diff --git a/.claude/hooks/session-start.sh b/.claude/hooks/session-start.sh
deleted file mode 100755
index 61417bc91..000000000
--- a/.claude/hooks/session-start.sh
+++ /dev/null
@@ -1,295 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart: perform the per-clone setup AGENTS.md documents, at the start of
-# the session.
-#
-# NOT before the MCP servers start, which this header claimed for its whole life
-# and CLOUD-734 measured false. Two samples, one per container incarnation on
-# 2026-08-19/20: the generated MCP config is written, the client opens its
-# connection logs ~2.4s later, and this hook writes its first byte ~5s after
-# that — the connections are initiated BEFORE the hook and complete while it is
-# still provisioning. What rescues the install fix below is therefore not
-# ordering but the client's 120s connect timeout: serena's connection was
-# established 45.5s in, from inside this hook's window. CLOUD-316 recorded that
-# timeout as 30s, at which this session would have lost serena outright.
-#
-# Why this exists (CLOUD-196). `.mcp.json` launches Serena with
-# `mise exec -- serena start-mcp-server`, and `mise exec` INSTALLS a missing
-# tool on demand. On a cold container that install runs inside the MCP client's
-# startup window: measured 24s for `pipx:serena-agent`, the handshake did not
-# complete, and MCP servers are not retried mid-session — so Serena was absent
-# for a whole session while being perfectly runnable seconds later. Nothing was
-# wrong with Serena or with mise; the per-clone `mise install` step simply never
-# ran, so `exec` was doing an installer's job at the worst possible moment.
-#
-# This hook is deliberately SYNCHRONOUS (no `{"async": true}` line). Async would
-# reintroduce exactly the race it exists to close: the session would start while
-# the install was still running. The cost is paid only when cold — a warm
-# `mise install` measured 0.067s.
-#
-# Failure is loud, never silent: a session that could not provision its
-# toolchain must say so, because the original defect's whole signature was an
-# absence with no error anywhere.
-#
-# This hook is NECESSARY BUT NOT SUFFICIENT. Measured on a genuinely cold
-# container: the hook ran and completed before the session started, serena was
-# installed and startable (21 tools, 1.1s warm) — and it was STILL absent from
-# the session. A `.mcp.json` server is project-scoped and requires per-project
-# approval; a cold container gets a fresh `~/.claude.json` whose
-# `enabledMcpjsonServers` is `[]`, and a remote session has nobody to answer the
-# approval prompt. That second gate is closed by committing
-# `"enabledMcpjsonServers": ["serena"]` in .claude/settings.json — do not remove
-# it thinking this hook covers the case. Both are load-bearing.
-#
-# It also PREFLIGHTS THE CONTAINER (CLOUD-261), by calling `container-preflight`
-# after provisioning. "The toolchain installed" and "this container can do the
-# work" are different questions, and the second one used to be answered three
-# tasks in, by a failure wearing someone else's name. That task owns the what
-# and the why; this hook owns only the WHEN — the very beginning of the session,
-# before any work is planned against a container that cannot land it.
-set -uo pipefail
-
-cd "${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel)}" || exit 0
-
-# THE SESSION STAMP (CLOUD-431), written before anything else this hook does.
-#
-# `claim-check`'s `refined-this-session` rule compares an issue's tracker-minted
-# `updatedAt` against this file's mtime: refinement must PREDATE the session that
-# implements it. That predicate is only honest if the stamp marks the beginning
-# of the session, so it is written here — above the provisioning steps, and above
-# the `exit 1` a degraded container takes — rather than appended at the end. A
-# session whose install failed still began, and a stamp written after the work
-# would date the session to whenever the agent got round to claiming, which is
-# exactly the ordering the rule exists to refuse.
-#
-# Silent and never fatal: this hook's job is setup, and a clone whose git dir is
-# unwritable has larger problems than the claim gate. `claim-check` refuses on a
-# MISSING stamp rather than passing, so a failure here fails closed downstream.
-if stamp_dir=$(git rev-parse --git-dir 2>/dev/null) &&
-	mkdir -p "$stamp_dir/batten-receipts" 2>/dev/null; then
-	: >"$stamp_dir/batten-receipts/session-start" 2>/dev/null || true
-fi
-
-fail=0
-step() { # step <label> <cmd...>
-	local label="$1"
-	shift
-	if ! "$@" >/tmp/session-start-"$label".log 2>&1; then
-		echo "::error:: session-start: $label failed — see /tmp/session-start-$label.log" >&2
-		tail -5 /tmp/session-start-"$label".log >&2
-		fail=1
-	fi
-}
-
-# The three per-clone steps from AGENTS.md ("Per clone: mise install, git
-# submodule update --init, hk install"), each idempotent.
-#
-# mise install is the load-bearing one: it is what makes `mise exec` in
-# .mcp.json a pure exec rather than an implicit install.
-#
-# MISE_LOCKFILE=false makes it a PURE install (CLOUD-223). A cold install of
-# `ubi:rust-cross/cargo-zigbuild` otherwise appends
-# `platforms.linux-x64-cargo-zigbuild` — platform plus the exe name, checksum,
-# no url — to the tracked lockfile. `mise lock` cannot produce that key
-# (measured: it locks 0 platform entries for the ubi backend, all 7 skipped), so
-# it is install residue rather than a lock, and `mise run lock-complete` rejects
-# it by name. Every session therefore opened with a dirty tree and a red gate no
-# branch had caused, and it got committed twice: 17b8436, reverted by 3bee7d2,
-# then a7cef00 on a branch named for unrelated work. Warm installs never rewrite
-# it, so the cost looked intermittent.
-#
-# The authority is now `[settings] lockfile = false` in mise.toml, which denies
-# the write to EVERY caller — including the sandbox's own provisioning, which
-# runs before this hook and so kept dirtying the tree after the per-caller fix
-# landed. This line is the belt to that suspenders: it keeps the install pure
-# even where the setting is overridden by an ambient MISE_LOCKFILE. Asserted by
-# tests/session-start.bats.
-#
-# Provisioning has no business writing the lockfile at all: currency is owned by
-# .github/workflows/lock-currency.yml, on a schedule, off the landing path.
-step mise-install env MISE_LOCKFILE=false mise install
-# bats lives in tests/bats; `mise run test:bats` cannot run without it.
-step submodules git submodule update --init --recursive
-
-# `doctor` joins the same synchronous window (CLOUD-218). `mise install` returning
-# is not "the toolchain is settled": doctor provisions what mise does NOT own —
-# the rustup cross targets above all — and left outside this window it runs for
-# the first time inside the first `mise run verify`, concurrently with whatever
-# else the sandbox is still laying down. Measured on a cold container
-# 2026-08-07: that first verify died in doctor with
-#
-#   error: failed to install component: 'rust-std-aarch64-apple-darwin',
-#   detected conflict: '.../libaddr2line-….rlib'
-#   ::error:: could not install rust target aarch64-apple-darwin; …
-#
-# and a second doctor, nothing changed but time, exited 0. The message names
-# cross-compilation, so it costs the reader a debugging session on a machine
-# where nothing is broken — CLOUD-196's failure mode in different clothes.
-#
-# This is not a retry: it does not make the race survivable, it empties the
-# window the race needs. CLOUD-220's per-toolchain mutex in `target-ensure`
-# serializes concurrent WRITERS; this leaves the later ones nothing to write,
-# because by the time any task runs the targets are already installed. Both
-# stand — the mutex covers the warm case (the verify graph racing itself,
-# CLOUD-201), this covers the cold one.
-#
-# `doctor` itself is unchanged, and runs AFTER the two steps above: its rustup
-# half needs the mise-provisioned toolchain, and its submodule half is a repair
-# for the case the step above did not reach. It goes through `step`, so the
-# loud-failure contract is the same as every other one — a `::error::` line, the
-# log pointer, and a non-zero exit at the end.
-step doctor mise run doctor
-
-# The binary every hook registration executes (CLOUD-312). Built and INSTALLED
-# here, in the synchronous provisioning window, for the same reason the steps
-# above are: a fresh container has no `target/`, so without this a session would
-# start with policy unenforced — a state the guards it replaced could not reach.
-#
-# `install:local` rather than `build:release` since CLOUD-824. The registrations
-# used to name `.claude/hooks/batten-hook.sh`, a launcher whose four-candidate
-# binary search let a session run with `target/release` and nothing else; they
-# now name `batten` directly, as the other four harnesses always did, so the
-# binary has to be somewhere PATH resolves. `install:local` puts it at
-# `install.sh`'s own destination.
-#
-# THIS STEP IS NOW THE WHOLE "no binary" REPORT, and it is louder than what it
-# replaces. The launcher failed open with a stderr line and a once-per-session
-# `$TMPDIR` marker — the quietest report this repository produces. `step` emits
-# `::error::`, the log pointer, and a non-zero exit, so a session that cannot
-# mediate says so at the moment it could still be fixed rather than on the first
-# tool call.
-step batten-build mise run install:local
-
-# The third per-clone step from AGENTS.md, performed at last (CLOUD-476).
-#
-# It used to be deliberately absent, and the reasoning was sound as far as it
-# went: `hk install` writes `exec hk run pre-commit`, calling `hk` BARE, which
-# resolves only where mise's shims are on PATH. In this environment they are
-# not, so that hook makes every `git commit` fail with `hk: not found` —
-# measured, on the very commit that added the step. A broken hook is worse than
-# none, so the step was dropped and 24 commits in one container went through no
-# gate at all.
-#
-# The answer is not to run `hk install` but to install a hook this repo owns:
-# `.claude/hooks/git-hook.sh` resolves `hk` through `mise exec --`, which is the
-# form that works here, and refuses to re-enter a gate that is already running.
-# Both properties are its own file's to explain; this step owns only the WHEN.
-#
-# A symlink, not a copy: a copy is a second authority that goes stale silently
-# the moment the checked-in body changes, and `doctor` would keep passing over
-# it. `-f` so a clone carrying hk's generated hook is repaired rather than
-# skipped, which is the state every existing clone is in.
-install_git_hooks() {
-	local root hooks src name
-	root=$(git rev-parse --show-toplevel) || return 1
-	hooks=$(git rev-parse --git-path hooks) || return 1
-	src="$root/.claude/hooks/git-hook.sh"
-	[[ -x "$src" ]] || {
-		echo "no executable hook body at $src" >&2
-		return 1
-	}
-	mkdir -p "$hooks" || return 1
-	# Both hooks hk defines (hk.pkl `hooks`), through one body that dispatches on
-	# the name it is invoked as. commit-msg carries the Conventional Commits
-	# check that release-plz's semver depends on, so leaving it out would gate
-	# the expensive half and not the one that decides a version.
-	for name in pre-commit commit-msg; do
-		ln -sfn "$src" "$hooks/$name" || return 1
-	done
-}
-step git-hooks install_git_hooks
-# The repo-local git identity, set before the session writes a line (CLOUD-274).
-#
-# It belongs in this window for the same reason `doctor` does: the vendor identity
-# is injected at the environment level, so a fresh clone is already carrying it
-# before any work starts, and the first thing that would notice is `commit-lint`
-# refusing a branch whose commits are all already written. Setting it here means
-# the gate has nothing to catch — feedforward that costs one idempotent git config
-# read, rather than a refusal an agent has to unwind with a rebase.
-#
-# After `batten-build`, because this is the engine answering: the policy is
-# `[attribution]` in batten.toml and `batten attribution identity` is what reads
-# it. A WRITE, self-declared as one (house style §5), scoped to .git/config in
-# this checkout — never --global, which covers a developer's own unrelated
-# repositories. An identity a contributor set accountably is left exactly alone.
-step attribution-identity mise run attribution-identity
-
-# The not-signing posture, put into force in the same window and for the same
-# reason (CLOUD-669). CLOUD-591 decided it — "the interim posture is not to
-# sign" — and shipped no mechanism, so it was never once in force: the launcher
-# writes `commit.gpgsign true` --global every session, and local beats global
-# only if something writes local.
-#
-# The identity repair above and this are the same defect on two fields. The
-# author field was gated and repaired; the SIGNATURE was neither, so every
-# commit carried the environment's own key — one this repo does not hold, cannot
-# publish, and which GitHub reports as `unknown_key`. `Attribution` has no
-# signature field, so `identity_deny` structurally cannot see it.
-#
-# Before any commit is written, for the reason stated above: a repair that lands
-# after the fact leaves signed commits that only a rebase can unwind.
-step signing-posture mise run signing-posture --repair
-
-# `hk install` is deliberately NOT run here, though AGENTS.md lists it as a
-# per-clone step. The hook it generates is `exec hk run pre-commit`, calling
-# `hk` bare — which resolves only where mise's shims are on PATH. In this
-# environment they are not, so installing it makes every `git commit` fail with
-# `hk: not found`. Measured: adding the step here broke the very commit that
-# added it. The gate is still enforced, by `mise run ci`/`verify` and by CI;
-# a local pre-commit hook is a convenience, and a broken one is worse than
-# none. Restoring it needs the PATH question answered first (CLOUD-196).
-
-if [[ "$fail" -ne 0 ]]; then
-	echo "::error:: session-start: setup incomplete — expect missing tools or MCP servers" >&2
-fi
-
-# --- can this container do the work at all? -----------------------------------
-#
-# Provisioning succeeding is a different question from the container being
-# usable, and the difference is invisible until a task deep in the lifecycle
-# fails in someone else's name. `container-preflight` asks the second question
-# and halts on it; see that task for what it checks and why each is unrepairable
-# from inside the session.
-#
-# It runs even when provisioning failed, because a failed install is usually a
-# SYMPTOM of what it diagnoses (a proxied api.github.com), and reporting the
-# cause beside the symptom is the whole point. Its own `--degraded` argument
-# tells it not to trust toolchain-dependent probes in that state.
-if [[ "$fail" -ne 0 ]]; then
-	mise run container-preflight -- --degraded || fail=1
-else
-	mise run container-preflight || fail=1
-fi
-
-# --- what was running when the container we replaced went down? ---------------
-#
-# CLOUD-451. The reclaim destroys a human's typed approval, and one mechanism has
-# already been built against it and removed (CLOUD-515) because nobody could say
-# whether occupancy was even the right lever. `reclaim-census` collects that
-# evidence off `land-lock hold`'s existing beat; this is where it is read back.
-#
-# RECORD BEFORE READ, and the order is load-bearing: recording this boot after
-# reading would make it part of the evidence it is being compared against.
-#
-# NEVER SETS `fail`, and deliberately not routed through `step`: a verdict about
-# a past container is not a provisioning failure, and halting a session over one
-# would be the sensor deciding something it has no business deciding. Only the
-# positive reading speaks — exit 1 (idle when replaced) and exit 2 (cannot look)
-# are silent, because a line every session start would be noise in the
-# overwhelming case where nothing happened. Pointer-only: a verdict and two
-# epochs, never a plan or a prompt body.
-# Relative, because this script has already `cd`ed to the repo root above, and
-# `CLAUDE_PROJECT_DIR` is only conditionally set, which `set -u` would fault on.
-census="mise-tasks/reclaim-census.sh"
-if [[ -x "$census" ]]; then
-	"$census" record-boot >/dev/null 2>&1 || true
-	if verdict=$("$census" report 2>/dev/null); then
-		echo "$verdict"
-	fi
-fi
-
-if [[ "$fail" -ne 0 ]]; then
-	exit 1
-fi
-# SILENCE ON THE NORMAL PATH (CLOUD-891). The failure paths above already speak;
-# this line only ever said "nothing went wrong", once per session, to a reader
-# with no action to take. See `mcp-attach-check` for the argument.
diff --git a/.claude/rules/toolchain.md b/.claude/rules/toolchain.md
index fab334298..8da1ddf88 100644
--- a/.claude/rules/toolchain.md
+++ b/.claude/rules/toolchain.md
@@ -15,9 +15,21 @@ These load when you touch the workshop; deeper detail is in
 **Use mise for everything** — tools via `[tools]`, env via `[env]`, commands as
 `[tasks]` run with `mise run`; never a bare `cargo`/`export`/one-off install, so
 CI, hk, and your shell run byte-identical commands. Per clone: `mise install`,
-`git submodule update --init` (bats, in `tests/bats`), and the git hooks — which
-`.claude/hooks/session-start.sh` now performs and `doctor` asserts (CLOUD-476),
-so none of the three is left to a human remembering a prose list. Not `hk
+`git submodule update --init` (bats, in `tests/bats`), and the git hooks — none
+of the three left to a human remembering a prose list, because each is a
+`session:*` task that `batten.toml` declares as a `[[hook.handler]] on =
+"session-start"` and `doctor` asserts afterwards (CLOUD-476, CLOUD-312 row 10).
+
+**The provisioning order and its bounds are `batten.toml`'s, not a script's.**
+The ten `session-*` handler rows ARE the sequence: declaration order is running
+order, each row declares its own `timeout_ms`, and `batten hook` dispatches them
+inline at session start. `.claude/hooks/session-start.sh` used to hold all of
+that and was the last by-path hook registration this repository owned; it is
+retired, and `crates/batten/tests/session_provisioning.rs` carries both its
+ledger and the tier that proves the door does what the rows say. Add a
+provisioning step by adding a task and a row — never by putting a second step
+inside an existing task's body, which is the shape that made the script
+unreadable from the committed authority. Not `hk
 install`: its generated hook calls `hk` bare, which does not resolve where
 mise's shims are off PATH, so the installed body is `.claude/hooks/git-hook.sh` —
 which also refuses to re-enter a gate that is already running, the recursion
@@ -785,6 +797,16 @@ prints the echo and exits 0). So in a **gate**, any command whose failure would
 change the verdict must be guarded explicitly — otherwise the gate reports on
 state it never refreshed, which is a silent false green and worse than no gate.
 
+**The declared shell is the discriminator, and reading this section without it is
+how three wrong comments landed** (CLOUD-1085, measured 2026-09-01). A task that
+declares NO `shell =` gets the default and `-e` with it, so there a bare failing
+command aborts the body where it stands rather than falling through. `test:bats`
+is such a task and its own comments claimed the opposite for their whole life;
+`verify` and `verify:gated` declare `shell = "bash -c"` and are the case this
+section is about. Guard either way — under `-e` the guard is what lets a step name
+its own failure instead of inheriting mise's — but do not carry "every line runs"
+across to a body that declared nothing.
+
 Two instances of this had already landed. `linear-check`'s `git fetch` fed the
 `origin/main` ref every later line reads, so a failed fetch left it comparing a
 stale main to itself, passing, and writing a receipt `ready-guard` then honours
diff --git a/.claude/settings.json b/.claude/settings.json
index b1632f516..a018511f0 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -54,14 +54,6 @@
             "command": "batten hook --harness claude-code"
           }
         ]
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/session-start.sh"
-          }
-        ]
       }
     ],
     "TaskCompleted": [
@@ -123,7 +115,7 @@
   "autoMode": {
     "environment": [
       "$defaults",
-      "This checkout is button-inc/batten, whose product IS `batten` — a repo-agnostic completion gate. The binary is built from crates/batten in this working directory and installed to ~/.local/bin/batten by .claude/session-start.sh via `mise run install:local`. It is not a third-party download and will not appear on any known-tool list. Every workflow here runs through it, directly or as a subprocess of a `mise run` task."
+      "This checkout is button-inc/batten, whose product IS `batten` — a repo-agnostic completion gate. The binary is built from crates/batten in this working directory and installed to ~/.local/bin/batten twice over: the released build by `mise run deps-install` at container provisioning, then this checkout's own by the `session-batten` handler `batten.toml` declares. It is not a third-party download and will not appear on any known-tool list. Every workflow here runs through it, directly or as a subprocess of a `mise run` task."
     ],
     "allow": [
       "$defaults",
diff --git a/batten.toml b/batten.toml
index cf849c97e..9c2e6f4d7 100644
--- a/batten.toml
+++ b/batten.toml
@@ -2578,11 +2578,26 @@ severity = "deny"
 scope = "tree"
 no_fix_reason = "declare it as a `[[pattern]]` row and read it by id; a tracker's vocabulary in the core is rule 1's violation, and moving it is the fix rather than rewording it"
 
+# A RETIREMENT LEDGER ARM IS EXEMPT, and this is a structural collision rather
+# than a convenience (CLOUD-1294). `bats-tests-not-deleted` matches an arm by the
+# deleted case's title QUOTED VERBATIM, and its `declared_in` puts every arm under
+# `crates/batten/tests/**` — inside this row's glob. So a governed bats case whose
+# TITLE happens to carry this word can never be recorded, and therefore never
+# retired, however honest the retirement is.
+#
+# Measured on CLOUD-312 row 10: `"the fixer is wired: session-start runs it, so a
+# clone is compliant before it commits"`.
+#
+# It is not a weakening of what this row decides. The row bans a consumer's name
+# appearing in the core; an arm is DATA ABOUT A LINE THAT NO LONGER EXISTS, and
+# the four markers anchor it at the start of a line, so nothing but a ledger row
+# can reach the exemption.
 [[rule]]
 id = "no-consumer-repo-name"
 kind = "forbid"
 glob = "crates/**"
 regex = "(?i)complian"
+exclude = "^// (carried|subsumed|changed|withdrawn): "
 severity = "deny"
 scope = "tree"
 
@@ -4113,7 +4128,18 @@ base = "origin/main"
 # withdrawal as one over a live subject and refuses it. A false refusal, in the
 # direction that blocks correct work.
 delta_sources = ["**"]
-line_sources = ["mise-tasks/*.sh", "crates/batten/tests/**/*.rs"]
+# `tests/**/*.bats` IS HALF THE GOVERNED SET AND WAS NOT A DECLARED SOURCE
+# (CLOUD-1294). `governed_at_head` selects every bats suite, but the lines of one
+# were never read — so `only_drops_a_retired_reference` bound `base` from
+# `base-lines` and came back UNDEFINED for every suite, and arm B refused every
+# edited `.bats` unconditionally, whatever the edit was. The one admitted edit
+# has been unreachable for half the corpus since it was written, and the refusal
+# was indistinguishable from a real one because the finding is byte-identical.
+#
+# Measured on CLOUD-312 row 10: three cases in two suites, no landable spelling.
+# The cost of reading them is `.claude/rules/rust.md`'s ~5.4 µs per declared
+# document against ~137 suites — under a millisecond, on a 100 ms budget.
+line_sources = ["mise-tasks/*.sh", "crates/batten/tests/**/*.rs", "tests/**/*.bats"]
 module = "policy/shell-retirement.rego"
 severity = "deny"
 
@@ -5476,13 +5502,40 @@ wiring = [".claude/settings.json"]
 # remaining shell registration to move behind the door in the same change — and a
 # guard cannot go behind the door without changing how it denies, which
 # `shell-retirement` refuses for a governed file that is edited rather than
-# retired. Two of this repository's guards cannot be retired yet (`run-shape-guard`
-# on CLOUD-856, `hooks-wiring-check` on the `$HOME` surface), so declaring the flag
-# would force exactly the edits the ratchet exists to refuse.
+# retired. `run-shape-guard` cannot be retired yet (CLOUD-856), so declaring the
+# flag would force exactly the edit the ratchet exists to refuse.
+#
+# WHAT ACTUALLY HOLDS THE FLAG SHUT IS A COUNT, NOT A CAPABILITY, and the second
+# name in this sentence used to be wrong. It read "`hooks-wiring-check` on the
+# `$HOME` surface", which was true until CLOUD-1167 landed `input.tree.external`
+# — a declared path beneath a named root variable, which `policy/harness-wiring.rego`
+# already reads as `harness-settings`. The `$HOME` surface is answered.
+#
+# The live obstacle is that `exclusive` refuses EVERY non-batten registration.
+# Four were live when this note was written, measured 2026-09-01 (`doctor hooks
+# -J`: `siblings: 2`, `merged_siblings: 2` for claude-code). **THIS COMMIT
+# CLEARS ONE OF THEM** — the `session-*` handler rows below retire
+# `.claude/hooks/session-start.sh`, so the committed surface now carries one
+# sibling rather than two. Three remain:
+#
+#   mise-tasks/run-shape-guard.sh      committed   CLOUD-856
+#   session-start-git-identity.sh      $HOME       CLOUD-1079
+#   stop-hook-git-check.sh             $HOME       CLOUD-1079
+#
+# The last two are launcher-provisioned and rewritten at every session start, so
+# no commit here can clear them; CLOUD-1079's remedy is the environment
+# configuration that generates them. Evidence on CLOUD-1160.
+#
+# So the flag is now ONE committed retirement away, and that one is CLOUD-856's:
+# `run-shape-guard` cannot move until its last family has a mediated-call
+# surface. The `$HOME` pair does not block the COMMITTED surface — `doctor`
+# reports `siblings` and `merged_siblings` separately — so a per-surface
+# `exclusive` would already be declarable, which is the shape CLOUD-1160 should
+# consider rather than waiting for a global zero.
 #
 # The capability is therefore shipped and unused, which is the honest state: a
 # consumer with no unretired registrations can declare it today, and this one
-# declares it when its last guard retires rather than by editing bash to qualify.
+# declares it when that count reaches zero rather than by editing bash to qualify.
 #
 # THE FIRST HANDLER, AND IT IS A WORKED EXAMPLE (CLOUD-898). `[[hook.action]]`
 # shipped with one because a plugin surface nobody uses is a surface nobody has
@@ -5645,6 +5698,208 @@ timeout_ms = 2000
 owner = "CLOUD-312"
 expires = "2027-02-28"
 
+# ---------------------------------------------------------------------------
+# CLOUD-312 ROW 10: `.claude/hooks/session-start.sh` RETIRES, AND ITS ORDER
+# BECOMES THIS LIST.
+#
+# The last by-path registration in `.claude/settings.json` is gone with it, so
+# every event on every harness now names `batten hook` by bare name and nothing
+# else. `doctor hooks` reports `siblings` for `claude-code` falling from 2 to 1;
+# the remainder is `run-shape-guard`, whose own retirement is CLOUD-856's.
+#
+# WHAT MOVED, AND WHERE. The script did three separable things, and only one of
+# them was its own:
+#
+#   ordering   -> the DECLARATION ORDER of the ten rows below. `dispatch` runs
+#                 handlers for an event in the order the config lists them, which
+#                 `Dispatched::refusal`'s doc states is why order is the running
+#                 order: a reader predicts it from the file rather than from a
+#                 rule. The `install < doctor < preflight` ordering the retired
+#                 suite asserted by grepping a call log is now readable directly.
+#   the bound  -> `timeout_ms`, imposed by the PARENT. The script had none at
+#                 all, on any step, and a hung `mise install` wedged the session.
+#   the report -> `mise.toml`'s `session:*` tasks, which are the `step` helper's
+#                 log-and-tail contract kept verbatim. That half stayed in a task
+#                 because the door does not provide it: stdout on a passing exit
+#                 is ADVISORY TEXT, so a step that prints on success would put a
+#                 line in every session saying nothing went wrong — the
+#                 announcement CLOUD-891 removed from this hook.
+#
+# THE BOOTSTRAP OBJECTION IS ANSWERED RATHER THAN ARGUED. A handler is dispatched
+# BY the binary, so this shape is only sound if something installs `batten`
+# before the first hook fires. #714 pulled this move because nothing did.
+# CLOUD-1085 closed that: `deps-install` runs from the environment's own
+# provisioning script, before Claude launches, and puts the RELEASED binary on
+# PATH. Verified warm on 2026-09-01 — `/root/.local/bin/batten`, v0.0.137,
+# `verified=sha256`, resolving by bare name. `session:batten` below then replaces
+# it with this checkout's build, because consumer #1 judges the engine it ships.
+#
+# THE RESIDUAL EXPOSURE, STATED BECAUSE IT IS REAL AND NOT MINE TO CLOSE. If
+# `deps-install` does not run, no binary dispatches these rows and nothing
+# provisions — where the old script, registered by path, would still have run.
+# Three things stand against it: the environment's setup script independently
+# runs `mise install` and `mise reshim`, so the toolchain survives; every
+# `session:*` task stays reachable by hand, so a degraded container has a manual
+# repair; and `contract::unmediated_session` (#798) reports a session whose
+# SessionStart never reached the engine instead of failing open in silence.
+#
+# EVERY BOUND BELOW IS COLD-SIZED, WHICH IS THE OPPOSITE STANDARD FROM
+# `mcp-attach-check`'s AND DELIBERATELY SO. That row's 2000ms is two orders above
+# a measured warm path, because a handler that reads two `jq` documents has no
+# cold case. These rows ARE the cold case: this whole surface exists because a
+# cold `mise install` took 24s inside the MCP client's startup window, and
+# CLOUD-1085 measured a cold `install:local` at 141s. A bound tighter than the
+# cold path turns a fail-open handler into the absence the hook was built to
+# close, so each is sized against the slowest honest run of that step and not
+# against the warm one this container measures.
+
+[[hook.handler]]
+id = "session-stamp"
+on = "session-start"
+run = ["mise", "run", "session:stamp"]
+# Two `git rev-parse` calls and a truncation. Nothing here can be slow, and a
+# bound this tight is the statement: a stamp that needs ten seconds is broken.
+timeout_ms = 10000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-install"
+on = "session-start"
+run = ["mise", "run", "session:install"]
+# Ten minutes. The measured cold figure for ONE tool was 24s (`pipx:serena-agent`,
+# CLOUD-196); this installs the whole `[tools]` table on a container with no
+# cache, and it is the step every other one depends on.
+timeout_ms = 600000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-submodules"
+on = "session-start"
+run = ["mise", "run", "session:submodules"]
+# A shallow network clone of `tests/bats`. Two minutes is generous for one small
+# repository and short enough that a hung transport does not hold the session.
+timeout_ms = 120000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-doctor"
+on = "session-start"
+run = ["mise", "run", "session:doctor"]
+# Fifteen minutes, the longest bound here and the one with the least measurement
+# behind it: doctor's rustup half installs cross targets over the network, and
+# the failure this step exists to prevent (CLOUD-218's `detected conflict`) is
+# itself a symptom of that install being slow enough to race something else.
+timeout_ms = 900000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-batten"
+on = "session-start"
+run = ["mise", "run", "session:batten"]
+# Ten minutes against a MEASURED 141s cold release build (CLOUD-1085's table,
+# `/tmp/session-start-batten-build.log`). Four times the measurement, because
+# the measurement was taken on a warm dependency cache and a cold one compiles
+# the whole graph.
+timeout_ms = 600000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-git-hooks"
+on = "session-start"
+run = ["mise", "run", "session:git-hooks"]
+# Two symlinks. Same reasoning as `session-stamp`.
+timeout_ms = 10000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-attribution-identity"
+on = "session-start"
+run = ["mise", "run", "session:identity"]
+# AFTER `session-batten`, because this is the ENGINE answering: the policy is
+# `[attribution]` in this file and `batten attribution identity` is what reads
+# it. The task spells `cargo run`, so a cold container pays a debug build here
+# that the release build above does not cover — which is what the ten minutes is
+# for, not the identity write itself.
+#
+# It belongs in the provisioning window at all because the vendor identity is
+# injected at the environment level: a fresh clone carries it before any work
+# starts, and the first thing that would notice is `commit-attribution` refusing
+# a branch whose commits are all already written.
+timeout_ms = 600000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-signing-posture"
+on = "session-start"
+run = ["mise", "run", "session:signing"]
+# The signature half of the same defect (CLOUD-669). CLOUD-591 decided the
+# interim posture is not to sign and shipped no mechanism, so it was never once
+# in force: the launcher writes `commit.gpgsign true` --global every session, and
+# local beats global only if something writes local. `Attribution` has no
+# signature field, so `identity_deny` structurally cannot see it.
+#
+# Before any commit is written, for the reason above it: a repair that lands
+# after the fact leaves signed commits only a rebase can unwind.
+timeout_ms = 600000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-container-preflight"
+on = "session-start"
+run = ["mise", "run", "container-preflight"]
+# LAST OF THE STEPS THAT CAN HALT, and that position is the whole point
+# (CLOUD-261). "The toolchain installed" and "this container can do the work" are
+# different questions, and the second used to be answered three tasks in, by a
+# failure wearing someone else's name.
+#
+# THE `--degraded` ARM IS GONE AND THAT IS A FIDELITY LOSS, recorded here rather
+# than glossed. The script tracked a `fail` variable across its steps and passed
+# `--degraded` when an earlier one had failed, telling the preflight not to trust
+# toolchain-dependent probes. Handlers do not share state — each is its own
+# process with its own outcome — so this now always runs the full probe set. The
+# consequence is a preflight that may report a toolchain-dependent probe failing
+# on a container whose install already failed: a second symptom of one cause
+# rather than a wrong answer, and both refusals are in the same reply. Recovering
+# the arm needs a fact the door does not carry today.
+timeout_ms = 120000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-census"
+on = "session-start"
+run = ["mise", "run", "session:census"]
+# LAST, AND ONE OF THE TWO ROWS THAT MAY SPEAK ON THE NORMAL PATH. Its report is
+# something this hook has to say to a reader with an action to take — what was
+# running when the container we replaced went down (CLOUD-451) — so its stdout is
+# deliberately left to become advisory text.
+#
+# THE OTHER IS `session-container-preflight`, and the count was wrong here until
+# it was measured: dispatching these rows for real on 2026-09-01 returned
+# `signing-posture: …` and `container-preflight: egress fenced, …` in the
+# advisory, where this comment claimed one line. Both were the retired script's
+# behaviour too — it ran `container-preflight` and the census directly and
+# `step`-wrapped everything else — so the preflight's line stays and the signing
+# row was repointed at a wrapped task to restore the silence it had. The lesson is
+# the one this file keeps re-learning: a claim about what a row PRINTS is a
+# measurement, and every other row above is silent by construction only because a
+# task makes it so.
+#
+# It is also the only row that cannot fail the session: the task swallows both
+# its exits, because a verdict about a PAST container is not a provisioning
+# failure.
+timeout_ms = 30000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
 # ---------------------------------------------------------------------------
 # THE REFUSAL VOCABULARY (CLOUD-1050).
 #
diff --git a/bench/suites/RESULTS.md b/bench/suites/RESULTS.md
index 81cf164df..e6c196998 100644
--- a/bench/suites/RESULTS.md
+++ b/bench/suites/RESULTS.md
@@ -6,136 +6,135 @@ runner measured it; the suite runs `--no-parallelize-within-files`, so a
 file's number is its own serial cost and is what an author adding a case
 to it pays.
 
-- suites: 130
-- serial total: 660.5s
+- suites: 127
+- serial total: 689.2s
 
 | seconds | share | suite |
 | ---: | ---: | --- |
-| 147.0 | 22.3% | `tests/land-lock.bats` |
-| 82.9 | 12.6% | `tests/land.bats` |
-| 48.1 | 7.3% | `tests/hooks-wiring-check.bats` |
-| 34.7 | 5.3% | `tests/main-watch.bats` |
-| 27.1 | 4.1% | `tests/sbom-check.bats` |
-| 24.4 | 3.7% | `tests/hook-latency-drift.bats` |
-| 21.5 | 3.3% | `tests/graph-check.bats` |
-| 17.0 | 2.6% | `tests/config-lint.bats` |
-| 14.8 | 2.2% | `tests/board-diff-overlap.bats` |
-| 11.4 | 1.7% | `tests/run-shape-guard.bats` |
-| 9.8 | 1.5% | `tests/sbom.bats` |
-| 8.9 | 1.3% | `tests/target-race.bats` |
-| 8.0 | 1.2% | `tests/token-bench.bats` |
-| 7.8 | 1.2% | `tests/ready-lint.bats` |
-| 7.6 | 1.2% | `tests/board-sweep.bats` |
-| 7.4 | 1.1% | `tests/ready-guard.bats` |
-| 6.8 | 1.0% | `tests/session-start.bats` |
-| 6.6 | 1.0% | `tests/released.bats` |
-| 6.5 | 1.0% | `tests/replay.bats` |
-| 5.4 | 0.8% | `tests/lock-complete.bats` |
-| 5.3 | 0.8% | `tests/in-progress-drain.bats` |
-| 5.2 | 0.8% | `tests/release-tracking-check.bats` |
-| 5.0 | 0.8% | `tests/lint-deno.bats` |
-| 5.0 | 0.8% | `tests/singleton.bats` |
-| 4.9 | 0.7% | `tests/release-assets-check.bats` |
-| 4.9 | 0.7% | `tests/mcp-allow-check.bats` |
-| 4.7 | 0.7% | `tests/step-receipt.bats` |
-| 4.3 | 0.7% | `tests/ready-cites-check.bats` |
-| 3.9 | 0.6% | `tests/land-divergence.bats` |
-| 3.9 | 0.6% | `tests/task-registry.bats` |
-| 3.8 | 0.6% | `tests/hk-selection.bats` |
-| 3.7 | 0.6% | `tests/doctor-race.bats` |
-| 3.5 | 0.5% | `tests/with-lock.bats` |
-| 3.3 | 0.5% | `tests/ntia-check.bats` |
-| 3.2 | 0.5% | `tests/target-ensure.bats` |
-| 2.9 | 0.4% | `tests/finding-sink-check.bats` |
-| 2.9 | 0.4% | `tests/closing-key-check.bats` |
+| 154.0 | 22.4% | `tests/land-lock.bats` |
+| 94.9 | 13.8% | `tests/land.bats` |
+| 52.4 | 7.6% | `tests/hooks-wiring-check.bats` |
+| 34.6 | 5.0% | `tests/main-watch.bats` |
+| 24.4 | 3.5% | `tests/graph-check.bats` |
+| 24.4 | 3.5% | `tests/hook-latency-drift.bats` |
+| 22.8 | 3.3% | `tests/sbom-check.bats` |
+| 20.6 | 3.0% | `tests/config-lint.bats` |
+| 15.8 | 2.3% | `tests/board-diff-overlap.bats` |
+| 14.9 | 2.2% | `tests/run-shape-guard.bats` |
+| 10.1 | 1.5% | `tests/token-bench.bats` |
+| 9.8 | 1.4% | `tests/ready-lint.bats` |
+| 9.1 | 1.3% | `tests/ready-guard.bats` |
+| 8.2 | 1.2% | `tests/released.bats` |
+| 7.8 | 1.1% | `tests/board-sweep.bats` |
+| 7.6 | 1.1% | `tests/target-race.bats` |
+| 7.0 | 1.0% | `tests/lock-complete.bats` |
+| 6.8 | 1.0% | `tests/replay.bats` |
+| 6.4 | 0.9% | `tests/step-receipt.bats` |
+| 6.3 | 0.9% | `tests/release-tracking-check.bats` |
+| 6.3 | 0.9% | `tests/sbom.bats` |
+| 6.2 | 0.9% | `tests/release-assets-check.bats` |
+| 5.9 | 0.9% | `tests/in-progress-drain.bats` |
+| 5.9 | 0.9% | `tests/mcp-allow-check.bats` |
+| 4.8 | 0.7% | `tests/ready-cites-check.bats` |
+| 4.6 | 0.7% | `tests/ntia-check.bats` |
+| 4.5 | 0.7% | `tests/singleton.bats` |
+| 4.3 | 0.6% | `tests/land-divergence.bats` |
+| 4.2 | 0.6% | `tests/task-registry.bats` |
+| 4.0 | 0.6% | `tests/hk-selection.bats` |
+| 3.8 | 0.5% | `tests/doctor-race.bats` |
+| 2.9 | 0.4% | `tests/target-ensure.bats` |
+| 2.8 | 0.4% | `tests/landed-check.bats` |
+| 2.8 | 0.4% | `tests/with-lock.bats` |
 | 2.7 | 0.4% | `tests/claim-race-check.bats` |
-| 2.7 | 0.4% | `tests/lint-rego.bats` |
-| 2.5 | 0.4% | `tests/landed-check.bats` |
-| 2.2 | 0.3% | `tests/spawn-census.bats` |
-| 2.1 | 0.3% | `tests/install.bats` |
-| 2.1 | 0.3% | `tests/ci-slow-needed.bats` |
-| 2.0 | 0.3% | `tests/suite-select.bats` |
-| 2.0 | 0.3% | `tests/bot-issue.bats` |
+| 2.6 | 0.4% | `tests/spec-ref-check.bats` |
+| 2.6 | 0.4% | `tests/closing-key-check.bats` |
+| 2.6 | 0.4% | `tests/suite-select.bats` |
+| 2.5 | 0.4% | `tests/finding-sink-check.bats` |
+| 2.4 | 0.4% | `tests/perf-record.bats` |
+| 2.4 | 0.3% | `tests/install.bats` |
+| 2.3 | 0.3% | `tests/unlanded-check.bats` |
+| 2.0 | 0.3% | `tests/tree-clean.bats` |
+| 2.0 | 0.3% | `tests/ci-slow-needed.bats` |
 | 2.0 | 0.3% | `tests/claimed-keys.bats` |
-| 1.8 | 0.3% | `tests/spec-ref-check.bats` |
-| 1.8 | 0.3% | `tests/alive.bats` |
-| 1.8 | 0.3% | `tests/ci-tools-check.bats` |
-| 1.7 | 0.3% | `tests/unlanded-check.bats` |
+| 2.0 | 0.3% | `tests/bot-issue.bats` |
+| 1.9 | 0.3% | `tests/signing-posture.bats` |
+| 1.9 | 0.3% | `tests/ci-tools-check.bats` |
+| 1.8 | 0.3% | `tests/ready-lint-deferral.bats` |
 | 1.7 | 0.3% | `tests/reclaim-census.bats` |
-| 1.7 | 0.3% | `tests/evaluator-closure-check.bats` |
-| 1.6 | 0.2% | `tests/signing-posture.bats` |
-| 1.5 | 0.2% | `tests/install-check.bats` |
-| 1.5 | 0.2% | `tests/deferral-check.bats` |
-| 1.5 | 0.2% | `tests/ready-lint-deferral.bats` |
-| 1.4 | 0.2% | `tests/ci-lease-precondition.bats` |
-| 1.4 | 0.2% | `tests/tree-clean.bats` |
-| 1.3 | 0.2% | `tests/done-check.bats` |
-| 1.3 | 0.2% | `tests/verify.bats` |
+| 1.7 | 0.2% | `tests/alive.bats` |
+| 1.5 | 0.2% | `tests/verify.bats` |
+| 1.5 | 0.2% | `tests/ci-lease-precondition.bats` |
+| 1.4 | 0.2% | `tests/done-check.bats` |
+| 1.4 | 0.2% | `tests/spawn-census.bats` |
+| 1.4 | 0.2% | `tests/deferral-check.bats` |
+| 1.3 | 0.2% | `tests/install-check.bats` |
 | 1.3 | 0.2% | `tests/awk-regex-check.bats` |
-| 1.2 | 0.2% | `tests/fact-record-keying.bats` |
-| 1.2 | 0.2% | `tests/perf-record.bats` |
+| 1.3 | 0.2% | `tests/linear-check.bats` |
+| 1.3 | 0.2% | `tests/nonverdict-scan.bats` |
+| 1.2 | 0.2% | `tests/land-divergence-assert.bats` |
+| 1.2 | 0.2% | `tests/perf-assert.bats` |
 | 1.1 | 0.2% | `tests/done-pr-check.bats` |
-| 1.1 | 0.2% | `tests/land-divergence-assert.bats` |
-| 1.1 | 0.2% | `tests/linear-check.bats` |
+| 1.1 | 0.2% | `tests/fact-record-keying.bats` |
+| 1.1 | 0.2% | `tests/release-backfill.bats` |
+| 1.1 | 0.2% | `tests/module-map-check.bats` |
+| 1.1 | 0.2% | `tests/duplicate-close-check.bats` |
+| 1.0 | 0.1% | `tests/doctor.bats` |
+| 1.0 | 0.1% | `tests/timeout-drift.bats` |
+| 1.0 | 0.1% | `tests/render-cli.bats` |
+| 1.0 | 0.1% | `tests/pr-unsubscribed.bats` |
 | 1.0 | 0.1% | `tests/attestation-check.bats` |
-| 1.0 | 0.1% | `tests/duplicate-close-check.bats` |
-| 0.9 | 0.1% | `tests/nonverdict-scan.bats` |
-| 0.9 | 0.1% | `tests/doctor.bats` |
-| 0.9 | 0.1% | `tests/module-map-check.bats` |
-| 0.9 | 0.1% | `tests/perf-assert.bats` |
-| 0.9 | 0.1% | `tests/release-backfill.bats` |
-| 0.8 | 0.1% | `tests/render-cli.bats` |
-| 0.8 | 0.1% | `tests/pr-unsubscribed.bats` |
-| 0.8 | 0.1% | `tests/hook-matcher-check.bats` |
-| 0.7 | 0.1% | `tests/commit-attribution.bats` |
-| 0.7 | 0.1% | `tests/timeout-drift.bats` |
+| 0.9 | 0.1% | `tests/evaluator-closure-check.bats` |
+| 0.9 | 0.1% | `tests/hook-matcher-check.bats` |
+| 0.9 | 0.1% | `tests/lint-rego.bats` |
+| 0.8 | 0.1% | `tests/sbom-binary.bats` |
+| 0.8 | 0.1% | `tests/lint-deno.bats` |
+| 0.8 | 0.1% | `tests/perf-compare.bats` |
+| 0.8 | 0.1% | `tests/verified.bats` |
+| 0.8 | 0.1% | `tests/suite-bench-check.bats` |
+| 0.7 | 0.1% | `tests/mcp-timeout-budget.bats` |
+| 0.7 | 0.1% | `tests/merged-pr-keys.bats` |
+| 0.7 | 0.1% | `tests/mcp-attach-check.bats` |
 | 0.7 | 0.1% | `tests/macos-link-check.bats` |
-| 0.6 | 0.1% | `tests/perf-compare.bats` |
-| 0.6 | 0.1% | `tests/merged-pr-keys.bats` |
+| 0.7 | 0.1% | `tests/stop-posture-check.bats` |
+| 0.7 | 0.1% | `tests/publish-credential-check.bats` |
 | 0.6 | 0.1% | `tests/checksums.bats` |
-| 0.6 | 0.1% | `tests/mcp-timeout-budget.bats` |
-| 0.6 | 0.1% | `tests/sbom-binary.bats` |
-| 0.6 | 0.1% | `tests/connector-allow-guard.bats` |
-| 0.6 | 0.1% | `tests/suite-bench-check.bats` |
-| 0.6 | 0.1% | `tests/stop-posture-check.bats` |
-| 0.6 | 0.1% | `tests/mcp-attach-check.bats` |
-| 0.6 | 0.1% | `tests/digest-major-agreement.bats` |
-| 0.6 | 0.1% | `tests/verified.bats` |
+| 0.6 | 0.1% | `tests/pipefail-grep-check.bats` |
+| 0.6 | 0.1% | `tests/commit-attribution.bats` |
+| 0.6 | 0.1% | `tests/hook-pin-check.bats` |
+| 0.6 | 0.1% | `tests/land-lock-check.bats` |
+| 0.5 | 0.1% | `tests/digest-major-agreement.bats` |
 | 0.5 | 0.1% | `tests/board-payloads.bats` |
+| 0.5 | 0.1% | `tests/connector-allow-guard.bats` |
+| 0.5 | 0.1% | `tests/run-shape-guard-quoting.bats` |
+| 0.5 | 0.1% | `tests/sonar-gate.bats` |
+| 0.5 | 0.1% | `tests/abandon-matrix.bats` |
 | 0.5 | 0.1% | `tests/branch-age-check.bats` |
-| 0.5 | 0.1% | `tests/commit-convention.bats` |
-| 0.5 | 0.1% | `tests/hook-pin-check.bats` |
-| 0.5 | 0.1% | `tests/land-lock-check.bats` |
-| 0.5 | 0.1% | `tests/publish-credential-check.bats` |
-| 0.4 | 0.1% | `tests/container-preflight.bats` |
-| 0.4 | 0.1% | `tests/pipefail-grep-check.bats` |
-| 0.4 | 0.1% | `tests/abandon-matrix.bats` |
-| 0.4 | 0.1% | `tests/sonar-gate.bats` |
-| 0.4 | 0.1% | `tests/msrv-pin-agreement.bats` |
-| 0.4 | 0.1% | `tests/connector-allow-resolve.bats` |
-| 0.4 | 0.1% | `tests/license-table-check.bats` |
-| 0.4 | 0.1% | `tests/timeout-check.bats` |
-| 0.4 | 0.1% | `tests/cap-drift.bats` |
+| 0.5 | 0.1% | `tests/msrv-pin-agreement.bats` |
+| 0.5 | 0.1% | `tests/timeout-check.bats` |
+| 0.5 | 0.1% | `tests/transcript-corpus-check.bats` |
+| 0.5 | 0.1% | `tests/license-table-check.bats` |
+| 0.4 | 0.1% | `tests/serena-mcp.bats` |
+| 0.4 | 0.1% | `tests/report-only-check.bats` |
+| 0.4 | 0.1% | `tests/no-doctests.bats` |
+| 0.4 | 0.1% | `tests/commit-convention.bats` |
 | 0.4 | 0.1% | `tests/release-due.bats` |
-| 0.4 | 0.1% | `tests/run-shape-guard-quoting.bats` |
-| 0.4 | 0.1% | `tests/transcript-corpus-check.bats` |
-| 0.4 | 0.1% | `tests/coderabbit-config-check.bats` |
-| 0.4 | 0.1% | `tests/batten-glob-check.bats` |
-| 0.3 | 0.1% | `tests/no-doctests.bats` |
-| 0.3 | 0.1% | `tests/serena-mcp.bats` |
-| 0.3 | 0.0% | `tests/nonverdict-assert.bats` |
-| 0.3 | 0.0% | `tests/report-only-check.bats` |
+| 0.4 | 0.1% | `tests/nonverdict-assert.bats` |
+| 0.3 | 0.1% | `tests/connector-allow-resolve.bats` |
+| 0.3 | 0.1% | `tests/batten-glob-check.bats` |
+| 0.3 | 0.0% | `tests/cap-drift.bats` |
+| 0.3 | 0.0% | `tests/container-preflight.bats` |
 | 0.3 | 0.0% | `tests/ci-drift.bats` |
+| 0.3 | 0.0% | `tests/coderabbit-config-check.bats` |
+| 0.3 | 0.0% | `tests/rust-paths-check.bats` |
 | 0.3 | 0.0% | `tests/git-hook.bats` |
-| 0.2 | 0.0% | `tests/rust-paths-check.bats` |
-| 0.2 | 0.0% | `tests/mise-action-floor.bats` |
-| 0.2 | 0.0% | `tests/dist.bats` |
 | 0.2 | 0.0% | `tests/token-bench-check.bats` |
-| 0.2 | 0.0% | `tests/remedy-payload-source.bats` |
+| 0.2 | 0.0% | `tests/mise-action-floor.bats` |
 | 0.2 | 0.0% | `tests/perf-gate.bats` |
-| 0.1 | 0.0% | `tests/task-fail-closed.bats` |
-| 0.1 | 0.0% | `tests/egress-check.bats` |
-| 0.1 | 0.0% | `tests/evaluator-io-check.bats` |
+| 0.2 | 0.0% | `tests/remedy-payload-source.bats` |
+| 0.2 | 0.0% | `tests/evaluator-io-check.bats` |
+| 0.2 | 0.0% | `tests/dist.bats` |
+| 0.2 | 0.0% | `tests/task-fail-closed.bats` |
+| 0.2 | 0.0% | `tests/egress-check.bats` |
 | 0.1 | 0.0% | `tests/darwin-link.bats` |
 | 0.1 | 0.0% | `tests/cross-check.bats` |
 | 0.0 | 0.0% | `tests/zizmor-split.bats` |
diff --git a/crates/batten/tests/it/main.rs b/crates/batten/tests/it/main.rs
index 2f17af496..4028a7773 100644
--- a/crates/batten/tests/it/main.rs
+++ b/crates/batten/tests/it/main.rs
@@ -160,6 +160,7 @@ mod runner_verdict;
 mod scanner_taxonomy;
 mod secrets_kind;
 mod semver_gate;
+mod session_provisioning;
 mod shell_retirement;
 mod shell_write_advisory;
 mod sinks;
diff --git a/crates/batten/tests/it/session_provisioning.rs b/crates/batten/tests/it/session_provisioning.rs
new file mode 100644
index 000000000..2e443bd90
--- /dev/null
+++ b/crates/batten/tests/it/session_provisioning.rs
@@ -0,0 +1,580 @@
+//! Session-start provisioning, driven THROUGH the door, over the compiled binary
+//! (CLOUD-312 row 10).
+//!
+//! # What retired, and what this is the second tier of
+//!
+//! `.claude/hooks/session-start.sh` was 295 lines of bash registered by path on
+//! `SessionStart` — the last by-path registration on any surface this repository
+//! owns. It did three separable things, and only one of them was its own:
+//!
+//! * it ORDERED a list of provisioning steps,
+//! * it BOUNDED none of them,
+//! * it wrapped each in a `step` helper that logged to a file and tailed five
+//!   lines to stderr on failure.
+//!
+//! The first two are now `batten.toml`'s: ten `[[hook.handler]] on =
+//! "session-start"` rows, whose declaration order IS the running order and whose
+//! `timeout_ms` is imposed by the parent. The third stayed, as `mise.toml`'s
+//! `session:*` tasks, because the door does not provide it.
+//!
+//! # Why the retired suite could not be this tier
+//!
+//! `tests/session-start.bats` ran the script directly and read what it printed.
+//! That is the bash equivalent of a Rego module's `with input as`, and
+//! `.claude/rules/policy-modules.md` names its failure exactly: it fabricates
+//! the shape the ENGINE may be unable to consume. Its ordering case is the
+//! sharpest instance — it stubbed `mise`, ran the hook, and grepped a call log
+//! for line numbers. That observes bash, not dispatch. Here the same property is
+//! read off `Dispatched`, which is the thing that will actually run it.
+//!
+//! # The stubs are the design, not a shortcut
+//!
+//! Every case below runs against a fixture repository whose handlers are stub
+//! programs with a chosen exit status and stdout. Driving the REAL rows would
+//! run `mise install`, `mise run doctor` and a release build — 141 seconds
+//! measured cold (CLOUD-1085) — inside `test:cargo`, which is the cost
+//! CLOUD-1268 exists to stop moving from one lane to another. It would also stop
+//! discriminating: a case that provisions a container tests the container.
+//!
+//! The one case that reads the committed `batten.toml` reads it as a DOCUMENT,
+//! asserting what is declared rather than running it. That split is deliberate —
+//! the engine's behaviour is proved against stubs, and the declaration is proved
+//! against the file that ships.
+//!
+//! # RETIREMENT LEDGER, PER PATH — what `shell-retirement` reads
+//!
+//! `.claude/hooks/session-start.sh` is not in `governed_when_deleted` (that set
+//! is `mise-tasks/` paths and `.bats` suites), so it owes no arm. The suite does.
+//!
+//! The policy surface is `crates/batten/src/handler.rs`: the properties the
+//! retired suite pinned about the SCRIPT — that it is synchronous, that it fails
+//! loudly, that it does not tell the host to start early — are now properties of
+//! the door, held for every dispatched program rather than re-derived in each.
+//! `kind:mechanism` and not `kind:verb`: no command surface widened, and the
+//! module is read by `batten hook`, which already existed.
+//!
+// carried: tests/session-start.bats crates/batten/src/handler.rs kind:mechanism crates/batten/tests/it/session_provisioning.rs
+//!
+//! # RETIREMENT LEDGER — `tests/session-start.bats`, 10 cases
+//!
+//! CARRIED — the property survives, proved here against the engine or against
+//! the committed declaration.
+//!
+// carried: "doctor runs inside the synchronous window — after install, before the preflight" crates/batten/tests/it/session_provisioning.rs
+// carried: "mise install runs — the step whose absence was the defect" crates/batten/tests/it/session_provisioning.rs
+// carried: "the install is lockfile-free — provisioning must not dirty the tracked lock" crates/batten/tests/it/session_provisioning.rs
+// carried: "a failed step exits non-zero — absence must never be silent" crates/batten/tests/it/session_provisioning.rs
+// carried: "the hook is registered as a SessionStart hook" crates/batten/tests/it/session_provisioning.rs
+//!
+//! SUBSUMED — the property became the door's, held for every handler rather than
+//! for this one program. Each names where it now lives.
+//!
+// subsumed: "the hook is executable" crates/batten/src/handler.rs kind:mechanism
+// subsumed: "the hook is synchronous — async would restore the race it closes" crates/batten/src/handler.rs kind:mechanism
+//!
+//! CHANGED — the property is narrower than it was, and each of these is a real
+//! fidelity loss rather than a relabelling. Stated at the granularity CLOUD-908
+//! demands: what the case asserted, and what now holds instead.
+//!
+//! * `"the hook runs green on this checkout"` ran the WHOLE provisioning
+//!   end to end and asserted exit 0 with empty stdout. The exit-0-and-silent half
+//!   is carried below against stubs; the end-to-end half is gone, because
+//!   dispatching the real rows means provisioning a container inside the test
+//!   suite. What covers it instead is the session itself: a failed step now
+//!   reports on the advisory channel at the moment it fails.
+//! * `"running the hook leaves the tracked lockfile untouched"` was the
+//!   end-to-end half of the CLOUD-223 residue check. `[settings] lockfile = false`
+//!   in `mise.toml` is the authority and `mise run lock-complete` is the standing
+//!   gate; what is lost is the observation that THIS provisioning path honours it,
+//!   and `session:install` carrying `MISE_LOCKFILE=false` is asserted below as the
+//!   declaration rather than as the effect.
+//! * `"the git hooks are installed — the per-clone step that was absent"` ran the
+//!   hook and then stat-ed two symlinks. `doctor` decides that same state on every
+//!   later run — which the retired case's own comment already named as its
+//!   backstop — and `tests/git-hook.bats` owns what the installed body does. What
+//!   is lost is the end-to-end pairing of the step with its effect in one case.
+//!
+// changed: "the hook runs green on this checkout" crates/batten/tests/it/session_provisioning.rs the exit-0-and-silent half survives as `a_step_that_passes_says_nothing`, against stubs; the END-TO-END half is withdrawn, because dispatching the real rows provisions a container inside `test:cargo` — 141s measured cold — which is the cost CLOUD-1268 exists to stop moving between lanes. What covers it instead is the session itself: a failed step reports on the advisory channel at the moment it fails
+// changed: "running the hook leaves the tracked lockfile untouched" crates/batten/tests/it/session_provisioning.rs narrowed from the EFFECT to the DECLARATION: `the_install_step_is_declared_lockfile_free` asserts `session:install` carries MISE_LOCKFILE=false, where the retired case ran the hook and diffed `git status -- mise.lock`. `[settings] lockfile = false` in mise.toml is the standing authority and `lock-complete` the standing gate; what is lost is the observation that this particular path honours it
+// changed: "the session-start hook calls it — the whole point is WHEN it runs" crates/batten/tests/it/session_provisioning.rs from `tests/container-preflight.bats`, whose own subject survives. The case grepped the retired script for `container-preflight`; the property — that a preflight nothing runs at startup is worthless — is now the `session-container-preflight` row, and its POSITION is asserted too, which the grep could not say
+// changed: "the hook passes --degraded when provisioning failed" batten.toml the capability is gone rather than moved, and this is the one real loss in this retirement. `--degraded` told the preflight not to trust toolchain-dependent probes when an earlier step had failed, and it worked because the script carried a `fail` variable across its steps. Handlers share no state — each is its own process with its own outcome — so nothing can compute the flag. The consequence is bounded: a container whose install failed now gets the full probe set, so it may report a second symptom of one cause, and both refusals arrive in the same reply. Recovering it needs a fact the door does not carry; filed rather than papered over
+// changed: "the fixer is wired: session-start runs it, so a clone is compliant before it commits" crates/batten/tests/it/session_provisioning.rs from `tests/commit-attribution.bats`, whose own subject (hk.pkl, mise.toml) survives. The case grepped the retired script for its `step attribution-identity` line; the property — that the identity fixer runs before a clone commits — is now the `session-attribution-identity` row, asserted by `the_committed_provisioning_declares_every_step_in_order`. It is CHANGED rather than CARRIED because the retired case pinned the invocation's exact spelling inside a program and this pins a row's presence and position in a list
+// changed: "the git hooks are installed — the per-clone step that was absent" mise-tasks/doctor.sh narrowed from perform-and-assert in one case to assert-only: `doctor` decides that same state on every later run, which the retired case's own comment already named as its backstop, and `tests/git-hook.bats` owns what the installed body does. What is lost is the pairing of the step with its effect inside one case
+//!
+//! # UNIX ONLY, and the gate is load-bearing rather than tidy
+//!
+//! Every dispatch case below runs a `#!/bin/sh` stub as a `[[hook.handler]]` row.
+//! On a Windows runner the spawn ladder cannot start the interpreter the shebang
+//! names, so the door reports a could-not-run and forwards nothing — and the
+//! cases that assert an ABSENCE would then pass for the wrong reason, which is
+//! the vacuous-pass class this file exists to close. `connector_allow_door.rs`
+//! gates its whole suite on the same rung, and the retired `.bats` suite never
+//! ran on Windows either, so nothing is narrowed that was covered.
+
+// Panicking on setup failure is the idiomatic way for a test to fail loudly.
+#![cfg(unix)]
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
+use crate::common;
+
+use std::path::{Path, PathBuf};
+
+use common::{at_root, git_in, scratch, stderr, stdout, write};
+
+/// The committed rows, in declaration order, as this suite expects to find them.
+///
+/// A LIST RATHER THAN A COUNT, because a count cannot tell an added row from a
+/// renamed one, and the ordering claim below needs the names anyway.
+const DECLARED: [&str; 10] = [
+    "session-stamp",
+    "session-install",
+    "session-submodules",
+    "session-doctor",
+    "session-batten",
+    "session-git-hooks",
+    "session-attribution-identity",
+    "session-signing-posture",
+    "session-container-preflight",
+    "session-census",
+];
+
+/// A fixture repository carrying only what a case declares.
+///
+/// NO `[[rule]]` AT ALL, for `connector_allow_door.rs`'s reason: an engine row
+/// producing a verdict of its own could stand in for the handler's, which is
+/// exactly the substitution that hid CLOUD-312 row 5's dropped verdict for the
+/// life of that migration.
+struct Bench {
+    repo: PathBuf,
+}
+
+/// What the door said to the host, and what it said about the handlers.
+struct Door {
+    out: String,
+    err: String,
+    code: Option<i32>,
+}
+
+impl Bench {
+    /// Hand one `SessionStart` envelope to the engine.
+    ///
+    /// The two streams are kept apart deliberately: a handler's advisory reaches
+    /// the host through Batten's own reply, and a contract violation is reported
+    /// on stderr. Merging them is how a dropped verdict reads as a delivered one.
+    fn session_start(&self) -> Door {
+        use std::io::Write as _;
+
+        let payload = serde_json::json!({
+            "hook_event_name": "SessionStart",
+            "session_id": "session-provisioning-fixture",
+            "source": "startup",
+        })
+        .to_string();
+
+        let mut child = common::batten()
+            .current_dir(&self.repo)
+            .args(["hook", "--harness", "claude-code"])
+            .stdin(std::process::Stdio::piped())
+            .stdout(std::process::Stdio::piped())
+            .stderr(std::process::Stdio::piped())
+            .spawn()
+            .expect("the binary runs");
+        child
+            .stdin
+            .take()
+            .expect("stdin is piped")
+            .write_all(payload.as_bytes())
+            .expect("write stdin");
+        let outcome = child.wait_with_output().expect("wait for batten");
+        Door {
+            out: stdout(&outcome),
+            err: stderr(&outcome),
+            code: outcome.status.code(),
+        }
+    }
+
+    /// Write one stub step and declare it as a `session-start` handler body.
+    fn step(&self, id: &str, body: &str) {
+        let path = format!("steps/{id}");
+        write(&self.repo, &path, &format!("#!/bin/sh\n{body}\n"));
+        make_executable(&self.repo.join(&path));
+    }
+}
+
+/// Build a fixture whose `batten.toml` declares `rows`, in order.
+fn bench(name: &str, rows: &[(&str, u64)]) -> Bench {
+    // `fmt::Write` rather than `push_str(&format!(..))`, which the workspace
+    // lints refuse as `format_push_string` — the same aliased import
+    // `admission.rs` uses, for the same reason: the extra `String` is pure
+    // allocation. Writing to a `String` is infallible, so the `Result` carries
+    // nothing to handle. Before the first statement, or `items_after_statements`
+    // refuses it in turn.
+    use std::fmt::Write as _;
+
+    let dir = scratch(name);
+    let repo = dir.join("repo");
+    std::fs::create_dir_all(repo.join("steps")).expect("the fixture repo");
+
+    let mut config = String::from("version = 1\n");
+    for (id, timeout_ms) in rows {
+        let _ = write!(
+            config,
+            "\n[[hook.handler]]\nid = \"{id}\"\non = \"session-start\"\nrun = [\"steps/{id}\"]\ntimeout_ms = {timeout_ms}\nowner = \"CLOUD-312\"\nexpires = \"2027-02-28\"\n"
+        );
+    }
+    write(&repo, "batten.toml", &config);
+    git_in(&repo, &["init", "-q", "-b", "main", "."]);
+
+    Bench { repo }
+}
+
+// No `#[cfg(unix)]` pair here: the module gate above already decides the target,
+// so a `#[cfg(not(unix))]` twin would be a definition nothing can reach.
+fn make_executable(path: &Path) {
+    use std::os::unix::fs::PermissionsExt as _;
+    let mut mode = std::fs::metadata(path)
+        .expect("the stub exists")
+        .permissions();
+    mode.set_mode(0o755);
+    std::fs::set_permissions(path, mode).expect("the stub is runnable");
+}
+
+/// One `[[hook.handler]]` row, reduced to the three fields this suite asks
+/// about.
+struct Row {
+    id: String,
+    on: String,
+    bounded: bool,
+}
+
+/// The committed `[[hook.handler]]` rows, in declaration order, read as TEXT.
+///
+/// **NOT `toml::from_str`, and the reason is measured rather than stylistic.**
+/// The committed `batten.toml` does not round-trip through the `toml` crate this
+/// workspace has in scope — it fails with `unexpected content, expected nothing`
+/// — while the engine reads it every run. Making this suite depend on a second
+/// parser agreeing with the engine's would be a second authority over what the
+/// config says, and it would fail for a reason having nothing to do with the
+/// property under test.
+///
+/// The scan is deliberately shallow and deliberately strict about its own
+/// premise: it takes each `[[hook.handler]]` header and reads the `key = value`
+/// lines up to the next table header. `every_handler_row_is_read` asserts the
+/// scan actually found rows, so a header this repository re-spells cannot turn
+/// every case below vacuous.
+fn handler_rows() -> Vec<Row> {
+    let text = std::fs::read_to_string(at_root("batten.toml"))
+        .expect("the committed authority is readable");
+
+    let mut rows = Vec::new();
+    for block in text.split("\n[[hook.handler]]\n").skip(1) {
+        let body = block.split("\n[").next().unwrap_or(block);
+        let field = |key: &str| -> Option<String> {
+            body.lines()
+                .find_map(|line| line.strip_prefix(&format!("{key} = ")))
+                .map(|value| value.trim().trim_matches('"').to_owned())
+        };
+        rows.push(Row {
+            id: field("id").unwrap_or_default(),
+            on: field("on").unwrap_or_default(),
+            bounded: field("timeout_ms").is_some(),
+        });
+    }
+    rows
+}
+
+/// The `session-start` rows, in declaration order.
+fn session_rows() -> Vec<Row> {
+    handler_rows()
+        .into_iter()
+        .filter(|row| row.on == "session-start")
+        .collect()
+}
+
+// ---------------------------------------------------------------------------
+// The engine's half: what the door does with what the declaration says.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn the_steps_run_in_declaration_order() {
+    // CARRIES `"doctor runs inside the synchronous window — after install, before
+    // the preflight"`, and it is a strictly better instrument than what it
+    // replaces. The retired case stubbed `mise`, ran the script, and grepped the
+    // stub's call log for line numbers — an observation about bash. Order is now
+    // a property of `dispatch`, which iterates the handler table as the config
+    // lists it, so this reads the thing that will actually run in a session.
+    //
+    // Three steps rather than two: with two, a dispatcher that reversed the list
+    // and one that preserved it are distinguishable, but a dispatcher that sorted
+    // by id is not — `first` and `second` happen to sort into the order they are
+    // declared in. The ids below are declared in an order that no sort produces.
+    let bench = bench(
+        "session-order",
+        &[("zulu", 5000), ("alpha", 5000), ("mike", 5000)],
+    );
+    let log = bench.repo.join("order.log");
+    for id in ["zulu", "alpha", "mike"] {
+        bench.step(
+            id,
+            &format!("printf '{id}\\n' >> \"$(dirname \"$0\")/../order.log\""),
+        );
+    }
+
+    let door = bench.session_start();
+    assert_eq!(door.code, Some(0), "session start allows: {}", door.err);
+
+    let ran = std::fs::read_to_string(&log).expect("every step ran");
+    assert_eq!(
+        ran.lines().collect::<Vec<_>>(),
+        ["zulu", "alpha", "mike"],
+        "the declaration order is the running order"
+    );
+}
+
+#[test]
+fn a_failed_step_is_reported_rather_than_silent() {
+    // CARRIES `"a failed step exits non-zero — absence must never be silent"`.
+    //
+    // The retired case asserted this by grepping the script for the string
+    // `exit 1`, which is a claim about its source rather than about what a
+    // session sees. Here a step actually fails and the reason has to arrive.
+    //
+    // `VIOLATION_EXIT` rather than `DENY_EXIT`: a provisioning failure is
+    // "the thing you asked about is wrong", not a refusal of the call. At
+    // `session-start` a deny would be demoted to advice anyway
+    // (`Event::carries_a_verdict`), so exiting 2 would prove nothing this does
+    // not — and it would misstate the step's own meaning in the exit table.
+    let bench = bench("session-loud", &[("failing", 5000)]);
+    bench.step(
+        "failing",
+        "echo '::error:: session-start: failing failed — see /tmp/x.log' >&2\nexit 1",
+    );
+
+    let door = bench.session_start();
+    assert_eq!(
+        door.code,
+        Some(0),
+        "a failed provisioning step never blocks the session"
+    );
+    let said = format!("{}{}", door.out, door.err);
+    assert!(
+        said.contains("session-start: failing failed"),
+        "the step's own reason reaches the session, not just its exit code: {said}"
+    );
+}
+
+#[test]
+fn a_step_that_passes_says_nothing() {
+    // CARRIES the silent half of `"the hook runs green on this checkout"`
+    // (CLOUD-891: silence is the pass). The end-to-end half is `changed:` above.
+    //
+    // Asserted over BOTH streams, because a success line on stderr is the same
+    // defect as one on stdout — the retired hook's `container-preflight` line
+    // was on stdout and the argument against it was about the reader, not the
+    // file descriptor.
+    let bench = bench("session-silent", &[("quiet", 5000)]);
+    bench.step("quiet", "exit 0");
+
+    let door = bench.session_start();
+    assert_eq!(door.code, Some(0));
+    assert!(
+        door.out.is_empty(),
+        "a passing step announces nothing on stdout: {}",
+        door.out
+    );
+    assert!(
+        !door.err.contains("quiet"),
+        "a passing step is not named on stderr either: {}",
+        door.err
+    );
+}
+
+#[test]
+fn a_step_that_hangs_is_killed_at_its_declared_bound() {
+    // SUBSUMES `"the hook is synchronous — async would restore the race it
+    // closes"`, and it is the half that was never testable before.
+    //
+    // The retired case asserted that the script does not print `{"async": true}`.
+    // That was the only spelling of the property available to it, and it is
+    // weaker in both directions: the script could have been synchronous and
+    // hung forever, which is what the absence of any bound made possible.
+    //
+    // Behind the door synchrony is structural — `run_one` waits for the child
+    // before `dispatch` returns and `batten hook` replies — so what is worth
+    // asserting is the thing that makes synchrony affordable: the bound. A step
+    // declaring 300ms and sleeping 30s must not hold the session for 30s.
+    //
+    // THE ASSERTION IS ON THE WALL CLOCK AND THAT IS DELIBERATE, against
+    // `.claude/rules/rust.md`'s standing preference for counters over timing:
+    // the property here IS elapsed time, and a counter cannot express "was
+    // killed early". The margin is two orders wide — 10s against a 30s sleep and
+    // a 300ms bound — so it discriminates a working bound from an absent one
+    // without discriminating a slow runner from a fast one.
+    let bench = bench("session-bound", &[("hanging", 300)]);
+    bench.step("hanging", "sleep 30");
+
+    let started = std::time::Instant::now();
+    let door = bench.session_start();
+    let took = started.elapsed();
+
+    assert_eq!(door.code, Some(0), "a timed-out step allows: {}", door.err);
+    assert!(
+        took < std::time::Duration::from_secs(10),
+        "the declared bound is imposed by the parent, not hoped for: took {took:?}"
+    );
+}
+
+#[test]
+fn a_steps_stdout_is_interpreted_never_forwarded() {
+    // SUBSUMES the other half of the async case, and it is why no handler can
+    // reintroduce the race whatever it writes.
+    //
+    // The retired script was registered directly, so anything it put on stdout
+    // went to the host verbatim — `{"async": true}` included, which is exactly
+    // the window the MCP handshake lost. Behind the door stdout is read into
+    // Batten's own types and re-rendered per harness, so a handler speaks to
+    // BATTEN and never to the host.
+    //
+    // Asserted as "the bytes do not appear verbatim", not as "nothing is said":
+    // the text is legitimately allowed to become advisory content, and a case
+    // demanding silence would be asserting the wrong property and would break
+    // the moment the advisory channel renders it.
+    let bench = bench("session-passthrough", &[("talkative", 5000)]);
+    bench.step("talkative", "printf '{\"async\": true}\\n'");
+
+    let door = bench.session_start();
+    assert_eq!(door.code, Some(0));
+    assert!(
+        !door.out.contains("{\"async\": true}"),
+        "a handler's stdout is never forwarded to the host verbatim: {}",
+        door.out
+    );
+}
+
+// ---------------------------------------------------------------------------
+// The declaration's half: what the committed authority actually says.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn the_committed_provisioning_declares_every_step_in_order() {
+    // CARRIES `"the hook is registered as a SessionStart hook"`. That case read
+    // `.claude/settings.json` and asserted a by-path command was present; the
+    // registration this change removes. The property it was protecting — that
+    // provisioning is actually wired to session start rather than merely written
+    // down — is now the handler roster, so this is where it is asserted.
+    let ids: Vec<String> = session_rows().into_iter().map(|row| row.id).collect();
+
+    assert_eq!(
+        ids, DECLARED,
+        "the provisioning steps are declared, in the order they must run"
+    );
+}
+
+#[test]
+fn every_handler_row_is_read() {
+    // THE ANTI-VACUITY CASE FOR THE SCAN ABOVE, and it is the reason the scan is
+    // allowed to be shallow. `handler_rows` matches a literal table header; if
+    // this repository ever spells one differently — an inline array, a rename —
+    // the scan returns nothing, every `session_rows()` case below passes over an
+    // empty list, and the suite reports green over a declaration it never read.
+    // That is the silent-empty-answer class `.claude/rules/scanning.md` records
+    // for a matcher pointed at an extensionless tree, one file over.
+    let rows = handler_rows();
+    assert!(
+        rows.len() > DECLARED.len(),
+        "the scan reads the handler table: the provisioning rows plus the \
+         user-prompt-submit and pre-tool rows that predate them, found {}",
+        rows.len()
+    );
+    assert!(
+        rows.iter().any(|row| row.on == "user-prompt-submit"),
+        "a row on another event is read too, so `session_rows` is filtering \
+         rather than being all there is"
+    );
+}
+
+#[test]
+fn every_provisioning_step_declares_its_own_bound() {
+    // NOT A CARRIED CASE — the retired suite had nothing like it, because the
+    // script it tested had no bound to assert. It is here because the bound is
+    // the one thing the door adds that the script could not have, and an
+    // undeclared `timeout_ms` silently falls back to `DEFAULT_TIMEOUT` — five
+    // seconds, chosen for handlers that read two `jq` documents. A cold
+    // `mise install` under a five-second bound is the fail-open absence this
+    // whole surface exists to close, arriving as a default nobody wrote.
+    for row in session_rows() {
+        assert!(
+            row.bounded,
+            "{} declares its own bound rather than inheriting the five-second default",
+            row.id
+        );
+    }
+}
+
+#[test]
+fn the_install_step_is_declared_lockfile_free() {
+    // CARRIES `"the install is lockfile-free — provisioning must not dirty the
+    // tracked lock"` (CLOUD-223), and `"mise install runs — the step whose
+    // absence was the defect"` with it: both were greps over the retired
+    // script's source, and the same fact now lives in the task the handler runs.
+    //
+    // READ FROM `mise.toml` RATHER THAN FROM THE HANDLER ROW, because that is
+    // where it is: the row names `mise run session:install`, and the environment
+    // assignment is inside that task's body. Asserting it on the row would be
+    // asserting a spelling this change did not choose.
+    let text = std::fs::read_to_string(at_root("mise.toml")).expect("mise.toml is readable");
+    let body = text
+        .split("[tasks.\"session:install\"]")
+        .nth(1)
+        .expect("the install step is a declared task")
+        .split("\n[tasks")
+        .next()
+        .expect("the task body ends at the next table");
+
+    assert!(
+        body.contains("MISE_LOCKFILE=false"),
+        "provisioning installs purely, so it cannot append a platform key `mise lock` \
+         cannot produce and `lock-complete` rejects"
+    );
+    assert!(
+        body.contains("mise install"),
+        "the step whose absence was CLOUD-196 is the one this task performs"
+    );
+}
+
+#[test]
+fn no_by_path_registration_survives_on_the_session_start_surface() {
+    // THE OTHER HALF OF THE RETIRED REGISTRATION CASE, in the direction that
+    // matters now. That case asserted a by-path command was PRESENT; the point
+    // of this change is that none is, so the assertion inverts rather than
+    // disappearing — and inverting it is what stops the registration coming back
+    // by hand while the handler rows sit unread beside it.
+    //
+    // `[hook] exclusive` is the capability that would decide this globally
+    // (CLOUD-893) and it stays undeclared while `run-shape-guard` is registered
+    // on `pre-tool` (CLOUD-856). This is that predicate for the one event this
+    // change clears, which is what makes the clearing durable.
+    let text = std::fs::read_to_string(at_root(".claude/settings.json"))
+        .expect("the wiring file is readable");
+    let settings: serde_json::Value = serde_json::from_str(&text).expect("the wiring file is JSON");
+
+    let commands: Vec<&str> = settings["hooks"]["SessionStart"]
+        .as_array()
+        .expect("SessionStart is registered")
+        .iter()
+        .flat_map(|group| {
+            group["hooks"]
+                .as_array()
+                .expect("a group carries hooks")
+                .iter()
+        })
+        .filter_map(|hook| hook["command"].as_str())
+        .collect();
+
+    assert_eq!(
+        commands,
+        ["batten hook --harness claude-code"],
+        "the engine is the only thing registered on session start; everything else \
+         is a `[[hook.handler]]` row it dispatches"
+    );
+}
diff --git a/crates/batten/tests/it/shell_retirement.rs b/crates/batten/tests/it/shell_retirement.rs
index 94e62219d..acea3a6cc 100644
--- a/crates/batten/tests/it/shell_retirement.rs
+++ b/crates/batten/tests/it/shell_retirement.rs
@@ -43,7 +43,11 @@ fn row() -> Rule {
         // declared subject is routinely under neither governed prefix, and a
         // narrow delta hides its death rather than reporting it.
         "delta_sources": ["**"],
-        "line_sources": ["mise-tasks/*.sh", "crates/batten/tests/*.rs"],
+        // MIRRORS THE COMMITTED ROW, including `tests/**/*.bats` (CLOUD-1294).
+        // Without that entry a suite's lines are never read, `base-lines` has no
+        // entry for it, and every case below would pass or fail for the wrong
+        // reason — which is the state the committed row was in.
+        "line_sources": ["mise-tasks/*.sh", "crates/batten/tests/*.rs", "tests/**/*.bats"],
         "module": "policy/shell-retirement.rego",
         "severity": "deny",
     }))
@@ -1366,3 +1370,216 @@ fn an_invocation_field_does_not_satisfy_the_successor_obligations() {
         findings(&root)
     );
 }
+
+/// A bats suite whose two cases differ only in what they name, so the pair below
+/// is byte-identical apart from which one the head drops (CLOUD-1294).
+///
+/// The first case greps the path the delta retires; the second names nothing
+/// this change touches. Both close with `}` at column 0 and both carry the same
+/// assertion line, which is deliberate: `removed` is a set of LINES, so the
+/// shared lines are still present at head and never enter it. What the arm has
+/// to admit is the opener and the naming line, and nothing else.
+const CASE_SUITE: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+@test \"the gate is wired\" {\n\
+\trun grep -q mise-tasks/old-gate.sh wiring\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+/// The retired case dropped, the unrelated one kept.
+const CASE_SUITE_RETIRED_DROPPED: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+/// The unrelated case dropped, the retired one kept. The anti-vacuity mirror.
+const CASE_SUITE_LIVE_DROPPED: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+@test \"the gate is wired\" {\n\
+\trun grep -q mise-tasks/old-gate.sh wiring\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+/// Only the retired case's OPENER dropped; its body, naming line included, stays.
+const CASE_SUITE_OPENER_ONLY: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+\trun grep -q mise-tasks/old-gate.sh wiring\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+fn suite_repo(name: &str, head_suite: &str) -> PathBuf {
+    repo(
+        name,
+        &[
+            ("mise-tasks/old-gate.sh", GATE),
+            ("mise-tasks/other.sh", GATE),
+            ("tests/suite.bats", CASE_SUITE),
+        ],
+        &Head {
+            written: &[
+                ("tests/suite.bats", head_suite),
+                (
+                    "crates/batten/tests/old_gate.rs",
+                    &ledger("mise-tasks/old-gate.sh"),
+                ),
+            ],
+            removed: &["mise-tasks/old-gate.sh"],
+        },
+    )
+}
+
+/// CLOUD-1294. Retiring a program leaves the suites that TESTED it greping a file
+/// that is gone, and dropping those cases is the cleanup the campaign mandates.
+///
+/// The arm above it admits only a removed LINE that names the retired path; a
+/// case's opener, its assertions and its closing brace name nothing. Measured on
+/// CLOUD-312 row 10 — three cases in two suites, and neither landable shape
+/// reached them, because both suites declare subjects that survive.
+#[test]
+fn a_bats_case_testing_a_retired_path_may_be_dropped_with_it() {
+    let root = suite_repo("bats-case-retired", CASE_SUITE_RETIRED_DROPPED);
+    assert!(
+        findings(&root).is_empty(),
+        "a case that tested the retired path goes with it, exactly as the line that \
+         named it does: {:?}",
+        findings(&root)
+    );
+}
+
+/// ANTI-VACUITY, and without it this arm is a licence to delete any case during
+/// any retirement — the maintaining-in-place arm B exists to refuse.
+///
+/// Byte-identical to the case above apart from WHICH block the head drops.
+#[test]
+fn a_bats_case_testing_a_live_path_is_still_refused() {
+    let root = suite_repo("bats-case-live", CASE_SUITE_LIVE_DROPPED);
+    assert_eq!(
+        findings(&root),
+        vec![String::from("shell-rule-retired")],
+        "the surviving case names nothing this delta retires, so dropping it is an \
+         ordinary edit to a governed suite"
+    );
+}
+
+/// A case is admitted when it DIES, never when it is merely opened up.
+///
+/// Deleting the opener and keeping the body would otherwise pass: the opener is
+/// absent from the head, which is what identifies a dead block. The clause that
+/// refuses it is `body in removed` — the line that named the retired path has to
+/// have gone too.
+#[test]
+fn a_half_deleted_bats_case_is_still_refused() {
+    let root = suite_repo("bats-case-half", CASE_SUITE_OPENER_ONLY);
+    assert_eq!(
+        findings(&root),
+        vec![String::from("shell-rule-retired")],
+        "a case whose naming line survives was edited, not retired"
+    );
+}
+
+/// CLOUD-1283's bound-and-spent shape, one arm over. `container-preflight.bats`
+/// binds its program once in `setup()` and every case greps `"$HOOK"`, so no line
+/// inside a case carries a path at all and the first arm cannot reach it.
+const BIND_SUITE: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+setup() {\n\
+\tHOOK=\"$BATS_TEST_DIRNAME/../mise-tasks/old-gate.sh\"\n\
+}\n\
+\n\
+@test \"the gate is wired\" {\n\
+\trun grep -q \"$HOOK\" wiring\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+/// The binding goes with the case that spent it.
+const BIND_SUITE_DROPPED: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+setup() {\n\
+}\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+/// The case goes, the binding stays. The anti-vacuity mirror for the same arm.
+const BIND_SUITE_BINDING_KEPT: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+setup() {\n\
+\tHOOK=\"$BATS_TEST_DIRNAME/../mise-tasks/old-gate.sh\"\n\
+}\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+fn bind_repo(name: &str, head_suite: &str) -> PathBuf {
+    repo(
+        name,
+        &[
+            ("mise-tasks/old-gate.sh", GATE),
+            ("mise-tasks/other.sh", GATE),
+            ("tests/binding.bats", BIND_SUITE),
+        ],
+        &Head {
+            written: &[
+                ("tests/binding.bats", head_suite),
+                (
+                    "crates/batten/tests/old_gate.rs",
+                    &ledger("mise-tasks/old-gate.sh"),
+                ),
+            ],
+            removed: &["mise-tasks/old-gate.sh"],
+        },
+    )
+}
+
+/// A case naming the retired path only through a variable dies with it, provided
+/// the binding dies too.
+#[test]
+fn a_bats_case_spending_a_retired_binding_may_be_dropped_with_it() {
+    let root = bind_repo("bats-bind-retired", BIND_SUITE_DROPPED);
+    assert!(
+        findings(&root).is_empty(),
+        "the case spent a binding this delta retires, and the binding went with \
+         it: {:?}",
+        findings(&root)
+    );
+}
+
+/// ANTI-VACUITY for the binding arm: a variable that survives buys nothing, so
+/// dropping a case that spends it is an ordinary edit to a governed suite.
+#[test]
+fn a_bats_case_spending_a_surviving_binding_is_refused() {
+    let root = bind_repo("bats-bind-kept", BIND_SUITE_BINDING_KEPT);
+    assert_eq!(
+        findings(&root),
+        vec![String::from("shell-rule-retired")],
+        "the binding is still there, so nothing about this case is going away"
+    );
+}
diff --git a/mise-tasks/hooks-wiring-check.sh b/mise-tasks/hooks-wiring-check.sh
index 1c047f1f9..2596e5318 100755
--- a/mise-tasks/hooks-wiring-check.sh
+++ b/mise-tasks/hooks-wiring-check.sh
@@ -175,7 +175,6 @@ gemini-cli .gemini/settings.json}"
 # Their owners are not invented: CLOUD-312 is "the shell guards retire behind
 # it", whose scope CLOUD-777 widened from pre-tool to every point.
 DECLARED="${HOOKS_WIRING_DECLARED-
-.claude/hooks/session-start.sh CLOUD-312
 mise-tasks/run-shape-guard.sh CLOUD-821
 stop-hook-git-check.sh CLOUD-605
 session-start-git-identity.sh CLOUD-605}"
diff --git a/mise.toml b/mise.toml
index 851be5237..f87e91aec 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1724,6 +1724,157 @@ run = "cargo run --quiet -p batten -- check --rule memory-graph"
 [tasks.rules-drift]
 description = "Gate: a value `.claude/rules/*.md` restates still agrees with the mechanism that owns it (CLOUD-506)"
 run = "cargo run --quiet -p batten -- check --rule rules-drift"
+# ---------------------------------------------------------------------------
+# The session-start provisioning steps, one task each (CLOUD-312 row 10).
+#
+# THESE ARE THE BODY OF `.claude/hooks/session-start.sh`, WHICH THIS CHANGE
+# DELETES. That script was 295 lines of bash registered by path on SessionStart,
+# and it did three separable things: it ORDERED a list of steps, it BOUNDED
+# nothing, and it wrapped each step in a `step` helper that logged to a file and
+# tailed five lines to stderr on failure. Two of those three now belong to
+# `[[hook.handler]]` — the order is the declaration order of the rows in
+# `batten.toml`, and the bound is `timeout_ms`, imposed by the parent. What the
+# door does NOT provide is the third, so it is what stayed, once per step.
+#
+# WHY A TASK PER STEP RATHER THAN ONE TASK RUNNING THEM ALL. One task would be
+# the same bash one layer down, invisible to the committed authority: a reader of
+# `batten.toml` would see one row and could not tell what runs, in what order, or
+# what happens when the fourth thing fails. It would also share one bound across
+# steps whose costs differ by two orders of magnitude. The row-per-step shape is
+# what makes `batten doctor hooks` and `batten config show` able to answer
+# "what does this repository do at session start" from the committed file.
+#
+# WHY THE REDIRECT IS HERE AND NOT IN THE HANDLER ROW. `handler.rs`'s contract
+# reads stdout on a passing exit as ADVISORY TEXT that joins the reply the host
+# sees. Several of these steps print on success — `install:local` echoes its
+# destination — so registered raw they would put a line in every session's
+# advisory saying nothing went wrong, which is exactly the announcement CLOUD-891
+# removed from this hook. `step` solved that by sending both streams to a log,
+# and these tasks solve it the same way: silence on the normal path, and on
+# failure the `::error::` line, the log pointer and the last five lines on
+# STDERR, which is where the door's contract puts a reason.
+#
+# The `|| { …; exit 1; }` is not belt-and-braces: a body declaring no `shell =`
+# runs under `sh -e`, so a bare failing call would abort the task before its own
+# report could run. That is measured — it cost a debugging cycle in #798 — and
+# the three corrected comments in `[tasks."test:bats"]` are the same fact said
+# where the next author reads it.
+
+[tasks."session:stamp"]
+description = "Session start: stamp the beginning of the session, before anything else runs (CLOUD-431)"
+# FIRST, AND THE ORDER IS THE PREDICATE. `claim-check`'s `refined-this-session`
+# rule compares an issue's tracker-minted `updatedAt` against this file's mtime:
+# refinement must PREDATE the session that implements it. A stamp written after
+# the provisioning steps would date the session to whenever provisioning finished,
+# which is exactly the ordering that rule exists to refuse.
+#
+# Silent and non-fatal by construction — `mkdir -p` and a truncation, both
+# idempotent. `claim-check` refuses on a MISSING stamp rather than passing, so a
+# failure here fails closed downstream instead of needing to halt the session.
+run = "mkdir -p \"$(git rev-parse --git-dir)/batten-receipts\" && : > \"$(git rev-parse --git-dir)/batten-receipts/session-start\""
+
+[tasks."session:install"]
+description = "Session start: provision the mise toolchain, purely — the step whose absence was CLOUD-196"
+# The load-bearing one. `.mcp.json` launches Serena with `mise exec --`, and
+# `mise exec` INSTALLS a missing tool on demand: on a cold container that install
+# ran inside the MCP client's startup window, measured 24s for `pipx:serena-agent`,
+# the handshake did not complete, and MCP servers are not retried mid-session.
+# This is what makes that `exec` a pure exec.
+#
+# `MISE_LOCKFILE=false` makes it a PURE install (CLOUD-223). A cold install of
+# `ubi:rust-cross/cargo-zigbuild` otherwise appends a platform key `mise lock`
+# cannot produce, which `lock-complete` rejects by name — so every session opened
+# with a dirty tree and a red gate no branch had caused. `[settings] lockfile =
+# false` is the authority; this is the belt to that suspenders, and it keeps the
+# install pure even under an ambient `MISE_LOCKFILE`.
+run = "env MISE_LOCKFILE=false mise install >/tmp/session-start-install.log 2>&1 || { echo '::error:: session-start: install failed — see /tmp/session-start-install.log' >&2; tail -5 /tmp/session-start-install.log >&2; exit 1; }"
+
+[tasks."session:submodules"]
+description = "Session start: check out the vendored submodules — bats lives in tests/bats"
+run = "git submodule update --init --recursive >/tmp/session-start-submodules.log 2>&1 || { echo '::error:: session-start: submodules failed — see /tmp/session-start-submodules.log' >&2; tail -5 /tmp/session-start-submodules.log >&2; exit 1; }"
+
+[tasks."session:doctor"]
+description = "Session start: provision what mise does not own — the rustup cross targets above all (CLOUD-218)"
+# AFTER `session:install` AND BEFORE THE PREFLIGHT, and both halves of that
+# ordering are load-bearing. Doctor's rustup half needs the mise-provisioned
+# toolchain, so it cannot go first; and left outside the provisioning window it
+# runs for the first time inside the first `mise run verify`, concurrently with
+# whatever else the sandbox is still laying down. Measured on a cold container
+# 2026-08-07: that first verify died in doctor with `detected conflict` on
+# `rust-std-aarch64-apple-darwin`, and a second doctor, nothing changed but time,
+# exited 0. The message names cross-compilation, so it costs the reader a
+# debugging session on a machine where nothing is broken.
+#
+# This is not a retry: it does not make the race survivable, it empties the
+# window the race needs.
+run = "mise run doctor >/tmp/session-start-doctor.log 2>&1 || { echo '::error:: session-start: doctor failed — see /tmp/session-start-doctor.log' >&2; tail -5 /tmp/session-start-doctor.log >&2; exit 1; }"
+
+[tasks."session:batten"]
+description = "Session start: build and install this checkout's own engine over the released one `deps-install` provisioned"
+# THE RELEASED BINARY IS ALREADY ON PATH BY THE TIME THIS RUNS, and that is what
+# makes this row possible at all. `deps-install` puts it there at provisioning
+# (CLOUD-1085, #798) — before Claude launches, so before any hook fires — which
+# is what dispatches the handler this task is registered as. This step then
+# REPLACES it with the working tree's build, because consumer #1 must judge the
+# engine it ships rather than the last release.
+#
+# The ordering consequence, stated because it inverts the old script's: a session
+# whose `deps-install` did not run has no binary to dispatch handlers with, so
+# nothing here runs and the advisory `contract::unmediated_session` reports it.
+# `mise run install:local` stays reachable by hand, which is the manual repair.
+run = "mise run install:local >/tmp/session-start-batten.log 2>&1 || { echo '::error:: session-start: install:local failed — see /tmp/session-start-batten.log' >&2; tail -5 /tmp/session-start-batten.log >&2; exit 1; }"
+
+[tasks."session:git-hooks"]
+description = "Session start: install the repo-owned git hooks, the per-clone step nothing performed for 24 commits (CLOUD-476)"
+# NOT `hk install`. The hook it generates is `exec hk run pre-commit`, calling
+# `hk` BARE, which resolves only where mise's shims are on PATH — in this
+# environment they are not, so that hook makes every `git commit` fail with
+# `hk: not found`. Measured, on the very commit that added the step. The body
+# installed here resolves `hk` through `mise exec --`, which is the form that
+# works, and refuses to re-enter a gate already running.
+#
+# A SYMLINK, NEVER A COPY: a copy is a second authority that goes stale silently
+# the moment the checked-in body changes, and `doctor` would keep passing over
+# it. `-f` so a clone carrying hk's generated hook is repaired rather than
+# skipped, which is the state every existing clone is in. Both hooks `hk.pkl`
+# defines, through one body that dispatches on the name it is invoked as —
+# commit-msg carries the Conventional Commits check release-plz's semver depends
+# on, so leaving it out would gate the expensive half and not the deciding one.
+run = "mkdir -p \"$(git rev-parse --git-path hooks)\" && ln -sfn \"$(git rev-parse --show-toplevel)/.claude/hooks/git-hook.sh\" \"$(git rev-parse --git-path hooks)/pre-commit\" && ln -sfn \"$(git rev-parse --show-toplevel)/.claude/hooks/git-hook.sh\" \"$(git rev-parse --git-path hooks)/commit-msg\""
+
+[tasks."session:identity"]
+description = "Session start: set this clone's repo-local git identity, quietly — the `step`-wrapped call from the retired hook"
+# WRAPPED RATHER THAN REGISTERED DIRECTLY, and the reason is measured. The retired
+# script ran `step attribution-identity mise run attribution-identity`, and `step`
+# sent both streams to a log — so the fixer's own line never reached a session.
+# Registering the bare task as a handler puts its stdout in the advisory instead,
+# which is the CLOUD-891 announcement this hook had already removed. This keeps
+# the old behaviour exactly: silent when it has nothing to repair, loud when it
+# fails.
+run = "mise run attribution-identity >/tmp/session-start-identity.log 2>&1 || { echo '::error:: session-start: attribution-identity failed — see /tmp/session-start-identity.log' >&2; tail -5 /tmp/session-start-identity.log >&2; exit 1; }"
+
+[tasks."session:signing"]
+description = "Session start: put the not-signing posture into force, quietly — the `step`-wrapped call from the retired hook"
+# The same wrapper for the same measured reason, and this is the one that caught
+# it: registered bare, `mise run signing-posture --repair` put
+# `signing-posture: signing disabled in this checkout …` into every session's
+# advisory. Measured 2026-09-01 by dispatching the real rows. The retired script
+# `step`-wrapped this call, so that line was never a session's to read.
+run = "mise run signing-posture --repair >/tmp/session-start-signing.log 2>&1 || { echo '::error:: session-start: signing-posture failed — see /tmp/session-start-signing.log' >&2; tail -5 /tmp/session-start-signing.log >&2; exit 1; }"
+
+[tasks."session:census"]
+description = "Session start: record this boot and read back what was running when the container we replaced went down (CLOUD-451)"
+# RECORD BEFORE READ, and the order is load-bearing: recording this boot after
+# reading would make it part of the evidence it is being compared against.
+#
+# NEVER FATAL, and that is why it is `|| true` rather than the `|| { …; exit 1; }`
+# every other step above carries: a verdict about a PAST container is not a
+# provisioning failure, and halting a session over one would be the sensor
+# deciding something it has no business deciding. Only the positive reading
+# speaks — the report's exit 1 (idle when replaced) and exit 2 (cannot look) are
+# silent, because a line every session start would be noise in the overwhelming
+# case where nothing happened.
+run = "mise run reclaim-census record-boot >/dev/null 2>&1 || true; mise run reclaim-census report 2>/dev/null || true"
 
 [tasks.batten-check]
 description = "Consumer #1: evaluate the committed batten.toml with batten's own engine against this repository"
@@ -2113,8 +2264,23 @@ depends = ["doctor --no-targets"]
 # here. Output stays a pointer (rule 4) — two counts and the worker count, never
 # a case name.
 #
-# This body runs under /bin/sh with no `set -e`, so every step is guarded
-# explicitly rather than trusting the previous line.
+# This body runs under `/bin/sh` WITH `-e`, so a bare failing command aborts the
+# task where it stands. Every step is guarded explicitly anyway, which is
+# belt-and-braces rather than load-bearing — and the guards are what let a step
+# CHOOSE its exit code instead of inheriting the abort.
+#
+# CORRECTED 2026-09-01, measured. These three comments said "with no `set -e`" and
+# were wrong. The discriminator is a DECLARED SHELL, not the file: a task that
+# declares `shell = "bash -c"` really does run every line regardless — that is the
+# case `.claude/rules/toolchain.md` documents and `tests/task-fail-closed.bats`
+# gates, over `verify` and `verify:gated`, both of which declare it. This task
+# declares none, so it gets the default and `-e` with it. Observed while landing
+# CLOUD-1085: a bare call in a default body aborted the task before the branch
+# reporting which failure it was could run.
+#
+# The error direction was benign, which is why nothing broke: believing "no
+# `set -e`" makes an author ADD guards. An author who believed the opposite would
+# omit them, and that is the direction this correction exists to prevent.
 # Receipt-gated (CLOUD-424). Deliberately glob-less in step-receipt's table:
 # these suites read mise.toml, hk.pkl, workflows and fixture trees all over the
 # repo, so the honest input set is the whole tracked tree — a rebase that
@@ -2144,9 +2310,9 @@ if ./mise-tasks/step-receipt.sh check test:bats; then exit 0; fi
 # besides: it produces the RELEASE binary for the mediated-call hot path, while
 # `helpers.bash:119-134` and `common/mod.rs:154` both resolve a debug one.
 #
-# Guarded explicitly: this body runs under `/bin/sh` with no `set -e`, so an
-# unguarded build would leave the suite running against a stale artifact and
-# reporting green — the exact failure this clause exists to remove.
+# Guarded explicitly so the failure is NAMED: under the default `-e` an unguarded
+# build would abort the task with mise's own line and nothing about stale
+# artifacts, and the pointer is the whole value of this clause.
 if ! cargo build --quiet -p batten; then
   echo "::error:: test:bats: the debug binary did not build, so the suite would run against a stale artifact or none. That is CLOUD-592/699's class and the reason this step builds at all." >&2
   exit 1
@@ -2176,9 +2342,12 @@ export HOOKS_WIRING_DIAGNOSIS
 # FAIL OPEN TOWARD COST: a selector that cannot answer at all falls back to every
 # suite. The asymmetry is the whole design — a run that is too wide shows up in
 # the bill, and one that is too narrow has no symptom at all.
-# CLEARED ON A NONZERO SELECTOR (CLOUD-480, found on review of #660). This body
-# runs under `/bin/sh` with no `set -e` — the hazard `.claude/rules/toolchain.md`
-# records — so a selector that died partway left its PARTIAL output in `suites`,
+# CLEARED ON A NONZERO SELECTOR (CLOUD-480, found on review of #660). The guard is
+# required whichever way the shell is set, which is why it is written as a status
+# read rather than an emptiness test: under the default `-e` a bare assignment from
+# a failed substitution aborts the task, and without it the substitution leaves its
+# PARTIAL output behind. CLOUD-480 measured the second — a selector that died partway
+# left partial output in `suites`,
 # the emptiness check below then saw a non-empty value, and the fallback never
 # fired. A narrow run has no symptom, which is the asymmetry the fallback exists
 # to respect, so the guard has to read the status rather than the output.
diff --git a/policy/shell-retirement.rego b/policy/shell-retirement.rego
index 49d0a4eca..ec79e38d5 100644
--- a/policy/shell-retirement.rego
+++ b/policy/shell-retirement.rego
@@ -93,6 +93,14 @@
 # character, so the pattern could never match the line it names. Nothing caught
 # it because nothing could reach a module to run it (CLOUD-1267).
 #MUTANT list-drop-not-exact|s@line == concat("", \[before, after\])@startswith(line, before)@|dropping_the_name_while_also_changing_the_line_is_refused
+# CLOUD-1294's three arms, and the case fields name the cases that observe them
+# — the exemption withdrawn above binds these too. The first keeps a half-deleted
+# case from buying its own removal; the second keeps a case whose binding
+# survives from doing the same; the third keeps the arm from becoming a licence
+# to delete any case during any retirement.
+#MUTANT case-half-deleted|s@body in removed@true@|a_half_deleted_bats_case_is_still_refused
+#MUTANT case-binding-survives|s@binding in removed@true@|a_bats_case_spending_a_surviving_binding_is_refused
+#MUTANT case-names-nothing-retired|s@mentions_retired(path, body, gone)@true@|a_bats_case_testing_a_live_path_is_still_refused
 #
 #MUTANT-SUITE crates/batten/tests/it/shell_retirement.rs
 
@@ -225,15 +233,14 @@ only_drops_a_retired_reference(path) if {
 	# neither is a retirement's cleanup.
 	count(removed) > 0
 
-	# Every removed line names a path this change retires.
-	#
-	# `mentions_retired` rather than a bare `contains` since CLOUD-1149: bash does
-	# not spell a sibling as a repo-relative path, so `$(dirname "$0")/x.sh` named
-	# nothing this clause could see and every such cleanup was refused.
+	# EVERY REMOVED LINE IS ADMITTED, by one of the two shapes below. Factored out
+	# of this body since CLOUD-1294, mirroring `admitted_addition` — the addition
+	# side has had four shapes behind one name since CLOUD-1224, and the removal
+	# side reading as a single inline predicate is what made its second shape look
+	# like a change to this clause rather than a sibling of it.
 	count({line |
 		some line in removed
-		some gone in delta.deleted
-		mentions_retired(path, line, gone)
+		admitted_removal(path, line, removed)
 	}) == count(removed)
 
 	# AND NOTHING WAS ADDED THAT IS NOT A TRUNCATION OF A REMOVED LINE. Without a
@@ -260,6 +267,51 @@ only_drops_a_retired_reference(path) if {
 	}) == count(added)
 }
 
+# A removed line names a path this change retires.
+#
+# `mentions_retired` rather than a bare `contains` since CLOUD-1149: bash does
+# not spell a sibling as a repo-relative path, so `$(dirname "$0")/x.sh` named
+# nothing this clause could see and every such cleanup was refused.
+admitted_removal(path, line, _) if {
+	some gone in delta.deleted
+	mentions_retired(path, line, gone)
+}
+
+# OR IT IS ONE OF THE LINES OF A `@test` CASE THAT DIES WITH THE PATH IT TESTED
+# (CLOUD-1294), and this is the second shape the campaign could not complete
+# without.
+#
+# THE MEASURED INSTANCE. Retiring `.claude/hooks/session-start.sh` (CLOUD-312 row
+# 10) leaves three cases in two suites greping a file that is gone —
+# `tests/commit-attribution.bats` and `tests/container-preflight.bats`. Neither
+# landable shape reaches them: deleting a suite whole is refused because both
+# declare subjects that SURVIVE (`hk.pkl`, `mise.toml`,
+# `mise-tasks/container-preflight.sh`), and the arm above admits only a removed
+# LINE that names the retired path — a removed case's opener, its assertions and
+# its closing brace name nothing. So the campaign again mandated a retirement it
+# could not land, which is CLOUD-1051's own words for why the arm above exists.
+#
+# THE CASE MUST BE GONE, NOT MERELY EDITED. `@test` titles are unique within a
+# suite, so an opener absent from the head identifies a block that died. Deleting
+# only the opener and keeping the body is NOT that, and it is refused by the
+# clause below rather than by taste: the line that names the retired path must
+# itself be among the removed, so a half-deleted case buys nothing.
+#
+# AND THE CASE MUST HAVE EARNED ITS OWN REMOVAL, by naming a path this delta
+# retires. Without that term this is a licence to delete any case during any
+# retirement — precisely the maintaining-in-place that arm B exists to refuse —
+# and `a_bats_case_testing_a_live_path_is_still_refused` is the mirror that fails
+# if it is ever dropped.
+#
+# THE BOUND, STATED RATHER THAN DISCOVERED: `removed` is a set of LINES, so a
+# removed line whose text exactly matches one inside the dying case is admitted
+# even if it came from elsewhere in the same file. Positional alignment would
+# close that, and Rego cannot compute one without a diff algorithm the engine
+# does not hand over. It is narrow — the match must be exact, nothing may be
+# ADDED under the clause below, and a stray identical line removed elsewhere
+# breaks the case it was taken from.
+admitted_removal(path, line, removed) if line_of_a_retired_case(path, line, removed)
+
 # An added line is admitted three ways, and all three are shapes rather than
 # judgements.
 admitted_addition(_, line, removed) if truncates_a_retired_reference(line, removed)
@@ -270,6 +322,97 @@ admitted_addition(path, line, removed) if repoints_at_the_declared_invocation(pa
 
 admitted_addition(_, line, removed) if drops_a_retired_name(line, removed)
 
+# ---------------------------------------------------------------------------
+# A `@test` case that goes with the path it tested (CLOUD-1294).
+# ---------------------------------------------------------------------------
+
+# A BOOLEAN RULE, NEVER A FUNCTION RETURNING A SET, and the distinction is
+# load-bearing rather than stylistic. A function whose body cannot bind — a path
+# with no `base-lines`, a caller that is not a bats suite at all — is UNDEFINED,
+# and an undefined term inside `only_drops_a_retired_reference` would make that
+# whole admission undefined and refuse the `mise-tasks/` cleanups that work
+# today. A rule that simply does not hold is false, which is the only safe shape
+# for an additive arm.
+line_of_a_retired_case(path, line, removed) if {
+	base := delta["base-lines"][path]
+	head := {l | some l in input.tree.lines[path]}
+
+	# A case whose opener the head no longer carries.
+	some start, opener in base
+	startswith(opener, "@test ")
+	not opener in head
+	stop := case_end(base, start)
+
+	case_earns_removal(path, base, start, stop, removed)
+
+	# `line` is one of that case's own lines.
+	some at, own in base
+	at >= start
+	at <= stop
+	own == line
+}
+
+# HOW A CASE EARNS ITS OWN REMOVAL. Two spellings, because a suite references the
+# program it tests in two ways and only one of them is a path.
+
+# It NAMES the retired path, and that line is going away too.
+#
+# The second conjunct is what refuses a half-deleted case: an absent opener is
+# what identifies a dead block, so without it, deleting only the opener and
+# keeping the body would pass.
+case_earns_removal(path, base, start, stop, removed) if {
+	some named, body in base
+	named >= start
+	named <= stop
+	body in removed
+	some gone in delta.deleted
+	mentions_retired(path, body, gone)
+}
+
+# Or it SPENDS a variable this file bound to the retired path, and the BINDING is
+# going away in the same delta.
+#
+# THE MEASURED INSTANCE, and it is why the arm above is not enough on its own.
+# `tests/container-preflight.bats` binds `HOOK` once in `setup()` and every case
+# then greps `"$HOOK"`. No line inside either case carries a path at all, so
+# `mentions_retired` sees nothing — and the one case that WAS admitted by the arm
+# above was admitted because the retired program's stem happened to appear in its
+# title, which is an accident of wording rather than a predicate.
+#
+# `retired_path_vars` is not reused here, deliberately: it reads
+# `is_retired_reference_by_text`, which requires the bound value to BE the path or
+# to resolve through a script-directory marker, and a suite spells it relative to
+# its own directory (`$BATS_TEST_DIRNAME/../.claude/hooks/…`). Loosening that
+# function would loosen the repointing arms on the ADDITION side with it, where
+# nothing is going away and the byte-check is the whole safety property. This
+# reads the same binding through `mentions_retired`, which is already the looser
+# going-away test, and requires the binding line itself to be removed — so a
+# variable that survives buys nothing.
+case_earns_removal(path, base, start, stop, removed) if {
+	some binding in base
+	binding in removed
+	some gone in delta.deleted
+	mentions_retired(path, binding, gone)
+	variable := assigned_name(binding)
+
+	some spent, body in base
+	spent >= start
+	spent <= stop
+	some spelling in {concat("", ["$", variable]), concat("", ["${", variable, "}"])}
+	contains(body, spelling)
+}
+
+# The `}` closing the case opened at `start`.
+#
+# Column 0 is the whole test: bats closes an `@test` there and every nested
+# closer inside one is indented. An unterminated case yields an empty set, `min`
+# is undefined over it, and the arm does not hold — the safe direction for a rule
+# whose failure mode is a silent licence.
+case_end(base, start) := stop if {
+	closers := {i | some i, l in base; i > start; l == "}"}
+	stop := min(closers)
+}
+
 # ---------------------------------------------------------------------------
 # How a caller SPELLS the program it is losing (CLOUD-1149).
 # ---------------------------------------------------------------------------
diff --git a/tests/commit-attribution.bats b/tests/commit-attribution.bats
index 07edd3196..8ee9bd1fa 100644
--- a/tests/commit-attribution.bats
+++ b/tests/commit-attribution.bats
@@ -38,11 +38,6 @@ setup() {
 	[ "$output" = "wired" ]
 }
 
-@test "the fixer is wired: session-start runs it, so a clone is compliant before it commits" {
-	run grep -c 'step attribution-identity mise run attribution-identity' .claude/hooks/session-start.sh
-	[ "$output" = "1" ]
-}
-
 @test "both tasks resolve to the engine, not to a second implementation" {
 	# The policy has exactly one evaluator. A shell task that re-implemented any
 	# part of the predicate would be the second authority this issue moved the
diff --git a/tests/container-preflight.bats b/tests/container-preflight.bats
index 21bd2dea7..02b0a29f9 100644
--- a/tests/container-preflight.bats
+++ b/tests/container-preflight.bats
@@ -12,7 +12,6 @@
 
 setup() {
 	PREFLIGHT="$BATS_TEST_DIRNAME/../mise-tasks/container-preflight.sh"
-	HOOK="$BATS_TEST_DIRNAME/../.claude/hooks/session-start.sh"
 	STUB="$BATS_TEST_TMPDIR/bin"
 	mkdir -p "$STUB"
 	# A fenced environment by default, so a test that is not about egress does
@@ -127,15 +126,3 @@ EOF
 	[[ "$output" == *"a defect in this repository"* ]]
 	[[ "$output" == *"memories"* ]]
 }
-
-@test "the session-start hook calls it — the whole point is WHEN it runs" {
-	# A preflight nothing runs at startup is the state this issue found: the
-	# diagnosis existed (gh-preflight) and no session ever consulted it.
-	run grep -q "container-preflight" "$HOOK"
-	[ "$status" -eq 0 ]
-}
-
-@test "the hook passes --degraded when provisioning failed" {
-	run grep -q -- "container-preflight -- --degraded" "$HOOK"
-	[ "$status" -eq 0 ]
-}
diff --git a/tests/session-start.bats b/tests/session-start.bats
deleted file mode 100644
index 2ffdf3ee0..000000000
--- a/tests/session-start.bats
+++ /dev/null
@@ -1,205 +0,0 @@
-#!/usr/bin/env bats
-# subject: .claude/hooks/session-start.sh
-# The SessionStart hook's load-bearing properties (CLOUD-196). The hook's effect
-# — a provisioned toolchain — is not assertable in a unit test, so these pin the
-# two properties whose loss would silently restore the defect: that it is
-# synchronous, and that it fails loudly rather than exiting 0 on a broken setup.
-
-setup() {
-	HOOK="$BATS_TEST_DIRNAME/../.claude/hooks/session-start.sh"
-	SETTINGS="$BATS_TEST_DIRNAME/../.claude/settings.json"
-
-	# The hook now ends in `mise run container-preflight`, whose verdict is about
-	# the CONTAINER — its egress policy and its credential — not about this code
-	# (CLOUD-261). Letting that verdict decide these tests would make `mise run
-	# test:bats` a container-health check, and the fix for a broken container
-	# could then never be landed from one. So the preflight alone is neutralised
-	# here, and every other `mise` call — `mise install` above all — still runs
-	# for real, which is what keeps the lockfile assertion below non-vacuous.
-	#
-	# The preflight's own behaviour is asserted in tests/container-preflight.bats,
-	# where the GitHub half is stubbed and every verdict is reachable.
-	#
-	# `doctor` is neutralised for the same reason and one more (CLOUD-218). Its
-	# rustup half reaches the network to install cross targets, so an offline
-	# container would decide these tests; and `[tasks."test:bats"]` already
-	# `depends = ["doctor --no-targets"]`, so letting each hook-running test
-	# invoke a FULL doctor would hang a cross-target install off every one of
-	# them. Its own behaviour is asserted in tests/doctor-check.bats and
-	# tests/target-race.bats.
-	#
-	# The stub RECORDS every invocation, which is what makes the wiring assertion
-	# below a real observation of the hook's behaviour rather than a grep of its
-	# source.
-	#
-	# `install` IS INTERCEPTED TOO, and opted back in per case (CLOUD-406). It
-	# used to exec the real binary unconditionally, on the argument that this is
-	# what keeps the lockfile assertions non-vacuous — half true, and the half
-	# that was false cost a red required check on a branch that changed nothing.
-	# Measured on run 31538830648: Sigstore's TUF metadata endpoint was down,
-	# `mise install` failed, and two cases whose properties are ORDER and OUTPUT
-	# went red through their `[ "$status" -eq 0 ]` line. Neither was asserting
-	# anything about the install succeeding; the hook records the call either way,
-	# because `step` sets `fail=1` and CONTINUES rather than aborting.
-	#
-	# Of the two lockfile assertions the old rationale named, only one needs a
-	# real install: the `grep` over the hook's source text does not touch a
-	# toolchain. That one, and the two other genuinely end-to-end cases, set
-	# `SESSION_START_REAL_INSTALL` and establish the precondition first — so a
-	# container that cannot provision SKIPS with a reason instead of reporting a
-	# hook defect, which is the `lock-check` split applied one layer down.
-	STUB="$BATS_TEST_TMPDIR/bin"
-	CALLS="$BATS_TEST_TMPDIR/mise-calls"
-	mkdir -p "$STUB"
-	REAL_MISE="$(command -v mise)"
-	cat >"$STUB/mise" <<EOF
-#!/usr/bin/env bash
-printf '%s\n' "\$*" >>"$CALLS"
-if [ "\$1" = run ] && { [ "\$2" = container-preflight ] || [ "\$2" = doctor ]; }; then exit 0; fi
-if [ "\$1" = install ] && [ -z "\${SESSION_START_REAL_INSTALL:-}" ]; then exit 0; fi
-exec "$REAL_MISE" "\$@"
-EOF
-	chmod +x "$STUB/mise"
-	PATH="$STUB:$PATH"
-	export PATH
-}
-
-# ESTABLISH THE PRECONDITION, NEVER RETRY THE MEASUREMENT (CLOUD-406). A case
-# that needs a real install asks for one HERE, directly, before the hook runs. A
-# failure at this line is a statement about the container's egress, not about the
-# hook — so it skips with a reason rather than reddening a branch. It is also the
-# discriminator that makes the opt-in honest: past it, the hook's own install
-# cannot fail for a provisioning reason, so a red from the case that follows is a
-# real defect. Idempotent and warm, so the second install costs milliseconds.
-real_install_or_skip() {
-	env MISE_LOCKFILE=false "$REAL_MISE" install >/dev/null 2>&1 ||
-		skip "this container cannot provision — \`mise install\` failed, which is a verdict about egress and not about the hook (CLOUD-406)"
-	export SESSION_START_REAL_INSTALL=1
-}
-
-@test "the hook is executable" {
-	[ -x "$HOOK" ]
-}
-
-@test "the hook is synchronous — async would restore the race it closes" {
-	# `{"async": true}` on stdout tells the client to start the session while
-	# this still runs, which is exactly the window the MCP handshake lost. The
-	# property is what the hook EMITS, not whether the word appears — the
-	# rationale comment names async precisely to explain why it is absent, and
-	# an earlier version of this test failed on that comment.
-	run env CLAUDE_PROJECT_DIR="$BATS_TEST_DIRNAME/.." "$HOOK"
-	[ "$status" -eq 0 ]
-	[[ "$output" != *"async"* ]]
-
-	# Belt and braces: no executable (non-comment) line declares it either.
-	run bash -c "grep -v '^[[:space:]]*#' '$HOOK' | grep -c '\"async\"' || true"
-	[ "$output" -eq 0 ]
-}
-
-@test "mise install runs — the step whose absence was the defect" {
-	# `mise exec` in .mcp.json installs on demand; this is what makes that a
-	# pure exec instead of a 24-second install inside the MCP startup window.
-	run grep -q "mise install" "$HOOK"
-	[ "$status" -eq 0 ]
-}
-
-@test "doctor runs inside the synchronous window — after install, before the preflight" {
-	# CLOUD-218. `mise install` returning is not "the toolchain is settled": the
-	# rustup cross targets are doctor's to provision, and outside this window
-	# they land inside the first `mise run verify`, where a concurrent writer
-	# turns the install into a `detected conflict` rollback that names
-	# cross-compilation. Ordering is the whole property — after `mise install`
-	# because doctor's rustup half needs the provisioned toolchain, before the
-	# preflight because the preflight is a halt and provisioning must be done
-	# by then.
-	run env CLAUDE_PROJECT_DIR="$BATS_TEST_DIRNAME/.." "$HOOK"
-	[ "$status" -eq 0 ]
-
-	local install doctor preflight
-	install=$(grep -nx 'install' "$CALLS" | head -1 | cut -d: -f1)
-	doctor=$(grep -nx 'run doctor' "$CALLS" | head -1 | cut -d: -f1)
-	preflight=$(grep -n '^run container-preflight' "$CALLS" | head -1 | cut -d: -f1)
-	[ -n "$install" ]
-	[ -n "$doctor" ]
-	[ -n "$preflight" ]
-	[ "$install" -lt "$doctor" ]
-	[ "$doctor" -lt "$preflight" ]
-}
-
-@test "a failed step exits non-zero — absence must never be silent" {
-	run grep -q "exit 1" "$HOOK"
-	[ "$status" -eq 0 ]
-}
-
-@test "the hook is registered as a SessionStart hook" {
-	run python3 -c "
-import json
-d = json.load(open('$SETTINGS'))
-hooks = d['hooks']['SessionStart']
-cmds = [h['command'] for g in hooks for h in g['hooks']]
-assert any('session-start.sh' in c for c in cmds), cmds
-print('registered')
-"
-	[ "$status" -eq 0 ]
-	[[ "$output" == *"registered"* ]]
-}
-
-@test "the hook runs green on this checkout" {
-	# Idempotent by construction, so running it here is safe and is the only
-	# end-to-end assertion available: the steps are all already satisfied.
-	real_install_or_skip
-	run env CLAUDE_PROJECT_DIR="$BATS_TEST_DIRNAME/.." "$HOOK"
-	[ "$status" -eq 0 ]
-	# SILENCE IS THE PASS (CLOUD-891). This asserted a success line, which is what
-	# kept one there: the hook announced "nothing went wrong" once per session to
-	# a reader with no action to take. Exit 0 is the verdict; stdout is for things
-	# somebody must act on.
-	[ -z "$output" ]
-}
-
-@test "the install is lockfile-free — provisioning must not dirty the tracked lock" {
-	# CLOUD-223: `[settings] lockfile = true` plus a cold ubi install appends a
-	# platform key `mise lock` cannot produce and `lock-complete` rejects, so
-	# every session began dirty and the residue was committed twice. Currency is
-	# lock-currency.yml's job, on a schedule; provisioning is a pure install.
-	run grep -qE 'MISE_LOCKFILE=false[[:space:]]+mise install' "$HOOK"
-	[ "$status" -eq 0 ]
-}
-
-@test "running the hook leaves the tracked lockfile untouched" {
-	# The end-to-end version of the assertion above, and the one that would have
-	# caught the original defect: the suite itself runs this hook.
-	# The one case the real install is genuinely load-bearing for: a stubbed
-	# install writes no lockfile, so it could not observe the residue CLOUD-223
-	# was about.
-	real_install_or_skip
-	local before after
-	before=$(git -C "$BATS_TEST_DIRNAME/.." status --porcelain -- mise.lock)
-	run env CLAUDE_PROJECT_DIR="$BATS_TEST_DIRNAME/.." "$HOOK"
-	[ "$status" -eq 0 ]
-	after=$(git -C "$BATS_TEST_DIRNAME/.." status --porcelain -- mise.lock)
-	[ "$before" = "$after" ]
-}
-
-@test "the git hooks are installed — the per-clone step that was absent" {
-	# CLOUD-476: `hk install` was named in two prose files, performed by nothing
-	# and asserted by nothing, so 24 commits in one container went through no
-	# gate. This is the end-to-end half; `doctor` decides the same state on every
-	# later run, and tests/git-hook.bats owns what the installed body does.
-	#
-	# Idempotent, and it installs into THIS clone — which is the point: the suite
-	# that asserts the step is also the thing that performs it here.
-	run env CLAUDE_PROJECT_DIR="$BATS_TEST_DIRNAME/.." "$HOOK"
-	[ "$status" -eq 0 ]
-
-	local root hooks name
-	root=$(cd "$BATS_TEST_DIRNAME/.." && pwd)
-	hooks=$(git -C "$root" rev-parse --git-path hooks)
-	for name in pre-commit commit-msg; do
-		[ -x "$hooks/$name" ]
-		# A symlink, not a copy: a copy is a second authority that goes stale the
-		# moment the checked-in body changes, and doctor would keep passing over it.
-		[ -L "$hooks/$name" ]
-		[ "$(readlink "$hooks/$name")" = "$root/.claude/hooks/git-hook.sh" ]
-	done
-}