diff --git a/.claude/hooks/guard-main-checkout-bash.selftest.sh b/.claude/hooks/guard-main-checkout-bash.selftest.sh
index 2dc939487c..8ebe430e86 100755
--- a/.claude/hooks/guard-main-checkout-bash.selftest.sh
+++ b/.claude/hooks/guard-main-checkout-bash.selftest.sh
@@ -27,7 +27,12 @@ trap 'rm -rf "$tmp"' EXIT
 MAIN="$tmp/mainrepo"
 WT="$tmp/wt"
 PLAIN="$tmp/plain"
-mkdir -p "$MAIN/pkg" "$PLAIN"
+# ODD: a PRIMARY checkout whose own path carries a literal `worktrees` segment. Every write
+# into it must BLOCK — it is a primary checkout, and the verdict comes from the git-dir vs
+# git-common-dir structure, never from the spelling of the path (#7259). $WT is its positive
+# twin: a real linked worktree at a path with no such segment.
+ODD="$tmp/worktrees/oddrepo"
+mkdir -p "$MAIN/pkg" "$PLAIN" "$ODD/pkg"
 (
   cd "$MAIN" || exit 1
   git init -q .
@@ -38,6 +43,14 @@ mkdir -p "$MAIN/pkg" "$PLAIN"
   git add -A
   git commit -qm init
   git worktree add -q "$WT" -b selftest-wt
+  cd "$ODD" || exit 1
+  git init -q .
+  git config user.email selftest@example.com
+  git config user.name selftest
+  : > README.md
+  : > pkg/x.ts
+  git add -A
+  git commit -qm init
 ) >/dev/null 2>&1 || { echo "could not build the git fixture" >&2; exit 1; }
 
 CWD="$MAIN"   # payload cwd for the cases that follow; reassigned per section
@@ -62,6 +75,7 @@ expect() { # expect <block|allow> <command> [env…]
   local got; got="$(verdict "$cmd" "$@")"
   local shown="${cmd//$'\n'/ ⏎ }"
   shown="${shown//$MAIN/\$MAIN}"; shown="${shown//$WT/\$WT}"; shown="${shown//$PLAIN/\$PLAIN}"
+  shown="${shown//$ODD/\$ODD}"
   if [ "$got" = "$want" ]; then
     pass=$((pass + 1)); printf '  ok   %-5s  %s\n' "$got" "$shown"
   else
@@ -109,6 +123,19 @@ expect allow 'touch pkg/new.ts'
 expect allow 'cp /tmp/a.txt pkg/a.txt'
 expect allow "cd $WT && tee pkg/a.ts"
 
+echo "== a PRIMARY checkout whose own path carries a 'worktrees' segment is BLOCKED =="
+# Every target here is ABSOLUTE, so the verdict can only have come from the path's own repo.
+# The two $ODD SUBDIRECTORY cases were `allow` under the `*/worktrees/*` substring test this
+# replaced — unguarded writes into a primary checkout — because git prints an ABSOLUTE
+# git-dir from a subdirectory and a RELATIVE one at the toplevel, so one checkout got
+# opposite verdicts by depth (#7259). The structural test is spelling-independent.
+CWD="$PLAIN"
+expect block "sed -i s/a/b/ $ODD/pkg/x.ts"   # a SUBDIRECTORY — the depth the substring test lost
+expect block "echo x > $ODD/pkg/x.ts"        # same depth, reached through redirection
+expect block "sed -i s/a/b/ $ODD/README.md"  # the toplevel, which blocked only by accident
+expect block "sed -i s/a/b/ $MAIN/pkg/x.ts"  # control: an ordinary shared primary checkout
+expect allow "sed -i s/a/b/ $WT/pkg/x.ts"    # control: a real linked worktree still allows
+
 echo "== writes outside any repo are fine (/tmp, scratchpad, \$HOME dotfiles) =="
 CWD="$MAIN"
 expect allow 'echo x > /tmp/os-selftest-out.log'
diff --git a/.claude/hooks/guard-main-checkout-bash.sh b/.claude/hooks/guard-main-checkout-bash.sh
index 94bb98fc86..117e48f364 100755
--- a/.claude/hooks/guard-main-checkout-bash.sh
+++ b/.claude/hooks/guard-main-checkout-bash.sh
@@ -17,9 +17,9 @@
 #
 # Repo predicate — lifted verbatim from guard-main-checkout.sh so the two hooks can never
 # disagree about what "shared checkout" means:
-#   resolve the target's nearest EXISTING ancestor dir -> `git rev-parse --git-dir`
+#   resolve the target's nearest EXISTING ancestor dir -> `git rev-parse`
 #     * not a git repo at all (/tmp, $HOME dotfiles, the scratchpad)  -> allow
-#     * git-dir matches */worktrees/*  (a linked worktree)            -> allow
+#     * git-dir differs from git-common-dir (a linked worktree)       -> allow
 #     * anything else (the shared PRIMARY checkout, any sibling repo) -> BLOCK
 #
 # PRECISION OVER RECALL. Recognising a write target inside an arbitrary shell command is
@@ -308,9 +308,14 @@ tokenize() {
 }
 
 # --- the repo predicate, identical to guard-main-checkout.sh's ------------------------
+# Canonicalise an existing directory to its physical absolute path, so both sides of the
+# comparison below are spelled the same way: git prints the common-dir RELATIVE, and some
+# hosts hand out symlinked temp dirs.
+canon_dir() { ( cd "$1" 2>/dev/null && pwd -P ) || printf '%s' "$1"; }
+
 # 0 = this target lands in a shared primary checkout (block it), 1 = fine / unknowable.
 target_is_shared_checkout() {
-  local p="$1" d gitdir
+  local p="$1" d gitdir commondir
   [ -n "$p" ] || return 1
   [ "$p" = "-" ] && return 1                 # stdout, not a file
 
@@ -330,10 +335,15 @@ target_is_shared_checkout() {
   while [ -n "$d" ] && [ "$d" != "/" ] && [ ! -d "$d" ]; do d="$(dirname "$d")"; done
   [ -d "$d" ] || return 1
 
-  gitdir="$(git -C "$d" rev-parse --git-dir 2>/dev/null)" || return 1
-  case "$gitdir" in
-    */worktrees/*) return 1 ;;
-  esac
+  # A linked worktree's git-dir (.git/worktrees/NAME) differs from its git-COMMON-dir
+  # (.git); a primary checkout has the two equal, and so does a submodule. Structural, so it
+  # holds whatever the path is spelled like — the `*/worktrees/*` substring match it replaces
+  # did not (#7259). --git-common-dir prints RELATIVE to $d, so resolve it against $d first or
+  # the guard fails open at EVERY depth.
+  gitdir="$(git -C "$d" rev-parse --absolute-git-dir 2>/dev/null)" || return 1
+  commondir="$(git -C "$d" rev-parse --git-common-dir 2>/dev/null)" || return 1
+  case "$commondir" in /*) ;; *) commondir="$d/$commondir" ;; esac
+  [ "$(canon_dir "$gitdir")" != "$(canon_dir "$commondir")" ] && return 1
   return 0
 }
 
diff --git a/.claude/hooks/guard-main-checkout.selftest.sh b/.claude/hooks/guard-main-checkout.selftest.sh
index 4844703e2a..e8bab6d282 100755
--- a/.claude/hooks/guard-main-checkout.selftest.sh
+++ b/.claude/hooks/guard-main-checkout.selftest.sh
@@ -14,15 +14,14 @@
 # all — it picks the payload's path key from the tool that sent it and makes a
 # PATH-AND-WORKTREE decision — so these cases are derived from what this hook actually
 # decides, not ported from the sibling.
-#
 # PORTED from objectstack's copy of this matrix (objectstack-ai/objectstack, .claude/hooks/
 # guard-main-checkout.selftest.sh @ d63c8a2) under objectui#6451, and the port is VERBATIM:
-# the two repos' guard-main-checkout.sh differ by 9 diff lines that are all inside one
-# comment block, no executable line differs, and both settings.json route the identical
+# the two repos' guard-main-checkout.sh differ by 10 diff lines that are all inside comment
+# blocks, no executable line differs, and both settings.json route the identical
 # Edit|Write|NotebookEdit matcher — so the sibling file was first run here BYTE-FOR-BYTE
 # unmodified (via the two env vars below) and returned 87 passed, 0 failed. Not one case
-# needed adapting. The only edit below the header is the one remaining KNOWN HOLE section,
-# whose issue reference is re-pointed at this repo's own card for the same defect.
+# needed adapting. The only edit below the header is the `worktrees`-segment section, whose
+# issue reference is re-pointed at this repo's own card for the same defect.
 # ⛔ Keep the two copies converged: a case that has to differ is evidence the HOOKS have
 # drifted, and that drift is the finding — not something to paper over here.
 #
@@ -134,6 +133,31 @@ expect() { # expect <block|allow> <file_path> [env…] — the common case
   check "$want" "$f" "$(payload "$f")" "$@"
 }
 
+stderr_of() { # stderr_of <payload> [env…] -> the refusal text an agent actually reads
+  local payload="$1"; shift
+  ( cd "$CWD" && printf '%s' "$payload" | env CLAUDE_PROJECT_DIR="$PROJ" "$@" "$hook" 2>&1 >/dev/null )
+}
+
+says() { # says <needle> <label> <payload> [env…]
+  local needle="$1" label="$2" subject="$3"; shift 3
+  local out; out="$(stderr_of "$subject" "$@")"
+  case "$out" in
+    *"$needle"*) pass=$((pass + 1)); printf '  ok   says   %s\n' "$label" ;;
+    *) fail=$((fail + 1)); printf '  FAIL missing "%s"  %s\n' "$needle" "$label" ;;
+  esac
+}
+
+lacks() { # lacks <needle> <label> <payload> [env…]
+  # The direction only an ABSENCE assertion can hold: a remedy that stopped being true stays
+  # in the text a reader acts on long after the thing it described stopped working.
+  local needle="$1" label="$2" subject="$3"; shift 3
+  local out; out="$(stderr_of "$subject" "$@")"
+  case "$out" in
+    *"$needle"*) fail=$((fail + 1)); printf '  FAIL still says "%s"  %s\n' "$needle" "$label" ;;
+    *) pass=$((pass + 1)); printf '  ok   lacks  %s\n' "$label" ;;
+  esac
+}
+
 echo "== the core verdict: shared PRIMARY checkout is blocked =="
 expect block "$MAIN/pkg/x.ts"
 expect block "$MAIN/pkg/deep/y.ts"
@@ -142,6 +166,10 @@ expect block "$MAIN/.changeset/x.md"
 expect block "$MAIN/pkg/x.ipynb"
 
 echo "== the SAME files inside a linked worktree are allowed =="
+# The POSITIVE twin of the `worktrees`-segment section below. $WT is a REAL linked worktree
+# (`git worktree add`) whose path carries NO `worktrees` segment, so these allows can only
+# come from the structural test and never from the path's spelling. Both depths are pinned
+# below — the repo toplevel and a subdirectory — because git answers them differently.
 expect allow "$WT/pkg/x.ts"
 expect allow "$WT/pkg/deep/y.ts"
 expect allow "$WT/README.md"
@@ -201,6 +229,27 @@ check block 'OS_ALLOW_MAIN_EDITS=yes'              "$(payload "$MAIN/pkg/x.ts")"
 check block 'OS_ALLOW_MAIN_EDITS=11'               "$(payload "$MAIN/pkg/x.ts")" OS_ALLOW_MAIN_EDITS=11
 check block 'OS_ALLOW_MAIN_EDITS=" 1" (padded)'    "$(payload "$MAIN/pkg/x.ts")" OS_ALLOW_MAIN_EDITS=" 1"
 
+echo "== the hatch names WHERE it works: this hook's own environment, never a prefix =="
+# The refusal used to end by telling the reader to re-run the same thing with the variable
+# as a VAR=1 command prefix — an instruction that cannot work where it is printed. A VAR=1
+# prefix sets the variable in the environment of THAT COMMAND; this hook is not that
+# command, and it reads the variable from its own environment, so the prefix changes
+# nothing and the refusal repeats (#15971). An instruction that does not work is an
+# invitation to route around the guard, so both directions are pinned: the dead remedy is
+# gone, and the sentence names the environment the hook actually reads. The `allow` rows
+# next door — the variable really in the hook's environment — are this pair's other half.
+# Both of this hook's message sites carry the sentence: the ordinary refusal and the
+# schema-drift refusal, which is why each is asserted separately here.
+CWD="$PLAIN"; PROJ="$PLAIN"
+lacks 're-run with' 'the block message no longer prints the prefix remedy' \
+  "$(payload "$MAIN/pkg/x.ts")"
+says 'hook itself runs in' 'the block message names the environment this hook reads' \
+  "$(payload "$MAIN/pkg/x.ts")"
+lacks 're-run with' 'the drift message no longer prints the prefix remedy' \
+  '{"tool_name":"Edit","tool_input":{}}'
+says 'hook itself runs in' 'the drift message names the environment this hook reads' \
+  '{"tool_name":"Edit","tool_input":{}}'
+
 echo "== a ROUTED tool whose payload lacks its own path key is drift — it blocks, never guesses =="
 # The dangerous branch is the one that turns an unreadable payload into a confident verdict.
 # For a tool this guard is routed, an absent path key is not "no path given", it is the
@@ -374,26 +423,21 @@ PROJ="$PLAIN"
 check block 'NotebookEdit, new file in a new dir under $MAIN' "$(nbpay "$MAIN/brand/new/nb.ipynb")"
 check allow 'NotebookEdit, new file in a new dir under $WT'   "$(nbpay "$WT/brand/new/nb.ipynb")"
 
-# ── KNOWN HOLES ─────────────────────────────────────────────────────────────────────────
-# The cases below pin what the hook does TODAY, and what it does today is WRONG. They are
-# here so the matrix says the hole out loud rather than being silent about it, and so that
-# fixing it is a mechanical edit to this file. They are NOT statements of intended
-# behaviour. Each names the issue that must flip it.
-echo "== KNOWN HOLE #7259: any git-dir path containing /worktrees/ reads as a linked worktree =="
-# `case "$gitdir" in */worktrees/*) exit 0` is a substring match on a path, not a test for a
-# linked worktree. $ODD is a PRIMARY checkout that merely lives under a directory named
-# `worktrees`. git prints a RELATIVE git-dir (`.git`) at a repo's toplevel and an ABSOLUTE
-# one from any subdirectory, so the same unguarded checkout gets opposite verdicts by depth.
-# When #7259 is fixed both of these become `block`. (Same defect as the sibling repo's
-# objectstack-ai/objectstack#11809 — the hooks share these lines; fix them together.)
-# The deciding detail, measured rather than assumed: it is the NEAREST EXISTING ANCESTOR
-# that is handed to git, so a path whose nearest existing ancestor is the repo toplevel gets
-# the relative git-dir and blocks, while anything resolving to a subdirectory gets the
-# absolute one and slips through.
-expect block "$ODD/README.md"          # correct today, but only because git-dir was relative
-expect block "$ODD/brand/new/f.ts"     # ditto — resolves up to the toplevel
-expect allow "$ODD/pkg/x.ts"           # ⛔ WRONG — an unguarded edit into a PRIMARY checkout
-expect allow "$ODD/pkg/brand/new/f.ts" # ⛔ WRONG — same hole, reached through the ancestor walk
+echo "== a PRIMARY checkout whose own path carries a 'worktrees' segment is BLOCKED =="
+# $ODD is a PRIMARY checkout that merely lives under a directory named `worktrees`. The
+# verdict comes from the STRUCTURE — git-dir differs from git-common-dir in a linked
+# worktree, and only there — never from the spelling of the path, so all four block. The two
+# SUBDIRECTORY cases were `allow` under the `*/worktrees/*` substring test this replaced:
+# unguarded edits into a primary checkout, which is the exact failure worktree-first exists
+# to stop (#7259). The pair of DEPTHS is what makes the section discriminating, and the
+# deciding detail was measured rather than assumed: it is the NEAREST EXISTING ANCESTOR that
+# is handed to git, so a path resolving to the repo toplevel got a RELATIVE git-dir and
+# blocked by accident, while anything resolving to a subdirectory got the absolute one and
+# slipped through.
+expect block "$ODD/README.md"          # nearest existing ancestor = the repo toplevel
+expect block "$ODD/brand/new/f.ts"     # ditto — the ancestor walk climbs to the toplevel
+expect block "$ODD/pkg/x.ts"           # a SUBDIRECTORY — the depth the substring test lost
+expect block "$ODD/pkg/brand/new/f.ts" # same depth, reached through the ancestor walk
 
 echo "== BOUNDARY: the jq-less fallback is a text scan, not a JSON parser =="
 # Not filed as a defect: jq is present wherever this hook runs, and Claude Code emits plain
@@ -415,11 +459,11 @@ printf '\n'
 #
 #   cp .claude/hooks/guard-main-checkout.sh /tmp/mutant.sh
 #   # e.g. delete the linked-worktree escape, which should redden every `allow` in a worktree:
-#   perl -0pi -e 's{^\s*\*/worktrees/\*\) exit 0 ;;\n}{}m' /tmp/mutant.sh
+#   perl -0pi -e 's{^\[ "\$\(canon_dir .*\n}{}m' /tmp/mutant.sh
 #   GUARD_MAIN_CHECKOUT_HOOK=/tmp/mutant.sh .claude/hooks/guard-main-checkout.selftest.sh
 #
-# The mutations used, one per class: drop the */worktrees/* arm (core verdict) · drop the
-# nearest-existing-ancestor walk (new-file class) · replace dirname "$file" with
+# The mutations used, one per class: drop the linked-worktree escape (core verdict) · drop
+# the nearest-existing-ancestor walk (new-file class) · replace dirname "$file" with
 # CLAUDE_PROJECT_DIR (the file's-own-repo class) · drop the OS_ALLOW_MAIN_EDITS line (escape
 # hatch) · turn the no-path else branch into exit 0 (the fails-closed class) · rename the key
 # in the grep fallback (the jq-less class) · change the final exit 2 to exit 0 (every block) ·
diff --git a/.claude/hooks/guard-main-checkout.sh b/.claude/hooks/guard-main-checkout.sh
index 619260d707..fa19901e35 100755
--- a/.claude/hooks/guard-main-checkout.sh
+++ b/.claude/hooks/guard-main-checkout.sh
@@ -83,7 +83,10 @@ blocks instead.
 Fix the row for $tool in this hook's known_path_keys table, then re-run
 .claude/hooks/guard-main-checkout.selftest.sh.
 
-Deliberate non-task exception: re-run with OS_ALLOW_MAIN_EDITS=1.
+Deliberate non-task exception: set OS_ALLOW_MAIN_EDITS=1 in the
+environment this hook itself runs in — a local settings "env" entry, or whatever this
+agent process was started with. A VAR=1 prefix on a command sets it for that command
+only, and this hook is not that command, so a prefix never reaches it.
 EOF
   exit 2
 fi
@@ -94,11 +97,24 @@ if [ -n "$file" ]; then d="$(dirname "$file")"; else d="${CLAUDE_PROJECT_DIR:-$P
 while [ -n "$d" ] && [ "$d" != "/" ] && [ ! -d "$d" ]; do d="$(dirname "$d")"; done
 [ -d "$d" ] || d="${CLAUDE_PROJECT_DIR:-$PWD}"
 
-gitdir="$(git -C "$d" rev-parse --git-dir 2>/dev/null)" || exit 0
-
-case "$gitdir" in
-  */worktrees/*) exit 0 ;;
-esac
+# Canonicalise an existing directory to its physical absolute path, so both sides of the
+# comparison below are spelled the same way: git prints the common-dir RELATIVE, and some
+# hosts hand out symlinked temp dirs.
+canon_dir() { ( cd "$1" 2>/dev/null && pwd -P ) || printf '%s' "$1"; }
+
+# Am I in a LINKED WORKTREE? Structurally: a linked worktree's git-dir (.git/worktrees/NAME)
+# differs from its git-COMMON-dir (.git). A primary checkout has the two equal, and so does a
+# submodule (.git/modules/NAME for both) — which is why neither needs a special case. The
+# test holds whatever the path is spelled like; the `*/worktrees/*` substring match it
+# replaces did not, so a PRIMARY checkout that merely lived under a directory named
+# `worktrees` read as a linked worktree and went unguarded (#7259). --git-common-dir prints
+# RELATIVE to $d (`.git` at a toplevel, `../.git` from a subdirectory), so it MUST be
+# resolved against $d first: compared raw it never equals the absolute git-dir, and the
+# guard would fail open at EVERY depth instead of some.
+gitdir="$(git -C "$d" rev-parse --absolute-git-dir 2>/dev/null)" || exit 0
+commondir="$(git -C "$d" rev-parse --git-common-dir 2>/dev/null)" || exit 0
+case "$commondir" in /*) ;; *) commondir="$d/$commondir" ;; esac
+[ "$(canon_dir "$gitdir")" != "$(canon_dir "$commondir")" ] && exit 0
 
 root="$(git -C "$d" rev-parse --show-toplevel 2>/dev/null || printf '%s' "$d")"
 branch="$(git -C "$d" rev-parse --abbrev-ref HEAD 2>/dev/null || printf '?')"
@@ -116,6 +132,9 @@ branch on the shared checkout is NOT enough; you must be in a dedicated worktree
 
 This guard checks the edited file's OWN repo, so sibling repos are covered too.
 
-Deliberate non-task exception: re-run with OS_ALLOW_MAIN_EDITS=1.
+Deliberate non-task exception: set OS_ALLOW_MAIN_EDITS=1 in the
+environment this hook itself runs in — a local settings "env" entry, or whatever this
+agent process was started with. A VAR=1 prefix on a command sets it for that command
+only, and this hook is not that command, so a prefix never reaches it.
 EOF
 exit 2
diff --git a/scripts/upstream-port-pin.json b/scripts/upstream-port-pin.json
index b57ffd030b..c2b7b1e189 100644
--- a/scripts/upstream-port-pin.json
+++ b/scripts/upstream-port-pin.json
@@ -1,7 +1,7 @@
 {
   "upstream": {
     "repo": "objectstack-ai/objectstack",
-    "ref": "bf10debd587f6ba891be9eadc2b76c91e15bd82b"
+    "ref": "70e77ec3b566b92d7c6551637d6bc746fb840bb6"
   },
   "files": [
     {
@@ -141,91 +141,19 @@
     {
       "ported": ".claude/hooks/guard-main-checkout.selftest.sh",
       "upstreamPath": ".claude/hooks/guard-main-checkout.selftest.sh",
-      "upstreamSha256": "fb413bdb1410c6333bfc24d924c0d1175daa8a3ee9ba43e1f5b1bd554a1887b6",
+      "upstreamSha256": "1d8d4458c90beb9f673556524e34262a8a0593e1a4d2de20a352f6b5a77c6721",
       "divergences": [
-        {
-          "id": "routed-key-header-sentence",
-          "why": "objectui#7686 taught the hook to pick its path key from the routed tool, so the header sentence describing what it reads was rewritten; the pinned upstream copy still says it reads .tool_input.file_path.",
-          "upstream": "# all — it reads .tool_input.file_path and makes a PATH-AND-WORKTREE decision — so these\n# cases are derived from what this hook actually decides, not ported from the sibling.\n",
-          "ported": "# all — it picks the payload's path key from the tool that sent it and makes a\n# PATH-AND-WORKTREE decision — so these cases are derived from what this hook actually\n# decides, not ported from the sibling.\n"
-        },
         {
           "id": "ported-from-provenance-header",
           "why": "The port added its own provenance paragraph (objectui#6451): upstream has no reason to record where its file was ported to, and this repo needs the two copies' convergence rule stated in the file.",
           "upstream": "#\n# Fail-open by default, on purpose: the process cwd AND CLAUDE_PROJECT_DIR both default to a\n",
-          "ported": "#\n# PORTED from objectstack's copy of this matrix (objectstack-ai/objectstack, .claude/hooks/\n# guard-main-checkout.selftest.sh @ d63c8a2) under objectui#6451, and the port is VERBATIM:\n# the two repos' guard-main-checkout.sh differ by 9 diff lines that are all inside one\n# comment block, no executable line differs, and both settings.json route the identical\n# Edit|Write|NotebookEdit matcher — so the sibling file was first run here BYTE-FOR-BYTE\n# unmodified (via the two env vars below) and returned 87 passed, 0 failed. Not one case\n# needed adapting. The only edit below the header is the one remaining KNOWN HOLE section,\n# whose issue reference is re-pointed at this repo's own card for the same defect.\n# ⛔ Keep the two copies converged: a case that has to differ is evidence the HOOKS have\n# drifted, and that drift is the finding — not something to paper over here.\n#\n# Fail-open by default, on purpose: the process cwd AND CLAUDE_PROJECT_DIR both default to a\n"
-        },
-        {
-          "id": "nbpay-payload-helper",
-          "why": "objectui#7686 promoted the NotebookEdit payload builder to a first-class helper used across the matrix; the pinned upstream copy defines one only inside the KNOWN HOLE section it still carries.",
-          "upstream": "\nexpect() { # expect <block|allow> <file_path> [env…] — the common case\n",
-          "ported": "\nnbpay() { # nbpay <notebook_path> [tool_name] -> the NotebookEdit payload shape\n  # Matches the tool's documented input schema: notebook_path (absolute, required) and\n  # new_source, with no file_path key anywhere in the payload.\n  jq -nc --arg f \"$1\" --arg t \"${2:-NotebookEdit}\" \\\n    '{session_id:\"selftest\",cwd:\"/payload-cwd-must-be-ignored\",tool_name:$t,\n      tool_input:{notebook_path:$f,new_source:\"x\",edit_mode:\"replace\"}}'\n}\n\nexpect() { # expect <block|allow> <file_path> [env…] — the common case\n"
-        },
-        {
-          "id": "tool-name-selects-path-key-section",
-          "why": "objectui#7686 made tool_name select which key of tool_input holds the path, so the section that pinned 'tool_name is never consulted' became one row per routed tool.",
-          "upstream": "echo \"== tool_name is never consulted — scoping lives in the settings.json matcher ==\"\n# The hook decides on the path alone. Which tools reach it is the matcher's job, asserted\n# in the wiring section below; these cases pin that the hook itself does not second-guess it.\nfor t in Edit Write NotebookEdit MultiEdit AnythingElse; do\n  check block \"tool_name=$t into \\$MAIN\"  \"$(payload \"$MAIN/pkg/x.ts\" \"$t\")\"\n  check allow \"tool_name=$t into \\$WT\"    \"$(payload \"$WT/pkg/x.ts\" \"$t\")\"\ndone\n",
-          "ported": "echo \"== tool_name selects the path key — one row per tool, and the matcher is its pair ==\"\n# tool_name is consulted for exactly one thing: which key of tool_input holds the path. The\n# verdict itself still comes from the path alone. Tools the table names are read for their\n# own key; a tool it does not name is not routed here by the matcher, and keeps the\n# permissive read — any known key it happens to carry, else the session's dir.\nfor t in Edit Write MultiEdit; do\n  check block \"tool_name=$t (file_path) into \\$MAIN\"  \"$(payload \"$MAIN/pkg/x.ts\" \"$t\")\"\n  check allow \"tool_name=$t (file_path) into \\$WT\"    \"$(payload \"$WT/pkg/x.ts\" \"$t\")\"\ndone\ncheck block 'tool_name=NotebookEdit (notebook_path) into $MAIN' \"$(nbpay \"$MAIN/pkg/x.ipynb\")\"\ncheck allow 'tool_name=NotebookEdit (notebook_path) into $WT'   \"$(nbpay \"$WT/pkg/x.ipynb\")\"\ncheck block 'unrouted tool carrying file_path, into $MAIN'      \"$(payload \"$MAIN/pkg/x.ts\" AnythingElse)\"\ncheck allow 'unrouted tool carrying file_path, into $WT'        \"$(payload \"$WT/pkg/x.ts\" AnythingElse)\"\ncheck block 'unrouted tool carrying notebook_path, into $MAIN'  \"$(nbpay \"$MAIN/pkg/x.ipynb\" AnythingElse)\"\ncheck allow 'unrouted tool carrying notebook_path, into $WT'    \"$(nbpay \"$WT/pkg/x.ipynb\" AnythingElse)\"\n"
-        },
-        {
-          "id": "routed-tool-missing-key-is-drift-section",
-          "why": "objectui#7686 added the drift arm — a tool this guard routes, arriving with no path key, blocks instead of falling back to the session dir — and this section is what pins it.",
-          "upstream": "echo \"== a payload carrying no usable path is judged by CLAUDE_PROJECT_DIR — fails CLOSED ==\"\n# This is the branch the hook takes when it learns nothing from the payload. It is the\n# opposite posture from the Bash sibling (which fails open on an unparseable command): here\n# an unreadable payload on the shared checkout still BLOCKS. Safe direction, and deliberate\n# — it is an explicit `else` in the hook, not a fall-through.\nfor probe in '{\"tool_name\":\"Edit\",\"tool_input\":{}}' '{}' 'not json at all' '' '{\"tool_input\":{\"file_path\":\"\"}}'; do\n",
-          "ported": "echo \"== a ROUTED tool whose payload lacks its own path key is drift — it blocks, never guesses ==\"\n# The dangerous branch is the one that turns an unreadable payload into a confident verdict.\n# For a tool this guard is routed, an absent path key is not \"no path given\", it is the\n# tool's schema moving under the guard — and judging the session's dir instead would answer\n# the same way all session long, right or wrong by where that session is rooted. Every row\n# here is run with CLAUDE_PROJECT_DIR pointed somewhere that would ALLOW under a fallback,\n# except the first of each trio, so a passing `block` can only have come from the drift arm.\nfor probe in \\\n  '{\"tool_name\":\"Edit\",\"tool_input\":{}}' \\\n  '{\"tool_name\":\"Write\",\"tool_input\":{\"content\":\"x\"}}' \\\n  '{\"tool_name\":\"NotebookEdit\",\"tool_input\":{\"new_source\":\"x\",\"edit_mode\":\"replace\"}}'\ndo\n  PROJ=\"$MAIN\";  check block \"routed tool, no path key, CLAUDE_PROJECT_DIR=\\$MAIN  [$probe]\"  \"$probe\"\n  PROJ=\"$WT\";    check block \"routed tool, no path key, CLAUDE_PROJECT_DIR=\\$WT    [$probe]\"  \"$probe\"\n  PROJ=\"$PLAIN\"; check block \"routed tool, no path key, CLAUDE_PROJECT_DIR=\\$PLAIN [$probe]\"  \"$probe\"\ndone\nPROJ=\"$PLAIN\"\n# the cross-key pair: the right tool, the other tool's key. Drift in both directions.\ncheck block 'NotebookEdit carrying file_path (the wrong key), into $WT' \"$(payload \"$WT/pkg/x.ipynb\" NotebookEdit)\"\ncheck block 'Edit carrying notebook_path (the wrong key), into $WT'     \"$(nbpay \"$WT/pkg/x.ipynb\" Edit)\"\n\necho \"== an UNROUTED payload carrying no usable path is judged by CLAUDE_PROJECT_DIR — fails CLOSED ==\"\n# The remaining no-path branch: nothing in the payload names a tool this guard knows, so\n# there is no contract to have drifted. It is the opposite posture from the Bash sibling\n# (which fails open on an unparseable command): here an unreadable payload on the shared\n# checkout still BLOCKS. Safe direction, and deliberate — an explicit `else`, not a\n# fall-through.\nfor probe in '{}' 'not json at all' '' '{\"tool_input\":{\"file_path\":\"\"}}' '{\"tool_name\":\"AnythingElse\",\"tool_input\":{}}'; do\n"
-        },
-        {
-          "id": "nopath-probe-uses-an-unrouted-tool",
-          "why": "The CLAUDE_PROJECT_DIR fallback row must use a tool the hook does NOT route, because after objectui#7686 a routed tool with no path key takes the drift arm instead of that branch.",
-          "upstream": "nopath='{\"tool_name\":\"Edit\",\"tool_input\":{}}'\n",
-          "ported": "nopath='{\"tool_name\":\"AnythingElse\",\"tool_input\":{}}'\n"
-        },
-        {
-          "id": "nojq-notebook-and-tool-name-decoy-rows",
-          "why": "objectui#7686 extended the jq-less text-scan fallback to tool_name and notebook_path, so the fallback section gained the rows that pin both, decoys included.",
-          "upstream": "check block 'with jq: same decoy payload'                                     \"$decoy\"\n\n",
-          "ported": "check block 'with jq: same decoy payload'                                     \"$decoy\"\n# the fallback mirrors the whole table, not just one key: it must read tool_name and the\n# notebook key too, or notebook edits silently rejoin the no-path branch whenever jq is away\ncheck block 'no jq: NotebookEdit into $MAIN'   \"$(nbpay \"$MAIN/pkg/x.ipynb\")\"  PATH=\"$nojq\"\ncheck allow 'no jq: NotebookEdit into $WT'     \"$(nbpay \"$WT/pkg/x.ipynb\")\"    PATH=\"$nojq\"\ncheck allow 'no jq: NotebookEdit into $PLAIN'  \"$(nbpay \"$PLAIN/x.ipynb\")\"     PATH=\"$nojq\"\ncheck block 'no jq: NotebookEdit with no notebook_path is drift' \\\n  '{\"tool_name\":\"NotebookEdit\",\"tool_input\":{\"new_source\":\"x\"}}' PATH=\"$nojq\"\n# tool_name gets the same decoy treatment as the path keys: quoted inside a string value its\n# quotes are escaped, so prose about a tool cannot re-key the scan\ndecoy2=\"$(jq -nc --arg f \"$MAIN/pkg/x.ts\" --arg c 'prose mentioning \"tool_name\": \"NotebookEdit\" verbatim' \\\n  '{tool_name:\"Write\",tool_input:{content:$c,file_path:$f}}')\"\ncheck block 'no jq: escaped decoy tool_name in content loses to the real one' \"$decoy2\" PATH=\"$nojq\"\ncheck block 'with jq: same tool_name decoy payload'                           \"$decoy2\"\n\n"
-        },
-        {
-          "id": "wiring-section-pins-the-matcher-pairing",
-          "why": "objectui#7686 made the settings.json matcher and the hook's known_path_keys table a checkable pair, so this section's heading and rationale say so rather than pinning the matcher alone.",
-          "upstream": "echo \"== wiring: settings.json must route Edit, Write and NotebookEdit to this hook ==\"\n# The hook is deliberately tool-agnostic, so the matcher is the ONLY thing that decides which\n# tools it sees. Nothing else in the repo checks that. Additions to the matcher are fine;\n# a removal is what this pins.\n",
-          "ported": "echo \"== wiring: the matcher routes Edit, Write and NotebookEdit, and every routed tool has a row ==\"\n# The matcher is the ONLY thing that decides which tools this hook sees, and the hook's\n# known_path_keys table is the only thing that decides what it reads out of each one.\n# Nothing else in the repo checks either half, so both are pinned here: a removal from the\n# matcher, and a tool routed with no row to read it by. Additions to the matcher are fine\n# — provided they bring their row.\n"
-        },
-        {
-          "id": "matcher-to-table-pairing-block",
-          "why": "The pairing assertion itself, added by objectui#7686: every tool the matcher routes must have a row in the hook's table, a relation nothing in the pinned upstream copy checks.",
-          "upstream": "  done\nelse\n",
-          "ported": "  done\n\n  # ── the pairing ───────────────────────────────────────────────────────────────────────\n  # \"a tool the matcher routes here\" and \"a path key this hook knows\" must be a CHECKABLE\n  # relation, not a convention: a tool routed here with no row is read for a key its payload\n  # never carries, and the guard silently goes back to judging the session. So: every name\n  # in the matcher must have a row in the hook's table. A row with no matcher entry is the\n  # harmless direction — a tool the hook is ready for that nothing routes yet — so it prints\n  # a note, not a failure.\n  table=\"$(sed -n \"s/^known_path_keys='\\(.*\\)'\\$/\\1/p\" \"$hook\" | head -1)\"\n  if [ -z \"$table\" ]; then\n    fail=$((fail + 1)); printf '  FAIL the hook has no known_path_keys table for the matcher to pair with\\n'\n  else\n    routed=\"$(printf '%s' \"$matcher\" | tr '|' ' ')\"\n    for tool in $routed; do\n      row=\"\"\n      for r in $table; do case \"$r\" in \"$tool=\"*) row=\"${r#*=}\" ;; esac; done\n      if [ -n \"$row\" ]; then\n        pass=$((pass + 1)); printf '  ok   pair   %-13s -> .tool_input.%s\\n' \"$tool\" \"$row\"\n      else\n        fail=$((fail + 1)); printf '  FAIL %s is routed to this hook but has no row in known_path_keys (%s)\\n' \"$tool\" \"$table\"\n      fi\n    done\n    for r in $table; do\n      t=\"${r%%=*}\"\n      case \" $routed \" in\n        *\" $t \"*) ;;\n        *) printf '  note       %s has a row in known_path_keys; the matcher does not route it\\n' \"$t\" ;;\n      esac\n    done\n  fi\nelse\n"
-        },
-        {
-          "id": "notebook-verdict-by-its-own-path",
-          "why": "objectui#7686 fixed notebooks to be judged by the notebook's own path, so this copy pins the FIXED behaviour where the pinned upstream copy pins the hole.",
-          "upstream": "\n# ── KNOWN HOLES ─────────────────────────────────────────────────────────────────────────\n",
-          "ported": "\necho \"== a notebook is judged by the NOTEBOOK's own path, exactly as a file edit is ==\"\n# The verdict must depend on where the notebook lives, never on where the session happens to\n# be rooted, so CLAUDE_PROJECT_DIR points at the WRONG place in every row here: a guard that\n# judged the session would answer the same way down each column instead of following the\n# path. The three `expect` rows are the same three notebooks through the Edit payload shape\n# — the two shapes must reach the same verdict, or the guard has one rule per tool.\nPROJ=\"$MAIN\"\ncheck block 'NotebookEdit into $MAIN,  CLAUDE_PROJECT_DIR=$MAIN'  \"$(nbpay \"$MAIN/pkg/x.ipynb\")\"\ncheck allow 'NotebookEdit into $WT,    CLAUDE_PROJECT_DIR=$MAIN'  \"$(nbpay \"$WT/pkg/x.ipynb\")\"\ncheck allow 'NotebookEdit into $PLAIN, CLAUDE_PROJECT_DIR=$MAIN'  \"$(nbpay \"$PLAIN/x.ipynb\")\"\nPROJ=\"$WT\"\ncheck block 'NotebookEdit into $MAIN,  CLAUDE_PROJECT_DIR=$WT'    \"$(nbpay \"$MAIN/pkg/x.ipynb\")\"\ncheck allow 'NotebookEdit into $WT,    CLAUDE_PROJECT_DIR=$WT'    \"$(nbpay \"$WT/pkg/x.ipynb\")\"\nPROJ=\"$PLAIN\"\ncheck block 'NotebookEdit into $MAIN,  CLAUDE_PROJECT_DIR=$PLAIN' \"$(nbpay \"$MAIN/pkg/x.ipynb\")\"\ncheck allow 'NotebookEdit into $WT,    CLAUDE_PROJECT_DIR=$PLAIN' \"$(nbpay \"$WT/pkg/x.ipynb\")\"\nPROJ=\"$WT\";   expect block \"$MAIN/pkg/x.ipynb\"\nPROJ=\"$MAIN\"; expect allow \"$WT/pkg/x.ipynb\"\nPROJ=\"$MAIN\"; expect allow \"$PLAIN/x.ipynb\"\nPROJ=\"$PLAIN\"\n# and the ancestor walk reaches notebooks too: a new notebook in a not-yet-created directory\ncheck block 'NotebookEdit, new file in a new dir under $MAIN' \"$(nbpay \"$MAIN/brand/new/nb.ipynb\")\"\ncheck allow 'NotebookEdit, new file in a new dir under $WT'   \"$(nbpay \"$WT/brand/new/nb.ipynb\")\"\n\n# ── KNOWN HOLES ─────────────────────────────────────────────────────────────────────────\n"
-        },
-        {
-          "id": "hole-heading-repointed",
-          "why": "The KNOWN HOLE heading names this repository's own card (objectui#7259) instead of upstream's number for the same defect, so a reader here can find the card that will flip these rows.",
-          "upstream": "echo \"== KNOWN HOLE #11809: any git-dir path containing /worktrees/ reads as a linked worktree ==\"\n",
-          "ported": "echo \"== KNOWN HOLE #7259: any git-dir path containing /worktrees/ reads as a linked worktree ==\"\n"
-        },
-        {
-          "id": "hole-crossref-repointed",
-          "why": "The same re-pointing in the body, keeping upstream's number as an explicit cross-reference because the two hooks share these lines and must be fixed together.",
-          "upstream": "# When #11809 is fixed both of these become `block`.\n",
-          "ported": "# When #7259 is fixed both of these become `block`. (Same defect as the sibling repo's\n# objectstack-ai/objectstack#11809 — the hooks share these lines; fix them together.)\n"
-        },
-        {
-          "id": "known-hole-notebook-section-removed",
-          "why": "The notebook-path hole is FIXED here (objectui#7260, by objectui#7686), so the section pinning it is gone; the pinned upstream copy still carries it as its own #11810.",
-          "upstream": "expect allow \"$ODD/pkg/brand/new/f.ts\" # ⛔ WRONG — same hole, reached through the ancestor walk\n\necho \"== KNOWN HOLE #11810: NotebookEdit's path key is notebook_path, which this hook never reads ==\"\n# The matcher routes NotebookEdit here, but the hook extracts only .tool_input.file_path, so\n# every notebook edit takes the no-path branch and is judged by CLAUDE_PROJECT_DIR instead of\n# by the file. The verdict below is a constant per session and is wrong in both directions.\n# When #11810 is fixed, these become block / allow / allow by the notebook's own path.\nnbpay() { jq -nc --arg f \"$1\" '{tool_name:\"NotebookEdit\",tool_input:{notebook_path:$f,new_source:\"x\",edit_mode:\"replace\"}}'; }\nPROJ=\"$MAIN\"\ncheck block 'NotebookEdit into $MAIN,  CLAUDE_PROJECT_DIR=$MAIN'  \"$(nbpay \"$MAIN/pkg/x.ipynb\")\"\ncheck block 'NotebookEdit into $WT,    CLAUDE_PROJECT_DIR=$MAIN'  \"$(nbpay \"$WT/pkg/x.ipynb\")\"   # ⛔ WRONG — refuses the mandated location\ncheck block 'NotebookEdit into $PLAIN, CLAUDE_PROJECT_DIR=$MAIN'  \"$(nbpay \"$PLAIN/x.ipynb\")\"    # ⛔ WRONG — refuses a file in no repo\nPROJ=\"$WT\"\ncheck allow 'NotebookEdit into $MAIN,  CLAUDE_PROJECT_DIR=$WT'    \"$(nbpay \"$MAIN/pkg/x.ipynb\")\" # ⛔ WRONG — unguarded edit into the shared checkout\nPROJ=\"$PLAIN\"\ncheck allow 'NotebookEdit into $MAIN,  CLAUDE_PROJECT_DIR=$PLAIN' \"$(nbpay \"$MAIN/pkg/x.ipynb\")\" # ⛔ WRONG — same, from a session rooted outside any repo\n\necho \"== BOUNDARY: the jq-less fallback is a text scan, not a JSON parser ==\"\n",
-          "ported": "expect allow \"$ODD/pkg/brand/new/f.ts\" # ⛔ WRONG — same hole, reached through the ancestor walk\n\necho \"== BOUNDARY: the jq-less fallback is a text scan, not a JSON parser ==\"\n"
+          "ported": "# PORTED from objectstack's copy of this matrix (objectstack-ai/objectstack, .claude/hooks/\n# guard-main-checkout.selftest.sh @ d63c8a2) under objectui#6451, and the port is VERBATIM:\n# the two repos' guard-main-checkout.sh differ by 10 diff lines that are all inside comment\n# blocks, no executable line differs, and both settings.json route the identical\n# Edit|Write|NotebookEdit matcher — so the sibling file was first run here BYTE-FOR-BYTE\n# unmodified (via the two env vars below) and returned 87 passed, 0 failed. Not one case\n# needed adapting. The only edit below the header is the `worktrees`-segment section, whose\n# issue reference is re-pointed at this repo's own card for the same defect.\n# ⛔ Keep the two copies converged: a case that has to differ is evidence the HOOKS have\n# drifted, and that drift is the finding — not something to paper over here.\n#\n# Fail-open by default, on purpose: the process cwd AND CLAUDE_PROJECT_DIR both default to a\n"
         },
         {
-          "id": "mutation-recipe-classes",
-          "why": "The mutation recipe lists one mutation per behaviour class, and objectui#7686 added three classes (the notebook row, the wiring pair, the schema-drift arm) the pinned upstream copy has no lines for.",
-          "upstream": "# in the grep fallback (the jq-less class) · change the final exit 2 to exit 0 (every block).\n",
-          "ported": "# in the grep fallback (the jq-less class) · change the final exit 2 to exit 0 (every block) ·\n# point NotebookEdit's row at file_path (the notebook class) · delete NotebookEdit's row\n# altogether (the wiring pair, which reds on the matcher relation and not on a verdict) ·\n# replace the drift block with the project-dir fallback (the schema-drift class).\n"
+          "id": "worktrees-section-crossref-repointed",
+          "why": "The worktrees-segment section names this repository's own card for the defect (objectui#7259) instead of upstream's number for the same one (objectstack#11809), so a reader here can find the card these rows belong to.",
+          "upstream": "# to stop (#11809). The pair of DEPTHS is what makes the section discriminating, and the\n",
+          "ported": "# to stop (#7259). The pair of DEPTHS is what makes the section discriminating, and the\n"
         }
       ]
     }