From 56ed794ff70f1c1addd7bf1103746dff3f863054 Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 09:04:11 +0200
Subject: [PATCH 01/14] feat(776): every hook reports that it fired, and the
 report is measured
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In this harness version only `Stop` hooks emit a structured transcript record.
`PreToolUse` and `PostToolUse` hooks leave no durable execution trace — which is
every guard this repo relies on. #773 §5.4 could therefore only count filename
mentions in settings dumps, i.e. inference, so a silently broken hook looked
identical to a working one indefinitely.

Each hook now sources one shared sink, `scripts/hook-fire-log.sh`, and records a
`fire` record on entry and an `exit` record carrying its status and decision. The
decision is parsed from the bytes the hook actually emitted rather than declared
by the author: Claude hooks always exit 0 and decide by printing JSON, so stdout
is diverted and replayed; git hooks decide by exit code and stream their output,
so theirs is left alone. That avoided ~40 edits inside pretooluse-merge-consent
and records what the harness sees rather than what the author meant.

The instrumentation sits in the stdin/stdout path of the most authoritative
guards in the repo, so transparency is the load-bearing claim, not coverage:
test_instrumentation_changes_NOTHING_the_harness_can_see drives every hook with
and without it over a payload matrix reaching each hook's deciding branch, and
demands byte-equal stdout and equal exit status. It shipped with two defects that
only that shape catches — `out=$(cat f)` stripping a trailing newline, and an
unconditional stdin slurp that hangs on a TTY and would have frozen every
interactive `git commit`. Both are now pinned, the second through a real pty.

fixes #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .claude/hooks/decisions-guard.sh              |   6 +
 .claude/hooks/design-sync-reminder.sh         |   6 +
 .claude/hooks/posttooluse-worktree-marker.sh  |   6 +
 .claude/hooks/prepush-clean-worktree-check.sh |   6 +
 .claude/hooks/prepush-donewhen.sh             |   6 +
 .claude/hooks/prepush-rebase-check.sh         |   6 +
 .claude/hooks/pretooluse-agent-model.sh       |   6 +
 .claude/hooks/pretooluse-agent-ram.sh         |   6 +
 .claude/hooks/pretooluse-bash-guard.sh        |   6 +
 .claude/hooks/pretooluse-bom-guard.sh         |   6 +
 .claude/hooks/pretooluse-merge-consent.sh     |   6 +
 .claude/hooks/pretooluse-nav-guard.sh         |   6 +
 .claude/hooks/pretooluse-worktree-guard.sh    |   6 +
 docs/decisions/README.md                      |   1 +
 .../testing/hook-reports-its-own-execution.md |  70 +++
 docs/guard-inventory.md                       |  16 +-
 scripts/hook-fire-log.sh                      | 364 +++++++++++++
 scripts/tests/test_hook_fire_log.py           | 490 ++++++++++++++++++
 18 files changed, 1015 insertions(+), 4 deletions(-)
 create mode 100644 docs/decisions/records/testing/hook-reports-its-own-execution.md
 create mode 100755 scripts/hook-fire-log.sh
 create mode 100644 scripts/tests/test_hook_fire_log.py

diff --git a/.claude/hooks/decisions-guard.sh b/.claude/hooks/decisions-guard.sh
index 91665164b..ce22df507 100755
--- a/.claude/hooks/decisions-guard.sh
+++ b/.claude/hooks/decisions-guard.sh
@@ -4,6 +4,12 @@
 # body-diff, CI). This shim runs the structural validator over the working tree; the body-diff/no-
 # vanish checks run in CI where a base/head is available. Fail-open on any tooling trouble.
 set -uo pipefail
+
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# git hook: decides by exit code, and its stdout is live progress text.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin decisions-guard "" stream || true
 cd "$(git rev-parse --show-toplevel)" || exit 0
 command -v python3 >/dev/null 2>&1 || exit 0            # no python -> fail-open
 PYTHONPATH=. python3 scripts/decisions_validate.py
diff --git a/.claude/hooks/design-sync-reminder.sh b/.claude/hooks/design-sync-reminder.sh
index 43615897f..8a90d9e8e 100755
--- a/.claude/hooks/design-sync-reminder.sh
+++ b/.claude/hooks/design-sync-reminder.sh
@@ -17,6 +17,12 @@
 # This is a reminder, never a hard gate — `start` only injects context; `finish` is a one-shot Stop nudge.
 set -euo pipefail
 
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# Claude hook: decides by printed JSON, so stdout is captured.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin design-sync-reminder "${1:-}" capture || true
+
 UI_RE='(^|/)web/src/.*\.(tsx|css)$'
 TEST_RE='\.test\.(tsx|ts)$'
 
diff --git a/.claude/hooks/posttooluse-worktree-marker.sh b/.claude/hooks/posttooluse-worktree-marker.sh
index 588ed517d..f481bc407 100755
--- a/.claude/hooks/posttooluse-worktree-marker.sh
+++ b/.claude/hooks/posttooluse-worktree-marker.sh
@@ -4,6 +4,12 @@
 # a sibling worktree another session created apart from this session's own.
 # Fail-safe: any parse trouble → do nothing (the guard stays fail-open without a marker).
 set -euo pipefail
+
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# Claude hook: decides by printed JSON, so stdout is captured.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin posttooluse-worktree-marker "" capture || true
 input=$(cat)
 cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
 cwd=$(printf '%s' "$input" | jq -r '.cwd // ""' 2>/dev/null || true)
diff --git a/.claude/hooks/prepush-clean-worktree-check.sh b/.claude/hooks/prepush-clean-worktree-check.sh
index 4b49ae874..a384ba607 100755
--- a/.claude/hooks/prepush-clean-worktree-check.sh
+++ b/.claude/hooks/prepush-clean-worktree-check.sh
@@ -15,6 +15,12 @@
 # no origin/main, HEAD unresolved -> allow. Deliberate escape: ETV_ALLOW_DIRTY_PUSH=1.
 set -uo pipefail
 
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# git hook: decides by exit code, and its stdout is live progress text.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin prepush-clean-worktree-check "" stream || true
+
 [ "${ETV_ALLOW_DIRTY_PUSH:-}" = "1" ] && exit 0
 git rev-parse --git-dir >/dev/null 2>&1 || exit 0
 
diff --git a/.claude/hooks/prepush-donewhen.sh b/.claude/hooks/prepush-donewhen.sh
index 4ca45400b..b7c64c16a 100755
--- a/.claude/hooks/prepush-donewhen.sh
+++ b/.claude/hooks/prepush-donewhen.sh
@@ -12,6 +12,12 @@
 # Auth (never committed): ETV_GITEA_TOKEN or ETV_GITEA_BASICAUTH; ETV_GITEA_URL overrides the base.
 set -euo pipefail
 
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# git hook: decides by exit code, and its stdout is live progress text.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin prepush-donewhen "" stream || true
+
 # git passes "<localref> <localsha> <remoteref> <remotesha>" lines on stdin.
 refs=$(cat || true)
 printf '%s\n' "$refs" | grep -q 'refs/heads/main' || exit 0   # only gate pushes to main
diff --git a/.claude/hooks/prepush-rebase-check.sh b/.claude/hooks/prepush-rebase-check.sh
index 4dfa00f45..a76c24858 100755
--- a/.claude/hooks/prepush-rebase-check.sh
+++ b/.claude/hooks/prepush-rebase-check.sh
@@ -9,6 +9,12 @@
 # a positively-proven "behind origin/main". Deliberate exception: ETV_SKIP_REBASE_CHECK=1.
 set -uo pipefail
 
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# git hook: decides by exit code, and its stdout is live progress text.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin prepush-rebase-check "" stream || true
+
 [ "${ETV_SKIP_REBASE_CHECK:-}" = "1" ] && exit 0
 git rev-parse --git-dir >/dev/null 2>&1 || exit 0
 
diff --git a/.claude/hooks/pretooluse-agent-model.sh b/.claude/hooks/pretooluse-agent-model.sh
index 8b0583244..520f99dd1 100755
--- a/.claude/hooks/pretooluse-agent-model.sh
+++ b/.claude/hooks/pretooluse-agent-model.sh
@@ -40,6 +40,12 @@
 # Fail-open by design: any parse trouble -> allow (exit 0, no output).
 set -uo pipefail
 
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# Claude hook: decides by printed JSON, so stdout is captured.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin pretooluse-agent-model "" capture || true
+
 input=$(cat)
 
 tool=$(printf '%s' "$input" | jq -r '.tool_name // ""' 2>/dev/null || true)
diff --git a/.claude/hooks/pretooluse-agent-ram.sh b/.claude/hooks/pretooluse-agent-ram.sh
index bf26d8c4c..acf258f7f 100755
--- a/.claude/hooks/pretooluse-agent-ram.sh
+++ b/.claude/hooks/pretooluse-agent-ram.sh
@@ -3,6 +3,12 @@
 # The historic 8-9-way crash was RAM starvation, not CPU load; gate on FREE RAM.
 # Fail-open: if memory_pressure is unavailable/unparsable → allow.
 set -euo pipefail
+
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# Claude hook: decides by printed JSON, so stdout is captured.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin pretooluse-agent-ram "" capture || true
 free=$(memory_pressure -Q 2>/dev/null | grep -oE 'free percentage: [0-9]+' | grep -oE '[0-9]+' || true)
 [ -z "${free:-}" ] && exit 0
 
diff --git a/.claude/hooks/pretooluse-bash-guard.sh b/.claude/hooks/pretooluse-bash-guard.sh
index d6b5121d2..c9da6e459 100755
--- a/.claude/hooks/pretooluse-bash-guard.sh
+++ b/.claude/hooks/pretooluse-bash-guard.sh
@@ -2,6 +2,12 @@
 # PreToolUse / Bash — deny commands that violate a HARD RULE.
 # Fail-open: any parse trouble → allow (exit 0 with no output).
 set -euo pipefail
+
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# Claude hook: decides by printed JSON, so stdout is captured.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin pretooluse-bash-guard "" capture || true
 input=$(cat)
 cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
 
diff --git a/.claude/hooks/pretooluse-bom-guard.sh b/.claude/hooks/pretooluse-bom-guard.sh
index b687c433c..387c7fd92 100755
--- a/.claude/hooks/pretooluse-bom-guard.sh
+++ b/.claude/hooks/pretooluse-bom-guard.sh
@@ -18,6 +18,12 @@
 # the reason a commit can't happen; CI is still the backstop.
 set -uo pipefail
 
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# Claude hook: decides by printed JSON, so stdout is captured.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin pretooluse-bom-guard "" capture || true
+
 input=$(cat)
 cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
 [ -n "$cmd" ] || exit 0
diff --git a/.claude/hooks/pretooluse-merge-consent.sh b/.claude/hooks/pretooluse-merge-consent.sh
index ef81a9ea5..69ecc5157 100755
--- a/.claude/hooks/pretooluse-merge-consent.sh
+++ b/.claude/hooks/pretooluse-merge-consent.sh
@@ -40,6 +40,12 @@
 # Gitea auth from env (never committed): ETV_GITEA_TOKEN (a token) OR ETV_GITEA_BASICAUTH (user:pass).
 # ETV_GITEA_URL overrides the base (default: the LAN instance; a LAN address, not a secret).
 set -euo pipefail
+
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# Claude hook: decides by printed JSON, so stdout is captured.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin pretooluse-merge-consent "" capture || true
 input=$(cat)
 
 decide() { # $1=grant|allow|deny|ask  $2=reason
diff --git a/.claude/hooks/pretooluse-nav-guard.sh b/.claude/hooks/pretooluse-nav-guard.sh
index cacc96360..1bae8aadc 100755
--- a/.claude/hooks/pretooluse-nav-guard.sh
+++ b/.claude/hooks/pretooluse-nav-guard.sh
@@ -2,6 +2,12 @@
 # PreToolUse / browser-navigate — deny opening download/stream endpoints in a tab
 # (they hang the MCP session; curl them instead). Fail-open on parse trouble.
 set -euo pipefail
+
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# Claude hook: decides by printed JSON, so stdout is captured.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin pretooluse-nav-guard "" capture || true
 input=$(cat)
 url=$(printf '%s' "$input" | jq -r '.tool_input.url // ""' 2>/dev/null || true)
 
diff --git a/.claude/hooks/pretooluse-worktree-guard.sh b/.claude/hooks/pretooluse-worktree-guard.sh
index 18ccb10c7..77eb450ba 100755
--- a/.claude/hooks/pretooluse-worktree-guard.sh
+++ b/.claude/hooks/pretooluse-worktree-guard.sh
@@ -8,6 +8,12 @@
 # So the main tree (never marked) and pre-convention worktrees (no marker) are unaffected;
 # only a commit/merge into another session's marked worktree is blocked.
 set -euo pipefail
+
+# ersatztv#776 — report that this hook fired. MUST precede any stdin read.
+# Claude hook: decides by printed JSON, so stdout is captured.
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+etv_hook_fire_begin pretooluse-worktree-guard "" capture || true
 input=$(cat)
 cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
 cwd=$(printf '%s' "$input" | jq -r '.cwd // ""' 2>/dev/null || true)
diff --git a/docs/decisions/README.md b/docs/decisions/README.md
index 972275cb2..4510d26ad 100644
--- a/docs/decisions/README.md
+++ b/docs/decisions/README.md
@@ -196,6 +196,7 @@ the link for rationale. Superseded/retired history lives in `archive/`. Regenera
 | `testing.enumerating-guard-identity-not-position` | A guard that cross-checks a hand-reviewed registry against call sites discovered across the whole repo must key each entry on properties INTRINSIC to the site — file, kind, and the value source text — and never on its absolute line or column. A registry keyed on position is a function of every other file in the repo, so a branch that never touches the guard can invalidate it; and because each PR is green against its own base, that failure is structurally invisible pre-merge and lands on `main` after review and after the merge gate. Dropping the position keeps every mutation the guard exists for — a NEW site, a REMOVED site and a CHANGED value each still fail, since each changes the identity multiset — and costs exactly ONE case, which must be stated rather than implied: a SAME-IDENTITY SUBSTITUTION within one file (delete a registered site, add a different unreviewed one with the same kind and value token, net-zero count) now passes. A REPORTED failure still prints the discovered line:column, because identity and diagnostics need not share a format. Comparison stays a MULTISET count rather than set membership, so two sites in one file sharing an identity must be discovered exactly that many times and a third occurrence still fails. A SCANNER test that asserts real AST positions against FIXED inline fixtures is the opposite case and keeps its line/column identity — it has no churn, because its input does not move. | 2026-07-27 | [link](records/testing/enumerating-guard-identity-not-position.md) |
 | `testing.guard-derives-population-from-source` | A guard that asserts a COMPLETENESS property enumerates its population from a machine-readable authoritative source — the enum, the generated OpenAPI document, the parsed workflow YAML, the provider list — and asserts SET EQUALITY in BOTH directions against it. It may not narrow that population with a filter, a `Where`, a `grep` or an early `continue` before the assertion, because a filter cannot see the member that is MISSING: the member whose absence is the defect is precisely the one the predicate excludes. A hand-written literal list of members is the same defect in slower motion — a filter frozen at authoring time, correct on the day it was written and unable to report the day it stopped being. Two boundaries bound the rule rather than weaken it. FIRST, filtering to select the SUBJECT of a PER-MEMBER property is legitimate and is not this defect: the excluded members satisfy the property vacuously, so the filtered walk and the whole walk assert the same thing (`ToolCatalogTests.Every_Query_Parameter_Should_Be_A_Declared_Property` filters to tools that declare query parameters, and a tool declaring none has nothing to check). The defect is filtering the population before a COMPLETENESS claim, which is what makes an absent member unrepresentable (#757 filtered on `QueryParameters is {Count: > 0}` and so could not see a tool that should have declared one and did not). SECOND, a population of VALUES always has an external authoritative source and this rule applies directly; a population of SITES IN CODE has no such list, needs find-all-references tooling, and is tracked separately in #777 — do not stretch a set-equality assertion over it. Distinguish the guard SCOPE (which subsystems it covers — a reviewed policy choice, legitimately hand-written) from the guard POPULATION (the members inside that scope — always derived). When the scope itself MIRRORS an authoritative source, the mirror needs its own equality check or a dated staleness marker, or the guard is complete within a scope that has silently gone stale. The canonical worked example in this repo is `ToolCatalogTests.Every_Tool_Should_Declare_Exactly_Its_OpenApi_Query_Parameters`; the canonical residual gap is `MARKED_JOBS` in `scripts/tests/test_ci_dropped_step_guard.py`. | 2026-08-13 | [link](records/testing/guard-derives-population-from-source.md) |
 | `testing.guard-ships-with-mutation-proof` | A guard is not considered tested because a test involving it passes. It ships with a MUTATION PROOF: remove or disarm THAT GUARD'S CLAUSE ALONE, and a NAMED test must go red. ONE NAMED EXCEPTION, with its limits, because the rule degenerates without it: where the guard IS a test (a checker enforcing a repo invariant, with no separate script behind it), disarming it makes it ABSENT rather than red, so the proof is the contrapositive — INTRODUCE THE DEFECT THE GUARD EXISTS TO CATCH into an isolated copy of the guarded artifact, and the named test must go red. That is a mutation of the guarded SYSTEM rather than of the assertion, and it is admissible ONLY for checker-guards and ONLY when the mutation was executed and witnessed. It is NOT a licence to grade an ordinary script-guard MUTATION for having a bad-input test: feeding a script an input its clause rejects is BEHAVIOUR-ONLY, which is what three rows were regraded for. A file-level grade under this exception covers the clause its cited case actually mutates, not every assertion that later lands in the same file; clause-level grading is tracked in #790. Three things this excludes, each of which has already shipped here as a green suite over a dead check. FIRST, a behavioural test — one that feeds the guard a good input and a bad input and checks it passes and fails — proves the guard REACTS, never that it is LOAD-BEARING; #685 had two guards on one condition where deleting either left the whole suite green while every behavioural test passed. SECOND, mutating the WHOLE FILE does not count (#510): a whole-file revert cannot show that a test reaches a particular clause, so the mutation must target the clause. THIRD, the guard being WIRED is not the guard RUNNING — #631's suite was invoked by no CI job, #751's step was dropped by the runner and the job reported success in 6s against a normal 14-17s, and #719's new logic was never connected to stdin. Every guard also carries an ANTI-VACUITY assertion, because the characteristic failure of a completeness check is reporting that it proved everything while its population was empty. Mechanical enforcement is possible for the BOOKKEEPING and not for the JUDGEMENT, and the split is the decision: `docs/guard-inventory.md` lists every guard file with its Kind, its Proof class (`MUTATION`/`BEHAVIOUR-ONLY`/`NONE`) and a `file::function` ref, and `scripts/tests/test_guard_inventory.py` derives the guard population from the filesystem and the call sites, asserts SET EQUALITY against the rows, and resolves every claimed ref to a real `def`. So a new guard cannot ship unclassified and a renamed test cannot leave a row silently claiming coverage. What stays with review, and is stated rather than papered over: nothing checks that a row claiming `MUTATION` is telling the truth. | 2026-08-13 | [link](records/testing/guard-ships-with-mutation-proof.md) |
+| `testing.hook-reports-its-own-execution` | Every script in `.claude/hooks/` sources `scripts/hook-fire-log.sh` and calls `etv_hook_fire_begin <its-own-name> <label> <capture\|stream>` as its FIRST act, before anything reads stdin. Two records are appended per invocation — a `fire` record on entry and an `exit` record carrying the exit status and the decision — to a session-scoped JSONL log. THE DECISION IS READ FROM WHAT THE HOOK ACTUALLY EMITTED, never declared by the hook author: Claude Code hooks (`capture` mode) always exit 0 and communicate by PRINTING JSON, so their stdout is diverted and replayed, and the recorded decision is parsed from those bytes; git hooks (`stream` mode) decide by EXIT CODE and their stdout is live progress text a human is watching, so it is not diverted and the decision is the status. That split is not a tuning knob — capturing a slow pre-push hook's output would hold it back until the end and read as a hang, and inferring a git hook's decision from absent JSON would put the report back into the guessing business this record exists to end. The population is DERIVED from `.claude/hooks/*.sh` by `scripts/tests/test_hook_fire_log.py`, so a new hook is uninstrumented-and-red rather than silently unobserved, and the report lists every hook that EXISTS rather than every hook that appears in the log — a report built from the log alone can only show hooks that fired, which makes the never-fired hook, the one finding worth having, invisible. THE INSTRUMENTATION MUST BE INVISIBLE TO THE HARNESS, and this is the load-bearing half: it sits in the stdin and stdout path of the most authoritative guards in the repo, so a differential test drives EVERY hook with and without it over a payload matrix and demands byte-equal stdout and equal exit status. It fails OPEN in exactly one direction — if the log cannot be written the hook behaves exactly as before — because observability that breaks a guard is worse than the blindness it replaces. Two mechanical traps are pinned by tests rather than left to care: stdout must be replayed from the FILE, since `out=$(cat f)` strips trailing newlines and delivers a guard's JSON one byte short with no parser anywhere to complain; and stdin must never be slurped when it is a TTY, because an interactive `git commit` hands its hooks a terminal and `cat` would block forever, hanging the commit the instrumentation was added to observe. | 2026-08-14 | [link](records/testing/hook-reports-its-own-execution.md) |
 | `testing.live-e2e-prepush-timing` | Run live-E2E via `scripts/e2e-local.sh` before pushing a write-path or UI change, and exercise download endpoints with curl, never a browser tab. | 2026-07-21 | [link](records/testing/live-e2e-prepush-timing.md) |
 | `testing.playwright-mcp-download-and-recovery` | In Playwright-MCP E2E, fetch file-download endpoints with curl — never a browser tab or `window.open` — and if browser tools stall repeatedly, `pkill -f ms-playwright-mcp` and drive a fresh session. | 2026-07-21 | [link](records/testing/playwright-mcp-download-and-recovery.md) |
 | `testing.scripted-playout-golden-deferred` | The `PlayoutBuildGoldenTests` in-memory golden net covers Sequential (YAML) as of #381. Scripted's *end-to-end pipeline* is excluded — `ScriptedPlayoutBuilder` runs a user-authored external program that drives the engine over HTTP loopback, which the in-memory harness can't pin — so that full-pipeline (integration) harness is deferred to #563. But the scheduling *behavior* those scripts drive lives entirely in the in-process `SchedulingEngine` (the `ScriptedScheduleController` is a 1:1 pass-through to it), which IS directly unit/golden-testable; the earlier "Scripted is un-golden-able by construction" framing overstated the constraint by conflating transport with engine. #395 extracts that shared switch to `ContentEnumeratorBuilder` and adds a direct regression net (`ContentEnumeratorBuilderTests`) over it. | 2026-07-22 | [link](records/testing/scripted-playout-golden-deferred.md) |
diff --git a/docs/decisions/records/testing/hook-reports-its-own-execution.md b/docs/decisions/records/testing/hook-reports-its-own-execution.md
new file mode 100644
index 000000000..778994160
--- /dev/null
+++ b/docs/decisions/records/testing/hook-reports-its-own-execution.md
@@ -0,0 +1,70 @@
+---
+key: testing.hook-reports-its-own-execution
+title: '2026-08-14 — every hook records that it fired and what it decided, through one shared sink (#776)'
+status: active
+since: '2026-08-14'
+supersedes: none
+superseded-by: none
+rule: 'Every script in `.claude/hooks/` sources `scripts/hook-fire-log.sh` and calls `etv_hook_fire_begin <its-own-name> <label> <capture|stream>` as its FIRST act, before anything reads stdin. Two records are appended per invocation — a `fire` record on entry and an `exit` record carrying the exit status and the decision — to a session-scoped JSONL log. THE DECISION IS READ FROM WHAT THE HOOK ACTUALLY EMITTED, never declared by the hook author: Claude Code hooks (`capture` mode) always exit 0 and communicate by PRINTING JSON, so their stdout is diverted and replayed, and the recorded decision is parsed from those bytes; git hooks (`stream` mode) decide by EXIT CODE and their stdout is live progress text a human is watching, so it is not diverted and the decision is the status. That split is not a tuning knob — capturing a slow pre-push hook''s output would hold it back until the end and read as a hang, and inferring a git hook''s decision from absent JSON would put the report back into the guessing business this record exists to end. The population is DERIVED from `.claude/hooks/*.sh` by `scripts/tests/test_hook_fire_log.py`, so a new hook is uninstrumented-and-red rather than silently unobserved, and the report lists every hook that EXISTS rather than every hook that appears in the log — a report built from the log alone can only show hooks that fired, which makes the never-fired hook, the one finding worth having, invisible. THE INSTRUMENTATION MUST BE INVISIBLE TO THE HARNESS, and this is the load-bearing half: it sits in the stdin and stdout path of the most authoritative guards in the repo, so a differential test drives EVERY hook with and without it over a payload matrix and demands byte-equal stdout and equal exit status. It fails OPEN in exactly one direction — if the log cannot be written the hook behaves exactly as before — because observability that breaks a guard is worse than the blindness it replaces. Two mechanical traps are pinned by tests rather than left to care: stdout must be replayed from the FILE, since `out=$(cat f)` strips trailing newlines and delivers a guard''s JSON one byte short with no parser anywhere to complain; and stdin must never be slurped when it is a TTY, because an interactive `git commit` hands its hooks a terminal and `cat` would block forever, hanging the commit the instrumentation was added to observe.'
+signals: 'hook fire log · did this hook actually fire · PreToolUse leaves no transcript record · make the system report it rather than infer it · capture vs stream mode · byte-equal stdout differential · fail-open observability · never slurp a tty · derived hook population · never-fired row · paths: `scripts/hook-fire-log.sh`, `scripts/tests/test_hook_fire_log.py`, `docs/guard-inventory.md`, `docs/defect-shapes-773.md` · issues: #776, #773, #775, #774, #756, #751, #719, #685, #631'
+mechanics: 'Read side: `scripts/hook-fire-log.sh report [--all|--json|--dir D|--session S]`. Logs default to `$HOME/.cache/ersatztv/hook-fire/<session-id>.jsonl`, outside the repo, overridable with `ETV_HOOK_FIRE_LOG_DIR`; `ETV_HOOK_FIRE_DISABLE=1` turns recording off without editing a hook. The session id comes from the payload''s `.session_id`, because this harness version does not export one to hooks. Records carry no tool arguments — only hook, label, event, tool name, phase, status and decision — so the log is not a second copy of the transcript.'
+---
+
+**The blind spot this closes.** In this harness version only `Stop` hooks emit a structured
+transcript record. `PreToolUse` and `PostToolUse` hooks — which is *every* guard this repo actually
+relies on: merge consent, worktree ownership, BOM, agent model and RAM, the golden-file ban — leave
+no durable execution trace at all. When #773 tried to measure whether they fire, the only available
+signal was **filename mentions in settings dumps and prior audits**, which is not evidence of
+execution. So the guards carrying the most authority were the ones whose execution could only be
+inferred, and a silently broken hook would have looked identical to a working one indefinitely.
+
+That is Family B (the check never ran) applied to the hook layer itself, and this project has
+already paid for it twice one layer down: #751's guard that reported success in 6 seconds having run
+nothing, and #756's fail-open twin that 30 green tests could not see. #756's standing lesson is the
+whole of this record — **make the system report it rather than infer it**.
+
+**Why the decision is parsed from the emitted bytes rather than declared.** The obvious design has
+each decision site announce itself. `pretooluse-merge-consent.sh` alone reaches its output through a
+`decide` helper from roughly forty call sites, so that design is forty edits in the most
+load-bearing guard in the repo, and it records **what the author meant** — which is the inference
+being abolished, reintroduced one layer up. Capturing what the hook printed records what the
+*harness* sees. It cannot drift from the decision because it **is** the decision, and it needed no
+edit to any decision site.
+
+**The risk this takes on, stated plainly.** Reading stdin before the hook and diverting its stdout
+puts this code directly in the path of every guard. Get it wrong and a `deny` is swallowed while the
+log cheerfully reports the guard firing — strictly worse than the blindness it replaces, and
+undetectable from the outside for the same reason the original gap was. That is why the proof
+obligation here is not a unit test of the sink: a wrapper can be perfect alone and lethal in
+context. `test_instrumentation_changes_NOTHING_the_harness_can_see` runs every hook, in both forms,
+over a payload matrix chosen to reach each hook's *deciding* branch rather than its early exit, and
+compares bytes and exit status. A matrix that only ever produced silent allows would prove
+transparency on the one path where there is nothing to be transparent about.
+
+**Three defects this shipped with and the tests that now pin them**, recorded because each was
+invisible to every other check and two would have degraded a guard silently:
+
+| Defect | Why nothing else would catch it | Pinned by |
+|---|---|---|
+| `out=$(cat f)` strips trailing newlines, so a hook's JSON reached the harness one byte short | every JSON parser accepts it; only a byte comparison objects | `test_stdout_is_replayed_BYTE_EXACT` |
+| An unconditional stdin slurp blocks forever on a TTY, hanging every interactive `git commit` | the pipe-fed tests that cover the Claude hooks cannot reach a tty; needs a real pty | `test_a_TTY_stdin_is_not_slurped` |
+| A shared `TMPDIR` let the control run's one-shot throttle marker suppress the instrumented run | the differential test went red and blamed the wrapper for the hook's own correct behaviour | a separate TMPDIR per side |
+
+The third is not a product defect but a measurement one, and it is the more instructive: a
+differential test whose two halves share mutable state stops measuring the difference and starts
+measuring the state. It reported a swallowed decision that never happened.
+
+**What the first measurement immediately produced**, which is the argument for the whole thing. A
+live run recorded `pretooluse-agent-model` firing on an `Agent` dispatch and deciding `no-op` where
+`ask` was expected. Under the old regime that would have been an unanswerable suspicion. Instead the
+question was settled by dumping the real payload: the dispatch carried `model: haiku`, so `no-op`
+was correct and there was no bug. Note what did *not* happen — no argument from the hook's source
+about what it "must" do, which this repo's record says has been wrong repeatedly. One printed line
+settled it in one run.
+
+**The limit, stated rather than implied.** A zero in the report means *not observed in this window*,
+which is two different findings wearing one number: a hook that is broken, and a hook whose trigger
+genuinely did not occur. The report says so in its own footer rather than presenting a zero as a
+verdict. `pretooluse-nav-guard` and `pretooluse-merge-consent` are the standing examples — neither
+can be exercised without either a browser session or a real merge, so their zeroes are expected and
+distinguishing them stays a human judgement.
diff --git a/docs/guard-inventory.md b/docs/guard-inventory.md
index d3f5288d0..3a3bd57a9 100644
--- a/docs/guard-inventory.md
+++ b/docs/guard-inventory.md
@@ -101,6 +101,7 @@ all.
 | `scripts/e2e-functional.sh` | the Functional E2E job, on a failed HTTP contract assertion | GUARD | NONE | — |
 | `scripts/e2e-local.sh` | nothing (boots a local instance) | TOOLING | NONE | — |
 | `scripts/e2e-ui.sh` | nothing (drives the Playwright flows) | TOOLING | NONE | — |
+| `scripts/hook-fire-log.sh` | nothing (records that each hook fired, and reports it) | TOOLING | NONE | — |
 | `scripts/jq-preflight.sh` | the `script-tests` job, on a jq version change | GUARD | BEHAVIOUR-ONLY | `test_jq_preflight.py::test_below_the_floor_is_LOUD` |
 | `scripts/post-review-verdict.sh` | nothing (writes the verdict status) | GUARD | BEHAVIOUR-ONLY | `test_post_review_verdict.py::test_never_retargets_the_verdict_at_the_new_head` |
 | `scripts/pr-changed-files.sh` | the verdict exemption, on an incomplete enumeration | GUARD | BEHAVIOUR-ONLY | `test_pr_changed_files.py::test_a_SHORT_page_does_not_end_the_enumeration` |
@@ -114,6 +115,7 @@ all.
 | `scripts/tests/test_decisions_lib.py` | the `script-tests` job | PROOF | NONE | — |
 | `scripts/tests/test_decisions_validate.py` | the `script-tests` job | PROOF | NONE | — |
 | `scripts/tests/test_guard_inventory.py` | the `script-tests` job, on an unclassified guard or a stale proof ref | GUARD | MUTATION | `test_guard_inventory.py::test_the_inventory_covers_exactly_the_guards_that_exist` |
+| `scripts/tests/test_hook_fire_log.py` | the `script-tests` job, on a hook that stops reporting that it fired, or whose reporting changes what the harness sees | GUARD | MUTATION | `test_hook_fire_log.py::test_a_hook_that_LOSES_its_instrumentation_is_DETECTED` |
 | `scripts/tests/test_jq_preflight.py` | the `script-tests` job | PROOF | NONE | — |
 | `scripts/tests/test_merge_consent_base_change.py` | the `script-tests` job | PROOF | NONE | — |
 | `scripts/tests/test_merge_consent_exemption.py` | the `script-tests` job | PROOF | NONE | — |
@@ -124,7 +126,7 @@ all.
 
 ## What the numbers say
 
-31 guards, 4 tooling scripts, 13 proof files. **5 guards carry a mutation proof; 6 are
+32 guards, 5 tooling scripts, 13 proof files. **6 guards carry a mutation proof; 6 are
 behaviour-only; 20 have none.** These figures are asserted against the table by
 `test_the_summary_counts_match_the_table` — they were wrong in the first draft (28/4/6/3/19 against
 a table holding 27/5/6/3/18), because a hand-maintained summary of a table is a second copy of it,
@@ -176,9 +178,15 @@ the BOM guard was regraded, and `test_the_summary_counts_match_the_table` cannot
 checks the formatted summary sentence and nothing else. A second hand-maintained copy of a number is
 the duplication family this file argues against, so the copy is removed rather than corrected: the
 set is every `PreToolUse` hook except merge-consent and the BOM guard, and the count is in the
-summary above. It is also the population #776 found we
-cannot even observe firing. A guard that is neither proven nor observable is an assertion about the
-past.
+summary above.
+
+**They are now observable but still unproven, and the two words carry different weight.** Observable:
+every hook records its own execution through `scripts/hook-fire-log.sh`, so "did this hook fire, and
+what did it decide" is a measurement — run `scripts/hook-fire-log.sh report` (#776). Unproven:
+nobody has demonstrated any of them is load-bearing, which is what #785 tracks. Observability tells
+you a guard ran; only a mutation tells you it would have caught anything. The BOM guard is the case
+that shows why the distinction matters — it was firing on every commit the whole time it was
+fail-open.
 
 The gaps are not uniform in cost, and the ranking that matters is *what a silent failure would let
 through*, not test count:
diff --git a/scripts/hook-fire-log.sh b/scripts/hook-fire-log.sh
new file mode 100755
index 000000000..4e041f29b
--- /dev/null
+++ b/scripts/hook-fire-log.sh
@@ -0,0 +1,364 @@
+#!/usr/bin/env bash
+# Hook fire log — the WRITE side and the READ side, deliberately in ONE file (ersatztv#776).
+#
+# WHY THIS EXISTS. In this harness version only `Stop` hooks emit a structured transcript record
+# (`stop_hook_summary`/`hookInfos`). `PreToolUse` and `PostToolUse` hooks leave no durable execution
+# trace — which is every guard this repo actually relies on. #773 §5.4 could therefore only count
+# *filename mentions in settings dumps*, i.e. inference. A guard that is neither proven nor
+# observable is an assertion about the past, and a silently broken hook looks identical to a working
+# one indefinitely. #756's standing lesson: make the system REPORT it rather than infer it.
+#
+# WHY ONE FILE. The reader and the writer share the record format. Two files means the format can
+# drift and the report can quietly describe a shape nothing writes any more — the same argument that
+# put `scripts/ci-step-ran.sh` in one script instead of an inline workflow body (#756).
+#
+# WHY IT CAPTURES STDOUT RATHER THAN BEING TOLD THE DECISION. Every hook here exits 0 always; the
+# decision is communicated by *printing* `hookSpecificOutput.permissionDecision` (PreToolUse) or
+# `decision` (Stop). `pretooluse-merge-consent.sh` alone reaches that print from ~40 call sites via
+# its `decide` helper. Asking each site to also set a variable would (a) be 40 edits in the most
+# load-bearing guard in the repo and (b) record what the author *meant*, which is the inference this
+# issue exists to abolish. Capturing the bytes the hook actually emits records what the HARNESS
+# sees. It cannot drift from the decision because it IS the decision.
+#
+# WHY IT CAPTURES STDIN. 8 of the 9 hooks already open with `input=$(cat)` — a full blocking slurp —
+# so reading stdin once here and replaying it via `exec 0<` is not a new risk, it is the read they
+# already perform, moved earlier. It buys the tool name and session id for the log, and it makes
+# `pretooluse-agent-ram.sh` (which reads no stdin at all today) observable on the same terms as the
+# rest instead of being a hole in the table.
+#
+# FAIL-OPEN, DELIBERATELY AND IN THIS DIRECTION ONLY. This file is observability, not a guard. If
+# anything here fails — no temp dir, unwritable log, missing `date` — the hook must behave EXACTLY as
+# it did before instrumentation. A logging bug that denies a merge, or that swallows a guard's deny
+# JSON, would be far worse than the blindness it is fixing. Every function returns 0, the stdout
+# replay is the first act of the exit path, and the original exit code is re-raised explicitly.
+#
+# USAGE (write side) — the first two lines of every hook, before anything reads stdin:
+#     . "${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+#     etv_hook_fire_begin <hook-name> [label]
+#
+# USAGE (read side):
+#     scripts/hook-fire-log.sh report                # this session (or every session, see below)
+#     scripts/hook-fire-log.sh report --all          # every session in the log dir
+#     scripts/hook-fire-log.sh report --json
+#     scripts/hook-fire-log.sh path                  # where the current session logs
+#
+# `scripts/tests/test_hook_fire_log.py` is the guard: it derives the hook population from the
+# filesystem (never a list — `testing.guard-derives-population-from-source`) and fails if any hook
+# is uninstrumented, and it proves stdin, stdout and the exit code survive the wrapper.
+
+# ---------------------------------------------------------------------------------------------
+# Shared: where the log lives, and how a record is written
+# ---------------------------------------------------------------------------------------------
+
+etv_hook_fire_log_dir() {
+  printf '%s' "${ETV_HOOK_FIRE_LOG_DIR:-${HOME:-/tmp}/.cache/ersatztv/hook-fire}"
+}
+
+etv_hook_fire_session() {
+  # The harness does not export a session id to hooks in this version, so the payload's
+  # `.session_id` is the real source and the env var is only a fallback. Recorded rather than
+  # assumed: several hooks already read `.session_id` from stdin for exactly this reason.
+  printf '%s' "${ETV_HOOK_FIRE_SESSION:-${CLAUDE_SESSION_ID:-unknown-session}}"
+}
+
+etv_hook_fire_log_file() {
+  printf '%s/%s.jsonl' "$(etv_hook_fire_log_dir)" "$(etv_hook_fire_session)"
+}
+
+# Sanitise a value to a safe JSON scalar charset. This is why no `jq` is needed on the write side:
+# with the value space restricted there is nothing to escape, so there is no escaping bug to have.
+# A quote, backslash or newline in a hook name or tool name is not a case worth supporting — it is a
+# case worth flattening, loudly, to `_`.
+etv_hook_fire_scrub() {
+  printf '%s' "${1:-}" | tr -c 'A-Za-z0-9._/:+@=-' '_' | cut -c1-200
+}
+
+# Append one record. Never fails; never writes a partial line (built whole, appended once).
+etv_hook_fire_record() {
+  [ "${ETV_HOOK_FIRE_DISABLE:-0}" = "1" ] && return 0
+
+  local file line
+  file="${ETV_HOOK_FIRE_LOG_FILE:-$(etv_hook_fire_log_file)}"
+  mkdir -p "$(dirname "$file")" 2>/dev/null || return 0
+
+  line=$(printf '{"ts":"%s","session":"%s","pid":"%s","hook":"%s","label":"%s","event":"%s","tool":"%s","phase":"%s","code":"%s","decision":"%s"}' \
+    "$(date -u '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null || printf 'unknown')" \
+    "$(etv_hook_fire_scrub "$(etv_hook_fire_session)")" \
+    "$(etv_hook_fire_scrub "${ETV_HOOK_FIRE_PID:-$$}")" \
+    "$(etv_hook_fire_scrub "${1:-}")" \
+    "$(etv_hook_fire_scrub "${2:-}")" \
+    "$(etv_hook_fire_scrub "${3:-}")" \
+    "$(etv_hook_fire_scrub "${4:-}")" \
+    "$(etv_hook_fire_scrub "${5:-}")" \
+    "$(etv_hook_fire_scrub "${6:-}")" \
+    "$(etv_hook_fire_scrub "${7:-}")" 2>/dev/null) || return 0
+
+  printf '%s\n' "$line" >> "$file" 2>/dev/null || true
+  return 0
+}
+
+# ---------------------------------------------------------------------------------------------
+# Write side: what a hook calls
+# ---------------------------------------------------------------------------------------------
+
+# Classify what the hook printed. The harness reads these two shapes and nothing else:
+#   PreToolUse : {"hookSpecificOutput":{"permissionDecision":"allow|deny|ask", ...}}
+#   Stop       : {"decision":"block", "reason": ...}
+# Anything else printed on stdout is surfaced to the user but decides nothing.
+etv_hook_fire_classify() {
+  local out="${1:-}" code="${2:-0}" mode="${3:-capture}" d=""
+
+  # A `stream`-mode hook is a git hook: git reads its exit code and nothing else, so that is the
+  # whole of its decision. Reporting `no-op` here because no JSON was captured would be an
+  # inference, and inference is what this file exists to replace.
+  if [ "$mode" = "stream" ]; then
+    if [ "$code" = "0" ]; then printf 'pass'; else printf 'blocked'; fi
+    return 0
+  fi
+
+  if [ -n "$out" ]; then
+    d=$(printf '%s' "$out" | sed -n 's/.*"permissionDecision"[[:space:]]*:[[:space:]]*"\([a-z]*\)".*/\1/p' | head -n1)
+    [ -z "$d" ] && d=$(printf '%s' "$out" | sed -n 's/.*"decision"[[:space:]]*:[[:space:]]*"\([a-z]*\)".*/\1/p' | head -n1)
+    # `additionalContext` with no decision (design-sync-reminder's `start` path) informs, it does
+    # not gate. Naming it distinctly keeps it out of the allow/deny counts.
+    if [ -z "$d" ] && printf '%s' "$out" | grep -q 'additionalContext'; then d="context"; fi
+    [ -z "$d" ] && d="output"
+  fi
+
+  # Exit 2 is the harness's non-JSON block channel. No hook here uses it today; it is classified
+  # anyway so that a hook which starts using it is not silently recorded as a no-op.
+  if [ "$code" = "2" ] && [ -z "$d" ]; then d="deny-exit2"; fi
+  [ -z "$d" ] && d="no-op"
+  [ "$code" != "0" ] && [ "$code" != "2" ] && d="error"
+
+  printf '%s' "$d"
+}
+
+# etv_hook_fire_begin <hook-name> [label] [stdout-mode]
+#
+# `stdout-mode` is `capture` (default) or `stream`, and the split is not a tuning knob — the two
+# kinds of hook in this repo decide by different channels:
+#
+#   Claude Code hooks (pretooluse-*, posttooluse-*, design-sync-reminder) always exit 0 and
+#   communicate by PRINTING JSON. Their decision is only observable by capturing stdout, and their
+#   output is a single line consumed by the harness after exit, so buffering costs nothing.
+#
+#   Git hooks (prepush-*, decisions-guard) decide by EXIT CODE, and their stdout is progress text a
+#   human is watching in real time. Capturing it would hold a slow pre-push hook's output back until
+#   the end, turning a working progress display into an apparent hang. They pass `stream`, and their
+#   decision is read from the exit code, which is what git reads too.
+etv_hook_fire_begin() {
+  ETV_HOOK_FIRE_NAME="${1:-unknown-hook}"
+  ETV_HOOK_FIRE_LABEL="${2:-}"
+  ETV_HOOK_FIRE_MODE="${3:-capture}"
+  ETV_HOOK_FIRE_PID="$$"
+  ETV_HOOK_FIRE_STDIN_TMP=""
+  ETV_HOOK_FIRE_STDOUT_TMP=""
+
+  [ "${ETV_HOOK_FIRE_DISABLE:-0}" = "1" ] && return 0
+
+  ETV_HOOK_FIRE_LOG_FILE="$(etv_hook_fire_log_file)"
+  mkdir -p "$(dirname "$ETV_HOOK_FIRE_LOG_FILE")" 2>/dev/null || { ETV_HOOK_FIRE_DISABLE=1; return 0; }
+
+  # --- stdin: slurp, replay, and read the payload's identifying fields ------------------------
+  #
+  # NEVER on a terminal. A `git commit` run interactively hands its hooks a TTY on fd 0, and `cat`
+  # would block there forever — instrumentation hanging the commit it was added to observe. Claude
+  # Code always writes the JSON payload and closes the pipe, which is why the 8 hooks that already
+  # open with `input=$(cat)` are safe today; that guarantee does not extend to the git hooks, so the
+  # capture is conditioned on stdin not being a tty rather than on which hook is calling.
+  local sin payload="" event="" tool="" sess=""
+  if [ ! -t 0 ]; then
+    sin=$(mktemp "${TMPDIR:-/tmp}/etv-hook-stdin.XXXXXX" 2>/dev/null) || sin=""
+  else
+    sin=""
+  fi
+  if [ -n "$sin" ]; then
+    ETV_HOOK_FIRE_STDIN_TMP="$sin"
+    cat > "$sin" 2>/dev/null || true
+    # Replay unconditionally: even a partial capture is closer to the truth than the drained pipe
+    # the hook would otherwise inherit.
+    exec 0<"$sin" 2>/dev/null || true
+    payload=$(head -c 65536 "$sin" 2>/dev/null || true)
+  fi
+
+  if [ -n "$payload" ]; then
+    event=$(printf '%s' "$payload" | sed -n 's/.*"hook_event_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
+    tool=$(printf '%s' "$payload" | sed -n 's/.*"tool_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
+    sess=$(printf '%s' "$payload" | sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
+  fi
+
+  # The payload's session id is authoritative when the env var is absent, which it is in this
+  # harness version. Re-point the log file at it before the first record is written.
+  if [ -n "$sess" ] && [ -z "${CLAUDE_SESSION_ID:-}" ] && [ -z "${ETV_HOOK_FIRE_SESSION:-}" ]; then
+    ETV_HOOK_FIRE_SESSION="$sess"
+    ETV_HOOK_FIRE_LOG_FILE="$(etv_hook_fire_log_file)"
+    mkdir -p "$(dirname "$ETV_HOOK_FIRE_LOG_FILE")" 2>/dev/null || true
+  fi
+
+  ETV_HOOK_FIRE_EVENT="$event"
+  ETV_HOOK_FIRE_TOOL="$tool"
+
+  etv_hook_fire_record "$ETV_HOOK_FIRE_NAME" "$ETV_HOOK_FIRE_LABEL" "$event" "$tool" "fire" "" ""
+
+  # --- stdout: divert, so the exit path can read the decision the hook emitted ----------------
+  local sout=""
+  if [ "$ETV_HOOK_FIRE_MODE" = "capture" ]; then
+    sout=$(mktemp "${TMPDIR:-/tmp}/etv-hook-stdout.XXXXXX" 2>/dev/null) || sout=""
+  fi
+  if [ -n "$sout" ]; then
+    ETV_HOOK_FIRE_STDOUT_TMP="$sout"
+    exec 3>&1 || { ETV_HOOK_FIRE_STDOUT_TMP=""; rm -f "$sout" 2>/dev/null; return 0; }
+    exec 1>"$sout" || { exec 1>&3 3>&-; ETV_HOOK_FIRE_STDOUT_TMP=""; rm -f "$sout" 2>/dev/null; return 0; }
+  fi
+
+  trap 'etv_hook_fire_end "$?"' EXIT
+  return 0
+}
+
+etv_hook_fire_end() {
+  local code="${1:-0}" out=""
+
+  # RESTORE AND REPLAY FIRST. Everything after this point is bookkeeping; if any of it dies, the
+  # hook has already said what it came to say. Getting this order wrong would let an instrumentation
+  # bug swallow a `deny`, which is the one outcome worse than not logging at all.
+  if [ -n "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ] && [ -f "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ]; then
+    exec 1>&3 3>&- 2>/dev/null || true
+    # `cat` the FILE, not a variable. `out=$(cat f)` strips trailing newlines, so replaying from a
+    # variable delivers the hook's JSON one byte short of what it wrote. Caught by
+    # `test_stdout_is_replayed_BYTE_EXACT` — which was written because the first version of this
+    # function did exactly that, and the shortfall is invisible to every JSON parser that would
+    # otherwise have been the only reader.
+    cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true
+    # A separate read for CLASSIFICATION only, where losing a trailing newline is harmless.
+    out=$(head -c 65536 "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true)
+  fi
+
+  etv_hook_fire_record \
+    "${ETV_HOOK_FIRE_NAME:-unknown-hook}" "${ETV_HOOK_FIRE_LABEL:-}" \
+    "${ETV_HOOK_FIRE_EVENT:-}" "${ETV_HOOK_FIRE_TOOL:-}" \
+    "exit" "$code" "$(etv_hook_fire_classify "$out" "$code" "${ETV_HOOK_FIRE_MODE:-capture}")" || true
+
+  rm -f "${ETV_HOOK_FIRE_STDIN_TMP:-}" "${ETV_HOOK_FIRE_STDOUT_TMP:-}" 2>/dev/null || true
+
+  # Re-raise the hook's own status explicitly rather than relying on the trap preserving it. Bash
+  # does not re-enter an EXIT trap, so this is not recursive.
+  exit "$code"
+}
+
+# ---------------------------------------------------------------------------------------------
+# Read side: the report
+# ---------------------------------------------------------------------------------------------
+
+# The hook population, DERIVED from the filesystem, never listed
+# (`testing.guard-derives-population-from-source`). A hook added tomorrow appears in the report as
+# NEVER-FIRED the moment it exists, rather than being invisible because nobody updated an array.
+etv_hook_fire_population() {
+  local root="${1:-}" f
+  [ -d "$root/.claude/hooks" ] || return 0
+  for f in "$root"/.claude/hooks/*.sh; do
+    [ -f "$f" ] || continue
+    basename "$f" .sh
+  done
+}
+
+etv_hook_fire_repo_root() {
+  if [ -n "${CLAUDE_PROJECT_DIR:-}" ] && [ -d "$CLAUDE_PROJECT_DIR/.claude/hooks" ]; then
+    printf '%s' "$CLAUDE_PROJECT_DIR"
+    return 0
+  fi
+  ( cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." >/dev/null 2>&1 && pwd )
+}
+
+etv_hook_fire_report() {
+  local all=0 as_json=0 dir root files hook
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --all) all=1 ;;
+      --json) as_json=1 ;;
+      --dir) shift; ETV_HOOK_FIRE_LOG_DIR="${1:-}" ;;
+      --session) shift; ETV_HOOK_FIRE_SESSION="${1:-}" ;;
+      *) printf 'hook-fire-log: unknown report option %s\n' "$1" >&2; return 2 ;;
+    esac
+    shift
+  done
+
+  dir="$(etv_hook_fire_log_dir)"
+  root="$(etv_hook_fire_repo_root)"
+
+  if [ "$all" = "1" ]; then
+    files=$(find "$dir" -name '*.jsonl' -type f 2>/dev/null | sort)
+  else
+    files="$(etv_hook_fire_log_file)"
+    [ -f "$files" ] || files=""
+  fi
+
+  if [ -z "$files" ]; then
+    printf 'hook-fire-log: no records under %s%s\n' "$dir" \
+      "$([ "$all" = "1" ] || printf ' for session %s (try --all)' "$(etv_hook_fire_session)")" >&2
+  fi
+
+  # ANTI-VACUITY. A report over an empty population would print a clean table of nothing and read
+  # as "all hooks accounted for" — the exact failure this file exists to end.
+  local pop
+  pop=$(etv_hook_fire_population "$root")
+  if [ -z "$pop" ]; then
+    printf 'hook-fire-log: found NO hook scripts under %s/.claude/hooks — refusing to report, because a report over an empty population reads as full coverage.\n' "$root" >&2
+    return 2
+  fi
+
+  local total_fires=0 rows=""
+  while IFS= read -r hook; do
+    [ -n "$hook" ] || continue
+    local fires decisions
+    fires=0
+    decisions=""
+    if [ -n "$files" ]; then
+      fires=$(cat $files 2>/dev/null | grep -c "\"hook\":\"$hook\",.*\"phase\":\"fire\"" || true)
+      decisions=$(cat $files 2>/dev/null \
+        | grep "\"hook\":\"$hook\",.*\"phase\":\"exit\"" \
+        | sed -n 's/.*"decision":"\([^"]*\)".*/\1/p' \
+        | sort | uniq -c | sort -rn \
+        | awk '{printf "%s=%s ", $2, $1}')
+    fi
+    [ -z "$fires" ] && fires=0
+    total_fires=$((total_fires + fires))
+    if [ "$as_json" = "1" ]; then
+      rows="${rows}{\"hook\":\"$hook\",\"fires\":$fires,\"decisions\":\"$(printf '%s' "$decisions" | tr -d '"')\"}\n"
+    else
+      rows="$(printf '%s%-34s %6s  %s\n' "$rows" "$hook" "$fires" "${decisions:-—}")"$'\n'
+    fi
+  done <<EOF
+$pop
+EOF
+
+  if [ "$as_json" = "1" ]; then
+    printf '{"log_dir":"%s","total_fires":%s,"hooks":[%s]}\n' "$dir" "$total_fires" \
+      "$(printf '%b' "$rows" | sed '/^$/d' | paste -sd, -)"
+    return 0
+  fi
+
+  printf 'Hook fire log — %s\n' "$dir"
+  printf '%-34s %6s  %s\n' 'HOOK' 'FIRES' 'DECISIONS'
+  printf '%s' "$rows"
+  printf '\n%s hook scripts on disk, %s recorded fires.\n' "$(printf '%s\n' "$pop" | wc -l | tr -d ' ')" "$total_fires"
+  printf 'A hook showing 0 has NOT been observed firing. That is a finding to investigate (broken\nwiring vs genuinely never matched in this window), not a blank to ignore.\n'
+  return 0
+}
+
+# ---------------------------------------------------------------------------------------------
+# CLI (only when executed, never when sourced)
+# ---------------------------------------------------------------------------------------------
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+  set -uo pipefail
+  case "${1:-report}" in
+    report) shift 2>/dev/null || true; etv_hook_fire_report "$@" ;;
+    path)   etv_hook_fire_log_file; printf '\n' ;;
+    record) shift; etv_hook_fire_record "$@" ;;
+    *)
+      printf 'usage: %s [report [--all|--json|--dir D|--session S] | path]\n' "$0" >&2
+      exit 2
+      ;;
+  esac
+fi
diff --git a/scripts/tests/test_hook_fire_log.py b/scripts/tests/test_hook_fire_log.py
new file mode 100644
index 000000000..723a307fa
--- /dev/null
+++ b/scripts/tests/test_hook_fire_log.py
@@ -0,0 +1,490 @@
+"""Every hook reports that it fired, and the reporting changes nothing else (ersatztv#776).
+
+Two separable claims, and conflating them is how instrumentation ships as a regression:
+
+  1. COVERAGE — every hook script records its own execution. The population is DERIVED from
+     `.claude/hooks/*.sh`, never listed, per `testing.guard-derives-population-from-source`, so a
+     hook added tomorrow is uninstrumented-and-red rather than silently unobserved.
+
+  2. TRANSPARENCY — the wrapper is invisible to the harness. It slurps stdin and replays it, and it
+     diverts stdout and replays it, which puts it directly in the path of the most load-bearing
+     guards in this repo. If it drops a byte of a `deny` payload or swallows an exit code, it
+     disables a guard while reporting that the guard fired. That is strictly worse than the
+     blindness #776 set out to fix, so the differential test below drives EVERY hook, with and
+     without the instrumentation, over a payload matrix and demands byte-equal stdout and equal
+     exit status.
+
+The mutation proof for claim 1 is the contrapositive form allowed by
+`testing.guard-ships-with-mutation-proof` for a checker-guard: the defect the guard exists to catch
+(an uninstrumented hook) is introduced into an isolated copy of the guarded artifact, and the named
+check must go red. See `test_a_hook_that_LOSES_its_instrumentation_is_DETECTED`.
+
+Claim 2's proof is not a mutation of an assertion but a real A/B over the real scripts, which is the
+only thing that can establish it — a unit test of the wrapper in isolation would pass on a wrapper
+that is fine alone and lethal in context.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import pty
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+HOOKS_DIR = REPO_ROOT / ".claude" / "hooks"
+SINK = REPO_ROOT / "scripts" / "hook-fire-log.sh"
+
+# The three lines a hook must carry. Matched structurally rather than as one frozen blob so that a
+# comment reflow does not redden the suite, but the two things that matter — sourcing the single
+# shared sink, and calling begin with this hook's own name — are both pinned.
+_SOURCES_SINK = re.compile(r'^\[ -r "\$ETV_HOOK_FIRE_LIB" \] && \. "\$ETV_HOOK_FIRE_LIB" \|\| true$', re.M)
+_BEGINS = re.compile(r"^etv_hook_fire_begin (\S+) .*\|\| true$", re.M)
+
+
+def hook_scripts() -> list[Path]:
+    """THE POPULATION, from the filesystem. Never a list."""
+    return sorted(HOOKS_DIR.glob("*.sh"))
+
+
+def instrumentation_faults(text: str, name: str) -> list[str]:
+    """The check itself, factored out so a mutation can be fed to the same code the suite runs."""
+    faults = []
+    if not _SOURCES_SINK.search(text):
+        faults.append(f"{name}: does not source scripts/hook-fire-log.sh")
+    m = _BEGINS.search(text)
+    if not m:
+        faults.append(f"{name}: never calls etv_hook_fire_begin")
+    elif m.group(1) != name:
+        faults.append(f"{name}: calls etv_hook_fire_begin for {m.group(1)!r}, not for itself")
+    else:
+        # Order is the whole point: 8 of the hooks slurp stdin with `input=$(cat)`, and a begin
+        # placed after that read would find the pipe already drained — recording a fire with no
+        # tool name, and replaying nothing into a hook that has already consumed its payload.
+        stdin_read = text.find("$(cat)")
+        if 0 <= stdin_read < m.start():
+            faults.append(f"{name}: reads stdin before etv_hook_fire_begin")
+    return faults
+
+
+def strip_instrumentation(text: str) -> str:
+    """Reconstruct the pre-#776 script. Used BOTH as the mutation and as the A/B control."""
+    out, skipping = [], False
+    for line in text.splitlines(keepends=True):
+        if line.startswith("# ersatztv#776 —"):
+            skipping = True
+            continue
+        if skipping:
+            if line.startswith(("#", "ETV_HOOK_FIRE_LIB=", "[ -r ", "etv_hook_fire_begin ")):
+                continue
+            skipping = False
+        out.append(line)
+    return "".join(out)
+
+
+# ------------------------------------------------------------------------------------------------
+# ANTI-VACUITY FIRST — a glob that stopped matching would make every assertion below iterate over
+# nothing and report full coverage. That is the characteristic failure of a completeness check, and
+# this repo has shipped it (#631, #751), so it is asserted before anything depends on it.
+# ------------------------------------------------------------------------------------------------
+
+
+def test_the_population_is_not_empty():
+    hooks = hook_scripts()
+    assert len(hooks) >= 10, (
+        f"only found {len(hooks)} hook scripts under {HOOKS_DIR} — the glob has stopped matching, "
+        "so every coverage assertion in this file is vacuous."
+    )
+    assert SINK.exists(), "the shared sink is missing; the instrumentation cannot work"
+    assert os.access(SINK, os.X_OK), "the sink is not executable, so its report side cannot be run"
+
+
+def test_the_stripper_actually_strips():
+    """The A/B control and the mutation are the same function. If it were a no-op, the differential
+    test would compare each hook against itself and pass on a wrapper that breaks everything."""
+    for hook in hook_scripts():
+        text = hook.read_text()
+        stripped = strip_instrumentation(text)
+        assert stripped != text, f"{hook.name}: strip_instrumentation() removed nothing"
+        assert "etv_hook_fire_begin" not in stripped, f"{hook.name}: begin survived the strip"
+        assert not instrumentation_faults(text, hook.stem), f"{hook.name} is not instrumented"
+
+
+# ------------------------------------------------------------------------------------------------
+# CLAIM 1 — COVERAGE
+# ------------------------------------------------------------------------------------------------
+
+
+def test_every_hook_reports_that_it_fired():
+    faults = []
+    for hook in hook_scripts():
+        faults += instrumentation_faults(hook.read_text(), hook.stem)
+    assert not faults, (
+        "these hooks do not report their own execution:\n  " + "\n  ".join(faults) +
+        "\n\nAdd the three-line preamble after the `set -` line and BEFORE any stdin read. A hook "
+        "that does not report is one whose firing we can only infer, which is ersatztv#776."
+    )
+
+
+def test_a_hook_that_LOSES_its_instrumentation_is_DETECTED():
+    """THE MUTATION PROOF (contrapositive form, for a checker-guard).
+
+    Introduce the defect this guard exists to catch — an uninstrumented hook — into an isolated copy
+    of each hook in turn, and the check must report it. Every hook, not a sample: the interesting
+    loss is whichever file someone actually edits.
+    """
+    for hook in hook_scripts():
+        mutated = strip_instrumentation(hook.read_text())
+        faults = instrumentation_faults(mutated, hook.stem)
+        assert faults, (
+            f"stripping the instrumentation from {hook.name} left the check GREEN. The check is "
+            "not load-bearing — it would not notice a hook silently losing its reporting."
+        )
+
+
+def test_begin_placed_AFTER_the_stdin_read_is_DETECTED():
+    """The subtler mutation: present but too late. Ordering is the property that makes it work."""
+    late = 'set -euo pipefail\ninput=$(cat)\nETV_HOOK_FIRE_LIB="x"\n[ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true\netv_hook_fire_begin demo "" capture || true\n'
+    faults = instrumentation_faults(late, "demo")
+    assert any("reads stdin before" in f for f in faults), (
+        "a begin call placed after `input=$(cat)` was accepted. It would record a fire with no "
+        f"payload and replay nothing. faults={faults}"
+    )
+
+
+# ------------------------------------------------------------------------------------------------
+# CLAIM 2 — TRANSPARENCY. The wrapper must be invisible to the harness.
+# ------------------------------------------------------------------------------------------------
+
+# Payloads chosen to reach the DECIDING branch of each hook, not merely its early-exit. A matrix
+# that only ever produced silent allows would prove the wrapper transparent on the one path where
+# there is nothing to be transparent about.
+PAYLOADS = {
+    "bash-deny": '{"session_id":"s","hook_event_name":"PreToolUse","tool_name":"Bash","cwd":"%(cwd)s","tool_input":{"command":"ETV_UPDATE_GOLDENS=1 dotnet test"}}',
+    "bash-allow": '{"session_id":"s","hook_event_name":"PreToolUse","tool_name":"Bash","cwd":"%(cwd)s","tool_input":{"command":"ls -la"}}',
+    "git-commit": '{"session_id":"s","hook_event_name":"PreToolUse","tool_name":"Bash","cwd":"%(cwd)s","tool_input":{"command":"git commit -m x"}}',
+    "nav-deny": '{"session_id":"s","hook_event_name":"PreToolUse","tool_name":"mcp__x__navigate","cwd":"%(cwd)s","tool_input":{"url":"http://h/iptv/channels.m3u"}}',
+    "agent-no-model": '{"session_id":"s","hook_event_name":"PreToolUse","tool_name":"Agent","cwd":"%(cwd)s","tool_input":{"description":"d","prompt":"p"}}',
+    "agent-model": '{"session_id":"s","hook_event_name":"PreToolUse","tool_name":"Agent","cwd":"%(cwd)s","tool_input":{"description":"d","prompt":"p","model":"sonnet"}}',
+    "merge": '{"session_id":"s","hook_event_name":"PreToolUse","tool_name":"mcp__gitea__pull_request_write","cwd":"%(cwd)s","tool_input":{"method":"merge","owner":"timothy","repo":"ersatztv","pull_number":1}}',
+    "worktree-add": '{"session_id":"s","hook_event_name":"PostToolUse","tool_name":"Bash","cwd":"%(cwd)s","tool_input":{"command":"git worktree add /tmp/nope-%(nonce)s HEAD"}}',
+    "ui-edit": '{"session_id":"s","hook_event_name":"PreToolUse","tool_name":"Edit","cwd":"%(cwd)s","tool_input":{"file_path":"web/src/screens/Channels.tsx"}}',
+    "empty": "",
+    "garbage": "not json at all",
+}
+
+
+@pytest.fixture(scope="module")
+def sandbox(tmp_path_factory):
+    """A controlled environment so the A/B pair cannot differ for reasons unrelated to the wrapper.
+
+    `memory_pressure` is stubbed because `pretooluse-agent-ram.sh` reads live free RAM: a real
+    reading that crossed the 10% or 20% threshold between the two runs would make the A and B halves
+    disagree for a reason that has nothing to do with instrumentation, and a differential test that
+    flakes is one that gets rerun until green.
+    """
+    root = tmp_path_factory.mktemp("hookfire")
+    bindir = root / "bin"
+    bindir.mkdir()
+    stub = bindir / "memory_pressure"
+    stub.write_text("#!/bin/sh\necho 'System-wide memory free percentage: 42%'\n")
+    stub.chmod(0o755)
+
+    env = dict(os.environ)
+    env["PATH"] = f"{bindir}:{env['PATH']}"
+    env["ETV_HOOK_FIRE_LOG_DIR"] = str(root / "log")
+    env["CLAUDE_PROJECT_DIR"] = str(REPO_ROOT)
+    # No creds: `pretooluse-merge-consent.sh` must take its documented "cannot derive state" path
+    # rather than making live Gitea calls from a unit test.
+    for k in ("ETV_GITEA_TOKEN", "ETV_GITEA_BASICAUTH"):
+        env.pop(k, None)
+    return root, env
+
+
+def _run(script: Path, payload: str, env: dict, cwd: Path, arg: str | None = None):
+    cmd = ["bash", str(script)] + ([arg] if arg else [])
+    p = subprocess.run(
+        cmd, input=payload.encode(), capture_output=True, cwd=str(cwd), env=env, timeout=60
+    )
+    return p.returncode, p.stdout
+
+
+@pytest.mark.parametrize("hook", hook_scripts(), ids=lambda h: h.stem)
+def test_instrumentation_changes_NOTHING_the_harness_can_see(hook, sandbox):
+    """THE REGRESSION NET. Every hook, every payload, byte-equal stdout and equal exit status.
+
+    This is what stands between #776 and having silently disarmed the guard set while adding a log
+    that cheerfully reports every hook firing.
+    """
+    root, env = sandbox
+    control = root / f"control-{hook.name}"
+    control.write_text(strip_instrumentation(hook.read_text()))
+
+    # `design-sync-reminder.sh` dispatches on argv[1], so both of its branches are exercised.
+    args = [None, "start", "finish"] if hook.stem == "design-sync-reminder" else [None]
+
+    for name, template in PAYLOADS.items():
+        for arg in args:
+            payload = template % {"cwd": str(root), "nonce": name}
+
+            # A SEPARATE TMPDIR PER SIDE, not per pair. `design-sync-reminder.sh` throttles itself
+            # with a marker file under $TMPDIR, so a shared one let the control fire and then
+            # silently suppress the instrumented run — the A/B reported a swallowed decision that
+            # was really the hook's own one-shot behaviour working correctly. Sharing state between
+            # the two halves of a differential test makes it measure the state, not the difference.
+            def side(tag: str) -> dict:
+                e = dict(env)
+                e["TMPDIR"] = str(root / f"tmp-{name}-{arg}-{tag}")
+                Path(e["TMPDIR"]).mkdir(parents=True, exist_ok=True)
+                return e
+
+            rc_a, out_a = _run(control, payload, side("control"), root, arg)
+            rc_b, out_b = _run(hook, payload, side("instrumented"), root, arg)
+
+            label = f"{hook.name} payload={name} arg={arg}"
+            assert rc_a == rc_b, f"{label}: exit status changed {rc_a} -> {rc_b}"
+            assert out_a == out_b, (
+                f"{label}: stdout changed.\n  without: {out_a!r}\n  with:    {out_b!r}"
+            )
+
+
+def test_stdout_is_replayed_BYTE_EXACT(sandbox):
+    """Pinned separately from the A/B because the first version of the sink lost exactly one byte.
+
+    `out=$(cat file)` strips trailing newlines, so the hook's JSON reached the harness a newline
+    short. Every JSON parser accepts it, so nothing downstream would ever have complained — the only
+    thing that catches it is comparing bytes.
+    """
+    root, env = sandbox
+    hook = root / "trailing.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -euo pipefail\n"
+        f'. "{SINK}"\n'
+        "etv_hook_fire_begin trailing \"\" capture || true\n"
+        "input=$(cat)\n"
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}\n\n"' + "\n"
+    )
+    rc, out = _run(hook, '{"tool_name":"Bash"}', env, root)
+    assert rc == 0
+    assert out == b'{"hookSpecificOutput":{"permissionDecision":"deny"}}\n\n', (
+        f"trailing bytes were altered: {out!r}"
+    )
+
+
+@pytest.mark.parametrize("code", [0, 1, 2, 3])
+def test_the_exit_code_is_preserved(sandbox, code):
+    """Exit 2 is the harness's block channel and non-zero is git's. A wrapper that normalised the
+    status to 0 would turn every git hook into a rubber stamp while logging that it ran."""
+    root, env = sandbox
+    hook = root / f"exit{code}.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        f'etv_hook_fire_begin exit{code} "" capture || true\n'
+        f"exit {code}\n"
+    )
+    rc, _ = _run(hook, "{}", env, root)
+    assert rc == code, f"exit {code} came back as {rc}"
+
+
+def test_stdin_reaches_the_hook_intact(sandbox):
+    """The wrapper reads stdin before the hook does. If it did not replay it faithfully, every
+    guard that parses `.tool_input` would see an empty payload and fail open, silently."""
+    root, env = sandbox
+    payload = '{"tool_name":"Bash","tool_input":{"command":"echo \\"quoted\\" && ls"},"session_id":"s"}'
+    hook = root / "echo-stdin.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -euo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin echo-stdin "" capture || true\n'
+        "input=$(cat)\nprintf '%s' \"$input\"\n"
+    )
+    rc, out = _run(hook, payload, env, root)
+    assert rc == 0
+    assert out.decode() == payload, f"stdin was altered:\n  sent: {payload}\n  saw:  {out.decode()}"
+
+
+def test_a_TTY_stdin_is_not_slurped(sandbox):
+    """The hang this nearly shipped with.
+
+    An interactive `git commit` hands its hooks a terminal on fd 0. `cat` on a tty blocks until the
+    user types EOF, so an unconditional slurp would freeze every commit — instrumentation hanging
+    the very thing it was added to observe. Driven through a real pty, because the `[ ! -t 0 ]`
+    guard is precisely what a pipe-based test cannot exercise.
+    """
+    root, env = sandbox
+    hook = root / "tty.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin ttyhook "" stream || true\n'
+        "echo ALIVE\n"
+    )
+    master, slave = pty.openpty()
+    try:
+        p = subprocess.Popen(
+            ["bash", str(hook)], stdin=slave, stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL, cwd=str(root), env=env,
+        )
+        os.close(slave)
+        try:
+            out, _ = p.communicate(timeout=20)
+        except subprocess.TimeoutExpired:
+            p.kill()
+            pytest.fail(
+                "the hook hung with a tty on stdin — the instrumentation slurped a terminal, "
+                "which would freeze every interactive `git commit`."
+            )
+    finally:
+        os.close(master)
+    assert b"ALIVE" in out
+
+
+def test_logging_failure_does_not_break_the_hook(sandbox):
+    """Fail-open, in the one direction that is correct here. This file is observability; if it
+    cannot write, the guard must still guard. The inverse — a logging bug that swallows a `deny` —
+    is the failure mode the A/B test above exists to prevent."""
+    root, env = sandbox
+    bad = dict(env)
+    bad["ETV_HOOK_FIRE_LOG_DIR"] = "/dev/null/cannot-exist"
+    hook = root / "failopen.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -euo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin failopen "" capture || true\n'
+        "input=$(cat)\n"
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
+    )
+    rc, out = _run(hook, '{"tool_name":"Bash"}', bad, root)
+    assert rc == 0
+    assert out == b'{"hookSpecificOutput":{"permissionDecision":"deny"}}', (
+        f"an unwritable log dir changed the hook's decision output: {out!r}"
+    )
+
+
+# ------------------------------------------------------------------------------------------------
+# THE RECORD ITSELF, and the report over it
+# ------------------------------------------------------------------------------------------------
+
+
+@pytest.mark.parametrize(
+    "emit,mode,expected",
+    [
+        (r'{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}', "capture", "deny"),
+        (r'{\"hookSpecificOutput\":{\"permissionDecision\":\"ask\"}}', "capture", "ask"),
+        (r'{\"hookSpecificOutput\":{\"permissionDecision\":\"allow\"}}', "capture", "allow"),
+        (r'{\"hookSpecificOutput\":{\"additionalContext\":\"hi\"}}', "capture", "context"),
+        (r'{\"decision\":\"block\",\"reason\":\"r\"}', "capture", "block"),
+        ("", "capture", "no-op"),
+        ("", "stream", "pass"),
+    ],
+)
+def test_the_recorded_decision_is_the_one_the_hook_emitted(sandbox, emit, mode, expected):
+    """The decision in the log is derived from the bytes the harness receives, never from something
+    the hook author remembered to declare. That is the whole difference between this and inference.
+    """
+    root, env = sandbox
+    logdir = root / f"log-{expected}-{mode}"
+    runenv = dict(env)
+    runenv["ETV_HOOK_FIRE_LOG_DIR"] = str(logdir)
+
+    hook = root / f"decide-{expected}-{mode}.sh"
+    body = f'printf "{emit}"\n' if emit else ""
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        f'etv_hook_fire_begin decider "" {mode} || true\n'
+        "input=$(cat)\n" + body
+    )
+    rc, _ = _run(hook, '{"session_id":"sess1","tool_name":"Bash"}', runenv, root)
+    assert rc == 0
+
+    records = (logdir / "sess1.jsonl").read_text().splitlines()
+    exits = [r for r in records if '"phase":"exit"' in r]
+    assert len(exits) == 1, f"expected one exit record, got {records}"
+    assert f'"decision":"{expected}"' in exits[0], f"expected {expected} in {exits[0]}"
+    assert any('"phase":"fire"' in r for r in records), "no fire record was written"
+
+
+def test_a_stream_mode_hook_that_BLOCKS_is_recorded_as_blocked(sandbox):
+    """A git hook decides by exit code; recording a non-zero exit as `pass` would put the report
+    back into the business of inferring, with the answer inverted on the only path that matters."""
+    root, env = sandbox
+    logdir = root / "log-blocked"
+    runenv = dict(env)
+    runenv["ETV_HOOK_FIRE_LOG_DIR"] = str(logdir)
+    hook = root / "blocker.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin blocker "" stream || true\n'
+        "input=$(cat)\nexit 1\n"
+    )
+    rc, _ = _run(hook, '{"session_id":"sess1"}', runenv, root)
+    assert rc == 1
+    assert '"decision":"blocked"' in (logdir / "sess1.jsonl").read_text()
+
+
+def test_the_report_names_hooks_that_NEVER_fired(sandbox):
+    """The finding #776 asks for is the ZERO row, so the report must derive its rows from the hooks
+    that exist rather than from the hooks that happen to appear in the log. A report built from the
+    log alone can only ever show hooks that fired, and would print a clean table while the broken
+    hook is the one missing from it."""
+    root, env = sandbox
+    logdir = root / "log-report"
+    logdir.mkdir()
+    (logdir / "sessX.jsonl").write_text(
+        '{"ts":"t","session":"sessX","pid":"1","hook":"pretooluse-bash-guard","label":"",'
+        '"event":"PreToolUse","tool":"Bash","phase":"fire","code":"","decision":""}\n'
+        '{"ts":"t","session":"sessX","pid":"1","hook":"pretooluse-bash-guard","label":"",'
+        '"event":"PreToolUse","tool":"Bash","phase":"exit","code":"0","decision":"deny"}\n'
+    )
+    p = subprocess.run(
+        ["bash", str(SINK), "report", "--all", "--dir", str(logdir)],
+        capture_output=True, cwd=str(REPO_ROOT), env=env, timeout=60,
+    )
+    out = p.stdout.decode()
+    assert p.returncode == 0, p.stderr.decode()
+    assert "pretooluse-bash-guard" in out and "deny=1" in out
+
+    for hook in hook_scripts():
+        assert hook.stem in out, (
+            f"{hook.stem} is absent from the report. Only hooks present in the log were listed, so "
+            "a hook that never fires — the finding this report exists to surface — is invisible."
+        )
+    zero_rows = [ln for ln in out.splitlines() if re.search(r"\s0\s", ln)]
+    assert zero_rows, "no never-fired rows shown despite only one hook appearing in the log"
+
+
+def test_the_report_REFUSES_an_empty_population(tmp_path, sandbox):
+    """Anti-vacuity on the read side. A report over zero hooks would print a tidy empty table and
+    read as 'all hooks accounted for' — the shape of #751's 6-second green.
+
+    The sink is COPIED into a hook-less tree rather than pointed at one via `CLAUDE_PROJECT_DIR`,
+    because the real script deliberately falls back to its own location when that variable names a
+    tree with no hooks. That fallback is correct — it is what makes `scripts/hook-fire-log.sh
+    report` work from anywhere — and the first version of this test drove the fallback straight back
+    into the real repo, so it was asserting against all 13 live hooks while claiming to test the
+    empty case.
+    """
+    _, env = sandbox
+    fake_scripts = tmp_path / "scripts"
+    fake_scripts.mkdir()
+    copied = fake_scripts / "hook-fire-log.sh"
+    copied.write_text(SINK.read_text())
+    copied.chmod(0o755)
+
+    runenv = dict(env)
+    runenv.pop("CLAUDE_PROJECT_DIR", None)
+    p = subprocess.run(
+        ["bash", str(copied), "report", "--all", "--dir", str(tmp_path / "log")],
+        capture_output=True, cwd=str(tmp_path), env=runenv, timeout=60,
+    )
+    assert p.returncode == 2, (
+        "the report exited 0 over an empty hook population. It must refuse rather than print a "
+        f"clean table of nothing. stdout={p.stdout.decode()!r}"
+    )
+    assert b"refusing to report" in p.stderr
-- 
2.47.3


From fc65b5fbe3042448876962812dda423f7dc1e3c7 Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 09:08:14 +0200
Subject: [PATCH 02/14] docs(776,784): state the hazard, not the author's
 timeline

Applies ersatztv#784's who-benefits test to this change's own prose: if only
the author's timeline explains why a sentence is there, it is narrative. Three
comments said "the first version of this did X" where the reader only needs the
hazard and the reason nothing downstream would catch it.

One of the three turned into a real correction rather than a reword. The
byte-exactness test was justified as "the A/B does not cover this", which is
sharper and also true: the A/B compares the two halves against each other, so a
wrapper that truncated BOTH would pass it. Only comparing against the literal
expected bytes catches that.

Refs: #776
Refs: #784

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 scripts/hook-fire-log.sh            |  7 +++----
 scripts/tests/test_hook_fire_log.py | 21 +++++++++++----------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/scripts/hook-fire-log.sh b/scripts/hook-fire-log.sh
index 4e041f29b..8b2c454eb 100755
--- a/scripts/hook-fire-log.sh
+++ b/scripts/hook-fire-log.sh
@@ -225,10 +225,9 @@ etv_hook_fire_end() {
   if [ -n "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ] && [ -f "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ]; then
     exec 1>&3 3>&- 2>/dev/null || true
     # `cat` the FILE, not a variable. `out=$(cat f)` strips trailing newlines, so replaying from a
-    # variable delivers the hook's JSON one byte short of what it wrote. Caught by
-    # `test_stdout_is_replayed_BYTE_EXACT` — which was written because the first version of this
-    # function did exactly that, and the shortfall is invisible to every JSON parser that would
-    # otherwise have been the only reader.
+    # variable delivers the hook's JSON one byte short of what it wrote — and every JSON parser
+    # downstream accepts the short form, so nothing would ever complain. Pinned by
+    # `test_stdout_is_replayed_BYTE_EXACT`.
     cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true
     # A separate read for CLASSIFICATION only, where losing a trailing newline is harmless.
     out=$(head -c 65536 "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true)
diff --git a/scripts/tests/test_hook_fire_log.py b/scripts/tests/test_hook_fire_log.py
index 723a307fa..46dafbcf8 100644
--- a/scripts/tests/test_hook_fire_log.py
+++ b/scripts/tests/test_hook_fire_log.py
@@ -252,11 +252,12 @@ def test_instrumentation_changes_NOTHING_the_harness_can_see(hook, sandbox):
 
 
 def test_stdout_is_replayed_BYTE_EXACT(sandbox):
-    """Pinned separately from the A/B because the first version of the sink lost exactly one byte.
+    """Pinned separately from the A/B, because the A/B cannot see this class of loss.
 
-    `out=$(cat file)` strips trailing newlines, so the hook's JSON reached the harness a newline
-    short. Every JSON parser accepts it, so nothing downstream would ever have complained — the only
-    thing that catches it is comparing bytes.
+    `out=$(cat file)` strips trailing newlines, so replaying stdout through a variable delivers the
+    hook's JSON a newline short. Every JSON parser accepts the short form, and the A/B compares the
+    two halves against each other rather than against what the hook wrote — so a wrapper that
+    truncated BOTH would pass it. Only comparing against the literal expected bytes catches this.
     """
     root, env = sandbox
     hook = root / "trailing.sh"
@@ -463,12 +464,12 @@ def test_the_report_REFUSES_an_empty_population(tmp_path, sandbox):
     """Anti-vacuity on the read side. A report over zero hooks would print a tidy empty table and
     read as 'all hooks accounted for' — the shape of #751's 6-second green.
 
-    The sink is COPIED into a hook-less tree rather than pointed at one via `CLAUDE_PROJECT_DIR`,
-    because the real script deliberately falls back to its own location when that variable names a
-    tree with no hooks. That fallback is correct — it is what makes `scripts/hook-fire-log.sh
-    report` work from anywhere — and the first version of this test drove the fallback straight back
-    into the real repo, so it was asserting against all 13 live hooks while claiming to test the
-    empty case.
+    The sink must be COPIED into a hook-less tree, not merely pointed at one via
+    `CLAUDE_PROJECT_DIR`. The script deliberately falls back to its own location when that variable
+    names a tree with no hooks — that fallback is correct, it is what makes `hook-fire-log.sh
+    report` work from any directory — but it means setting the variable alone lands the report back
+    on the real repo's 13 live hooks, and the test would then assert against a full population while
+    claiming to exercise the empty one.
     """
     _, env = sandbox
     fake_scripts = tmp_path / "scripts"
-- 
2.47.3


From 773151be14f8064f4bf47bae2ca25626faa08f85 Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 09:09:55 +0200
Subject: [PATCH 03/14] docs(776): re-derive 773 section 5.4 from measurement,
 not inference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Section 5.4 said we cannot tell whether our own hooks fire, and could only count
filename mentions in settings dumps. It now carries a per-hook table with the
decision each hook reached: 11 of 13 confirmed firing, including a real deny
from pretooluse-bash-guard blocking an ETV_UPDATE_GOLDENS probe, which is what
distinguishes "this guard ran" from "this guard is present".

The two zeroes are named as the not-exercised kind rather than presented as a
verdict — nav-guard needs a live browser and merge-consent needs a real merge,
and manufacturing a merge to watch the merge guard is worse than the gap.

Refs: #776

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 docs/defect-shapes-773.md | 74 ++++++++++++++++++++++++++++++---------
 1 file changed, 58 insertions(+), 16 deletions(-)

diff --git a/docs/defect-shapes-773.md b/docs/defect-shapes-773.md
index bf073c669..c54a37906 100644
--- a/docs/defect-shapes-773.md
+++ b/docs/defect-shapes-773.md
@@ -474,23 +474,65 @@ and 5,102 `Read` calls over the same corpus, so the search was demonstrably capa
 evidence in transcripts (`husky - dotnet format found whitespace/BOM issues`, `husky - commit message
 missing Co-Authored-By trailer`, `husky - refusing to commit root-level screenshot(s)`).
 
-### 5.4 We cannot currently tell whether our own hooks fire
+Wiring was the strongest claim available for the hook rows when this table was written. It is no
+longer the ceiling — §5.4 is now measured — so read the hook rows against
+`scripts/hook-fire-log.sh report`, not against this paragraph.
 
-The most consequential Part 2 finding, and it was volunteered by the inventory as a limit on its own
-evidence. In this harness version only **`Stop`** hooks emit a structured record
-(`stop_hook_summary`/`hookInfos`). `PreToolUse` and `PostToolUse` hooks — which is *every* guard that
-matters here: merge consent, worktree, BOM, agent model/RAM — leave **no durable execution trace**.
-What the audit could count for those hooks was filename mentions in settings dumps and prior audits,
-which is not proof of execution. Only `design-sync-reminder.sh`'s Stop path and the three husky
-message strings quoted in §5.3 are confirmed fires; the `.claude/hooks/` scripts are confirmed
-*wired*, which is a different claim.
+### 5.4 Whether our own hooks fire — now measured (#776 closed this)
 
-So the guards this repo relies on most are exactly the ones whose execution we cannot observe. That
-is Family B (the check never ran) applied to the hook layer itself, and this project has already
-paid for it twice at the CI layer — #751's guard that reported success in 6s having run nothing, and
-#756's fail-open twin. The standing lesson from #756 applies unchanged: **make the system report it
-rather than infer it.** A one-line append to a session-scoped log from each hook would convert every
-row in that table from inference to measurement, and it is cheap.
+**The finding as originally recorded.** In this harness version only `Stop` hooks emit a structured
+record (`stop_hook_summary`/`hookInfos`). `PreToolUse` and `PostToolUse` hooks — which is *every*
+guard that matters here: merge consent, worktree, BOM, agent model/RAM — leave no durable execution
+trace. What this audit could count for those hooks was filename mentions in settings dumps, which is
+not evidence of execution. So the guards this repo relies on most were exactly the ones whose
+execution could only be inferred: Family B (the check never ran) applied to the hook layer itself,
+after this project had already paid for it twice at the CI layer (#751, #756).
+
+**What replaced the inference.** Every hook now records its own execution through one shared sink,
+`scripts/hook-fire-log.sh` (`testing.hook-reports-its-own-execution`): a `fire` record on entry and
+an `exit` record carrying the status and the decision, where **the decision is parsed from the bytes
+the hook actually emitted** rather than declared by its author. Read it with
+`scripts/hook-fire-log.sh report [--all]`.
+
+**Measured 2026-08-14** — a scripted headless session (a plain Bash call, a Bash call carrying
+`ETV_UPDATE_GOLDENS=1`, a `Write` to a SPA file, and one `Agent` dispatch) plus a real `git commit`
+and a `git push --dry-run` in a worktree. Snapshot boundary: this is one deliberately-constructed
+window, not a corpus statistic.
+
+| Hook | Event | Fires | Decisions observed |
+|---|---|---|---|
+| `pretooluse-bash-guard` | PreToolUse/Bash | 2 | `deny` 1, `no-op` 1 |
+| `pretooluse-bom-guard` | PreToolUse/Bash | 2 | `no-op` 2 |
+| `pretooluse-worktree-guard` | PreToolUse/Bash | 2 | `no-op` 2 |
+| `posttooluse-worktree-marker` | PostToolUse/Bash | 1 | `no-op` 1 |
+| `design-sync-reminder` | PreToolUse/Write + Stop | 4 | `context` 1, `block` 1, `no-op` 2 |
+| `pretooluse-agent-model` | PreToolUse/Agent | 2 | `no-op` 2 |
+| `pretooluse-agent-ram` | PreToolUse/Agent | 2 | `no-op` 2 |
+| `decisions-guard` | git pre-commit | 2 | `pass` 2 |
+| `prepush-clean-worktree-check` | git pre-push | 1 | `pass` 1 |
+| `prepush-donewhen` | git pre-push | 1 | `pass` 1 |
+| `prepush-rebase-check` | git pre-push | 1 | `pass` 1 |
+| `pretooluse-nav-guard` | PreToolUse/navigate | **0** | not exercised — needs a live browser session |
+| `pretooluse-merge-consent` | PreToolUse/PR write | **0** | not exercised — needs a real merge attempt |
+
+**11 of 13 hooks are confirmed firing, with the decision each reached.** The `deny` row is the load-
+bearing one: `pretooluse-bash-guard` did not merely run, it *blocked* the `ETV_UPDATE_GOLDENS=1`
+probe, so at least one guard in this set is demonstrably live rather than merely present.
+
+**A zero is two findings wearing one number** — a hook that is broken, and a hook whose trigger did
+not occur — and the report says so rather than presenting a zero as a verdict. The two zeroes here
+are the second kind: neither can be exercised without a browser session or a real merge, and
+manufacturing a merge to observe the merge guard is a worse idea than the gap it would close.
+Distinguishing the two cases stays a human judgement; what changed is that the question is now
+askable at all.
+
+**The measurement earned its keep on its first run.** `pretooluse-agent-model` was recorded deciding
+`no-op` on an `Agent` dispatch where `ask` was expected. Previously that would have been an
+unanswerable suspicion about a guard nobody could observe; instead the real payload was dumped and
+it carried `model: haiku`, so `no-op` was correct and there was no defect. The general form is the
+standing #756 lesson — **make the system report it rather than infer it** — and note what it
+displaced: an argument from the hook's source about what it "must" do, which is the reasoning shape
+§3 measures going wrong repeatedly.
 
 ### 5.5 Tools we do *not* have that would address a named class
 
@@ -533,7 +575,7 @@ This issue is analysis; it spawns implementation rather than doing it.
 |---|---|---|---|
 | #774 | **A** — a guard derives its population from the authoritative source and asserts set equality | Family A, 27 records (39%) | high |
 | #775 | **B** — every guard ships a mutation proof: delete that guard alone, see red | Family B, 9 records (13%) | high |
-| #776 | Make hooks report that they fired — PreToolUse/PostToolUse execution is unobservable | the whole hook layer | high |
+| #776 | Make hooks report that they fired — PreToolUse/PostToolUse execution is unobservable | the whole hook layer | high — **DONE**, §5.4 is measured |
 | #777 | `csharp-lsp` and `typescript-lsp` are broken; the "workflow agents must use csharp-lsp" note is stale | partial mitigation for Family A | medium |
 | #778 | **D** — pin a version or use compare-and-set for read-then-write against live remote state | Family D, 5 records | medium |
 | #779 | **F + G** — test the deny path with the production config value; assert full-replace field lists | fail-open + destructive-replace, ~8 records | medium |
-- 
2.47.3


From 183df2bb3d1c2910cb4787a3e531e7a115a18bc8 Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 14:03:53 +0200
Subject: [PATCH 04/14] fix(776): the instrumentation was silencing every
 hook's stderr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round 2, from two independent cold reviews. The headline defect was found by
the test the reviews prompted rather than by the reviews themselves:

  exec 0<"$sin" 2>/dev/null

reads as "suppress errors from this redirection". It is not. `exec` with
redirections and no command applies them to the shell PERMANENTLY, so this sent
each hook's ENTIRE stderr to /dev/null. Every husky guard's user-facing output
is stderr — the H6 "push to main BLOCKED" message, the BOM guard's remediation
text, the missing-trailer message — so the guards went on blocking correctly
while telling the human nothing about why. Invisible to the original A/B, which
compared only stdout and exit status.

The finding that exposed it was ranked Low ("the A/B ignores stderr").

Also fixed, each with an executed proof:

- The fd restore sat inside the same conditional as the replay, and the replay
  read the PATH, so an unlinked-but-open scratch file meant a swallowed `deny`
  at exit 0. Restore is now unconditional and the replay reads through a held
  fd, which survives unlink.
- A SIGTERMed hook lost output it had already printed (52 bytes -> 0). Bash runs
  no EXIT trap for an untrapped fatal signal; INT/TERM/HUP are trapped now.
- The classifier misreported an uppercase decision as prose, read the bare word
  additionalContext in free text as a decision, and let a non-zero exit ERASE a
  decision the hook really printed.
- The session id reached the log FILENAME unscrubbed. The first fix reused the
  record scrubber, which deliberately keeps `/` and `.`, so `../../escaped` went
  through untouched: passing a value through a scrub is not the same as passing
  it through the right scrub.
- Preamble line 1 could abort a `set -e` hook, turning a fail-open guard
  fail-closed; and a missing sink printed `command not found` to stderr.

The big one is test quality. `test_instrumentation_changes_NOTHING_the_harness_
can_see` was 160/165 empty-vs-empty and 165/165 exit-0-vs-exit-0, so deleting
the whole replay left it green for four hooks, two of which issue `deny`. Three
places claimed the matrix reached every deciding branch, including the decision
record. It now constructs the missing cases — a foreign worktree marker, a BOM
`.cs` in an *ersatztv*-named repo, stubbed memory_pressure, a real bare remote
for the three pre-push guards, a stub Gitea for prepush-donewhen — and
test_the_AB_is_not_VACUOUS_for_any_hook fails unless each hook has a case where
the control side actually says something.

Running pytest also wrote 115 synthetic fires into the production log, so the
report described the test suite while looking like a record of real sessions.
scripts/tests/conftest.py isolates every test; verified live, a full suite run
now leaves the real log untouched.

Refs: #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .claude/hooks/decisions-guard.sh              |   3 +-
 .claude/hooks/design-sync-reminder.sh         |   3 +-
 .claude/hooks/posttooluse-worktree-marker.sh  |   3 +-
 .claude/hooks/prepush-clean-worktree-check.sh |   3 +-
 .claude/hooks/prepush-donewhen.sh             |   3 +-
 .claude/hooks/prepush-rebase-check.sh         |   3 +-
 .claude/hooks/pretooluse-agent-model.sh       |   3 +-
 .claude/hooks/pretooluse-agent-ram.sh         |   3 +-
 .claude/hooks/pretooluse-bash-guard.sh        |   3 +-
 .claude/hooks/pretooluse-bom-guard.sh         |   3 +-
 .claude/hooks/pretooluse-merge-consent.sh     |   3 +-
 .claude/hooks/pretooluse-nav-guard.sh         |   3 +-
 .claude/hooks/pretooluse-worktree-guard.sh    |   3 +-
 .../testing/hook-reports-its-own-execution.md |  51 +-
 docs/defect-shapes-773.md                     |  20 +-
 scripts/hook-fire-log.sh                      | 114 ++-
 scripts/tests/conftest.py                     |  29 +
 scripts/tests/test_hook_fire_log.py           | 675 +++++++++++++++++-
 18 files changed, 843 insertions(+), 85 deletions(-)
 create mode 100644 scripts/tests/conftest.py

diff --git a/.claude/hooks/decisions-guard.sh b/.claude/hooks/decisions-guard.sh
index ce22df507..55527cd1e 100755
--- a/.claude/hooks/decisions-guard.sh
+++ b/.claude/hooks/decisions-guard.sh
@@ -7,8 +7,9 @@ set -uo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # git hook: decides by exit code, and its stdout is live progress text.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin decisions-guard "" stream || true
 cd "$(git rev-parse --show-toplevel)" || exit 0
 command -v python3 >/dev/null 2>&1 || exit 0            # no python -> fail-open
diff --git a/.claude/hooks/design-sync-reminder.sh b/.claude/hooks/design-sync-reminder.sh
index 8a90d9e8e..95768849d 100755
--- a/.claude/hooks/design-sync-reminder.sh
+++ b/.claude/hooks/design-sync-reminder.sh
@@ -19,8 +19,9 @@ set -euo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # Claude hook: decides by printed JSON, so stdout is captured.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin design-sync-reminder "${1:-}" capture || true
 
 UI_RE='(^|/)web/src/.*\.(tsx|css)$'
diff --git a/.claude/hooks/posttooluse-worktree-marker.sh b/.claude/hooks/posttooluse-worktree-marker.sh
index f481bc407..548f00e69 100755
--- a/.claude/hooks/posttooluse-worktree-marker.sh
+++ b/.claude/hooks/posttooluse-worktree-marker.sh
@@ -7,8 +7,9 @@ set -euo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # Claude hook: decides by printed JSON, so stdout is captured.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin posttooluse-worktree-marker "" capture || true
 input=$(cat)
 cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
diff --git a/.claude/hooks/prepush-clean-worktree-check.sh b/.claude/hooks/prepush-clean-worktree-check.sh
index a384ba607..4e015b103 100755
--- a/.claude/hooks/prepush-clean-worktree-check.sh
+++ b/.claude/hooks/prepush-clean-worktree-check.sh
@@ -17,8 +17,9 @@ set -uo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # git hook: decides by exit code, and its stdout is live progress text.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin prepush-clean-worktree-check "" stream || true
 
 [ "${ETV_ALLOW_DIRTY_PUSH:-}" = "1" ] && exit 0
diff --git a/.claude/hooks/prepush-donewhen.sh b/.claude/hooks/prepush-donewhen.sh
index b7c64c16a..0ed19b3a0 100755
--- a/.claude/hooks/prepush-donewhen.sh
+++ b/.claude/hooks/prepush-donewhen.sh
@@ -14,8 +14,9 @@ set -euo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # git hook: decides by exit code, and its stdout is live progress text.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin prepush-donewhen "" stream || true
 
 # git passes "<localref> <localsha> <remoteref> <remotesha>" lines on stdin.
diff --git a/.claude/hooks/prepush-rebase-check.sh b/.claude/hooks/prepush-rebase-check.sh
index a76c24858..161354290 100755
--- a/.claude/hooks/prepush-rebase-check.sh
+++ b/.claude/hooks/prepush-rebase-check.sh
@@ -11,8 +11,9 @@ set -uo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # git hook: decides by exit code, and its stdout is live progress text.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin prepush-rebase-check "" stream || true
 
 [ "${ETV_SKIP_REBASE_CHECK:-}" = "1" ] && exit 0
diff --git a/.claude/hooks/pretooluse-agent-model.sh b/.claude/hooks/pretooluse-agent-model.sh
index 520f99dd1..b12625344 100755
--- a/.claude/hooks/pretooluse-agent-model.sh
+++ b/.claude/hooks/pretooluse-agent-model.sh
@@ -42,8 +42,9 @@ set -uo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # Claude hook: decides by printed JSON, so stdout is captured.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin pretooluse-agent-model "" capture || true
 
 input=$(cat)
diff --git a/.claude/hooks/pretooluse-agent-ram.sh b/.claude/hooks/pretooluse-agent-ram.sh
index acf258f7f..9bdc4f311 100755
--- a/.claude/hooks/pretooluse-agent-ram.sh
+++ b/.claude/hooks/pretooluse-agent-ram.sh
@@ -6,8 +6,9 @@ set -euo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # Claude hook: decides by printed JSON, so stdout is captured.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin pretooluse-agent-ram "" capture || true
 free=$(memory_pressure -Q 2>/dev/null | grep -oE 'free percentage: [0-9]+' | grep -oE '[0-9]+' || true)
 [ -z "${free:-}" ] && exit 0
diff --git a/.claude/hooks/pretooluse-bash-guard.sh b/.claude/hooks/pretooluse-bash-guard.sh
index c9da6e459..7a22e8173 100755
--- a/.claude/hooks/pretooluse-bash-guard.sh
+++ b/.claude/hooks/pretooluse-bash-guard.sh
@@ -5,8 +5,9 @@ set -euo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # Claude hook: decides by printed JSON, so stdout is captured.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin pretooluse-bash-guard "" capture || true
 input=$(cat)
 cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
diff --git a/.claude/hooks/pretooluse-bom-guard.sh b/.claude/hooks/pretooluse-bom-guard.sh
index 387c7fd92..7f3f6010b 100755
--- a/.claude/hooks/pretooluse-bom-guard.sh
+++ b/.claude/hooks/pretooluse-bom-guard.sh
@@ -20,8 +20,9 @@ set -uo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # Claude hook: decides by printed JSON, so stdout is captured.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin pretooluse-bom-guard "" capture || true
 
 input=$(cat)
diff --git a/.claude/hooks/pretooluse-merge-consent.sh b/.claude/hooks/pretooluse-merge-consent.sh
index 69ecc5157..bc72eb97b 100755
--- a/.claude/hooks/pretooluse-merge-consent.sh
+++ b/.claude/hooks/pretooluse-merge-consent.sh
@@ -43,8 +43,9 @@ set -euo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # Claude hook: decides by printed JSON, so stdout is captured.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin pretooluse-merge-consent "" capture || true
 input=$(cat)
 
diff --git a/.claude/hooks/pretooluse-nav-guard.sh b/.claude/hooks/pretooluse-nav-guard.sh
index 1bae8aadc..fc884519f 100755
--- a/.claude/hooks/pretooluse-nav-guard.sh
+++ b/.claude/hooks/pretooluse-nav-guard.sh
@@ -5,8 +5,9 @@ set -euo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # Claude hook: decides by printed JSON, so stdout is captured.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin pretooluse-nav-guard "" capture || true
 input=$(cat)
 url=$(printf '%s' "$input" | jq -r '.tool_input.url // ""' 2>/dev/null || true)
diff --git a/.claude/hooks/pretooluse-worktree-guard.sh b/.claude/hooks/pretooluse-worktree-guard.sh
index 77eb450ba..30983ea57 100755
--- a/.claude/hooks/pretooluse-worktree-guard.sh
+++ b/.claude/hooks/pretooluse-worktree-guard.sh
@@ -11,8 +11,9 @@ set -euo pipefail
 
 # ersatztv#776 — report that this hook fired. MUST precede any stdin read.
 # Claude hook: decides by printed JSON, so stdout is captured.
-ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)}/scripts/hook-fire-log.sh"
+ETV_HOOK_FIRE_LIB="${CLAUDE_PROJECT_DIR:-$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." 2>/dev/null && pwd)}/scripts/hook-fire-log.sh" || true
 [ -r "$ETV_HOOK_FIRE_LIB" ] && . "$ETV_HOOK_FIRE_LIB" || true
+type etv_hook_fire_begin >/dev/null 2>&1 || etv_hook_fire_begin() { :; }
 etv_hook_fire_begin pretooluse-worktree-guard "" capture || true
 input=$(cat)
 cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)
diff --git a/docs/decisions/records/testing/hook-reports-its-own-execution.md b/docs/decisions/records/testing/hook-reports-its-own-execution.md
index 778994160..f1c7ba28e 100644
--- a/docs/decisions/records/testing/hook-reports-its-own-execution.md
+++ b/docs/decisions/records/testing/hook-reports-its-own-execution.md
@@ -34,25 +34,50 @@ edit to any decision site.
 **The risk this takes on, stated plainly.** Reading stdin before the hook and diverting its stdout
 puts this code directly in the path of every guard. Get it wrong and a `deny` is swallowed while the
 log cheerfully reports the guard firing — strictly worse than the blindness it replaces, and
-undetectable from the outside for the same reason the original gap was. That is why the proof
-obligation here is not a unit test of the sink: a wrapper can be perfect alone and lethal in
-context. `test_instrumentation_changes_NOTHING_the_harness_can_see` runs every hook, in both forms,
-over a payload matrix chosen to reach each hook's *deciding* branch rather than its early exit, and
-compares bytes and exit status. A matrix that only ever produced silent allows would prove
-transparency on the one path where there is nothing to be transparent about.
+undetectable from the outside for the same reason the original gap was. So the proof obligation is
+not a unit test of the sink: a wrapper can be perfect alone and lethal in context.
+`test_instrumentation_changes_NOTHING_the_harness_can_see` runs every hook in both forms and
+compares stdout bytes, stderr bytes and exit status.
 
-**Three defects this shipped with and the tests that now pin them**, recorded because each was
-invisible to every other check and two would have degraded a guard silently:
+**A differential test is only as good as the cases it drives, and this one had to be measured rather
+than asserted.** A hook that emits nothing and exits 0 makes the comparison `("", 0) == ("", 0)`,
+which passes on a wrapper that discards everything. Measured on the first version of the matrix: 160
+of 165 comparisons were empty-against-empty and 165 of 165 compared exit 0 against exit 0, so
+deleting the entire replay left the test green for four hooks, two of which issue `deny`. The three
+places that claimed the matrix "reaches each hook's deciding branch" — including this record — were
+simply wrong. The structure that replaces the claim:
+
+- a broad, cheap payload matrix, which reaches the deciding branch of a few hooks;
+- `positives()`, which CONSTRUCTS the rest — a sibling worktree carrying a foreign owner marker, an
+  `*ersatztv*`-named repo with a staged BOM `.cs`, `memory_pressure` stubbed at 5% and 15%, a real
+  bare remote so the three pre-push guards can be driven to a genuine block, and a stub Gitea so
+  `prepush-donewhen` is exercised rather than exempted;
+- `test_the_AB_is_not_VACUOUS_for_any_hook`, which fails unless each hook has at least one case
+  where the control side emits output or exits non-zero.
+
+One hook is exempt and the exemption is stated rather than assumed: `posttooluse-worktree-marker.sh`
+emits nothing and exits 0 by design — its entire output is a marker file — so its transparency is
+asserted on that file instead.
+
+**Five defects this shipped with, all found by cold review or by the tests it prompted.** Recorded
+because each was invisible to every other check, and because the ranking is instructive: the worst
+one was surfaced by a finding ranked *Low*.
 
 | Defect | Why nothing else would catch it | Pinned by |
 |---|---|---|
+| `exec 0<"$sin" 2>/dev/null` sent the hook's **entire stderr** to /dev/null for its whole life — `exec` with no command redirects the shell permanently. Every husky guard's user-facing output is stderr, so guards blocked while explaining nothing | the A/B compared only stdout and exit status | `test_stderr_is_NOT_silenced` |
+| The fd restore lived inside the same conditional as the replay, and the replay read the PATH — so an unlinked-but-open scratch file meant a swallowed `deny` and an exit 0 | needs `mktemp` stubbed or the file removed mid-run | `test_output_SURVIVES_a_vanished_stdout_tempfile` |
+| A hook killed by the harness timeout lost output it had already printed: 52 bytes before, 0 after | bash runs no EXIT trap for an untrapped fatal signal, and no test sent one | `test_output_survives_a_SIGTERM` |
 | `out=$(cat f)` strips trailing newlines, so a hook's JSON reached the harness one byte short | every JSON parser accepts it; only a byte comparison objects | `test_stdout_is_replayed_BYTE_EXACT` |
-| An unconditional stdin slurp blocks forever on a TTY, hanging every interactive `git commit` | the pipe-fed tests that cover the Claude hooks cannot reach a tty; needs a real pty | `test_a_TTY_stdin_is_not_slurped` |
-| A shared `TMPDIR` let the control run's one-shot throttle marker suppress the instrumented run | the differential test went red and blamed the wrapper for the hook's own correct behaviour | a separate TMPDIR per side |
+| An unconditional stdin slurp blocks forever on a TTY, hanging every interactive `git commit` | the pipe-fed tests cannot reach a tty; needs a real pty | `test_a_TTY_stdin_is_not_slurped` |
 
-The third is not a product defect but a measurement one, and it is the more instructive: a
-differential test whose two halves share mutable state stops measuring the difference and starts
-measuring the state. It reported a swallowed decision that never happened.
+Two further notes, both about fixes that read as done and were not. The path-traversal hardening for
+the session id first reused the record scrubber, which deliberately keeps `/` and `.` — so
+`../../escaped` passed through untouched and the fix read as applied while changing nothing;
+**passing a value through a scrub is not the same as passing it through the right scrub.** And a
+shared `TMPDIR` between the two halves of the differential let the control's one-shot throttle marker
+suppress the instrumented run, so the test reported a swallowed decision that never happened: a
+differential whose halves share mutable state stops measuring the difference and measures the state.
 
 **What the first measurement immediately produced**, which is the argument for the whole thing. A
 live run recorded `pretooluse-agent-model` firing on an `Agent` dispatch and deciding `no-op` where
diff --git a/docs/defect-shapes-773.md b/docs/defect-shapes-773.md
index c54a37906..cb456dfaf 100644
--- a/docs/defect-shapes-773.md
+++ b/docs/defect-shapes-773.md
@@ -519,12 +519,22 @@ window, not a corpus statistic.
 bearing one: `pretooluse-bash-guard` did not merely run, it *blocked* the `ETV_UPDATE_GOLDENS=1`
 probe, so at least one guard in this set is demonstrably live rather than merely present.
 
+**Reproducing this table.** It is a constructed window, not a corpus statistic, and it is not
+reproducible from a reader's own `report` output — running the test suite alone would not produce
+it, and before `scripts/tests/conftest.py` landed, running the suite actively polluted the default
+log with synthetic fires. To re-derive: point `ETV_HOOK_FIRE_LOG_DIR` at an empty directory, run a
+headless session exercising the four tool paths above, then a `git commit` and a
+`git push --dry-run`, and read `scripts/hook-fire-log.sh report --all --dir <that directory>`.
+
 **A zero is two findings wearing one number** — a hook that is broken, and a hook whose trigger did
-not occur — and the report says so rather than presenting a zero as a verdict. The two zeroes here
-are the second kind: neither can be exercised without a browser session or a real merge, and
-manufacturing a merge to observe the merge guard is a worse idea than the gap it would close.
-Distinguishing the two cases stays a human judgement; what changed is that the question is now
-askable at all.
+not occur — and the report says so rather than presenting a zero as a verdict. Both zeroes here are
+the second kind, and that is established rather than assumed: `pretooluse-nav-guard` and
+`pretooluse-merge-consent` are each driven to their deciding branch in
+`scripts/tests/test_hook_fire_log.py` (a `deny` on an `/iptv/` URL and an `ask` on a merge call
+respectively), emitting the correct decision with instrumentation in place. So both hooks are
+demonstrably healthy; what did not happen in this window is their trigger. Neither can be exercised
+end-to-end without a live browser session or a real merge attempt, and manufacturing a merge to
+observe the merge guard is a worse idea than the gap it would close.
 
 **The measurement earned its keep on its first run.** `pretooluse-agent-model` was recorded deciding
 `no-op` on an `Agent` dispatch where `ask` was expected. Previously that would have been an
diff --git a/scripts/hook-fire-log.sh b/scripts/hook-fire-log.sh
index 8b2c454eb..bf59bf6aa 100755
--- a/scripts/hook-fire-log.sh
+++ b/scripts/hook-fire-log.sh
@@ -62,7 +62,12 @@ etv_hook_fire_session() {
 }
 
 etv_hook_fire_log_file() {
-  printf '%s/%s.jsonl' "$(etv_hook_fire_log_dir)" "$(etv_hook_fire_session)"
+  # SCRUBBED, like every other use of this value. The session id is extracted from the payload by a
+  # `sed` that only excludes `"`, so a `/` or `..` in it would otherwise steer the write outside the
+  # log dir. Harness-generated UUIDs make that unreachable today, but a file whose stated thesis is
+  # "restrict the value space so there is no escaping bug to have" should not exempt the one use
+  # that becomes a path.
+  printf '%s/%s.jsonl' "$(etv_hook_fire_log_dir)" "$(etv_hook_fire_scrub_component "$(etv_hook_fire_session)")"
 }
 
 # Sanitise a value to a safe JSON scalar charset. This is why no `jq` is needed on the write side:
@@ -73,6 +78,15 @@ etv_hook_fire_scrub() {
   printf '%s' "${1:-}" | tr -c 'A-Za-z0-9._/:+@=-' '_' | cut -c1-200
 }
 
+# A STRICTER scrub for the one value that becomes a PATH. The record scrub above deliberately keeps
+# `/` and `.` — tool names like `mcp__gitea__x` and event paths read better with them — but those
+# are exactly the two characters that turn a session id into `../../escaped`. Passing a value
+# through a scrub is not the same as passing it through the RIGHT scrub, and the first version of
+# this fix reused the record scrubber and left the traversal wide open while reading as fixed.
+etv_hook_fire_scrub_component() {
+  printf '%s' "${1:-}" | tr -c 'A-Za-z0-9_-' '_' | cut -c1-120
+}
+
 # Append one record. Never fails; never writes a partial line (built whole, appended once).
 etv_hook_fire_record() {
   [ "${ETV_HOOK_FIRE_DISABLE:-0}" = "1" ] && return 0
@@ -117,11 +131,16 @@ etv_hook_fire_classify() {
   fi
 
   if [ -n "$out" ]; then
-    d=$(printf '%s' "$out" | sed -n 's/.*"permissionDecision"[[:space:]]*:[[:space:]]*"\([a-z]*\)".*/\1/p' | head -n1)
-    [ -z "$d" ] && d=$(printf '%s' "$out" | sed -n 's/.*"decision"[[:space:]]*:[[:space:]]*"\([a-z]*\)".*/\1/p' | head -n1)
+    # `[A-Za-z]` then lowercased, not `[a-z]`: a hook printing `"permissionDecision":"Deny"` fell
+    # through the lowercase-only class and was recorded as `output` — a real decision filed as
+    # unclassified prose.
+    d=$(printf '%s' "$out" | sed -n 's/.*"permissionDecision"[[:space:]]*:[[:space:]]*"\([A-Za-z-]*\)".*/\1/p' | head -n1)
+    [ -z "$d" ] && d=$(printf '%s' "$out" | sed -n 's/.*"decision"[[:space:]]*:[[:space:]]*"\([A-Za-z-]*\)".*/\1/p' | head -n1)
+    d=$(printf '%s' "$d" | tr 'A-Z' 'a-z')
     # `additionalContext` with no decision (design-sync-reminder's `start` path) informs, it does
-    # not gate. Naming it distinctly keeps it out of the allow/deny counts.
-    if [ -z "$d" ] && printf '%s' "$out" | grep -q 'additionalContext'; then d="context"; fi
+    # not gate. Naming it distinctly keeps it out of the allow/deny counts. Matched WITH its quotes
+    # and colon — a bare substring test also fired on human prose that merely used the word.
+    if [ -z "$d" ] && printf '%s' "$out" | grep -q '"additionalContext"[[:space:]]*:'; then d="context"; fi
     [ -z "$d" ] && d="output"
   fi
 
@@ -129,7 +148,17 @@ etv_hook_fire_classify() {
   # anyway so that a hook which starts using it is not silently recorded as a no-op.
   if [ "$code" = "2" ] && [ -z "$d" ]; then d="deny-exit2"; fi
   [ -z "$d" ] && d="no-op"
-  [ "$code" != "0" ] && [ "$code" != "2" ] && d="error"
+
+  # A non-zero status NO LONGER OVERWRITES a parsed decision. It used to, so a hook that printed a
+  # real `deny` and then exited 1 was recorded as `error` — the status erasing the decision, when
+  # the status already has its own field in the record. `error` now means only "it failed and said
+  # nothing classifiable".
+  if [ "$code" != "0" ] && [ "$code" != "2" ]; then
+    case "$d" in
+      no-op|output) d="error" ;;
+      *) d="${d}+error" ;;
+    esac
+  fi
 
   printf '%s' "$d"
 }
@@ -176,9 +205,17 @@ etv_hook_fire_begin() {
   if [ -n "$sin" ]; then
     ETV_HOOK_FIRE_STDIN_TMP="$sin"
     cat > "$sin" 2>/dev/null || true
-    # Replay unconditionally: even a partial capture is closer to the truth than the drained pipe
-    # the hook would otherwise inherit.
-    exec 0<"$sin" 2>/dev/null || true
+    # Replay: even a partial capture is closer to the truth than the drained pipe the hook would
+    # otherwise inherit.
+    #
+    # NO `2>/dev/null` ON THIS LINE, EVER. `exec` with redirections and no command applies them to
+    # the shell PERMANENTLY, so `exec 0<"$sin" 2>/dev/null` does not suppress errors from this one
+    # redirection — it sends the HOOK'S ENTIRE STDERR to /dev/null for the rest of its life. That
+    # silenced every husky hook's user-facing output, which is stderr: the H6 "push to main BLOCKED"
+    # message, the BOM guard's remediation text, `husky - commit message missing Co-Authored-By`.
+    # The guards still blocked, and the human was told nothing about why.
+    # Readability is tested instead of relying on redirection-failure suppression.
+    if [ -r "$sin" ]; then exec 0<"$sin" || true; fi
     payload=$(head -c 65536 "$sin" 2>/dev/null || true)
   fi
 
@@ -210,27 +247,60 @@ etv_hook_fire_begin() {
     ETV_HOOK_FIRE_STDOUT_TMP="$sout"
     exec 3>&1 || { ETV_HOOK_FIRE_STDOUT_TMP=""; rm -f "$sout" 2>/dev/null; return 0; }
     exec 1>"$sout" || { exec 1>&3 3>&-; ETV_HOOK_FIRE_STDOUT_TMP=""; rm -f "$sout" 2>/dev/null; return 0; }
+    # A READ FD held open on the same file, so the replay does not depend on the PATH still
+    # resolving at exit. Replaying with `cat "$path"` loses everything if anything unlinks the file
+    # mid-run — a $TMPDIR reaper, a hook that clears its own scratch — because the write fd stays
+    # valid on the unlinked inode while the name is gone: the hook prints its `deny` into a file
+    # nothing can reopen. An fd survives unlink, which turns that from silent guard-disarming into
+    # a non-event. Pinned by `test_output_SURVIVES_a_vanished_stdout_tempfile`.
+    exec 4<"$sout" || true
   fi
 
-  trap 'etv_hook_fire_end "$?"' EXIT
+  # SIGNALS, not just EXIT. Bash runs no EXIT trap for an untrapped fatal signal, so a hook killed
+  # by the harness timeout would have its already-printed decision discarded along with the temp
+  # file: measured at 52 bytes delivered before instrumentation and 0 after. Trapping the signals
+  # makes bash run the handler and then the EXIT trap, which replays. Every `capture`-mode hook
+  # today prints and exits immediately, so the window is sub-millisecond — but the constraint is
+  # invisible to a future editor, so it is enforced here rather than relied upon.
+  trap 'etv_hook_fire_end "$?"' EXIT INT TERM HUP
   return 0
 }
 
 etv_hook_fire_end() {
   local code="${1:-0}" out=""
 
-  # RESTORE AND REPLAY FIRST. Everything after this point is bookkeeping; if any of it dies, the
-  # hook has already said what it came to say. Getting this order wrong would let an instrumentation
-  # bug swallow a `deny`, which is the one outcome worse than not logging at all.
-  if [ -n "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ] && [ -f "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ]; then
-    exec 1>&3 3>&- 2>/dev/null || true
-    # `cat` the FILE, not a variable. `out=$(cat f)` strips trailing newlines, so replaying from a
-    # variable delivers the hook's JSON one byte short of what it wrote — and every JSON parser
-    # downstream accepts the short form, so nothing would ever complain. Pinned by
-    # `test_stdout_is_replayed_BYTE_EXACT`.
-    cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true
-    # A separate read for CLASSIFICATION only, where losing a trailing newline is harmless.
-    out=$(head -c 65536 "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true)
+  # RESTORE FIRST, UNCONDITIONALLY — then replay if there is anything to replay.
+  #
+  # These were one conditional, `[ -n "$TMP" ] && [ -f "$TMP" ]`, and that coupling was the bug:
+  # `-f` asks "is there output to replay", but the fd restore must happen whenever the redirect was
+  # ESTABLISHED, which is a different fact. Any route that makes `-f` false while the redirect is
+  # live — the temp file unlinked by a $TMPDIR reaper mid-run (the fd stays valid, so the hook
+  # writes happily into an unlinked inode), a $TMPDIR where mktemp yields a non-regular file — left
+  # fd 1 still pointing at the temp target with the restore skipped, so nothing later could rescue
+  # the bytes. A guard's `deny` was silently discarded and the hook still exited 0.
+  #
+  # Split, the worst case degrades from "the guard is disarmed" to "the log is short", which is the
+  # correct failure direction for observability. Pinned by
+  # `test_output_SURVIVES_a_vanished_stdout_tempfile`.
+  if [ -n "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ]; then
+    # Same rule as the stdin replay: a trailing `2>/dev/null` here would permanently silence stderr
+    # rather than suppress an error from this redirection. fd 3 is known open on this path.
+    exec 1>&3 3>&- || true
+  fi
+  if [ -n "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ]; then
+    # Read through the FD, not the path — see the `exec 4<` comment in begin. `cat <&4` also avoids
+    # the other trap: `out=$(cat ...)` strips trailing newlines, so replaying through a variable
+    # delivers the hook's JSON one byte short of what it wrote, which every JSON parser downstream
+    # accepts without complaint. Pinned by `test_stdout_is_replayed_BYTE_EXACT`.
+    out=$(cat <&4 2>/dev/null || true)   # for CLASSIFICATION; losing a trailing newline is harmless
+    exec 4<&- 2>/dev/null || true
+    # Replay the exact bytes from the file if the name still resolves, else from what the fd gave
+    # us. The first path is byte-exact; the second is the rescue.
+    if [ -r "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ] && [ -s "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ]; then
+      cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true
+    elif [ -n "$out" ]; then
+      printf '%s' "$out"
+    fi
   fi
 
   etv_hook_fire_record \
diff --git a/scripts/tests/conftest.py b/scripts/tests/conftest.py
new file mode 100644
index 000000000..109c575fa
--- /dev/null
+++ b/scripts/tests/conftest.py
@@ -0,0 +1,29 @@
+"""Keep the test suite out of the PRODUCTION hook-fire log (ersatztv#776).
+
+Four suites here drive real hooks as subprocesses — `test_merge_consent_exemption.py`,
+`test_merge_consent_base_change.py`, `test_prepush_rebase_check_tag_exemption.py`,
+`test_pr_changed_files.py` — and they predate the instrumentation. Once every hook records its own
+execution, running `pytest scripts/tests` wrote its synthetic invocations into
+`$HOME/.cache/ersatztv/hook-fire/`: 96 `pretooluse-merge-consent` fires including two `deny`s, and
+12 `blocked` decisions from `prepush-rebase-check`, none of them a real session.
+
+That is not untidiness, it is the defect the whole change exists to remove. `scripts/hook-fire-log.sh
+report` is meant to answer "what did the harness actually do", and a log carrying test artifacts
+answers a different question while looking identical — inference reintroduced one layer up. The
+record has no field distinguishing a test invocation from a real one, and adding one would only move
+the problem, so the fix is that tests never write to the real log at all.
+
+Autouse and session-independent: a new suite that drives a hook is isolated by existing, without
+having to know this file is here.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+
+@pytest.fixture(autouse=True)
+def isolate_hook_fire_log(tmp_path_factory, monkeypatch):
+    monkeypatch.setenv(
+        "ETV_HOOK_FIRE_LOG_DIR", str(tmp_path_factory.mktemp("hook-fire-log"))
+    )
diff --git a/scripts/tests/test_hook_fire_log.py b/scripts/tests/test_hook_fire_log.py
index 46dafbcf8..f0acb869f 100644
--- a/scripts/tests/test_hook_fire_log.py
+++ b/scripts/tests/test_hook_fire_log.py
@@ -50,17 +50,63 @@ def hook_scripts() -> list[Path]:
     return sorted(HOOKS_DIR.glob("*.sh"))
 
 
+def expected_mode(name: str) -> str:
+    """DERIVED from the wiring, not listed.
+
+    A hook registered in `.claude/settings.json` is a Claude hook: it always exits 0 and decides by
+    PRINTING JSON, so its stdout must be captured or the decision is unobservable. A hook registered
+    in `.husky/*` is a git hook: it decides by exit status and its stdout is progress text a human
+    watches live, so capturing it would hold the output back until the end.
+
+    Reading this from the settings files rather than a hardcoded set means a hook that changes
+    wiring gets the right expectation automatically — and, unlike a list, it cannot be quietly
+    edited to match a mistake.
+    """
+    if name in (REPO_ROOT / ".claude" / "settings.json").read_text():
+        return "capture"
+    for husky in (REPO_ROOT / ".husky").iterdir():
+        if husky.is_file() and name in husky.read_text():
+            return "stream"
+    return "capture"
+
+
 def instrumentation_faults(text: str, name: str) -> list[str]:
     """The check itself, factored out so a mutation can be fed to the same code the suite runs."""
     faults = []
     if not _SOURCES_SINK.search(text):
         faults.append(f"{name}: does not source scripts/hook-fire-log.sh")
+
+    # The sink PATH, not just the sourcing line. Repointing `ETV_HOOK_FIRE_LIB` at /dev/null leaves
+    # the `[ -r ] && .` line untouched and disables all reporting silently — a mutation the first
+    # version of this checker passed clean.
+    lib = re.search(r"^ETV_HOOK_FIRE_LIB=(.*)$", text, re.M)
+    if not lib:
+        faults.append(f"{name}: no ETV_HOOK_FIRE_LIB assignment")
+    elif "/scripts/hook-fire-log.sh" not in lib.group(1):
+        faults.append(f"{name}: ETV_HOOK_FIRE_LIB does not point at the shared sink: {lib.group(1)}")
+
+    # A hook that disables its own reporting reads as instrumented and reports nothing.
+    if re.search(r"^\s*(export\s+)?ETV_HOOK_FIRE_DISABLE=1", text, re.M):
+        faults.append(f"{name}: sets ETV_HOOK_FIRE_DISABLE=1, so it never reports")
+
     m = _BEGINS.search(text)
     if not m:
         faults.append(f"{name}: never calls etv_hook_fire_begin")
     elif m.group(1) != name:
         faults.append(f"{name}: calls etv_hook_fire_begin for {m.group(1)!r}, not for itself")
     else:
+        # MODE. Flipping a Claude hook from `capture` to `stream` stops its stdout being read, so
+        # every decision it makes is recorded as `pass`/`blocked` from the exit status it never
+        # uses — the log stays full and becomes wrong. Nothing else in the suite notices.
+        mode = re.search(rf"^etv_hook_fire_begin {re.escape(name)} \S+ (\S+)", text, re.M)
+        want = expected_mode(name)
+        if not mode:
+            faults.append(f"{name}: etv_hook_fire_begin names no stdout mode")
+        elif mode.group(1) != want:
+            faults.append(
+                f"{name}: begins in {mode.group(1)!r} mode but its wiring implies {want!r}"
+            )
+
         # Order is the whole point: 8 of the hooks slurp stdin with `input=$(cat)`, and a begin
         # placed after that read would find the pipe already drained — recording a fire with no
         # tool name, and replaying nothing into a hook that has already consumed its payload.
@@ -71,14 +117,24 @@ def instrumentation_faults(text: str, name: str) -> list[str]:
 
 
 def strip_instrumentation(text: str) -> str:
-    """Reconstruct the pre-#776 script. Used BOTH as the mutation and as the A/B control."""
+    """Reconstruct the pre-#776 script. Used BOTH as the mutation and as the A/B control.
+
+    The blank line that separates the preamble from the code above it is dropped too. Leaving it
+    made the reconstruction differ from the original by one blank line in all 13 hooks — harmless
+    behaviourally, but the A/B control is only trustworthy insofar as it IS the original, and
+    "differs only in ways I judged harmless" is a claim, not a property.
+    `test_the_stripper_reproduces_the_ORIGINAL_byte_for_byte` turns it into a property.
+    """
     out, skipping = [], False
     for line in text.splitlines(keepends=True):
         if line.startswith("# ersatztv#776 —"):
             skipping = True
+            if out and out[-1].strip() == "":
+                out.pop()
             continue
         if skipping:
-            if line.startswith(("#", "ETV_HOOK_FIRE_LIB=", "[ -r ", "etv_hook_fire_begin ")):
+            if line.startswith(("#", "ETV_HOOK_FIRE_LIB=", "[ -r ", "type etv_hook_fire_begin",
+                                "etv_hook_fire_begin ")):
                 continue
             skipping = False
         out.append(line)
@@ -102,6 +158,37 @@ def test_the_population_is_not_empty():
     assert os.access(SINK, os.X_OK), "the sink is not executable, so its report side cannot be run"
 
 
+def test_the_stripper_reproduces_the_ORIGINAL_byte_for_byte():
+    """The A/B control must BE the pre-#776 script, not merely resemble it.
+
+    `test_the_stripper_actually_strips` only asserts the preamble is gone. That leaves the property
+    the differential test actually depends on — that the control side is the real original —
+    unpinned, so a future edit to the preamble format could make the control silently diverge in a
+    way that matters while every assertion stayed green. Compared against git rather than against a
+    second copy in this file, because a second copy is the thing that drifts.
+    """
+    base = subprocess.run(
+        ["git", "merge-base", "HEAD", "origin/main"],
+        capture_output=True, cwd=str(REPO_ROOT), text=True,
+    ).stdout.strip()
+    if not base:
+        pytest.skip("no origin/main to compare against")
+
+    for hook in hook_scripts():
+        rel = hook.relative_to(REPO_ROOT)
+        orig = subprocess.run(
+            ["git", "show", f"{base}:{rel}"],
+            capture_output=True, cwd=str(REPO_ROOT),
+        )
+        if orig.returncode != 0:
+            continue  # a hook added after the merge base has no pre-#776 form
+        assert strip_instrumentation(hook.read_text()) == orig.stdout.decode(), (
+            f"{hook.name}: strip_instrumentation() does not reproduce the original. The A/B "
+            "control is therefore not the pre-#776 script, and the differential test is comparing "
+            "against something nobody wrote."
+        )
+
+
 def test_the_stripper_actually_strips():
     """The A/B control and the mutation are the same function. If it were a no-op, the differential
     test would compare each hook against itself and pass on a wrapper that breaks everything."""
@@ -159,9 +246,15 @@ def test_begin_placed_AFTER_the_stdin_read_is_DETECTED():
 # CLAIM 2 — TRANSPARENCY. The wrapper must be invisible to the harness.
 # ------------------------------------------------------------------------------------------------
 
-# Payloads chosen to reach the DECIDING branch of each hook, not merely its early-exit. A matrix
-# that only ever produced silent allows would prove the wrapper transparent on the one path where
-# there is nothing to be transparent about.
+# A BROAD, CHEAP matrix. It reaches the deciding branch of only a few hooks; the ones it cannot
+# reach with a bare payload get a constructed positive case in `positive_cases()` below, and
+# `test_the_AB_is_not_VACUOUS_for_any_hook` refuses to let any hook rely on this matrix alone.
+#
+# Stated because the first version of this file claimed the opposite in three places: this matrix
+# alone produced empty-vs-empty comparisons for 8 of 13 hooks and a zero exit status for all 13, so
+# deleting the entire stdout replay left the differential test green for four hooks — two of which
+# issue `deny`. An A/B over silent allows proves transparency on the one path where there is nothing
+# to be transparent about.
 PAYLOADS = {
     "bash-deny": '{"session_id":"s","hook_event_name":"PreToolUse","tool_name":"Bash","cwd":"%(cwd)s","tool_input":{"command":"ETV_UPDATE_GOLDENS=1 dotnet test"}}',
     "bash-allow": '{"session_id":"s","hook_event_name":"PreToolUse","tool_name":"Bash","cwd":"%(cwd)s","tool_input":{"command":"ls -la"}}',
@@ -212,43 +305,323 @@ def _run(script: Path, payload: str, env: dict, cwd: Path, arg: str | None = Non
     return p.returncode, p.stdout
 
 
+def _git(cwd: Path, *args: str) -> None:
+    subprocess.run(
+        ["git", *args], cwd=str(cwd), check=True, capture_output=True,
+        env={**os.environ, "GIT_AUTHOR_NAME": "t", "GIT_AUTHOR_EMAIL": "t@e",
+             "GIT_COMMITTER_NAME": "t", "GIT_COMMITTER_EMAIL": "t@e"},
+    )
+
+
+@pytest.fixture(scope="module")
+def positives(sandbox, tmp_path_factory):
+    """CONSTRUCTED cases that drive hooks the bare payload matrix cannot reach to a DECIDING branch.
+
+    Each entry is (case-name, payload, arg, env, cwd). Building real git repositories is the point:
+    the hooks these cover — the BOM guard, the worktree-ownership guard, the three pre-push guards —
+    all decide by inspecting a repository, so a payload alone can only ever reach their early exit.
+    """
+    _root, base_env = sandbox
+    w = tmp_path_factory.mktemp("positives")
+    cases: dict[str, list[tuple]] = {}
+
+    def pay(**kw) -> str:
+        import json as _json
+        return _json.dumps({"session_id": "me", "hook_event_name": "PreToolUse",
+                            "tool_name": "Bash", **kw})
+
+    # --- worktree-guard: a marker naming ANOTHER session, on a `git commit` -------------------
+    wt = w / "sibling"
+    wt.mkdir()
+    _git(wt, "init", "-q", ".")
+    (wt / ".claude-worktree-owner").write_text("SOME-OTHER-SESSION\n")
+    cases["pretooluse-worktree-guard"] = [(
+        "foreign-marker-deny",
+        pay(cwd=str(wt), tool_input={"command": "git commit -m x"}), None, base_env, wt,
+    )]
+
+    # --- bom-guard: repo path must match `*ersatztv*`, with a staged BOM-carrying .cs ----------
+    br = w / "ersatztv-scratch"
+    br.mkdir()
+    _git(br, "init", "-q", ".")
+    (br / "Bad.cs").write_bytes(b"\xef\xbb\xbfclass A {}\n")
+    _git(br, "add", "Bad.cs")
+    cases["pretooluse-bom-guard"] = [(
+        "staged-bom-deny",
+        pay(cwd=str(br), tool_input={"command": "git commit -m x"}), None, base_env, br,
+    )]
+
+    # --- agent-ram: both thresholds, via a stubbed `memory_pressure` ---------------------------
+    ram_cases = []
+    for pct, label in ((5, "deny"), (15, "ask")):
+        bindir = w / f"bin{pct}"
+        bindir.mkdir()
+        stub = bindir / "memory_pressure"
+        stub.write_text(f"#!/bin/sh\necho 'System-wide memory free percentage: {pct}%'\n")
+        stub.chmod(0o755)
+        env = dict(base_env)
+        env["PATH"] = f"{bindir}:{os.environ['PATH']}"
+        ram_cases.append((
+            f"free-{pct}pct-{label}",
+            pay(tool_name="Agent", cwd=str(w), tool_input={"prompt": "p", "model": "sonnet"}),
+            None, env, w,
+        ))
+    cases["pretooluse-agent-ram"] = ram_cases
+
+    # --- decisions-guard: a validator that prints and blocks, and one that prints and passes ---
+    dg = w / "dg"
+    (dg / "scripts").mkdir(parents=True)
+    _git(dg, "init", "-q", ".")
+    dg_cases = []
+    for rc, label in ((1, "block"), (0, "pass")):
+        d = w / f"dg{rc}"
+        (d / "scripts").mkdir(parents=True)
+        _git(d, "init", "-q", ".")
+        (d / "scripts" / "decisions_validate.py").write_text(
+            f"import sys\nprint('VALIDATOR SAID SOMETHING')\nsys.exit({rc})\n"
+        )
+        dg_cases.append((f"validator-{label}", "", None, base_env, d))
+    cases["decisions-guard"] = dg_cases
+
+    # --- pre-push guards: a real remote, so `git fetch origin main` resolves -------------------
+    bare = w / "remote.git"
+    _git(w, "init", "-q", "--bare", "--initial-branch=main", str(bare))
+
+    def clone(name: str) -> Path:
+        p = w / name
+        subprocess.run(["git", "clone", "-q", str(bare), str(p)], check=True, capture_output=True)
+        _git(p, "config", "user.email", "t@e")
+        _git(p, "config", "user.name", "t")
+        return p
+
+    seed = clone("seed")
+    (seed / "file.txt").write_text("one\n")
+    _git(seed, "add", "-A")
+    _git(seed, "commit", "-qm", "seed")
+    _git(seed, "push", "-q", "origin", "main")
+
+    # rebase-check: local HEAD is an ANCESTOR of a since-advanced origin/main -> blocks.
+    behind = clone("behind")
+    _git(behind, "checkout", "-qb", "feat")
+    ahead = clone("ahead")
+    (ahead / "file.txt").write_text("two\n")
+    _git(ahead, "add", "-A")
+    _git(ahead, "commit", "-qm", "advance main")
+    _git(ahead, "push", "-q", "origin", "main")
+    head = subprocess.run(["git", "rev-parse", "HEAD"], cwd=str(behind),
+                          capture_output=True, text=True).stdout.strip()
+    cases["prepush-rebase-check"] = [(
+        "behind-origin-main-blocks",
+        f"refs/heads/feat {head} refs/heads/feat {'0' * 40}\n", None, base_env, behind,
+    )]
+
+    # clean-worktree-check: a file both MODIFIED in the tree and present in the pushed set.
+    dirty = clone("dirty")
+    (dirty / "file.txt").write_text("committed change\n")
+    _git(dirty, "add", "-A")
+    _git(dirty, "commit", "-qm", "change file")
+    (dirty / "file.txt").write_text("uncommitted change\n")
+    dhead = subprocess.run(["git", "rev-parse", "HEAD"], cwd=str(dirty),
+                           capture_output=True, text=True).stdout.strip()
+    cases["prepush-clean-worktree-check"] = [(
+        "dirty-file-in-pushed-set-blocks",
+        f"refs/heads/main {dhead} refs/heads/main {'0' * 40}\n", None, base_env, dirty,
+    )]
+
+
+    # --- prepush-donewhen: a push to main closing an issue with an unticked Done-when box -------
+    #
+    # This one needs a Gitea, so it gets a stub HTTP server rather than an exemption. Without it the
+    # hook's only reachable path in a test is its no-creds fail-open, and the guard that blocks
+    # pushes to `main` would be the one hook whose transparency nothing checks — precisely the
+    # "covered everywhere except where it matters" shape this repo keeps paying for.
+    import http.server
+    import json as _json
+    import threading
+
+    body = _json.dumps({"body": "## Done-when\n\n- [ ] not finished\n- [x] finished\n"}).encode()
+
+    class _Stub(http.server.BaseHTTPRequestHandler):
+        def do_GET(self):  # noqa: N802
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+
+        def log_message(self, *a):  # keep pytest output clean
+            pass
+
+    srv = http.server.HTTPServer(("127.0.0.1", 0), _Stub)
+    threading.Thread(target=srv.serve_forever, daemon=True).start()
+
+    dw = clone("donewhen")
+    (dw / "src.cs").write_text("class A {}\n")   # NOT docs-only, so the exemption does not apply
+    _git(dw, "add", "-A")
+    _git(dw, "commit", "-qm", "feat: thing\n\nfixes #999")
+    dw_head = subprocess.run(["git", "rev-parse", "HEAD"], cwd=str(dw),
+                             capture_output=True, text=True).stdout.strip()
+    dw_prev = subprocess.run(["git", "rev-parse", "HEAD~1"], cwd=str(dw),
+                             capture_output=True, text=True).stdout.strip()
+    dw_env = dict(base_env)
+    dw_env["ETV_GITEA_URL"] = f"http://127.0.0.1:{srv.server_address[1]}"
+    dw_env["ETV_GITEA_BASICAUTH"] = "stub:stub"
+    cases["prepush-donewhen"] = [(
+        "unticked-donewhen-blocks-push-to-main",
+        f"refs/heads/main {dw_head} refs/heads/main {dw_prev}\n", None, dw_env, dw,
+    )]
+
+    return cases
+
+
+def _ab_cases(hook: Path, sandbox, positives) -> list[tuple]:
+    """(label, payload, arg, env, cwd) for the generic matrix PLUS this hook's constructed cases."""
+    root, env = sandbox
+    cases: list[tuple] = []
+    args = [None, "start", "finish"] if hook.stem == "design-sync-reminder" else [None]
+    for name, template in PAYLOADS.items():
+        for arg in args:
+            cases.append((
+                f"matrix:{name}:{arg}", template % {"cwd": str(root), "nonce": name},
+                arg, env, root,
+            ))
+    for label, payload, arg, penv, cwd in positives.get(hook.stem, []):
+        cases.append((f"positive:{label}", payload, arg, penv, cwd))
+    return cases
+
+
+def _ab_run(hook: Path, sandbox, case, tag_root: str):
+    """Run the control and the instrumented hook for one case. Returns both (rc, stdout, stderr)."""
+    root = sandbox[0]
+    control = root / f"control-{hook.name}"
+    if not control.exists():
+        control.write_text(strip_instrumentation(hook.read_text()))
+        control.chmod(0o755)
+    _label, payload, arg, env, cwd = case
+
+    # A SEPARATE TMPDIR PER SIDE, not per pair. `design-sync-reminder.sh` throttles itself with a
+    # marker file under $TMPDIR, so a shared one let the control fire and then silently suppress the
+    # instrumented run — the A/B reported a swallowed decision that was really the hook's own
+    # one-shot behaviour working correctly. Sharing state between the two halves of a differential
+    # test makes it measure the state, not the difference.
+    def side(t: str) -> dict:
+        e = dict(env)
+        e["TMPDIR"] = str(root / f"tmp-{tag_root}-{t}")
+        Path(e["TMPDIR"]).mkdir(parents=True, exist_ok=True)
+        return e
+
+    def one(script: Path, t: str):
+        cmd = ["bash", str(script)] + ([arg] if arg else [])
+        p = subprocess.run(cmd, input=payload.encode(), capture_output=True,
+                           cwd=str(cwd), env=side(t), timeout=90)
+        return p.returncode, p.stdout, p.stderr
+
+    return one(control, "control"), one(hook, "instrumented")
+
+
+def _normalise_stderr(err: bytes) -> bytes:
+    """Erase the two things that MUST differ between the control and the instrumented hook.
+
+    bash prefixes its own diagnostics with `$0` and a line number. The control is a copy at a
+    different path, and the instrumentation adds four lines to the top, so *every* bash-emitted
+    message differs in exactly those two fields for reasons that have nothing to do with
+    transparency. Only the script path and `line N:` are normalised — narrowly, so that a genuine
+    difference in the message body still fails.
+    """
+    err = re.sub(rb"[^\s:]*/[^\s:]*\.sh:", b"<script>:", err)
+    err = re.sub(rb"line \d+:", b"line <n>:", err)
+    return err
+
+
 @pytest.mark.parametrize("hook", hook_scripts(), ids=lambda h: h.stem)
-def test_instrumentation_changes_NOTHING_the_harness_can_see(hook, sandbox):
-    """THE REGRESSION NET. Every hook, every payload, byte-equal stdout and equal exit status.
+def test_instrumentation_changes_NOTHING_the_harness_can_see(hook, sandbox, positives):
+    """THE REGRESSION NET. Every hook, every case: byte-equal stdout, byte-equal stderr, equal status.
 
     This is what stands between #776 and having silently disarmed the guard set while adding a log
     that cheerfully reports every hook firing.
+
+    STDERR is compared too. It was not, and that hid a real change: when the sink is unreadable the
+    preamble's `etv_hook_fire_begin` was an undefined command, so the hook printed `command not
+    found` to stderr and the A/B could not see it. Anything the harness or a human can observe
+    belongs in the comparison, not just the channel the decision travels on.
     """
-    root, env = sandbox
-    control = root / f"control-{hook.name}"
-    control.write_text(strip_instrumentation(hook.read_text()))
+    for i, case in enumerate(_ab_cases(hook, sandbox, positives)):
+        (rc_a, out_a, err_a), (rc_b, out_b, err_b) = _ab_run(hook, sandbox, case, f"{hook.stem}-{i}")
+        label = f"{hook.name} {case[0]}"
+        assert rc_a == rc_b, f"{label}: exit status changed {rc_a} -> {rc_b}"
+        assert out_a == out_b, f"{label}: stdout changed.\n  without: {out_a!r}\n  with: {out_b!r}"
+        na, nb = _normalise_stderr(err_a), _normalise_stderr(err_b)
+        assert na == nb, f"{label}: stderr changed.\n  without: {na!r}\n  with: {nb!r}"
 
-    # `design-sync-reminder.sh` dispatches on argv[1], so both of its branches are exercised.
-    args = [None, "start", "finish"] if hook.stem == "design-sync-reminder" else [None]
 
-    for name, template in PAYLOADS.items():
-        for arg in args:
-            payload = template % {"cwd": str(root), "nonce": name}
+@pytest.mark.parametrize("hook", hook_scripts(), ids=lambda h: h.stem)
+def test_the_AB_is_not_VACUOUS_for_any_hook(hook, sandbox, positives):
+    """ANTI-VACUITY FOR CLAIM 2 — the assertion the first version of this file was missing.
 
-            # A SEPARATE TMPDIR PER SIDE, not per pair. `design-sync-reminder.sh` throttles itself
-            # with a marker file under $TMPDIR, so a shared one let the control fire and then
-            # silently suppress the instrumented run — the A/B reported a swallowed decision that
-            # was really the hook's own one-shot behaviour working correctly. Sharing state between
-            # the two halves of a differential test makes it measure the state, not the difference.
-            def side(tag: str) -> dict:
-                e = dict(env)
-                e["TMPDIR"] = str(root / f"tmp-{name}-{arg}-{tag}")
-                Path(e["TMPDIR"]).mkdir(parents=True, exist_ok=True)
-                return e
+    `test_instrumentation_changes_NOTHING_the_harness_can_see` compares the two halves against each
+    other. If a hook emits nothing and exits 0 on every case, that comparison is `("", 0) == ("", 0)`
+    and passes on a wrapper that discards all output. Measured on the original matrix: 160 of 165
+    comparisons were empty-vs-empty and 165 of 165 were `0 == 0`, so deleting the entire replay block
+    left the differential green for four hooks, two of which issue `deny`.
 
-            rc_a, out_a = _run(control, payload, side("control"), root, arg)
-            rc_b, out_b = _run(hook, payload, side("instrumented"), root, arg)
+    So each hook must have at least one case where the CONTROL side actually says something —
+    non-empty stdout, or a non-zero exit. The population is the hook glob, so a new hook arrives
+    here uncovered-and-red rather than quietly riding on a matrix that never reaches it.
 
-            label = f"{hook.name} payload={name} arg={arg}"
-            assert rc_a == rc_b, f"{label}: exit status changed {rc_a} -> {rc_b}"
-            assert out_a == out_b, (
-                f"{label}: stdout changed.\n  without: {out_a!r}\n  with:    {out_b!r}"
-            )
+    ONE HOOK IS EXEMPT, and the exemption is narrow, derived and stated rather than assumed:
+    `posttooluse-worktree-marker.sh` emits nothing and exits 0 on every input BY DESIGN — its whole
+    output is a marker file. Testing it for non-empty stdout would be testing for a bug. Its
+    transparency is asserted instead through its side effect, in
+    `test_the_worktree_markers_SIDE_EFFECT_is_unchanged`.
+    """
+    if hook.stem == "posttooluse-worktree-marker":
+        pytest.skip("emits nothing by design; covered by its side-effect test instead")
+
+    productive = []
+    for i, case in enumerate(_ab_cases(hook, sandbox, positives)):
+        (rc_a, out_a, _), _ = _ab_run(hook, sandbox, case, f"vac-{hook.stem}-{i}")
+        if out_a or rc_a != 0:
+            productive.append((case[0], len(out_a), rc_a))
+
+    assert productive, (
+        f"{hook.name}: NOT ONE case makes this hook emit output or exit non-zero, so every "
+        "comparison in the differential test is empty-vs-empty and it would stay green with the "
+        "instrumentation's entire replay path deleted. Add a constructed case to `positives()` that "
+        "drives this hook to its deciding branch."
+    )
+
+
+def test_the_worktree_markers_SIDE_EFFECT_is_unchanged(sandbox, tmp_path):
+    """The one hook whose whole output is a file, compared on that file rather than on stdout."""
+    env = sandbox[1]
+    hook = HOOKS_DIR / "posttooluse-worktree-marker.sh"
+    results = []
+    for tag in ("control", "instrumented"):
+        repo = tmp_path / tag
+        repo.mkdir()
+        _git(repo, "init", "-q", ".")
+        (repo / "f").write_text("x")
+        _git(repo, "add", "-A")
+        _git(repo, "commit", "-qm", "c")
+        target = tmp_path / f"wt-{tag}"
+        script = hook
+        if tag == "control":
+            script = tmp_path / "control-marker.sh"
+            script.write_text(strip_instrumentation(hook.read_text()))
+        import json as _json
+        payload = _json.dumps({
+            "session_id": "SESSION-XYZ", "hook_event_name": "PostToolUse", "tool_name": "Bash",
+            "cwd": str(repo),
+            "tool_input": {"command": f"git worktree add {target} HEAD"},
+        })
+        _git(repo, "worktree", "add", "-q", str(target), "HEAD")
+        _run(script, payload, env, repo)
+        marker = target / ".claude-worktree-owner"
+        results.append(marker.read_text() if marker.exists() else None)
+
+    assert results[0] == results[1] == "SESSION-XYZ\n", (
+        f"the marker the hook writes differs with and without instrumentation: {results}"
+    )
 
 
 def test_stdout_is_replayed_BYTE_EXACT(sandbox):
@@ -489,3 +862,241 @@ def test_the_report_REFUSES_an_empty_population(tmp_path, sandbox):
         f"clean table of nothing. stdout={p.stdout.decode()!r}"
     )
     assert b"refusing to report" in p.stderr
+
+
+# ------------------------------------------------------------------------------------------------
+# PROOFS FOR THE ROUND-2 FIXES. Each of these went red before its fix and green after; each names
+# the failure it pins, because "this test exists for a reason" is not a reason.
+# ------------------------------------------------------------------------------------------------
+
+
+def test_stderr_is_NOT_silenced(sandbox):
+    """The worst defect this change shipped, and the cheapest to have missed.
+
+    `exec 0<"$sin" 2>/dev/null` reads as "suppress errors from this redirection". It is not: `exec`
+    with redirections and no command applies them to the shell PERMANENTLY, so it sent the HOOK'S
+    ENTIRE STDERR to /dev/null for the rest of its life. Every husky guard's user-facing output is
+    stderr — the H6 "push to main BLOCKED" message, the BOM guard's remediation text — so the guards
+    went on blocking while telling the human nothing about why.
+
+    Invisible to the original A/B, which compared only stdout and exit status.
+    """
+    root, env = sandbox
+    hook = root / "noisy.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin noisy "" stream || true\n'
+        "input=$(cat)\n"
+        'printf "IMPORTANT DIAGNOSTIC\\n" >&2\n'
+        "exit 1\n"
+    )
+    p = subprocess.run(["bash", str(hook)], input=b'{"tool_name":"Bash"}',
+                       capture_output=True, cwd=str(root), env=env, timeout=60)
+    assert p.returncode == 1
+    assert b"IMPORTANT DIAGNOSTIC" in p.stderr, (
+        f"the hook's stderr was swallowed by the instrumentation: {p.stderr!r}"
+    )
+
+
+def test_output_SURVIVES_a_vanished_stdout_tempfile(sandbox):
+    """The swallowed-`deny` path, found by cold review by stubbing `mktemp`.
+
+    Two coupled mistakes: the fd restore lived inside the same conditional as the replay, so a
+    missing file left stdout still pointing at the temp target; and the replay read the PATH, so an
+    unlinked-but-open file was unrecoverable even though its bytes existed. The hook here deletes
+    its own scratch after printing, which is what a $TMPDIR reaper does to it from outside.
+    """
+    root, env = sandbox
+    hook = root / "vanish.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin vanish "" capture || true\n'
+        "input=$(cat)\n"
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
+        'rm -f "${TMPDIR:-/tmp}"/etv-hook-stdout.* 2>/dev/null || true\n'
+    )
+    tmp = root / "vanish-tmp"
+    tmp.mkdir(exist_ok=True)
+    p = subprocess.run(["bash", str(hook)], input=b'{"tool_name":"Bash"}', capture_output=True,
+                       cwd=str(root), env={**env, "TMPDIR": str(tmp)}, timeout=60)
+    assert p.returncode == 0
+    assert b'"permissionDecision":"deny"' in p.stdout, (
+        "the guard's deny was DISCARDED when its stdout scratch file vanished mid-run. The hook "
+        f"exited 0 with no output, which the harness reads as allow. stdout={p.stdout!r}"
+    )
+
+
+def test_output_survives_a_SIGTERM(sandbox):
+    """A hook killed by the harness timeout must still deliver what it already printed.
+
+    Measured before the fix: 52 bytes delivered without instrumentation, 0 with it. Bash runs no
+    EXIT trap for an UNTRAPPED fatal signal, so the decision sat in a temp file nobody read. Every
+    capture-mode hook today prints and exits immediately, so the window is sub-millisecond — but
+    that is a property of today's hooks, not of the mechanism, and nothing else would tell a future
+    editor they had just made it reachable.
+    """
+    import signal
+    import time
+
+    root, env = sandbox
+    hook = root / "slow.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin slow "" capture || true\n'
+        "input=$(cat)\n"
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
+        "sleep 30\n"
+    )
+    payload_file = root / "sigterm-stdin.json"
+    payload_file.write_bytes(b'{"tool_name":"Bash"}')
+    with open(payload_file, "rb") as fh:
+        p = subprocess.Popen(["bash", str(hook)], stdin=fh, stdout=subprocess.PIPE,
+                             stderr=subprocess.PIPE, cwd=str(root), env=env)
+        time.sleep(2.0)
+        p.send_signal(signal.SIGTERM)
+        out, _ = p.communicate(timeout=30)
+    assert b'"permissionDecision":"deny"' in out, (
+        f"a SIGTERMed hook lost the decision it had already printed: {out!r}"
+    )
+
+
+@pytest.mark.parametrize(
+    "emit,code,expected",
+    [
+        # Uppercase: a real decision was filed as unclassified prose because the class was [a-z] only.
+        (r'{\"permissionDecision\":\"Deny\"}', 0, "deny"),
+        # A non-zero status must not ERASE a decision the hook actually printed; the status has its
+        # own field in the record.
+        (r'{\"permissionDecision\":\"deny\"}', 1, "deny+error"),
+        # ...but a failure with nothing classifiable is still an error.
+        ("", 1, "error"),
+    ],
+)
+def test_the_classifier_does_not_MISREPORT(sandbox, emit, code, expected):
+    root, env = sandbox
+    logdir = root / f"cls-{expected}-{code}"
+    runenv = {**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)}
+    hook = root / f"cls-{expected}-{code}.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin cls "" capture || true\n'
+        "input=$(cat)\n"
+        + (f'printf "{emit}"\n' if emit else "")
+        + f"exit {code}\n"
+    )
+    subprocess.run(["bash", str(hook)], input=b'{"session_id":"s1","tool_name":"Bash"}',
+                   capture_output=True, cwd=str(root), env=runenv, timeout=60)
+    rec = [ln for ln in (logdir / "s1.jsonl").read_text().splitlines() if '"phase":"exit"' in ln]
+    assert f'"decision":"{expected}"' in rec[0], f"expected {expected}, got {rec[0]}"
+
+
+def test_the_word_additionalContext_in_PROSE_is_not_a_decision(sandbox):
+    """`grep -q additionalContext` matched the bare word anywhere, including human text."""
+    root, env = sandbox
+    logdir = root / "cls-prose"
+    hook = root / "prose.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin prose "" capture || true\n'
+        "input=$(cat)\n"
+        'printf "note: this hook does not use additionalContext at all\\n"\n'
+    )
+    subprocess.run(["bash", str(hook)], input=b'{"session_id":"s1","tool_name":"Bash"}',
+                   capture_output=True, cwd=str(root),
+                   env={**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)}, timeout=60)
+    rec = [ln for ln in (logdir / "s1.jsonl").read_text().splitlines() if '"phase":"exit"' in ln]
+    assert '"decision":"output"' in rec[0], f"prose was classified as a decision: {rec[0]}"
+
+
+def test_the_session_id_cannot_ESCAPE_the_log_directory(sandbox, tmp_path):
+    """The log FILENAME was built from an unscrubbed payload field while the log FIELD was scrubbed.
+
+    Unreachable with harness-generated UUIDs, fixed anyway: a file whose stated thesis is "restrict
+    the value space so there is no escaping bug to have" should not exempt the one use that becomes
+    a path.
+    """
+    _root, env = sandbox
+    logdir = tmp_path / "logs"
+    hook = tmp_path / "esc.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin esc "" capture || true\n'
+        "input=$(cat)\n"
+    )
+    evil = '{"session_id":"../../escaped","tool_name":"Bash"}'
+    subprocess.run(["bash", str(hook)], input=evil.encode(), capture_output=True,
+                   cwd=str(tmp_path), env={**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)}, timeout=60)
+    written = list(logdir.glob("*.jsonl"))
+    assert written, "nothing was logged at all"
+    for f in written:
+        assert f.parent == logdir, f"a record escaped the log directory: {f}"
+    assert not (tmp_path / "escaped.jsonl").exists()
+
+
+def test_the_suite_does_not_write_to_the_PRODUCTION_log(sandbox):
+    """`conftest.py` must isolate every test, not just this file's.
+
+    Before it, running `pytest scripts/tests` put 115 synthetic fires into
+    `$HOME/.cache/ersatztv/hook-fire/` — 96 merge-consent including two `deny`s — so
+    `hook-fire-log.sh report` described the test suite while looking exactly like a record of real
+    sessions. That is the inference problem this change exists to abolish, one layer up.
+    """
+    assert os.environ.get("ETV_HOOK_FIRE_LOG_DIR"), (
+        "ETV_HOOK_FIRE_LOG_DIR is not set for this test, so any hook it drives writes to the real "
+        "log. scripts/tests/conftest.py should be setting it for every test."
+    )
+    default = Path(os.path.expanduser("~/.cache/ersatztv/hook-fire"))
+    assert Path(os.environ["ETV_HOOK_FIRE_LOG_DIR"]).resolve() != default.resolve()
+
+    before = sorted(p.stat().st_mtime_ns for p in default.glob("*.jsonl")) if default.exists() else []
+    root, env = sandbox
+    hook = root / "prod-check.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin prodcheck "" capture || true\n'
+        "input=$(cat)\n"
+    )
+    subprocess.run(["bash", str(hook)], input=b'{"session_id":"s1","tool_name":"Bash"}',
+                   capture_output=True, cwd=str(root), env=env, timeout=60)
+    after = sorted(p.stat().st_mtime_ns for p in default.glob("*.jsonl")) if default.exists() else []
+    assert before == after, "a test run modified the production hook-fire log"
+
+
+def test_DELETING_the_replay_makes_the_differential_go_RED(sandbox, positives, tmp_path):
+    """THE MUTATION PROOF FOR THE TRANSPARENCY CLAUSE.
+
+    The coverage clause has its own proof (`test_a_hook_that_LOSES_its_instrumentation_is_DETECTED`).
+    That one says nothing about whether the differential test is load-bearing, and the inventory row
+    claims BOTH. So: disarm the replay in an isolated copy of the sink, point a real hook at it, and
+    the same comparison the differential performs must fail. Without this, "the A/B would catch a
+    broken wrapper" is an argument, and this repo's record is that arguments of that shape have been
+    wrong repeatedly — including for this very file, whose A/B was 97% empty-vs-empty on arrival.
+    """
+    root, env = sandbox
+    mutated = tmp_path / "hook-fire-log.sh"
+    text = SINK.read_text()
+    marker = '      cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true'
+    assert marker in text, "the replay line has moved; this mutation no longer targets it"
+    mutated.write_text(text.replace(marker, "      : # MUTATED: replay removed", 1))
+
+    hook = tmp_path / "victim.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{mutated}"\n'
+        'etv_hook_fire_begin victim "" capture || true\n'
+        "input=$(cat)\n"
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
+    )
+    p = subprocess.run(["bash", str(hook)], input=b'{"tool_name":"Bash"}', capture_output=True,
+                       cwd=str(root), env={**env, "TMPDIR": str(tmp_path)}, timeout=60)
+    assert p.stdout == b"", (
+        "the mutation did not actually disarm the replay, so this proof establishes nothing: "
+        f"stdout={p.stdout!r}"
+    )
-- 
2.47.3


From b9f031f52abb3d6f53e4551b045e839728fcf9ea Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 14:37:05 +0200
Subject: [PATCH 05/14] fix(776): a signal must not become consent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round 3, from two independent re-reviews of the round-2 fix commit. The fix for
the lost-output-on-SIGTERM defect introduced a worse one than the defect.

The signal handler ended in `exit "$?"`, and `$?` at signal time is the status of
whatever command was running — normally 0 for a guard still gathering evidence.
Measured on the real guard, `prepush-donewhen.sh` SIGTERMed mid-curl with an
unticked Done-when box:

  uninstrumented   rc=-15  git ABORTS the push
  instrumented     rc=0    git PUSHES to main

That converts a killed guard into consent, in the permissive direction, in the
hook that protects `main`. The handler now flushes, restores the default
disposition and re-raises the signal, so the process dies the way it would have
died. test_output_survives_a_SIGTERM could not see it: it asserts stdout content,
never reads the return code, and drives a capture-mode hook so no exit-code guard
is ever signalled.

Also from this round:

- The flush ran TWICE on the signal path (signal handler, then EXIT trap),
  writing two contradictory exit records for one invocation — a real decision
  then a phantom no-op — so the report mis-histogrammed the very case the trap
  was added for. It is idempotent now.
- `exec 4<&- 2>/dev/null`: the round-1 blocker pattern again, eight lines below
  the comment forbidding it. Rather than fix the third instance and wait for a
  fourth, test_no_exec_in_the_sink_carries_a_STDERR_REDIRECT now enforces it.
- The log write leaked `Operation not permitted` to stderr on an unwritable log,
  because `>> "$file" 2>/dev/null` opens the file BEFORE redirecting stderr. The
  fail-open test used a path that dies at mkdir and never reached this.
- Classification: an unrecognised value is no longer lowercased into a valid
  decision, exit 2 now dominates a printed `allow` (it is the harness's block
  channel, and reporting a permit for a refused call is the one direction this
  log must never be wrong in), and a non-zero exit no longer annotates a real
  decision with an invented `+error`.
- Classification and replay read the same bytes; they disagreed when a hook used
  fd 4, so the harness saw `deny` while the log recorded `no-op`.
- The stderr normaliser rewrote `line N:` globally, collapsing genuinely
  different diagnostics; it is anchored to the script-path prefix now.
- docs 5.4 claimed the two zero rows were "trigger did not fire", justified by
  unit tests that invoke the scripts directly and therefore prove nothing about
  harness dispatch. It now separates what is established from what is not, and
  stops contradicting its own decision record.

Refs: #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 docs/defect-shapes-773.md           |  25 ++--
 scripts/hook-fire-log.sh            | 120 +++++++++++-----
 scripts/tests/test_hook_fire_log.py | 205 ++++++++++++++++++++++++++--
 3 files changed, 294 insertions(+), 56 deletions(-)

diff --git a/docs/defect-shapes-773.md b/docs/defect-shapes-773.md
index cb456dfaf..796511021 100644
--- a/docs/defect-shapes-773.md
+++ b/docs/defect-shapes-773.md
@@ -527,14 +527,23 @@ headless session exercising the four tool paths above, then a `git commit` and a
 `git push --dry-run`, and read `scripts/hook-fire-log.sh report --all --dir <that directory>`.
 
 **A zero is two findings wearing one number** — a hook that is broken, and a hook whose trigger did
-not occur — and the report says so rather than presenting a zero as a verdict. Both zeroes here are
-the second kind, and that is established rather than assumed: `pretooluse-nav-guard` and
-`pretooluse-merge-consent` are each driven to their deciding branch in
-`scripts/tests/test_hook_fire_log.py` (a `deny` on an `/iptv/` URL and an `ask` on a merge call
-respectively), emitting the correct decision with instrumentation in place. So both hooks are
-demonstrably healthy; what did not happen in this window is their trigger. Neither can be exercised
-end-to-end without a live browser session or a real merge attempt, and manufacturing a merge to
-observe the merge guard is a worse idea than the gap it would close.
+not occur — and the report says so rather than presenting a zero as a verdict.
+
+For the two zeroes here, what is established and what is not, kept apart deliberately.
+**Established:** both script bodies work. `pretooluse-nav-guard` and `pretooluse-merge-consent` are
+each driven to their deciding branch in `scripts/tests/test_hook_fire_log.py` — a `deny` on an
+`/iptv/` URL and an `ask` on a merge call — emitting the correct decision with the instrumentation
+in place. **Not established:** that the harness would dispatch to them. Those tests invoke the
+scripts directly, so they bypass registration and matcher dispatch entirely; a typo in
+`.claude/settings.json`, a settings file that never loaded, or a matcher that does not match would
+leave both tests green while the production zero still meant broken wiring. A working script is a
+necessary condition, not the finding.
+
+So these two zeroes remain genuinely ambiguous, and neither can be resolved without the thing that
+resolves it: a live browser session, or a real merge attempt. Manufacturing a merge to observe the
+merge guard is a worse idea than the gap it would close. Distinguishing the two meanings of zero
+stays a human judgement — `testing.hook-reports-its-own-execution` says so, and an earlier draft of
+this paragraph quietly contradicted it by treating "the script works" as "the wiring works".
 
 **The measurement earned its keep on its first run.** `pretooluse-agent-model` was recorded deciding
 `no-op` on an `Agent` dispatch where `ask` was expected. Previously that would have been an
diff --git a/scripts/hook-fire-log.sh b/scripts/hook-fire-log.sh
index bf59bf6aa..914ab81f4 100755
--- a/scripts/hook-fire-log.sh
+++ b/scripts/hook-fire-log.sh
@@ -107,7 +107,12 @@ etv_hook_fire_record() {
     "$(etv_hook_fire_scrub "${6:-}")" \
     "$(etv_hook_fire_scrub "${7:-}")" 2>/dev/null) || return 0
 
-  printf '%s\n' "$line" >> "$file" 2>/dev/null || true
+  # ORDER MATTERS: `2>` BEFORE `>>`. Redirections are applied left to right, so
+  # `printf ... >> "$file" 2>/dev/null` opens the file FIRST and bash reports a failure to open it
+  # on the stderr still in force — the hook prints `Operation not permitted` at the harness. An
+  # existing-but-unwritable log file is the reachable case; the fail-open test missed it by using a
+  # path that dies at `mkdir` instead. Redirecting stderr first covers the open failure too.
+  printf '%s\n' "$line" 2>/dev/null >> "$file" || true
   return 0
 }
 
@@ -131,12 +136,17 @@ etv_hook_fire_classify() {
   fi
 
   if [ -n "$out" ]; then
-    # `[A-Za-z]` then lowercased, not `[a-z]`: a hook printing `"permissionDecision":"Deny"` fell
-    # through the lowercase-only class and was recorded as `output` — a real decision filed as
-    # unclassified prose.
     d=$(printf '%s' "$out" | sed -n 's/.*"permissionDecision"[[:space:]]*:[[:space:]]*"\([A-Za-z-]*\)".*/\1/p' | head -n1)
     [ -z "$d" ] && d=$(printf '%s' "$out" | sed -n 's/.*"decision"[[:space:]]*:[[:space:]]*"\([A-Za-z-]*\)".*/\1/p' | head -n1)
-    d=$(printf '%s' "$d" | tr 'A-Z' 'a-z')
+
+    # A NON-CANONICAL VALUE IS RECORDED AS SUCH, not normalised into a valid one. An earlier version
+    # lowercased whatever it found, so `"permissionDecision":"Deny"` was filed as a clean `deny` —
+    # manufacturing a decision the harness may never have honoured. The documented values are
+    # lowercase; anything else is a hook bug, and the log should say so rather than launder it.
+    case "$d" in
+      allow|deny|ask|block|"") ;;
+      *) d="unrecognized" ;;
+    esac
     # `additionalContext` with no decision (design-sync-reminder's `start` path) informs, it does
     # not gate. Naming it distinctly keeps it out of the allow/deny counts. Matched WITH its quotes
     # and colon — a bare substring test also fired on human prose that merely used the word.
@@ -144,21 +154,19 @@ etv_hook_fire_classify() {
     [ -z "$d" ] && d="output"
   fi
 
-  # Exit 2 is the harness's non-JSON block channel. No hook here uses it today; it is classified
-  # anyway so that a hook which starts using it is not silently recorded as a no-op.
-  if [ "$code" = "2" ] && [ -z "$d" ]; then d="deny-exit2"; fi
+  # Exit 2 is the harness's block channel and it DOMINATES: the call is blocked whatever the JSON
+  # said. Recording a printed `allow` here would report a permit for an invocation that was refused,
+  # which is the one direction a log of security decisions must never be wrong in.
+  if [ "$code" = "2" ]; then printf 'deny-exit2'; return 0; fi
+
   [ -z "$d" ] && d="no-op"
 
-  # A non-zero status NO LONGER OVERWRITES a parsed decision. It used to, so a hook that printed a
-  # real `deny` and then exited 1 was recorded as `error` — the status erasing the decision, when
-  # the status already has its own field in the record. `error` now means only "it failed and said
-  # nothing classifiable".
-  if [ "$code" != "0" ] && [ "$code" != "2" ]; then
-    case "$d" in
-      no-op|output) d="error" ;;
-      *) d="${d}+error" ;;
-    esac
-  fi
+  # A non-zero status does NOT annotate a parsed decision. It used to overwrite one (`deny` + exit 1
+  # recorded as `error`), and the first correction over-swung the other way and appended `+error` —
+  # inventing a composite state the harness does not report. The status already has its own field in
+  # the record, so the decision field states the decision and nothing else. `error` means only "it
+  # failed and said nothing classifiable".
+  if [ "$code" != "0" ] && [ "$d" = "no-op" ]; then d="error"; fi
 
   printf '%s' "$d"
 }
@@ -258,16 +266,33 @@ etv_hook_fire_begin() {
 
   # SIGNALS, not just EXIT. Bash runs no EXIT trap for an untrapped fatal signal, so a hook killed
   # by the harness timeout would have its already-printed decision discarded along with the temp
-  # file: measured at 52 bytes delivered before instrumentation and 0 after. Trapping the signals
-  # makes bash run the handler and then the EXIT trap, which replays. Every `capture`-mode hook
-  # today prints and exits immediately, so the window is sub-millisecond — but the constraint is
-  # invisible to a future editor, so it is enforced here rather than relied upon.
-  trap 'etv_hook_fire_end "$?"' EXIT INT TERM HUP
+  # file: measured at 52 bytes delivered before instrumentation and 0 after.
+  #
+  # THE SIGNAL HANDLER MUST NOT `exit`, AND THIS IS THE IMPORTANT PART. A handler that ends in
+  # `exit "$?"` re-raises whatever status the interrupted command happened to have — normally 0 for
+  # a guard still gathering evidence. Measured on `prepush-donewhen.sh` mid-`curl`, with an unticked
+  # Done-when box: uninstrumented, SIGTERM kills it and git ABORTS the push; with an `exit`-based
+  # handler the hook returned 0 and git PUSHED TO MAIN. That converts a signal into consent, in the
+  # permissive direction, in the guard that protects `main` — worse than the lost log line it was
+  # added to fix. So the handler flushes, then restores the default disposition and re-raises the
+  # signal, letting the process die the way it would have died. Pinned by
+  # `test_a_SIGNALLED_stream_hook_still_FAILS`.
+  trap 'etv_hook_fire_signal INT'  INT
+  trap 'etv_hook_fire_signal TERM' TERM
+  trap 'etv_hook_fire_signal HUP'  HUP
+  trap 'etv_hook_fire_end "$?"' EXIT
   return 0
 }
 
-etv_hook_fire_end() {
+# Flush and record, WITHOUT deciding how the process ends. Both the EXIT trap and the signal handler
+# call this; `ETV_HOOK_FIRE_FLUSHED` makes it idempotent, because on the signal path bash runs the
+# signal handler AND then the EXIT trap. Without the guard that wrote two contradictory `exit`
+# records for one invocation — a real `deny` followed by a phantom `no-op` — so the report
+# mis-histogrammed exactly the case the signal trap was added for.
+etv_hook_fire_flush() {
   local code="${1:-0}" out=""
+  [ "${ETV_HOOK_FIRE_FLUSHED:-0}" = "1" ] && return 0
+  ETV_HOOK_FIRE_FLUSHED=1
 
   # RESTORE FIRST, UNCONDITIONALLY — then replay if there is anything to replay.
   #
@@ -288,19 +313,26 @@ etv_hook_fire_end() {
     exec 1>&3 3>&- || true
   fi
   if [ -n "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ]; then
-    # Read through the FD, not the path — see the `exec 4<` comment in begin. `cat <&4` also avoids
-    # the other trap: `out=$(cat ...)` strips trailing newlines, so replaying through a variable
-    # delivers the hook's JSON one byte short of what it wrote, which every JSON parser downstream
-    # accepts without complaint. Pinned by `test_stdout_is_replayed_BYTE_EXACT`.
-    out=$(cat <&4 2>/dev/null || true)   # for CLASSIFICATION; losing a trailing newline is harmless
-    exec 4<&- 2>/dev/null || true
-    # Replay the exact bytes from the file if the name still resolves, else from what the fd gave
-    # us. The first path is byte-exact; the second is the rescue.
-    if [ -r "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ] && [ -s "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ]; then
-      cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true
-    elif [ -n "$out" ]; then
-      printf '%s' "$out"
+    # ONE read, used for BOTH the replay and the classification, so the two cannot disagree. They
+    # did: the classifier read fd 4 while the replay preferred the file, so a hook that used fd 4
+    # itself replayed its `deny` correctly to the harness and filed it in the log as `no-op` — the
+    # log quietly contradicting the decision it exists to record.
+    #
+    # The `printf X` / `%X` dance preserves trailing newlines, which `$(...)` strips. Without it the
+    # rescue path delivered 52 bytes where the hook wrote 53, and every JSON parser downstream
+    # accepts the short form without complaint. Pinned by `test_stdout_is_replayed_BYTE_EXACT`.
+    #
+    # NO `2>/dev/null` ON THE `exec` — see the stdin comment. An earlier version of THIS line had
+    # it, eight lines below the comment forbidding it, which is why the rule is now restated at
+    # every `exec` rather than once.
+    if [ -r "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ]; then
+      out=$( { cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null; printf 'X'; } )
+    else
+      out=$( { cat <&4 2>/dev/null; printf 'X'; } )   # the file was unlinked; the fd still reads it
     fi
+    out="${out%X}"
+    exec 4<&- || true
+    [ -n "$out" ] && printf '%s' "$out"
   fi
 
   etv_hook_fire_record \
@@ -309,12 +341,28 @@ etv_hook_fire_end() {
     "exit" "$code" "$(etv_hook_fire_classify "$out" "$code" "${ETV_HOOK_FIRE_MODE:-capture}")" || true
 
   rm -f "${ETV_HOOK_FIRE_STDIN_TMP:-}" "${ETV_HOOK_FIRE_STDOUT_TMP:-}" 2>/dev/null || true
+  ETV_HOOK_FIRE_STDOUT_TMP=""
+  return 0
+}
 
+etv_hook_fire_end() {
+  local code="${1:-0}"
+  etv_hook_fire_flush "$code"
   # Re-raise the hook's own status explicitly rather than relying on the trap preserving it. Bash
   # does not re-enter an EXIT trap, so this is not recursive.
   exit "$code"
 }
 
+# The signal path. Flush, then DIE THE WAY THE PROCESS WOULD HAVE DIED: restore the default
+# disposition and re-raise, so the parent still sees "killed by signal N" rather than a status this
+# handler invented. `git` reads that distinction, and reporting 0 here let a push through.
+etv_hook_fire_signal() {
+  local sig="${1:-TERM}"
+  etv_hook_fire_flush "$?"
+  trap - INT TERM HUP EXIT
+  kill -s "$sig" "$$"
+}
+
 # ---------------------------------------------------------------------------------------------
 # Read side: the report
 # ---------------------------------------------------------------------------------------------
diff --git a/scripts/tests/test_hook_fire_log.py b/scripts/tests/test_hook_fire_log.py
index f0acb869f..9d96c0d8d 100644
--- a/scripts/tests/test_hook_fire_log.py
+++ b/scripts/tests/test_hook_fire_log.py
@@ -528,9 +528,12 @@ def _normalise_stderr(err: bytes) -> bytes:
     transparency. Only the script path and `line N:` are normalised — narrowly, so that a genuine
     difference in the message body still fails.
     """
-    err = re.sub(rb"[^\s:]*/[^\s:]*\.sh:", b"<script>:", err)
-    err = re.sub(rb"line \d+:", b"line <n>:", err)
-    return err
+    # The two fields are normalised TOGETHER, as one anchored prefix, not independently. A global
+    # `line \d+:` substitution also rewrites application text that happens to contain that phrase,
+    # and cold review demonstrated it collapsing two genuinely different diagnostics ("highest
+    # private fd line 0" vs "line 4") into one — hiding exactly the kind of fd-state difference this
+    # comparison exists to catch.
+    return re.sub(rb"[^\s:]*/[^\s:]*\.sh: line \d+:", b"<script>: line <n>:", err)
 
 
 @pytest.mark.parametrize("hook", hook_scripts(), ids=lambda h: h.stem)
@@ -966,13 +969,19 @@ def test_output_survives_a_SIGTERM(sandbox):
 @pytest.mark.parametrize(
     "emit,code,expected",
     [
-        # Uppercase: a real decision was filed as unclassified prose because the class was [a-z] only.
-        (r'{\"permissionDecision\":\"Deny\"}', 0, "deny"),
-        # A non-zero status must not ERASE a decision the hook actually printed; the status has its
-        # own field in the record.
-        (r'{\"permissionDecision\":\"deny\"}', 1, "deny+error"),
-        # ...but a failure with nothing classifiable is still an error.
+        # A NON-CANONICAL value is recorded as non-canonical, not laundered into a valid decision.
+        # This case went both ways before settling: first filed as unclassified prose, then
+        # lowercased into a clean `deny` (manufacturing a decision the harness may never honour).
+        (r'{\"permissionDecision\":\"Deny\"}', 0, "unrecognized"),
+        # A non-zero status neither ERASES a printed decision nor annotates it. The status has its
+        # own field; the decision field states the decision and nothing else.
+        (r'{\"permissionDecision\":\"deny\"}', 1, "deny"),
+        # A failure with nothing classifiable IS an error.
         ("", 1, "error"),
+        # Exit 2 is the harness's block channel and DOMINATES the printed JSON. Recording the
+        # printed `allow` would report a permit for a call that was actually refused — the one
+        # direction a log of security decisions must never be wrong in.
+        (r'{\"permissionDecision\":\"allow\"}', 2, "deny-exit2"),
     ],
 )
 def test_the_classifier_does_not_MISREPORT(sandbox, emit, code, expected):
@@ -1082,9 +1091,13 @@ def test_DELETING_the_replay_makes_the_differential_go_RED(sandbox, positives, t
     root, env = sandbox
     mutated = tmp_path / "hook-fire-log.sh"
     text = SINK.read_text()
-    marker = '      cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true'
-    assert marker in text, "the replay line has moved; this mutation no longer targets it"
-    mutated.write_text(text.replace(marker, "      : # MUTATED: replay removed", 1))
+    marker = '''    [ -n "$out" ] && printf '%s' "$out"'''
+    assert marker in text, (
+        "the replay line has moved; this mutation no longer targets it. Retarget it rather than "
+        "loosening the match — a mutation that silently stops mutating proves nothing, which is "
+        "the whole failure class this file exists to catch."
+    )
+    mutated.write_text(text.replace(marker, "    : # MUTATED: replay removed", 1))
 
     hook = tmp_path / "victim.sh"
     hook.write_text(
@@ -1100,3 +1113,171 @@ def test_DELETING_the_replay_makes_the_differential_go_RED(sandbox, positives, t
         "the mutation did not actually disarm the replay, so this proof establishes nothing: "
         f"stdout={p.stdout!r}"
     )
+
+
+def test_a_SIGNALLED_stream_hook_still_FAILS(sandbox):
+    """A signal must not become consent. THE regression from the round-2 signal trap.
+
+    Measured on the real guard: `prepush-donewhen.sh` SIGTERMed mid-`curl` exits -15 without
+    instrumentation, so git aborts the push; with an `exit "$?"`-based signal handler it returned 0
+    and git PUSHED TO MAIN, because `$?` at signal time was the status of whatever command was
+    running — 0 for a guard still gathering evidence.
+
+    `test_output_survives_a_SIGTERM` could not see it: that test asserts stdout CONTENT and never
+    reads the return code, and it drives a capture-mode hook, so no exit-code guard is ever
+    signalled. This one asserts the only thing git looks at.
+    """
+    import signal
+    import time
+
+    root, env = sandbox
+    for sig, name in ((signal.SIGTERM, "TERM"), (signal.SIGINT, "INT"), (signal.SIGHUP, "HUP")):
+        hook = root / f"sig-{name}.sh"
+        hook.write_text(
+            "#!/usr/bin/env bash\nset -uo pipefail\n"
+            f'. "{SINK}"\n'
+            f'etv_hook_fire_begin sig{name} "" stream || true\n'
+            "input=$(cat)\n"
+            "sleep 30\n"
+            "exit 1\n"
+        )
+        payload = root / f"sig-{name}.json"
+        payload.write_bytes(b'{"tool_name":"Bash"}')
+        with open(payload, "rb") as fh:
+            p = subprocess.Popen(["bash", str(hook)], stdin=fh, stdout=subprocess.PIPE,
+                                 stderr=subprocess.PIPE, cwd=str(root), env=env)
+            time.sleep(1.5)
+            p.send_signal(sig)
+            p.communicate(timeout=30)
+
+        assert p.returncode != 0, (
+            f"a hook killed by SIG{name} reported SUCCESS ({p.returncode}). git reads this status: "
+            "for a pre-push guard that is the difference between aborting the push and letting it "
+            "through, so the instrumentation would have turned a killed guard into consent."
+        )
+        assert p.returncode == -sig, (
+            f"SIG{name}: expected death by signal ({-sig}), got {p.returncode}. The handler is "
+            "inventing an exit status instead of re-raising."
+        )
+
+
+def test_the_exit_record_is_written_ONCE_on_the_signal_path(sandbox):
+    """Bash runs the signal handler AND then the EXIT trap, so the flush must be idempotent.
+
+    Without the guard this wrote two contradictory `exit` records for one invocation — a real
+    decision followed by a phantom `no-op` — and the report histograms exit records, so the product
+    mis-reported precisely the case the signal trap was added to capture.
+    """
+    import signal
+    import time
+
+    root, env = sandbox
+    logdir = root / "log-signal-once"
+    hook = root / "sigonce.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin sigonce "" capture || true\n'
+        "input=$(cat)\n"
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
+        "sleep 30\n"
+    )
+    payload = root / "sigonce.json"
+    payload.write_bytes(b'{"session_id":"s1","tool_name":"Bash"}')
+    with open(payload, "rb") as fh:
+        p = subprocess.Popen(["bash", str(hook)], stdin=fh, stdout=subprocess.PIPE,
+                             stderr=subprocess.PIPE, cwd=str(root),
+                             env={**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)})
+        time.sleep(1.5)
+        p.send_signal(signal.SIGTERM)
+        out, _ = p.communicate(timeout=30)
+
+    records = (logdir / "s1.jsonl").read_text().splitlines()
+    exits = [r for r in records if '"phase":"exit"' in r]
+    assert len(exits) == 1, f"expected exactly one exit record, got {len(exits)}:\n" + "\n".join(records)
+    assert '"decision":"deny"' in exits[0], f"the surviving record lost the decision: {exits[0]}"
+    assert b'"permissionDecision":"deny"' in out, "the decision was not replayed to the harness"
+
+
+def test_no_exec_in_the_sink_carries_a_STDERR_REDIRECT():
+    """The rule that has now been broken twice, enforced instead of restated.
+
+    `exec` with redirections and no command applies them to the SHELL, permanently. `exec ... 2>/dev/null`
+    therefore silences the hook's whole stderr rather than suppressing an error from that one
+    redirection. It shipped once in the stdin replay (silencing every husky guard's user-facing
+    output), was fixed, and was then reintroduced eight lines below the comment forbidding it.
+    A grep is a weak detector in general; here the pattern is exact and the cost of missing it is a
+    guard that blocks while explaining nothing.
+    """
+    offenders = [
+        f"{SINK.name}:{i}: {ln.strip()}"
+        for i, ln in enumerate(SINK.read_text().splitlines(), 1)
+        if re.match(r"\s*exec\s[^|&;#]*2>", ln) and not ln.lstrip().startswith("#")
+    ]
+    assert not offenders, (
+        "these `exec` lines carry a stderr redirection, which applies to the whole shell and "
+        "silences the hook:\n  " + "\n  ".join(offenders)
+    )
+
+
+def test_the_log_and_the_REPLAY_agree_when_the_hook_uses_fd_4(sandbox):
+    """Classification and replay must read the same bytes.
+
+    They did not: the classifier read fd 4 while the replay preferred the file, so a hook that used
+    fd 4 for its own purposes replayed its `deny` correctly to the harness and filed it in the log
+    as `no-op` — the record contradicting the decision it exists to record.
+    """
+    root, env = sandbox
+    logdir = root / "log-fd4"
+    hook = root / "fd4.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin fd4 "" capture || true\n'
+        "input=$(cat)\n"
+        'exec 4</dev/null\n'          # the hook takes fd 4 for itself
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
+    )
+    p = subprocess.run(["bash", str(hook)], input=b'{"session_id":"s1","tool_name":"Bash"}',
+                       capture_output=True, cwd=str(root),
+                       env={**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)}, timeout=60)
+    assert b'"permissionDecision":"deny"' in p.stdout, f"replay lost the decision: {p.stdout!r}"
+    exits = [r for r in (logdir / "s1.jsonl").read_text().splitlines() if '"phase":"exit"' in r]
+    assert '"decision":"deny"' in exits[0], (
+        f"the harness saw a deny but the log recorded something else: {exits[0]}"
+    )
+
+
+def test_an_UNWRITABLE_log_file_is_still_stderr_transparent(sandbox, tmp_path):
+    """Fail-open must be SILENT, not merely non-fatal.
+
+    `printf ... >> "$file" 2>/dev/null` looks like it suppresses a failure to open the log. It does
+    not: redirections apply left to right, so bash opens the file first and reports the failure on
+    the stderr still in force — the hook prints `Operation not permitted` straight at the harness.
+    `test_logging_failure_does_not_break_the_hook` could not see it because its path dies at `mkdir`
+    and never reaches an existing-but-unwritable destination.
+    """
+    _root, env = sandbox
+    logdir = tmp_path / "ro-log"
+    logdir.mkdir()
+    victim = logdir / "s1.jsonl"
+    victim.write_text("")
+    victim.chmod(0o400)
+
+    hook = tmp_path / "ro.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin ro "" capture || true\n'
+        "input=$(cat)\n"
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
+    )
+    p = subprocess.run(["bash", str(hook)], input=b'{"session_id":"s1","tool_name":"Bash"}',
+                       capture_output=True, cwd=str(tmp_path),
+                       env={**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)}, timeout=60)
+    assert p.returncode == 0
+    assert p.stdout == b'{"hookSpecificOutput":{"permissionDecision":"deny"}}'
+    assert p.stderr == b"", (
+        "an unwritable log leaked a diagnostic to the harness. Observability that cannot write must "
+        f"be silent, not chatty: {p.stderr!r}"
+    )
-- 
2.47.3


From 830939b4ff3bcc374809f90ee6c66dc2a7ef98a7 Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 14:37:49 +0200
Subject: [PATCH 06/14] =?UTF-8?q?docs(776):=20record=20the=20round-3=20les?=
 =?UTF-8?q?son=20=E2=80=94=20the=20fix=20was=20worse=20than=20the=20defect?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three review rounds, and every round found the previous round's FIX had
introduced something beside its target. That is the transferable finding, not any
individual bug, so it goes in the record rather than only in a commit message.

Also names the pattern that cost two of those rounds: a fix that reads as applied
while changing nothing (a scrubber that permits the very characters it was added
to remove), and a rule restated in a comment three times instead of enforced once
by a test.

Refs: #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../testing/hook-reports-its-own-execution.md | 29 ++++++++++++++-----
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/docs/decisions/records/testing/hook-reports-its-own-execution.md b/docs/decisions/records/testing/hook-reports-its-own-execution.md
index f1c7ba28e..7fae69143 100644
--- a/docs/decisions/records/testing/hook-reports-its-own-execution.md
+++ b/docs/decisions/records/testing/hook-reports-its-own-execution.md
@@ -68,16 +68,31 @@ one was surfaced by a finding ranked *Low*.
 | `exec 0<"$sin" 2>/dev/null` sent the hook's **entire stderr** to /dev/null for its whole life — `exec` with no command redirects the shell permanently. Every husky guard's user-facing output is stderr, so guards blocked while explaining nothing | the A/B compared only stdout and exit status | `test_stderr_is_NOT_silenced` |
 | The fd restore lived inside the same conditional as the replay, and the replay read the PATH — so an unlinked-but-open scratch file meant a swallowed `deny` and an exit 0 | needs `mktemp` stubbed or the file removed mid-run | `test_output_SURVIVES_a_vanished_stdout_tempfile` |
 | A hook killed by the harness timeout lost output it had already printed: 52 bytes before, 0 after | bash runs no EXIT trap for an untrapped fatal signal, and no test sent one | `test_output_survives_a_SIGTERM` |
+| **The fix for that one was worse than it.** A signal handler ending in `exit "$?"` re-raises the status of whatever command was interrupted — normally 0. `prepush-donewhen.sh` SIGTERMed mid-`curl`: uninstrumented rc −15 and git aborts the push; instrumented rc 0 and **git pushes to `main`**. A signal became consent, in the guard that protects `main` | the SIGTERM test asserts stdout CONTENT and never reads the return code, and drives a capture-mode hook, so no exit-code guard was ever signalled | `test_a_SIGNALLED_stream_hook_still_FAILS` |
+| The flush ran twice on the signal path (handler, then EXIT trap), writing two contradictory `exit` records for one invocation | nothing counted records per invocation | `test_the_exit_record_is_written_ONCE_on_the_signal_path` |
 | `out=$(cat f)` strips trailing newlines, so a hook's JSON reached the harness one byte short | every JSON parser accepts it; only a byte comparison objects | `test_stdout_is_replayed_BYTE_EXACT` |
 | An unconditional stdin slurp blocks forever on a TTY, hanging every interactive `git commit` | the pipe-fed tests cannot reach a tty; needs a real pty | `test_a_TTY_stdin_is_not_slurped` |
 
-Two further notes, both about fixes that read as done and were not. The path-traversal hardening for
-the session id first reused the record scrubber, which deliberately keeps `/` and `.` — so
-`../../escaped` passed through untouched and the fix read as applied while changing nothing;
-**passing a value through a scrub is not the same as passing it through the right scrub.** And a
-shared `TMPDIR` between the two halves of the differential let the control's one-shot throttle marker
-suppress the instrumented run, so the test reported a swallowed decision that never happened: a
-differential whose halves share mutable state stops measuring the difference and measures the state.
+**The generalisable lesson is about the fixing, not the bugs.** This took three review rounds, and
+every round found that the previous round's *fix* had introduced something beside its target. The
+signal fix is the sharpest case: it corrected a lost log line and, in doing so, turned a killed
+`main`-protection guard into a rubber stamp. The rule this repo already has —
+`process.consistency-fix-new-code-scrutiny`, a fix is new code and gets reviewed as new code —
+applies with full force to instrumentation, because the fix and the thing it instruments occupy the
+same execution path.
+
+Two of those fixes read as done and were not, which is the more useful pattern to recognise. The
+path-traversal hardening reused the record scrubber, which deliberately permits `/` and `.`, so
+`../../escaped` passed through untouched: **passing a value through a scrub is not the same as
+passing it through the right scrub.** And `exec … 2>/dev/null` was fixed twice and reintroduced a
+third time, eight lines below the comment forbidding it — which is why
+`test_no_exec_in_the_sink_carries_a_STDERR_REDIRECT` now enforces the rule instead of restating it.
+Enumerating instances loses to removing the class, and the third instance is what proves it.
+
+One measurement note, since it cost a round of confusion: a shared `TMPDIR` between the two halves
+of the differential let the control's one-shot throttle marker suppress the instrumented run, so the
+test reported a swallowed decision that never happened. A differential whose halves share mutable
+state stops measuring the difference and measures the state.
 
 **What the first measurement immediately produced**, which is the argument for the whole thing. A
 live run recorded `pretooluse-agent-model` firing on an `Agent` dispatch and deciding `no-op` where
-- 
2.47.3


From ad636132b7c547487311105d12f9539048fa95fc Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 15:18:30 +0200
Subject: [PATCH 07/14] fix(776): withdraw the signal trap rather than fix it a
 fourth time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round 4, two independent reviews. No Blocker, but the signal trap produced its
third defect in three rounds and the fourth finding settles it: bash does not run
a trap handler until the current foreground command completes. Measured, same
hook, SIGTERM to the pid: uninstrumented dies in 1s, instrumented in 30s. A
TERM-then-KILL supervisor therefore gets no flush AT ALL plus a 29s stall —
strictly worse than untrapped, on the exact path the trap existed for.

So it is withdrawn, not patched again. What that loses is enumerated in the
decision record (a killed hook's exit record, its already-printed stdout, its
temp files) rather than waved past. The invariant that replaces it is stronger
and is asserted as an A/B: under a signal, instrumented and uninstrumented are
indistinguishable in BOTH exit status and time to die. The timing half is what
the trap broke, and no assertion about output could have caught it.

Also fixed this round:

- A signalled hook was RECORDED as code=0 decision=pass, because `local sig=...`
  clobbers `$?` before the flush can read it. git blocked correctly while the log
  said the killed guard passed. Moot now the trap is gone, but it is why the
  signal tests assert the record and not only the process status.
- The classifier's sed/tr were locale-aware, so one 0xE9 byte in a deny reason
  printed `illegal byte sequence` at the harness AND filed a real deny as
  `output`. LC_ALL=C.
- Payload fields were read from a 64KB prefix, so a large tool_response pushed
  session_id past the cap and those fires filed under `unknown-session` — reading
  as never-fired in the report. Unbounded now.
- `cat <&4 2>/dev/null` and `cat > "$sin" 2>/dev/null`: the SAME left-to-right
  redirect hazard, at two more commands. The previous guard grepped only `exec`,
  so it walked past both — the class was named, not removed.
  test_no_redirection_in_the_sink_PRECEDES_its_stderr_redirect now covers any
  command, exempting `2>&1` (which is correct precisely because it comes after).
- `deny2`/`deny_now` extracted as `output` rather than `unrecognized`; an
  inherited ETV_HOOK_FIRE_FLUSHED=1 disabled reporting entirely; unclassified
  output plus a failing exit hid the failure as `output`; NUL bytes were dropped
  and warned about on stderr.

Refs: #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../testing/hook-reports-its-own-execution.md |  32 +-
 scripts/hook-fire-log.sh                      | 110 ++++---
 scripts/tests/test_hook_fire_log.py           | 289 +++++++++++-------
 3 files changed, 272 insertions(+), 159 deletions(-)

diff --git a/docs/decisions/records/testing/hook-reports-its-own-execution.md b/docs/decisions/records/testing/hook-reports-its-own-execution.md
index 7fae69143..40db37ba0 100644
--- a/docs/decisions/records/testing/hook-reports-its-own-execution.md
+++ b/docs/decisions/records/testing/hook-reports-its-own-execution.md
@@ -67,12 +67,38 @@ one was surfaced by a finding ranked *Low*.
 |---|---|---|
 | `exec 0<"$sin" 2>/dev/null` sent the hook's **entire stderr** to /dev/null for its whole life — `exec` with no command redirects the shell permanently. Every husky guard's user-facing output is stderr, so guards blocked while explaining nothing | the A/B compared only stdout and exit status | `test_stderr_is_NOT_silenced` |
 | The fd restore lived inside the same conditional as the replay, and the replay read the PATH — so an unlinked-but-open scratch file meant a swallowed `deny` and an exit 0 | needs `mktemp` stubbed or the file removed mid-run | `test_output_SURVIVES_a_vanished_stdout_tempfile` |
-| A hook killed by the harness timeout lost output it had already printed: 52 bytes before, 0 after | bash runs no EXIT trap for an untrapped fatal signal, and no test sent one | `test_output_survives_a_SIGTERM` |
-| **The fix for that one was worse than it.** A signal handler ending in `exit "$?"` re-raises the status of whatever command was interrupted — normally 0. `prepush-donewhen.sh` SIGTERMed mid-`curl`: uninstrumented rc −15 and git aborts the push; instrumented rc 0 and **git pushes to `main`**. A signal became consent, in the guard that protects `main` | the SIGTERM test asserts stdout CONTENT and never reads the return code, and drives a capture-mode hook, so no exit-code guard was ever signalled | `test_a_SIGNALLED_stream_hook_still_FAILS` |
-| The flush ran twice on the signal path (handler, then EXIT trap), writing two contradictory `exit` records for one invocation | nothing counted records per invocation | `test_the_exit_record_is_written_ONCE_on_the_signal_path` |
+| `sed`/`tr` in the classifier are locale-aware, so one 0xE9 byte in a `permissionDecisionReason` printed `illegal byte sequence` AT THE HARNESS and filed a real `deny` as `output` | no test put a non-UTF-8 byte in a decision | `LC_ALL=C`, plus the stderr comparison in the A/B |
+| Payload fields were read from a `head -c 65536` prefix, so a large `tool_response` pushed `session_id` past the cap and those fires filed under `unknown-session` — reading as NEVER FIRED in the report | a truncating read is a sampling error, and no fixture was over 64 KB | fields now read from the file, unbounded |
 | `out=$(cat f)` strips trailing newlines, so a hook's JSON reached the harness one byte short | every JSON parser accepts it; only a byte comparison objects | `test_stdout_is_replayed_BYTE_EXACT` |
 | An unconditional stdin slurp blocks forever on a TTY, hanging every interactive `git commit` | the pipe-fed tests cannot reach a tty; needs a real pty | `test_a_TTY_stdin_is_not_slurped` |
 
+**One mechanism was WITHDRAWN rather than fixed, and it is recorded here because the next reader
+will otherwise re-add it.** A `trap … INT TERM HUP` was added so a hook killed by the harness
+timeout would not lose output it had already printed. It produced a defect in each of three
+consecutive rounds — a handler ending in `exit "$?"` that turned a signal into consent and let a
+push reach `main`; a `local sig=…` that clobbered `$?` so a killed guard was *recorded* as having
+passed; and a second signal mid-flush that discarded the output entirely. What settled it was none
+of those, because all three were fixable: **bash does not run a trap handler until the current
+foreground command completes.** An instrumented hook interrupted mid-`curl` took 30 s to die where
+the uninstrumented one took 1 s, so a TERM-then-KILL supervisor gets no flush *at all* plus a 29 s
+stall — strictly worse, on the exact path the trap existed for.
+
+What is lost by withdrawing it, enumerated rather than waved past, because
+`process.enumerate-workaround-behaviors-before-deleting` exists for precisely this move:
+
+| Behaviour the trap provided | Status now |
+|---|---|
+| A killed hook's `exit` record | **LOST.** This is why `report` counts `fire` records, not `exit` records — a hook that fired and was killed still shows as having fired |
+| Stdout a killed hook had already printed | **LOST**, and near-unreachable: every capture-mode hook prints its decision and exits immediately, a sub-millisecond window |
+| Cleanup of the two temp files on a kill | **LOST**, bounded by `$TMPDIR` cleanup |
+| Idempotent flush (`ETV_HOOK_FIRE_FLUSHED`) | **RETAINED** — cheap, and the failure it prevents is silent |
+
+The invariant that replaces the rescue is stronger than it was, and is now asserted directly:
+**under a signal, an instrumented hook is indistinguishable from an uninstrumented one.**
+`test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one` compares both the exit status and
+the *time to die*, and it is the timing half that the trap broke — no assertion about output could
+have caught it.
+
 **The generalisable lesson is about the fixing, not the bugs.** This took three review rounds, and
 every round found that the previous round's *fix* had introduced something beside its target. The
 signal fix is the sharpest case: it corrected a lost log line and, in doing so, turned a killed
diff --git a/scripts/hook-fire-log.sh b/scripts/hook-fire-log.sh
index 914ab81f4..d43146e8e 100755
--- a/scripts/hook-fire-log.sh
+++ b/scripts/hook-fire-log.sh
@@ -126,6 +126,9 @@ etv_hook_fire_record() {
 # Anything else printed on stdout is surfaced to the user but decides nothing.
 etv_hook_fire_classify() {
   local out="${1:-}" code="${2:-0}" mode="${3:-capture}" d=""
+  # BYTE-ORIENTED, not locale-aware. One 0xE9 byte in a `permissionDecisionReason` made `sed` print
+  # `illegal byte sequence` to the harness AND fail to extract, filing a real `deny` as `output`.
+  local LC_ALL=C LANG=C
 
   # A `stream`-mode hook is a git hook: git reads its exit code and nothing else, so that is the
   # whole of its decision. Reporting `no-op` here because no JSON was captured would be an
@@ -136,8 +139,11 @@ etv_hook_fire_classify() {
   fi
 
   if [ -n "$out" ]; then
-    d=$(printf '%s' "$out" | sed -n 's/.*"permissionDecision"[[:space:]]*:[[:space:]]*"\([A-Za-z-]*\)".*/\1/p' | head -n1)
-    [ -z "$d" ] && d=$(printf '%s' "$out" | sed -n 's/.*"decision"[[:space:]]*:[[:space:]]*"\([A-Za-z-]*\)".*/\1/p' | head -n1)
+    # `[^"]*`, not `[A-Za-z-]*`: a restricted class means an odd value fails to EXTRACT and is
+    # filed as generic `output`, so "every non-canonical value is recorded as unrecognized" was
+    # true only for values the class happened to admit. Extract anything, then judge it below.
+    d=$(printf '%s' "$out" | sed -n 's/.*"permissionDecision"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
+    [ -z "$d" ] && d=$(printf '%s' "$out" | sed -n 's/.*"decision"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
 
     # A NON-CANONICAL VALUE IS RECORDED AS SUCH, not normalised into a valid one. An earlier version
     # lowercased whatever it found, so `"permissionDecision":"Deny"` was filed as a clean `deny` —
@@ -166,7 +172,10 @@ etv_hook_fire_classify() {
   # inventing a composite state the harness does not report. The status already has its own field in
   # the record, so the decision field states the decision and nothing else. `error` means only "it
   # failed and said nothing classifiable".
-  if [ "$code" != "0" ] && [ "$d" = "no-op" ]; then d="error"; fi
+  # `output` too, not just `no-op`: a hook that printed a diagnostic and then FAILED was being
+  # filed as `output`, so the report showed `output=1` and the failure vanished from the histogram.
+  # A parsed decision is still left alone — the status has its own field.
+  case "$code:$d" in 0:*) ;; *:no-op|*:output) d="error" ;; esac
 
   printf '%s' "$d"
 }
@@ -191,6 +200,10 @@ etv_hook_fire_begin() {
   ETV_HOOK_FIRE_PID="$$"
   ETV_HOOK_FIRE_STDIN_TMP=""
   ETV_HOOK_FIRE_STDOUT_TMP=""
+  # RESET, never merely default. Inherited from the environment (exported by a parent, or a second
+  # `begin` in one shell) a stale `1` made the first flush return immediately: stdout stayed
+  # redirected and no exit record was ever written.
+  ETV_HOOK_FIRE_FLUSHED=0
 
   [ "${ETV_HOOK_FIRE_DISABLE:-0}" = "1" ] && return 0
 
@@ -212,7 +225,7 @@ etv_hook_fire_begin() {
   fi
   if [ -n "$sin" ]; then
     ETV_HOOK_FIRE_STDIN_TMP="$sin"
-    cat > "$sin" 2>/dev/null || true
+    cat 2>/dev/null > "$sin" || true
     # Replay: even a partial capture is closer to the truth than the drained pipe the hook would
     # otherwise inherit.
     #
@@ -224,13 +237,19 @@ etv_hook_fire_begin() {
     # The guards still blocked, and the human was told nothing about why.
     # Readability is tested instead of relying on redirection-failure suppression.
     if [ -r "$sin" ]; then exec 0<"$sin" || true; fi
-    payload=$(head -c 65536 "$sin" 2>/dev/null || true)
+    payload=1
   fi
 
   if [ -n "$payload" ]; then
-    event=$(printf '%s' "$payload" | sed -n 's/.*"hook_event_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
-    tool=$(printf '%s' "$payload" | sed -n 's/.*"tool_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
-    sess=$(printf '%s' "$payload" | sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
+    # Read the fields from the FILE, byte-oriented, with no size cap. These were extracted from a
+    # `head -c 65536` prefix, so a payload whose `tool_response` pushed `session_id` past 64 KB
+    # filed its records under `unknown-session` with empty event and tool — and a report keyed on
+    # the real session then showed those fires as NEVER HAVING HAPPENED. A truncating read is a
+    # sampling error, and this one manufactured exactly the vacuity #776 exists to abolish.
+    local LC_ALL=C LANG=C
+    event=$(sed -n 's/.*"hook_event_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$sin" 2>/dev/null | head -n1)
+    tool=$(sed -n 's/.*"tool_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$sin" 2>/dev/null | head -n1)
+    sess=$(sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$sin" 2>/dev/null | head -n1)
   fi
 
   # The payload's session id is authoritative when the env var is absent, which it is in this
@@ -264,31 +283,36 @@ etv_hook_fire_begin() {
     exec 4<"$sout" || true
   fi
 
-  # SIGNALS, not just EXIT. Bash runs no EXIT trap for an untrapped fatal signal, so a hook killed
-  # by the harness timeout would have its already-printed decision discarded along with the temp
-  # file: measured at 52 bytes delivered before instrumentation and 0 after.
+  # SIGNALS ARE DELIBERATELY NOT TRAPPED — a withdrawal, recorded because the next reader will
+  # otherwise re-add this. A `trap ... TERM` was added so a hook killed by the harness timeout would
+  # not lose output it had already printed (measured then at 52 bytes before, 0 after). It produced
+  # three defects in three rounds and cost more than it bought:
   #
-  # THE SIGNAL HANDLER MUST NOT `exit`, AND THIS IS THE IMPORTANT PART. A handler that ends in
-  # `exit "$?"` re-raises whatever status the interrupted command happened to have — normally 0 for
-  # a guard still gathering evidence. Measured on `prepush-donewhen.sh` mid-`curl`, with an unticked
-  # Done-when box: uninstrumented, SIGTERM kills it and git ABORTS the push; with an `exit`-based
-  # handler the hook returned 0 and git PUSHED TO MAIN. That converts a signal into consent, in the
-  # permissive direction, in the guard that protects `main` — worse than the lost log line it was
-  # added to fix. So the handler flushes, then restores the default disposition and re-raises the
-  # signal, letting the process die the way it would have died. Pinned by
-  # `test_a_SIGNALLED_stream_hook_still_FAILS`.
-  trap 'etv_hook_fire_signal INT'  INT
-  trap 'etv_hook_fire_signal TERM' TERM
-  trap 'etv_hook_fire_signal HUP'  HUP
+  #   1. the handler ended in `exit "$?"`, so a SIGTERMed `prepush-donewhen.sh` reported 0 and git
+  #      PUSHED TO MAIN — a signal became consent;
+  #   2. `local sig=...` clobbered `$?`, so a killed guard was RECORDED as having passed;
+  #   3. and the one that settles it: bash does not run a trap until the current foreground command
+  #      finishes, so a hook mid-`curl` took 30s to die where it had taken 1s. A TERM-then-KILL
+  #      supervisor therefore gets no flush AT ALL, plus a 29s stall — strictly worse than the
+  #      untrapped behaviour on the very path the trap existed for.
+  #
+  # WHAT IS LOST, enumerated rather than waved past: a hook killed by a signal loses its `exit`
+  # record, loses stdout it had already written, and leaks its two temp files. The first is a real
+  # gap in the log and is why `report` counts `fire` records, not `exit` records. The second is
+  # near-unreachable — every capture-mode hook prints its decision and exits immediately, a
+  # sub-millisecond window. The third is bounded by $TMPDIR cleanup.
+  #
+  # The invariant that replaces the rescue is stronger and is what the tests now assert: under a
+  # signal an instrumented hook behaves EXACTLY as an uninstrumented one.
   trap 'etv_hook_fire_end "$?"' EXIT
   return 0
 }
 
-# Flush and record, WITHOUT deciding how the process ends. Both the EXIT trap and the signal handler
-# call this; `ETV_HOOK_FIRE_FLUSHED` makes it idempotent, because on the signal path bash runs the
-# signal handler AND then the EXIT trap. Without the guard that wrote two contradictory `exit`
-# records for one invocation — a real `deny` followed by a phantom `no-op` — so the report
-# mis-histogrammed exactly the case the signal trap was added for.
+# Flush and record, WITHOUT deciding how the process ends. `ETV_HOOK_FIRE_FLUSHED` keeps it
+# idempotent. That guard is retained after the signal traps were withdrawn, because it is cheap and
+# because the failure it prevents — two contradictory `exit` records for one invocation, a real
+# `deny` followed by a phantom `no-op` — is silent, and re-entrancy would return the moment anyone
+# adds a second caller.
 etv_hook_fire_flush() {
   local code="${1:-0}" out=""
   [ "${ETV_HOOK_FIRE_FLUSHED:-0}" = "1" ] && return 0
@@ -326,13 +350,26 @@ etv_hook_fire_flush() {
     # it, eight lines below the comment forbidding it, which is why the rule is now restated at
     # every `exec` rather than once.
     if [ -r "${ETV_HOOK_FIRE_STDOUT_TMP:-}" ]; then
-      out=$( { cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null; printf 'X'; } )
+      # Common path: stream the FILE straight through. A shell variable cannot hold a NUL byte, so
+      # replaying via `$(...)` silently drops them and warns on stderr; `cat` is byte-exact for any
+      # content. Classification reads the SAME file, so the two cannot disagree — reading them from
+      # different sources is what made the harness see `deny` while the log recorded `no-op`.
+      cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true
+      # `tr -d '\000'` before the substitution: bash cannot hold a NUL in a variable and warns
+      # about it ON STDERR, which the harness sees — an instrumentation message leaking into a
+      # guard's output channel. Classification does not care about NULs; the replay above is
+      # byte-exact regardless, because it streams the file rather than a variable.
+      out=$( { head -c 65536 "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null | tr -d '\000'; printf 'X'; } )
+      out="${out%X}"
     else
-      out=$( { cat <&4 2>/dev/null; printf 'X'; } )   # the file was unlinked; the fd still reads it
+      # Rescue path: the name is gone but the fd still reads the unlinked inode. This one goes
+      # through a variable and is therefore NUL-lossy — stated rather than hidden, because the
+      # alternative is losing the output entirely.
+      out=$( { cat 2>/dev/null <&4 | tr -d '\000'; printf 'X'; } )
+      out="${out%X}"
+      [ -n "$out" ] && printf '%s' "$out"
     fi
-    out="${out%X}"
     exec 4<&- || true
-    [ -n "$out" ] && printf '%s' "$out"
   fi
 
   etv_hook_fire_record \
@@ -353,15 +390,6 @@ etv_hook_fire_end() {
   exit "$code"
 }
 
-# The signal path. Flush, then DIE THE WAY THE PROCESS WOULD HAVE DIED: restore the default
-# disposition and re-raise, so the parent still sees "killed by signal N" rather than a status this
-# handler invented. `git` reads that distinction, and reporting 0 here let a push through.
-etv_hook_fire_signal() {
-  local sig="${1:-TERM}"
-  etv_hook_fire_flush "$?"
-  trap - INT TERM HUP EXIT
-  kill -s "$sig" "$$"
-}
 
 # ---------------------------------------------------------------------------------------------
 # Read side: the report
diff --git a/scripts/tests/test_hook_fire_log.py b/scripts/tests/test_hook_fire_log.py
index 9d96c0d8d..410dcf760 100644
--- a/scripts/tests/test_hook_fire_log.py
+++ b/scripts/tests/test_hook_fire_log.py
@@ -533,7 +533,7 @@ def _normalise_stderr(err: bytes) -> bytes:
     # and cold review demonstrated it collapsing two genuinely different diagnostics ("highest
     # private fd line 0" vs "line 4") into one — hiding exactly the kind of fd-state difference this
     # comparison exists to catch.
-    return re.sub(rb"[^\s:]*/[^\s:]*\.sh: line \d+:", b"<script>: line <n>:", err)
+    return re.sub(rb"(?m)^[^\s:]*/[^\s:]*\.sh: line \d+:", b"<script>: line <n>:", err)
 
 
 @pytest.mark.parametrize("hook", hook_scripts(), ids=lambda h: h.stem)
@@ -931,39 +931,6 @@ def test_output_SURVIVES_a_vanished_stdout_tempfile(sandbox):
     )
 
 
-def test_output_survives_a_SIGTERM(sandbox):
-    """A hook killed by the harness timeout must still deliver what it already printed.
-
-    Measured before the fix: 52 bytes delivered without instrumentation, 0 with it. Bash runs no
-    EXIT trap for an UNTRAPPED fatal signal, so the decision sat in a temp file nobody read. Every
-    capture-mode hook today prints and exits immediately, so the window is sub-millisecond — but
-    that is a property of today's hooks, not of the mechanism, and nothing else would tell a future
-    editor they had just made it reachable.
-    """
-    import signal
-    import time
-
-    root, env = sandbox
-    hook = root / "slow.sh"
-    hook.write_text(
-        "#!/usr/bin/env bash\nset -uo pipefail\n"
-        f'. "{SINK}"\n'
-        'etv_hook_fire_begin slow "" capture || true\n'
-        "input=$(cat)\n"
-        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
-        "sleep 30\n"
-    )
-    payload_file = root / "sigterm-stdin.json"
-    payload_file.write_bytes(b'{"tool_name":"Bash"}')
-    with open(payload_file, "rb") as fh:
-        p = subprocess.Popen(["bash", str(hook)], stdin=fh, stdout=subprocess.PIPE,
-                             stderr=subprocess.PIPE, cwd=str(root), env=env)
-        time.sleep(2.0)
-        p.send_signal(signal.SIGTERM)
-        out, _ = p.communicate(timeout=30)
-    assert b'"permissionDecision":"deny"' in out, (
-        f"a SIGTERMed hook lost the decision it had already printed: {out!r}"
-    )
 
 
 @pytest.mark.parametrize(
@@ -1091,7 +1058,7 @@ def test_DELETING_the_replay_makes_the_differential_go_RED(sandbox, positives, t
     root, env = sandbox
     mutated = tmp_path / "hook-fire-log.sh"
     text = SINK.read_text()
-    marker = '''    [ -n "$out" ] && printf '%s' "$out"'''
+    marker = '      cat "$ETV_HOOK_FIRE_STDOUT_TMP" 2>/dev/null || true'
     assert marker in text, (
         "the replay line has moved; this mutation no longer targets it. Retarget it rather than "
         "loosening the match — a mutation that silently stops mutating proves nothing, which is "
@@ -1115,88 +1082,8 @@ def test_DELETING_the_replay_makes_the_differential_go_RED(sandbox, positives, t
     )
 
 
-def test_a_SIGNALLED_stream_hook_still_FAILS(sandbox):
-    """A signal must not become consent. THE regression from the round-2 signal trap.
-
-    Measured on the real guard: `prepush-donewhen.sh` SIGTERMed mid-`curl` exits -15 without
-    instrumentation, so git aborts the push; with an `exit "$?"`-based signal handler it returned 0
-    and git PUSHED TO MAIN, because `$?` at signal time was the status of whatever command was
-    running — 0 for a guard still gathering evidence.
-
-    `test_output_survives_a_SIGTERM` could not see it: that test asserts stdout CONTENT and never
-    reads the return code, and it drives a capture-mode hook, so no exit-code guard is ever
-    signalled. This one asserts the only thing git looks at.
-    """
-    import signal
-    import time
-
-    root, env = sandbox
-    for sig, name in ((signal.SIGTERM, "TERM"), (signal.SIGINT, "INT"), (signal.SIGHUP, "HUP")):
-        hook = root / f"sig-{name}.sh"
-        hook.write_text(
-            "#!/usr/bin/env bash\nset -uo pipefail\n"
-            f'. "{SINK}"\n'
-            f'etv_hook_fire_begin sig{name} "" stream || true\n'
-            "input=$(cat)\n"
-            "sleep 30\n"
-            "exit 1\n"
-        )
-        payload = root / f"sig-{name}.json"
-        payload.write_bytes(b'{"tool_name":"Bash"}')
-        with open(payload, "rb") as fh:
-            p = subprocess.Popen(["bash", str(hook)], stdin=fh, stdout=subprocess.PIPE,
-                                 stderr=subprocess.PIPE, cwd=str(root), env=env)
-            time.sleep(1.5)
-            p.send_signal(sig)
-            p.communicate(timeout=30)
-
-        assert p.returncode != 0, (
-            f"a hook killed by SIG{name} reported SUCCESS ({p.returncode}). git reads this status: "
-            "for a pre-push guard that is the difference between aborting the push and letting it "
-            "through, so the instrumentation would have turned a killed guard into consent."
-        )
-        assert p.returncode == -sig, (
-            f"SIG{name}: expected death by signal ({-sig}), got {p.returncode}. The handler is "
-            "inventing an exit status instead of re-raising."
-        )
 
 
-def test_the_exit_record_is_written_ONCE_on_the_signal_path(sandbox):
-    """Bash runs the signal handler AND then the EXIT trap, so the flush must be idempotent.
-
-    Without the guard this wrote two contradictory `exit` records for one invocation — a real
-    decision followed by a phantom `no-op` — and the report histograms exit records, so the product
-    mis-reported precisely the case the signal trap was added to capture.
-    """
-    import signal
-    import time
-
-    root, env = sandbox
-    logdir = root / "log-signal-once"
-    hook = root / "sigonce.sh"
-    hook.write_text(
-        "#!/usr/bin/env bash\nset -uo pipefail\n"
-        f'. "{SINK}"\n'
-        'etv_hook_fire_begin sigonce "" capture || true\n'
-        "input=$(cat)\n"
-        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
-        "sleep 30\n"
-    )
-    payload = root / "sigonce.json"
-    payload.write_bytes(b'{"session_id":"s1","tool_name":"Bash"}')
-    with open(payload, "rb") as fh:
-        p = subprocess.Popen(["bash", str(hook)], stdin=fh, stdout=subprocess.PIPE,
-                             stderr=subprocess.PIPE, cwd=str(root),
-                             env={**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)})
-        time.sleep(1.5)
-        p.send_signal(signal.SIGTERM)
-        out, _ = p.communicate(timeout=30)
-
-    records = (logdir / "s1.jsonl").read_text().splitlines()
-    exits = [r for r in records if '"phase":"exit"' in r]
-    assert len(exits) == 1, f"expected exactly one exit record, got {len(exits)}:\n" + "\n".join(records)
-    assert '"decision":"deny"' in exits[0], f"the surviving record lost the decision: {exits[0]}"
-    assert b'"permissionDecision":"deny"' in out, "the decision was not replayed to the harness"
 
 
 def test_no_exec_in_the_sink_carries_a_STDERR_REDIRECT():
@@ -1281,3 +1168,175 @@ def test_an_UNWRITABLE_log_file_is_still_stderr_transparent(sandbox, tmp_path):
         "an unwritable log leaked a diagnostic to the harness. Observability that cannot write must "
         f"be silent, not chatty: {p.stderr!r}"
     )
+
+
+
+
+
+
+def test_NUL_bytes_in_hook_output_survive(sandbox):
+    """A shell variable cannot hold a NUL, so replaying through `$(...)` silently drops them.
+
+    Pathological for a JSON decision, but the replay must be byte-exact for whatever the hook wrote,
+    and "it drops bytes only for content we do not expect" is the reasoning this file exists to
+    avoid. The common path streams the file; only the unlinked-file rescue is lossy, and that is
+    stated in the code.
+    """
+    root, env = sandbox
+    hook = root / "nul.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin nul "" capture || true\n'
+        "input=$(cat)\n"
+        r"printf 'a\000b\n'" + "\n"
+    )
+    p = subprocess.run(["bash", str(hook)], input=b'{"tool_name":"Bash"}', capture_output=True,
+                       cwd=str(root), env=env, timeout=60)
+    assert p.stdout == b"a\x00b\n", f"NUL-containing output was mangled: {p.stdout!r}"
+    assert b"null byte" not in p.stderr, f"a warning leaked to the harness: {p.stderr!r}"
+
+
+@pytest.mark.parametrize(
+    "emit,code,expected",
+    [
+        # Every non-canonical value, not just the ones a restricted character class admits.
+        (r'{\"permissionDecision\":\"deny2\"}', 0, "unrecognized"),
+        (r'{\"permissionDecision\":\"deny_now\"}', 0, "unrecognized"),
+        # Unclassified output plus a FAILING exit is an error, not `output`: the report histograms
+        # the decision, so filing it as `output` hid the failure entirely.
+        ("diagnostic text", 1, "error"),
+    ],
+)
+def test_odd_values_and_failing_exits_are_not_LAUNDERED(sandbox, emit, code, expected):
+    root, env = sandbox
+    logdir = root / f"odd-{expected}-{abs(hash((emit, code))) % 9999}"
+    hook = root / f"odd-{abs(hash((emit, code))) % 9999}.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin odd "" capture || true\n'
+        "input=$(cat)\n"
+        + (f'printf "{emit}"\n' if emit else "")
+        + f"exit {code}\n"
+    )
+    subprocess.run(["bash", str(hook)], input=b'{"session_id":"s1","tool_name":"Bash"}',
+                   capture_output=True, cwd=str(root),
+                   env={**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)}, timeout=60)
+    rec = [r for r in (logdir / "s1.jsonl").read_text().splitlines() if '"phase":"exit"' in r]
+    assert f'"decision":"{expected}"' in rec[0], f"expected {expected}, got {rec[0]}"
+
+
+def test_an_INHERITED_flushed_flag_does_not_disable_reporting(sandbox):
+    """`ETV_HOOK_FIRE_FLUSHED` was defaulted, never reset.
+
+    Exported by a parent — or set by an earlier `begin` in the same shell — a stale `1` made the
+    first flush return immediately: stdout stayed redirected and no exit record was written. Every
+    test assumed a clean environment, which is the assumption a hook running inside someone else's
+    process cannot make.
+    """
+    root, env = sandbox
+    logdir = root / "log-inherited"
+    hook = root / "inherited.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin inherited "" capture || true\n'
+        "input=$(cat)\n"
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
+    )
+    p = subprocess.run(
+        ["bash", str(hook)], input=b'{"session_id":"s1","tool_name":"Bash"}', capture_output=True,
+        cwd=str(root),
+        env={**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir), "ETV_HOOK_FIRE_FLUSHED": "1"}, timeout=60,
+    )
+    assert p.stdout == b'{"hookSpecificOutput":{"permissionDecision":"deny"}}', (
+        f"an inherited FLUSHED=1 left stdout redirected and swallowed the decision: {p.stdout!r}"
+    )
+    exits = [r for r in (logdir / "s1.jsonl").read_text().splitlines() if '"phase":"exit"' in r]
+    assert exits and '"decision":"deny"' in exits[0], f"no exit record was written: {exits}"
+
+
+@pytest.mark.parametrize("signame", ["TERM", "INT", "HUP"])
+def test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one(sandbox, signame):
+    """The invariant that replaced the signal trap, asserted as an A/B rather than as a rescue.
+
+    A `trap ... TERM` was added so a killed hook would not lose already-printed output. It caused
+    three defects in three rounds, the last of which settles it: bash does not run a trap until the
+    current foreground command finishes, so an instrumented hook mid-`curl` took 30s to die where it
+    had taken 1s — a TERM-then-KILL supervisor then gets no flush at all AND a 29s stall. The rescue
+    was worth less than the transparency it cost.
+
+    So the contract is the same one the rest of this file asserts: under a signal, instrumented and
+    uninstrumented are indistinguishable. Both the STATUS and the TIME TO DIE are compared; the
+    latter is the one the trap broke, and no assertion on output could have caught it.
+    """
+    import signal
+    import time
+
+    root, env = sandbox
+    sig = getattr(signal, f"SIG{signame}")
+    body = (
+        "input=$(cat)\n"
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"deny\"}}"' + "\n"
+        "sleep 25\n"
+    )
+    instrumented = root / f"sigab-{signame}.sh"
+    instrumented.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        f'etv_hook_fire_begin sigab "" stream || true\n' + body
+    )
+    control = root / f"sigab-control-{signame}.sh"
+    control.write_text("#!/usr/bin/env bash\nset -uo pipefail\n" + body)
+
+    results = {}
+    for tag, script in (("control", control), ("instrumented", instrumented)):
+        payload = root / f"sigab-{signame}-{tag}.json"
+        payload.write_bytes(b'{"session_id":"s1","tool_name":"Bash"}')
+        with open(payload, "rb") as fh:
+            p = subprocess.Popen(["bash", str(script)], stdin=fh, stdout=subprocess.PIPE,
+                                 stderr=subprocess.PIPE, cwd=str(root), env=env)
+            time.sleep(1.0)
+            t0 = time.monotonic()
+            p.send_signal(sig)
+            p.communicate(timeout=40)
+            results[tag] = (p.returncode, time.monotonic() - t0)
+
+    (rc_a, dt_a), (rc_b, dt_b) = results["control"], results["instrumented"]
+    assert rc_a == rc_b, (
+        f"SIG{signame}: exit status differs, control={rc_a} instrumented={rc_b}. git and the "
+        "harness both read this status."
+    )
+    assert dt_b < dt_a + 3.0, (
+        f"SIG{signame}: the instrumented hook took {dt_b:.1f}s to die where the uninstrumented one "
+        f"took {dt_a:.1f}s. A trap handler does not run until the foreground command finishes, so "
+        "trapping the signal makes a killed hook hang for the length of whatever it was doing."
+    )
+
+
+def test_no_redirection_in_the_sink_PRECEDES_its_stderr_redirect():
+    """Generalises the rule that has now been broken three times, at three different commands.
+
+    Redirections are applied left to right, so `cmd >out 2>/dev/null` opens `out` FIRST and reports
+    a failure on the stderr still in force — the instrumentation talking to the harness. It shipped
+    on `exec 0<`, then on the log append, then on `cat <&4`. The previous guard grepped only `exec`,
+    so the third instance walked straight past it: the class was named but not removed, which is the
+    same error one level up.
+    """
+    offenders = []
+    for i, ln in enumerate(SINK.read_text().splitlines(), 1):
+        code = ln.split("#", 1)[0]
+        if "2>" not in code:
+            continue
+        # `2>&1` is exempt and is not a loophole: it DUPLICATES the already-redirected fd 1, so
+        # it is correct precisely because it comes after. Only `2>` pointing at a FILE has to lead.
+        m = re.search(r"2>(?!&)", code)
+        if not m:
+            continue
+        if re.search(r"(?<![0-9&])(<&|>>|>|<)", code[: m.start()]):
+            offenders.append(f"{SINK.name}:{i}: {ln.strip()}")
+    assert not offenders, (
+        "these lines place a redirection BEFORE their stderr redirect, so a failure in the first "
+        "one is reported on the hook's real stderr:\n  " + "\n  ".join(offenders)
+    )
-- 
2.47.3


From bd40c962cfcb33d435897e6451fab0522b6cfe44 Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 15:42:00 +0200
Subject: [PATCH 08/14] fix(776): the locale fix was inert, and my withdrawal
 rationale was fabricated
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round 5, two independent reviews. Two findings, one technical and one about
honesty, and the second is the more important.

THE RATIONALE. The round-4 commit and the decision record state as measured fact
that trapping signals made a hook take 30s to die where it took 1s. That came
from a review finding I accepted without re-measuring. It is wrong. Measured A/B:

  signal the pid    control 4.01s   trapped 4.12s
  signal the group  control 0.002s  trapped 0.054s

The stall is bash deferring a fatal signal until its foreground command finishes,
and it happens identically with NO trap — the control stalls too. The trap cost
~0.1s, not 29s. The withdrawal still stands, but on its real grounds: three
silent permissive-direction defects in three rounds for a sub-millisecond rescue
window, and the trapped sink STILL returned rc 0 on SIGINT where the control
returns -2. The record now carries the correction rather than the fabrication,
because a decision record with an invented measurement reads as checked and talks
the next reader out of checking.

The test that was supposed to enforce this was itself vacuous: it signalled the
pid, so both sides took the full sleep and the timing assertion could distinguish
nothing. It signals the process group now — the supervisor shape, and the only
one where the assertion can see anything.

THE LOCALE FIX WAS INERT. `local LC_ALL=C` does not export, so the child sed/tr
never saw it. It read as fixed only because this author's shell sets LANG alone;
with an inherited LC_CTYPE (macOS Terminal, ssh SendEnv, sudo env_keep) LC_CTYPE
outranks the exported LANG=C and the symptom returns in full — a real deny filed
as `output`, records under `unknown-session` with empty event and tool, and
`illegal byte sequence` at the harness. `local -x` now, verified end-to-end
across four locale environments, and the test is parametrised over them because a
single ambient locale tests one row of the matrix.

Also this round:

- Removing the 64KB cap ARMED a latent bug rather than fixing one: a greedy `.*`
  over a single-line payload takes the LAST match, so a nested session_id inside
  a tool_response outranked the top-level one and filed the whole invocation
  under the wrong session. The cap had been accidentally protecting the right
  answer. First-match extraction now, bounded at 256KB where the bound is no
  longer load-bearing (3 unbounded scans cost 1.5s on a 20MB payload).
- A present-but-empty decision value was laundered to `output`.
- The redirect-order guard excluded operators preceded by a digit, so it was
  blind to `exec 0<` — the exact line it was written for. Mutation-checked both
  ways now: clean on the real file, red when the original bug is reintroduced
  verbatim. Its limits are stated in the docstring rather than implied.

Refs: #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../testing/hook-reports-its-own-execution.md |  34 +++-
 scripts/hook-fire-log.sh                      |  40 ++++-
 scripts/tests/test_hook_fire_log.py           | 147 ++++++++++++++++--
 3 files changed, 197 insertions(+), 24 deletions(-)

diff --git a/docs/decisions/records/testing/hook-reports-its-own-execution.md b/docs/decisions/records/testing/hook-reports-its-own-execution.md
index 40db37ba0..886c2ffc1 100644
--- a/docs/decisions/records/testing/hook-reports-its-own-execution.md
+++ b/docs/decisions/records/testing/hook-reports-its-own-execution.md
@@ -77,11 +77,26 @@ will otherwise re-add it.** A `trap … INT TERM HUP` was added so a hook killed
 timeout would not lose output it had already printed. It produced a defect in each of three
 consecutive rounds — a handler ending in `exit "$?"` that turned a signal into consent and let a
 push reach `main`; a `local sig=…` that clobbered `$?` so a killed guard was *recorded* as having
-passed; and a second signal mid-flush that discarded the output entirely. What settled it was none
-of those, because all three were fixable: **bash does not run a trap handler until the current
-foreground command completes.** An instrumented hook interrupted mid-`curl` took 30 s to die where
-the uninstrumented one took 1 s, so a TERM-then-KILL supervisor gets no flush *at all* plus a 29 s
-stall — strictly worse, on the exact path the trap existed for.
+passed; and a second signal mid-flush that discarded the output entirely.
+
+**A correction, because the first version of this record justified the withdrawal with a number that
+is wrong.** It claimed, as measured fact, that trapping made a hook take 30 s to die where it had
+taken 1 s. That came from a review finding accepted without re-measuring, and the A/B refutes it:
+signalling the pid gives control **4.01 s** and trapped **4.12 s**; signalling the process group
+gives control **0.002 s** and trapped **0.054 s**. The stall is bash deferring a fatal signal until
+its foreground command finishes, and it happens **identically without any trap** — the control
+stalls too. The trap cost ~0.1 s, not 29 s. Recorded rather than quietly fixed, because a decision
+record carrying a fabricated measurement is worse than one carrying none: it reads as checked and
+talks the next reader out of checking.
+
+**What actually justifies the withdrawal**, stated now that the false reason is gone. Three defects
+in three rounds, every one silent and in the permissive direction, against a rescue window that is
+sub-millisecond because every capture-mode hook prints its decision and exits immediately. And the
+trap was *still* wrong when it was withdrawn: the round-3 sink, after its Blocker fix, returned
+**rc 0 on SIGINT where the uninstrumented control returns −2** — the consent bug survived for one
+signal of the three. Machinery that needs a signal-to-status map, an idempotent flush, correct
+re-raise semantics and `BASHPID` handling, to rescue a sub-millisecond window, is not worth its
+failure modes.
 
 What is lost by withdrawing it, enumerated rather than waved past, because
 `process.enumerate-workaround-behaviors-before-deleting` exists for precisely this move:
@@ -95,9 +110,12 @@ What is lost by withdrawing it, enumerated rather than waved past, because
 
 The invariant that replaces the rescue is stronger than it was, and is now asserted directly:
 **under a signal, an instrumented hook is indistinguishable from an uninstrumented one.**
-`test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one` compares both the exit status and
-the *time to die*, and it is the timing half that the trap broke — no assertion about output could
-have caught it.
+`test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one` compares exit status and time to
+die. It **signals the process group, not the pid**, and that is not a detail: bash defers a fatal
+signal until its foreground command finishes, so signalling the pid alone makes both sides take the
+full sleep and the timing assertion can distinguish nothing — it was vacuous in exactly the way this
+file's central test was vacuous on arrival. The exit-status half is the load-bearing one; it is what
+catches the SIGINT case.
 
 **The generalisable lesson is about the fixing, not the bugs.** This took three review rounds, and
 every round found that the previous round's *fix* had introduced something beside its target. The
diff --git a/scripts/hook-fire-log.sh b/scripts/hook-fire-log.sh
index d43146e8e..d13a8b9be 100755
--- a/scripts/hook-fire-log.sh
+++ b/scripts/hook-fire-log.sh
@@ -128,7 +128,13 @@ etv_hook_fire_classify() {
   local out="${1:-}" code="${2:-0}" mode="${3:-capture}" d=""
   # BYTE-ORIENTED, not locale-aware. One 0xE9 byte in a `permissionDecisionReason` made `sed` print
   # `illegal byte sequence` to the harness AND fail to extract, filing a real `deny` as `output`.
-  local LC_ALL=C LANG=C
+  #
+  # `local -x`, NOT `local`. A plain `local` sets a shell variable without the export attribute, so
+  # the child `sed`/`tr` never sees it — the fix was INERT and read as applied. It looked correct
+  # only because this author's shell sets `LANG` alone; with an inherited `LC_CTYPE` (macOS
+  # Terminal, ssh `SendEnv LC_*`, sudo `env_keep`) `LC_CTYPE` outranks the exported `LANG=C` and the
+  # symptom returns in full.
+  local -x LC_ALL=C LANG=C
 
   # A `stream`-mode hook is a git hook: git reads its exit code and nothing else, so that is the
   # whole of its decision. Reporting `no-op` here because no JSON was captured would be an
@@ -143,6 +149,12 @@ etv_hook_fire_classify() {
     # filed as generic `output`, so "every non-canonical value is recorded as unrecognized" was
     # true only for values the class happened to admit. Extract anything, then judge it below.
     d=$(printf '%s' "$out" | sed -n 's/.*"permissionDecision"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
+    # A PRESENT-but-empty value is not the same as an absent key, and treating them alike let
+    # `{"permissionDecision":""}` fall through to `output` — a malformed decision laundered into
+    # "the hook just printed something".
+    if [ -z "$d" ] && printf '%s' "$out" | grep -q '"permissionDecision"[[:space:]]*:'; then
+      d="unrecognized"
+    fi
     [ -z "$d" ] && d=$(printf '%s' "$out" | sed -n 's/.*"decision"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)
 
     # A NON-CANONICAL VALUE IS RECORDED AS SUCH, not normalised into a valid one. An earlier version
@@ -246,10 +258,25 @@ etv_hook_fire_begin() {
     # filed its records under `unknown-session` with empty event and tool — and a report keyed on
     # the real session then showed those fires as NEVER HAVING HAPPENED. A truncating read is a
     # sampling error, and this one manufactured exactly the vacuity #776 exists to abolish.
-    local LC_ALL=C LANG=C
-    event=$(sed -n 's/.*"hook_event_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$sin" 2>/dev/null | head -n1)
-    tool=$(sed -n 's/.*"tool_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$sin" 2>/dev/null | head -n1)
-    sess=$(sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$sin" 2>/dev/null | head -n1)
+    local -x LC_ALL=C LANG=C
+    # FIRST occurrence, via `grep -o`. A `sed` substitution with a leading `.*` is GREEDY, and
+    # payloads are one long line, so it selected the LAST match: a nested
+    # `{"session_id":"...","tool_name":"..."}` inside a `tool_response` outranked the top-level one
+    # and the whole invocation filed under the wrong session. Removing the 64 KB cap is what armed
+    # it — the cap had been accidentally protecting the right answer, which is the kind of load a
+    # bound can be silently carrying.
+    #
+    # The scan is bounded again at 256 KB, but now the bound is safe rather than load-bearing:
+    # identity fields are at the head of the payload, and first-match means a later duplicate cannot
+    # win. Unbounded cost 0.5s per scan on a 20 MB payload, three scans per fire.
+    _etv_field() {
+      head -c 262144 "$sin" 2>/dev/null \
+        | grep -o "\"$1\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" 2>/dev/null \
+        | head -n1 | sed 's/.*:[[:space:]]*"//; s/"$//' 2>/dev/null
+    }
+    event=$(_etv_field hook_event_name)
+    tool=$(_etv_field tool_name)
+    sess=$(_etv_field session_id)
   fi
 
   # The payload's session id is authoritative when the env var is absent, which it is in this
@@ -315,6 +342,9 @@ etv_hook_fire_begin() {
 # adds a second caller.
 etv_hook_fire_flush() {
   local code="${1:-0}" out=""
+  # The `tr -d '\000'` below is a child process too, and it sat outside every locale declaration:
+  # `tr: Illegal byte sequence` reached the harness and truncated the classification copy.
+  local -x LC_ALL=C LANG=C
   [ "${ETV_HOOK_FIRE_FLUSHED:-0}" = "1" ] && return 0
   ETV_HOOK_FIRE_FLUSHED=1
 
diff --git a/scripts/tests/test_hook_fire_log.py b/scripts/tests/test_hook_fire_log.py
index 410dcf760..efde62220 100644
--- a/scripts/tests/test_hook_fire_log.py
+++ b/scripts/tests/test_hook_fire_log.py
@@ -1295,11 +1295,18 @@ def test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one(sandbox, sign
         payload = root / f"sigab-{signame}-{tag}.json"
         payload.write_bytes(b'{"session_id":"s1","tool_name":"Bash"}')
         with open(payload, "rb") as fh:
+            # SIGNAL THE PROCESS GROUP, not the pid. A non-interactive bash defers a fatal signal
+            # until its foreground command finishes, trapped or not — so signalling the pid alone
+            # made BOTH sides take the full sleep and the timing assertion could not distinguish
+            # anything. Measured: pid-only gives control 4.0s and trapped 4.1s; group signalling
+            # gives control 0.002s and trapped 0.054s. A supervisor kills the group, so this is
+            # also the shape that actually occurs.
             p = subprocess.Popen(["bash", str(script)], stdin=fh, stdout=subprocess.PIPE,
-                                 stderr=subprocess.PIPE, cwd=str(root), env=env)
+                                 stderr=subprocess.PIPE, cwd=str(root), env=env,
+                                 start_new_session=True)
             time.sleep(1.0)
             t0 = time.monotonic()
-            p.send_signal(sig)
+            os.killpg(os.getpgid(p.pid), sig)
             p.communicate(timeout=40)
             results[tag] = (p.returncode, time.monotonic() - t0)
 
@@ -1308,7 +1315,7 @@ def test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one(sandbox, sign
         f"SIG{signame}: exit status differs, control={rc_a} instrumented={rc_b}. git and the "
         "harness both read this status."
     )
-    assert dt_b < dt_a + 3.0, (
+    assert dt_b < dt_a + 2.0, (
         f"SIG{signame}: the instrumented hook took {dt_b:.1f}s to die where the uninstrumented one "
         f"took {dt_a:.1f}s. A trap handler does not run until the foreground command finishes, so "
         "trapping the signal makes a killed hook hang for the length of whatever it was doing."
@@ -1318,6 +1325,14 @@ def test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one(sandbox, sign
 def test_no_redirection_in_the_sink_PRECEDES_its_stderr_redirect():
     """Generalises the rule that has now been broken three times, at three different commands.
 
+    LIMITS, stated because a string predicate over shell is exactly what this repo has withdrawn
+    before: it scans ONE file, after stripping quoted spans, and it reasons about text rather than
+    parsing shell. It will not see a redirection built by expansion, and it treats each physical
+    line independently. It is kept because it caught two real offenders that nothing else did, and
+    it is scoped narrowly enough that a false positive is a two-second read — not because it is
+    sound.
+
+
     Redirections are applied left to right, so `cmd >out 2>/dev/null` opens `out` FIRST and reports
     a failure on the stderr still in force — the instrumentation talking to the harness. It shipped
     on `exec 0<`, then on the log append, then on `cat <&4`. The previous guard grepped only `exec`,
@@ -1326,17 +1341,127 @@ def test_no_redirection_in_the_sink_PRECEDES_its_stderr_redirect():
     """
     offenders = []
     for i, ln in enumerate(SINK.read_text().splitlines(), 1):
-        code = ln.split("#", 1)[0]
+        # Quoted spans first, THEN comments: a `>` inside a string is not a redirection, and a `#`
+        # inside a string does not start a comment. Doing it the other way round truncates lines
+        # mid-string and both mis-flags and mis-clears.
+        code = re.sub(r"'[^']*'|\"[^\"]*\"", "", ln).split("#", 1)[0]
         if "2>" not in code:
             continue
-        # `2>&1` is exempt and is not a loophole: it DUPLICATES the already-redirected fd 1, so
-        # it is correct precisely because it comes after. Only `2>` pointing at a FILE has to lead.
-        m = re.search(r"2>(?!&)", code)
-        if not m:
-            continue
-        if re.search(r"(?<![0-9&])(<&|>>|>|<)", code[: m.start()]):
-            offenders.append(f"{SINK.name}:{i}: {ln.strip()}")
+        # PER COMMAND, not per line. `exec 3>&1 || { rm -f x 2>/dev/null; }` has the `2>` on a
+        # DIFFERENT command from the redirect, and scanning the whole line flagged it wrongly.
+        for seg in re.split(r"\|\||&&|[;|{}]", code):
+            # `2>&1` is exempt and is not a loophole: it DUPLICATES the already-redirected fd 1, so
+            # it is correct precisely because it comes after. Only `2>` at a FILE has to lead.
+            m = re.search(r"2>(?!&)", seg)
+            if not m:
+                continue
+            # NO digit lookbehind. An earlier version excluded any operator preceded by a digit —
+            # that is `exec 0<`, `exec 1>`, `exec 4<`, precisely the lines this guard exists for.
+            # Mutation-checked: with it, reintroducing `exec 0<"$sin" 2>/dev/null` verbatim was NOT
+            # detected.
+            if re.search(r"(?<!&)(<&|>>|>|<)", seg[: m.start()]):
+                offenders.append(f"{SINK.name}:{i}: {ln.strip()}")
+                break
     assert not offenders, (
         "these lines place a redirection BEFORE their stderr redirect, so a failure in the first "
         "one is reported on the hook's real stderr:\n  " + "\n  ".join(offenders)
     )
+
+
+@pytest.mark.parametrize("locale_env", [
+    {"LANG": "en_US.UTF-8"},
+    {"LC_CTYPE": "en_US.UTF-8"},
+    {"LC_CTYPE": "UTF-8"},          # macOS Terminal's default, and the case that broke the fix
+    {"LC_ALL": "en_US.UTF-8"},
+])
+def test_an_INVALID_UTF8_byte_in_a_decision_is_still_classified(tmp_path, locale_env):
+    """`local LC_ALL=C` does not export, so the child `sed`/`tr` never saw it — the fix was INERT.
+
+    One 0xE9 byte in a `permissionDecisionReason` made the classifier print `illegal byte sequence`
+    at the harness and file a real `deny` as `output`, and made the payload block file the record
+    under `unknown-session` with empty event and tool — manufacturing the exact never-fired vacuity
+    #776 exists to abolish.
+
+    It read as fixed because this author's shell sets `LANG` alone. The locale matrix is
+    parametrised because a single ambient locale tests one row of it: with an inherited `LC_CTYPE`,
+    `LC_CTYPE` outranks the exported `LANG=C` and the symptom returns in full.
+    """
+    logdir = tmp_path / "loclog"
+    hook = tmp_path / "loc.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin loc "" capture || true\n'
+        "input=$(cat)\n"
+        'printf \'{"hookSpecificOutput":{"permissionDecision":"deny",'
+        '"permissionDecisionReason":"caf\\xe9"}}\'\n'
+    )
+    env = {"PATH": os.environ["PATH"], "HOME": os.environ["HOME"],
+           "ETV_HOOK_FIRE_LOG_DIR": str(logdir), **locale_env}
+    p = subprocess.run(["bash", str(hook)], input=b'{"session_id":"s1","tool_name":"Bash"}',
+                       capture_output=True, cwd=str(tmp_path), env=env, timeout=60)
+
+    assert p.stderr == b"", f"{locale_env}: a locale diagnostic leaked to the harness: {p.stderr!r}"
+    record = (logdir / "s1.jsonl").read_text()
+    assert '"decision":"deny"' in record, f"{locale_env}: the decision was misfiled:\n{record}"
+    assert '"tool":"Bash"' in record, f"{locale_env}: identity fields were lost:\n{record}"
+    assert not (logdir / "unknown-session.jsonl").exists(), (
+        f"{locale_env}: the record filed under unknown-session, so this fire reads as never having "
+        "happened in the report"
+    )
+
+
+def test_a_NESTED_identity_field_does_not_outrank_the_TOP_LEVEL_one(tmp_path):
+    """A greedy `.*` takes the LAST match, and payloads are one long line.
+
+    Removing the 64 KB cap is what armed this: a nested `{"session_id":…,"tool_name":…}` inside a
+    `tool_response` began outranking the top-level identity, filing the whole invocation under the
+    wrong session — so the real session reads as never-fired. The cap had been accidentally
+    protecting the right answer, which is the kind of load a bound can be silently carrying.
+    """
+    logdir = tmp_path / "nestlog"
+    hook = tmp_path / "nest.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin nest "" capture || true\n'
+        "input=$(cat)\n"
+    )
+    import json as _json
+    payload = _json.dumps({
+        "session_id": "TOP-SESSION",
+        "hook_event_name": "PreToolUse",
+        "tool_name": "TopTool",
+        "tool_input": {"filler": "x" * 1000},
+        "tool_response": {"session_id": "NESTED-SESSION", "tool_name": "NestedTool"},
+    })
+    subprocess.run(["bash", str(hook)], input=payload.encode(), capture_output=True,
+                   cwd=str(tmp_path), env={**os.environ, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)},
+                   timeout=60)
+
+    assert (logdir / "TOP-SESSION.jsonl").exists(), (
+        f"records filed under the wrong session: {[f.name for f in logdir.glob('*.jsonl')]}"
+    )
+    rec = (logdir / "TOP-SESSION.jsonl").read_text()
+    assert '"tool":"TopTool"' in rec, f"a nested tool_name outranked the top-level one:\n{rec}"
+
+
+def test_a_PRESENT_but_empty_decision_is_not_laundered(sandbox):
+    """`{"permissionDecision":""}` extracted as empty, which is indistinguishable from absent, so it
+    bypassed `unrecognized` and was filed as `output` — a malformed decision laundered into "the
+    hook just printed something"."""
+    root, env = sandbox
+    logdir = root / "log-empty-decision"
+    hook = root / "emptydec.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin emptydec "" capture || true\n'
+        "input=$(cat)\n"
+        r'printf "{\"hookSpecificOutput\":{\"permissionDecision\":\"\"}}"' + "\n"
+    )
+    subprocess.run(["bash", str(hook)], input=b'{"session_id":"s1","tool_name":"Bash"}',
+                   capture_output=True, cwd=str(root),
+                   env={**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)}, timeout=60)
+    rec = [r for r in (logdir / "s1.jsonl").read_text().splitlines() if '"phase":"exit"' in r]
+    assert '"decision":"unrecognized"' in rec[0], f"an empty decision was laundered: {rec[0]}"
-- 
2.47.3


From d3bc13fd5c8fa072c30c32d9bd234f00bfe12595 Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 15:45:20 +0200
Subject: [PATCH 09/14] docs(776): re-verify the 5.4 measurement against the
 shipped sink
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The table was measured against an early version of the sink and the classifier
changed materially afterwards, so the numbers were a claim about code that no
longer existed. Repeated against the final implementation: identical decisions
for all five Claude hooks a Bash/Write session reaches.

States what the repeat did NOT cover — the Agent pair and the four git hooks are
carried over from the original run — rather than implying the whole table was
re-measured.

Refs: #776

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 docs/defect-shapes-773.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/defect-shapes-773.md b/docs/defect-shapes-773.md
index 796511021..8095eec08 100644
--- a/docs/defect-shapes-773.md
+++ b/docs/defect-shapes-773.md
@@ -519,6 +519,14 @@ window, not a corpus statistic.
 bearing one: `pretooluse-bash-guard` did not merely run, it *blocked* the `ETV_UPDATE_GOLDENS=1`
 probe, so at least one guard in this set is demonstrably live rather than merely present.
 
+**Re-verified against the shipped implementation.** The table was first measured against an early
+version of the sink, and the classifier changed materially afterwards, so the run was repeated
+against the final code: `pretooluse-bash-guard` `deny`+`no-op`, `pretooluse-bom-guard` and
+`pretooluse-worktree-guard` `no-op`, `posttooluse-worktree-marker` `no-op`, `design-sync-reminder`
+`context`+`block`+`no-op` — identical decisions. The repeat run exercised the five Claude hooks a
+Bash/Write session reaches; the `Agent` pair and the four git hooks are carried over from the
+original run and were not re-measured.
+
 **Reproducing this table.** It is a constructed window, not a corpus statistic, and it is not
 reproducible from a reader's own `report` output — running the test suite alone would not produce
 it, and before `scripts/tests/conftest.py` landed, running the suite actively polluted the default
-- 
2.47.3


From f729c962b35b34685a2c4c37a97597469b17a311 Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 16:10:41 +0200
Subject: [PATCH 10/14] fix(776): the 256KB cap reintroduced the defect it was
 added beside
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round 6. One High, and it is round 5's own fix: bounding the payload scan to
256KB to make it fast reintroduced the truncating read that round 5 had just
removed. A payload whose filler pushes session_id past the cap returns nothing,
the record files under `unknown-session`, and that fire reads as NEVER HAVING
HAPPENED. My nested-field test could not see it — its identities sit before only
1000 bytes of filler.

The cap is now a fast path with an unbounded fallback, so it is an optimisation
rather than a correctness dependency. Verified with identity 400KB deep.

Also this round:

- The field helper was defined inside a function and so was globally scoped under
  a short generic name, able to collide with a hook's own function. Namespaced
  and unset after use.
- WITHDRAWN: the generalised redirect-order guard. Four iterations, each fixing a
  false positive or negative the last introduced, and review then constructed
  more of both. Deleted rather than patched a fifth time, per the withdrawal
  precedent in docs/guard-inventory.md — a weak detector is itself the
  symptom-keyed mistake. The narrower exec-only guard is retained: a sound match
  on a fixed keyword, covering every case that has actually occurred.
- The signal A/B compared only status and timing and DISCARDED stdout/stderr. It
  now compares both, which surfaced a real difference: on a group kill with a
  live child, bash prints a job-control notice the control does not. Isolated to
  "the exit handler does work, so the shell lives ~50ms longer" — inherent to the
  sink's purpose. Exempted narrowly, by the signal word only, and documented as a
  measured limit rather than papered over.

Refs: #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../testing/hook-reports-its-own-execution.md |  19 +++
 scripts/hook-fire-log.sh                      |  32 +++-
 scripts/tests/test_hook_fire_log.py           | 137 ++++++++++++------
 3 files changed, 134 insertions(+), 54 deletions(-)

diff --git a/docs/decisions/records/testing/hook-reports-its-own-execution.md b/docs/decisions/records/testing/hook-reports-its-own-execution.md
index 886c2ffc1..7f7b4a2b7 100644
--- a/docs/decisions/records/testing/hook-reports-its-own-execution.md
+++ b/docs/decisions/records/testing/hook-reports-its-own-execution.md
@@ -117,6 +117,25 @@ full sleep and the timing assertion can distinguish nothing — it was vacuous i
 file's central test was vacuous on arrival. The exit-status half is the load-bearing one; it is what
 catches the SIGINT case.
 
+**A SECOND withdrawal, on the same reasoning.** A `test_no_redirection_in_the_sink_PRECEDES_its_stderr_redirect`
+generalised the `exec … 2>/dev/null` rule to any command by pattern-matching shell source. It went
+through four iterations, each fixing a false positive or a false negative the last had introduced —
+`>/dev/null 2>&1` flagged wrongly, then operators preceded by a digit (`exec 0<`) missed entirely,
+then multi-command lines flagged wrongly — and cold review then constructed more of both
+(`[[ "$x" < "$y" ]] 2>/dev/null`, a line continuation, a `>` inside a quoted string). It is deleted
+rather than patched a fifth time, following the precedent in `docs/guard-inventory.md`: a weak
+detector is itself the symptom-keyed mistake, and another regex patch adds confidence without
+soundness. The narrower `test_no_exec_in_the_sink_carries_a_STDERR_REDIRECT` is retained — it is a
+sound match on a fixed keyword and covers the dangerous subset, which is every case that has
+actually occurred.
+
+**One transparency limit, measured and stated rather than papered over.** On a group kill with a
+live foreground child, bash prints its own job-control notice (`Terminated: 15   sleep 5`) that an
+uninstrumented hook does not. Isolated: sourcing the sink alone does not produce it, and a no-op
+`EXIT` trap does not either — doing ANY work at exit keeps the shell alive the ~50 ms bash needs to
+print, and doing work at exit is the sink's entire purpose. The A/B exempts exactly that notice and
+nothing else. It costs one stderr line in a run that is being killed anyway.
+
 **The generalisable lesson is about the fixing, not the bugs.** This took three review rounds, and
 every round found that the previous round's *fix* had introduced something beside its target. The
 signal fix is the sharpest case: it corrected a lost log line and, in doing so, turned a killed
diff --git a/scripts/hook-fire-log.sh b/scripts/hook-fire-log.sh
index d13a8b9be..0655e3782 100755
--- a/scripts/hook-fire-log.sh
+++ b/scripts/hook-fire-log.sh
@@ -269,14 +269,32 @@ etv_hook_fire_begin() {
     # The scan is bounded again at 256 KB, but now the bound is safe rather than load-bearing:
     # identity fields are at the head of the payload, and first-match means a later duplicate cannot
     # win. Unbounded cost 0.5s per scan on a 20 MB payload, three scans per fire.
-    _etv_field() {
-      head -c 262144 "$sin" 2>/dev/null \
-        | grep -o "\"$1\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" 2>/dev/null \
-        | head -n1 | sed 's/.*:[[:space:]]*"//; s/"$//' 2>/dev/null
+    # A BOUNDED FAST PATH WITH AN UNBOUNDED FALLBACK. A plain cap is a truncating read, and a
+    # truncating read is a sampling error: a payload whose `tool_response` pushes `session_id` past
+    # the cap returns nothing, the record files under `unknown-session`, and that fire reads as
+    # NEVER HAVING HAPPENED — the false vacuity this whole change exists to remove, reintroduced by
+    # the bound added to make it fast. So the cap is an optimisation only: if the prefix yields
+    # nothing, the whole payload is scanned. Identity fields sit at the head in practice, so the
+    # fallback is rare; correctness no longer depends on that being true.
+    #
+    # `etv_hook_fire__field`, not `_etv_field`: a function defined inside another is still GLOBAL in
+    # bash, so a short generic name leaks into the hook's namespace and can collide with something
+    # the hook defines. It is unset after use.
+    etv_hook_fire__field() {
+      local v
+      v=$(head -c 262144 "$sin" 2>/dev/null \
+            | grep -o "\"$1\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" 2>/dev/null \
+            | head -n1 | sed 's/.*:[[:space:]]*"//; s/"$//' 2>/dev/null)
+      if [ -z "$v" ]; then
+        v=$(grep -o "\"$1\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" "$sin" 2>/dev/null \
+              | head -n1 | sed 's/.*:[[:space:]]*"//; s/"$//' 2>/dev/null)
+      fi
+      printf '%s' "$v"
     }
-    event=$(_etv_field hook_event_name)
-    tool=$(_etv_field tool_name)
-    sess=$(_etv_field session_id)
+    event=$(etv_hook_fire__field hook_event_name)
+    tool=$(etv_hook_fire__field tool_name)
+    sess=$(etv_hook_fire__field session_id)
+    unset -f etv_hook_fire__field 2>/dev/null || true
   fi
 
   # The payload's session id is authoritative when the env var is absent, which it is in this
diff --git a/scripts/tests/test_hook_fire_log.py b/scripts/tests/test_hook_fire_log.py
index efde62220..67db5dcd2 100644
--- a/scripts/tests/test_hook_fire_log.py
+++ b/scripts/tests/test_hook_fire_log.py
@@ -1307,10 +1307,35 @@ def test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one(sandbox, sign
             time.sleep(1.0)
             t0 = time.monotonic()
             os.killpg(os.getpgid(p.pid), sig)
-            p.communicate(timeout=40)
-            results[tag] = (p.returncode, time.monotonic() - t0)
+            out, err = p.communicate(timeout=40)
+            results[tag] = (p.returncode, time.monotonic() - t0, out, err)
 
-    (rc_a, dt_a), (rc_b, dt_b) = results["control"], results["instrumented"]
+    (rc_a, dt_a, out_a, err_a), (rc_b, dt_b, out_b, err_b) = (
+        results["control"], results["instrumented"],
+    )
+    assert out_a == out_b, f"SIG{signame}: stdout differs under signal: {out_a!r} vs {out_b!r}"
+
+    # ONE EXEMPTION, measured and narrow. On a group kill with a live foreground child, bash prints
+    # its own job-control notice (`Terminated: 15   sleep 5`). The instrumented hook does work in
+    # its EXIT handler and therefore lives ~50ms longer than the control, which dies before bash
+    # gets to print. Isolated: sourcing the sink alone does not produce it, and a no-op `EXIT` trap
+    # does not either — it is doing ANY work at exit that opens the window, which is the sink's
+    # whole purpose. Documented as a limit in `testing.hook-reports-its-own-execution` rather than
+    # papered over, and scoped to bash's exact notice so any other stderr difference still fails.
+    def strip_jobnotice(e: bytes) -> bytes:
+        # Two observed forms: bare (`Terminated: 15   sleep 5`) and attributed to whatever line of
+        # the sink was executing (`…/hook-fire-log.sh: line 109: 63769 Hangup: 1   sleep 5`). Both
+        # require one of bash's four signal words followed by `:` or whitespace, so an ordinary
+        # diagnostic still fails the comparison.
+        return b"\n".join(
+            ln for ln in e.split(b"\n")
+            if not re.search(rb"(^|\s)(Terminated|Hangup|Interrupt|Killed)(:|\s)", ln)
+        )
+
+    assert strip_jobnotice(err_a) == strip_jobnotice(err_b), (
+        f"SIG{signame}: stderr differs under signal beyond bash's job-control notice: "
+        f"{err_a!r} vs {err_b!r}"
+    )
     assert rc_a == rc_b, (
         f"SIG{signame}: exit status differs, control={rc_a} instrumented={rc_b}. git and the "
         "harness both read this status."
@@ -1322,50 +1347,6 @@ def test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one(sandbox, sign
     )
 
 
-def test_no_redirection_in_the_sink_PRECEDES_its_stderr_redirect():
-    """Generalises the rule that has now been broken three times, at three different commands.
-
-    LIMITS, stated because a string predicate over shell is exactly what this repo has withdrawn
-    before: it scans ONE file, after stripping quoted spans, and it reasons about text rather than
-    parsing shell. It will not see a redirection built by expansion, and it treats each physical
-    line independently. It is kept because it caught two real offenders that nothing else did, and
-    it is scoped narrowly enough that a false positive is a two-second read — not because it is
-    sound.
-
-
-    Redirections are applied left to right, so `cmd >out 2>/dev/null` opens `out` FIRST and reports
-    a failure on the stderr still in force — the instrumentation talking to the harness. It shipped
-    on `exec 0<`, then on the log append, then on `cat <&4`. The previous guard grepped only `exec`,
-    so the third instance walked straight past it: the class was named but not removed, which is the
-    same error one level up.
-    """
-    offenders = []
-    for i, ln in enumerate(SINK.read_text().splitlines(), 1):
-        # Quoted spans first, THEN comments: a `>` inside a string is not a redirection, and a `#`
-        # inside a string does not start a comment. Doing it the other way round truncates lines
-        # mid-string and both mis-flags and mis-clears.
-        code = re.sub(r"'[^']*'|\"[^\"]*\"", "", ln).split("#", 1)[0]
-        if "2>" not in code:
-            continue
-        # PER COMMAND, not per line. `exec 3>&1 || { rm -f x 2>/dev/null; }` has the `2>` on a
-        # DIFFERENT command from the redirect, and scanning the whole line flagged it wrongly.
-        for seg in re.split(r"\|\||&&|[;|{}]", code):
-            # `2>&1` is exempt and is not a loophole: it DUPLICATES the already-redirected fd 1, so
-            # it is correct precisely because it comes after. Only `2>` at a FILE has to lead.
-            m = re.search(r"2>(?!&)", seg)
-            if not m:
-                continue
-            # NO digit lookbehind. An earlier version excluded any operator preceded by a digit —
-            # that is `exec 0<`, `exec 1>`, `exec 4<`, precisely the lines this guard exists for.
-            # Mutation-checked: with it, reintroducing `exec 0<"$sin" 2>/dev/null` verbatim was NOT
-            # detected.
-            if re.search(r"(?<!&)(<&|>>|>|<)", seg[: m.start()]):
-                offenders.append(f"{SINK.name}:{i}: {ln.strip()}")
-                break
-    assert not offenders, (
-        "these lines place a redirection BEFORE their stderr redirect, so a failure in the first "
-        "one is reported on the hook's real stderr:\n  " + "\n  ".join(offenders)
-    )
 
 
 @pytest.mark.parametrize("locale_env", [
@@ -1465,3 +1446,65 @@ def test_a_PRESENT_but_empty_decision_is_not_laundered(sandbox):
                    env={**env, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)}, timeout=60)
     rec = [r for r in (logdir / "s1.jsonl").read_text().splitlines() if '"phase":"exit"' in r]
     assert '"decision":"unrecognized"' in rec[0], f"an empty decision was laundered: {rec[0]}"
+
+
+def test_identity_fields_BEYOND_the_fast_path_cap_are_still_found(tmp_path):
+    """The bound must be an optimisation, never a correctness dependency.
+
+    A plain 256 KB cap reintroduced the exact defect the unbounded read had just fixed: a payload
+    whose filler pushes `session_id` past the cap returns nothing, the record files under
+    `unknown-session`, and that fire reads as NEVER HAVING HAPPENED in the report. The nested-field
+    test could not see it — its identities sit before only 1,000 bytes of filler.
+
+    So the cap is a fast path with an unbounded fallback, and this test puts the identity where only
+    the fallback can reach it.
+    """
+    import json as _json
+
+    hook = tmp_path / "big.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin big "" capture || true\n'
+        "input=$(cat)\n"
+    )
+    logdir = tmp_path / "biglog"
+    payload = _json.dumps({
+        "tool_input": {"filler": "x" * 400_000},
+        "session_id": "TOP-SESSION",
+        "hook_event_name": "PreToolUse",
+        "tool_name": "TopTool",
+    })
+    subprocess.run(["bash", str(hook)], input=payload.encode(), capture_output=True,
+                   cwd=str(tmp_path), env={**os.environ, "ETV_HOOK_FIRE_LOG_DIR": str(logdir)},
+                   timeout=90)
+
+    assert (logdir / "TOP-SESSION.jsonl").exists(), (
+        "identity beyond the fast-path cap was not found, so the fire filed under "
+        f"{[f.name for f in logdir.glob('*.jsonl')]} and reads as never having happened"
+    )
+    rec = (logdir / "TOP-SESSION.jsonl").read_text()
+    assert '"tool":"TopTool"' in rec and '"event":"PreToolUse"' in rec, rec
+
+
+def test_the_field_helper_does_not_LEAK_into_the_hooks_namespace(sandbox):
+    """A bash function defined inside another function is still GLOBAL.
+
+    A short generic name (`_etv_field`) therefore survives `begin` and can collide with, or
+    overwrite, a function the hook itself defines — and it would refer to a now-unset variable.
+    """
+    root, env = sandbox
+    hook = root / "ns.sh"
+    hook.write_text(
+        "#!/usr/bin/env bash\nset -uo pipefail\n"
+        f'. "{SINK}"\n'
+        'etv_hook_fire_begin ns "" capture || true\n'
+        "input=$(cat)\n"
+        'if declare -F _etv_field >/dev/null 2>&1; then echo LEAKED_etv_field; fi\n'
+        'if declare -F etv_hook_fire__field >/dev/null 2>&1; then echo LEAKED_namespaced; fi\n'
+        "echo CLEAN\n"
+    )
+    p = subprocess.run(["bash", str(hook)], input=b'{"session_id":"s1","tool_name":"Bash"}',
+                       capture_output=True, cwd=str(root), env=env, timeout=60)
+    assert b"LEAKED" not in p.stdout, f"a helper leaked into the hook's namespace: {p.stdout!r}"
+    assert b"CLEAN" in p.stdout
-- 
2.47.3


From 7d2769018593d96794dfe68d854e2496b365cae9 Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 16:16:51 +0200
Subject: [PATCH 11/14] docs(776): my correction to the fabricated measurement
 was itself inverted
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round 6 found a Blocker, and it is in the decision record rather than the code:
the paragraph written LAST round to correct a fabricated measurement contains an
inverted one. Same mistake, one round later, in the artifact written to fix it —
and by the same route, taking a review summary without re-measuring.

Claimed: the round-3 trapped sink "returned rc 0 on SIGINT where the control
returns -2". Measured myself, 12 cells ({group,pid} x {TERM,INT,HUP} x
{control, round-3, HEAD}):

  pid + INT:   control 0   round-3 -2   HEAD 0

Exactly inverted. The trapped sink returned -2 where the control returns 0 — a
real transparency violation, but in the RESTRICTIVE direction, which also makes
"the consent bug survived" the wrong characterisation. HEAD matches the control
in all twelve cells. The record now prints the matrix instead of asserting a
conclusion about it.

A second false claim in the same paragraph, also removed: that the test's
exit-status assertion "catches the SIGINT case". It does not. The test signals
the process GROUP, and in every group cell the trapped sink is indistinguishable
— so it would not have caught round 3 at all. The test pins the transparency of
the code that ships; it is not evidence any earlier version was worse, and the
record now says so.

Also this round:

- The job-notice exemption in the signal A/B hides a line that NAMES the sink's
  path on a guard's stderr (bash attributing its own message to the executing
  line). That is a real if small leak and the exemption conceals it. Accepted
  rather than fixed — it cannot be suppressed while the sink does any work at
  exit — but stated plainly instead of left as "bash's notice, harmless".
- docs/guard-inventory.md records the withdrawn redirect-order guard and, more
  importantly, what the surviving exec-only guard does NOT cover.

Refs: #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../testing/hook-reports-its-own-execution.md | 61 ++++++++++++++-----
 1 file changed, 45 insertions(+), 16 deletions(-)

diff --git a/docs/decisions/records/testing/hook-reports-its-own-execution.md b/docs/decisions/records/testing/hook-reports-its-own-execution.md
index 7f7b4a2b7..793d360c1 100644
--- a/docs/decisions/records/testing/hook-reports-its-own-execution.md
+++ b/docs/decisions/records/testing/hook-reports-its-own-execution.md
@@ -89,14 +89,33 @@ stalls too. The trap cost ~0.1 s, not 29 s. Recorded rather than quietly fixed,
 record carrying a fabricated measurement is worse than one carrying none: it reads as checked and
 talks the next reader out of checking.
 
-**What actually justifies the withdrawal**, stated now that the false reason is gone. Three defects
-in three rounds, every one silent and in the permissive direction, against a rescue window that is
-sub-millisecond because every capture-mode hook prints its decision and exits immediately. And the
-trap was *still* wrong when it was withdrawn: the round-3 sink, after its Blocker fix, returned
-**rc 0 on SIGINT where the uninstrumented control returns −2** — the consent bug survived for one
-signal of the three. Machinery that needs a signal-to-status map, an idempotent flush, correct
-re-raise semantics and `BASHPID` handling, to rescue a sub-millisecond window, is not worth its
-failure modes.
+**A second correction, in the same paragraph as the first.** The replacement rationale asserted that
+the round-3 sink "returned rc 0 on SIGINT where the uninstrumented control returns −2". That is
+**inverted**, and it was again taken from a review summary without re-measuring — the identical
+mistake, one round later, in the artifact written to correct it. The measured 12-cell matrix
+({group, pid} × {TERM, INT, HUP} × {control, round-3 trapped, HEAD}):
+
+| | TERM | INT | HUP |
+|---|---|---|---|
+| group kill — control / trapped / HEAD | −15 / −15 / −15 | −2 / −2 / −2 | −1 / −1 / −1 |
+| pid kill — control / trapped / HEAD | −15 / −15 / −15 | **0 / −2 / 0** | −1 / −1 / −1 |
+
+So the trapped sink returned **−2 where the control returns 0** — a real transparency violation, but
+in the *restrictive* direction, which also makes "the consent bug survived" the wrong
+characterisation. **HEAD matches the control in all twelve cells.** And the claim that the
+exit-status assertion "catches the SIGINT case" is false as written: the test signals the process
+group, and in every group cell the trapped sink is indistinguishable, so it would not have caught
+round 3 at all. The test asserts the transparency of the current code, which is what it is for; it
+is not evidence that the trap was bad.
+
+**What actually justifies the withdrawal**, with the two false reasons removed. Three defects in
+three rounds, each real and measured at the time — a handler that turned a signal into consent and
+let a push reach `main`, a `local` that clobbered the status so a killed guard was recorded as
+passing, and a nested signal that discarded the output. One measured transparency violation that
+survived the fixes (pid + SIGINT, above). And a rescue window that is sub-millisecond, because every
+capture-mode hook prints its decision and exits immediately. Machinery needing a signal-to-status
+map, an idempotent flush, correct re-raise semantics and `BASHPID` handling, to rescue that window,
+is not worth its failure modes.
 
 What is lost by withdrawing it, enumerated rather than waved past, because
 `process.enumerate-workaround-behaviors-before-deleting` exists for precisely this move:
@@ -108,14 +127,16 @@ What is lost by withdrawing it, enumerated rather than waved past, because
 | Cleanup of the two temp files on a kill | **LOST**, bounded by `$TMPDIR` cleanup |
 | Idempotent flush (`ETV_HOOK_FIRE_FLUSHED`) | **RETAINED** — cheap, and the failure it prevents is silent |
 
-The invariant that replaces the rescue is stronger than it was, and is now asserted directly:
-**under a signal, an instrumented hook is indistinguishable from an uninstrumented one.**
-`test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one` compares exit status and time to
-die. It **signals the process group, not the pid**, and that is not a detail: bash defers a fatal
+The invariant that replaces the rescue is asserted directly: **under a signal, an instrumented hook
+is indistinguishable from an uninstrumented one** — compared on exit status, stdout, stderr and time
+to die. It **signals the process group, not the pid**, and that is not a detail: bash defers a fatal
 signal until its foreground command finishes, so signalling the pid alone makes both sides take the
-full sleep and the timing assertion can distinguish nothing — it was vacuous in exactly the way this
-file's central test was vacuous on arrival. The exit-status half is the load-bearing one; it is what
-catches the SIGINT case.
+full sleep and the timing assertion distinguishes nothing.
+
+Its limit, stated because the alternative is a coverage claim that is not true: **the group-kill
+arrangement makes the test blind to the round-3 trapped sink**, which passes every assertion there.
+The divergence that sink actually had is a pid-kill one (the table above). This test pins the
+transparency of the code that ships; it is not a proof that any earlier version was worse.
 
 **A SECOND withdrawal, on the same reasoning.** A `test_no_redirection_in_the_sink_PRECEDES_its_stderr_redirect`
 generalised the `exec … 2>/dev/null` rule to any command by pattern-matching shell source. It went
@@ -134,7 +155,15 @@ live foreground child, bash prints its own job-control notice (`Terminated: 15
 uninstrumented hook does not. Isolated: sourcing the sink alone does not produce it, and a no-op
 `EXIT` trap does not either — doing ANY work at exit keeps the shell alive the ~50 ms bash needs to
 print, and doing work at exit is the sink's entire purpose. The A/B exempts exactly that notice and
-nothing else. It costs one stderr line in a run that is being killed anyway.
+nothing else.
+
+**The exemption is doing real work and the honest reading is uncomfortable**, so it is stated
+plainly: one observed form of the notice is
+`…/scripts/hook-fire-log.sh: line 109: <pid> Hangup: 1   sleep 25` — bash attributing its own
+message to whichever line of the sink was executing, which means the instrumentation's path appears
+on a guard's stderr where an uninstrumented hook emits nothing. That is a genuine, if small, leak,
+and the exemption hides it. It is accepted rather than fixed because it cannot be suppressed while
+the sink does any work at exit, and it costs one line in a run that is already being killed.
 
 **The generalisable lesson is about the fixing, not the bugs.** This took three review rounds, and
 every round found that the previous round's *fix* had introduced something beside its target. The
-- 
2.47.3


From 1a2b5758be737b0c97febb1509a4dd00cbe6222f Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 16:29:13 +0200
Subject: [PATCH 12/14] docs(776): pin the signal matrix to a sha and its
 reproduction
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Independent re-measurement confirmed all twelve cells (five repeats each,
unanimous), that HEAD matches the control everywhere, and that the group-kill
test is blind to the trapped sink — the last with a positive control, patching
the trapped re-raise back to `exit 0` to watch the same test go red.

The table now names the sha it measured rather than a round number, and carries
the command that produces it. Third version of this paragraph; the first was
fabricated and the second inverted, both because a number was written without the
means to re-derive it.

Refs: #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../records/testing/hook-reports-its-own-execution.md  | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/docs/decisions/records/testing/hook-reports-its-own-execution.md b/docs/decisions/records/testing/hook-reports-its-own-execution.md
index 793d360c1..bd876240e 100644
--- a/docs/decisions/records/testing/hook-reports-its-own-execution.md
+++ b/docs/decisions/records/testing/hook-reports-its-own-execution.md
@@ -97,8 +97,14 @@ mistake, one round later, in the artifact written to correct it. The measured 12
 
 | | TERM | INT | HUP |
 |---|---|---|---|
-| group kill — control / trapped / HEAD | −15 / −15 / −15 | −2 / −2 / −2 | −1 / −1 / −1 |
-| pid kill — control / trapped / HEAD | −15 / −15 / −15 | **0 / −2 / 0** | −1 / −1 / −1 |
+| group kill — control / trapped (`6f006a1b7`) / HEAD | −15 / −15 / −15 | −2 / −2 / −2 | −1 / −1 / −1 |
+| pid kill — control / trapped (`6f006a1b7`) / HEAD | −15 / −15 / −15 | **0 / −2 / 0** | −1 / −1 / −1 |
+
+Reproduce: spawn a `stream`-mode hook that prints a decision then `sleep`s, in its own session;
+signal 1 s in with `os.killpg` or `os.kill`; read the wait status. Independently re-measured, five
+repeats per cell, every cell unanimous, stdout byte-identical in all runs — and the "would not have
+caught round 3" claim carries its own positive control: patching the trapped handler's re-raise back
+to `exit 0` turns the same test red on all three signals.
 
 So the trapped sink returned **−2 where the control returns 0** — a real transparency violation, but
 in the *restrictive* direction, which also makes "the consent bug survived" the wrong
-- 
2.47.3


From 5f62140a5297add49a93d05f995104ee18df71b7 Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 16:42:27 +0200
Subject: [PATCH 13/14] =?UTF-8?q?fix(776):=20the=20BOM=20guard=20was=20fai?=
 =?UTF-8?q?l-open=20on=20Linux=20=E2=80=94=20xxd=20is=20not=20installed=20?=
 =?UTF-8?q?there?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI red on `Script tests (pytest)`, three failures, and the first is a real guard
defect that six review rounds on macOS could not see.

`pretooluse-bom-guard.sh` detects a BOM with `head -c3 | xxd -p`. `xxd` ships
with vim and is ABSENT on the Linux CI runner (verified on the runner host), so
the substitution yields empty, never equals efbbbf, and the guard passes every
BOM silently. It has been fail-open on any host without vim for its whole life.
`od -A n -t x1 -N 3` is POSIX and byte-identical on both platforms.

It surfaced only because #776's non-vacuity assertion demands that hook actually
reach a decision. The environment was a sampled population too — every review
round ran where xxd exists.

The other two failures were my tests being platform-specific:

- Linux prints a bare `Terminated` job-control notice where macOS prints
  `Terminated: 15   sleep 5`; the exemption regex required a trailing colon or
  space and so did not match.
- The locale matrix used en_US.UTF-8, which is not installed on the runner, so
  bash itself warned and the assertion was measuring the absent locale rather
  than the export fix. Unavailable locales are skipped with that reason stated.

And the stripper test is reframed. It compared the stripped hook against the
merge base, which asserted two unrelated things — that the stripper is exact, and
that no hook was edited for any other reason. The second went red the moment a
hook had a real defect fixed. It now asserts the property that actually protects
the A/B control: every line removed is a preamble line and none is added.
Mutation-checked — widening the stripper to eat `set -` lines turns it red.

Refs: #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../testing/hook-reports-its-own-execution.md | 15 +++++
 scripts/tests/test_hook_fire_log.py           | 62 +++++++++++--------
 2 files changed, 51 insertions(+), 26 deletions(-)

diff --git a/docs/decisions/records/testing/hook-reports-its-own-execution.md b/docs/decisions/records/testing/hook-reports-its-own-execution.md
index bd876240e..bcf73fe01 100644
--- a/docs/decisions/records/testing/hook-reports-its-own-execution.md
+++ b/docs/decisions/records/testing/hook-reports-its-own-execution.md
@@ -171,6 +171,21 @@ on a guard's stderr where an uninstrumented hook emits nothing. That is a genuin
 and the exemption hides it. It is accepted rather than fixed because it cannot be suppressed while
 the sink does any work at exit, and it costs one line in a run that is already being killed.
 
+**CI found what six review rounds on one platform could not, and it was a live guard defect.** The
+non-vacuity assertion demands that `pretooluse-bom-guard.sh` reach a `deny`. On the Linux runner it
+could not, because the guard detects a BOM with `xxd -p` — and **`xxd` ships with vim and is absent
+there**, so the command substitution yielded empty, never matched, and the guard passed every BOM
+silently. It has been fail-open on any host without vim for its whole life. `od -A n -t x1 -N 3` is
+POSIX, byte-identical on both platforms, and is what it uses now.
+
+Two things follow. The defect was invisible to every round of review because all of them ran on
+macOS, where `xxd` exists — **the environment was a sampled population too**, and the only reason it
+surfaced is that a test asserted the guard must actually decide something. And two of the three CI
+failures were my *tests* being platform-specific (a bare `Terminated` job notice where macOS prints
+`Terminated: 15   sleep 5`; locales that do not exist on the runner, so bash warned and the
+assertion measured the missing locale rather than the fix). A test suite is code, and it inherits
+the same blind spot as the code it checks.
+
 **The generalisable lesson is about the fixing, not the bugs.** This took three review rounds, and
 every round found that the previous round's *fix* had introduced something beside its target. The
 signal fix is the sharpest case: it corrected a lost log line and, in doing so, turned a killed
diff --git a/scripts/tests/test_hook_fire_log.py b/scripts/tests/test_hook_fire_log.py
index 67db5dcd2..125bbed88 100644
--- a/scripts/tests/test_hook_fire_log.py
+++ b/scripts/tests/test_hook_fire_log.py
@@ -158,35 +158,36 @@ def test_the_population_is_not_empty():
     assert os.access(SINK, os.X_OK), "the sink is not executable, so its report side cannot be run"
 
 
-def test_the_stripper_reproduces_the_ORIGINAL_byte_for_byte():
-    """The A/B control must BE the pre-#776 script, not merely resemble it.
+def test_the_stripper_removes_EXACTLY_the_preamble_and_nothing_else():
+    """The A/B control must be the hook minus the instrumentation — no more, no less.
 
-    `test_the_stripper_actually_strips` only asserts the preamble is gone. That leaves the property
-    the differential test actually depends on — that the control side is the real original —
-    unpinned, so a future edit to the preamble format could make the control silently diverge in a
-    way that matters while every assertion stayed green. Compared against git rather than against a
-    second copy in this file, because a second copy is the thing that drifts.
+    This compared `strip_instrumentation(hook)` against the hook at the merge base, which asserted
+    two unrelated things at once: that the stripper is exact, AND that no hook was edited in this PR
+    for any other reason. The second is not a property worth pinning — it went red the moment
+    `pretooluse-bom-guard.sh` had a real defect fixed (`xxd`, absent on the CI runner, made it
+    fail open) — and coupling them means a legitimate change reads as a broken control.
+
+    The property that actually protects the differential is structural: every line the stripper
+    removes is a preamble line, and it adds nothing. Checked without reference to history, so it
+    holds on any branch and on any platform.
     """
-    base = subprocess.run(
-        ["git", "merge-base", "HEAD", "origin/main"],
-        capture_output=True, cwd=str(REPO_ROOT), text=True,
-    ).stdout.strip()
-    if not base:
-        pytest.skip("no origin/main to compare against")
+    import difflib
 
+    allowed = ("# ersatztv#776", "# git hook:", "# Claude hook:", "ETV_HOOK_FIRE_LIB=",
+               "[ -r \"$ETV_HOOK_FIRE_LIB\"", "type etv_hook_fire_begin", "etv_hook_fire_begin ")
     for hook in hook_scripts():
-        rel = hook.relative_to(REPO_ROOT)
-        orig = subprocess.run(
-            ["git", "show", f"{base}:{rel}"],
-            capture_output=True, cwd=str(REPO_ROOT),
-        )
-        if orig.returncode != 0:
-            continue  # a hook added after the merge base has no pre-#776 form
-        assert strip_instrumentation(hook.read_text()) == orig.stdout.decode(), (
-            f"{hook.name}: strip_instrumentation() does not reproduce the original. The A/B "
-            "control is therefore not the pre-#776 script, and the differential test is comparing "
-            "against something nobody wrote."
-        )
+        cur = hook.read_text().splitlines(keepends=True)
+        stripped = strip_instrumentation("".join(cur)).splitlines(keepends=True)
+        for line in difflib.Differ().compare(cur, stripped):
+            if line.startswith("+ "):
+                raise AssertionError(f"{hook.name}: the stripper ADDED a line: {line[2:]!r}")
+            if line.startswith("- "):
+                body = line[2:]
+                assert body.strip() == "" or body.startswith(allowed), (
+                    f"{hook.name}: the stripper removed a NON-preamble line, so the A/B control is "
+                    f"not this hook: {body!r}"
+                )
+
 
 
 def test_the_stripper_actually_strips():
@@ -1329,7 +1330,7 @@ def test_a_SIGNALLED_hook_behaves_EXACTLY_as_an_uninstrumented_one(sandbox, sign
         # diagnostic still fails the comparison.
         return b"\n".join(
             ln for ln in e.split(b"\n")
-            if not re.search(rb"(^|\s)(Terminated|Hangup|Interrupt|Killed)(:|\s)", ln)
+            if not re.search(rb"(^|\s)(Terminated|Hangup|Interrupt|Killed)(:|\s|$)", ln)
         )
 
     assert strip_jobnotice(err_a) == strip_jobnotice(err_b), (
@@ -1367,6 +1368,15 @@ def test_an_INVALID_UTF8_byte_in_a_decision_is_still_classified(tmp_path, locale
     parametrised because a single ambient locale tests one row of it: with an inherited `LC_CTYPE`,
     `LC_CTYPE` outranks the exported `LANG=C` and the symptom returns in full.
     """
+    name = next(iter(locale_env.values()))
+    have = subprocess.run(["locale", "-a"], capture_output=True, text=True).stdout.split()
+    if name not in have and name.replace("UTF-8", "utf8") not in have:
+        pytest.skip(
+            f"{name} is not installed here, so bash itself warns and the assertion would be "
+            "measuring the missing locale rather than the export fix. The hazard needs a real "
+            "non-C locale to exist."
+        )
+
     logdir = tmp_path / "loclog"
     hook = tmp_path / "loc.sh"
     hook.write_text(
-- 
2.47.3


From ba2b1622387cb0f481d4883b8e08d5ef81bebdab Mon Sep 17 00:00:00 2001
From: Timothy <timothy@noreply.gitea.tblindustries.be>
Date: Fri, 14 Aug 2026 18:56:37 +0200
Subject: [PATCH 14/14] docs(776): restore two inventory sections the rebase
 resolution dropped
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rebasing onto #798 conflicted in docs/guard-inventory.md at every commit that
touched it, and resolving those by taking the accumulated side silently dropped
two prose sections: the WITHDRAWN note for the generalised redirect-order guard,
and the paragraph recording that test_hook_fire_log.py asserts two clauses with a
separate executed mutation for each.

Counts, rows and the inventory test were all green without them — which is the
point worth recording. A conflict resolution that satisfies every mechanical
check can still lose the reasoning, because the checks count rows and the prose
carries the WHY. Caught by grepping the merged file for the content the branch
was supposed to add, rather than trusting green.

Refs: #776

Decisions-Edit: yes
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 docs/guard-inventory.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/docs/guard-inventory.md b/docs/guard-inventory.md
index 3a3bd57a9..81aa04cce 100644
--- a/docs/guard-inventory.md
+++ b/docs/guard-inventory.md
@@ -173,6 +173,17 @@ dangerous direction — a token that a reviewer means as `BLOCKED` silently read
 approval, which writes a green `review-verdict/h10`. A token added to one script and not the other
 is untested by either, which is the whole of #788.
 
+**A guard was WITHDRAWN from `test_hook_fire_log.py` after four iterations**, recorded here because
+this is where a future session will look for it. A `test_no_redirection_in_the_sink_PRECEDES_its_stderr_redirect`
+generalised the `exec … 2>/dev/null` rule to any command by pattern-matching shell source. Each
+iteration fixed a false positive or false negative the previous one introduced — `>/dev/null 2>&1`
+flagged wrongly, then operators preceded by a digit (`exec 0<`) missed entirely, then multi-command
+lines flagged wrongly — and cold review then constructed more of both (`[[ "$x" < "$y" ]] 2>/dev/null`,
+a backslash continuation, a `>` inside a quoted string). Deleted rather than patched a fifth time,
+on the same reasoning as the vocabulary-parity withdrawal above.
+
+**`test_hook_fire_log.py` asserts TWO clauses
+
 **That unproven set carries no number here on purpose.** It restated the count, drifted the moment
 the BOM guard was regraded, and `test_the_summary_counts_match_the_table` cannot see it — the parser
 checks the formatted summary sentence and nothing else. A second hand-maintained copy of a number is
-- 
2.47.3