diff --git a/packages/cli/src/commands/review/lib/worktree.test.ts b/packages/cli/src/commands/review/lib/worktree.test.ts
index 946020fc8f9..9d6fe904ba3 100644
--- a/packages/cli/src/commands/review/lib/worktree.test.ts
+++ b/packages/cli/src/commands/review/lib/worktree.test.ts
@@ -32,9 +32,14 @@ import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import { isolateHostGitConfig } from './test-utils.js';
 import {
+  MAX_SCREEN_CANDIDATES,
+  MAX_SCREEN_KEYS,
+  carriesReplacementChar,
   discardWorktree,
   exposeDependencies,
+  localFilterCommands,
   sanitizedGitEnv,
+  screenStopDetail,
   worktreeCreateFailureDetail,
   worktreeResidue,
 } from './worktree.js';
@@ -1885,3 +1890,489 @@ describe('worktreeCreateFailureDetail', () => {
     );
   });
 });
+
+describe('localFilterCommands', () => {
+  let dir: string;
+  let isolation: { dispose: () => void };
+
+  const initRepo = (d: string) => {
+    execFileSync('git', ['init', '-q', '-b', 'main', '--template=', '.'], {
+      cwd: d,
+    });
+  };
+
+  beforeEach(() => {
+    isolation = isolateHostGitConfig();
+    dir = mkdtempSync(join(tmpdir(), 'qwen-screen-'));
+    initRepo(dir);
+  });
+
+  afterEach(() => {
+    try {
+      chmodSync(join(dir, '.git', 'worktrees'), 0o755);
+    } catch {
+      // Not every case creates it; rmSync below is the cleanup either way.
+    }
+    isolation.dispose();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it('finds a repo-local filter and reports the total', () => {
+    execFileSync('git', ['config', 'filter.evil.smudge', 'cat'], { cwd: dir });
+
+    const screen = localFilterCommands(dir);
+
+    expect(screen.keys).toEqual(['filter.evil.smudge']);
+    expect(screen.total).toBe(1);
+    expect(screen.unreadable).toBeNull();
+  });
+
+  it("never reports the user's global keys through an include", () => {
+    // The screen does not follow includes at all — a declared limit, see the
+    // spawn's comment. This pins the half of it that MUST hold: an
+    // `include.path` naming the user's own global config never drags their
+    // `filter.lfs.*` into a repo-local refusal. `git lfs install` writes that
+    // key, so following the edge would put every contributor with git-lfs into
+    // permanent refusal — the failure this screen is scoped to avoid.
+    const outside = mkdtempSync(join(tmpdir(), 'qwen-userconf-'));
+    try {
+      const userConfig = join(outside, 'gitconfig');
+      writeFileSync(
+        userConfig,
+        '[filter "lfs"]\n\tclean = git-lfs clean -- %f\n',
+      );
+      appendFileSync(
+        join(dir, '.git', 'config'),
+        `[include]\n\tpath = ${userConfig}\n`,
+      );
+
+      const screen = localFilterCommands(dir);
+
+      expect(screen.keys).toEqual([]);
+      expect(screen.stopped).toBeNull();
+    } finally {
+      rmSync(outside, { recursive: true, force: true });
+    }
+  });
+
+  it('never reports global keys through a `~` include either', () => {
+    // Same rule through the tilde form: `[include] path = ~/.gitconfig` is the
+    // one-line write a probe can make into the never-wiped common config, and
+    // `sanitizedGitEnv()` keeps HOME so it would expand to the reviewing
+    // user's real config.
+    const home = process.env['HOME'];
+    expect(home).toBeTruthy();
+    writeFileSync(
+      join(home as string, '.gitconfig'),
+      '[filter "lfs"]\n\tclean = git-lfs clean -- %f\n',
+    );
+    appendFileSync(
+      join(dir, '.git', 'config'),
+      '[include]\n\tpath = ~/.gitconfig\n',
+    );
+
+    const screen = localFilterCommands(dir);
+
+    expect(screen.keys).toEqual([]);
+    expect(screen.stopped).toBeNull();
+  });
+
+  it('matches a filter key whose subsection carries an invalid UTF-8 byte', () => {
+    // `--get-regexp` is POSIX matching and locale-sensitive: under a UTF-8
+    // locale a key holding an invalid byte never matches, so git exits 1 and
+    // that reads as the ordinary "no key matched". The checkout resolves
+    // filter keys by exact name, which no locale affects — so the screen would
+    // certify clean over a filter the checkout runs.
+    appendFileSync(
+      join(dir, '.git', 'config'),
+      Buffer.concat([
+        Buffer.from('[filter "'),
+        Buffer.from([0xff]),
+        Buffer.from('"]\n\tsmudge = cat\n'),
+      ]),
+    );
+
+    const screen = localFilterCommands(dir);
+
+    expect(screen.total).toBe(1);
+    expect(screen.keys[0]).toMatch(/^filter\..*\.smudge$/);
+  });
+
+  it('refuses when an admin entry name did not survive the decode', () => {
+    // Entry names are the third attacker-influenced source of candidate bytes,
+    // after the two rev-parse answers. An invalid byte in the name comes back
+    // from `readdirSync` as U+FFFD, `join` re-encodes it, `existsSync` is then
+    // false, and the loop would skip a `config.worktree` that really exists
+    // and really defines a filter — the clean verdict authorising the
+    // checkout that runs it.
+    //
+    // The fixture uses a real U+FFFD in the name rather than an invalid byte:
+    // it is what the guard actually tests for, and unlike an invalid byte it
+    // can be created on every platform (macOS rejects those with EILSEQ).
+    mkdirSync(join(dir, '.git', 'worktrees', 'w\uFFFDx'), { recursive: true });
+
+    const screen = localFilterCommands(dir);
+
+    expect(screen.stopped).toBe('unreadable');
+    expect(screen.unreadable).toBe(join(dir, '.git', 'worktrees'));
+  });
+
+  it('treats a transcoded rev-parse answer as unmeasured', () => {
+    // `encoding: 'utf8'` turns an invalid byte in the repository path into
+    // U+FFFD, so every candidate built from the answer names a file that does
+    // not exist, the admin readdir hits ENOENT — the branch treated as the
+    // ordinary "no linked worktrees" case — and the screen would answer clean
+    // over whatever the real path holds. Unmeasured is not clean; the residue
+    // walker in this file fails the same shape closed.
+    //
+    // Pinned at this level deliberately. The end-to-end fixture cannot be
+    // built from Node: a path carrying an invalid byte does not survive
+    // `Buffer`→`string`, and `cwd` accepts only a string, so the repository
+    // cannot be created and then addressed from a test. (Attempting it is how
+    // this test got written the first time — the round-trip re-encoded 0xFF as
+    // 0xC3 0xBF and git failed with ENOENT on a path that did not exist.)
+    expect(carriesReplacementChar('/tmp/plain/path')).toBe(false);
+    expect(carriesReplacementChar('')).toBe(false);
+    expect(carriesReplacementChar('/tmp/n\uFFFDd/repo')).toBe(true);
+    expect(carriesReplacementChar('\uFFFD')).toBe(true);
+  });
+
+  // POSIX-only: `mkfifo` does not exist on Windows. The bound it pins is
+  // platform-independent; only this way of provoking a block is not.
+  it.skipIf(process.platform === 'win32')(
+    'refuses rather than hanging when an include names a FIFO',
+    () => {
+      // git follows includes at startup, so the very first `rev-parse` blocks on
+      // a FIFO nobody writes to — and `spawnSync` blocks the event loop, so no
+      // JS timer can interrupt it. The bound has to be on the spawn, and a
+      // killed discovery must not read as "not a usable repository".
+      const fifo = join(dir, '.git', 'evil.fifo');
+      execFileSync('mkfifo', [fifo]);
+      appendFileSync(
+        join(dir, '.git', 'config'),
+        `[include]\n\tpath = ${fifo}\n`,
+      );
+
+      const started = Date.now();
+      const screen = localFilterCommands(dir);
+      const elapsed = Date.now() - started;
+
+      expect(screen.stopped).toBe('unreadable');
+      // One spawn timeout, not two. A null `commonDir` already decides the
+      // refusal above, so re-running discovery for `gitDir` only doubles the
+      // synchronous block: 40s measured, most of vitest's fixed 60s worker RPC
+      // budget, which on the Linux lane exits an all-green suite red.
+      expect(elapsed).toBeLessThan(30_000);
+    },
+    60_000,
+  );
+
+  it('caps the reported keys and keeps the pre-cap total', () => {
+    // The keys come from an attacker-writable file that cleanup never wipes;
+    // an unbounded list is its own denial-of-service in the refusal message.
+    let cfg = '';
+    for (let i = 0; i < MAX_SCREEN_KEYS + 5; i++) {
+      cfg += `[filter "evil${i}"]\n\tsmudge = cat\n`;
+    }
+    appendFileSync(join(dir, '.git', 'config'), cfg);
+
+    const screen = localFilterCommands(dir);
+
+    expect(screen.keys).toHaveLength(MAX_SCREEN_KEYS);
+    expect(screen.total).toBe(MAX_SCREEN_KEYS + 5);
+    // Still names a real planted key — a cap that reported none would be a
+    // refusal nobody can act on.
+    expect(screen.keys[0]).toMatch(/^filter\.evil\d+\.smudge$/);
+  });
+
+  // POSIX-only: the shim is a `#!/bin/sh` script found through `which`, and
+  // neither works on Windows. The ORDER it pins is platform-independent, so
+  // skipping there loses the witness, not the behaviour.
+  it.skipIf(process.platform === 'win32')(
+    'reads `<common>/config` LAST, after the amplifiable admin set',
+    () => {
+      // Order is load-bearing, not cosmetic. The checkout this screen authorises
+      // reads merged config at its start, so the gap between the screen's read
+      // of a file and that checkout is a window a plant can land in. The
+      // admin-dir set is attacker-amplifiable — filler entries cost spawns and
+      // stretch the walk — so reading the common config first would put the
+      // likeliest plant target at the START of a window the plant itself can
+      // widen. Pinned through a `git` shim on PATH, which is deterministic;
+      // racing it would not be.
+      const shimDir = mkdtempSync(join(tmpdir(), 'qwen-shim-'));
+      const log = join(shimDir, 'calls.log');
+      const realGit = execFileSync('which', ['git'], {
+        encoding: 'utf8',
+      }).trim();
+      writeFileSync(
+        join(shimDir, 'git'),
+        `#!/bin/sh\nprintf '%s\\n' "$*" >> ${log}\nexec ${realGit} "$@"\n`,
+      );
+      chmodSync(join(shimDir, 'git'), 0o755);
+      for (const e of ['w1', 'w2']) {
+        mkdirSync(join(dir, '.git', 'worktrees', e), { recursive: true });
+        writeFileSync(join(dir, '.git', 'worktrees', e, 'config.worktree'), '');
+      }
+      writeFileSync(join(dir, '.git', 'config.worktree'), '');
+      const savedPath = process.env['PATH'];
+      try {
+        process.env['PATH'] = `${shimDir}:${savedPath ?? ''}`;
+
+        localFilterCommands(dir);
+
+        const reads = readFileSync(log, 'utf8')
+          .split('\n')
+          .filter((l) => l.includes('--file'))
+          .map((l) => l.split(' --file ')[1]?.split(' ')[0] ?? '');
+        const own = join(dir, '.git', 'config.worktree');
+        const commonCfg = join(dir, '.git', 'config');
+        // The file the checkout honours is dead last...
+        expect(reads[reads.length - 1]).toBe(own);
+        // ...with the common config immediately before it, and the paddable
+        // admin entries before both.
+        expect(reads[reads.length - 2]).toBe(commonCfg);
+        expect(
+          reads.indexOf(join(dir, '.git', 'worktrees', 'w1', 'config.worktree')),
+        ).toBeLessThan(reads.indexOf(commonCfg));
+      } finally {
+        process.env['PATH'] = savedPath;
+        rmSync(shimDir, { recursive: true, force: true });
+      }
+    },
+  );
+
+  // POSIX-only, same shim mechanism as the sibling above.
+  it.skipIf(process.platform === 'win32')(
+    'reads a CROSS-tree checkout target last, not the screened tree\'s own',
+    () => {
+      // `scratch-tree` screens the review worktree while authorising a
+      // checkout in the scratch tree. The producer cannot tell which admin
+      // entry that is, so the caller names it — and it, not the screened
+      // tree's own config, is what has to be read last.
+      const shimDir = mkdtempSync(join(tmpdir(), 'qwen-xshim-'));
+      const log = join(shimDir, 'calls.log');
+      const realGit = execFileSync('which', ['git'], {
+        encoding: 'utf8',
+      }).trim();
+      writeFileSync(
+        join(shimDir, 'git'),
+        `#!/bin/sh\nprintf '%s\\n' "$*" >> ${log}\nexec ${realGit} "$@"\n`,
+      );
+      chmodSync(join(shimDir, 'git'), 0o755);
+      for (const e of ['other', 'scratchy']) {
+        mkdirSync(join(dir, '.git', 'worktrees', e), { recursive: true });
+        writeFileSync(join(dir, '.git', 'worktrees', e, 'config.worktree'), '');
+      }
+      writeFileSync(join(dir, '.git', 'config.worktree'), '');
+      const savedPath = process.env['PATH'];
+      try {
+        process.env['PATH'] = `${shimDir}:${savedPath ?? ''}`;
+
+        localFilterCommands(dir, join(dirname(dir), 'scratchy'));
+
+        const reads = readFileSync(log, 'utf8')
+          .split('\n')
+          .filter((l) => l.includes('--file'))
+          .map((l) => l.split(' --file ')[1]?.split(' ')[0] ?? '');
+        expect(reads[reads.length - 1]).toBe(
+          join(dir, '.git', 'worktrees', 'scratchy', 'config.worktree'),
+        );
+        // The screened tree's own config is no longer the last read.
+        expect(reads).not.toContain(join(dir, '.git', 'config.worktree'));
+      } finally {
+        process.env['PATH'] = savedPath;
+        rmSync(shimDir, { recursive: true, force: true });
+      }
+    },
+  );
+
+  it("refuses past the candidate cap instead of walking a plant's filler", () => {
+    // Each entry costs one synchronous `git config` spawn, on every screen
+    // call — once per mutant. Skipping past the bound would let filler hide a
+    // real filter behind it, so the screen refuses.
+    for (let i = 0; i <= MAX_SCREEN_CANDIDATES; i++) {
+      mkdirSync(join(dir, '.git', 'worktrees', `filler-${i}`), {
+        recursive: true,
+      });
+    }
+
+    const screen = localFilterCommands(dir);
+
+    expect(screen.unreadable).toBe(join(dir, '.git', 'worktrees'));
+    expect(screen.keys).toEqual([]);
+    // Read fine, just too many — a different remedy from an unreadable file.
+    expect(screen.stopped).toBe('over-cap');
+  });
+
+  // POSIX DAC bits only: Windows does not restrict listing through chmod, and
+  // root bypasses the mode entirely — the fixture would be red on both rather
+  // than pinning anything. Same guard as the other permission-bit fixture in
+  // this file.
+  it.skipIf(process.platform === 'win32' || process.getuid?.() === 0)(
+    'refuses when the worktrees admin dir cannot be read',
+    () => {
+      // git opens each `worktrees/<e>/config.worktree` by direct path — the
+      // search bit alone suffices — so a readdir that fails with EACCES means
+      // the screen never saw candidates git will still honour. Swallowing that
+      // as "no linked worktrees" answers clean on a config it did not read.
+      const admin = join(dir, '.git', 'worktrees');
+      mkdirSync(admin, { recursive: true });
+      chmodSync(admin, 0o111);
+
+      const screen = localFilterCommands(dir);
+
+      expect(screen.unreadable).toBe(admin);
+      // The two refusal causes must stay distinguishable: this one is a file
+      // to fix, the over-cap one is a directory to prune.
+      expect(screen.stopped).toBe('unreadable');
+    },
+  );
+
+  it('names a key whose subsection carries whitespace, intact', () => {
+    // A config subsection name may legally hold spaces, and `--get-regexp`
+    // prints `key value` on one line — so splitting on whitespace named
+    // `filter.evil` for a planted `filter.evil name.smudge`. The refusal then
+    // prescribed an unset that exits 5 while the plant stood, and two distinct
+    // keys sharing a truncated prefix collapsed into one, understating `total`.
+    execFileSync('git', ['config', 'filter.evil name.smudge', 'CMD'], {
+      cwd: dir,
+    });
+    execFileSync('git', ['config', 'filter.evil other.smudge', 'CMD2'], {
+      cwd: dir,
+    });
+
+    const screen = localFilterCommands(dir);
+
+    expect(screen.keys.sort()).toEqual([
+      'filter.evil name.smudge',
+      'filter.evil other.smudge',
+    ]);
+    expect(screen.total).toBe(2);
+  });
+
+  it('sees a filter through a repo path that carries a newline', () => {
+    // The screened trees are linked worktrees inheriting the user's repo path.
+    // A combined `rev-parse --git-common-dir --git-dir` answer splits into four
+    // records under such a path instead of two, every candidate resolves to
+    // nothing, the admin readdir hits ENOENT — the branch treated as ordinary —
+    // and the screen answers clean over a live plant.
+    const base = mkdtempSync(join(tmpdir(), 'qwen-nl-'));
+    try {
+      const holder = join(base, 'nl\ndir');
+      mkdirSync(holder, { recursive: true });
+      const main = join(holder, 'main');
+      mkdirSync(main);
+      initRepo(main);
+      writeFileSync(join(main, 'a.ts'), 'x\n');
+      execFileSync('git', ['add', '-A'], { cwd: main });
+      execFileSync(
+        'git',
+        ['-c', 'user.email=t@t.t', '-c', 'user.name=t', 'commit', '-qm', 'i'],
+        { cwd: main },
+      );
+      execFileSync('git', ['config', 'filter.evil.smudge', 'cat'], {
+        cwd: main,
+      });
+      const linked = join(holder, 'wt');
+      execFileSync(
+        'git',
+        ['worktree', 'add', '-q', '--detach', linked, 'HEAD'],
+        { cwd: main },
+      );
+
+      const screen = localFilterCommands(linked);
+
+      expect(screen.keys).toEqual(['filter.evil.smudge']);
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
+  it('stays clean on a repo with no linked worktrees at all', () => {
+    // ENOENT on the admin dir is the ordinary case and must NOT refuse.
+    expect(existsSync(join(dir, '.git', 'worktrees'))).toBe(false);
+
+    const screen = localFilterCommands(dir);
+
+    expect(screen).toEqual({
+      keys: [],
+      total: 0,
+      unreadable: null,
+      stopped: null,
+    });
+  });
+
+  it('refuses a candidate git cannot parse', () => {
+    // Opens fine, and git then dies on it with exit 128 — not the exit 1 that
+    // means "no key matched".
+    writeFileSync(
+      join(dir, '.git', 'config.worktree'),
+      '[filter "evil"\n\tsmudge = cat\n',
+    );
+
+    const screen = localFilterCommands(dir);
+
+    expect(screen.unreadable).toBe(join(dir, '.git', 'config.worktree'));
+  });
+
+  it('does NOT see a filter one include-hop away — a declared limit', () => {
+    // `git config --file` does not expand includes and this screen does not
+    // walk them either, so a filter behind an include is invisible here while
+    // the checkout, reading merged config, would run it. That gap is real and
+    // deliberate: both ways of closing it were tried and both were worse (the
+    // spawn's comment records why), and #10441 carries the design that closes
+    // it properly. This test exists so the limit is visible rather than
+    // assumed — if a later change starts following includes, it goes red and
+    // whoever wrote it has to decide deliberately.
+    writeFileSync(
+      join(dir, '.git', 'evil.inc'),
+      '[filter "evil"]\n\tsmudge = cat\n',
+    );
+    appendFileSync(
+      join(dir, '.git', 'config'),
+      '[include]\n\tpath = evil.inc\n',
+    );
+
+    const screen = localFilterCommands(dir);
+
+    expect(screen.keys).toEqual([]);
+    expect(screen.stopped).toBeNull();
+  });
+});
+
+describe('screenStopDetail', () => {
+  // The two refusal causes call for OPPOSITE remedies, so they must not share a
+  // sentence — an unreadable candidate is a file to fix or remove, while an
+  // over-cap admin directory was read perfectly well and "remove that file"
+  // there would deregister every legitimate linked worktree. Each arm is pinned
+  // directly: the producer's classification is tested elsewhere, but the
+  // rendered remedy a reader acts on is only here.
+  it('names the prune remedy for an over-cap directory, not a file to remove', () => {
+    const detail = screenStopDetail({
+      keys: [],
+      total: 0,
+      unreadable: '/repo/.git/worktrees',
+      stopped: 'over-cap',
+    });
+
+    expect(detail).toContain('git worktree prune');
+    expect(detail).toContain('registered under');
+    expect(detail).toContain(String(MAX_SCREEN_CANDIDATES));
+    expect(detail).toContain('/repo/.git/worktrees');
+    // Must NOT tell the reader the directory could not be read — it was.
+    expect(detail).not.toContain('could not be read to the end');
+  });
+
+  it('names the unreadable file plainly, without the prune remedy', () => {
+    const detail = screenStopDetail({
+      keys: [],
+      total: 0,
+      unreadable: '/repo/.git/config.worktree',
+      stopped: 'unreadable',
+    });
+
+    expect(detail).toContain('/repo/.git/config.worktree');
+    expect(detail).toContain('could not be read to the end');
+    expect(detail).not.toContain('git worktree prune');
+  });
+});
diff --git a/packages/cli/src/commands/review/lib/worktree.ts b/packages/cli/src/commands/review/lib/worktree.ts
index 13a122da70f..245b7a19b11 100644
--- a/packages/cli/src/commands/review/lib/worktree.ts
+++ b/packages/cli/src/commands/review/lib/worktree.ts
@@ -18,6 +18,8 @@
 
 import { spawnSync } from 'node:child_process';
 import {
+  accessSync,
+  constants as fsConstants,
   existsSync,
   lstatSync,
   mkdtempSync,
@@ -34,6 +36,7 @@ import {
 } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute, join, resolve, sep } from 'node:path';
+import { inertPath } from './paths.js';
 import { readWorkspacePackages } from './workspaces.js';
 
 export type SweepResult = ReturnType<typeof spawnSync>;
@@ -578,6 +581,467 @@ function trackedIgnoreSources(
  */
 export const RESIDUE_PATH_CAP = 12;
 
+/**
+ * Caps for the config screen, which reads attacker-writable files.
+ *
+ * `MAX_SCREEN_KEYS` bounds what a refusal REPORTS — the message names the
+ * first keys and the caller says how many more; an unbounded join is its own
+ * denial-of-service, the same rule the `unreadable` field follows by naming
+ * one file rather than a list. `MAX_SCREEN_CANDIDATES` bounds what the screen
+ * READS: one synchronous spawn per registered worktree, on a directory a
+ * probe can fill. Both fail closed — past the candidate bound the screen
+ * refuses, because skipping would let filler entries hide a real filter.
+ */
+export const MAX_SCREEN_KEYS = RESIDUE_PATH_CAP;
+export const MAX_SCREEN_CANDIDATES = 256;
+
+/**
+ * The repo-local `filter.<name>` COMMANDS, when any are defined.
+ *
+ * A checkout EXECUTES these whenever it rewrites a file, and disabling hooks
+ * does not cover filters — they are separate config. The callers that screen
+ * through this function are the scratch tree's reset and rebuild, the probe
+ * tree's per-run restore, and the probe tree's revert. That list is the set of
+ * SCREENED sites, not a census of the pipeline's filter-executing checkouts:
+ * the `worktree add` spawns that CREATE the probe and base trees run
+ * unscreened today, and hooks are neutralised only at the spawns that pass
+ * `core.hooksPath` explicitly, not pipeline-wide. Do not read this comment as
+ * a completeness map — widening the screen means adding a call site, and the
+ * count above is what has one.
+ *
+ * The planting surface this screen covers is two plain writes a probe can
+ * make into the COMMON dir this command's report calls shared:
+ * `git config filter.evil.smudge CMD` and one line appended to
+ * `$(git rev-parse --git-path info/attributes)`. discard and cleanup never
+ * wipe the common dir, so a filter planted while reviewing one PR fires on
+ * every later matching checkout of the user's OWN repository — persistence
+ * planted by reviewing a malicious PR, measured live. The candidate config
+ * files are read with `--file`, one file at a time, rather than merged config:
+ * filters in the user's global config (git-lfs is the common one) are the
+ * user's own contract, exactly like any git command they run, so global config
+ * stays out of scope.
+ *
+ * TWO limits, both declared rather than discovered. Screening repo-local-only
+ * is a deliberate TRADE, not a claim that repo-local files are all a probe can
+ * reach: probe code runs as the user, so `git config --global` is open to it,
+ * and a filter planted there is read by every checkout here and never seen by
+ * this screen. And a filter reached only through an `include.path` /
+ * `includeIf` directive is not seen either — see the spawn below for why
+ * neither `--includes` nor a hand-walk is the answer, and #10441 for the
+ * design that is.
+ * Refusing on merged config is not the answer — `git lfs install` writes
+ * `filter.lfs.clean` globally, and refusing on that is permanent refusal for
+ * every contributor who has git-lfs. The state cannot be told apart from a
+ * filter the user set deliberately, and cannot be safely wiped, so a hit is a
+ * refusal upstream, not a cleanup here.
+ */
+export interface LocalFilterScreen {
+  /**
+   * The repo-local `filter.<name>` command keys found, capped at
+   * `MAX_SCREEN_KEYS`. `total` says how many there were before the cap, so a
+   * refusal can name what it is not showing instead of silently shortening.
+   */
+  keys: string[];
+  /**
+   * How many matching entries the screen found, against `keys.length` shown.
+   *
+   * Exact while under `MAX_SCREEN_KEYS`; beyond it an upper bound, because
+   * retention stops at the cap and there is nothing left to deduplicate a
+   * later repeat against. Either way it answers the only question a refusal
+   * needs it for: is there more than what is named.
+   */
+  total: number;
+  /**
+   * Why the screen stopped, when it did.
+   *
+   * `unreadable` and `over-cap` both refuse, but they call for opposite
+   * remedies: an unreadable candidate is a file to fix or remove, while an
+   * over-cap admin directory was read perfectly well and holds more
+   * registered worktrees than the bound — "remove that file" there would
+   * deregister every legitimate linked worktree, the pipeline's own included.
+   */
+  stopped: 'unreadable' | 'over-cap' | null;
+  /**
+   * The first candidate file the screen could not read to completion, when one
+   * stopped it — otherwise null.
+   *
+   * Exit 1 is git's ordinary "no key matched" and is not a failure. Anything
+   * else is: a spawn error, a spawn killed at the timeout, a config git could
+   * not parse to the end (a malformed section header exits 128), or an ENOBUFS
+   * from more filter keys than the buffer holds. Skipping such a file reports the
+   * repository clean on the one file that might define the filter, so the caller
+   * refuses instead. One file, not a list: the refusal only has to name where
+   * the screen stopped, and an unbounded join is its own denial-of-service.
+   */
+  unreadable: string | null;
+}
+
+/**
+ * The screened keys, flattened and counted, for a refusal message.
+ *
+ * `keys` arrives already capped by the producer, so this never re-slices; it
+ * reports the shortfall instead. Both halves matter: `inertPath` because a
+ * config subsection name legally carries control and format characters that
+ * `--get-regexp` prints verbatim, and these strings land in the agent-facing
+ * report; the count because a message naming 12 of 13 keys sends a user to
+ * remove the 12 and be refused again on the one it never mentioned.
+ */
+export function screenKeyList(screen: LocalFilterScreen): string {
+  const shown = screen.keys.map(inertPath).join(', ');
+  return screen.total > screen.keys.length
+    ? `${shown} (capped enumeration: ${screen.keys.length} shown of ${screen.total})`
+    : shown;
+}
+
+/**
+ * Why a screen that stopped could not finish, phrased for the reader who has
+ * to act on it.
+ *
+ * The two causes need opposite remedies, so they must not share a sentence:
+ * an unreadable candidate is a file to fix or remove, while an over-cap admin
+ * directory was read perfectly well — telling that reader to "remove that
+ * file" would deregister every legitimate linked worktree they have.
+ */
+export function screenStopDetail(screen: LocalFilterScreen): string {
+  const where = inertPath(screen.unreadable ?? '');
+  return screen.stopped === 'over-cap'
+    ? `more than ${MAX_SCREEN_CANDIDATES} worktrees are registered under ${where} — more than this screen will walk, so it cannot tell whether one of them defines a content filter. Prune stale ones (\`git worktree prune\`) and re-run`
+    : `${where} could not be read to the end`;
+}
+
+/**
+ * A single `git rev-parse <flag>` answer, as a path, or null on any failure.
+ *
+ * One invocation per value, never a combined newline-delimited request: the
+ * answers are arbitrary filesystem paths and a POSIX path may itself carry a
+ * newline, so a combined answer cannot be split unambiguously — a healthy
+ * worktree below a directory whose name holds a newline parses to extra
+ * records, misassigns the paths, and the caller reports a live plant as clean
+ * or a real worktree as not-a-worktree. Measured with exactly such a directory.
+ * The only byte removed is git's terminal record delimiter; every other byte
+ * belongs to the path, so neither a split nor a trim is a parse here. Callers
+ * that need absolute paths pass `--path-format=absolute` as a leading flag.
+ */
+/**
+ * The screen's spawn budget.
+ *
+ * Every read below opens attacker-writable config, and git follows an
+ * `include.path` at startup — so a plant naming a FIFO (or a symlink to
+ * `/dev/zero`) blocks the very first `rev-parse`. `spawnSync` blocks the event
+ * loop, so no JS timer can interrupt it; the bound has to be on the spawn.
+ */
+const SCREEN_SPAWN_TIMEOUT_MS = 20_000;
+
+/**
+ * A rev-parse answer, or null when the screen could not get one.
+ *
+ * `encoding: 'utf8'` transcodes an invalid byte to U+FFFD, so a repository
+ * under a path carrying one yields an answer that names no real file. Callers
+ * must treat that as unmeasured rather than resolve candidates against it —
+ * the residue walker in this file fails the same shape closed for the same
+ * reason.
+ */
+function revParsePath(cwd: string, ...flags: string[]): string | null {
+  const r = spawnSync('git', ['rev-parse', ...flags], {
+    cwd,
+    encoding: 'utf8',
+    timeout: SCREEN_SPAWN_TIMEOUT_MS,
+    killSignal: 'SIGKILL',
+    env: sanitizedGitEnv(),
+  });
+  if (r.error || r.status !== 0 || typeof r.stdout !== 'string') return null;
+  return r.stdout.endsWith('\n') ? r.stdout.slice(0, -1) : r.stdout;
+}
+
+/**
+ * True when a transcode replaced bytes this screen would otherwise resolve.
+ *
+ * Exported for its own test: the end-to-end fixture cannot be built from Node.
+ * A path holding an invalid UTF-8 byte survives neither `Buffer`→`string` nor
+ * the `cwd` option, which takes a string only — so the repository that would
+ * produce such a rev-parse answer cannot be created and then addressed from a
+ * test. The rule this function states is pinned here instead, and its two call
+ * sites are one `if` each.
+ */
+export function carriesReplacementChar(value: string): boolean {
+  return value.includes('\uFFFD');
+}
+
+export function localFilterCommands(
+  worktree: string,
+  /**
+   * The tree the authorised checkout will run in, when that is not `worktree`.
+   *
+   * The screen reads candidates in sequence and the checkout reads merged
+   * config at its start, so each file's window runs from ITS read to the
+   * spawn. The file that decides what the checkout executes therefore has to
+   * be read last. For the restore and the revert that tree is the screened
+   * one, which is the default; `scratch-tree` screens the review worktree
+   * while authorising a checkout in the scratch tree, and only the caller
+   * knows which tree that is.
+   *
+   * Its per-worktree config is looked for at `<common>/worktrees/<basename of
+   * that path>/config.worktree`, which is where `git worktree add` registers
+   * it. If the tree does not exist yet — the rebuild path creates it after
+   * this screen — the file does not exist either and the read is a no-op,
+   * which is the correct answer: there is nothing there to plant in.
+   */
+  checkoutTree?: string,
+): LocalFilterScreen {
+  const commonDir = revParsePath(worktree, '--git-common-dir');
+  // The second discovery spawn is skipped once the first fails. Both read
+  // config at git startup, so a plant that blocks one blocks the other for the
+  // whole `SCREEN_SPAWN_TIMEOUT_MS`, and a null `commonDir` already decides the
+  // refusal below whatever `gitDir` would have answered. Running both anyway
+  // doubled that stall to a measured 40s of blocked event loop — most of
+  // vitest's fixed 60s worker RPC budget, which on the Linux lane (no
+  // unhandled-error exemption) exits an all-green suite red.
+  const gitDir =
+    commonDir === null ? null : revParsePath(worktree, '--git-dir');
+  if (commonDir === null || gitDir === null) {
+    // Two very different reasons land here, and only one is benign. A plain
+    // "not a repository" answer is the caller's own problem — its checkout has
+    // nothing to run in either. But a discovery spawn KILLED at the timeout
+    // above reaches this line too, and that one happens precisely when a plant
+    // has made git block, so it must not read as clean. There is no way to
+    // tell them apart from the outside, so this fails closed: a screen that
+    // could not discover the repository did not screen it.
+    return {
+      keys: [],
+      total: 0,
+      unreadable: worktree,
+      stopped: 'unreadable',
+    };
+  }
+  if (carriesReplacementChar(commonDir) || carriesReplacementChar(gitDir)) {
+    // An invalid byte in the repository path came back as U+FFFD, so every
+    // candidate built from it names a file that does not exist, the admin
+    // readdir hits ENOENT — "the ordinary case" — and the screen would answer
+    // clean over whatever the real path holds. Unmeasured, not clean.
+    return {
+      keys: [],
+      total: 0,
+      unreadable: worktree,
+      stopped: 'unreadable',
+    };
+  }
+  const common = resolve(worktree, commonDir);
+  // `<common>/config` is read LAST, and the order is load-bearing. The
+  // checkout this screen authorises reads merged config at its own start, so
+  // everything between the screen's read of a file and that checkout is a
+  // window in which a plant can land in it. The admin-dir set below is
+  // attacker-AMPLIFIABLE — up to MAX_SCREEN_CANDIDATES one-byte filler
+  // entries, each costing spawns — so reading the common config first put the
+  // most likely plant target at the START of a walk the plant itself can
+  // stretch to seconds. Measured: 256 fillers stretched the walk to ~9 s, and
+  // a blind planter won. Reading it last leaves only the walk's own tail
+  // between it and the checkout. This does not close the window — nothing
+  // here can, since a checkout either reads merged config or does not run —
+  // it removes the amplification.
+  // The checkout tree's own per-worktree config, held back to the very end.
+  const ownAdminConfig =
+    checkoutTree === undefined || resolve(checkoutTree) === resolve(worktree)
+      ? join(resolve(worktree, gitDir), 'config.worktree')
+      : join(
+          common,
+          'worktrees',
+          basename(resolve(checkoutTree)),
+          'config.worktree',
+        );
+  const candidates: string[] = [];
+  // Every OTHER worktree's per-worktree config too. This screen runs against
+  // the review worktree, but the checkout it authorises runs in the SCRATCH
+  // tree, whose own `<common>/worktrees/<label>/config.worktree` is honored
+  // once `extensions.worktreeConfig` is on and was never read here — a filter
+  // planted there executed during the reset while this function reported the
+  // repository clean. The admin directory is one `readdir`, and a filter in
+  // any of these is a plant whichever tree carries it.
+  //
+  // Bounded, and fail closed over the bound. Each entry costs one synchronous
+  // `git config` spawn below, and the admin directory is the same never-wiped
+  // surface the filter itself is planted in: M empty `worktrees/<e>/` dirs are
+  // M spawns on EVERY screen call, which is once per mutant. A healthy repo
+  // carries O(shards) entries. Past the cap the screen has not read what it
+  // was asked to read, so it refuses rather than walking a plant's filler —
+  // and refusing beats skipping, which would let filler hide a real filter.
+  let worktreeEntries: string[] | null = null;
+  try {
+    worktreeEntries = readdirSync(join(common, 'worktrees'));
+  } catch (e) {
+    // ENOENT is the ordinary "no linked worktrees registered" — the two
+    // candidates above are all of it. Anything else is a directory this
+    // screen could NOT walk while git still opens each `config.worktree` by
+    // direct path (the search bit alone suffices), so a swallowed EACCES
+    // would answer clean on candidates that were never read. Refuse instead:
+    // this is the directory-level twin of the per-file readability gate below.
+    if ((e as NodeJS.ErrnoException)?.code !== 'ENOENT') {
+      return {
+        keys: [],
+        total: 0,
+        unreadable: join(common, 'worktrees'),
+        stopped: 'unreadable',
+      };
+    }
+  }
+  if (worktreeEntries && worktreeEntries.length > MAX_SCREEN_CANDIDATES) {
+    return {
+      keys: [],
+      total: 0,
+      unreadable: join(common, 'worktrees'),
+      stopped: 'over-cap',
+    };
+  }
+  for (const entry of worktreeEntries ?? []) {
+    // The checkout tree's own config comes last, below — not here, in the
+    // middle of a set an attacker can pad.
+    // Entry names are the THIRD attacker-influenced source of candidate bytes,
+    // after the two rev-parse answers. `readdirSync` transcodes an invalid
+    // byte to U+FFFD, `join` re-encodes it as EF BF BD, `existsSync` is then
+    // false and the loop would skip a `config.worktree` that really exists and
+    // really defines a filter — the clean verdict authorising the checkout
+    // that runs it. The sibling hazards on this same directory (EACCES, and
+    // U+FFFD in the rev-parse answers) both refuse; so does this.
+    if (carriesReplacementChar(entry)) {
+      return {
+        keys: [],
+        total: 0,
+        unreadable: join(common, 'worktrees'),
+        stopped: 'unreadable',
+      };
+    }
+    const candidate = join(common, 'worktrees', entry, 'config.worktree');
+    if (candidate !== ownAdminConfig) candidates.push(candidate);
+  }
+  // Then the common config, then — dead last — the file the authorised
+  // checkout will actually honour. Order is the whole mitigation here: the
+  // admin set above is attacker-paddable, so anything read before it carries a
+  // window the plant itself can widen.
+  candidates.push(join(common, 'config'));
+  candidates.push(ownAdminConfig);
+  // Retention is bounded at INSERTION, not at the report. The caps below limit
+  // how many keys are NAMED and how many files are read, but the Set itself
+  // would hold every distinct key an attacker wrote — bounded only by the
+  // product of the caps, on exactly the input this screen exists to survive.
+  // Tens of thousands of keys per file across the admin set is a gibibyte of
+  // key text held live to report twelve of them, once per mutant. Past the cap
+  // only the count matters, so only the count is kept.
+  const found = new Set<string>();
+  let total = 0;
+  let unreadable: string | null = null;
+  for (const file of candidates) {
+    if (!existsSync(file)) continue;
+    // Existence is not readability, and git does not distinguish them for us:
+    // an unreadable `--file` exits 1 with a warning on stderr — byte-identical
+    // in status to "no key matched" — so asking git and reading the exit code
+    // reports a config this screen never read as clean. Settle it here instead,
+    // by construction: a regular file (git follows symlinks to read config, so
+    // this must too) that this process can open. Anything else is a candidate
+    // the screen could not check, which is a refusal, not a pass.
+    let readable = false;
+    try {
+      readable = statSync(file).isFile();
+      if (readable) accessSync(file, fsConstants.R_OK);
+    } catch {
+      readable = false;
+    }
+    if (!readable) {
+      unreadable ??= file;
+      continue;
+    }
+    const r = spawnSync(
+      'git',
+      [
+        'config',
+        '--file',
+        file,
+        // NO `--includes`, and no hand-walk of the include graph either —
+        // this screen does not follow includes at all, and that is a declared
+        // limit rather than an oversight. Both alternatives were tried and
+        // both were worse. `--includes` makes git EVALUATE `includeIf` in
+        // THIS process's context while the checkout runs in another tree, so a
+        // condition false here and true there hides a filter the checkout then
+        // executes; it also follows an edge out of the repository, dragging
+        // the user's own `filter.lfs.*` into a repo-local screen and refusing
+        // every later review. Walking the graph by hand instead means
+        // re-implementing git's own path resolution — `%(prefix)`, `~//`,
+        // `~user`, symlinked components, non-UTF-8 targets — and eleven
+        // divergences from git were measured across five review rounds, each
+        // one a silent skip. The condition problem survives both: no single
+        // context matches a cross-tree checkout.
+        //
+        // So a filter reached only through an include is NOT screened here.
+        // Issue #9558 scopes it out in as many words ("`include.path` /
+        // `includeIf` ... are each handled separately today"), and #10441
+        // carries the design that closes it — resolving each hit's origin the
+        // way git resolves it, which is a different change with its own tests.
+        // BEFORE the pattern: `--name-only` after it silently prints nothing
+        // and exits 1 even with live keys. With it, each line is the whole key
+        // and nothing has to be parsed out of a `key value` pair — a config
+        // subsection name may legally carry whitespace, and splitting on it
+        // named `filter.evil` for a planted `filter.evil name.smudge`, so the
+        // refusal prescribed an unset that exits 5 while the plant stood. Key
+        // names cannot contain newlines, so line-per-key is unambiguous.
+        '--name-only',
+        '--get-regexp',
+        // `process` beside the pair: it is the third executable key (a
+        // long-running filter git speaks a protocol to), and enumerating two
+        // of three is how the first cut of this screen read as complete.
+        '^filter\\..*\\.(smudge|clean|process)$',
+      ],
+      {
+        cwd: worktree,
+        encoding: 'utf8',
+        // No raised `maxBuffer`: `--name-only` prints one KEY per matching line
+        // and never the value, so a padded `smudge` value cannot reach stdout —
+        // output is bounded by key count, not by an attacker-chosen length. A
+        // config carrying more keys than the default holds sets `r.error`
+        // (ENOBUFS), which the gate below turns into a refusal.
+        timeout: SCREEN_SPAWN_TIMEOUT_MS,
+        killSignal: 'SIGKILL',
+        // Byte-wise regex semantics. `--get-regexp` is POSIX matching and is
+        // locale-sensitive: under a UTF-8 locale a key whose subsection name
+        // carries an invalid byte never matches, so git exits 1 and the gate
+        // below reads that as the ordinary clean answer — while the checkout
+        // resolves filter keys by exact name, which no locale affects. The
+        // screen would certify clean over a filter the checkout runs.
+        env: { ...sanitizedGitEnv(), LC_ALL: 'C' },
+      },
+    );
+    // Exit 1 is "no key matched" — the ordinary clean answer. Every other
+    // outcome means this file was not read to the end, and a screen that did
+    // not finish must not be the reason a checkout is authorised.
+    if (r.error || (r.status !== 0 && r.status !== 1)) {
+      unreadable ??= file;
+      continue;
+    }
+    if (r.status === 1 || typeof r.stdout !== 'string') continue;
+    for (const line of r.stdout.split('\n')) {
+      const key = line;
+      // A Set, not `Array.includes`: the key names here are attacker-written and
+      // as many as the 1 MiB output holds, so a linear membership test per line
+      // is quadratic on exactly the input this screen exists to survive.
+      // (Measured: 100k keys took 144 s as an array scan and 53 ms as a Set.)
+      if (!key) continue;
+      // Deduplicated only within the cap — past it there is nothing left to
+      // deduplicate against, which is the whole point of not retaining it. So
+      // `total` counts matching entries, exact while under the cap and an
+      // upper bound beyond it; `keys` stays distinct. A refusal saying "12
+      // shown of 40" is honest either way: there is more than it is naming.
+      if (found.size < MAX_SCREEN_KEYS) {
+        if (found.has(key)) continue;
+        found.add(key);
+      }
+      total += 1;
+    }
+  }
+  return {
+    keys: [...found],
+    total,
+    unreadable,
+    stopped: unreadable === null ? null : 'unreadable',
+  };
+}
+
 /**
  * The paths a tree carries that its HEAD commit does not — probe residue, seen
  * from the reading side (#9207).
@@ -700,25 +1164,14 @@ export function worktreeResidue(
   // add`, a cleanup whose `rmSync` failed — `status` exits 0 against the
   // enclosing user checkout: the wrong tree's dirty state answered as this
   // one's. Fail closed the way a loud git failure below does.
-  // One invocation per value: the answers are three arbitrary filesystem
-  // paths, and a POSIX name may carry a newline, so no combined
-  // newline-delimited answer can be split unambiguously — a healthy
-  // worktree below a directory whose name holds one parses to extra
-  // records, misassigns gitDir/commondir, and reports the checkout as not
-  // a worktree. Measured with exactly such a directory.
-  const discover = (flag: string): string | null => {
-    const r = spawnSync('git', ['rev-parse', '--path-format=absolute', flag], {
-      cwd,
-      encoding: 'utf8',
-      env: sanitizedGitEnv(),
-    });
-    if (r.error || r.status !== 0 || typeof r.stdout !== 'string') {
-      return null;
-    }
-    // Remove only git's terminal record delimiter: every other byte
-    // belongs to the path, so neither a split nor a trim is a parse here.
-    return r.stdout.endsWith('\n') ? r.stdout.slice(0, -1) : r.stdout;
-  };
+  // One invocation per value (see `revParsePath`): the answers are three
+  // arbitrary filesystem paths, a POSIX name may carry a newline, so no combined
+  // newline-delimited answer can be split unambiguously — a healthy worktree
+  // below a directory whose name holds one parses to extra records, misassigns
+  // gitDir/commondir, and reports the checkout as not a worktree. These need
+  // absolute paths, so they pass `--path-format=absolute`.
+  const discover = (flag: string): string | null =>
+    revParsePath(cwd, '--path-format=absolute', flag);
   const toplevel = discover('--show-toplevel');
   const gitDir = discover('--git-dir');
   const commonDir = discover('--git-common-dir');
diff --git a/packages/cli/src/commands/review/scratch-tree.test.ts b/packages/cli/src/commands/review/scratch-tree.test.ts
index 3c9f8b0e46b..5eb741bf7e3 100644
--- a/packages/cli/src/commands/review/scratch-tree.test.ts
+++ b/packages/cli/src/commands/review/scratch-tree.test.ts
@@ -33,6 +33,7 @@ import {
   symlinkSync,
   writeFileSync,
 } from 'node:fs';
+import { MAX_SCREEN_KEYS } from './lib/worktree.js';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 import yargs, { type Argv } from 'yargs';
@@ -113,12 +114,41 @@ describe('runScratchTree', () => {
       existsSync(scratchWorktreePath(worktree, 'verify--round-1--abc123')),
     ).toBe(false);
 
+    // `process` is the third executable key — a long-running filter git speaks
+    // a protocol to — and enumerating `smudge`/`clean` and stopping is how the
+    // first cut of this screen read as complete.
+    git(worktree, 'config', '--unset', 'filter.evil.smudge');
+    git(worktree, 'config', 'filter.evil.process', `touch ${pwned}`);
+    const viaProcess = run();
+    expect(viaProcess.available).toBe(false);
+    expect(viaProcess.note).toContain('filter.evil.process');
+    expect(existsSync(pwned)).toBe(false);
+
     // A repo WITHOUT the filter still gets a tree (the global-config filters
     // a user's own git-lfs install carries are not this surface).
-    git(worktree, 'config', '--unset', 'filter.evil.smudge');
+    git(worktree, 'config', '--unset', 'filter.evil.process');
     expect(run().available).toBe(true);
   });
 
+  it('tells the user how many filter keys it did NOT name', () => {
+    // The cap keeps an attacker-written key list out of the refusal string;
+    // the count keeps the refusal actionable. Naming 12 of 13 sends a user to
+    // remove the 12 and be refused again on the one never mentioned — and the
+    // two refusal surfaces in this pipeline must report the state the same way.
+    for (let i = 0; i < MAX_SCREEN_KEYS + 1; i++) {
+      git(worktree, 'config', `filter.evil${i}.smudge`, 'cat');
+    }
+    writeFileSync(join(worktree, 'a.ts'), 'dirty\n');
+
+    const r = run();
+
+    expect(r.available).toBe(false);
+    expect(r.note).toContain('capped enumeration');
+    expect(r.note).toContain(
+      `${MAX_SCREEN_KEYS} shown of ${MAX_SCREEN_KEYS + 1}`,
+    );
+  });
+
   it("screens ANOTHER worktree's per-worktree config, not just this one's", () => {
     // The screen runs against the review worktree, but the checkout it
     // authorises runs in the SCRATCH tree — whose own
@@ -155,6 +185,28 @@ describe('runScratchTree', () => {
     expect(r.note).toContain('filter.planted.smudge');
   });
 
+  it('refuses when the screen STOPPED before finishing — not only when it found a key', () => {
+    // `runScratchTree` gates on `filters.stopped`, a branch distinct from the
+    // "found a filter key" one: a screen that could not read a candidate to the
+    // end is not a clean result, because the checkouts below would execute any
+    // filter it failed to see. Here the review worktree's own `config.worktree`
+    // candidate is a directory — a candidate the screen cannot read — so the
+    // screen stops and the command refuses before creating or resetting a tree.
+    const gitDir = execFileSync('git', ['rev-parse', '--absolute-git-dir'], {
+      cwd: worktree,
+      encoding: 'utf8',
+    }).trim();
+    mkdirSync(join(gitDir, 'config.worktree'));
+
+    const r = run();
+
+    expect(r.available).toBe(false);
+    expect(r.note).toContain('the screen could not clear this repository');
+    expect(
+      existsSync(scratchWorktreePath(worktree, 'verify--round-1--abc123')),
+    ).toBe(false);
+  });
+
   it('places it BESIDE the review worktree, never inside it', () => {
     // Nested, every probe file would land in the tree this command exists to
     // keep clean — and in the PR's own diff with it.
diff --git a/packages/cli/src/commands/review/scratch-tree.ts b/packages/cli/src/commands/review/scratch-tree.ts
index ba9f53037ae..65b2fd2f20f 100644
--- a/packages/cli/src/commands/review/scratch-tree.ts
+++ b/packages/cli/src/commands/review/scratch-tree.ts
@@ -42,7 +42,6 @@ import {
   lstatSync,
   mkdirSync,
   readFileSync,
-  readdirSync,
   realpathSync,
   writeFileSync,
 } from 'node:fs';
@@ -59,8 +58,11 @@ import {
   RESIDUE_PATH_CAP,
   discardWorktree,
   exposeDependencies,
+  localFilterCommands,
   redirectedAncestor,
   sanitizedGitEnv,
+  screenKeyList,
+  screenStopDetail,
   worktreeCreateFailureDetail,
   worktreeResidue,
   type DependencyFarm,
@@ -150,76 +152,6 @@ export interface ScratchTreeArgs {
  */
 const NO_HOOKS = ['-c', 'core.hooksPath=/dev/null/no-hooks'];
 
-/**
- * The repo-local `filter.<name>.smudge|clean` commands, when any are defined.
- *
- * The reset's and rebuild's checkouts EXECUTE these — hooks are disabled above,
- * filters are not — and the planting surface is two plain writes a probe can
- * make into the COMMON dir this command's report calls shared:
- * `git config filter.evil.smudge CMD` and one line appended to
- * `$(git rev-parse --git-path info/attributes)`. discard and cleanup never
- * wipe the common dir, so a filter planted while reviewing one PR fires on
- * every later matching checkout of the user's OWN repository — persistence
- * planted by reviewing a malicious PR, measured live. The two local config
- * files are checked with `--file` rather than merged config because filters
- * in the user's global config (git-lfs is the common one) are the user's own
- * contract, exactly like any git command they run — while a probe's planting
- * surface is the repo-local files. The state cannot be told apart from a
- * filter the user set deliberately, and cannot be safely wiped, so a hit is a
- * refusal upstream, not a cleanup here.
- */
-function localFilterCommands(worktree: string): string[] {
-  const files = spawnSync(
-    'git',
-    ['rev-parse', '--git-common-dir', '--git-dir'],
-    { cwd: worktree, encoding: 'utf8', env: sanitizedGitEnv() },
-  );
-  if (files.error || files.status !== 0 || typeof files.stdout !== 'string') {
-    return [];
-  }
-  const [commonDir, gitDir] = files.stdout.trim().split('\n');
-  const common = resolve(worktree, commonDir);
-  const candidates = [
-    join(common, 'config'),
-    join(resolve(worktree, gitDir), 'config.worktree'),
-  ];
-  // Every OTHER worktree's per-worktree config too. This screen runs against
-  // the review worktree, but the checkout it authorises runs in the SCRATCH
-  // tree, whose own `<common>/worktrees/<label>/config.worktree` is honored
-  // once `extensions.worktreeConfig` is on and was never read here — a filter
-  // planted there executed during the reset while this function reported the
-  // repository clean. The admin directory is one `readdir`, and a filter in
-  // any of these is a plant whichever tree carries it.
-  try {
-    for (const entry of readdirSync(join(common, 'worktrees'))) {
-      candidates.push(join(common, 'worktrees', entry, 'config.worktree'));
-    }
-  } catch {
-    // No linked worktrees registered: the two candidates above are all of it.
-  }
-  const found: string[] = [];
-  for (const file of candidates) {
-    if (!existsSync(file)) continue;
-    const r = spawnSync(
-      'git',
-      [
-        'config',
-        '--file',
-        file,
-        '--get-regexp',
-        '^filter\\..*\\.(smudge|clean)$',
-      ],
-      { cwd: worktree, encoding: 'utf8', env: sanitizedGitEnv() },
-    );
-    if (r.error || r.status !== 0 || typeof r.stdout !== 'string') continue;
-    for (const line of r.stdout.split('\n')) {
-      const key = line.split(/\s+/)[0];
-      if (key && !found.includes(key)) found.push(key);
-    }
-  }
-  return found;
-}
-
 function gitOut(cwd: string, ...args: string[]): string {
   // `ls-files -v` prints a line per tracked file and `clean` a line per removal;
   // both pass the default 1 MiB buffer on a large repo, and `spawnSync` answers
@@ -493,12 +425,29 @@ export function runScratchTree(args: ScratchTreeArgs): ScratchTreeReport {
 
   // BEFORE any checkout runs — the reuse path's reset and the rebuild path's
   // `worktree add` both execute configured content filters.
-  const filters = localFilterCommands(worktree);
-  if (filters.length > 0) {
+  //
+  // The screen runs against the REVIEW worktree, but the checkout it
+  // authorises runs in the SCRATCH tree, whose own `config.worktree` is just
+  // another entry in the admin set as far as the screen can tell — read in the
+  // middle of a walk a plant can pad, with the longest window of any candidate
+  // to the spawn that honours it. Only this caller knows which entry that is,
+  // so it says: read that one last.
+  const filters = localFilterCommands(
+    worktree,
+    scratchWorktreePath(worktree, label),
+  );
+  if (filters.stopped) {
+    return unavailable(
+      `the screen could not clear this repository: ${screenStopDetail(filters)}. ` +
+        'A screen that did not finish is not a clean result — the checkouts ' +
+        'below would EXECUTE any content filter it failed to see.',
+    );
+  }
+  if (filters.keys.length > 0) {
     return unavailable(
-      `the repository's local config defines content filter(s) ${filters
-        .map(inertPath)
-        .join(', ')} — ` +
+      `the repository's local config defines content filter(s) ${screenKeyList(
+        filters,
+      )} — ` +
         'the checkouts this command runs would EXECUTE them (hooks are disabled, ' +
         'filters are config-driven), and two plain writes into the common dir are ' +
         'enough to plant both the filter and the attributes that select it. Remove ' +
diff --git a/packages/cli/src/commands/review/test-efficacy.integration.test.ts b/packages/cli/src/commands/review/test-efficacy.integration.test.ts
index 815c156023f..11bb9261e83 100644
--- a/packages/cli/src/commands/review/test-efficacy.integration.test.ts
+++ b/packages/cli/src/commands/review/test-efficacy.integration.test.ts
@@ -16,6 +16,7 @@ import { execFileSync, spawnSync } from 'node:child_process';
 import {
   mkdtempSync,
   mkdirSync,
+  chmodSync,
   writeFileSync,
   readFileSync,
   rmSync,
@@ -1670,6 +1671,270 @@ process.stdout.write(JSON.stringify({
     ]);
   });
 
+  it('refuses the REVERT checkout when the baseline suite planted a filter mid-run', async () => {
+    // The restore is screened once at the top of each run, but what runs
+    // BETWEEN the restore and the revert is the PR's own test code. It can
+    // write two lines into the shared common dir — `filter.evil.smudge` and an
+    // attributes line selecting it — and every later restore then refuses
+    // while the mutation phase's catch deliberately keeps going "so the revert
+    // probe below still runs". With the revert unscreened, that second
+    // checkout rewrites the PR-modified files through the planted smudge and
+    // the command executes on the host, the run looking like a plain
+    // inconclusive. The canary is the assertion; the verdicts are not.
+    const canary = join(repo, 'PWNED-revert-smudge');
+    writeFileSync(
+      vitestScript(),
+      `#!/usr/bin/env node
+import path from 'node:path';
+import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
+const g = (...a) => execFileSync('git', a, { encoding: 'utf8' }).trim();
+// Plant once — on the baseline — the way a probe's own test code would.
+const common = g('rev-parse', '--git-common-dir');
+const stamp = path.join(common, 'PLANTED');
+if (!fs.existsSync(stamp)) {
+  fs.writeFileSync(stamp, '');
+  execFileSync('git', ['config', 'filter.evil.smudge', 'sh -c "pwd >> ${canary}; cat"']);
+  const attrs = g('rev-parse', '--git-path', 'info/attributes');
+  fs.mkdirSync(path.dirname(attrs), { recursive: true });
+  fs.appendFileSync(attrs, '*.ts filter=evil\\n');
+}
+const files = process.argv.slice(2).filter((a) => a.includes('.test.'));
+const results = files.map((f) => ({
+  name: path.resolve(f),
+  assertionResults: [{ status: 'passed' }],
+}));
+process.stdout.write(JSON.stringify({
+  numPassedTests: results.length,
+  numFailedTests: 0,
+  testResults: results,
+}));
+`,
+    );
+    const { wt, base } = scaffoldModifiedPr();
+
+    await runHandler({
+      report: join(repo, 'report.json'),
+      worktree: wt,
+      base,
+      out: join(repo, 'out.json'),
+    });
+
+    // The screen ran before the revert's checkout, so the planted command was
+    // never executed. Without the revert-phase screen this file exists.
+    expect(existsSync(canary)).toBe(false);
+  });
+
+  it('neutralises core.fsmonitor at the REVERT checkout, not only at the restore', async () => {
+    // The filter screen names `filter.*` keys; `core.fsmonitor` is a different
+    // config-driven command surface it does not cover, and git runs it on a
+    // pathspec checkout. The restore already empties it (`-c core.fsmonitor=`);
+    // the revert's `checkout base -- <paths>` used to run bare. A baseline that
+    // plants `core.fsmonitor` into the never-wiped common config would then have
+    // its command fire when the revert rewrites the PR-modified files. The
+    // revert now passes the same neutralisation the restore does, so it never
+    // runs — this file's absence is the assertion.
+    const canary = join(repo, 'PWNED-revert-fsmonitor');
+    writeFileSync(
+      vitestScript(),
+      `#!/usr/bin/env node
+import path from 'node:path';
+import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
+const g = (...a) => execFileSync('git', a, { encoding: 'utf8' }).trim();
+// Plant once — on the baseline — the way a probe's own test code would. No
+// filter and no attributes: fsmonitor is not attribute-gated, so this slips
+// past the filter screen entirely and only the checkout's own -c can stop it.
+const common = g('rev-parse', '--git-common-dir');
+const stamp = path.join(common, 'PLANTED');
+if (!fs.existsSync(stamp)) {
+  fs.writeFileSync(stamp, '');
+  execFileSync('git', ['config', 'core.fsmonitor', 'sh -c "touch ${canary}; :"']);
+}
+const files = process.argv.slice(2).filter((a) => a.includes('.test.'));
+const results = files.map((f) => ({
+  name: path.resolve(f),
+  assertionResults: [{ status: 'passed' }],
+}));
+process.stdout.write(JSON.stringify({
+  numPassedTests: results.length,
+  numFailedTests: 0,
+  testResults: results,
+}));
+`,
+    );
+    const { wt, base } = scaffoldModifiedPr();
+
+    await runHandler({
+      report: join(repo, 'report.json'),
+      worktree: wt,
+      base,
+      out: join(repo, 'out.json'),
+    });
+
+    expect(existsSync(canary)).toBe(false);
+  });
+
+  it('refuses the REVERT when the baseline planted an unparseable config', async () => {
+    // The keys-found branch has a witness; the `stopped` branch did not. A
+    // plant that makes the screen STOP — here an unparseable `config.worktree`
+    // — must refuse the revert just as a found key does, because a screen that
+    // could not finish did not clear anything. The plant lands mid-run, after
+    // the restore's own screen has already passed.
+    const canary = join(repo, 'PWNED-revert-stopped');
+    writeFileSync(
+      vitestScript(),
+      `#!/usr/bin/env node
+import path from 'node:path';
+import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
+const g = (...a) => execFileSync('git', a, { encoding: 'utf8' }).trim();
+const common = g('rev-parse', '--git-common-dir');
+const stamp = path.join(common, 'PLANTED');
+if (!fs.existsSync(stamp)) {
+  fs.writeFileSync(stamp, '');
+  // The filter that would fire, plus the attributes selecting it...
+  execFileSync('git', ['config', 'filter.evil.smudge', 'sh -c "pwd >> ${canary}; cat"']);
+  const attrs = g('rev-parse', '--git-path', 'info/attributes');
+  fs.mkdirSync(path.dirname(attrs), { recursive: true });
+  fs.appendFileSync(attrs, '*.ts filter=evil\\n');
+  // ...and an unparseable candidate, so the screen STOPS before it can
+  // enumerate that filter. A stop must refuse exactly as a key would.
+  const gitDir = g('rev-parse', '--git-dir');
+  fs.writeFileSync(path.join(gitDir, 'config.worktree'), '[filter "x"\\n\\tsmudge = cat\\n');
+}
+const files = process.argv.slice(2).filter((a) => a.includes('.test.'));
+const results = files.map((f) => ({
+  name: path.resolve(f),
+  assertionResults: [{ status: 'passed' }],
+}));
+process.stdout.write(JSON.stringify({
+  numPassedTests: results.length,
+  numFailedTests: 0,
+  testResults: results,
+}));
+`,
+    );
+    const { wt, base } = scaffoldModifiedPr();
+
+    await runHandler({
+      report: join(repo, 'report.json'),
+      worktree: wt,
+      base,
+      out: join(repo, 'out.json'),
+    });
+
+    expect(existsSync(canary)).toBe(false);
+  });
+
+  it('runs no planted post-checkout hook during the revert', async () => {
+    // `CHECKOUT_INERT` carries two neutralisations and only fsmonitor was
+    // pinned. A pathspec checkout DOES fire an executable `post-checkout`
+    // hook, and the hook needs no config of its own — so it is a surface the
+    // filter screen cannot see, closed only by the flag.
+    const canary = join(repo, 'PWNED-post-checkout');
+    writeFileSync(
+      vitestScript(),
+      `#!/usr/bin/env node
+import path from 'node:path';
+import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
+const g = (...a) => execFileSync('git', a, { encoding: 'utf8' }).trim();
+const common = g('rev-parse', '--git-common-dir');
+const stamp = path.join(common, 'PLANTED');
+if (!fs.existsSync(stamp)) {
+  fs.writeFileSync(stamp, '');
+  // The fixture redirects hooks to this directory, so the plant goes there.
+  const hooks = execFileSync('git', ['config', 'core.hooksPath'], { encoding: 'utf8' }).trim();
+  fs.mkdirSync(hooks, { recursive: true });
+  const hook = path.join(hooks, 'post-checkout');
+  fs.writeFileSync(hook, '#!/bin/sh\\necho fired >> ${canary}\\n');
+  fs.chmodSync(hook, 0o755);
+}
+const files = process.argv.slice(2).filter((a) => a.includes('.test.'));
+const results = files.map((f) => ({
+  name: path.resolve(f),
+  assertionResults: [{ status: 'passed' }],
+}));
+process.stdout.write(JSON.stringify({
+  numPassedTests: results.length,
+  numFailedTests: 0,
+  testResults: results,
+}));
+`,
+    );
+    const { wt, base } = scaffoldModifiedPr();
+
+    await runHandler({
+      report: join(repo, 'report.json'),
+      worktree: wt,
+      base,
+      out: join(repo, 'out.json'),
+    });
+
+    expect(existsSync(canary)).toBe(false);
+  });
+
+  // POSIX-only: the relink is driven from a `#!/bin/sh` shim.
+  it.skipIf(process.platform === 'win32')(
+    'refuses the REVERT when the root is swapped after its escape check',
+    async () => {
+      // The revert takes its root verdict above the classification loop and
+      // used to act on it after the loop AND the filter screen — both
+      // attacker-sized. The relink target here is the SHARED review worktree,
+      // which is the scenario that matters: it holds `base`, so without the
+      // re-check `checkout base -- <paths>` SUCCEEDS there and rewrites the
+      // reviewer's PR-modified files back to the merge base.
+      //
+      // Deterministic rather than raced: `cat-file` is unique to the
+      // classification loop, so the shim arms there (with `modified` computed
+      // against the real probe tree) and swaps on the next config read — the
+      // revert's own screen — landing exactly in the window.
+      const shimDir = mkdtempSync(join(tmpdir(), 'qwen-revshim-'));
+      const savedPath = process.env['PATH'];
+      const realGit = execFileSync('which', ['git'], {
+        encoding: 'utf8',
+      }).trim();
+      try {
+        const { wt, base } = scaffoldModifiedPr();
+        const probe = `${wt}-probe`;
+        const prFile = join(wt, 'packages/lib/src/f.ts');
+        const prContent = readFileSync(prFile, 'utf8');
+        writeFileSync(
+          join(shimDir, 'git'),
+          `#!/bin/sh
+case "$*" in
+  *cat-file*) touch ${shimDir}/armed ;;
+  *--file*)
+    if [ -e ${shimDir}/armed ] && [ ! -e ${shimDir}/done ] && [ -d ${probe} ]; then
+      touch ${shimDir}/done
+      mv ${probe} ${probe}.real && ln -s ${wt} ${probe}
+    fi
+    ;;
+esac
+exec ${realGit} "$@"
+`,
+        );
+        chmodSync(join(shimDir, 'git'), 0o755);
+        process.env['PATH'] = `${shimDir}:${savedPath ?? ''}`;
+
+        await runHandler({
+          report: join(repo, 'report.json'),
+          worktree: wt,
+          base,
+          out: join(repo, 'out.json'),
+        });
+
+        // The damage assertion: the shared worktree still holds the PR's
+        // version, not the merge base's.
+        expect(readFileSync(prFile, 'utf8')).toBe(prContent);
+      } finally {
+        process.env['PATH'] = savedPath;
+        rmSync(shimDir, { recursive: true, force: true });
+      }
+    },
+  );
+
   it('never deletes a line that does not hold the selected statement', () => {
     // `runOneMutant`'s mismatch guard, pinned directly: selection and the
     // probe tree both derive from the same commit, so the command cannot reach
diff --git a/packages/cli/src/commands/review/test-efficacy.test.ts b/packages/cli/src/commands/review/test-efficacy.test.ts
index 7a90f3bc792..8ea4de4fc86 100644
--- a/packages/cli/src/commands/review/test-efficacy.test.ts
+++ b/packages/cli/src/commands/review/test-efficacy.test.ts
@@ -34,11 +34,13 @@ import {
   committedSymlinkProbes,
 } from './test-efficacy.js';
 import { isolateHostGitConfig } from './lib/test-utils.js';
-import { sanitizedGitEnv } from './lib/worktree.js';
+import { MAX_SCREEN_KEYS, sanitizedGitEnv } from './lib/worktree.js';
 import {
   mkdtempSync,
   mkdirSync,
+  chmodSync,
   writeFileSync,
+  appendFileSync,
   symlinkSync,
   existsSync,
   readFileSync,
@@ -565,6 +567,324 @@ describe('restoreProbeTreeTracked, through runOneMutant', () => {
     }
   });
 
+  it('refuses to run through a repo-LOCAL content filter, and only a local one', () => {
+    // The restore rewrites every tracked file in this tree, and a checkout
+    // EXECUTES `filter.<name>.smudge` whenever it does — the same surface
+    // `scratch-tree` refuses to reset through, run twice per probe run one
+    // directory over with no screen at all.
+    const dir = mkdtempSync(join(tmpdir(), 'qwen-filter-'));
+    const canaryDir = mkdtempSync(join(tmpdir(), 'qwen-canary-'));
+    const isolation = isolateHostGitConfig();
+    try {
+      writeFileSync(join(dir, 'a.ts'), 'gone.clear();\n');
+      writeFileSync(join(dir, 'b.ts'), 'export const b = 1;\n');
+      // The attributes line is half the plant and belongs in the fixture: a
+      // filter git never SELECTS for a tracked path executes nothing, so
+      // without this the restore is harmless with or without the screen and
+      // the test would stay green if a later edit moved the screen below the
+      // checkout. With it, the canary below pins the ORDER, not just the
+      // message.
+      writeFileSync(join(dir, '.gitattributes'), '*.ts filter=evil\n');
+      asCheckout(dir);
+      // OUTSIDE the probe tree, but inside a fixture this test removes: the
+      // restore's second spawn is `clean -ffdx`, which deletes an untracked
+      // canary written into the tree and would hide the very ordering bug the
+      // canary exists to catch. Nothing is left on the runner either way.
+      const canary = join(canaryDir, 'PWNED-smudge');
+      execFileSync('git', ['config', 'filter.evil.smudge', `touch ${canary}`], {
+        cwd: dir,
+      });
+      // A checkout runs the smudge only on files it actually REWRITES, and it
+      // rewrites nothing when the tree already matches HEAD. A dirty file is
+      // what a probe run leaves behind and what the restore exists to undo, so
+      // it is also the condition under which the canary can fire at all.
+      writeFileSync(join(dir, 'a.ts'), 'dirtied by a previous run\n');
+
+      const r = runOneMutant(
+        dir,
+        { file: 'a.ts', line: 1, statement: 'gone.clear();' },
+        ['a.test.ts'],
+      );
+
+      expect(r.verdict).toBe('inconclusive');
+      expect(r.detail).toContain('filter.evil.smudge');
+      // The refusal has to come BEFORE the checkout, not merely instead of a
+      // verdict: this is the assertion that goes red if the screen moves down.
+      expect(existsSync(canary)).toBe(false);
+
+      // ...and a filter in the user's GLOBAL config is their own contract, the
+      // way it is for any git command they run. `git lfs install` writes one
+      // there, so refusing on it would put every contributor with git-lfs into
+      // permanent refusal — the failure mode a blanket rule reproduces.
+      execFileSync('git', ['config', '--unset', 'filter.evil.smudge'], {
+        cwd: dir,
+      });
+      execFileSync(
+        'git',
+        ['config', '--global', 'filter.lfs.clean', 'git-lfs clean -- %f'],
+        { cwd: dir },
+      );
+
+      // It gets all the way to the runner, which this bare fixture does not
+      // have — the throw is from `findVitestBin`, and that IS the observation:
+      // the restore did not refuse, so the phase proceeded.
+      let afterDetail: string;
+      try {
+        afterDetail = runOneMutant(
+          dir,
+          { file: 'a.ts', line: 1, statement: 'gone.clear();' },
+          ['a.test.ts'],
+        ).detail;
+      } catch (e) {
+        afterDetail = e instanceof Error ? e.message : String(e);
+      }
+
+      expect(afterDetail).not.toContain('filter.lfs.clean');
+      expect(afterDetail).not.toContain('content filter');
+      // The local `evil` filter is gone, so nothing selected by the committed
+      // attributes line remains to execute either.
+      expect(existsSync(canary)).toBe(false);
+    } finally {
+      isolation.dispose();
+      rmSync(dir, { recursive: true, force: true });
+      rmSync(canaryDir, { recursive: true, force: true });
+    }
+  });
+
+  it('still sees a filter whose value is padded huge — `--name-only` never prints the value', () => {
+    // The screened file is attacker-writable, and a `smudge` value padded past
+    // `spawnSync`'s DEFAULT 1 MiB buffer would kill git with ENOBUFS if the
+    // enumeration printed values — the screen would skip the one file that
+    // defines the filter and report the repository clean. `--name-only` prints
+    // only the KEY, so the padded value never reaches stdout: the key is found
+    // and the refusal fires with no raised buffer at all. Remove `--name-only`
+    // and this goes red (the 1.2 MiB value overflows the default buffer and the
+    // detail no longer names the key), which is what pins the flag.
+    const dir = mkdtempSync(join(tmpdir(), 'qwen-bigvalue-'));
+    const canaryDir = mkdtempSync(join(tmpdir(), 'qwen-canary-'));
+    const isolation = isolateHostGitConfig();
+    try {
+      writeFileSync(join(dir, 'a.ts'), 'gone.clear();\n');
+      writeFileSync(join(dir, '.gitattributes'), '*.ts filter=evil\n');
+      asCheckout(dir);
+      const canary = join(canaryDir, 'PWNED-bigvalue');
+      // git takes the LAST value; the first is only there to push the
+      // enumeration's output past the default buffer.
+      appendFileSync(
+        join(dir, '.git', 'config'),
+        `[filter "evil"]\n\tsmudge = echo ${'x'.repeat(1200000)}\n` +
+          `\tsmudge = touch ${canary}\n`,
+      );
+      writeFileSync(join(dir, 'a.ts'), 'dirtied by a previous run\n');
+
+      const r = runOneMutant(
+        dir,
+        { file: 'a.ts', line: 1, statement: 'gone.clear();' },
+        ['a.test.ts'],
+      );
+
+      expect(r.verdict).toBe('inconclusive');
+      expect(r.detail).toContain('filter.evil.smudge');
+      expect(existsSync(canary)).toBe(false);
+    } finally {
+      isolation.dispose();
+      rmSync(dir, { recursive: true, force: true });
+      rmSync(canaryDir, { recursive: true, force: true });
+    }
+  });
+
+  it('refuses a config candidate it cannot read — not "clean"', () => {
+    // git reports an unreadable `--file` with exit 1 and a warning on stderr —
+    // the same status as "no key matched" — so a screen that asks git and reads
+    // the exit code calls a config it never read clean. The candidate here is
+    // `config.worktree`, which git honors once `extensions.worktreeConfig` is
+    // on; a directory in its place is a candidate the screen cannot check.
+    const dir = mkdtempSync(join(tmpdir(), 'qwen-unreadable-'));
+    const isolation = isolateHostGitConfig();
+    try {
+      writeFileSync(join(dir, 'a.ts'), 'gone.clear();\n');
+      asCheckout(dir);
+      mkdirSync(join(dir, '.git', 'config.worktree'));
+
+      const r = runOneMutant(
+        dir,
+        { file: 'a.ts', line: 1, statement: 'gone.clear();' },
+        ['a.test.ts'],
+      );
+
+      expect(r.verdict).toBe('inconclusive');
+      expect(r.detail).toContain('could not be read to the end');
+    } finally {
+      isolation.dispose();
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('says the enumeration was capped when more keys were planted than shown', () => {
+    // The cap exists so an attacker-written key list cannot become the whole
+    // refusal string; the count exists so the message does not send a user to
+    // remove the keys it named and leave the rest standing.
+    const dir = mkdtempSync(join(tmpdir(), 'qwen-capmsg-'));
+    const isolation = isolateHostGitConfig();
+    try {
+      writeFileSync(join(dir, 'a.ts'), 'gone.clear();\n');
+      asCheckout(dir);
+      let cfg = '';
+      for (let i = 0; i < MAX_SCREEN_KEYS + 1; i++) {
+        cfg += `[filter "evil${i}"]\n\tsmudge = cat\n`;
+      }
+      appendFileSync(join(dir, '.git', 'config'), cfg);
+
+      const r = runOneMutant(
+        dir,
+        { file: 'a.ts', line: 1, statement: 'gone.clear();' },
+        ['a.test.ts'],
+      );
+
+      expect(r.verdict).toBe('inconclusive');
+      expect(r.detail).toContain('capped enumeration');
+      expect(r.detail).toContain(
+        `${MAX_SCREEN_KEYS} shown of ${MAX_SCREEN_KEYS + 1}`,
+      );
+    } finally {
+      isolation.dispose();
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('flattens control characters in the filter key it names', () => {
+    // A config subsection name legally carries control and format characters,
+    // and `--get-regexp` prints them verbatim. These detail strings reach the
+    // agent-facing report through JSON.stringify, which escapes Cc but NOT Cf
+    // (bidi overrides), Zl/Zp, or backticks — so the flattening has to happen
+    // here, through the same helper scratch-tree already uses.
+    const dir = mkdtempSync(join(tmpdir(), 'qwen-inert-'));
+    const isolation = isolateHostGitConfig();
+    try {
+      writeFileSync(join(dir, 'a.ts'), 'gone.clear();\n');
+      asCheckout(dir);
+      // ESC (Cc) and a right-to-left override (Cf) inside the subsection name.
+      execFileSync(
+        'git',
+        ['config', 'filter.ev\u001bil\u202eX.smudge', 'cat'],
+        { cwd: dir },
+      );
+
+      const r = runOneMutant(
+        dir,
+        { file: 'a.ts', line: 1, statement: 'gone.clear();' },
+        ['a.test.ts'],
+      );
+
+      expect(r.verdict).toBe('inconclusive');
+      expect(r.detail).toContain('filter.ev il X.smudge');
+      expect(r.detail).not.toContain('\u001b');
+      expect(r.detail).not.toContain('\u202e');
+    } finally {
+      isolation.dispose();
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  // POSIX-only: the relink is a symlink swap driven from a `#!/bin/sh` shim.
+  it.skipIf(process.platform === 'win32')(
+    'refuses when the tree stops being its own root mid-screen',
+    () => {
+      // The root verdict is taken at the top of the restore; the filter screen
+      // runs between it and the destructive spawns, and an attacker can
+      // stretch that walk. A planter that swaps the root for a symlink to the
+      // SHARED tree inside the window would send `checkout --force` and
+      // `clean -ffdx` there — tracked files rewritten, untracked and ignored
+      // ones deleted. Driven deterministically here: a `git` shim performs the
+      // swap on the screen's first config read, so the relink lands exactly in
+      // the window rather than by racing.
+      const dir = mkdtempSync(join(tmpdir(), 'qwen-relink-'));
+      const victim = mkdtempSync(join(tmpdir(), 'qwen-victim-'));
+      const shimDir = mkdtempSync(join(tmpdir(), 'qwen-relinkshim-'));
+      const isolation = isolateHostGitConfig();
+      const savedPath = process.env['PATH'];
+      try {
+        writeFileSync(join(dir, 'a.ts'), 'gone.clear();\n');
+        asCheckout(dir);
+        writeFileSync(join(dir, 'a.ts'), 'dirtied\n');
+        // The tree the relink points at is a real checkout, so without the
+        // re-check the spawns SUCCEED there rather than failing on "not a git
+        // repository" — `clean -ffdx` eats the untracked file, which is what
+        // makes this a damage witness and not just a diagnostics one.
+        writeFileSync(join(victim, 'tracked.ts'), 'shared\n');
+        asCheckout(victim);
+        writeFileSync(join(victim, 'PRECIOUS'), 'do not delete\n');
+        const realGit = execFileSync('which', ['git'], {
+          encoding: 'utf8',
+        }).trim();
+        // On the first `config --file` read, swap the root for a symlink.
+        writeFileSync(
+          join(shimDir, 'git'),
+          `#!/bin/sh\ncase "$*" in\n  *--file*)\n    if [ ! -e ${shimDir}/done ]; then\n      touch ${shimDir}/done\n      rm -rf ${dir}.real && mv ${dir} ${dir}.real && ln -s ${victim} ${dir}\n    fi\n    ;;\nesac\nexec ${realGit} "$@"\n`,
+        );
+        chmodSync(join(shimDir, 'git'), 0o755);
+        process.env['PATH'] = `${shimDir}:${savedPath ?? ''}`;
+
+        // Wrapped, because without the re-check the run does not merely
+        // return a wrong verdict — it throws further along, after the damage.
+        let detail = '';
+        try {
+          detail = runOneMutant(
+            dir,
+            { file: 'a.ts', line: 1, statement: 'gone.clear();' },
+            ['a.test.ts'],
+          ).detail;
+        } catch (e) {
+          detail = e instanceof Error ? e.message : String(e);
+        }
+
+        // The damage assertion FIRST: this is the one that fails when the
+        // re-check is removed, and it fails because `clean -ffdx` really did
+        // run in the shared tree.
+        expect(existsSync(join(victim, 'PRECIOUS'))).toBe(true);
+        expect(detail).toContain('stopped being its own root');
+      } finally {
+        process.env['PATH'] = savedPath;
+        isolation.dispose();
+        rmSync(shimDir, { recursive: true, force: true });
+        rmSync(`${dir}.real`, { recursive: true, force: true });
+        rmSync(dir, { recursive: true, force: true });
+        rmSync(victim, { recursive: true, force: true });
+      }
+    },
+  );
+
+  it('refuses when git cannot PARSE a candidate config — not "clean"', () => {
+    // The readability gate above answers "can this process open it"; this is
+    // the other half — a file that opens fine and that git then dies on. A
+    // malformed section header exits 128 (not the 1 that means "no key
+    // matched"), so a screen that only distinguished 0 from non-0 would skip
+    // the file and report the repository clean on a config it never read.
+    const dir = mkdtempSync(join(tmpdir(), 'qwen-malformed-'));
+    const isolation = isolateHostGitConfig();
+    try {
+      writeFileSync(join(dir, 'a.ts'), 'gone.clear();\n');
+      asCheckout(dir);
+      // Unclosed section header — a regular, readable file git refuses to parse.
+      writeFileSync(
+        join(dir, '.git', 'config.worktree'),
+        '[filter "evil"\n\tsmudge = cat\n',
+      );
+
+      const r = runOneMutant(
+        dir,
+        { file: 'a.ts', line: 1, statement: 'gone.clear();' },
+        ['a.test.ts'],
+      );
+
+      expect(r.verdict).toBe('inconclusive');
+      expect(r.detail).toContain('could not be read to the end');
+    } finally {
+      isolation.dispose();
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   it('refuses to run when the index hides a tracked file from the restore', () => {
     // `checkout --force` SILENTLY skips a file carrying skip-worktree, and
     // `clean` never touches a tracked file — so a bit the guest suite sets with
diff --git a/packages/cli/src/commands/review/test-efficacy.ts b/packages/cli/src/commands/review/test-efficacy.ts
index 7b84d43245c..bdf194e45bb 100644
--- a/packages/cli/src/commands/review/test-efficacy.ts
+++ b/packages/cli/src/commands/review/test-efficacy.ts
@@ -84,7 +84,10 @@ import {
 import {
   discardWorktree,
   exposeDependencies,
+  localFilterCommands,
   redirectedAncestor,
+  screenKeyList,
+  screenStopDetail,
   sanitizedGitEnv,
   worktreeCreateFailureDetail,
   type SweepResult,
@@ -1301,6 +1304,20 @@ interface TestEfficacyArgs {
 // resets, the revert's checkout — so the mutations would land in whichever
 // repository the environment names while every check against the tree passes
 // silently. The trees this file touches are chosen by the paths it is given.
+// The two config-driven command surfaces a checkout fires from the very tree it
+// is cleaning: `core.hooksPath` (a `post-checkout` hook planted in the shared
+// common dir) and `core.fsmonitor` (a command git runs on checkout/status).
+// Disabling hooks does not cover filters and neutralising one checkout does not
+// cover the next — so every checkout in this file that rewrites files (the
+// restore and the revert alike) passes these, and none is hardened while a
+// sibling stays steerable.
+const CHECKOUT_INERT = [
+  '-c',
+  'core.hooksPath=/dev/null/no-hooks',
+  '-c',
+  'core.fsmonitor=',
+] as const;
+
 function git(cwd: string, ...args: string[]): void {
   const r = spawnSync('git', args, {
     cwd,
@@ -1592,6 +1609,10 @@ function restoreProbeTreeTracked(probeTree: string): string | null {
           `git rev-parse exited ${top.status}`;
   }
   const [toplevel, commonDir, gitDir] = top.stdout.trim().split('\n');
+  // Captured with the root verdict below, re-asked immediately before the
+  // spawns — see `probeRootIdentity`. The screen between them is a walk an
+  // attacker can stretch.
+  const rootAtVerdict = probeRootIdentity(probeTree);
   try {
     // The LEAF first. Every comparison below realpaths both sides, so a probe
     // tree that is itself a symlink into the shared review worktree agrees
@@ -1643,15 +1664,41 @@ function restoreProbeTreeTracked(probeTree: string): string | null {
   // in a tree this code is defending against, so it is emptied here the way
   // every other checkout in this pipeline empties it. `--` and a pathspec:
   // this restores FILES and never moves HEAD.
-  // `core.fsmonitor` runs a command on BOTH of these, and the config that sets
-  // it lives in the tree they are cleaning: the residue probe empties it for
-  // exactly this reason and these two spawns were the ones still steerable.
-  const inert = [
-    '-c',
-    'core.hooksPath=/dev/null/no-hooks',
-    '-c',
-    'core.fsmonitor=',
-  ];
+  // Filters, before either spawn. A checkout EXECUTES `filter.<name>.smudge`
+  // whenever it rewrites a file, and the restore below rewrites every tracked
+  // file this tree has — so the same surface `scratch-tree` refuses to reset
+  // through was, one directory over, run through twice per probe run. The
+  // screen reads repo-LOCAL config only: `git lfs install` writes
+  // `filter.lfs.clean` into the user's GLOBAL config, and refusing on that
+  // would put every contributor with git-lfs into permanent refusal — the same
+  // failure as a tripwire that fires on every healthy run.
+  const filters = localFilterCommands(probeTree);
+  // Gate on `stopped`, not `unreadable` — the same field `scratch-tree` gates
+  // on. A screen that stopped for ANY reason (an unreadable candidate OR an
+  // over-cap admin dir) did not finish, and either way the checkout below would
+  // execute a filter it failed to see. Keying on the `unreadable` file field
+  // would let a future stop mode that sets `stopped` without a file silently
+  // authorise the checkout while scratch-tree refuses.
+  if (filters.stopped) {
+    return `the screen could not clear this tree's restore: ${screenStopDetail(filters)}`;
+  }
+  if (filters.keys.length > 0) {
+    return `the repository's local config defines content filter(s) ${screenKeyList(filters)}, which this tree's restore would EXECUTE`;
+  }
+  // The root verdict again, with only these two syscalls before the spawns.
+  // Everything above — the gitfile round-trip, the ancestor walk, the filter
+  // screen's per-candidate spawns — ran on the verdict taken at the top, and
+  // the screen in particular is stretchable by filler admin entries.
+  if (
+    rootAtVerdict === null ||
+    probeRootIdentity(probeTree) !== rootAtVerdict
+  ) {
+    return `${probeTree} stopped being its own root while the restore was being cleared, so the checkout and clean would run somewhere else`;
+  }
+  // `core.hooksPath` and `core.fsmonitor` both run a command on these two
+  // spawns, and the config that sets them lives in the tree they are cleaning:
+  // the residue probe empties them for exactly this reason.
+  const inert = CHECKOUT_INERT;
   for (const args of [
     [...inert, 'checkout', '--force', 'HEAD', '--', '.'],
     // `-ffdx`, because `-fd` honors the ignore rules — and those belong to the
@@ -2040,6 +2087,34 @@ function newSideLength(header: string): number {
  * control that never ran) rather than written through; a component missing on
  * disk escapes nothing — the read or write fails on its own.
  */
+/**
+ * The probe tree root's identity, for re-asking immediately before a spawn.
+ *
+ * Every root-escape verdict in this file is taken once and then acted on
+ * several statements later — and what sits in between grew: the filter screen
+ * is a walk of one spawn per candidate, and an attacker can stretch it with
+ * filler admin entries. A detached planter (the capability the revert phase's
+ * own comment credits) that replaces the predictable `<worktree>-probe` root
+ * with a symlink to the SHARED review worktree inside that window turns
+ * `checkout --force` and `clean -ffdx` loose on the reviewer's own tree:
+ * tracked files rewritten, untracked and ignored files deleted — `.qwen/**`
+ * included — while the restore still reports success.
+ *
+ * So the verdict is re-taken here, with nothing but two syscalls between it
+ * and the spawn. `null` means "not a root to write into"; comparing the
+ * answer to the one taken earlier catches a root swapped in between. This does
+ * not close the window — a check and a spawn are never one operation — it
+ * narrows it to what fs calls cost, from a walk an attacker can widen.
+ */
+function probeRootIdentity(probeTree: string): string | null {
+  try {
+    if (lstatSync(probeTree).isSymbolicLink()) return null;
+    return realpathSync(probeTree);
+  } catch {
+    return null;
+  }
+}
+
 function probeTargetEscapes(probeTree: string, file: string): boolean {
   // The separator set is platform-dependent: on POSIX a backslash is an
   // ordinary NAME character, so splitting on it turns `x\\y.test.ts` into two
@@ -2969,6 +3044,20 @@ async function runTestEfficacy(args: TestEfficacyArgs): Promise<void> {
               'root), so the revert would run against whatever it points at',
           );
         }
+        // Captured here, re-asked immediately before the checkout — the
+        // classification loop and the filter screen both sit in between, and
+        // both are attacker-sized (one `cat-file -e` per revert path; one
+        // spawn per screened candidate).
+        const revertRootAtVerdict = probeRootIdentity(probeTree);
+        // Filters, again, and for the same reason the restore screens them:
+        // `checkout base -- <paths>` below rewrites files, and a rewrite
+        // EXECUTES `filter.<name>.smudge`. Screening once at the restore is
+        // not enough — every run between then and here has executed the PR's
+        // own test code, which can plant the filter mid-run, and the mutation
+        // phase's catch deliberately continues so that this revert still runs.
+        // A refused restore therefore reaches this line with the plant live.
+        // The throw lands in this phase's existing catch and is recorded as a
+        // probe that did not run, which is what it is.
         // "Revert to base" is two operations, confined to the throwaway tree. A
         // file the PR MODIFIED is checked out from base; a file the PR ADDED did
         // not exist at base, so it is removed — through `safeRmWithin`, which
@@ -2980,8 +3069,68 @@ async function runTestEfficacy(args: TestEfficacyArgs): Promise<void> {
         for (const p of revert) {
           (existsAtBase(probeTree, base, p) ? modified : added).push(p);
         }
+        // Screened HERE, immediately before the spawn, not above the loop.
+        // The classification above runs one synchronous `git cat-file -e` per
+        // revert path, and `revert` is the plan's full source-file list —
+        // attacker-controlled in count. A screen above it leaves a window
+        // measured in seconds between the last read and the checkout, and the
+        // probe's own test code can spawn a detached process that plants the
+        // filter inside it. Moving the screen below the loop leaves only the
+        // checkout spawn in the gap. A residual window remains and cannot be
+        // closed from here — there is no `-c` kill switch for
+        // attribute-selected filters, so a checkout either reads merged config
+        // or does not run. It is NOT sub-millisecond: the screen is a walk of
+        // several spawns, measured at 56-100 ms on a repository with no linked
+        // worktrees, and a plant can stretch it with filler admin entries. The
+        // screen reads `<common>/config` last for that reason (see
+        // `localFilterCommands`), which removes the amplification but not the
+        // window.
+        const revertFilters = localFilterCommands(probeTree);
+        // Gate on `stopped`, matching the restore and scratch-tree — a screen
+        // that stopped for any reason did not finish, so the checkout must not
+        // proceed on it (see the restore's note above).
+        if (revertFilters.stopped) {
+          throw new Error(
+            'the screen could not clear this revert: ' +
+              screenStopDetail(revertFilters),
+          );
+        }
+        if (revertFilters.keys.length > 0) {
+          throw new Error(
+            "the repository's local config defines content filter(s) " +
+              `${screenKeyList(revertFilters)}, which this revert's checkout ` +
+              'would EXECUTE',
+          );
+        }
+        // The root verdict again, two syscalls before the spawn. `safeRmWithin`
+        // re-walks ancestors on every call, so the DELETE half already asks
+        // this question per path; the checkout half trusted the verdict taken
+        // above the classification loop, and a relink landing in between
+        // rewrote the reviewer's own files with base content.
+        if (
+          revertRootAtVerdict === null ||
+          probeRootIdentity(probeTree) !== revertRootAtVerdict
+        ) {
+          throw new Error(
+            'the probe tree stopped being its own root while the revert was ' +
+              'being cleared, so the checkout would run somewhere else',
+          );
+        }
         if (modified.length > 0) {
-          git(probeTree, 'checkout', base, '--', ...modified);
+          // Same neutralisation the restore's checkout runs (CHECKOUT_INERT):
+          // this revert rewrites the PR-modified files, and a `post-checkout`
+          // hook or a `core.fsmonitor` command planted in the never-wiped
+          // common dir mid-run would otherwise fire here — a surface the filter
+          // screen above does not cover, on a checkout the restore hardens and
+          // this one used to leave steerable.
+          git(
+            probeTree,
+            ...CHECKOUT_INERT,
+            'checkout',
+            base,
+            '--',
+            ...modified,
+          );
         }
         for (const p of added) safeRmWithin(probeTree, p);