir, so creating a new file in a
-#      new directory can't fail-open past the guard.
-#   4. Reads the path from the key the ROUTED TOOL actually carries — a per-tool table,
-#      not one hard-coded key — and blocks rather than guessing when a routed tool's
-#      payload does not carry it. A guard that learns nothing from the payload and falls
-#      back to judging the session's directory returns a verdict that is constant per
-#      session and wrong in BOTH directions, decided by where the session happens to be
-#      rooted rather than by anything about the edit.
-#
-# Deliberate exception (a human quick-fix that still lands via PR): OS_ALLOW_MAIN_EDITS=1.
-
-set -uo pipefail
-
-[ "${OS_ALLOW_MAIN_EDITS:-}" = "1" ] && exit 0
-
-input="$(cat 2>/dev/null || true)"
-
-# WHICH tools reach this guard is the matcher's job, in .claude/settings.json; which KEY
-# each of them carries its path in is this table's. The two are one pair, and the pairing
-# is checked rather than assumed: a tool routed here with no row below would be read for a
-# key its payload never carries, so the guard would learn nothing and judge the session
-# instead of the file. The self-test's wiring section reads the line below and reds when
-# the matcher routes a tool that has no row in it. Add the tool AND its row together.
-known_path_keys='Edit=file_path Write=file_path MultiEdit=file_path NotebookEdit=notebook_path'
-
-have_jq=0; command -v jq >/dev/null 2>&1 && have_jq=1
-
-scan() { # scan <key-alternation> -> first "key": "value" a plain text scan finds, no jq.
-  # JSON escapes the quotes of any key name quoted inside a string value, so a payload that
-  # merely TALKS about one of these keys cannot outrank the real one.
-  printf '%s' "$input" | grep -oE "\"($1)\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" | head -1 |
-    sed 's/^.*"\([^"]*\)"$/\1/' || true
-}
-
-tool=""
-[ "$have_jq" = 1 ] && tool="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
-[ -n "$tool" ] || tool="$(scan 'tool_name')"
-
-key=""
-for row in $known_path_keys; do
-  case "$row" in "$tool="*) key="${row#*=}" ;; esac
-done
-
-file=""
-if [ -n "$key" ]; then
-  # A tool the table names: read exactly the key that tool is contracted to carry.
-  [ "$have_jq" = 1 ] && file="$(printf '%s' "$input" | jq -r --arg k "$key" '.tool_input[$k] // empty' 2>/dev/null || true)"
-  [ -n "$file" ] || file="$(scan "$key")"
-else
-  # A tool the table does not name is not routed here by the matcher. Judge it by whichever
-  # known key it happens to carry, and fall back to the project dir when it carries none.
-  [ "$have_jq" = 1 ] && file="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.notebook_path // empty' 2>/dev/null || true)"
-  [ -n "$file" ] || file="$(scan 'file_path|notebook_path')"
-fi
-
-# A ROUTED tool that carries no path under its own key is schema drift, not a missing path:
-# the contract this guard was written against has moved. Report it instead of guessing.
-if [ -n "$key" ] && [ -z "$file" ]; then
-  cat >&2 <<EOF
-⛔ Blocked: a $tool payload carrying no "$key" — this guard cannot tell which file is being written.
-
-$tool is routed to this guard by .claude/settings.json, and this guard reads that tool's
-path from .tool_input.$key. An absent value means the tool's input schema has moved under
-the guard. Falling back to the session's directory would make the verdict a constant per
-session — right or wrong purely by where the session is rooted, not by the edit — so this
-blocks instead.
-
-Fix the row for $tool in this hook's known_path_keys table, then re-run
-.claude/hooks/guard-main-checkout.selftest.sh.
-
-Deliberate non-task exception: set OS_ALLOW_MAIN_EDITS=1 in the
-environment this hook itself runs in — a local settings "env" entry, or whatever this
-agent process was started with. A VAR=1 prefix on a command sets it for that command
-only, and this hook is not that command, so a prefix never reaches it.
-EOF
-  exit 2
-fi
-
-# Judge the checkout at the file's nearest existing ancestor dir (handles new files in
-# not-yet-created directories). Fall back to the project dir when no file path is given.
-if [ -n "$file" ]; then d="$(dirname "$file")"; else d="${CLAUDE_PROJECT_DIR:-$PWD}"; fi
-while [ -n "$d" ] && [ "$d" != "/" ] && [ ! -d "$d" ]; do d="$(dirname "$d")"; done
-[ -d "$d" ] || d="${CLAUDE_PROJECT_DIR:-$PWD}"
-
-# Canonicalise an existing directory to its physical absolute path, so both sides of the
-# comparison below are spelled the same way: git prints the common-dir RELATIVE, and some
-# hosts hand out symlinked temp dirs.
-canon_dir() { ( cd "$1" 2>/dev/null && pwd -P ) || printf '%s' "$1"; }
-
-# Am I in a LINKED WORKTREE? Structurally: a linked worktree's git-dir (.git/worktrees/NAME)
-# differs from its git-COMMON-dir (.git). A primary checkout has the two equal, and so does a
-# submodule (.git/modules/NAME for both) — which is why neither needs a special case. The
-# test holds whatever the path is spelled like; the `*/worktrees/*` substring match it
-# replaces did not, so a PRIMARY checkout that merely lived under a directory named
-# `worktrees` read as a linked worktree and went unguarded (#7259). --git-common-dir prints
-# RELATIVE to $d (`.git` at a toplevel, `../.git` from a subdirectory), so it MUST be
-# resolved against $d first: compared raw it never equals the absolute git-dir, and the
-# guard would fail open at EVERY depth instead of some.
-gitdir="$(git -C "$d" rev-parse --absolute-git-dir 2>/dev/null)" || exit 0
-commondir="$(git -C "$d" rev-parse --git-common-dir 2>/dev/null)" || exit 0
-case "$commondir" in /*) ;; *) commondir="$d/$commondir" ;; esac
-[ "$(canon_dir "$gitdir")" != "$(canon_dir "$commondir")" ] && exit 0
-
-root="$(git -C "$d" rev-parse --show-toplevel 2>/dev/null || printf '%s' "$d")"
-branch="$(git -C "$d" rev-parse --abbrev-ref HEAD 2>/dev/null || printf '?')"
-name="$(basename "$root")"
-cat >&2 <<EOF
-⛔ Blocked: editing on the shared PRIMARY checkout, not a worktree.
-   repo: $root  (branch: $branch)
-
-This repo is edited by multiple agents at once — the shared checkout gets its HEAD
-switched and tree reset under you, silently clobbering uncommitted work. A feature
-branch on the shared checkout is NOT enough; you must be in a dedicated worktree:
-
-  git fetch origin main && git worktree add --no-track ../${name}-<task> -b <branch> origin/main
-  cd ../${name}-<task> && pnpm install    # then re-run your edits there
-
-This guard checks the edited file's OWN repo, so sibling repos are covered too.
-
-Deliberate non-task exception: set OS_ALLOW_MAIN_EDITS=1 in the
-environment this hook itself runs in — a local settings "env" entry, or whatever this
-agent process was started with. A VAR=1 prefix on a command sets it for that command
-only, and this hook is not that command, so a prefix never reaches it.
-EOF
-exit 2
diff --git a/ui/.claude/hooks/guard-shared-stash.selftest.sh b/ui/.claude/hooks/guard-shared-stash.selftest.sh
deleted file mode 100755
index 830f384aa02..00000000000
--- a/ui/.claude/hooks/guard-shared-stash.selftest.sh
+++ /dev/null
@@ -1,230 +0,0 @@
-#!/usr/bin/env bash
-# copied from objectstack@338297e46018ae96256262590a308c8be735f825
-# Self-test for guard-shared-stash.sh — run it after touching that hook:
-#
-#   .claude/hooks/guard-shared-stash.selftest.sh
-#
-# Feeds the hook the same JSON payload shape Claude Code delivers on PreToolUse and
-# asserts the block/allow verdict per command. Needs jq (to build payloads) and nothing
-# else: no install, no build, no network. Exit 0 = all cases hold.
-
-set -uo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-hook="$here/guard-shared-stash.sh"
-pass=0
-fail=0
-
-command -v jq >/dev/null 2>&1 || { echo "selftest needs jq to build payloads" >&2; exit 1; }
-
-# verdict <command> [env assignments…] -> prints "block" or "allow"
-verdict() {
-  local cmd="$1"; shift
-  local payload out rc
-  payload="$(jq -nc --arg c "$cmd" '{tool_name:"Bash",tool_input:{command:$c}}')"
-  out="$(printf '%s' "$payload" | env "$@" "$hook" 2>/dev/null)"
-  rc=$?
-  case "$rc" in
-    0) printf 'allow' ;;
-    2) printf 'block' ;;
-    *) printf 'exit%s' "$rc" ;;
-  esac
-}
-
-expect() { # expect <block|allow> <command> [env…]
-  local want="$1" cmd="$2"; shift 2
-  local got; got="$(verdict "$cmd" "$@")"
-  if [ "$got" = "$want" ]; then
-    pass=$((pass + 1)); printf '  ok   %-5s  %s\n' "$got" "$cmd"
-  else
-    fail=$((fail + 1)); printf '  FAIL want=%s got=%s  %s\n' "$want" "$got" "$cmd"
-  fi
-}
-
-stderr_of() { # stderr_of <command> [env…] -> the refusal text an agent actually reads
-  local cmd="$1"; shift
-  local payload
-  payload="$(jq -nc --arg c "$cmd" '{tool_name:"Bash",tool_input:{command:$c}}')"
-  printf '%s' "$payload" | env "$@" "$hook" 2>&1 >/dev/null
-}
-
-says() { # says <needle> <label> <command> [env…]
-  local needle="$1" label="$2" subject="$3"; shift 3
-  local out; out="$(stderr_of "$subject" "$@")"
-  case "$out" in
-    *"$needle"*) pass=$((pass + 1)); printf '  ok   says   %s\n' "$label" ;;
-    *) fail=$((fail + 1)); printf '  FAIL missing "%s"  %s\n' "$needle" "$label" ;;
-  esac
-}
-
-lacks() { # lacks <needle> <label> <command> [env…]
-  # The direction only an ABSENCE assertion can hold: a remedy that stopped being true stays
-  # in the text a reader acts on long after the thing it described stopped working.
-  local needle="$1" label="$2" subject="$3"; shift 3
-  local out; out="$(stderr_of "$subject" "$@")"
-  case "$out" in
-    *"$needle"*) fail=$((fail + 1)); printf '  FAIL still says "%s"  %s\n' "$needle" "$label" ;;
-    *) pass=$((pass + 1)); printf '  ok   lacks  %s\n' "$label" ;;
-  esac
-}
-
-echo "== mutating forms must be blocked =="
-expect block 'git stash'
-expect block 'git stash push -- packages/fields/src/RecordPickerDialog.tsx'
-expect block 'git stash pop'
-expect block 'git stash save wip'
-expect block 'git stash drop'
-expect block 'git stash clear'
-expect block 'git stash branch recovered'
-expect block 'git stash pop > /dev/null'
-
-echo "== positional stash@{N} is NOT SHA-pinned: still the shared stack =="
-expect block 'git stash pop stash@{0}'
-expect block 'git stash apply stash@{1}'
-
-echo "== reached through separators, substitution and git -C =="
-expect block 'cd /home/user/objectui && git stash pop'
-expect block 'git -C ../objectui-issue-3422 stash pop'
-expect block 'out=$(git stash pop)'
-expect block 'git status && git stash push -m wip; pnpm test'
-
-echo "== read-only and SHA-pinned forms are allowed =="
-expect allow 'git stash list'
-expect allow 'git stash show -p'
-expect allow 'git stash create'
-expect allow 'git stash --help'
-expect allow 'git stash apply abc1234'
-expect allow 'git stash apply --index deadbeefcafe1234'
-expect allow 'git stash store -m "WIP issue-3430" b52e3aa1234567'
-
-echo "== unrelated commands are untouched =="
-expect allow 'pnpm --filter @object-ui/app-shell test'
-expect allow 'git status'
-expect allow 'git commit -am wip'
-expect allow 'git diff > /tmp/wip.patch && git checkout -- packages/fields'
-
-echo "== writing ABOUT the ban must not trip the ban =="
-expect allow 'grep -n "git stash" AGENTS.md'
-expect allow 'grep -rn "cd x && git stash pop" .claude/'
-expect allow 'echo "never run git stash pop in a shared checkout"'
-expect allow 'git grep -n "git stash"'
-
-echo "== an UNQUOTED \\\" opens no quote, so the stash behind it is still seen (objectstack#11131) =="
-# The measured hole: segmentation read the escaped `"` as OPENING a quoted region that never
-# closed. Every separator behind it went inert, the command collapsed into one `echo`
-# segment, and the real `git stash` was just another argument.
-expect block 'echo \" ; git stash'
-expect block 'echo \" ; git stash pop'
-expect block 'printf \" ; git stash drop'
-expect block "$(printf 'echo \\"\ngit stash pop\n')"
-# Precision twins: the escape must not manufacture a stash where none is run, and the forms
-# this guard deliberately allows stay allowed when reached through the same escape. (Upstream's
-# twin aims the command at a linked worktree; this hook reads no cwd, so the SHA-pinned and
-# read-only allow-list is the analogous precision surface.)
-expect allow 'echo \" ; echo hello'
-expect allow 'echo \" ; cat README.md'
-expect allow 'echo a\ b'
-expect allow 'echo \\ ; grep -n worktree README.md'
-expect allow 'echo \" ; git stash list'
-
-echo "== an escaped \\\" INSIDE a double-quoted word does NOT close it =="
-# Inside "…" a backslash is special only before " \ $ ` — so an escaped `\"` is a literal
-# quote and the quoted region stays OPEN. A pass that reads it as closing goes "outside
-# quotes" while bash is still inside: separators behind it split where bash would not, and
-# the tail of a pure READ becomes a segment of its own, judged on its own head word. The
-# single-level control above (`grep -rn "cd x && git stash pop" .claude/`) is the same
-# command without the nested escape, so it isolates that escape as the only difference.
-expect allow 'grep -rn "he said \"cd x && git stash pop\" once" .claude/'
-expect allow 'echo "he said \"x && git stash pop\" once"'
-# Precision twins — this is not a blanket "ignore whatever follows a backslash". Once the
-# escapes pair up the region really is closed, and the stash behind it is still caught.
-expect block 'echo "he said \"x\"" && git stash pop'
-expect block 'echo "he said \"x\"" ; git stash drop'
-expect block 'echo "quoted" && git stash pop'
-# `\\` inside "…" is an escaped backslash, so the NEXT `"` still closes the region; without
-# the `\` arm of the escapee list that closing quote is eaten and the stash rides through.
-expect block 'echo "a \\" ; git stash pop'
-# Inside '…' nothing is special — that asymmetry is what the q='"' gate pins. Applied to
-# single quotes the branch would swallow the closing `'` and pass the stash behind it.
-expect block "echo 'a \\' ; git stash pop"
-
-echo "== a \$(…), backtick or \${…} inside \"…\" is its own quoting context (objectstack#24901) =="
-# Reading the `"` inside the body as CLOSING the outer string split the body at its `;`, so a
-# pure read became a stash. The first three were BLOCKED before subst_end() existed here; the
-# fourth (both kinds nested) was allowed then only because two misread quotes cancelled out,
-# and the single-level `echo "x; git stash pop"` was allowed throughout.
-expect allow 'echo "a $(echo "x; git stash pop")"'
-expect allow 'echo "a `echo "x; git stash pop"`"'
-expect allow 'echo "${x:-"a; git stash pop"}"'
-expect allow 'echo "${x:-"$(echo "a; git stash pop")"}"'
-expect allow 'echo "x; git stash pop"'
-# Recall: a stash behind or beside a quoted expansion is still seen.
-expect block 'echo "${x:-"a"}" ; git stash pop'
-expect block 'X="${Y:-"z"}" && git stash push -m wip'
-expect block 'git stash push -m "${msg:-"wip; x"}"'
-# The fail-OPEN mirror: the `"` inside the single quotes left the outer string hanging, so the
-# separator behind it went inert and the real stash rode through as text. Both were ALLOWED
-# before subst_end() existed here.
-expect block "echo \"\$(printf '\"')\" ; git stash pop"
-expect block "echo \"\${x:-\$(printf '\"')}\" ; git stash pop"
-# Deliberately not claimed, as before: a stash INSIDE a quoted substitution is one inert word.
-expect allow 'echo "$(git stash pop)"'
-
-echo "== the shared quoting rule is guard-main-checkout-bash.sh's, byte for byte (objectstack#24901) =="
-# subst_end() lives in three hooks here. A copy that drifts is a quoting rule the guards no longer
-# share, and nothing else notices: each hook's own cases keep passing on its own dialect.
-fn_text() { sed -n "/^$1() {\$/,/^}\$/p" "$2"; }
-same_fn() { # same_fn <function> <file holding the copy this hook must equal>
-  local mine theirs
-  mine="$(fn_text "$1" "$hook")"; theirs="$(fn_text "$1" "$2")"
-  if [ -n "$mine" ] && [ "${mine%%$'\n'*}" = "$1() {" ] && [ "$mine" = "$theirs" ]; then
-    pass=$((pass + 1)); printf '  ok   same   %s() as %s\n' "$1" "${2##*/}"
-  else
-    fail=$((fail + 1)); printf '  FAIL %s() is missing here or differs from %s\n' "$1" "${2##*/}"
-  fi
-}
-same_fn subst_end "$here/guard-main-checkout-bash.sh"
-
-echo "== escape hatch =="
-expect allow 'git stash pop' OS_ALLOW_STASH=1
-
-echo "== the hatch names WHERE it works: this hook's own environment, never a prefix =="
-# The refusal used to end by telling the reader to re-run the same thing with the variable
-# as a VAR=1 command prefix — an instruction that cannot work where it is printed. A VAR=1
-# prefix sets the variable in the environment of THAT COMMAND; this hook is not that
-# command, and it reads the variable from its own environment, so the prefix changes
-# nothing and the refusal repeats (#15971). An instruction that does not work is an
-# invitation to route around the guard, so both directions are pinned: the dead remedy is
-# gone, and the sentence names the environment the hook actually reads. The `allow` rows
-# next door — the variable really in the hook's environment — are this pair's other half.
-lacks 're-run with' 'the refusal no longer prints the prefix remedy' 'git stash pop'
-says 'hook itself runs in' 'the refusal names the environment this hook reads' 'git stash pop'
-
-echo "== payload with no command fails open =="
-if printf '%s' '{"tool_name":"Bash","tool_input":{}}' | "$hook" >/dev/null 2>&1; then
-  pass=$((pass + 1)); printf '  ok   allow  (empty tool_input)\n'
-else
-  fail=$((fail + 1)); printf '  FAIL empty tool_input should fail open\n'
-fi
-
-echo "== jq-less fallback still parses the command =="
-nojq="$(mktemp -d)"
-for b in bash env cat sed head grep; do
-  p="$(command -v "$b")" && ln -s "$p" "$nojq/$b"
-done
-printf '%s' '{"tool_name":"Bash","tool_input":{"command":"git stash pop"}}' \
-  | PATH="$nojq" "$hook" >/dev/null 2>&1
-case "$?" in
-  0) got_nojq=allow ;;
-  2) got_nojq=block ;;
-  *) got_nojq="exit$?" ;;
-esac
-if [ "$got_nojq" = block ]; then
-  pass=$((pass + 1)); printf '  ok   block  (no jq on PATH)\n'
-else
-  fail=$((fail + 1)); printf '  FAIL no-jq fallback got=%s\n' "$got_nojq"
-fi
-rm -rf "$nojq"
-
-printf '\n%s passed, %s failed\n' "$pass" "$fail"
-[ "$fail" -eq 0 ]
diff --git a/ui/.claude/hooks/guard-shared-stash.sh b/ui/.claude/hooks/guard-shared-stash.sh
deleted file mode 100755
index f622d0a0670..00000000000
--- a/ui/.claude/hooks/guard-shared-stash.sh
+++ /dev/null
@@ -1,272 +0,0 @@
-#!/usr/bin/env bash
-# copied from objectstack@338297e46018ae96256262590a308c8be735f825
-# guard-shared-stash.sh — PreToolUse guard: the stash stack is SHARED across worktrees.
-# Blocks Bash commands that push to / pop from / drop the shared stash stack, and lets
-# the read-only and SHA-pinned forms through.
-#
-# Why: `git stash` keeps its stack in refs/stash inside the COMMON .git directory. Every
-# linked worktree shares that one LIFO stack, so the per-task worktree isolation AGENTS.md
-# mandates — and guard-main-checkout.sh enforces — does NOT extend to stash. Two agents
-# stashing in their own worktrees operate on the same stack: A's pop restores whatever B
-# pushed a moment earlier, and A's own changes stay on the stack for B to take.
-#
-# Live incident, objectui#3430 (2026-08-06, ~03:56Z): a reverse-verification
-# `git stash push -- packages/fields/.../RecordPickerDialog.tsx` followed by
-# `git stash pop` dropped b52e3aa instead — another agent's WIP on claude/issue-5733-…,
-# two unrelated plugin-detail files. Both agents' in-flight work swapped places; a
-# `git add -A` on either side would have merged the other's changes into the wrong PR.
-# The failure mode is maximally confusing: pop reports SUCCESS, and someone else's files
-# simply appear in your git status. Reverse verification is routine here and stash is the
-# handiest tool for it, so the collision probability is not small.
-#
-# Alternatives — no shared state, all three work inside your own worktree:
-#   1. patch file       git diff > /tmp/wip.patch && git checkout -- <paths>
-#                       git apply /tmp/wip.patch          (git apply -R to undo again)
-#   2. temporary commit git commit -am wip                (git reset --soft HEAD~1)
-#   3. a second worktree for the comparison checkout
-#
-# Allowed through, deliberately:
-#   - `git stash list` / `git stash show`  — read-only, they never mutate the stack.
-#   - `git stash create`  — writes a commit object and prints its object id WITHOUT
-#     storing it in the ref namespace (git-stash(1)); the safe primitive underneath the
-#     SHA-pinned workflow.
-#   - `git stash apply <sha>` / `git stash store <sha>` — the recovery path used to repair
-#     the incident above. An explicit hex object id ONLY: stash@{0} is a POSITION in the
-#     shared stack and may be another agent's entry by the time your command runs.
-#
-# Deliberate exception (you know the stack is yours alone): OS_ALLOW_STASH=1.
-#
-# Exit-code contract, mirroring guard-main-checkout.sh: 0 = allow, 2 = block with the
-# reason on stderr. Anything this cannot parse fails OPEN — a guard that blocks work it
-# does not understand gets disabled, and then it guards nothing.
-#
-# Known boundary, stated so nobody has to rediscover it: the check reads the FIRST WORD of
-# each shell segment, so a wrapped invocation (bash -c '…', xargs, ssh host '…') is not
-# caught. That is the deliberate trade — the target is the reflexive `git stash push` an
-# agent reaches for mid-task, not a determined evader, and OS_ALLOW_STASH=1 already exists
-# for anyone who means it. Widening it to string-match anywhere in the command would block
-# every `grep "git stash"` run against this very file.
-#
-# Self-test (62 cases, no network, no build): .claude/hooks/guard-shared-stash.selftest.sh
-# 62 = 57 `expect ` lines + 2 inline specials (empty-tool_input fail-open, no-jq fallback)
-# + 2 hatch-message assertions (`lacks`/`says`, which are not `expect ` lines) + 1 identity
-# pin (`same_fn`, the subst_end() copy, which is not an `expect ` line either).
-# Re-derive when the matrix changes: `grep -c '^expect ' <selftest>` + 5, and the run's own
-# tail prints the total ("N passed, N failed") — keep this number equal to it.
-
-set -uo pipefail
-
-[ "${OS_ALLOW_STASH:-}" = "1" ] && exit 0
-
-input="$(cat 2>/dev/null || true)"
-cmd=""
-if command -v jq >/dev/null 2>&1; then
-  cmd="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
-fi
-if [ -z "$cmd" ]; then
-  # jq-less fallback: lift the JSON string value honouring backslash escapes (so an
-  # embedded \" does not truncate the command), then unescape what matters for shell text.
-  cmd="$(printf '%s' "$input" \
-    | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(\(\\.\|[^"\\]\)*\)".*/\1/p' \
-    | head -1 \
-    | sed 's/\\n/ /g; s/\\t/ /g; s/\\"/"/g; s/\\\\/\\/g')"
-fi
-
-[ -n "$cmd" ] || exit 0
-
-# --- split the command into shell segments, honouring quotes ---------------------------
-# A separator inside '…' or "…" does NOT split, so writing *about* the ban is never caught
-# by the ban: `grep -n "cd x && git stash pop" AGENTS.md` stays one segment whose first
-# word is grep. (objectstack#4890's lesson — the PR writing a rule must not trip it.)
-#
-# OUTSIDE quotes a backslash escapes the NEXT character, so an escaped `\"` opens no quoted
-# region at all. Without a branch for it this pass read that `"` as OPENING a region that
-# never closed, went inert for every separator behind it, collapsed the whole command into
-# one segment whose head word was the harmless one, and waved a real `git stash` through as
-# a mere argument of `echo`. That is a fail-OPEN in the backstop for the one rule whose
-# breach silently corrupts ANOTHER agent's work (objectstack#11131, the same defect the
-# sibling hook guard-main-checkout-bash.sh carried; objectui#6042).
-#
-# INSIDE "…" the rule inverts: there a backslash is special only before " \ $ ` , and an
-# escaped `\"` is a literal quote that leaves the region OPEN. A pass that reads it as
-# CLOSING goes outside quotes while bash is still inside, so separators behind it split
-# where bash would not: the tail of a pure READ becomes a segment of its own, judged on its
-# own head word — a false BLOCK on a command that touches no stash, which is exactly what
-# the paragraph at the top of this section promises can never happen. The same gap fails
-# OPEN in the other direction: once the escapes pair up the quoted region is left hanging
-# and a real `git stash` behind it rides through as a mere argument. Inside '…' nothing is
-# special, hence the q='"' gate. This is the in-quote half of the backslash rule, in the
-# same shape and with the same escapee list as guard-main-checkout-bash.sh's
-# split_segments() carries; that guard's `word` bookkeeping has no analogue here because
-# this pass has no comment rule to track word starts for.
-#
-# INSIDE "…" a `$(`, a backtick or a `${` opens a quoting context of its own, so a `"` in its
-# body nests instead of closing the outer string. Without that rule this pass read the inner
-# `"` as the closer, the `;` inside the body split, and a pure read became a stash command —
-# measured on this repo's copy before the fix: `echo "a $(echo "x; git stash pop")"` and
-# `echo "${x:-"a; git stash pop"}"` were BLOCKED (objectstack#24901). The body is kept verbatim inside
-# the segment, so a stash inside a QUOTED substitution stays the fail-open it always was.
-#
-# subst_end() is copied byte-for-byte from guard-main-checkout-bash.sh, whose comment above
-# the function is its documentation; this hook's self-test fails when the copy differs.
-SUBST_END=0
-subst_end() {
-  local s="$1" i="$2" n=${#1} st ch top run
-  case "${s:i:2}" in
-    '$(') st=')' ; i=$((i + 1)) ;;
-    '${') st='}' ; i=$((i + 1)) ;;
-    '`'*) st='`' ;;
-    *) return 1 ;;
-  esac
-  for ((i = i + 1; i < n; i++)); do
-    ch="${s:i:1}" ; top="${st:${#st}-1:1}"
-    if [ "$top" = "'" ]; then [ "$ch" = "'" ] && st="${st%?}"; continue; fi
-    if [ "$ch" = '\' ]; then i=$((i + 1)); continue; fi
-    if [ "$top" = '"' ] || [ "$top" = '}' ]; then
-      case "$ch" in
-        '"') if [ "$top" = '"' ]; then st="${st%?}"; else st+='"'; fi ;;
-        '`') st+='`' ;;
-        '$')
-          case "${s:i+1:1}" in
-            '(') st+=')' ; i=$((i + 1)) ;;
-            '{') st+='}' ; i=$((i + 1)) ;;
-          esac ;;
-        '}') [ "$top" = '}' ] && st="${st%?}" ;;
-        "'")
-          if [ "$top" = '}' ]; then
-            run="${s:i+1}"
-            case "$run" in *"'"*) ;; *) SUBST_END=$((n - 1)); return 0 ;; esac
-            run="${run%%"'"*}"
-            case "$run" in *[\"\\\`\$\}]*) SUBST_END=$((n - 1)); return 0 ;; esac
-            i=$((i + ${#run} + 1))
-          fi ;;
-      esac
-      if [ -z "$st" ]; then SUBST_END=$i; return 0; fi
-      continue
-    fi
-    case "$ch" in
-      "'" | '"') st+="$ch" ;;
-      '(') st+=')' ;;
-      ')') [ "$top" = ')' ] && st="${st%?}" ;;
-      '`') if [ "$top" = '`' ]; then st="${st%?}"; else st+='`'; fi ;;
-    esac
-    if [ -z "$st" ]; then SUBST_END=$i; return 0; fi
-  done
-  SUBST_END=$((n - 1))
-  return 0
-}
-
-segments=()
-split_segments() {
-  local s="$1" seg="" q="" ch i n=${#1}
-  for ((i = 0; i < n; i++)); do
-    ch="${s:i:1}"
-    if [ -n "$q" ]; then
-      if [ "$q" = '"' ] && [ "$ch" = '\' ] && [ $((i + 1)) -lt "$n" ]; then
-        case "${s:i+1:1}" in
-          '"' | '\' | '$' | '`')
-            seg+="$ch" ; i=$((i + 1)) ; seg+="${s:i:1}" ; continue ;;
-        esac
-      fi
-      if [ "$q" = '"' ] && { [ "$ch" = '$' ] || [ "$ch" = '`' ]; } && subst_end "$s" "$i"; then
-        seg+="${s:i:SUBST_END-i+1}" ; i=$SUBST_END ; continue
-      fi
-      seg+="$ch"
-      [ "$ch" = "$q" ] && q=""
-      continue
-    fi
-    case "$ch" in
-      '\')
-        seg+="$ch"
-        if [ $((i + 1)) -lt "$n" ]; then i=$((i + 1)) ; seg+="${s:i:1}" ; fi
-        ;;
-      "'" | '"') q="$ch" ; seg+="$ch" ;;
-      ';' | '|' | '&' | '(' | ')' | '{' | '}' | $'\n') segments+=("$seg") ; seg="" ;;
-      *) seg+="$ch" ;;
-    esac
-  done
-  segments+=("$seg")
-}
-
-# --- verdict for one segment -----------------------------------------------------------
-# returns 0 = fine, 1 = this segment mutates the shared stash stack.
-check_segment() {
-  local seg="$1"
-  local -a w=()
-  read -r -a w <<<"$seg"
-  local i=0 n=${#w[@]}
-  [ "$n" -gt 0 ] || return 0
-
-  # leading FOO=bar environment assignments
-  while [ "$i" -lt "$n" ]; do
-    case "${w[$i]}" in
-      [A-Za-z_][A-Za-z0-9_]*=*) i=$((i + 1)) ;;
-      *) break ;;
-    esac
-  done
-  [ "$i" -lt "$n" ] || return 0
-
-  # /usr/bin/git -> git
-  [ "${w[$i]##*/}" = "git" ] || return 0
-  i=$((i + 1))
-
-  # git's own global options, before the subcommand
-  while [ "$i" -lt "$n" ]; do
-    case "${w[$i]}" in
-      -C | -c | --exec-path | --git-dir | --work-tree | --namespace) i=$((i + 2)) ;;
-      -*) i=$((i + 1)) ;;
-      *) break ;;
-    esac
-  done
-  [ "$i" -lt "$n" ] || return 0
-  [ "${w[$i]}" = "stash" ] || return 0
-  i=$((i + 1))
-
-  local sub="${w[$i]:-}"
-  case "$sub" in
-    --help | -h) return 0 ;;             # reading the manual is not stashing
-    list | show) return 0 ;;             # read-only against refs/stash
-    create) return 0 ;;                  # makes an object, does NOT store it in the stack
-    apply | store)
-      # pinned to an explicit hex object id => this cannot pick up another agent's entry.
-      local j
-      for ((j = i + 1; j < n; j++)); do
-        [[ "${w[$j]}" =~ ^[0-9a-fA-F]{7,40}$ ]] && return 0
-      done
-      ;;
-  esac
-  return 1
-}
-
-split_segments "$cmd"
-for seg in "${segments[@]}"; do
-  check_segment "$seg" && continue
-  offending="${seg#"${seg%%[![:space:]]*}"}"
-  cat >&2 <<EOF
-⛔ Blocked: git stash uses ONE stack shared by every worktree of this repo.
-   command: $offending
-
-refs/stash lives in the COMMON .git directory, so the per-task worktree isolation this
-repo mandates does NOT cover the stash stack. Another agent's pop takes YOUR entry and
-yours takes theirs — pop reports success and their files show up in your git status,
-which is why objectui#3430 swapped two agents' in-flight changes without an error.
-
-Use instead — no shared state, all inside your own worktree:
-  1. patch file       git diff > /tmp/wip.patch && git checkout -- <paths>
-                      git apply /tmp/wip.patch          # git apply -R to undo again
-  2. temporary commit git commit -am wip                # git reset --soft HEAD~1
-  3. a second worktree for the comparison checkout
-
-Already allowed, no flag needed:
-  git stash list | git stash show | git stash create
-  git stash apply <sha> | git stash store <sha>    # literal hex id, never stash@{N}
-
-Deliberate exception (the stack really is yours alone): set OS_ALLOW_STASH=1 in the
-environment this hook itself runs in — a local settings "env" entry, or whatever this
-agent process was started with. A VAR=1 prefix on a command sets it for that command
-only, and this hook is not that command, so a prefix never reaches it.
-EOF
-  exit 2
-done
-
-exit 0
diff --git a/ui/.claude/hooks/guard-tree-enum.selftest.sh b/ui/.claude/hooks/guard-tree-enum.selftest.sh
deleted file mode 100755
index 9d98cde7728..00000000000
--- a/ui/.claude/hooks/guard-tree-enum.selftest.sh
+++ /dev/null
@@ -1,194 +0,0 @@
-#!/usr/bin/env bash
-# copied from objectstack@338297e46018ae96256262590a308c8be735f825
-# Self-test for guard-tree-enum.sh — run it after touching that hook:
-#
-#   .claude/hooks/guard-tree-enum.selftest.sh
-#
-# Feeds the hook the same JSON payload shape Claude Code delivers on PreToolUse and asserts
-# the block/allow verdict per command. Needs jq (to build payloads) and nothing else: no
-# install, no build, no network. Exit 0 = all cases hold.
-#
-# The first case is THIS repository's measured incident of 2026-08-29 (objectstack#13305)
-# reproduced verbatim; it is the one case whose failure means the guard has stopped doing
-# the only job it was written for.
-#
-# Mirrored one-for-one from objectstack's self-test of the same name alongside the hook, so
-# the two repos' guards cannot drift; only example paths are localised.
-
-set -uo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-hook="$here/guard-tree-enum.sh"
-pass=0
-fail=0
-
-command -v jq >/dev/null 2>&1 || { echo "selftest needs jq to build payloads" >&2; exit 1; }
-
-# verdict <command> [env assignments…] -> prints "block" or "allow"
-verdict() {
-  local cmd="$1"; shift
-  local payload out rc
-  payload="$(jq -nc --arg c "$cmd" '{tool_name:"Bash",tool_input:{command:$c}}')"
-  out="$(printf '%s' "$payload" | env "$@" "$hook" 2>/dev/null)"
-  rc=$?
-  case "$rc" in
-    0) printf 'allow' ;;
-    2) printf 'block' ;;
-    *) printf 'exit%s' "$rc" ;;
-  esac
-}
-
-expect() { # expect <block|allow> <command> [env…]
-  local want="$1" cmd="$2"; shift 2
-  local got; got="$(verdict "$cmd" "$@")"
-  if [ "$got" = "$want" ]; then
-    pass=$((pass + 1)); printf '  ok   %-5s  %s\n' "$got" "$cmd"
-  else
-    fail=$((fail + 1)); printf '  FAIL want=%s got=%s  %s\n' "$want" "$got" "$cmd"
-  fi
-}
-
-stderr_of() { # stderr_of <command> [env…] -> the refusal text an agent actually reads
-  local cmd="$1"; shift
-  local payload
-  payload="$(jq -nc --arg c "$cmd" '{tool_name:"Bash",tool_input:{command:$c}}')"
-  printf '%s' "$payload" | env "$@" "$hook" 2>&1 >/dev/null
-}
-
-says() { # says <needle> <label> <command> [env…]
-  local needle="$1" label="$2" subject="$3"; shift 3
-  local out; out="$(stderr_of "$subject" "$@")"
-  case "$out" in
-    *"$needle"*) pass=$((pass + 1)); printf '  ok   says   %s\n' "$label" ;;
-    *) fail=$((fail + 1)); printf '  FAIL missing "%s"  %s\n' "$needle" "$label" ;;
-  esac
-}
-
-lacks() { # lacks <needle> <label> <command> [env…]
-  # The direction only an ABSENCE assertion can hold: a remedy that stopped being true stays
-  # in the text a reader acts on long after the thing it described stopped working.
-  local needle="$1" label="$2" subject="$3"; shift 3
-  local out; out="$(stderr_of "$subject" "$@")"
-  case "$out" in
-    *"$needle"*) fail=$((fail + 1)); printf '  FAIL still says "%s"  %s\n' "$needle" "$label" ;;
-    *) pass=$((pass + 1)); printf '  ok   lacks  %s\n' "$label" ;;
-  esac
-}
-
-echo "== THE MEASURED SIGNATURE: working-tree list + origin/main read in one command =="
-# objectui, 2026-08-29 — the loop that reported "no workflow subscribes ready_for_review"
-expect block 'for f in .github/workflows/*.yml; do git show "origin/main:$f" | grep -q ready_for_review && echo "$f"; done'
-expect block 'for f in .github/workflows/*.yml; do git show origin/main:$f; done'
-expect block 'ls .github/workflows/*.yml | while read f; do git show "origin/main:$f"; done'
-expect block 'for f in scripts/*.mjs; do git cat-file -e "origin/main:$f" || echo missing; done'
-expect block 'find .github/workflows -name "*.yml" | while read f; do git show "origin/main:$f"; done'
-expect block 'for f in packages/components/src/*.ts; do git grep -q PATTERN origin/main -- "$f"; done'
-
-echo "== reached through separators, env prefixes and git -C =="
-expect block 'cd /home/user/objectui && for f in .claude/hooks/*.sh; do git show "origin/main:$f"; done'
-expect block 'for f in docs/adr/*.md; do git -C . show "origin/main:$f" | head -1; done'
-expect block 'NODE_OPTIONS=--max-old-space-size=4096 ls scripts/*.mjs | xargs -I{} git show origin/main:{}'
-
-echo "== THE CANONICAL IDIOM is never blocked, however it then reads =="
-expect allow 'git ls-tree --name-only origin/main .github/workflows/'
-expect allow 'for f in $(git ls-tree --name-only origin/main .github/workflows/); do git show "origin/main:$f"; done'
-expect allow 'git ls-tree -r --name-only origin/main scripts/ | while read f; do git show "origin/main:$f"; done'
-echo "-- the population/read cross-check the block message recommends must not itself block --"
-expect allow 'git ls-tree --name-only origin/main .github/workflows/ | wc -l; ls .github/workflows/* | wc -l; git show origin/main:AGENTS.md | head -1'
-
-echo "== EITHER HALF ALONE is ordinary and correct =="
-echo "-- (a) working-tree enumeration with no origin/main read --"
-expect allow 'ls .github/workflows/*.yml'
-expect allow 'for f in packages/*/package.json; do jq -r .name "$f"; done'
-expect allow 'find scripts -name "*.mjs" | wc -l'
-expect allow 'for f in .claude/hooks/*.sh; do bash -n "$f"; done'
-echo "-- (b) origin/main read with no working-tree enumeration --"
-expect allow 'git show origin/main:AGENTS.md | wc -l'
-expect allow 'git grep -n ready_for_review origin/main'
-expect allow 'git show "origin/main:.github/workflows/governed-surface-guard.yml"'
-expect allow 'git cat-file -e origin/main:.github/workflows/ci.yml'
-expect allow 'git diff origin/main -- .github/workflows/'
-
-echo "== a LOCAL ref is not the hazard this guard is about =="
-expect allow 'for f in .github/workflows/*.yml; do git show "HEAD:$f"; done'
-expect allow 'for f in .github/workflows/*.yml; do git show "$BASE:$f"; done'
-
-echo "== writing ABOUT the defect must not trip the guard =="
-expect allow 'grep -n "git show origin/main:" AGENTS.md'
-expect allow 'grep -rn "for f in .github/workflows/\*.yml" .claude/hooks/'
-expect allow 'echo "never feed a working-tree glob into git show origin/main:"'
-expect allow 'git grep -n "ls-tree --name-only origin/main"'
-expect allow 'cat .claude/hooks/guard-tree-enum.sh'
-
-echo "== a \"…\" string ends only where bash ends it (objectstack#24901) =="
-# Two shapes inside "…" whose `"` does NOT close the outer string, and this pass read both as
-# closing it, so a pure read split into an enumeration segment and an origin/main read. Every
-# allow-case below was BLOCKED before the fix; the single-level forms next door never were.
-# (1) an escaped `\"`, the objectstack#11804 repair its two siblings already carried:
-expect allow 'echo "say \"; ls *.yml; git show origin/main:x\" ok"'
-expect allow 'echo "say ; ls *.yml; git show origin/main:x ok"'
-# (2) a `"` inside a `$(…)`, a backtick or a `${…}`, which opens a context of its own:
-expect allow 'echo "a $(echo "x; ls *.yml")" && git show origin/main:README.md'
-expect allow 'echo "a `echo "; find ."`"; git grep foo origin/main'
-expect allow 'echo "${x:-"; ls *.yml"}" && git show origin/main:README.md'
-expect allow 'echo "x; ls *.yml" && git show origin/main:README.md'
-# Recall: the sweep this guard exists for is still caught when a quoted expansion sits in it.
-expect block 'for f in "${dir:-"docs"}"/*.md; do git show "origin/main:$f"; done'
-expect block 'for f in .github/workflows/*.yml; do git show "origin/main:${f}"; done'
-expect block 'echo "${x:-"a"}" ; for f in *.yml; do git show "origin/main:$f"; done'
-# The fail-OPEN mirror of (1): the escaped quotes paired up and left the region hanging, so
-# the real sweep behind them rode through as text. ALLOWED before the fix.
-expect block 'echo "he said \"x\"" ; for f in *.yml; do git show "origin/main:$f"; done'
-
-echo "== the shared quoting rules are copies, byte for byte (objectstack#24901) =="
-# split_segments() is guard-shared-stash.sh's and subst_end() is guard-main-checkout-bash.sh's.
-# This pass's header called it identical while it lacked the in-quote escape rule — exactly
-# the drift a prose claim cannot catch and this pin does.
-fn_text() { sed -n "/^$1() {\$/,/^}\$/p" "$2"; }
-same_fn() { # same_fn <function> <file holding the copy this hook must equal>
-  local mine theirs
-  mine="$(fn_text "$1" "$hook")"; theirs="$(fn_text "$1" "$2")"
-  if [ -n "$mine" ] && [ "${mine%%$'\n'*}" = "$1() {" ] && [ "$mine" = "$theirs" ]; then
-    pass=$((pass + 1)); printf '  ok   same   %s() as %s\n' "$1" "${2##*/}"
-  else
-    fail=$((fail + 1)); printf '  FAIL %s() is missing here or differs from %s\n' "$1" "${2##*/}"
-  fi
-}
-same_fn split_segments "$here/guard-shared-stash.sh"
-same_fn subst_end "$here/guard-main-checkout-bash.sh"
-
-echo "== unrelated commands are untouched =="
-expect allow 'pnpm --filter @object-ui/components test'
-expect allow 'git status'
-expect allow 'node scripts/check-changeset-presence.mjs'
-expect allow 'git worktree add ../objectui-issue-13305 -b claude/issue-13305 origin/main'
-
-echo "== the deliberate exception releases it =="
-expect allow 'for f in .github/workflows/*.yml; do git show "origin/main:$f"; done' OS_ALLOW_TREE_ENUM=1
-
-echo "== the hatch names WHERE it works: this hook's own environment, never a prefix =="
-# The refusal used to end by telling the reader to re-run the same thing with the variable
-# as a VAR=1 command prefix — an instruction that cannot work where it is printed. A VAR=1
-# prefix sets the variable in the environment of THAT COMMAND; this hook is not that
-# command, and it reads the variable from its own environment, so the prefix changes
-# nothing and the refusal repeats (#15971). An instruction that does not work is an
-# invitation to route around the guard, so both directions are pinned: the dead remedy is
-# gone, and the sentence names the environment the hook actually reads. The `allow` rows
-# next door — the variable really in the hook's environment — are this pair's other half.
-lacks 're-run with' 'the refusal no longer prints the prefix remedy' \
-  'for f in .github/workflows/*.yml; do git show "origin/main:$f"; done'
-says 'hook itself runs in' 'the refusal names the environment this hook reads' \
-  'for f in .github/workflows/*.yml; do git show "origin/main:$f"; done'
-
-echo "== fails OPEN on payloads it cannot parse =="
-printf '%s' '{"tool_name":"Bash","tool_input":{}}' | "$hook" >/dev/null 2>&1
-if [ $? -eq 0 ]; then pass=$((pass + 1)); printf '  ok   allow  <no command in payload>\n'
-else fail=$((fail + 1)); printf '  FAIL want=allow  <no command in payload>\n'; fi
-printf '%s' 'not json at all' | "$hook" >/dev/null 2>&1
-if [ $? -eq 0 ]; then pass=$((pass + 1)); printf '  ok   allow  <malformed payload>\n'
-else fail=$((fail + 1)); printf '  FAIL want=allow  <malformed payload>\n'; fi
-
-echo
-echo "guard-tree-enum selftest: $pass passed, $fail failed"
-[ "$fail" -eq 0 ] || exit 1
-exit 0
diff --git a/ui/.claude/hooks/guard-tree-enum.sh b/ui/.claude/hooks/guard-tree-enum.sh
deleted file mode 100755
index f46d1249377..00000000000
--- a/ui/.claude/hooks/guard-tree-enum.sh
+++ /dev/null
@@ -1,397 +0,0 @@
-#!/usr/bin/env bash
-# copied from objectstack@338297e46018ae96256262590a308c8be735f825
-# guard-tree-enum.sh — PreToolUse guard: the `origin/main` reading rule covers file
-# CONTENTS but not file ENUMERATION. Blocks a Bash command that takes its file LIST from
-# the working tree and its file CONTENTS from `origin/main`, and lets either half alone —
-# and the `git ls-tree origin/main` enumeration — straight through.
-#
-# Why: this repo's instructions say "核验 main 用 `origin/main`" — read contents with
-# `git show origin/main:<path>` or `git grep … origin/main`, never from the shared working
-# tree whose HEAD other agents switch under you. That rule is about READS. A sweep can obey
-# it perfectly and still be wrong, because the FILE LIST is a second, unruled source:
-#
-#   for f in .github/workflows/*.yml; do          # ← list from the WORKING TREE
-#     git show "origin/main:$f" | grep -q PATTERN # ← contents from origin/main
-#   done
-#
-# Every file it opens is read correctly. Files that exist on `origin/main` but not at the
-# working tree's current HEAD are never iterated at all, so the loop cannot report them and
-# cannot know it missed them. The output is a zero that looks like a full-tree scan.
-#
-# Live incident, THIS repository (2026-08-29), filed as objectstack#13305: a seat ran exactly
-# the loop above to decide whether flipping a batch of draft PRs to ready would trigger any CI.
-# Measured that day — working tree `ls .github/workflows/*.yml | wc -l` = 30;
-# `git ls-tree --name-only origin/main .github/workflows/ | grep -c '\.yml$'` = 31. The one
-# missing file was `.github/workflows/governed-surface-guard.yml`, whose line 36 declares
-# `types: [opened, synchronize, reopened, ready_for_review]` — that is, the answer to the
-# exact question being asked was the file left out of the enumeration. Acting on the wrong
-# reading, the seat flipped 10 PRs to ready; each fired a fresh guard run and went from
-# `mergeable_state: clean` to `unstable`, during an ongoing runner-capacity outage.
-#
-# ⚠️ Why the existing zero-hit discipline did not catch it — the transferable part, and the
-# reason this is a hook rather than a paragraph. The discipline says a zero is only a
-# reading if a control term that MUST hit is run in the same query and does. One was run:
-# `pull_request` matched 5 workflow files, so the method demonstrably worked. But those 5
-# files came from the SAME faulty list, so the control validated the MATCHER and said
-# nothing about the ENUMERATION. Grading of objectstack#13305, verbatim and untranslated:
-#
-#   「一个对照必须有能力因为你担心的那个原因而失败;同源对照结构上做不到。」
-#
-# ⇒ when a sweep's POPULATION and its per-item READ come from different sources, the
-# control has to be drawn from the population source, not the read source.
-#
-# The canonical fix, mirroring how `git show origin/main:` is already the canonical way to
-# read contents — enumerate from the same ref you read from:
-#
-#   git ls-tree --name-only origin/main <dir>
-#
-# A command that enumerates that way is never blocked here, however it then reads.
-#
-# What is detected, and only when BOTH appear in ONE command — either alone is fine and is
-# allowed, because either alone is correct in ordinary use:
-#   (a) a WORKING-TREE enumeration — `for NAME in <glob>`, `ls <glob>`, `find <path>`
-#   (b) an `origin/…` CONTENT read — `git show origin/…:<path>`, `git grep … origin/…`,
-#       `git cat-file … origin/…:<path>`
-# Suppressed whenever the same command also runs `git ls-tree … origin/…`: that is the
-# recommended population/read cross-check, and it must not be harder to write than the bug.
-#
-# Deliberate exception (the working tree really is the population you mean — e.g. you are
-# asking what YOUR branch changed): OS_ALLOW_TREE_ENUM=1.
-#
-# Exit-code contract, mirroring guard-shared-stash.sh and guard-main-checkout.sh:
-# 0 = allow, 2 = block with the reason on stderr. Anything this cannot parse fails OPEN —
-# a guard that blocks work it does not understand gets disabled, and then it guards nothing.
-# The rule outranks the hook, not the other way round.
-#
-# Known boundaries, stated so nobody has to rediscover them:
-#   - Classification reads the FIRST WORD of each shell segment, so a wrapped invocation
-#     (`bash -c '…'`, `xargs`, `ssh host '…'`) is not caught. Same deliberate trade the
-#     stash guard documents: the target is the reflexive sweep an agent writes mid-task,
-#     not a determined evader, and OS_ALLOW_TREE_ENUM=1 exists for anyone who means it.
-#   - Split across two Bash calls (glob into a variable in one, read it in the next) is out
-#     of reach by construction — a PreToolUse hook sees one command at a time.
-#   - Writing ABOUT the defect is never caught: `grep -n 'git show origin/main:' AGENTS.md`
-#     has head word `grep`, so it is neither (a) nor (b). The PR that writes a rule must not
-#     trip the rule it writes.
-#
-# Mirrored from objectstack's hook of the same name (objectstack#13305), the same discipline
-# guard-shared-stash.sh and guard-main-checkout-bash.sh already document: the verdict logic
-# below is kept case-for-case identical to objectstack's so the two repos' guards cannot
-# drift; only the incident's framing and the self-test's example paths are localised. The
-# measured incident is THIS repository's, so it reads in the first person here.
-#
-# Self-test (no network, no build): .claude/hooks/guard-tree-enum.selftest.sh
-
-set -uo pipefail
-
-[ "${OS_ALLOW_TREE_ENUM:-}" = "1" ] && exit 0
-
-input="$(cat 2>/dev/null || true)"
-cmd=""
-if command -v jq >/dev/null 2>&1; then
-  cmd="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
-fi
-if [ -z "$cmd" ]; then
-  # jq-less fallback: lift the JSON string value honouring backslash escapes (so an
-  # embedded \" does not truncate the command), then unescape what matters for shell text.
-  cmd="$(printf '%s' "$input" \
-    | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(\(\\.\|[^"\\]\)*\)".*/\1/p' \
-    | head -1 \
-    | sed 's/\\n/ /g; s/\\t/ /g; s/\\"/"/g; s/\\\\/\\/g')"
-fi
-
-[ -n "$cmd" ] || exit 0
-
-# --- split the command into shell segments, honouring quotes ---------------------------
-# Kept case-for-case identical to guard-shared-stash.sh's pass, and the self-test fails when
-# it is not. That covers the objectstack#11738 repair: OUTSIDE quotes a backslash escapes the NEXT
-# character, so an escaped `\"` opens no quoted region. Without that branch a stray `\"`
-# makes every separator behind it inert, the command collapses into one segment, and the
-# real work rides through as an argument.
-#
-# INSIDE "…" two more rules hold, and this copy carried neither until objectstack#24901, while the line
-# above already called it identical. A `\"` there is a literal quote that leaves the region
-# OPEN (objectstack#11804); and a `$(`, a backtick or a `${` opens a quoting context of its own, so a
-# `"` in its body nests instead of closing the outer string. Reading either `"` as the
-# closer split a pure read: measured on this repo's copy before the fix,
-# `echo "say \"; ls *.yml; git show origin/main:x\" ok"` and
-# `echo "a $(echo "x; ls *.yml")" && git show origin/main:README.md` were both BLOCKED.
-# subst_end() is copied byte-for-byte from guard-main-checkout-bash.sh, whose comment above
-# the function is its documentation; the self-test pins that copy too.
-#
-# `(` and `)` are separators, which is what makes command substitution fall out correctly
-# here: `for f in $(git ls-tree --name-only origin/main dir)` becomes `for f in $` — no
-# glob, so not an enumeration — plus a `git ls-tree` segment, which is the suppressor.
-SUBST_END=0
-subst_end() {
-  local s="$1" i="$2" n=${#1} st ch top run
-  case "${s:i:2}" in
-    '$(') st=')' ; i=$((i + 1)) ;;
-    '${') st='}' ; i=$((i + 1)) ;;
-    '`'*) st='`' ;;
-    *) return 1 ;;
-  esac
-  for ((i = i + 1; i < n; i++)); do
-    ch="${s:i:1}" ; top="${st:${#st}-1:1}"
-    if [ "$top" = "'" ]; then [ "$ch" = "'" ] && st="${st%?}"; continue; fi
-    if [ "$ch" = '\' ]; then i=$((i + 1)); continue; fi
-    if [ "$top" = '"' ] || [ "$top" = '}' ]; then
-      case "$ch" in
-        '"') if [ "$top" = '"' ]; then st="${st%?}"; else st+='"'; fi ;;
-        '`') st+='`' ;;
-        '$')
-          case "${s:i+1:1}" in
-            '(') st+=')' ; i=$((i + 1)) ;;
-            '{') st+='}' ; i=$((i + 1)) ;;
-          esac ;;
-        '}') [ "$top" = '}' ] && st="${st%?}" ;;
-        "'")
-          if [ "$top" = '}' ]; then
-            run="${s:i+1}"
-            case "$run" in *"'"*) ;; *) SUBST_END=$((n - 1)); return 0 ;; esac
-            run="${run%%"'"*}"
-            case "$run" in *[\"\\\`\$\}]*) SUBST_END=$((n - 1)); return 0 ;; esac
-            i=$((i + ${#run} + 1))
-          fi ;;
-      esac
-      if [ -z "$st" ]; then SUBST_END=$i; return 0; fi
-      continue
-    fi
-    case "$ch" in
-      "'" | '"') st+="$ch" ;;
-      '(') st+=')' ;;
-      ')') [ "$top" = ')' ] && st="${st%?}" ;;
-      '`') if [ "$top" = '`' ]; then st="${st%?}"; else st+='`'; fi ;;
-    esac
-    if [ -z "$st" ]; then SUBST_END=$i; return 0; fi
-  done
-  SUBST_END=$((n - 1))
-  return 0
-}
-
-segments=()
-split_segments() {
-  local s="$1" seg="" q="" ch i n=${#1}
-  for ((i = 0; i < n; i++)); do
-    ch="${s:i:1}"
-    if [ -n "$q" ]; then
-      if [ "$q" = '"' ] && [ "$ch" = '\' ] && [ $((i + 1)) -lt "$n" ]; then
-        case "${s:i+1:1}" in
-          '"' | '\' | '$' | '`')
-            seg+="$ch" ; i=$((i + 1)) ; seg+="${s:i:1}" ; continue ;;
-        esac
-      fi
-      if [ "$q" = '"' ] && { [ "$ch" = '$' ] || [ "$ch" = '`' ]; } && subst_end "$s" "$i"; then
-        seg+="${s:i:SUBST_END-i+1}" ; i=$SUBST_END ; continue
-      fi
-      seg+="$ch"
-      [ "$ch" = "$q" ] && q=""
-      continue
-    fi
-    case "$ch" in
-      '\')
-        seg+="$ch"
-        if [ $((i + 1)) -lt "$n" ]; then i=$((i + 1)) ; seg+="${s:i:1}" ; fi
-        ;;
-      "'" | '"') q="$ch" ; seg+="$ch" ;;
-      ';' | '|' | '&' | '(' | ')' | '{' | '}' | $'\n') segments+=("$seg") ; seg="" ;;
-      *) seg+="$ch" ;;
-    esac
-  done
-  segments+=("$seg")
-}
-
-# strip one layer of surrounding quotes so `"origin/main:$f"` reads as origin/main:$f
-unquote() {
-  local w="$1"
-  w="${w#\"}" ; w="${w%\"}"
-  w="${w#\'}" ; w="${w%\'}"
-  printf '%s' "$w"
-}
-
-# a word that the shell would glob-expand against the working tree
-is_glob_word() {
-  case "$1" in
-    *\**| *\?*) return 0 ;;
-  esac
-  return 1
-}
-
-# a word naming a path on a remote-tracking ref, e.g. origin/main:.github/workflows/x.yml
-is_remote_pathspec() {
-  case "$(unquote "$1")" in
-    origin/*:*) return 0 ;;
-  esac
-  return 1
-}
-
-# a bare remote-tracking ref used as a git-grep search root, e.g. origin/main
-is_remote_ref() {
-  case "$(unquote "$1")" in
-    origin/*:*) return 1 ;;
-    origin/?*) return 0 ;;
-  esac
-  return 1
-}
-
-saw_working_tree_enum=0
-saw_remote_read=0
-saw_ls_tree=0
-enum_example=""
-read_example=""
-
-# --- classify one segment ---------------------------------------------------------------
-classify_segment() {
-  local seg="$1"
-  local -a w=()
-  read -r -a w <<<"$seg"
-  local i=0 n=${#w[@]}
-  [ "$n" -gt 0 ] || return 0
-
-  # leading shell keywords a separator leaves at the head of a segment, plus FOO=bar
-  while [ "$i" -lt "$n" ]; do
-    case "${w[$i]}" in
-      do | then | else | elif | '!' | time | nohup | exec | command | env)
-        i=$((i + 1)) ;;
-      [A-Za-z_][A-Za-z0-9_]*=*) i=$((i + 1)) ;;
-      *) break ;;
-    esac
-  done
-  [ "$i" -lt "$n" ] || return 0
-
-  local head="${w[$i]##*/}"
-  local j
-
-  # (a) working-tree enumeration ---------------------------------------------------------
-  case "$head" in
-    for)
-      # for NAME in WORD…  — a glob in the `in` list expands against the working tree
-      for ((j = i + 1; j < n; j++)); do
-        [ "${w[$j]}" = "in" ] || continue
-        local k
-        for ((k = j + 1; k < n; k++)); do
-          if is_glob_word "${w[$k]}"; then
-            saw_working_tree_enum=1
-            [ -n "$enum_example" ] || enum_example="for ${w[$((i + 1))]} in ${w[$k]}"
-            return 0
-          fi
-        done
-        break
-      done
-      ;;
-    ls)
-      for ((j = i + 1; j < n; j++)); do
-        if is_glob_word "${w[$j]}"; then
-          saw_working_tree_enum=1
-          [ -n "$enum_example" ] || enum_example="ls ${w[$j]}"
-          return 0
-        fi
-      done
-      ;;
-    find)
-      # find PATH … — enumerates the working tree whether or not a glob is written
-      for ((j = i + 1; j < n; j++)); do
-        case "${w[$j]}" in
-          -*) break ;;
-          *)
-            saw_working_tree_enum=1
-            [ -n "$enum_example" ] || enum_example="find ${w[$j]}"
-            return 0 ;;
-        esac
-      done
-      ;;
-  esac
-
-  # (b) an origin/… read, and the ls-tree suppressor -------------------------------------
-  [ "$head" = "git" ] || return 0
-  i=$((i + 1))
-  while [ "$i" -lt "$n" ]; do
-    case "${w[$i]}" in
-      -C | -c | --exec-path | --git-dir | --work-tree | --namespace) i=$((i + 2)) ;;
-      -*) i=$((i + 1)) ;;
-      *) break ;;
-    esac
-  done
-  [ "$i" -lt "$n" ] || return 0
-
-  case "${w[$i]}" in
-    ls-tree)
-      # enumerating from the ref you read from: the canonical idiom, never blocked
-      for ((j = i + 1; j < n; j++)); do
-        if is_remote_ref "${w[$j]}" || is_remote_pathspec "${w[$j]}"; then
-          saw_ls_tree=1
-          return 0
-        fi
-      done
-      ;;
-    show | cat-file)
-      for ((j = i + 1; j < n; j++)); do
-        if is_remote_pathspec "${w[$j]}"; then
-          saw_remote_read=1
-          [ -n "$read_example" ] || read_example="git ${w[$i]} $(unquote "${w[$j]}")"
-          return 0
-        fi
-      done
-      ;;
-    grep)
-      for ((j = i + 1; j < n; j++)); do
-        if is_remote_ref "${w[$j]}"; then
-          saw_remote_read=1
-          [ -n "$read_example" ] || read_example="git grep … $(unquote "${w[$j]}")"
-          return 0
-        fi
-      done
-      ;;
-  esac
-  return 0
-}
-
-split_segments "$cmd"
-for seg in "${segments[@]}"; do
-  classify_segment "$seg"
-done
-
-# Either half alone is correct and ordinary. The DEFECT is the pair, and only when the
-# population is never cross-checked against the ref being read.
-if [ "$saw_working_tree_enum" = "1" ] && [ "$saw_remote_read" = "1" ] && [ "$saw_ls_tree" = "0" ]; then
-  cat >&2 <<EOF
-⛔ Blocked: this command takes its file LIST from the working tree and its file CONTENTS
-   from origin/main. The result is a zero that looks like a full-tree scan.
-   enumeration: $enum_example
-   read:        $read_example
-
-The origin/main reading rule covers CONTENTS. It does not cover ENUMERATION. Files that
-exist on origin/main but not at this checkout's current HEAD are never iterated, so the
-loop cannot report them and cannot know it missed them — every file it does open is read
-perfectly correctly, which is what makes the output so convincing.
-
-Measured HERE, 2026-08-29 (objectstack#13305): working tree 30 workflow files,
-origin/main 31. The missing one was .github/workflows/governed-surface-guard.yml, which
-declares ready_for_review — the answer to the very question being asked. 10 PRs were
-flipped to ready on that reading, during a runner-capacity outage.
-
-⚠️ A zero-hit control does NOT cover this. One was run at the time and passed, because it
-was drawn from the same faulty file list: it validated the MATCHER, not the ENUMERATION.
-「一个对照必须有能力因为你担心的那个原因而失败;同源对照结构上做不到。」
-
-Enumerate from the ref you are reading from:
-  git ls-tree --name-only origin/main <dir>
-  git ls-tree -r --name-only origin/main <dir>      # recursive
-
-  # the population/read cross-check, before trusting any zero:
-  git ls-tree --name-only origin/main <dir> | wc -l
-  ls <dir>/* | wc -l                                # differ? the working tree is not the population
-
-A command that enumerates with git ls-tree is never blocked here, however it then reads.
-Either half alone is fine too — this fires only on the two together.
-
-Deliberate exception (the working tree really is the population you mean — e.g. asking
-what YOUR branch changed): set OS_ALLOW_TREE_ENUM=1 in the
-environment this hook itself runs in — a local settings "env" entry, or whatever this
-agent process was started with. A VAR=1 prefix on a command sets it for that command
-only, and this hook is not that command, so a prefix never reaches it.
-EOF
-  exit 2
-fi
-
-exit 0
diff --git a/ui/.claude/settings.json b/ui/.claude/settings.json
index 30c3367037d..728c37b0209 100644
--- a/ui/.claude/settings.json
+++ b/ui/.claude/settings.json
@@ -33,35 +33,5 @@
       "mcp__github__enable_pr_auto_merge",
       "mcp__github__disable_pr_auto_merge"
     ]
-  },
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Edit|Write|NotebookEdit",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/guard-main-checkout.sh\""
-          }
-        ]
-      },
-      {
-        "matcher": "Bash",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/guard-shared-stash.sh\""
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/guard-main-checkout-bash.sh\""
-          },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/guard-tree-enum.sh\""
-          }
-        ]
-      }
-    ]
   }
 }