diff --git a/.claude/hooks/guard-governed-enqueue.selftest.sh b/.claude/hooks/guard-governed-enqueue.selftest.sh
deleted file mode 100755
index 2d9f332ea51..00000000000
--- a/.claude/hooks/guard-governed-enqueue.selftest.sh
+++ /dev/null
@@ -1,633 +0,0 @@
-#!/usr/bin/env bash
-# Self-test for guard-governed-enqueue.sh — run it after touching that hook:
-#
-#   .claude/hooks/guard-governed-enqueue.selftest.sh
-#
-# Feeds the hook the same JSON payload shape Claude Code delivers on PreToolUse
-# and asserts the block/allow verdict per case, plus the load-bearing sentences
-# of the refusal. Modelled on guard-shared-stash.selftest.sh; the two matrices
-# are kept in the same shape so neither drifts into its own idiom.
-#
-# NO NETWORK. The three GitHub reads come from `OS_GOVERNED_ENQUEUE_FIXTURE`
-# (documented in the hook's header as test-only injection): a directory holding
-# `pull.json` / `files.json` / `reviews.json`. What is NOT stubbed is the part
-# that matters — both predicates run for real, so this matrix fails if the hook
-# ever stops asking the register and the queue guard and starts deciding for
-# itself.
-#
-# Needs `jq` (to build fixtures) and `node` (the two real predicates run). No
-# pnpm install, no build: measured against a worktree with no `node_modules`.
-#
-# ⚠️ THE PURE-REGENERATION CASE IS AN AGREEMENT ASSERTION, NOT A FIXED VERDICT,
-# and that is a repair rather than a preference: the first revision of this file
-# hard-coded `expect allow` against the one exception row that was cheap to
-# lift, and that row was retired upstream hours later — the case then went red
-# over a register change the hook had nothing to do with. Copying a verdict out
-# of the register makes this matrix a second register. It now ASKS the register
-# and requires the hook to answer the same way; see that block for the detail.
-
-set -uo pipefail
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-hook="$here/guard-governed-enqueue.sh"
-# The hook `run`/`stderr_of` actually invoke. It is `$hook` for every case but
-# one: the bare `gh pr merge <n>` case asks the hook about a DIFFERENT checkout's
-# origin, and the hook derives its repo root from its own path, so that case runs
-# a copy sitting in a checkout it built — and restores this on the next line.
-hook_under_test="$hook"
-repo_root="$(cd "$here/../.." && pwd)"
-pass=0
-fail=0
-
-command -v jq >/dev/null 2>&1 || { echo "selftest needs jq to build payloads" >&2; exit 1; }
-command -v node >/dev/null 2>&1 || { echo "selftest needs node: both predicates run for real" >&2; exit 1; }
-[ -x "$hook" ] || { echo "hook is not executable: $hook" >&2; exit 1; }
-
-HEAD_SHA=b25f061c6a1d4e2f3c9b8a7d6e5f4a3b2c1d0e9f
-OLD_SHA=0f9e8d7c6b5a4938271605f4e3d2c1b0a98877665
-
-root="$(mktemp -d)"
-trap 'rm -rf "$root"' EXIT INT TERM
-
-# fixture <name> <files-json> <reviews-json> -> prints the directory
-fixture() {
-  local dir="$root/$1"
-  mkdir -p "$dir"
-  jq -nc --arg s "$HEAD_SHA" '{head:{sha:$s}}' > "$dir/pull.json"
-  printf '%s' "$2" > "$dir/files.json"
-  printf '%s' "$3" > "$dir/reviews.json"
-  printf '%s' "$dir"
-}
-
-files_of() { # files_of path... -> the /pulls/{n}/files body shape
-  local out="[]" p
-  for p in "$@"; do out="$(printf '%s' "$out" | jq -c --arg f "$p" '. + [{filename:$f}]')"; done
-  printf '%s' "$out"
-}
-
-# A RENAME is the one entry shape `files_of` cannot build: every other status
-# carries `filename` alone, a renamed one ALSO carries `previous_filename`.
-# Measured on PR #17372 (`GET /pulls/17372/files`): `filename` is the NEW path,
-# `previous_filename` the OLD one. `files_of` keeps its shape; this is the twin.
-renamed_of() { # renamed_of <old path> <new path> -> the /files body for one RENAME
-  jq -nc --arg o "$1" --arg n "$2" '[{filename:$n,previous_filename:$o,status:"renamed"}]'
-}
-
-approved_at() { # approved_at <login> <sha>
-  jq -nc --arg l "$1" --arg c "$2" '[{state:"APPROVED",user:{login:$l},commit_id:$c}]'
-}
-
-NO_REVIEWS='[]'
-GOVERNED_FILES="$(files_of AGENTS.md packages/spec/src/index.ts)"
-CLEAR_FILES="$(files_of packages/spec/src/index.ts README.md)"
-# The incident's own file class, and four of them, the way it actually happened:
-# `skills/*/references/_index.md` is a governed `skills/**` path whose generator
-# (`gen:skill-refs`) owns it, so a byte-exact regeneration is lifted and needs no
-# approval at all. Every path here must be one the generator DECLARES — a skill
-# absent from its map is hand-authored content that stays governed, which is the
-# ruling's own limit and not a bug to route around.
-REGEN_PATHS="skills/objectstack-data/references/_index.md skills/objectstack-query/references/_index.md skills/objectstack-ui/references/_index.md skills/objectstack-api/references/_index.md"
-# shellcheck disable=SC2086
-REGEN_FILES="$(files_of $REGEN_PATHS)"
-
-F_UNAPPROVED="$(fixture governed-unapproved "$GOVERNED_FILES" "$NO_REVIEWS")"
-F_PINNED="$(fixture governed-pinned "$GOVERNED_FILES" "$(approved_at os-zhuang "$HEAD_SHA")")"
-F_OLDER="$(fixture governed-approved-on-an-earlier-commit "$GOVERNED_FILES" "$(approved_at os-zhuang "$OLD_SHA")")"
-F_OUTSIDER="$(fixture governed-outsider "$GOVERNED_FILES" "$(approved_at os-warren "$HEAD_SHA")")"
-F_DISMISSED="$(fixture governed-dismissed "$GOVERNED_FILES" \
-  "$(jq -nc --arg c "$HEAD_SHA" '[{state:"APPROVED",user:{login:"os-zhuang"},commit_id:$c},{state:"DISMISSED",user:{login:"os-zhuang"},commit_id:$c}]')")"
-F_CLEAR="$(fixture not-governed "$CLEAR_FILES" "$NO_REVIEWS")"
-F_REGEN="$(fixture pure-regeneration "$REGEN_FILES" "$NO_REVIEWS")"
-F_EMPTY="$(fixture empty-diff '[]' "$NO_REVIEWS")"
-F_RENAMED_OFF="$(fixture governed-renamed-off-the-surface "$(renamed_of AGENTS.md docs/AGENTS.md)" "$NO_REVIEWS")"
-F_RENAMED_CLEAR="$(fixture rename-within-an-ordinary-prefix "$(renamed_of packages/spec/src/a.ts packages/spec/src/b.ts)" "$NO_REVIEWS")"
-
-mcp() { # mcp <tool> <pull> [owner] [repo]
-  jq -nc --arg t "$1" --argjson n "$2" --arg o "${3:-objectstack-ai}" --arg r "${4:-objectstack}" \
-    '{tool_name:$t,tool_input:{owner:$o,repo:$r,pullNumber:$n}}'
-}
-bash_call() { jq -nc --arg c "$1" '{tool_name:"Bash",tool_input:{command:$c}}'; }
-
-AUTO=mcp__github__enable_pr_auto_merge
-MERGE=mcp__github__merge_pull_request
-
-# The hook is the LAST element of the pipeline, so `$?` here is the HOOK's exit
-# status and not some downstream reader's. That is the only shape in which
-# reading a status after a pipe is safe, and it is why nothing is piped past it.
-run() { # run <payload> [env assignments…] -> allow | block | exitN
-  local payload="$1"; shift
-  local rc
-  printf '%s' "$payload" | env "$@" "$hook_under_test" >/dev/null 2>&1
-  rc=$?
-  case "$rc" in
-    0) printf 'allow' ;;
-    2) printf 'block' ;;
-    *) printf 'exit%s' "$rc" ;;
-  esac
-}
-
-stderr_of() { # stderr_of <payload> [env…]
-  local payload="$1"; shift
-  printf '%s' "$payload" | env "$@" "$hook_under_test" 2>&1 >/dev/null
-}
-
-expect() { # expect <block|allow> <label> <payload> [env…]
-  local want="$1" label="$2" payload="$3"; shift 3
-  local got; got="$(run "$payload" "$@")"
-  if [ "$got" = "$want" ]; then
-    pass=$((pass + 1)); printf '  ok   %-5s  %s\n' "$got" "$label"
-  else
-    fail=$((fail + 1)); printf '  FAIL want=%s got=%s  %s\n' "$want" "$got" "$label"
-  fi
-}
-
-expect_says() { # expect_says <needle> <label> <payload> [env…]
-  local needle="$1" label="$2" payload="$3"; shift 3
-  local out; out="$(stderr_of "$payload" "$@")"
-  case "$out" in
-    *"$needle"*) pass=$((pass + 1)); printf '  ok   says   %s\n' "$label" ;;
-    *) fail=$((fail + 1)); printf '  FAIL missing "%s"  %s\n' "$needle" "$label" ;;
-  esac
-}
-
-# The other direction, and it earns its place: a retired RULE leaves its
-# sentence behind in the text a seat actually reads, long after the predicate
-# stopped enforcing it. `expect_says` cannot catch that — only an assertion that
-# a phrase is ABSENT can.
-expect_lacks() { # expect_lacks <needle> <label> <payload> [env…]
-  local needle="$1" label="$2" payload="$3"; shift 3
-  local out; out="$(stderr_of "$payload" "$@")"
-  case "$out" in
-    *"$needle"*) fail=$((fail + 1)); printf '  FAIL still says "%s"  %s\n' "$needle" "$label" ;;
-    *) pass=$((pass + 1)); printf '  ok   lacks  %s\n' "$label" ;;
-  esac
-}
-
-echo "== the incident's own shape: governed + no approval at all =="
-expect block 'enable_pr_auto_merge on a governed PR with zero reviews' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect block 'merge_pull_request on a governed PR with zero reviews' \
-  "$(mcp $MERGE 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-
-echo "== the refusal carries its one-line reason and its remedy =="
-expect_says 'approve BEFORE enqueue' 'the order is stated' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect_says 'does NOT re-run on a later approval' 'the no-re-run reason is stated' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect_says 'OS_ALLOW_GOVERNED_ENQUEUE=1' 'the deliberate exception is named' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-# …and it names WHERE that variable has to be set. A VAR=1 prefix sets the variable in the
-# environment of THAT COMMAND; this hook is not that command, and it reads its own
-# environment, so a prefix never reaches it (#15971). The `lacks` row is the shape shared
-# with the other four matrices, where the dead prefix remedy was actually printed.
-expect_lacks 're-run with' 'no prefix remedy is offered for the exception' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect_says 'hook itself runs in' 'the exception names the environment this hook reads' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect_says "$HEAD_SHA" 'the current head sha is named so the reader knows which PR state this is' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect_says 'does NOT have to sit on the' 'the remedy states the 2026-09-04 predicate, not the retired sha pin' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect_lacks 'unpins it' 'the retired advice (a push unpins the approval) is gone from the refusal' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect_says 'AGENTS.md' 'the governed hit is named' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-
-echo "== an AUTHORIZED APPROVED review is the pass, on the head or on any commit =="
-expect allow 'governed + os-zhuang APPROVED at the current head' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_PINNED"
-# ⭐ 2026-09-04, verbatim: 只需要有人工批准记录就行，不需要卡最新的提交。 Under the
-# retired sha pin this SAME fixture was the block case, which is exactly why it
-# is pinned in the ruled direction here rather than deleted. The hook holds no
-# predicate of its own, so this direction arrives entirely through the imported
-# `authorizedApprovalVerdict` — flipping it back there flips this case red.
-expect allow 'governed + os-zhuang APPROVED on an EARLIER commit still counts' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_OLDER"
-
-echo "== the two ways an approval does not count (authorizedApprovalVerdict, imported) =="
-expect block 'an APPROVED review from outside GOVERNED_APPROVERS never counts' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_OUTSIDER"
-expect block 'a later DISMISSED supersedes the same reviewer approval' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_DISMISSED"
-expect_says 'outside the authorized set' 'an unauthorized approval is reported as such' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_OUTSIDER"
-
-echo "== nothing governed in the diff: allowed, and no review is ever consulted =="
-expect allow 'an ordinary diff enqueues freely' \
-  "$(mcp $AUTO 14070)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_CLEAR"
-
-echo "== a RENAME is a change to BOTH paths, so the OLD one is read too =="
-# Read `filename` alone and the old path is simply absent from the list handed to
-# the register — and a dropped path can only REMOVE governance, never add it, so
-# a diff that moves AGENTS.md to docs/AGENTS.md would read here as an ordinary
-# one. The other two readers of the same diff already see both paths (the queue
-# guard decomposes per commit with `--no-renames`, and `--pr` derives the list
-# three-dot), so this is the hook catching up to them, not a new predicate.
-expect block 'a governed file renamed OFF the governed surface is still governed' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_RENAMED_OFF"
-expect_says 'AGENTS.md' 'the OLD path is the governed hit the refusal names' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_RENAMED_OFF"
-expect allow 'a rename inside a non-governed prefix changes no verdict' \
-  "$(mcp $AUTO 14070)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_RENAMED_CLEAR"
-
-echo "== PURE REGENERATION: the hook must AGREE with the register, never re-decide =="
-# The requirement (maintainer 2026-09-01: 纯生成的指针行 … 不需要我审核吧) is that
-# this hook never re-closes a zero-approval path the register clears. Pinned
-# against a REAL exception-row candidate, and pinned as AGREEMENT rather than as
-# a fixed verdict, for a reason this matrix learned the hard way: an earlier
-# revision hard-coded `expect allow` on the one row that was cheap to lift, that
-# row was RETIRED upstream the same day (its surface left the governed fence
-# entirely), and the case then failed for a reason that had nothing to do with
-# the hook. A verdict copied from the register is a second register.
-#
-# So: ask the register what it says about this path list on THIS tree, and
-# require the hook to answer the same way.
-#   exit 0 => lifted (the generator toolchain is present and the bytes match)
-#             => the hook MUST allow with zero reviews. This is the branch CI
-#                takes, where dependencies are installed.
-#   exit 3 => not lifted (fail-closed: no toolchain, or a hand edit)
-#             => the hook MUST refuse, exactly as the register asked.
-# Either way the property under test holds: the hook contributes no judgment of
-# its own about the exemption.
-# shellcheck disable=SC2086
-node "$repo_root/scripts/pm/check-governed-merges.mjs" --test $REGEN_PATHS >/dev/null 2>&1
-regen_rc=$?
-if [ "$regen_rc" -eq 0 ]; then
-  regen_want=allow
-  regen_branch='LIFTED — byte-exact regeneration, so zero approvals must pass (the toolchain is present here)'
-else
-  regen_want=block
-  regen_branch="NOT lifted (exit $regen_rc, fail-closed: no generator toolchain, or a hand edit) — the refusal must stand"
-fi
-printf '  ..   register verdict on the four %s: %s\n' 'skills/*/references/_index.md' "$regen_branch"
-expect "$regen_want" 'the hook agrees with the register about an exception-row candidate' \
-  "$(mcp $AUTO 14070)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_REGEN"
-
-# ...and the structural half, which no fixture can go stale on: the ONLY branch
-# that can reach a refusal is the register's own "governed" exit code. Anything
-# the register clears leaves through `exit 0` before a single review is read.
-if grep -qE '^[[:space:]]*0\)[[:space:]]*exit 0' "$hook"; then
-  pass=$((pass + 1)); printf '  ok   wired  a cleared predicate verdict exits before any review is read\n'
-else
-  fail=$((fail + 1)); printf '  FAIL the hook no longer allows unconditionally on a cleared predicate verdict\n'
-fi
-
-echo "== the Bash spellings reach the same decision =="
-expect block 'gh pr merge <n> -R owner/repo' \
-  "$(bash_call 'gh pr merge 13794 -R objectstack-ai/objectstack --squash')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect block 'gh pr merge --auto --repo=owner/repo <n>' \
-  "$(bash_call 'gh pr merge --auto --repo=objectstack-ai/objectstack 13794')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect block 'gh pr merge <html url>' \
-  "$(bash_call 'gh pr merge https://github.com/objectstack-ai/objectstack/pull/13794 --squash')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect block 'a REST PUT .../pulls/<n>/merge through curl' \
-  "$(bash_call 'curl -sS -X PUT https://api.github.com/repos/objectstack-ai/objectstack/pulls/13794/merge -d "{}"')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect block 'gh api -X PUT /repos/o/r/pulls/<n>/merge' \
-  "$(bash_call 'gh api -X PUT /repos/objectstack-ai/objectstack/pulls/13794/merge')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect block 'reached through a separator' \
-  "$(bash_call 'git fetch origin main && gh pr merge 13794 -R objectstack-ai/objectstack')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect allow 'the same Bash spelling on an approved PR' \
-  "$(bash_call 'gh pr merge 13794 -R objectstack-ai/objectstack')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_PINNED"
-
-echo "== a bare \`gh pr merge <n>\` derives the slug from the checkout's OWN origin =="
-# The second half of this card's defect, and the expensive half: with no `-R` the
-# target repo comes from the checkout's `origin`, so a `.git` suffix left on the
-# slug rides into the API URL — `GET /repos/objectstack-ai/objectstack.git/pulls/N`
-# answers 404 and this guard's read-failure branch ALLOWS. On any clone made with
-# the URL `git clone` hands out by default, that spelling was unguarded.
-#
-# The checkout is BUILT here: the hook derives its repo root from its own path
-# (`BASH_SOURCE`), so the only way to ask it about another origin is to run a copy
-# that sits in one. `.claude/hooks/` and `scripts/` are symlinked back at this
-# tree, so both predicates are the same files, running the same way.
-#
-# ⛔ The allow/block verdict is deliberately NOT asserted here, and that is
-# measured rather than cautious: `OS_GOVERNED_ENQUEUE_FIXTURE` answers EVERY path,
-# so the 404 that makes the real guard fail open cannot be reproduced without the
-# network — under the fixture the wrong slug blocks exactly like the right one,
-# and a verdict row here would pass in both worlds. What discriminates is the slug
-# itself, which the refusal prints as `<owner>/<repo>#<n>`: it read
-# `objectstack-ai/objectstack.git#13794` until `slug_of` stripped the suffix.
-DOTGIT_CLONE="$root/dotgit-url-clone"     # under $root: the existing trap removes it
-mkdir -p "$DOTGIT_CLONE/.claude/hooks"
-ln -s "$hook" "$DOTGIT_CLONE/.claude/hooks/guard-governed-enqueue.sh"
-ln -s "$repo_root/scripts" "$DOTGIT_CLONE/scripts"
-git -C "$DOTGIT_CLONE" init -q >/dev/null 2>&1
-git -C "$DOTGIT_CLONE" remote add origin https://github.com/objectstack-ai/objectstack.git >/dev/null 2>&1
-hook_under_test="$DOTGIT_CLONE/.claude/hooks/guard-governed-enqueue.sh"
-expect_says 'objectstack-ai/objectstack#13794' 'the slug the guard reads is the one the API answers for' \
-  "$(bash_call 'gh pr merge 13794 --squash')" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect_lacks 'objectstack.git' 'no .git suffix rides into the repo path the guard reads' \
-  "$(bash_call 'gh pr merge 13794 --squash')" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-hook_under_test="$hook"                   # every case below is back on the real hook
-
-echo "== an UNQUOTED \\\" opens no quote, so the merge behind it is still seen =="
-# The #11738 class, carried by all three Bash-reading guards in this directory:
-# segmentation used to read the escaped `\"` as OPENING a region that never
-# closed, every separator behind it went inert, and the real command rode
-# through as an argument of something harmless.
-expect block 'echo \" ; gh pr merge <n>' \
-  "$(bash_call 'echo \" ; gh pr merge 13794 -R objectstack-ai/objectstack')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect allow 'echo \" ; git status  (precision twin: no manufactured block)' \
-  "$(bash_call 'echo \" ; git status')" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-
-echo "== writing ABOUT the ban must not trip the ban =="
-expect allow 'grep -n "gh pr merge" AGENTS.md' \
-  "$(bash_call 'grep -n "gh pr merge" AGENTS.md')" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect allow 'echo "never gh pr merge a governed PR"' \
-  "$(bash_call 'echo "never gh pr merge a governed PR"')" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-
-echo "== unrelated tools and commands are untouched =="
-expect allow 'a Bash command that enqueues nothing' \
-  "$(bash_call 'pnpm --filter @objectstack/spec test')" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect allow 'a non-enqueue MCP tool' \
-  "$(jq -nc '{tool_name:"mcp__github__create_pull_request",tool_input:{owner:"objectstack-ai",repo:"objectstack",draft:true}}')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect allow 'an Edit call' \
-  "$(jq -nc '{tool_name:"Edit",tool_input:{file_path:"AGENTS.md"}}')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-
-echo "== parse-confidently-or-allow =="
-expect allow 'a payload with no tool_name at all' '{}' "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect allow 'an empty payload' '' "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect allow 'an enqueue call naming no pull number' \
-  "$(jq -nc --arg t "$AUTO" '{tool_name:$t,tool_input:{owner:"objectstack-ai",repo:"objectstack"}}')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect allow 'a non-numeric pull number' \
-  "$(jq -nc --arg t "$AUTO" '{tool_name:$t,tool_input:{owner:"objectstack-ai",repo:"objectstack",pullNumber:"nope"}}')" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect allow 'gh pr merge on the CURRENT branch (the PR is not named)' \
-  "$(bash_call 'gh pr merge --auto --squash')" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-expect_says 'names no pull request' 'the unidentifiable form says why it was allowed' \
-  "$(bash_call 'gh pr merge --auto --squash')" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED"
-
-echo "== FAIL-OPEN on a read failure, with the reason on stderr =="
-expect allow 'the API cannot be read at all' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED" OS_GOVERNED_ENQUEUE_READFAIL=1
-expect_says 'ALLOWING' 'the fail-open says it is allowing' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED" OS_GOVERNED_ENQUEUE_READFAIL=1
-expect_says 'merge-queue guard remains the hard line' 'the fail-open names where correctness still lives' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED" OS_GOVERNED_ENQUEUE_READFAIL=1
-expect allow 'a PR reporting no changed files is not a governed answer' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_EMPTY"
-
-echo "== a generated-exception row on a repo with no checkout to recompute against =="
-# With no checkout of the target repo the register cannot recompute the row's
-# provenance on the RIGHT tree, and judging one repo's paths against another's
-# files would be worse than not answering: fail open, say so.
-#
-# ⚠️ THIS CASE'S PREMISE IS INJECTED, AND THE INJECTION IS THE REPAIR. It used to
-# rest on a fact about the BOX — "objectstack-ai/cloud has no sibling checkout
-# here" — which is a property of the container, not of the hook, and not true
-# everywhere: on a box that does carry a sibling `cloud` checkout the guard
-# resolved it, recomputed the predicate on it and BLOCKED, so this matrix read
-# `54 passed, 1 failed` there and was green in CI only because the runner
-# mounts no sibling. A case whose verdict depends on what else happens to sit
-# next to the checkout is not hermetic, whatever the step comment says. It now
-# points the lookup at a directory it created itself and therefore knows is
-# empty, so the "cannot resolve" premise is one this file OWNS on every box.
-# ONE spelling of the path, read by the fixture the hook is handed AND by the
-# register leg below. Two spellings drift: change the fixture alone and the
-# agreement leg goes on asking about the old path, which is agreement with a
-# question nobody asked.
-CROSS_REPO_PATH=skills/objectstack-data/references/_index.md
-F_CROSS_REGEN="$(fixture cross-repo-regen "$(files_of "$CROSS_REPO_PATH")" "$NO_REVIEWS")"
-NO_SIBLING_ROOT="$root/no-sibling-here"   # under $root: the existing trap removes it
-mkdir -p "$NO_SIBLING_ROOT"
-#
-# ⚠️ AND IT DOES NOT REACH THE "no checkout … is available" FAIL-OPEN — measured,
-# because the comment that used to sit here said it did. With nothing resolved
-# the register is asked WITHOUT `--root`, so it answers about THIS tree, where
-# this path is byte-exact against its own generator and therefore LIFTED: the
-# hook leaves at the cleared-predicate `exit 0` with EMPTY stderr, several
-# branches above that fail-open. Pinning a warning here would pin a sentence
-# nothing prints. What this case does hold is the property the card is about —
-# the verdict must not depend on what else is mounted beside the checkout — and
-# the resolved-sibling case below is its other half: same fixture, same payload,
-# only the injected root differs.
-expect allow 'an exception-row path in a repo this container cannot resolve' \
-  "$(mcp $AUTO 999 objectstack-ai cloud)" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_CROSS_REGEN" "OS_GOVERNED_ENQUEUE_SIBLING_ROOT=$NO_SIBLING_ROOT"
-
-echo "== ...and a sibling checkout that DOES resolve is audited on its own tree =="
-# The other half of that same branch, and the reason the case above needs an
-# injection rather than a rename: when a checkout of the target repo IS
-# reachable, resolving it and recomputing the predicate there is the DESIGNED
-# behaviour — the answer then reflects the DIFF instead of the environment,
-# which is the whole point of passing `--root`. Pin only the fail-open and the
-# guard stays green after it stops looking for siblings at all.
-#
-# The sibling is BUILT here rather than borrowed from the box: `git init` plus an
-# `origin` naming objectstack-ai/cloud is the entire admission requirement, since
-# the hook compares origin slugs and reads nothing else. Measured on a container
-# carrying the real read-only /home/user/cloud checkout: this throwaway and that
-# checkout hand the register the SAME verdict with the SAME reason — governed,
-# `pureRegeneration: false`, "the generator declared no output set … fail closed"
-# — because the `gen:skill-refs` toolchain cannot run on either tree. The
-# throwaway reproduces the real sibling, so no further tree is needed.
-#
-# ⛔ The origin URL is the BARE form on purpose — do not "tidy" a `.git` suffix
-# onto it. The hook's slug reader keeps that suffix (its path character class
-# owns the dot and swallows it, leaving `cloud.git`), so the `.git` spelling
-# resolves NOTHING and this case would silently become a second copy of the one
-# above. Measured here; filed separately as its own defect, since the same
-# reader also derives the slug for a bare `gh pr merge <n>`.
-#
-# ⭐ Asserted as AGREEMENT with the register, for the reason the pure-regeneration
-# case above learned the hard way: `skills/**` leaving the governed fence, or this
-# exception row being retired, would flip the verdict for a reason the hook had
-# nothing to do with, and a verdict copied from the register makes this matrix a
-# second register. Here and in CI today that branch is `block`.
-SIBLING_ROOT="$root/sibling-parent"       # under $root: the existing trap removes it
-mkdir -p "$SIBLING_ROOT/cloud"
-git -C "$SIBLING_ROOT/cloud" init -q >/dev/null 2>&1
-git -C "$SIBLING_ROOT/cloud" remote add origin https://github.com/objectstack-ai/cloud >/dev/null 2>&1
-node "$repo_root/scripts/pm/check-governed-merges.mjs" --test --root "$SIBLING_ROOT/cloud" \
-  "$CROSS_REPO_PATH" >/dev/null 2>&1
-sibling_rc=$?
-if [ "$sibling_rc" -eq 0 ]; then
-  sibling_want=allow
-  sibling_branch='LIFTED on the sibling tree — the hook must answer the same way'
-else
-  sibling_want=block
-  sibling_branch="GOVERNED on the sibling tree (exit $sibling_rc, fail-closed: the generator cannot run there) — the refusal must stand"
-fi
-printf '  ..   register verdict on the RESOLVED sibling: %s\n' "$sibling_branch"
-expect "$sibling_want" 'a sibling checkout that resolves is audited, never waved through' \
-  "$(mcp $AUTO 999 objectstack-ai cloud)" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_CROSS_REGEN" "OS_GOVERNED_ENQUEUE_SIBLING_ROOT=$SIBLING_ROOT"
-# ⛔ No companion assertion that the fail-open text is ABSENT here — it was
-# written, and measured to be a phantom: when the sibling does NOT resolve the
-# hook does not print that warning either (it leaves at the cleared-predicate
-# exit with empty stderr, per the case above), so the assertion passed in both
-# worlds and discriminated nothing. The verdict row above is the discriminator,
-# and it is the one that goes red when the sibling stops being resolved.
-
-echo "== an exception row with NO tree to recompute it on takes the fail-open =="
-# The branch neither case above reaches, and the reason it needs a third fixture
-# rather than a third root: with nothing resolved the register is asked WITHOUT
-# `--root`, so it answers about THIS tree, and a path this tree's generator owns
-# is LIFTED there — the cleared-predicate `exit 0`, several branches ABOVE the
-# fail-open. To reach it the payload must carry a path that stays GOVERNED with
-# an exception row wherever the register is asked: a `skills/**` path that no
-# generator declares. The hook then holds an exception row and no right tree to
-# recompute its provenance on, which is the whole of this branch's premise.
-#
-# The injected root is the EMPTY one the case above already built — same
-# injection, and the path shape is the only thing separating the cleared exit
-# from this warning. Reused rather than re-created so the two cases cannot drift
-# into asking about different emptiness.
-#
-# ⛔ Do not "fix" the path to a real skill. A declared path is byte-exact
-# against its own output here and is lifted, which would turn this case into a
-# silent second copy of the one above — green forever over a branch nothing
-# reaches, the exact failure this file was repaired for once already.
-#
-# Hermetic in both directions and both were measured: with `node_modules`
-# present the register answers "does not write … not among the 9 file(s) that
-# generator declared on this tree"; without it, "the generator declared no
-# output set (the generator's own --check exited 254)". Two reasons, one
-# precondition — exit 3 carrying an exception row — and that precondition is all
-# this branch reads, so the case holds on an installed worktree and on the bare
-# one this file documents itself as running under.
-UNGENERATED_PATH=skills/zz-no-such-skill/references/_index.md
-F_UNGENERATED="$(fixture ungenerated-exception-row "$(files_of "$UNGENERATED_PATH")" "$NO_REVIEWS")"
-# Printed, never asserted: the rows below pin the HOOK's branch, not a register
-# verdict, so copying one in would make this matrix a second register again.
-# It is here so a dead premise — the register no longer answering governed with
-# an exception row for this shape — reads as one line instead of as two
-# mysteriously red text assertions.
-node "$repo_root/scripts/pm/check-governed-merges.mjs" --test --json "$UNGENERATED_PATH" \
-  > "$root/ungenerated-verdict.json" 2>/dev/null
-ungenerated_rc=$?
-printf '  ..   register verdict on THIS tree for the ungenerated path: exit %s with %s exception row(s)\n' \
-  "$ungenerated_rc" "$(jq '.exceptions | length' < "$root/ungenerated-verdict.json" 2>/dev/null || printf '?')"
-expect allow 'an exception row with no checkout to recompute it on is waved through, not refused' \
-  "$(mcp $AUTO 999 objectstack-ai cloud)" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNGENERATED" "OS_GOVERNED_ENQUEUE_SIBLING_ROOT=$NO_SIBLING_ROOT"
-expect_says 'no checkout of objectstack-ai/cloud' 'the fail-open names the repo it could not resolve' \
-  "$(mcp $AUTO 999 objectstack-ai cloud)" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNGENERATED" "OS_GOVERNED_ENQUEUE_SIBLING_ROOT=$NO_SIBLING_ROOT"
-expect_says 'recompute its provenance' 'the fail-open names the reading that was missing' \
-  "$(mcp $AUTO 999 objectstack-ai cloud)" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNGENERATED" "OS_GOVERNED_ENQUEUE_SIBLING_ROOT=$NO_SIBLING_ROOT"
-# THE FIRING CONTROL, and it is what keeps the two rows above from being the
-# phantom this file has already paid for once: the same payload with the sibling
-# RESOLVED (the throwaway built above — one, not two) recomputes on that tree
-# and never reaches the branch, so the sentence must be ABSENT there. Measured
-# in both directions before it was written: unresolved prints it and allows,
-# resolved prints the ordinary governed refusal and blocks. Point either `says`
-# row at this root and it goes red — which is the proof a text assertion owes,
-# and the reading the companion assertion on the resolved-sibling case could not
-# give, since nothing prints that sentence in EITHER of the two worlds it saw.
-expect_lacks 'no checkout of' 'the same payload with the sibling RESOLVED never claims a missing checkout' \
-  "$(mcp $AUTO 999 objectstack-ai cloud)" \
-  "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNGENERATED" "OS_GOVERNED_ENQUEUE_SIBLING_ROOT=$SIBLING_ROOT"
-
-echo "== every spelling of that same origin URL resolves to that same sibling =="
-# The other half of this card's defect. `git clone` hands out
-# `https://github.com/objectstack-ai/cloud.git`, and until `slug_of` stripped that
-# suffix the slug read back as `objectstack-ai/cloud.git` — equal to no
-# `owner/repo` this guard is ever asked about, so a sibling cloned the
-# conventional way resolved NOTHING and the case above silently degraded into a
-# second copy of the "cannot resolve" one. That is why its origin is pinned to the
-# bare form in place; these are the four spellings it does not cover.
-#
-# Same `$sibling_want`, and deliberately the same variable rather than four more
-# register calls: every tree here is built exactly as that one is (an empty
-# `git init` plus an `origin`), so the register would be answering the identical
-# question about identical content — and the verdict still comes FROM the register
-# rather than from a word copied into this file.
-#
-# ⚠️ `-u GIT_CONFIG_COUNT -u GIT_CONFIG_PARAMETERS` is what makes the two
-# `git@github.com:` rows MEAN what they say, and it was measured here rather than
-# assumed: this container injects `url.https://github.com/.insteadOf
-# git@github.com:` through the environment, and the hook reads the origin with
-# `git remote get-url`, which HONOURS that rewrite — so without the unset git
-# hands the hook `https://…` and both ssh rows silently become second copies of
-# the https ones, green forever over a reader they never reach. A row whose
-# premise is a property of the box is the defect the cross-repo case above was
-# repaired for; these rows own theirs. On a machine that injects nothing, `env -u`
-# on an unset name is a no-op.
-spelling_n=0
-for spelling_url in \
-  'https://github.com/objectstack-ai/cloud.git' \
-  'git@github.com:objectstack-ai/cloud' \
-  'git@github.com:objectstack-ai/cloud.git' \
-  'https://github.com/objectstack-ai/cloud.git/' \
-  ; do
-  spelling_n=$((spelling_n + 1))
-  spelling_root="$root/sibling-spelling-$spelling_n"    # under $root: the trap removes it
-  mkdir -p "$spelling_root/cloud"
-  git -C "$spelling_root/cloud" init -q >/dev/null 2>&1
-  git -C "$spelling_root/cloud" remote add origin "$spelling_url" >/dev/null 2>&1
-  expect "$sibling_want" "origin $spelling_url resolves and is audited" \
-    "$(mcp $AUTO 999 objectstack-ai cloud)" \
-    -u GIT_CONFIG_COUNT -u GIT_CONFIG_PARAMETERS \
-    "OS_GOVERNED_ENQUEUE_FIXTURE=$F_CROSS_REGEN" "OS_GOVERNED_ENQUEUE_SIBLING_ROOT=$spelling_root"
-done
-
-echo "== the deliberate exception switch =="
-expect allow 'OS_ALLOW_GOVERNED_ENQUEUE=1 on the blocking case' \
-  "$(mcp $AUTO 13794)" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED" OS_ALLOW_GOVERNED_ENQUEUE=1
-
-echo "== the jq-less fallback still identifies the call and still refuses =="
-nojq="$(mktemp -d)"
-# Every external the hook reaches for, MINUS jq. A missing one here reads as a
-# fail-open ("could not read …"), which is the hook behaving correctly on a
-# broken PATH — so keep this list complete or the case tests the harness.
-for b in bash env cat sed head tail grep printf node git curl mktemp rm tr cut wc dirname; do
-  p="$(command -v "$b")" && ln -s "$p" "$nojq/$b" 2>/dev/null
-done
-printf '%s' "$(mcp $AUTO 13794)" \
-  | env "PATH=$nojq" "OS_GOVERNED_ENQUEUE_FIXTURE=$F_UNAPPROVED" "$hook" >/dev/null 2>&1
-case "$?" in
-  2) pass=$((pass + 1)); printf '  ok   block  (no jq on PATH)\n' ;;
-  0) fail=$((fail + 1)); printf '  FAIL no-jq fallback ALLOWED a governed unapproved enqueue\n' ;;
-  *) fail=$((fail + 1)); printf '  FAIL no-jq fallback exit%s\n' "$?" ;;
-esac
-rm -rf "$nojq"
-
-echo "== the two predicates are the imported ones, not a local copy =="
-# A restatement of either predicate inside the hook is the failure this asserts
-# against: grep the hook for a second path list or a second approver list.
-if grep -q 'check-governed-merges.mjs' "$hook" && grep -q 'authorizedApprovalVerdict' "$hook"; then
-  pass=$((pass + 1)); printf '  ok   wired  both single sources are invoked by name\n'
-else
-  fail=$((fail + 1)); printf '  FAIL the hook no longer invokes both single sources\n'
-fi
-if grep -qE "os-zhuang|hotlong" "$hook"; then
-  fail=$((fail + 1)); printf '  FAIL the hook spells out an approver login: GOVERNED_APPROVERS is the single source\n'
-else
-  pass=$((pass + 1)); printf '  ok   wired  no approver login is spelled out in the hook\n'
-fi
-if grep -vE '^[[:space:]]*#' "$hook" | grep -qE 'AGENTS\.md|CLAUDE\.md|skills/|docs/adr/'; then
-  fail=$((fail + 1)); printf '  FAIL a governed-surface path literal appears in the hook CODE: that is a second register\n'
-else
-  pass=$((pass + 1)); printf '  ok   wired  no governed-path literal outside the header comments\n'
-fi
-
-echo "== the hook is registered where Claude Code will actually run it =="
-settings="$repo_root/.claude/settings.json"
-if [ -f "$settings" ] && grep -q 'guard-governed-enqueue.sh' "$settings"; then
-  pass=$((pass + 1)); printf '  ok   wired  .claude/settings.json registers the hook\n'
-else
-  fail=$((fail + 1)); printf '  FAIL .claude/settings.json does not register the hook — it would guard nothing\n'
-fi
-for m in mcp__github__enable_pr_auto_merge mcp__github__merge_pull_request; do
-  if [ -f "$settings" ] && grep -q "$m" "$settings"; then
-    pass=$((pass + 1)); printf '  ok   wired  matcher covers %s\n' "$m"
-  else
-    fail=$((fail + 1)); printf '  FAIL no PreToolUse matcher covers %s\n' "$m"
-  fi
-done
-
-printf '\n%s passed, %s failed\n' "$pass" "$fail"
-[ "$fail" -eq 0 ]
diff --git a/.claude/hooks/guard-governed-enqueue.sh b/.claude/hooks/guard-governed-enqueue.sh
deleted file mode 100755
index 3c25d9cfbd6..00000000000
--- a/.claude/hooks/guard-governed-enqueue.sh
+++ /dev/null
@@ -1,624 +0,0 @@
-#!/usr/bin/env bash
-# guard-governed-enqueue.sh — PreToolUse guard: never ENQUEUE a governed PR that
-# carries no authorized approval pinned to its CURRENT head sha.
-#
-# Blocks the enqueue-class tool calls — `mcp__github__enable_pr_auto_merge`,
-# `mcp__github__merge_pull_request`, and the Bash spellings (`gh pr merge`, a
-# `PUT .../pulls/<n>/merge` REST call) — when the target PR's changed files are
-# governed and no account in `GOVERNED_APPROVERS` holds an APPROVED review whose
-# `commit_id` equals the PR's current head. Everything else is allowed.
-#
-# ## Why a CLIENT-SIDE guard, when the queue guard already refuses
-#
-# `scripts/pm/check-governed-queue-guard.mjs` is the hard correctness line and
-# stays it: on the `merge_group` build it reads the reviews live and REFUSES
-# (EXIT_REFUSED_UNAPPROVED). It held. What it cannot do is make the refusal
-# cheap.
-#
-# Measured 2026-09-01: a governed PR (four `skills/*/references/_index.md`
-# files) was flipped ready and enqueued with ZERO approvals on the PR. The queue
-# guard refused exactly as designed, the queue entry popped out red, and the
-# maintainer pinned an approval to head `b25f061c6` at 01:53:29Z — after which
-# THE RED ENTRY DID NOT RE-RUN. GitHub's merge queue does not retry a failed
-# entry when an approval arrives later. So the cost of "enqueue first, get
-# approved after" is not zero and never can be: one burned queue cycle plus a
-# red entry the maintainer reads as "I reviewed it and it still blocked me".
-#
-# ⭐ The design note in the queue guard's sibling says the enqueue threshold
-# "cannot be stopped by machine — a GitHub model limitation", and that is true
-# of GitHub: there is no server-side hook between a seat's enqueue call and the
-# queue. It is NOT true of OUR OWN tool-call surface. The enqueue action reaches
-# GitHub through a tool call this process makes, and PreToolUse sits in front of
-# it. That is the whole idea here — the server-side gate stays where it is, and
-# this one removes the wasted cycle before it is spent. The two answer the same
-# question with the same code (see "no second mechanism" below), so this guard
-# can only ever refuse what the queue guard would also have refused.
-#
-# The prose alternative was tried and rejected on the spot. The maintainer, on
-# the card that produced this file (2026-09-01, verbatim, untranslated):
-#
-#   > 你写skills 有用吗?他经常会忘记。
-#
-# ⇒ machine enforcement first; the protocol text is the annotation, not the
-# defense. Same lesson the worktree and stash rules already paid for: a ⛔-level
-# rule in this repo is only stable once a check enforces it.
-#
-# ## ⛔ NO SECOND MECHANISM — both predicates are IMPORTED, never restated
-#
-# This file contains no path list and no approval rule of its own. It asks the
-# two existing single sources and reports what they answer:
-#
-#   1. "is this diff governed?"  →  `check-governed-merges.mjs --test --json`,
-#      the very predicate a seat runs before flipping ready. Exit 3 = governed,
-#      exit 0 = clear. Its register (`GOVERNED_SURFACES`) is repo-agnostic, so
-#      the same call answers for every repo configured in `GOVERNED_REPOS`.
-#   2. "is it approved by an authorized account?"  →  `authorizedApprovalVerdict`
-#      + `GOVERNED_APPROVERS` imported from `check-governed-queue-guard.mjs` —
-#      the same function the queue build decides on, applied to the same review
-#      list shape. The authorized set is never spelled out here, and neither is
-#      the rule: the 2026-09-04 ruling (an authorized approval counts on ANY
-#      commit) reached this hook by changing that function and nothing in here.
-#
-# A register row or a ruling that moves either predicate reaches this guard for
-# free, and the two tools cannot answer differently about the same diff — the
-# #11705 constraint ("⛔ do not author a second mechanism") applied one level
-# out.
-#
-# ## The pure-regeneration class MUST pass, and does so by construction
-#
-# The maintainer ruled 2026-09-01 (verbatim, untranslated):
-#
-#   > 纯生成的指针行(spec 源变更后再生成的 references/_index.md) 不需要我审核吧
-#
-# So a PR whose only governed paths are generator-owned files that byte-equal
-# their own generator's output — recomputed on the tree under test, never a
-# stored baseline — clears with ZERO approvals. That exemption lives in the
-# register's `applyGeneratedExceptions`, and because step 1 above is the
-# register's own `--test`, this guard inherits it whole: a pure regeneration
-# comes back exit 0 and is ALLOWED before any review is read. This guard must
-# never be the thing that re-closes a path the queue guard now clears, and the
-# self-test pins that with a REAL lifted path, not a stub.
-#
-# Fail-closed inside the exemption is the register's business, not this file's:
-# a provenance that cannot be recomputed keeps the path governed there, and this
-# guard reports that answer rather than softening it. `OS_ALLOW_GOVERNED_ENQUEUE=1`
-# is the stated way out when a human knows better.
-#
-# ## FAIL-OPEN on a read failure — deliberate, and the opposite of the queue guard
-#
-# ⚠️ The queue guard fails CLOSED on an unreadable review list, and is right to:
-# it is the last thing before `main`. This guard is not that, and copying the
-# stance here would be wrong. It sits in front of every enqueue attempt with a
-# network dependency; a guard that blocks work whenever the API hiccups gets
-# switched off, and then it guards nothing. So every branch this file cannot
-# ANSWER — no token, an HTTP error, a truncated file list, an unparsable
-# payload, a predicate that will not run — ALLOWS, with one warning line on
-# stderr naming what it could not read.
-#
-# That is affordable for exactly one reason, and it should be re-checked if the
-# reason ever stops holding: the correctness line is elsewhere. An unapproved
-# governed PR that slips past this file still meets `check-governed-queue-guard`
-# on the merge-group build and is still refused. What this guard saves is the
-# wasted cycle and the false red — never the merge itself.
-#
-# ## Two premises this file rests on, both MEASURED (2026-09-01, this container)
-#
-#   ① THE API READ PATH. There is no `gh` in this container class (`command -v
-#      gh` → absent). The repo-scoped REST channel is reachable: `GET
-#      /repos/{o}/{r}/pulls/{n}`, `.../files` and `.../reviews` each answered
-#      HTTP 200, including from a grandchild subprocess two levels down, which
-#      is the depth a hook runs at.
-#   ⚠️ curl, NOT node's global fetch. `GITHUB_TOKEN` in these containers is the
-#      14-byte placeholder `proxy-injected`; the real credential is swapped in
-#      on the wire by the agent proxy. curl honours `HTTPS_PROXY` and gets 200.
-#      Node's `fetch` does not proxy by default, sends the placeholder verbatim
-#      and gets **401** — measured side by side. So the transport here is curl
-#      and node only ever receives already-fetched JSON as data. (The queue
-#      guard's own `fetch`-based readers are fine where they run: CI holds a
-#      real token.)
-#   ② FAIL-OPEN, per the section above.
-#
-# ## Exit-code contract, mirroring the sibling guards
-#
-#   0 = allow, 2 = block with the reason on stderr. Anything this cannot parse
-#   CONFIDENTLY fails open — a guard that blocks work it does not understand
-#   gets disabled. Deliberate exception: OS_ALLOW_GOVERNED_ENQUEUE=1.
-#
-# ## Known boundaries, stated so nobody has to rediscover them
-#
-#   - `gh pr merge` with NO pull-request argument targets the current branch,
-#     which the payload does not name. That form is ALLOWED, with a warning: the
-#     PR cannot be identified, and guessing is worse than the queue guard
-#     catching it. Pass the number (`gh pr merge 1234`) to be checked.
-#   - Like `guard-shared-stash.sh`, the Bash pass reads the FIRST WORD of each
-#     shell segment, so a wrapped invocation (`bash -c '…'`, xargs, ssh) is not
-#     caught. Same deliberate trade: the target is the reflexive enqueue call an
-#     agent makes, not a determined evader — and the switch above already exists
-#     for anyone who means it.
-#   - A PR with more changed files than this reads (10 pages × 100) is a
-#     truncated list; it warns and allows rather than judging a partial diff.
-#     Under-enumeration is the one direction a governed reading must never be
-#     wrong in (#9902), so a partial answer is refused as an ANSWER, not
-#     converted into a refusal of the work.
-#
-# Test-only injection, documented so it is never mistaken for a bypass:
-# OS_GOVERNED_ENQUEUE_FIXTURE=<dir> makes the three reads come from
-# `pull.json` / `files.json` / `reviews.json` in that directory instead of the
-# network, and OS_GOVERNED_ENQUEUE_READFAIL=1 simulates an unreadable API. They
-# change where DATA comes from and nothing else; the open escape hatch above is
-# the way to actually skip the guard.
-#
-# OS_GOVERNED_ENQUEUE_SIBLING_ROOT=<dir> is the third, and it moves WHERE a
-# sibling checkout is looked for — never WHAT is accepted as one. The admission
-# rule stays the origin-slug comparison further down: a directory becomes the
-# tree this guard audits only when its own `origin` declares the target
-# `owner/repo`, so a value pointed anywhere wrong resolves NOTHING. It cannot
-# widen the audit, and it cannot soften one either — a sibling that does resolve
-# is judged exactly as it is today.
-#
-#   unset   → `$(dirname "$repo_root")`, the parent of this checkout. Today's
-#             behaviour, to the byte.
-#   empty   → the same as unset. An empty value is an accident (`export VAR=`,
-#             or `VAR="$SOMETHING_UNSET"`), and the safe reading of an accident
-#             is "no override" — never "look nowhere", which would silently
-#             drop a real audit.
-#   a directory carrying no matching checkout, one that does not exist included
-#           → nothing resolves, and the run takes the existing "no checkout of
-#             the target repo is available" fail-open below, with its existing
-#             warning. That is the branch a box WITHOUT the sibling has always
-#             taken; this variable opens no new way out.
-#
-# Why it exists: the self-test's cross-repo case asserts that fail-open, and its
-# premise used to be a fact about the BOX ("objectstack-ai/cloud has no sibling
-# checkout here") rather than about the hook. On a container that does carry a
-# sibling `cloud` checkout the guard resolved it, recomputed the predicate on it
-# and blocked — 54 passed / 1 failed, green in CI only because CI carries no
-# sibling. The matrix now sets this variable and owns its own premise, and the
-# resolved-sibling BLOCK is pinned beside it as the deliberate behaviour it is.
-#
-# Self-test (no network, no build): .claude/hooks/guard-governed-enqueue.selftest.sh
-
-set -uo pipefail
-
-[ "${OS_ALLOW_GOVERNED_ENQUEUE:-}" = "1" ] && exit 0
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-repo_root="$(cd "$here/../.." && pwd)"
-merges_predicate="$repo_root/scripts/pm/check-governed-merges.mjs"
-queue_guard="$repo_root/scripts/pm/check-governed-queue-guard.mjs"
-api_base="${GITHUB_API_URL:-https://api.github.com}"
-
-warn() { printf '⚠️  guard-governed-enqueue: %s — ALLOWING (the merge-queue guard remains the hard line).\n' "$1" >&2; }
-
-input="$(cat 2>/dev/null || true)"
-[ -n "$input" ] || exit 0
-
-have_jq=0
-command -v jq >/dev/null 2>&1 && have_jq=1
-
-# Lift one scalar out of the payload. jq when present; otherwise a flat key scan
-# that is good enough for the four fields this guard reads and yields empty —
-# which means ALLOW — when it is not.
-payload_get() { # payload_get <jq filter> <key name>
-  local v=""
-  if [ "$have_jq" = 1 ]; then
-    v="$(printf '%s' "$input" | jq -r "$1 // empty" 2>/dev/null || true)"
-  fi
-  if [ -z "$v" ]; then
-    v="$(printf '%s' "$input" \
-      | sed -n "s/.*\"$2\"[[:space:]]*:[[:space:]]*\"\([^\"]*\)\".*/\1/p;s/.*\"$2\"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p" \
-      | head -1)"
-  fi
-  printf '%s' "$v"
-}
-
-tool="$(payload_get '.tool_name' 'tool_name')"
-[ -n "$tool" ] || exit 0
-
-owner=""
-repo=""
-pull=""
-
-# ── identify the target PR ───────────────────────────────────────────────────
-
-case "$tool" in
-  mcp__github__enable_pr_auto_merge | mcp__github__merge_pull_request)
-    owner="$(payload_get '.tool_input.owner' 'owner')"
-    repo="$(payload_get '.tool_input.repo' 'repo')"
-    pull="$(payload_get '.tool_input.pullNumber' 'pullNumber')"
-    ;;
-  Bash)
-    cmd=""
-    if [ "$have_jq" = 1 ]; then
-      cmd="$(printf '%s' "$input" | jq -r '.tool_input.command // empty' 2>/dev/null || true)"
-    fi
-    if [ -z "$cmd" ]; then
-      # jq-less fallback: lift the JSON string honouring backslash escapes, so an
-      # embedded \" does not truncate the command. Same shape guard-shared-stash.sh uses.
-      cmd="$(printf '%s' "$input" \
-        | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(\(\\.\|[^"\\]\)*\)".*/\1/p' \
-        | head -1 \
-        | sed 's/\\n/ /g; s/\\t/ /g; s/\\"/"/g; s/\\\\/\\/g')"
-    fi
-    [ -n "$cmd" ] || exit 0
-    ;;
-  *) exit 0 ;;
-esac
-
-# --- split a Bash command into shell segments, honouring quotes --------------
-# A separator inside '…' or "…" does NOT split, so writing ABOUT an enqueue call
-# is never caught by the guard. OUTSIDE quotes a backslash escapes the NEXT
-# character, so an escaped \" opens no quoted region — without that branch the
-# pass goes inert behind one and a real command rides through as an argument of
-# something harmless. This is the same repair guard-shared-stash.sh and
-# guard-main-checkout-bash.sh both carry; the three passes are kept in the same
-# shape on purpose.
-segments=()
-split_segments() {
-  local s="$1" seg="" q="" ch i n=${#1}
-  for ((i = 0; i < n; i++)); do
-    ch="${s:i:1}"
-    if [ -n "$q" ]; then
-      seg+="$ch"
-      [ "$ch" = "$q" ] && q=""
-      continue
-    fi
-    case "$ch" in
-      '\')
-        seg+="$ch"
-        if [ $((i + 1)) -lt "$n" ]; then i=$((i + 1)) ; seg+="${s:i:1}" ; fi
-        ;;
-      "'" | '"') q="$ch" ; seg+="$ch" ;;
-      ';' | '|' | '&' | '(' | ')' | '{' | '}' | $'\n') segments+=("$seg") ; seg="" ;;
-      *) seg+="$ch" ;;
-    esac
-  done
-  segments+=("$seg")
-}
-
-# A REST merge URL in any spelling: .../repos/<owner>/<repo>/pulls/<n>/merge
-url_target() { # url_target <word> -> "owner repo pull" or empty
-  local w="${1//\"/}"
-  w="${w//\'/}"
-  [[ "$w" =~ /repos/([A-Za-z0-9._-]+)/([A-Za-z0-9._-]+)/pulls/([0-9]+)/merge ]] || return 1
-  printf '%s %s %s' "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" "${BASH_REMATCH[3]}"
-}
-
-# The `owner/repo` a checkout's `origin` names, or nothing. ONE reader with two
-# call sites — the bare `gh pr merge <n>` target derivation just below, and the
-# sibling admission rule further down — because the two inlined copies it
-# replaces agreed on a defect: the path character class owns `.` and is greedy,
-# so the optional `\(\.git\)` group matched EMPTY and
-# `https://github.com/objectstack-ai/cloud.git` read as the slug
-# `objectstack-ai/cloud.git`, which equals no `owner/repo` this guard is ever
-# asked about. A sibling cloned with the conventional URL therefore never
-# resolved, and a bare `gh pr merge <n>` in such a clone derived a slug the API
-# answers 404 for — this guard's fail-open, on the clone URL `git clone` hands
-# out by default.
-#
-# The suffix is stripped AFTER the match rather than carved out of the class:
-# the class still has to own `.` (a repository may legitimately be called
-# `objectstack.ai`), and which of the two the class-vs-group race gives it up to
-# is exactly the kind of thing GNU and BSD sed are free to disagree about. A
-# trailing `.git` is removed by the shell either way, and nothing legitimate is
-# lost with it — GitHub refuses a repository name that ends in `.git`.
-slug_of() { # slug_of <checkout dir> -> owner/repo, or empty
-  local slug
-  slug="$(git -C "$1" remote get-url origin 2>/dev/null \
-    | sed -n 's#.*github\.com[:/]\([A-Za-z0-9._-]*/[A-Za-z0-9._-]*\)/*$#\1#p')"
-  printf '%s' "${slug%.git}"
-}
-
-# The enqueue-class target one shell segment names, or nothing.
-segment_target() { # segment_target <segment> -> "owner repo pull" or empty
-  local seg="$1"
-  local -a w=()
-  read -r -a w <<<"$seg"
-  local i=0 n=${#w[@]} j hit
-  [ "$n" -gt 0 ] || return 1
-
-  while [ "$i" -lt "$n" ]; do
-    case "${w[$i]}" in
-      [A-Za-z_][A-Za-z0-9_]*=*) i=$((i + 1)) ;;
-      *) break ;;
-    esac
-  done
-  [ "$i" -lt "$n" ] || return 1
-
-  local head="${w[$i]##*/}"
-
-  # `curl … https://api.github.com/repos/o/r/pulls/N/merge` — the URL shape is
-  # the identification; no method sniffing, because that URL has no read verb.
-  if [ "$head" = "curl" ] || [ "$head" = "wget" ]; then
-    for ((j = i + 1; j < n; j++)); do
-      if hit="$(url_target "${w[$j]}")"; then printf '%s' "$hit"; return 0; fi
-    done
-    return 1
-  fi
-
-  [ "$head" = "gh" ] || return 1
-  i=$((i + 1))
-
-  # `gh api … /repos/o/r/pulls/N/merge`
-  if [ "${w[$i]:-}" = "api" ]; then
-    for ((j = i + 1; j < n; j++)); do
-      if hit="$(url_target "${w[$j]}")"; then printf '%s' "$hit"; return 0; fi
-    done
-    return 1
-  fi
-
-  # `gh pr merge …`
-  [ "${w[$i]:-}" = "pr" ] || return 1
-  i=$((i + 1))
-  [ "${w[$i]:-}" = "merge" ] || return 1
-  i=$((i + 1))
-
-  local slug="" num=""
-  for ((j = i; j < n; j++)); do
-    case "${w[$j]}" in
-      -R | --repo) slug="${w[$((j + 1))]:-}" ; j=$((j + 1)) ;;
-      -R=* | --repo=*) slug="${w[$j]#*=}" ;;
-      -*) ;;
-      *)
-        if [ -z "$num" ]; then
-          if [[ "${w[$j]}" =~ ^([0-9]+)$ ]]; then
-            num="${BASH_REMATCH[1]}"
-          elif [[ "${w[$j]}" =~ ^https?://[^/]+/([A-Za-z0-9._-]+)/([A-Za-z0-9._-]+)/pull/([0-9]+) ]]; then
-            slug="${BASH_REMATCH[1]}/${BASH_REMATCH[2]}"
-            num="${BASH_REMATCH[3]}"
-          fi
-        fi
-        ;;
-    esac
-  done
-
-  # No number: `gh pr merge` on the CURRENT branch. The payload does not name
-  # the PR, so this is the parse-confidently-or-allow line — see the header.
-  if [ -z "$num" ]; then
-    warn "'gh pr merge' names no pull request (it would target the current branch), so the PR cannot be identified"
-    return 1
-  fi
-  if [ -z "$slug" ]; then
-    slug="$(slug_of "$repo_root")"
-  fi
-  [ -n "$slug" ] || return 1
-  printf '%s %s %s' "${slug%%/*}" "${slug#*/}" "$num"
-}
-
-if [ "$tool" = "Bash" ]; then
-  split_segments "$cmd"
-  for seg in "${segments[@]}"; do
-    if target="$(segment_target "$seg")"; then
-      read -r owner repo pull <<<"$target"
-      break
-    fi
-  done
-fi
-
-# Nothing identifiable ⇒ this call is not our business, or we could not parse it
-# confidently. Either way: allow.
-[ -n "$owner" ] && [ -n "$repo" ] && [ -n "$pull" ] || exit 0
-[[ "$pull" =~ ^[0-9]+$ ]] || exit 0
-
-# ── read the PR: head sha, changed files, reviews ────────────────────────────
-
-work="$(mktemp -d 2>/dev/null)" || { warn "could not create a temporary directory"; exit 0; }
-trap 'rm -rf "$work"' EXIT INT TERM
-
-api_get() { # api_get <path-and-query> <outfile> -> 0 on HTTP 200
-  local path="$1" out="$2" code
-  if [ -n "${OS_GOVERNED_ENQUEUE_FIXTURE:-}" ]; then
-    [ "${OS_GOVERNED_ENQUEUE_READFAIL:-}" = "1" ] && return 1
-    local name
-    case "$path" in
-      */files*) name=files.json ;;
-      */reviews*) name=reviews.json ;;
-      *) name=pull.json ;;
-    esac
-    [ -f "$OS_GOVERNED_ENQUEUE_FIXTURE/$name" ] || return 1
-    cat "$OS_GOVERNED_ENQUEUE_FIXTURE/$name" > "$out" 2>/dev/null || return 1
-    return 0
-  fi
-  code="$(curl -sS --max-time 10 -o "$out" -w '%{http_code}' \
-    -H "Authorization: Bearer ${GITHUB_TOKEN:-${GH_TOKEN:-}}" \
-    -H 'Accept: application/vnd.github+json' \
-    "$api_base$path" 2>/dev/null)" || return 1
-  [ "$code" = "200" ]
-}
-
-pr_ref="$owner/$repo#$pull"
-
-api_get "/repos/$owner/$repo/pulls/$pull" "$work/pull.json" \
-  || { warn "could not read $pr_ref"; exit 0; }
-
-# ⚠️ EVERY API body is parsed by node, never by sed — and never by jq either, so
-# there is ONE reading rather than a fast path and a fallback that can disagree.
-# The rejected spelling and why: a line-based `sed -n 's/.*"filename".*/\1/p'`
-# over GitHub's single-line array is GREEDY, so it returns the LAST filename in
-# the body and NOTHING ELSE. That is under-enumeration of a governed diff — the
-# one direction a governed-surface reading must never be wrong in (#9902) — and
-# it fails silently, as a shorter list, at exit 0. Measured here on a two-file
-# fixture before this comment existed: 2 files in, 0 out.
-#
-# node is already a hard dependency (both predicates are node), so this costs
-# nothing that was not already being paid. jq stays for the PAYLOAD read alone,
-# where the fields are flat and the cost of a node spawn would be charged to
-# every Bash tool call in the session.
-json_read() { # json_read <file> <mode: head-sha|filenames|count|exceptions|hits>
-  OS_GUARD_FILE="$1" OS_GUARD_MODE="$2" node -e '
-const fs = require("node:fs");
-let d;
-try { d = JSON.parse(fs.readFileSync(process.env.OS_GUARD_FILE, "utf8")); }
-catch { process.exit(1); }
-const mode = process.env.OS_GUARD_MODE;
-if (mode === "head-sha") { const s = d && d.head && d.head.sha; if (!s) process.exit(1); console.log(s); }
-else if (mode === "filenames") { if (!Array.isArray(d)) process.exit(1); for (const f of d) { if (f && f.filename) console.log(f.filename); if (f && f.previous_filename && f.previous_filename !== f.filename) console.log(f.previous_filename); } }
-else if (mode === "count") { if (!Array.isArray(d)) process.exit(1); console.log(d.length); }
-else if (mode === "exceptions") console.log(((d || {}).exceptions || []).length);
-else if (mode === "hits") console.log((((d || {}).hitPaths) || []).join(", "));
-else process.exit(1);
-' 2>/dev/null
-}
-
-head_sha="$(json_read "$work/pull.json" head-sha)"
-[[ "$head_sha" =~ ^[0-9a-fA-F]{7,40}$ ]] || { warn "could not read the head sha of $pr_ref"; exit 0; }
-
-# Changed files, paginated. A list this cannot read WHOLE is not an answer.
-: > "$work/files.txt"
-page=1
-truncated=0
-while [ "$page" -le 10 ]; do
-  api_get "/repos/$owner/$repo/pulls/$pull/files?per_page=100&page=$page" "$work/files.json" \
-    || { warn "could not read the changed files of $pr_ref"; exit 0; }
-  count="$(json_read "$work/files.json" count)"
-  [ -n "$count" ] || { warn "could not parse the changed files of $pr_ref"; exit 0; }
-  json_read "$work/files.json" filenames >> "$work/files.txt"
-  [ "$count" -eq 100 ] || break
-  page=$((page + 1))
-  [ "$page" -gt 10 ] && truncated=1
-done
-if [ "$truncated" = 1 ]; then
-  warn "$pr_ref changes more files than this guard reads (10 pages x 100); a truncated diff is not a governed-surface answer"
-  exit 0
-fi
-
-# Read the list with a while-read loop, never the bash-4 builtin the repo-wide
-# floor gate refuses (scripts/check-bash32-floor.mjs): macOS ships bash 3.2, and
-# a 127 there would take this guard out entirely on the operator's own machine.
-changed=()
-while IFS= read -r changed_line; do
-  [ -n "$changed_line" ] && changed+=("$changed_line")
-done < "$work/files.txt"
-[ "${#changed[@]}" -gt 0 ] || { warn "$pr_ref reported no changed files"; exit 0; }
-
-# ── predicate 1: is the diff governed? (the register's own --test) ───────────
-#
-# Provenance for the generated-artifact exception is recomputed on a TREE, so it
-# has to be the target repo's own tree. Resolve a checkout whose origin actually
-# declares owner/repo — never audit one repo's paths against another's files.
-
-# `slug_of` is defined once, up beside the Bash pass that shares it.
-#
-# WHERE a sibling is looked for is injectable (OS_GOVERNED_ENQUEUE_SIBLING_ROOT,
-# header); WHAT is accepted as one is not. The slug comparison below is the whole
-# admission rule and is untouched by it, so the variable can only move the
-# search — a sibling that resolves is audited exactly as before, and a root
-# holding no matching checkout resolves nothing and falls through to the
-# "no checkout available" fail-open, the branch a box without the sibling
-# already takes. Unset or empty ⇒ the parent of this checkout, as always.
-sibling_root="${OS_GOVERNED_ENQUEUE_SIBLING_ROOT:-$(dirname "$repo_root")}"
-
-target_root=""
-if [ "$(slug_of "$repo_root")" = "$owner/$repo" ]; then
-  target_root="$repo_root"
-elif [ "$(slug_of "$sibling_root/$repo")" = "$owner/$repo" ]; then
-  target_root="$sibling_root/$repo"
-fi
-
-test_args=(--test --json)
-[ -n "$target_root" ] && test_args+=(--root "$target_root")
-node "$merges_predicate" "${test_args[@]}" "${changed[@]}" > "$work/test.json" 2> "$work/test.err"
-test_rc=$?
-
-case "$test_rc" in
-  0) exit 0 ;;                       # not governed, or fully lifted by the exception
-  3) ;;                              # governed
-  *) warn "the governed-surface predicate did not run (exit $test_rc): $(tr '\n' ' ' < "$work/test.err" | cut -c1-200)"; exit 0 ;;
-esac
-
-# A hit on a generated-exception row is judged by recomputing the generator on a
-# tree. With no checkout of the target repo there is no right tree to recompute
-# on, and the register's fail-closed answer then reflects the ENVIRONMENT rather
-# than the diff — a false refusal. Allow, and say which reading was missing.
-exception_rows="$(json_read "$work/test.json" exceptions)"
-if [ -z "$target_root" ] && [ "${exception_rows:-unknown}" != "0" ]; then
-  warn "$pr_ref may hit a generated-surface exception row, and no checkout of $owner/$repo is available to recompute its provenance on"
-  exit 0
-fi
-
-hits="$(json_read "$work/test.json" hits)"
-
-# ── predicate 2: an authorized APPROVED review, on any commit (2026-09-04) ───
-
-api_get "/repos/$owner/$repo/pulls/$pull/reviews?per_page=100" "$work/reviews.json" \
-  || { warn "could not read the reviews of $pr_ref"; exit 0; }
-
-# ⚠️ The three inputs travel as ENV, never as argv. `isEntrypoint` (scripts/
-# invoked-as.mjs) decides "was I run or imported?" by comparing `process.argv[1]`
-# against the module's own URL — so passing the module PATH as the first
-# argument makes the import look like a direct run, and the queue guard's own
-# main() fires, complains about a missing GITHUB_EVENT_PATH and exits 1.
-# Measured here before this line was written.
-verdict="$(OS_GUARD_MODULE="$queue_guard" OS_GUARD_REVIEWS="$work/reviews.json" OS_GUARD_HEAD="$head_sha" \
-  node --input-type=module -e '
-const { OS_GUARD_MODULE: modPath, OS_GUARD_REVIEWS: reviewsPath, OS_GUARD_HEAD: headSha } = process.env;
-const { readFileSync } = await import("node:fs");
-const m = await import(modPath);
-const reviews = JSON.parse(readFileSync(reviewsPath, "utf8"));
-const v = m.authorizedApprovalVerdict(reviews, headSha);
-// Line 1 is the verdict word the shell branches on; line 2 is the human detail.
-// Rendered HERE rather than in the shell so there is one reading of this object.
-// ⚠️ `v.approvalsOnEarlierCommits` is deliberately NOT rendered here. Since
-// 2026-09-04 it can only be non-empty when the verdict is `approved`, and this
-// string is only ever printed on the blocking path below — so a line for it
-// would be dead code that reads like a live refusal reason.
-const detail = [
-  `reviews read: ${v.reviewsRead}`,
-  v.unauthorizedApprovers.length
-    ? `APPROVED by account(s) outside the authorized set (never counts): ${v.unauthorizedApprovers.join(", ")}`
-    : null,
-  v.changesRequestedBy.length ? `CHANGES_REQUESTED standing from: ${v.changesRequestedBy.join(", ")}` : null,
-  `authorized approvers (GOVERNED_APPROVERS): ${m.GOVERNED_APPROVERS.join(", ")}`,
-].filter(Boolean).join("; ");
-console.log(v.state);
-console.log(detail);
-' 2> "$work/verdict.err")"
-verdict_rc=$?
-
-if [ "$verdict_rc" -ne 0 ] || [ -z "$verdict" ]; then
-  warn "the authorized-approval predicate did not run: $(tr '\n' ' ' < "$work/verdict.err" | cut -c1-200)"
-  exit 0
-fi
-
-state="$(printf '%s\n' "$verdict" | head -1)"
-detail="$(printf '%s\n' "$verdict" | tail -n +2)"
-
-[ "$state" = "approved" ] && exit 0
-
-cat >&2 <<EOF
-⛔ Blocked: $pr_ref is GOVERNED and has no APPROVED review from an authorized approver —
-   approve BEFORE enqueue; a failed queue entry does NOT re-run on a later approval.
-
-   tool:      $tool
-   head:      $head_sha
-   governed:  ${hits:-see the predicate output below}
-   approvals: $detail
-
-Enqueuing now does not fail safe, it fails EXPENSIVELY. The merge-queue guard
-(scripts/pm/check-governed-queue-guard.mjs) reads the reviews on the merge_group
-build and refuses, so nothing wrong lands — but GitHub does not retry that queue
-entry when the approval arrives afterwards. The entry stays red, one queue cycle
-is spent, and the red reads to the maintainer as "I approved it and it still
-blocked me". That exact sequence was measured on 2026-09-01.
-
-Do this instead:
-  1. Leave the PR as a DRAFT and request review from an authorized approver.
-  2. Wait for the APPROVED review to land. It does NOT have to sit on the
-     current head ($head_sha), and a later push does not expire it — maintainer,
-     2026-09-04: 只需要有人工批准记录就行，不需要卡最新的提交。
-  3. Then enqueue. Or let the maintainer merge by hand: a human merge IS the
-     review record for a governed PR, and it needs nothing from this guard.
-  ⛔ Never approve a governed PR from an agent seat, under any account.
-
-Pure regeneration is already exempt and never reaches this message: a diff whose
-only governed paths byte-equal their own generator's output clears with zero
-approvals, decided by the register (check-governed-merges.mjs), not here.
-
-Verdict source: check-governed-merges.mjs --test (governed) +
-authorizedApprovalVerdict/GOVERNED_APPROVERS from check-governed-queue-guard.mjs.
-Deliberate exception (you know this one is right): set OS_ALLOW_GOVERNED_ENQUEUE=1 in the
-environment this hook itself runs in — a local settings "env" entry, or whatever this
-agent process was started with. A VAR=1 prefix on a command sets it for that command
-only, and this hook is not that command, so a prefix never reaches it.
-EOF
-exit 2
diff --git a/.claude/settings.json b/.claude/settings.json
index 428a0300bd5..15b20ba4118 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -80,15 +80,6 @@
           }
         ]
       },
-      {
-        "matcher": "mcp__github__enable_pr_auto_merge|mcp__github__merge_pull_request",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/guard-governed-enqueue.sh\""
-          }
-        ]
-      },
       {
         "matcher": "Bash",
         "hooks": [
@@ -100,10 +91,6 @@
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/guard-process-kill.sh\""
           },
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/guard-governed-enqueue.sh\""
-          },
           {
             "type": "command",
             "command": "\"$CLAUDE_PROJECT_DIR/.claude/hooks/guard-main-checkout-bash.sh\""
diff --git a/scripts/pm/check-governed-merges.mjs b/scripts/pm/check-governed-merges.mjs
index eab2fbd5ec0..20b77f92ee1 100644
--- a/scripts/pm/check-governed-merges.mjs
+++ b/scripts/pm/check-governed-merges.mjs
@@ -1287,9 +1287,9 @@ export function renderTestVerdict(verdict) {
 // ── deriving the path list (#17003): three-dot, or a refusal ────────────────
 
 /**
- * What `--test` says about its own INPUT. Printed on STDERR, deliberately: the
- * enqueue hook (`.claude/hooks/guard-governed-enqueue.sh`) reads this mode's
- * STDOUT as JSON, and a predicate that changes what it hands its consumers in
+ * What `--test` says about its own INPUT. Printed on STDERR, deliberately: this
+ * mode's STDOUT is a machine-read surface (`--json` hands any caller a JSON
+ * verdict), and a predicate that changes what it hands its consumers in
  * order to warn its humans has broken something to say something. So `--test`'s
  * stdout is byte-identical to the pre-#17003 form in both renderings, and the
  * note travels beside it.
@@ -2747,8 +2747,8 @@ async function runTestMode(args) {
     return EXIT_CANNOT_SWEEP;
   }
   // #17003: on STDERR, so this mode's STDOUT stays byte-identical in both
-  // renderings for the consumers that parse it (the enqueue hook reads the
-  // `--json` form). A predicate that changes what it hands its callers in
+  // renderings for any consumer that parses it (the `--json` form is a
+  // machine-read surface). A predicate that changes what it hands its callers in
   // order to warn its humans has broken something in order to say something.
   console.error(CALLER_DERIVED_NOTE);
   return await emitVerdict(paths, args);
diff --git a/scripts/pm/check-governed-queue-guard.mjs b/scripts/pm/check-governed-queue-guard.mjs
index f7938efe94a..feafc08ac7a 100644
--- a/scripts/pm/check-governed-queue-guard.mjs
+++ b/scripts/pm/check-governed-queue-guard.mjs
@@ -863,13 +863,17 @@ export function approvalVerdict(reviews) {
  * `pinnedApprovalVerdict`. Renaming a predicate is cheap; leaving a retired
  * rule's vocabulary lying around next to a live one is not.
  *
- * ⭐ BOTH RENAMES LANDED WITH THEIR IMPORTER, in one commit.
- * `.claude/hooks/guard-governed-enqueue.sh` imports this function and reads that
- * bucket off its result — the "⛔ no second mechanism" design paying off, since
- * the seat-side hook's verdict flipped with this ruling for free and it needs no
- * predicate of its own. ⛔ Never rename either name without that hook in the
- * same diff: it catches the resulting failure and ALLOWS, with one warning line
- * on stderr, so every governed enqueue would sail through it silently.
+ * ⭐ BOTH RENAMES LANDED WITH THEIR IMPORTER, in one commit. At the time a
+ * seat-side PreToolUse enqueue hook imported this function and read that bucket
+ * off its result — the "⛔ no second mechanism" design paying off, since its
+ * verdict flipped with this ruling for free and it needed no predicate of its
+ * own. That client-side hook has since been REMOVED by ruling (it only ever
+ * saved a queue cycle; this file's `merge_group` refusal is the line), so the
+ * queue leg in this file is now this function's only consumer. The two names
+ * are still this module's exported contract: ⛔ never rename either without
+ * grepping for importers in the same diff — an importer that catches the
+ * resulting failure and ALLOWS is a silent hole, which is exactly what the old
+ * hook would have become.
  *
  * Pure; the array is expected in GitHub's chronological order, so last wins.
  */
diff --git a/scripts/pm/check-settings-deny-roster.mjs b/scripts/pm/check-settings-deny-roster.mjs
index 5736aad3869..8bad6ec004a 100644
--- a/scripts/pm/check-settings-deny-roster.mjs
+++ b/scripts/pm/check-settings-deny-roster.mjs
@@ -23,8 +23,8 @@
  *
  * Nothing under `scripts/` read the deny list's MEMBERSHIP before this file.
  * The key `permissions.deny` occurred there only inside comments and one
- * handoff string, and the hook self-tests grep `.claude/settings.json` for hook
- * registration and for two enqueue matchers -- never for a tool name. So a tool
+ * handoff string, and the hook self-tests grep `.claude/settings.json` for
+ * their own registration -- never for a tool name. So a tool
  * the charter declares closed could be absent from `deny` with every gate
  * green, and that is measured rather than hypothetical: #18218 was exactly that
  * state for `update_pull_request`, declared closed in the prose and open in the
@@ -60,10 +60,12 @@
  * (#18282, ruled A). The REST route `PUT .../pulls/{n}/ccr/auto_merge` in
  * `.claude/skills/pm-dispatch/references/rest-channel.md` already serves every
  * real enqueue, so denying the MCP pair costs a seat nothing, and a tool the
- * runtime refuses cannot be mis-called by a seat that mis-reads the scope of
- * the PreToolUse hook `.claude/hooks/guard-governed-enqueue.sh`. That hook
- * stays as defence in depth: it judges a governed PR's pinned approval, this
- * gate judges membership, and neither reads the other.
+ * runtime refuses cannot be mis-called at all. This roster is the ONLY
+ * seat-side refusal of the MCP enqueue class: the client-side PreToolUse
+ * enqueue guard was removed by ruling (it only ever saved a queue cycle), and
+ * the line that judges a governed PR's approval is
+ * `scripts/pm/check-governed-queue-guard.mjs` on the `merge_group` build. This
+ * gate judges membership; neither reads the other.
  *
  * ## What is deliberately NOT asserted
  *