guard hook reads .abcd/guard.json from a REFUSED foreign-uid root when the workdir (or session cwd) is that root, while the refusal note says it was not read (internal/surface/cli/guard.go:430, internal/core/rules/root.go:255); it can only add hazards (Strictest), but the foreign file's why/successor text reaches the agent as the block message. Fixed on feat/ruled-security-forks (da3efea6/ebc6290d), not on main.

guard hook reads .abcd/guard.json from a REFUSED foreign-uid root when the workdir (or session cwd) is that root, while the refusal note says it was not read (internal/surface/cli/guard.go:430, internal/core/rules/root.go:255); it can only add hazards (Strictest), but the foreign file's why/successor text reaches the agent as the block message. Fixed on feat/ruled-security-forks (da3efea6/ebc6290d), not on main.

Grounds

• pursued: the refusal note never says a configuration went unread that the loaders read; a session or workdir at a refused root with its own .abcd/ whose note says NOT read would show it wrong