restore: replay four merged-but-not-on-main PRs onto the trunk

[EdbertChan]

Summary

Four merged PRs never reached main. #291, #292, #298 and #296 all report state=MERGED, but their merge commits are on their own stack branches, not on the trunk. This branch replays those four squashes onto current main so the work is actually in effect.

The cause was gh pr edit --base main. It exits 0 and prints a Projects-classic GraphQL deprecation warning while leaving the base unchanged, so each child merged into its parent's branch instead of the trunk. The same command silently drops --add-label writes in this repo.

No content changed. Each commit is a git cherry-pick -x of the original squash, applied cleanly with no conflicts.

Test Plan

Every CI gate run locally against this branch:

run_all_tests.sh PASS skill_test_coverage PASS
no_tracked_local_artifacts PASS skill_test_debt_no_growth PASS
hook_test_coverage PASS skill_trigger_mechanism PASS
skills_three_harnesses PASS dora_baseline PASS
ecosystem_boundaries PASS no_dated_provenance PASS
skill_file_refs PASS no_new_comments PASS

ruff and shellcheck are not installed on the local box, so those two run in CI only.

Verify the gap this closes:

gh pr view 296 --json mergeCommit --jq .mergeCommit.oid # c094d31e4...
git branch -r --contains c094d31e4 | grep -c origin/main # 0 before, 1 after

Revert Plan

git revert the four commits, or reset main to the commit before the merge. Nothing here is stateful and no migration runs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01F43CBUnsDEs6J2zEC1r8a8

---

Note

Medium Risk
New PreToolUse blocking can stop legitimate Bash automation on the live desktop; lock/idle probes fail open on non-macOS/errors while missing the hands-off marker still blocks.

Overview
Adds ui-input-guard, a Bash PreToolUse hook that blocks synthetic session control (AppleScript System Events keystrokes/clicks, cliclick, xdotool, video screencapture, ffmpeg screen capture) unless a fresh /tmp/.ui-input-window hands-off marker exists, the screen is unlocked, and the user has been idle ~10s on macOS. It follows wrapper scripts (chunked scan, refuses unscannable files over 8MB instead of treating them as clean), and is wired through install.sh plus Claude settings merge.

Policy and reflect plumbing: Live-demo / cat-mode / CLAUDE.core.md now require disposable UI surfaces and the same marker; evidence rules add an explicit hit / clean / unchecked rule for guards. wrong-check-reflect and reflect treat concessions like “your instinct was right” or “good catch” plus a correction as FAIL shapes. scope-lock gains tests pinning corrupt state vs unreadable transcript behavior. check_hook_test_coverage.py requires hooks that read files to have tests naming the unreadable outcome.

^{Reviewed by Cursor Bugbot for commit 9f0f9ab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_cc8f8af7-d22b-4d68-9ead-1fd52b2ef0cb)