Tell the fix-forward path that it needs the flag twice

The guard prints `CI_GREEN_SKIP=1 git commit ...` and stops there, but it runs
at two stages: at commit, and again inside the pre-push CI mirror's
clean-worktree `pre-commit` run, which sees the same still-red baseline. So the
documented escape gets you past the commit and into an identical wall at push,
with no hint and nothing in the output connecting the two.

Hit today landing the pre-commit cache-key fix: the commit went through, the
push did not. The variable is read from the environment and `ci_mirror.sh` does
not scrub it, so `CI_GREEN_SKIP=1 git push` carries through to the nested run --
which is now what the message says.

Verified both paths: with the variable set the script warns and exits 0, and
against today's green main it exits 0 silently. shellcheck clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SfnJmxxsZ534AKk16rC2Gr

docs/superpowers/evidence/ci-green-hint-push-2026-08-29.json

@@ -0,0 +1,36 @@
+{
+  "intent": "Make the CI-baseline guard's own error message tell the whole truth: the fix-forward escape hatch has to be given at commit AND at push, because the hook runs at both stages.",
+  "scope": [
+    "meta/scripts/check_ci_green.sh: the header comment and the failure hint",
+    "Non-goal: changing when the guard fires, what it checks, or the semantics of CI_GREEN_SKIP"
+  ],
+  "changes": [
+    "Header comment now documents both invocations and why the second is needed (the pre-push CI mirror re-runs pre-commit in a clean worktree against the same still-red baseline)",
+    "Failure hint now prints `CI_GREEN_SKIP=1 git push` beneath the commit form, plus one line naming the mirror as the reason"
+  ],
+  "verification": [
+    {
+      "command": "shellcheck meta/scripts/check_ci_green.sh",
+      "result": "pass",
+      "evidence": "shellcheck OK (no output)"
+    },
+    {
+      "command": "CI_GREEN_SKIP=1 bash meta/scripts/check_ci_green.sh",
+      "result": "pass",
+      "evidence": "check_ci_green.sh: CI_GREEN_SKIP is set / skipping the CI-baseline check (pre-push ci-mirror is the real gate). exit 0"
+    },
+    {
+      "command": "bash meta/scripts/check_ci_green.sh",
+      "result": "pass",
+      "evidence": "silent, exit 0, against a main that is green as of 6eb70de0"
+    }
+  ],
+  "risks": [
+    "The red path's exact wording is not covered by a test; there is no test file for this script in the repo, so a future edit could break the hint without failing anything.",
+    "If ci_mirror.sh ever starts scrubbing the environment, the documented push form stops working and this message becomes wrong."
+  ],
+  "rollback": [
+    "git revert the commit; the change is comment and printf text only, so nothing depends on it.",
+    "After rollback, confirm the guard still exits 0 on a green main and 1 on a red one."
+  ]
+}

meta/scripts/check_ci_green.sh

@@ -18,8 +18,13 @@
 # failing is how a red baseline gets buried under changes that make it harder
 # to bisect.
 #
-# Bypass for a deliberate fix-forward commit:
+# Bypass for a deliberate fix-forward commit. It must be given TWICE, because
+# this hook runs at both stages: once at commit, and again inside the pre-push
+# CI mirror's clean-worktree `pre-commit` run, which sees the same still-red
+# baseline. The variable is read from the environment and the mirror does not
+# scrub it, so exporting it for the push carries through:
 #   CI_GREEN_SKIP=1 git commit ...
+#   CI_GREEN_SKIP=1 git push
 # ============================================================================
 
 set -euo pipefail
@@ -76,6 +81,8 @@ if [[ ${#failed[@]} -gt 0 ]]; then
 	printf '\nCommitting more work onto a failing baseline buries the breakage.\n' >&2
 	printf 'Fix it first, or if THIS commit is the fix:\n' >&2
 	printf '  CI_GREEN_SKIP=1 git commit ...\n' >&2
+	printf '  CI_GREEN_SKIP=1 git push\n' >&2
+	printf '(both: the pre-push CI mirror re-runs this same check.)\n' >&2
 	exit 1
 fi