From 0c22466fac8db8e4fccb92ec6a591fabfc4c3386 Mon Sep 17 00:00:00 2001
From: Alec Wenzowski <alec@wenzowski.com>
Date: Tue, 1 Sep 2026 06:33:07 +0000
Subject: [PATCH 1/5] docs(toolchain): correct the shell discriminator and the
 stale wiring blocker

Three comments in `[tasks."test:bats"]` said the body "runs under /bin/sh with
no `set -e`". Measured false: a mise task declaring no `shell =` runs under
`sh -e`, and `shell = "bash -c"` is the every-line-runs case. The discriminator
is a DECLARED SHELL, not the file. This cost a debugging cycle in #798, where a
bare call aborted the task before its own error branch could run.

`.claude/rules/toolchain.md` names the contrast at the section readers
generalise from, so the next author does not re-derive the three comments.

`batten.toml`'s `[hook] exclusive` blocker note named `hooks-wiring-check` on
the `$HOME` surface. That stopped being the blocker when CLOUD-1167 landed
`input.tree.external`. The real blocker is four live sibling registrations, and
the row now carries the table plus the measurement `siblings: 2,
merged_siblings: 2`.

Admits: 12bc0d5675f0158bf1441a5f15ea8ad6ad04b6e46b25c30153d189a44185b023
Admits-rule: protected-mutation
Admits-verdict: V-PROTECTED-MUTATION
Admits-subject: batten.toml
Admits-head: c52854e3e5c5761e84fc2ab2712f2decb1d199a4
Admits-epoch: c81e3ad211cddfce765e42d79469223b10d01ff822929696d3914e643004f748
Admits-author: alec@wenzowski.com
Admits-prev: -
Admits-answer-lost: The next reader scoping CLOUD-1160 is sent at a blocker that no longer exists instead of at the four live sibling registrations that are the real one. That already happened once this session and cost the row a wrong scoping before it was returned to Backlog.
Admits-answer-precondition: batten.toml is itself the owning surface for policy config, and the change is prose INSIDE it: the blocker note at :5185 names hooks-wiring-check on the $HOME surface, which stopped being the blocker when CLOUD-1167 landed input.tree.external. No other surface can express a correction to batten.toml's own comments, and the diff is three sentences a reviewer reads in place.
Admits-answer-rejected-route: R-USE-THE-OWNING-SURFACE does not apply because batten.toml IS the owning surface for its own comments; there is no narrower surface to redirect to. R-RESTORE-IT would discard the correction and leave the stale blocker naming a retired mechanism.

Refs: CLOUD-1085, CLOUD-1268, CLOUD-1160
---
 .claude/rules/toolchain.md | 10 ++++++++++
 batten.toml                | 26 ++++++++++++++++++++++----
 mise.toml                  | 34 ++++++++++++++++++++++++++--------
 3 files changed, 58 insertions(+), 12 deletions(-)

diff --git a/.claude/rules/toolchain.md b/.claude/rules/toolchain.md
index fab334298..a22cb33a9 100644
--- a/.claude/rules/toolchain.md
+++ b/.claude/rules/toolchain.md
@@ -785,6 +785,16 @@ prints the echo and exits 0). So in a **gate**, any command whose failure would
 change the verdict must be guarded explicitly — otherwise the gate reports on
 state it never refreshed, which is a silent false green and worse than no gate.
 
+**The declared shell is the discriminator, and reading this section without it is
+how three wrong comments landed** (CLOUD-1085, measured 2026-09-01). A task that
+declares NO `shell =` gets the default and `-e` with it, so there a bare failing
+command aborts the body where it stands rather than falling through. `test:bats`
+is such a task and its own comments claimed the opposite for their whole life;
+`verify` and `verify:gated` declare `shell = "bash -c"` and are the case this
+section is about. Guard either way — under `-e` the guard is what lets a step name
+its own failure instead of inheriting mise's — but do not carry "every line runs"
+across to a body that declared nothing.
+
 Two instances of this had already landed. `linear-check`'s `git fetch` fed the
 `origin/main` ref every later line reads, so a failed fetch left it comparing a
 stale main to itself, passing, and writing a receipt `ready-guard` then honours
diff --git a/batten.toml b/batten.toml
index cf849c97e..b30658093 100644
--- a/batten.toml
+++ b/batten.toml
@@ -5476,13 +5476,31 @@ wiring = [".claude/settings.json"]
 # remaining shell registration to move behind the door in the same change — and a
 # guard cannot go behind the door without changing how it denies, which
 # `shell-retirement` refuses for a governed file that is edited rather than
-# retired. Two of this repository's guards cannot be retired yet (`run-shape-guard`
-# on CLOUD-856, `hooks-wiring-check` on the `$HOME` surface), so declaring the flag
-# would force exactly the edits the ratchet exists to refuse.
+# retired. `run-shape-guard` cannot be retired yet (CLOUD-856), so declaring the
+# flag would force exactly the edit the ratchet exists to refuse.
+#
+# WHAT ACTUALLY HOLDS THE FLAG SHUT IS A COUNT, NOT A CAPABILITY, and the second
+# name in this sentence used to be wrong. It read "`hooks-wiring-check` on the
+# `$HOME` surface", which was true until CLOUD-1167 landed `input.tree.external`
+# — a declared path beneath a named root variable, which `policy/harness-wiring.rego`
+# already reads as `harness-settings`. The `$HOME` surface is answered.
+#
+# The live obstacle is that `exclusive` refuses EVERY non-batten registration and
+# four are live, measured 2026-09-01 (`doctor hooks -J`: `siblings: 2`,
+# `merged_siblings: 2` for claude-code), each with its own owner:
+#
+#   mise-tasks/run-shape-guard.sh      committed   CLOUD-856
+#   .claude/hooks/session-start.sh     committed   CLOUD-312 row 10
+#   session-start-git-identity.sh      $HOME       CLOUD-1079
+#   stop-hook-git-check.sh             $HOME       CLOUD-1079
+#
+# The last two are launcher-provisioned and rewritten at every session start, so
+# no commit here can clear them; CLOUD-1079's remedy is the environment
+# configuration that generates them. Evidence on CLOUD-1160.
 #
 # The capability is therefore shipped and unused, which is the honest state: a
 # consumer with no unretired registrations can declare it today, and this one
-# declares it when its last guard retires rather than by editing bash to qualify.
+# declares it when that count reaches zero rather than by editing bash to qualify.
 #
 # THE FIRST HANDLER, AND IT IS A WORKED EXAMPLE (CLOUD-898). `[[hook.action]]`
 # shipped with one because a plugin surface nobody uses is a surface nobody has
diff --git a/mise.toml b/mise.toml
index 851be5237..5bee0e46b 100644
--- a/mise.toml
+++ b/mise.toml
@@ -2113,8 +2113,23 @@ depends = ["doctor --no-targets"]
 # here. Output stays a pointer (rule 4) — two counts and the worker count, never
 # a case name.
 #
-# This body runs under /bin/sh with no `set -e`, so every step is guarded
-# explicitly rather than trusting the previous line.
+# This body runs under `/bin/sh` WITH `-e`, so a bare failing command aborts the
+# task where it stands. Every step is guarded explicitly anyway, which is
+# belt-and-braces rather than load-bearing — and the guards are what let a step
+# CHOOSE its exit code instead of inheriting the abort.
+#
+# CORRECTED 2026-09-01, measured. These three comments said "with no `set -e`" and
+# were wrong. The discriminator is a DECLARED SHELL, not the file: a task that
+# declares `shell = "bash -c"` really does run every line regardless — that is the
+# case `.claude/rules/toolchain.md` documents and `tests/task-fail-closed.bats`
+# gates, over `verify` and `verify:gated`, both of which declare it. This task
+# declares none, so it gets the default and `-e` with it. Observed while landing
+# CLOUD-1085: a bare call in a default body aborted the task before the branch
+# reporting which failure it was could run.
+#
+# The error direction was benign, which is why nothing broke: believing "no
+# `set -e`" makes an author ADD guards. An author who believed the opposite would
+# omit them, and that is the direction this correction exists to prevent.
 # Receipt-gated (CLOUD-424). Deliberately glob-less in step-receipt's table:
 # these suites read mise.toml, hk.pkl, workflows and fixture trees all over the
 # repo, so the honest input set is the whole tracked tree — a rebase that
@@ -2144,9 +2159,9 @@ if ./mise-tasks/step-receipt.sh check test:bats; then exit 0; fi
 # besides: it produces the RELEASE binary for the mediated-call hot path, while
 # `helpers.bash:119-134` and `common/mod.rs:154` both resolve a debug one.
 #
-# Guarded explicitly: this body runs under `/bin/sh` with no `set -e`, so an
-# unguarded build would leave the suite running against a stale artifact and
-# reporting green — the exact failure this clause exists to remove.
+# Guarded explicitly so the failure is NAMED: under the default `-e` an unguarded
+# build would abort the task with mise's own line and nothing about stale
+# artifacts, and the pointer is the whole value of this clause.
 if ! cargo build --quiet -p batten; then
   echo "::error:: test:bats: the debug binary did not build, so the suite would run against a stale artifact or none. That is CLOUD-592/699's class and the reason this step builds at all." >&2
   exit 1
@@ -2176,9 +2191,12 @@ export HOOKS_WIRING_DIAGNOSIS
 # FAIL OPEN TOWARD COST: a selector that cannot answer at all falls back to every
 # suite. The asymmetry is the whole design — a run that is too wide shows up in
 # the bill, and one that is too narrow has no symptom at all.
-# CLEARED ON A NONZERO SELECTOR (CLOUD-480, found on review of #660). This body
-# runs under `/bin/sh` with no `set -e` — the hazard `.claude/rules/toolchain.md`
-# records — so a selector that died partway left its PARTIAL output in `suites`,
+# CLEARED ON A NONZERO SELECTOR (CLOUD-480, found on review of #660). The guard is
+# required whichever way the shell is set, which is why it is written as a status
+# read rather than an emptiness test: under the default `-e` a bare assignment from
+# a failed substitution aborts the task, and without it the substitution leaves its
+# PARTIAL output behind. CLOUD-480 measured the second — a selector that died partway
+# left partial output in `suites`,
 # the emptiness check below then saw a non-empty value, and the fallback never
 # fired. A narrow run has no symptom, which is the asymmetry the fallback exists
 # to respect, so the guard has to read the status rather than the output.

From 7d1885809d9be12cfed87573118489fef1d3cfa5 Mon Sep 17 00:00:00 2001
From: Alec Wenzowski <alec@wenzowski.com>
Date: Tue, 1 Sep 2026 07:08:56 +0000
Subject: [PATCH 2/5] feat(hook): retire session-start.sh into ten declared
 handler rows
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CLOUD-312 row 10. `.claude/hooks/session-start.sh` was the last by-path hook
registration this repository owned. It did three separable things and only one
of them was its own:

  ordering   -> the declaration order of ten `[[hook.handler]] on = "session-start"`
                rows in batten.toml. `dispatch` runs handlers in config order, so
                install < doctor < preflight is now readable from the authority
                instead of grepped out of a stubbed call log.
  the bound  -> `timeout_ms`, imposed by the parent. The script had none, on any
                step, so a hung `mise install` wedged the session.
  the report -> `mise.toml`'s `session:*` tasks, which keep the `step` helper's
                log-and-tail contract verbatim. The door does not provide it:
                stdout on a passing exit is advisory text, so a step that prints
                on success would announce itself every session (CLOUD-891).

Verified by dispatching the real rows, not by reasoning about them: exit 0, the
whole provisioning ran, and the reply carried exactly the two lines the retired
script also emitted. `crates/batten/tests/session_provisioning.rs` is the tier —
ten cases over the compiled binary against a fixture whose handlers are stubs,
proving order, the bound (0.749s against a 30s sleep), silence on a pass, the
reason reaching the session on a failure, and that stdout is never forwarded.

The bootstrap objection that pulled this from #714 is answered rather than
argued: `deps-install` (CLOUD-1085, #798) puts the released binary on PATH at
provisioning, before Claude launches, so there is something to dispatch with.
`session:batten` then replaces it with this checkout's build.

Two corrections the live dispatch measured, both of my own writing:
`signing-posture` prints on success, so registered bare it added a line the
retired script's `step` wrapper had swallowed — repointed at `session:signing`;
and the claim that only `session-census` may speak was wrong, because
`container-preflight` speaks too and did under the old script as well.

NOT READY TO LAND. Three cases in two governed suites grep the retired script
and go red: `tests/commit-attribution.bats:41` and
`tests/container-preflight.bats:131,138`. Measured over the whole corpus —
those three and nothing else. Both suites declare subjects that survive
(`hk.pkl`, `mise.toml`, `mise-tasks/container-preflight.sh`), so
`bats-tests-not-deleted` refuses deleting them and `shell-retirement` refuses
editing them: `only_drops_a_retired_reference` admits a removed line that names
a retired path, and a removed `@test` block's other lines name nothing.
`V-SHELL-RULE-EDITED` declares no override and no bypass_env.

Admits: dddb39ae4779d81289438ea653f09f6610f0945146dd12f8dab939d528de807b
Admits-rule: protected-mutation
Admits-verdict: V-PROTECTED-MUTATION
Admits-subject: batten.toml
Admits-head: 094058e4e2b8477e28cfeecbe913e81e23e7b1d1
Admits-epoch: 121f33e1fca81092b00c148867959d9bf6cb54a82832540296b8b7f4fb2b7efb
Admits-author: alec@wenzowski.com
Admits-prev: 0d15402fe6e42f8c889653b827876c756c2d35c008671b41bf49c239f3b0360e
Admits-answer-lost: CLOUD-312 row 10 stays open, .claude/settings.json keeps the last by-path registration on any surface this repository owns, and 295 lines of bash keep ordering provisioning with no bound on any step. The verified work — ten rows, ten tasks, a compiled tier, and a live dispatch that returned exit 0 — would exist only in a container the platform reclaims.
Admits-answer-precondition: This commit writes ten hook.handler rows into batten.toml plus the corrections measured while dispatching them. The handler table is compiled-in config with no other surface: no mise task, rego module or CLI verb can add a row to it, so writing batten.toml directly is the only route, and every row lands in a diff a reviewer reads beside the script it replaces.
Admits-answer-rejected-route: R-USE-THE-OWNING-SURFACE does not apply: batten.toml is the owning surface for hook.handler and for its own comments. R-RESTORE-IT would discard the rows and leave the deleted script with nothing dispatching its steps.

Refs: CLOUD-312, CLOUD-1085, CLOUD-898
---
 .claude/hooks/session-start.sh                | 295 ---------
 .claude/rules/toolchain.md                    |  18 +-
 .claude/settings.json                         |  10 +-
 batten.toml                                   | 219 ++++++-
 crates/batten/tests/it/main.rs                |   1 +
 .../batten/tests/it/session_provisioning.rs   | 571 ++++++++++++++++++
 mise-tasks/hooks-wiring-check.sh              |   1 -
 mise.toml                                     | 151 +++++
 tests/session-start.bats                      | 205 -------
 9 files changed, 954 insertions(+), 517 deletions(-)
 delete mode 100755 .claude/hooks/session-start.sh
 create mode 100644 crates/batten/tests/it/session_provisioning.rs
 delete mode 100644 tests/session-start.bats

diff --git a/.claude/hooks/session-start.sh b/.claude/hooks/session-start.sh
deleted file mode 100755
index 61417bc91..000000000
--- a/.claude/hooks/session-start.sh
+++ /dev/null
@@ -1,295 +0,0 @@
-#!/usr/bin/env bash
-# SessionStart: perform the per-clone setup AGENTS.md documents, at the start of
-# the session.
-#
-# NOT before the MCP servers start, which this header claimed for its whole life
-# and CLOUD-734 measured false. Two samples, one per container incarnation on
-# 2026-08-19/20: the generated MCP config is written, the client opens its
-# connection logs ~2.4s later, and this hook writes its first byte ~5s after
-# that — the connections are initiated BEFORE the hook and complete while it is
-# still provisioning. What rescues the install fix below is therefore not
-# ordering but the client's 120s connect timeout: serena's connection was
-# established 45.5s in, from inside this hook's window. CLOUD-316 recorded that
-# timeout as 30s, at which this session would have lost serena outright.
-#
-# Why this exists (CLOUD-196). `.mcp.json` launches Serena with
-# `mise exec -- serena start-mcp-server`, and `mise exec` INSTALLS a missing
-# tool on demand. On a cold container that install runs inside the MCP client's
-# startup window: measured 24s for `pipx:serena-agent`, the handshake did not
-# complete, and MCP servers are not retried mid-session — so Serena was absent
-# for a whole session while being perfectly runnable seconds later. Nothing was
-# wrong with Serena or with mise; the per-clone `mise install` step simply never
-# ran, so `exec` was doing an installer's job at the worst possible moment.
-#
-# This hook is deliberately SYNCHRONOUS (no `{"async": true}` line). Async would
-# reintroduce exactly the race it exists to close: the session would start while
-# the install was still running. The cost is paid only when cold — a warm
-# `mise install` measured 0.067s.
-#
-# Failure is loud, never silent: a session that could not provision its
-# toolchain must say so, because the original defect's whole signature was an
-# absence with no error anywhere.
-#
-# This hook is NECESSARY BUT NOT SUFFICIENT. Measured on a genuinely cold
-# container: the hook ran and completed before the session started, serena was
-# installed and startable (21 tools, 1.1s warm) — and it was STILL absent from
-# the session. A `.mcp.json` server is project-scoped and requires per-project
-# approval; a cold container gets a fresh `~/.claude.json` whose
-# `enabledMcpjsonServers` is `[]`, and a remote session has nobody to answer the
-# approval prompt. That second gate is closed by committing
-# `"enabledMcpjsonServers": ["serena"]` in .claude/settings.json — do not remove
-# it thinking this hook covers the case. Both are load-bearing.
-#
-# It also PREFLIGHTS THE CONTAINER (CLOUD-261), by calling `container-preflight`
-# after provisioning. "The toolchain installed" and "this container can do the
-# work" are different questions, and the second one used to be answered three
-# tasks in, by a failure wearing someone else's name. That task owns the what
-# and the why; this hook owns only the WHEN — the very beginning of the session,
-# before any work is planned against a container that cannot land it.
-set -uo pipefail
-
-cd "${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel)}" || exit 0
-
-# THE SESSION STAMP (CLOUD-431), written before anything else this hook does.
-#
-# `claim-check`'s `refined-this-session` rule compares an issue's tracker-minted
-# `updatedAt` against this file's mtime: refinement must PREDATE the session that
-# implements it. That predicate is only honest if the stamp marks the beginning
-# of the session, so it is written here — above the provisioning steps, and above
-# the `exit 1` a degraded container takes — rather than appended at the end. A
-# session whose install failed still began, and a stamp written after the work
-# would date the session to whenever the agent got round to claiming, which is
-# exactly the ordering the rule exists to refuse.
-#
-# Silent and never fatal: this hook's job is setup, and a clone whose git dir is
-# unwritable has larger problems than the claim gate. `claim-check` refuses on a
-# MISSING stamp rather than passing, so a failure here fails closed downstream.
-if stamp_dir=$(git rev-parse --git-dir 2>/dev/null) &&
-	mkdir -p "$stamp_dir/batten-receipts" 2>/dev/null; then
-	: >"$stamp_dir/batten-receipts/session-start" 2>/dev/null || true
-fi
-
-fail=0
-step() { # step <label> <cmd...>
-	local label="$1"
-	shift
-	if ! "$@" >/tmp/session-start-"$label".log 2>&1; then
-		echo "::error:: session-start: $label failed — see /tmp/session-start-$label.log" >&2
-		tail -5 /tmp/session-start-"$label".log >&2
-		fail=1
-	fi
-}
-
-# The three per-clone steps from AGENTS.md ("Per clone: mise install, git
-# submodule update --init, hk install"), each idempotent.
-#
-# mise install is the load-bearing one: it is what makes `mise exec` in
-# .mcp.json a pure exec rather than an implicit install.
-#
-# MISE_LOCKFILE=false makes it a PURE install (CLOUD-223). A cold install of
-# `ubi:rust-cross/cargo-zigbuild` otherwise appends
-# `platforms.linux-x64-cargo-zigbuild` — platform plus the exe name, checksum,
-# no url — to the tracked lockfile. `mise lock` cannot produce that key
-# (measured: it locks 0 platform entries for the ubi backend, all 7 skipped), so
-# it is install residue rather than a lock, and `mise run lock-complete` rejects
-# it by name. Every session therefore opened with a dirty tree and a red gate no
-# branch had caused, and it got committed twice: 17b8436, reverted by 3bee7d2,
-# then a7cef00 on a branch named for unrelated work. Warm installs never rewrite
-# it, so the cost looked intermittent.
-#
-# The authority is now `[settings] lockfile = false` in mise.toml, which denies
-# the write to EVERY caller — including the sandbox's own provisioning, which
-# runs before this hook and so kept dirtying the tree after the per-caller fix
-# landed. This line is the belt to that suspenders: it keeps the install pure
-# even where the setting is overridden by an ambient MISE_LOCKFILE. Asserted by
-# tests/session-start.bats.
-#
-# Provisioning has no business writing the lockfile at all: currency is owned by
-# .github/workflows/lock-currency.yml, on a schedule, off the landing path.
-step mise-install env MISE_LOCKFILE=false mise install
-# bats lives in tests/bats; `mise run test:bats` cannot run without it.
-step submodules git submodule update --init --recursive
-
-# `doctor` joins the same synchronous window (CLOUD-218). `mise install` returning
-# is not "the toolchain is settled": doctor provisions what mise does NOT own —
-# the rustup cross targets above all — and left outside this window it runs for
-# the first time inside the first `mise run verify`, concurrently with whatever
-# else the sandbox is still laying down. Measured on a cold container
-# 2026-08-07: that first verify died in doctor with
-#
-#   error: failed to install component: 'rust-std-aarch64-apple-darwin',
-#   detected conflict: '.../libaddr2line-….rlib'
-#   ::error:: could not install rust target aarch64-apple-darwin; …
-#
-# and a second doctor, nothing changed but time, exited 0. The message names
-# cross-compilation, so it costs the reader a debugging session on a machine
-# where nothing is broken — CLOUD-196's failure mode in different clothes.
-#
-# This is not a retry: it does not make the race survivable, it empties the
-# window the race needs. CLOUD-220's per-toolchain mutex in `target-ensure`
-# serializes concurrent WRITERS; this leaves the later ones nothing to write,
-# because by the time any task runs the targets are already installed. Both
-# stand — the mutex covers the warm case (the verify graph racing itself,
-# CLOUD-201), this covers the cold one.
-#
-# `doctor` itself is unchanged, and runs AFTER the two steps above: its rustup
-# half needs the mise-provisioned toolchain, and its submodule half is a repair
-# for the case the step above did not reach. It goes through `step`, so the
-# loud-failure contract is the same as every other one — a `::error::` line, the
-# log pointer, and a non-zero exit at the end.
-step doctor mise run doctor
-
-# The binary every hook registration executes (CLOUD-312). Built and INSTALLED
-# here, in the synchronous provisioning window, for the same reason the steps
-# above are: a fresh container has no `target/`, so without this a session would
-# start with policy unenforced — a state the guards it replaced could not reach.
-#
-# `install:local` rather than `build:release` since CLOUD-824. The registrations
-# used to name `.claude/hooks/batten-hook.sh`, a launcher whose four-candidate
-# binary search let a session run with `target/release` and nothing else; they
-# now name `batten` directly, as the other four harnesses always did, so the
-# binary has to be somewhere PATH resolves. `install:local` puts it at
-# `install.sh`'s own destination.
-#
-# THIS STEP IS NOW THE WHOLE "no binary" REPORT, and it is louder than what it
-# replaces. The launcher failed open with a stderr line and a once-per-session
-# `$TMPDIR` marker — the quietest report this repository produces. `step` emits
-# `::error::`, the log pointer, and a non-zero exit, so a session that cannot
-# mediate says so at the moment it could still be fixed rather than on the first
-# tool call.
-step batten-build mise run install:local
-
-# The third per-clone step from AGENTS.md, performed at last (CLOUD-476).
-#
-# It used to be deliberately absent, and the reasoning was sound as far as it
-# went: `hk install` writes `exec hk run pre-commit`, calling `hk` BARE, which
-# resolves only where mise's shims are on PATH. In this environment they are
-# not, so that hook makes every `git commit` fail with `hk: not found` —
-# measured, on the very commit that added the step. A broken hook is worse than
-# none, so the step was dropped and 24 commits in one container went through no
-# gate at all.
-#
-# The answer is not to run `hk install` but to install a hook this repo owns:
-# `.claude/hooks/git-hook.sh` resolves `hk` through `mise exec --`, which is the
-# form that works here, and refuses to re-enter a gate that is already running.
-# Both properties are its own file's to explain; this step owns only the WHEN.
-#
-# A symlink, not a copy: a copy is a second authority that goes stale silently
-# the moment the checked-in body changes, and `doctor` would keep passing over
-# it. `-f` so a clone carrying hk's generated hook is repaired rather than
-# skipped, which is the state every existing clone is in.
-install_git_hooks() {
-	local root hooks src name
-	root=$(git rev-parse --show-toplevel) || return 1
-	hooks=$(git rev-parse --git-path hooks) || return 1
-	src="$root/.claude/hooks/git-hook.sh"
-	[[ -x "$src" ]] || {
-		echo "no executable hook body at $src" >&2
-		return 1
-	}
-	mkdir -p "$hooks" || return 1
-	# Both hooks hk defines (hk.pkl `hooks`), through one body that dispatches on
-	# the name it is invoked as. commit-msg carries the Conventional Commits
-	# check that release-plz's semver depends on, so leaving it out would gate
-	# the expensive half and not the one that decides a version.
-	for name in pre-commit commit-msg; do
-		ln -sfn "$src" "$hooks/$name" || return 1
-	done
-}
-step git-hooks install_git_hooks
-# The repo-local git identity, set before the session writes a line (CLOUD-274).
-#
-# It belongs in this window for the same reason `doctor` does: the vendor identity
-# is injected at the environment level, so a fresh clone is already carrying it
-# before any work starts, and the first thing that would notice is `commit-lint`
-# refusing a branch whose commits are all already written. Setting it here means
-# the gate has nothing to catch — feedforward that costs one idempotent git config
-# read, rather than a refusal an agent has to unwind with a rebase.
-#
-# After `batten-build`, because this is the engine answering: the policy is
-# `[attribution]` in batten.toml and `batten attribution identity` is what reads
-# it. A WRITE, self-declared as one (house style §5), scoped to .git/config in
-# this checkout — never --global, which covers a developer's own unrelated
-# repositories. An identity a contributor set accountably is left exactly alone.
-step attribution-identity mise run attribution-identity
-
-# The not-signing posture, put into force in the same window and for the same
-# reason (CLOUD-669). CLOUD-591 decided it — "the interim posture is not to
-# sign" — and shipped no mechanism, so it was never once in force: the launcher
-# writes `commit.gpgsign true` --global every session, and local beats global
-# only if something writes local.
-#
-# The identity repair above and this are the same defect on two fields. The
-# author field was gated and repaired; the SIGNATURE was neither, so every
-# commit carried the environment's own key — one this repo does not hold, cannot
-# publish, and which GitHub reports as `unknown_key`. `Attribution` has no
-# signature field, so `identity_deny` structurally cannot see it.
-#
-# Before any commit is written, for the reason stated above: a repair that lands
-# after the fact leaves signed commits that only a rebase can unwind.
-step signing-posture mise run signing-posture --repair
-
-# `hk install` is deliberately NOT run here, though AGENTS.md lists it as a
-# per-clone step. The hook it generates is `exec hk run pre-commit`, calling
-# `hk` bare — which resolves only where mise's shims are on PATH. In this
-# environment they are not, so installing it makes every `git commit` fail with
-# `hk: not found`. Measured: adding the step here broke the very commit that
-# added it. The gate is still enforced, by `mise run ci`/`verify` and by CI;
-# a local pre-commit hook is a convenience, and a broken one is worse than
-# none. Restoring it needs the PATH question answered first (CLOUD-196).
-
-if [[ "$fail" -ne 0 ]]; then
-	echo "::error:: session-start: setup incomplete — expect missing tools or MCP servers" >&2
-fi
-
-# --- can this container do the work at all? -----------------------------------
-#
-# Provisioning succeeding is a different question from the container being
-# usable, and the difference is invisible until a task deep in the lifecycle
-# fails in someone else's name. `container-preflight` asks the second question
-# and halts on it; see that task for what it checks and why each is unrepairable
-# from inside the session.
-#
-# It runs even when provisioning failed, because a failed install is usually a
-# SYMPTOM of what it diagnoses (a proxied api.github.com), and reporting the
-# cause beside the symptom is the whole point. Its own `--degraded` argument
-# tells it not to trust toolchain-dependent probes in that state.
-if [[ "$fail" -ne 0 ]]; then
-	mise run container-preflight -- --degraded || fail=1
-else
-	mise run container-preflight || fail=1
-fi
-
-# --- what was running when the container we replaced went down? ---------------
-#
-# CLOUD-451. The reclaim destroys a human's typed approval, and one mechanism has
-# already been built against it and removed (CLOUD-515) because nobody could say
-# whether occupancy was even the right lever. `reclaim-census` collects that
-# evidence off `land-lock hold`'s existing beat; this is where it is read back.
-#
-# RECORD BEFORE READ, and the order is load-bearing: recording this boot after
-# reading would make it part of the evidence it is being compared against.
-#
-# NEVER SETS `fail`, and deliberately not routed through `step`: a verdict about
-# a past container is not a provisioning failure, and halting a session over one
-# would be the sensor deciding something it has no business deciding. Only the
-# positive reading speaks — exit 1 (idle when replaced) and exit 2 (cannot look)
-# are silent, because a line every session start would be noise in the
-# overwhelming case where nothing happened. Pointer-only: a verdict and two
-# epochs, never a plan or a prompt body.
-# Relative, because this script has already `cd`ed to the repo root above, and
-# `CLAUDE_PROJECT_DIR` is only conditionally set, which `set -u` would fault on.
-census="mise-tasks/reclaim-census.sh"
-if [[ -x "$census" ]]; then
-	"$census" record-boot >/dev/null 2>&1 || true
-	if verdict=$("$census" report 2>/dev/null); then
-		echo "$verdict"
-	fi
-fi
-
-if [[ "$fail" -ne 0 ]]; then
-	exit 1
-fi
-# SILENCE ON THE NORMAL PATH (CLOUD-891). The failure paths above already speak;
-# this line only ever said "nothing went wrong", once per session, to a reader
-# with no action to take. See `mcp-attach-check` for the argument.
diff --git a/.claude/rules/toolchain.md b/.claude/rules/toolchain.md
index a22cb33a9..8da1ddf88 100644
--- a/.claude/rules/toolchain.md
+++ b/.claude/rules/toolchain.md
@@ -15,9 +15,21 @@ These load when you touch the workshop; deeper detail is in
 **Use mise for everything** — tools via `[tools]`, env via `[env]`, commands as
 `[tasks]` run with `mise run`; never a bare `cargo`/`export`/one-off install, so
 CI, hk, and your shell run byte-identical commands. Per clone: `mise install`,
-`git submodule update --init` (bats, in `tests/bats`), and the git hooks — which
-`.claude/hooks/session-start.sh` now performs and `doctor` asserts (CLOUD-476),
-so none of the three is left to a human remembering a prose list. Not `hk
+`git submodule update --init` (bats, in `tests/bats`), and the git hooks — none
+of the three left to a human remembering a prose list, because each is a
+`session:*` task that `batten.toml` declares as a `[[hook.handler]] on =
+"session-start"` and `doctor` asserts afterwards (CLOUD-476, CLOUD-312 row 10).
+
+**The provisioning order and its bounds are `batten.toml`'s, not a script's.**
+The ten `session-*` handler rows ARE the sequence: declaration order is running
+order, each row declares its own `timeout_ms`, and `batten hook` dispatches them
+inline at session start. `.claude/hooks/session-start.sh` used to hold all of
+that and was the last by-path hook registration this repository owned; it is
+retired, and `crates/batten/tests/session_provisioning.rs` carries both its
+ledger and the tier that proves the door does what the rows say. Add a
+provisioning step by adding a task and a row — never by putting a second step
+inside an existing task's body, which is the shape that made the script
+unreadable from the committed authority. Not `hk
 install`: its generated hook calls `hk` bare, which does not resolve where
 mise's shims are off PATH, so the installed body is `.claude/hooks/git-hook.sh` —
 which also refuses to re-enter a gate that is already running, the recursion
diff --git a/.claude/settings.json b/.claude/settings.json
index b1632f516..a018511f0 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -54,14 +54,6 @@
             "command": "batten hook --harness claude-code"
           }
         ]
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/session-start.sh"
-          }
-        ]
       }
     ],
     "TaskCompleted": [
@@ -123,7 +115,7 @@
   "autoMode": {
     "environment": [
       "$defaults",
-      "This checkout is button-inc/batten, whose product IS `batten` — a repo-agnostic completion gate. The binary is built from crates/batten in this working directory and installed to ~/.local/bin/batten by .claude/session-start.sh via `mise run install:local`. It is not a third-party download and will not appear on any known-tool list. Every workflow here runs through it, directly or as a subprocess of a `mise run` task."
+      "This checkout is button-inc/batten, whose product IS `batten` — a repo-agnostic completion gate. The binary is built from crates/batten in this working directory and installed to ~/.local/bin/batten twice over: the released build by `mise run deps-install` at container provisioning, then this checkout's own by the `session-batten` handler `batten.toml` declares. It is not a third-party download and will not appear on any known-tool list. Every workflow here runs through it, directly or as a subprocess of a `mise run` task."
     ],
     "allow": [
       "$defaults",
diff --git a/batten.toml b/batten.toml
index b30658093..8ccbb05ca 100644
--- a/batten.toml
+++ b/batten.toml
@@ -5485,12 +5485,14 @@ wiring = [".claude/settings.json"]
 # — a declared path beneath a named root variable, which `policy/harness-wiring.rego`
 # already reads as `harness-settings`. The `$HOME` surface is answered.
 #
-# The live obstacle is that `exclusive` refuses EVERY non-batten registration and
-# four are live, measured 2026-09-01 (`doctor hooks -J`: `siblings: 2`,
-# `merged_siblings: 2` for claude-code), each with its own owner:
+# The live obstacle is that `exclusive` refuses EVERY non-batten registration.
+# Four were live when this note was written, measured 2026-09-01 (`doctor hooks
+# -J`: `siblings: 2`, `merged_siblings: 2` for claude-code). **THIS COMMIT
+# CLEARS ONE OF THEM** — the `session-*` handler rows below retire
+# `.claude/hooks/session-start.sh`, so the committed surface now carries one
+# sibling rather than two. Three remain:
 #
 #   mise-tasks/run-shape-guard.sh      committed   CLOUD-856
-#   .claude/hooks/session-start.sh     committed   CLOUD-312 row 10
 #   session-start-git-identity.sh      $HOME       CLOUD-1079
 #   stop-hook-git-check.sh             $HOME       CLOUD-1079
 #
@@ -5498,6 +5500,13 @@ wiring = [".claude/settings.json"]
 # no commit here can clear them; CLOUD-1079's remedy is the environment
 # configuration that generates them. Evidence on CLOUD-1160.
 #
+# So the flag is now ONE committed retirement away, and that one is CLOUD-856's:
+# `run-shape-guard` cannot move until its last family has a mediated-call
+# surface. The `$HOME` pair does not block the COMMITTED surface — `doctor`
+# reports `siblings` and `merged_siblings` separately — so a per-surface
+# `exclusive` would already be declarable, which is the shape CLOUD-1160 should
+# consider rather than waiting for a global zero.
+#
 # The capability is therefore shipped and unused, which is the honest state: a
 # consumer with no unretired registrations can declare it today, and this one
 # declares it when that count reaches zero rather than by editing bash to qualify.
@@ -5663,6 +5672,208 @@ timeout_ms = 2000
 owner = "CLOUD-312"
 expires = "2027-02-28"
 
+# ---------------------------------------------------------------------------
+# CLOUD-312 ROW 10: `.claude/hooks/session-start.sh` RETIRES, AND ITS ORDER
+# BECOMES THIS LIST.
+#
+# The last by-path registration in `.claude/settings.json` is gone with it, so
+# every event on every harness now names `batten hook` by bare name and nothing
+# else. `doctor hooks` reports `siblings` for `claude-code` falling from 2 to 1;
+# the remainder is `run-shape-guard`, whose own retirement is CLOUD-856's.
+#
+# WHAT MOVED, AND WHERE. The script did three separable things, and only one of
+# them was its own:
+#
+#   ordering   -> the DECLARATION ORDER of the ten rows below. `dispatch` runs
+#                 handlers for an event in the order the config lists them, which
+#                 `Dispatched::refusal`'s doc states is why order is the running
+#                 order: a reader predicts it from the file rather than from a
+#                 rule. The `install < doctor < preflight` ordering the retired
+#                 suite asserted by grepping a call log is now readable directly.
+#   the bound  -> `timeout_ms`, imposed by the PARENT. The script had none at
+#                 all, on any step, and a hung `mise install` wedged the session.
+#   the report -> `mise.toml`'s `session:*` tasks, which are the `step` helper's
+#                 log-and-tail contract kept verbatim. That half stayed in a task
+#                 because the door does not provide it: stdout on a passing exit
+#                 is ADVISORY TEXT, so a step that prints on success would put a
+#                 line in every session saying nothing went wrong — the
+#                 announcement CLOUD-891 removed from this hook.
+#
+# THE BOOTSTRAP OBJECTION IS ANSWERED RATHER THAN ARGUED. A handler is dispatched
+# BY the binary, so this shape is only sound if something installs `batten`
+# before the first hook fires. #714 pulled this move because nothing did.
+# CLOUD-1085 closed that: `deps-install` runs from the environment's own
+# provisioning script, before Claude launches, and puts the RELEASED binary on
+# PATH. Verified warm on 2026-09-01 — `/root/.local/bin/batten`, v0.0.137,
+# `verified=sha256`, resolving by bare name. `session:batten` below then replaces
+# it with this checkout's build, because consumer #1 judges the engine it ships.
+#
+# THE RESIDUAL EXPOSURE, STATED BECAUSE IT IS REAL AND NOT MINE TO CLOSE. If
+# `deps-install` does not run, no binary dispatches these rows and nothing
+# provisions — where the old script, registered by path, would still have run.
+# Three things stand against it: the environment's setup script independently
+# runs `mise install` and `mise reshim`, so the toolchain survives; every
+# `session:*` task stays reachable by hand, so a degraded container has a manual
+# repair; and `contract::unmediated_session` (#798) reports a session whose
+# SessionStart never reached the engine instead of failing open in silence.
+#
+# EVERY BOUND BELOW IS COLD-SIZED, WHICH IS THE OPPOSITE STANDARD FROM
+# `mcp-attach-check`'s AND DELIBERATELY SO. That row's 2000ms is two orders above
+# a measured warm path, because a handler that reads two `jq` documents has no
+# cold case. These rows ARE the cold case: this whole surface exists because a
+# cold `mise install` took 24s inside the MCP client's startup window, and
+# CLOUD-1085 measured a cold `install:local` at 141s. A bound tighter than the
+# cold path turns a fail-open handler into the absence the hook was built to
+# close, so each is sized against the slowest honest run of that step and not
+# against the warm one this container measures.
+
+[[hook.handler]]
+id = "session-stamp"
+on = "session-start"
+run = ["mise", "run", "session:stamp"]
+# Two `git rev-parse` calls and a truncation. Nothing here can be slow, and a
+# bound this tight is the statement: a stamp that needs ten seconds is broken.
+timeout_ms = 10000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-install"
+on = "session-start"
+run = ["mise", "run", "session:install"]
+# Ten minutes. The measured cold figure for ONE tool was 24s (`pipx:serena-agent`,
+# CLOUD-196); this installs the whole `[tools]` table on a container with no
+# cache, and it is the step every other one depends on.
+timeout_ms = 600000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-submodules"
+on = "session-start"
+run = ["mise", "run", "session:submodules"]
+# A shallow network clone of `tests/bats`. Two minutes is generous for one small
+# repository and short enough that a hung transport does not hold the session.
+timeout_ms = 120000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-doctor"
+on = "session-start"
+run = ["mise", "run", "session:doctor"]
+# Fifteen minutes, the longest bound here and the one with the least measurement
+# behind it: doctor's rustup half installs cross targets over the network, and
+# the failure this step exists to prevent (CLOUD-218's `detected conflict`) is
+# itself a symptom of that install being slow enough to race something else.
+timeout_ms = 900000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-batten"
+on = "session-start"
+run = ["mise", "run", "session:batten"]
+# Ten minutes against a MEASURED 141s cold release build (CLOUD-1085's table,
+# `/tmp/session-start-batten-build.log`). Four times the measurement, because
+# the measurement was taken on a warm dependency cache and a cold one compiles
+# the whole graph.
+timeout_ms = 600000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-git-hooks"
+on = "session-start"
+run = ["mise", "run", "session:git-hooks"]
+# Two symlinks. Same reasoning as `session-stamp`.
+timeout_ms = 10000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-attribution-identity"
+on = "session-start"
+run = ["mise", "run", "session:identity"]
+# AFTER `session-batten`, because this is the ENGINE answering: the policy is
+# `[attribution]` in this file and `batten attribution identity` is what reads
+# it. The task spells `cargo run`, so a cold container pays a debug build here
+# that the release build above does not cover — which is what the ten minutes is
+# for, not the identity write itself.
+#
+# It belongs in the provisioning window at all because the vendor identity is
+# injected at the environment level: a fresh clone carries it before any work
+# starts, and the first thing that would notice is `commit-attribution` refusing
+# a branch whose commits are all already written.
+timeout_ms = 600000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-signing-posture"
+on = "session-start"
+run = ["mise", "run", "session:signing"]
+# The signature half of the same defect (CLOUD-669). CLOUD-591 decided the
+# interim posture is not to sign and shipped no mechanism, so it was never once
+# in force: the launcher writes `commit.gpgsign true` --global every session, and
+# local beats global only if something writes local. `Attribution` has no
+# signature field, so `identity_deny` structurally cannot see it.
+#
+# Before any commit is written, for the reason above it: a repair that lands
+# after the fact leaves signed commits only a rebase can unwind.
+timeout_ms = 600000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-container-preflight"
+on = "session-start"
+run = ["mise", "run", "container-preflight"]
+# LAST OF THE STEPS THAT CAN HALT, and that position is the whole point
+# (CLOUD-261). "The toolchain installed" and "this container can do the work" are
+# different questions, and the second used to be answered three tasks in, by a
+# failure wearing someone else's name.
+#
+# THE `--degraded` ARM IS GONE AND THAT IS A FIDELITY LOSS, recorded here rather
+# than glossed. The script tracked a `fail` variable across its steps and passed
+# `--degraded` when an earlier one had failed, telling the preflight not to trust
+# toolchain-dependent probes. Handlers do not share state — each is its own
+# process with its own outcome — so this now always runs the full probe set. The
+# consequence is a preflight that may report a toolchain-dependent probe failing
+# on a container whose install already failed: a second symptom of one cause
+# rather than a wrong answer, and both refusals are in the same reply. Recovering
+# the arm needs a fact the door does not carry today.
+timeout_ms = 120000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
+[[hook.handler]]
+id = "session-census"
+on = "session-start"
+run = ["mise", "run", "session:census"]
+# LAST, AND ONE OF THE TWO ROWS THAT MAY SPEAK ON THE NORMAL PATH. Its report is
+# something this hook has to say to a reader with an action to take — what was
+# running when the container we replaced went down (CLOUD-451) — so its stdout is
+# deliberately left to become advisory text.
+#
+# THE OTHER IS `session-container-preflight`, and the count was wrong here until
+# it was measured: dispatching these rows for real on 2026-09-01 returned
+# `signing-posture: …` and `container-preflight: egress fenced, …` in the
+# advisory, where this comment claimed one line. Both were the retired script's
+# behaviour too — it ran `container-preflight` and the census directly and
+# `step`-wrapped everything else — so the preflight's line stays and the signing
+# row was repointed at a wrapped task to restore the silence it had. The lesson is
+# the one this file keeps re-learning: a claim about what a row PRINTS is a
+# measurement, and every other row above is silent by construction only because a
+# task makes it so.
+#
+# It is also the only row that cannot fail the session: the task swallows both
+# its exits, because a verdict about a PAST container is not a provisioning
+# failure.
+timeout_ms = 30000
+owner = "CLOUD-312"
+expires = "2027-02-28"
+
 # ---------------------------------------------------------------------------
 # THE REFUSAL VOCABULARY (CLOUD-1050).
 #
diff --git a/crates/batten/tests/it/main.rs b/crates/batten/tests/it/main.rs
index 2f17af496..4028a7773 100644
--- a/crates/batten/tests/it/main.rs
+++ b/crates/batten/tests/it/main.rs
@@ -160,6 +160,7 @@ mod runner_verdict;
 mod scanner_taxonomy;
 mod secrets_kind;
 mod semver_gate;
+mod session_provisioning;
 mod shell_retirement;
 mod shell_write_advisory;
 mod sinks;
diff --git a/crates/batten/tests/it/session_provisioning.rs b/crates/batten/tests/it/session_provisioning.rs
new file mode 100644
index 000000000..d435de55a
--- /dev/null
+++ b/crates/batten/tests/it/session_provisioning.rs
@@ -0,0 +1,571 @@
+//! Session-start provisioning, driven THROUGH the door, over the compiled binary
+//! (CLOUD-312 row 10).
+//!
+//! # What retired, and what this is the second tier of
+//!
+//! `.claude/hooks/session-start.sh` was 295 lines of bash registered by path on
+//! `SessionStart` — the last by-path registration on any surface this repository
+//! owns. It did three separable things, and only one of them was its own:
+//!
+//! * it ORDERED a list of provisioning steps,
+//! * it BOUNDED none of them,
+//! * it wrapped each in a `step` helper that logged to a file and tailed five
+//!   lines to stderr on failure.
+//!
+//! The first two are now `batten.toml`'s: ten `[[hook.handler]] on =
+//! "session-start"` rows, whose declaration order IS the running order and whose
+//! `timeout_ms` is imposed by the parent. The third stayed, as `mise.toml`'s
+//! `session:*` tasks, because the door does not provide it.
+//!
+//! # Why the retired suite could not be this tier
+//!
+//! `tests/session-start.bats` ran the script directly and read what it printed.
+//! That is the bash equivalent of a Rego module's `with input as`, and
+//! `.claude/rules/policy-modules.md` names its failure exactly: it fabricates
+//! the shape the ENGINE may be unable to consume. Its ordering case is the
+//! sharpest instance — it stubbed `mise`, ran the hook, and grepped a call log
+//! for line numbers. That observes bash, not dispatch. Here the same property is
+//! read off `Dispatched`, which is the thing that will actually run it.
+//!
+//! # The stubs are the design, not a shortcut
+//!
+//! Every case below runs against a fixture repository whose handlers are stub
+//! programs with a chosen exit status and stdout. Driving the REAL rows would
+//! run `mise install`, `mise run doctor` and a release build — 141 seconds
+//! measured cold (CLOUD-1085) — inside `test:cargo`, which is the cost
+//! CLOUD-1268 exists to stop moving from one lane to another. It would also stop
+//! discriminating: a case that provisions a container tests the container.
+//!
+//! The one case that reads the committed `batten.toml` reads it as a DOCUMENT,
+//! asserting what is declared rather than running it. That split is deliberate —
+//! the engine's behaviour is proved against stubs, and the declaration is proved
+//! against the file that ships.
+//!
+//! # RETIREMENT LEDGER, PER PATH — what `shell-retirement` reads
+//!
+//! `.claude/hooks/session-start.sh` is not in `governed_when_deleted` (that set
+//! is `mise-tasks/` paths and `.bats` suites), so it owes no arm. The suite does.
+//!
+//! The policy surface is `crates/batten/src/handler.rs`: the properties the
+//! retired suite pinned about the SCRIPT — that it is synchronous, that it fails
+//! loudly, that it does not tell the host to start early — are now properties of
+//! the door, held for every dispatched program rather than re-derived in each.
+//! `kind:mechanism` and not `kind:verb`: no command surface widened, and the
+//! module is read by `batten hook`, which already existed.
+//!
+// carried: tests/session-start.bats crates/batten/src/handler.rs kind:mechanism crates/batten/tests/it/session_provisioning.rs
+//!
+//! # RETIREMENT LEDGER — `tests/session-start.bats`, 10 cases
+//!
+//! CARRIED — the property survives, proved here against the engine or against
+//! the committed declaration.
+//!
+// carried: "doctor runs inside the synchronous window — after install, before the preflight" crates/batten/tests/it/session_provisioning.rs
+// carried: "mise install runs — the step whose absence was the defect" crates/batten/tests/it/session_provisioning.rs
+// carried: "the install is lockfile-free — provisioning must not dirty the tracked lock" crates/batten/tests/it/session_provisioning.rs
+// carried: "a failed step exits non-zero — absence must never be silent" crates/batten/tests/it/session_provisioning.rs
+// carried: "the hook is registered as a SessionStart hook" crates/batten/tests/it/session_provisioning.rs
+//!
+//! SUBSUMED — the property became the door's, held for every handler rather than
+//! for this one program. Each names where it now lives.
+//!
+// subsumed: "the hook is executable" crates/batten/src/handler.rs kind:mechanism
+// subsumed: "the hook is synchronous — async would restore the race it closes" crates/batten/src/handler.rs kind:mechanism
+//!
+//! CHANGED — the property is narrower than it was, and each of these is a real
+//! fidelity loss rather than a relabelling. Stated at the granularity CLOUD-908
+//! demands: what the case asserted, and what now holds instead.
+//!
+//! * `"the hook runs green on this checkout"` ran the WHOLE provisioning
+//!   end to end and asserted exit 0 with empty stdout. The exit-0-and-silent half
+//!   is carried below against stubs; the end-to-end half is gone, because
+//!   dispatching the real rows means provisioning a container inside the test
+//!   suite. What covers it instead is the session itself: a failed step now
+//!   reports on the advisory channel at the moment it fails.
+//! * `"running the hook leaves the tracked lockfile untouched"` was the
+//!   end-to-end half of the CLOUD-223 residue check. `[settings] lockfile = false`
+//!   in `mise.toml` is the authority and `mise run lock-complete` is the standing
+//!   gate; what is lost is the observation that THIS provisioning path honours it,
+//!   and `session:install` carrying `MISE_LOCKFILE=false` is asserted below as the
+//!   declaration rather than as the effect.
+//! * `"the git hooks are installed — the per-clone step that was absent"` ran the
+//!   hook and then stat-ed two symlinks. `doctor` decides that same state on every
+//!   later run — which the retired case's own comment already named as its
+//!   backstop — and `tests/git-hook.bats` owns what the installed body does. What
+//!   is lost is the end-to-end pairing of the step with its effect in one case.
+//!
+// changed: "the hook runs green on this checkout" crates/batten/tests/it/session_provisioning.rs the exit-0-and-silent half survives as `a_step_that_passes_says_nothing`, against stubs; the END-TO-END half is withdrawn, because dispatching the real rows provisions a container inside `test:cargo` — 141s measured cold — which is the cost CLOUD-1268 exists to stop moving between lanes. What covers it instead is the session itself: a failed step reports on the advisory channel at the moment it fails
+// changed: "running the hook leaves the tracked lockfile untouched" crates/batten/tests/it/session_provisioning.rs narrowed from the EFFECT to the DECLARATION: `the_install_step_is_declared_lockfile_free` asserts `session:install` carries MISE_LOCKFILE=false, where the retired case ran the hook and diffed `git status -- mise.lock`. `[settings] lockfile = false` in mise.toml is the standing authority and `lock-complete` the standing gate; what is lost is the observation that this particular path honours it
+// changed: "the session-start hook calls it — the whole point is WHEN it runs" crates/batten/tests/it/session_provisioning.rs from `tests/container-preflight.bats`, whose own subject survives. The case grepped the retired script for `container-preflight`; the property — that a preflight nothing runs at startup is worthless — is now the `session-container-preflight` row, and its POSITION is asserted too, which the grep could not say
+// withdrawn: "the hook passes --degraded when provisioning failed" the capability is gone rather than moved, and this is the one real loss in this retirement. `--degraded` told the preflight not to trust toolchain-dependent probes when an earlier step had failed, and it worked because the script carried a `fail` variable across its steps. Handlers share no state — each is its own process with its own outcome — so nothing can compute the flag. The consequence is bounded: a container whose install failed now gets the full probe set, so it may report a second symptom of one cause, and both refusals arrive in the same reply. Recovering it needs a fact the door does not carry; filed rather than papered over
+// changed: "the fixer is wired: session-start runs it, so a clone is compliant before it commits" crates/batten/tests/it/session_provisioning.rs from `tests/commit-attribution.bats`, whose own subject (hk.pkl, mise.toml) survives. The case grepped the retired script for its `step attribution-identity` line; the property — that the identity fixer runs before a clone commits — is now the `session-attribution-identity` row, asserted by `the_committed_provisioning_declares_every_step_in_order`. It is CHANGED rather than CARRIED because the retired case pinned the invocation's exact spelling inside a program and this pins a row's presence and position in a list
+// changed: "the git hooks are installed — the per-clone step that was absent" mise-tasks/doctor.sh narrowed from perform-and-assert in one case to assert-only: `doctor` decides that same state on every later run, which the retired case's own comment already named as its backstop, and `tests/git-hook.bats` owns what the installed body does. What is lost is the pairing of the step with its effect inside one case
+//!
+//! # UNIX ONLY, and the gate is load-bearing rather than tidy
+//!
+//! Every dispatch case below runs a `#!/bin/sh` stub as a `[[hook.handler]]` row.
+//! On a Windows runner the spawn ladder cannot start the interpreter the shebang
+//! names, so the door reports a could-not-run and forwards nothing — and the
+//! cases that assert an ABSENCE would then pass for the wrong reason, which is
+//! the vacuous-pass class this file exists to close. `connector_allow_door.rs`
+//! gates its whole suite on the same rung, and the retired `.bats` suite never
+//! ran on Windows either, so nothing is narrowed that was covered.
+
+// Panicking on setup failure is the idiomatic way for a test to fail loudly.
+#![cfg(unix)]
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
+use crate::common;
+
+use std::path::{Path, PathBuf};
+
+use common::{at_root, git_in, scratch, stderr, stdout, write};
+
+/// The committed rows, in declaration order, as this suite expects to find them.
+///
+/// A LIST RATHER THAN A COUNT, because a count cannot tell an added row from a
+/// renamed one, and the ordering claim below needs the names anyway.
+const DECLARED: [&str; 10] = [
+    "session-stamp",
+    "session-install",
+    "session-submodules",
+    "session-doctor",
+    "session-batten",
+    "session-git-hooks",
+    "session-attribution-identity",
+    "session-signing-posture",
+    "session-container-preflight",
+    "session-census",
+];
+
+/// A fixture repository carrying only what a case declares.
+///
+/// NO `[[rule]]` AT ALL, for `connector_allow_door.rs`'s reason: an engine row
+/// producing a verdict of its own could stand in for the handler's, which is
+/// exactly the substitution that hid CLOUD-312 row 5's dropped verdict for the
+/// life of that migration.
+struct Bench {
+    repo: PathBuf,
+}
+
+/// What the door said to the host, and what it said about the handlers.
+struct Door {
+    out: String,
+    err: String,
+    code: Option<i32>,
+}
+
+impl Bench {
+    /// Hand one `SessionStart` envelope to the engine.
+    ///
+    /// The two streams are kept apart deliberately: a handler's advisory reaches
+    /// the host through Batten's own reply, and a contract violation is reported
+    /// on stderr. Merging them is how a dropped verdict reads as a delivered one.
+    fn session_start(&self) -> Door {
+        use std::io::Write as _;
+
+        let payload = serde_json::json!({
+            "hook_event_name": "SessionStart",
+            "session_id": "session-provisioning-fixture",
+            "source": "startup",
+        })
+        .to_string();
+
+        let mut child = common::batten()
+            .current_dir(&self.repo)
+            .args(["hook", "--harness", "claude-code"])
+            .stdin(std::process::Stdio::piped())
+            .stdout(std::process::Stdio::piped())
+            .stderr(std::process::Stdio::piped())
+            .spawn()
+            .expect("the binary runs");
+        child
+            .stdin
+            .take()
+            .expect("stdin is piped")
+            .write_all(payload.as_bytes())
+            .expect("write stdin");
+        let outcome = child.wait_with_output().expect("wait for batten");
+        Door {
+            out: stdout(&outcome),
+            err: stderr(&outcome),
+            code: outcome.status.code(),
+        }
+    }
+
+    /// Write one stub step and declare it as a `session-start` handler body.
+    fn step(&self, id: &str, body: &str) {
+        let path = format!("steps/{id}");
+        write(&self.repo, &path, &format!("#!/bin/sh\n{body}\n"));
+        make_executable(&self.repo.join(&path));
+    }
+}
+
+/// Build a fixture whose `batten.toml` declares `rows`, in order.
+fn bench(name: &str, rows: &[(&str, u64)]) -> Bench {
+    let dir = scratch(name);
+    let repo = dir.join("repo");
+    std::fs::create_dir_all(repo.join("steps")).expect("the fixture repo");
+
+    let mut config = String::from("version = 1\n");
+    for (id, timeout_ms) in rows {
+        config.push_str(&format!(
+            "\n[[hook.handler]]\nid = \"{id}\"\non = \"session-start\"\nrun = [\"steps/{id}\"]\ntimeout_ms = {timeout_ms}\nowner = \"CLOUD-312\"\nexpires = \"2027-02-28\"\n"
+        ));
+    }
+    write(&repo, "batten.toml", &config);
+    git_in(&repo, &["init", "-q", "-b", "main", "."]);
+
+    Bench { repo }
+}
+
+// No `#[cfg(unix)]` pair here: the module gate above already decides the target,
+// so a `#[cfg(not(unix))]` twin would be a definition nothing can reach.
+fn make_executable(path: &Path) {
+    use std::os::unix::fs::PermissionsExt as _;
+    let mut mode = std::fs::metadata(path)
+        .expect("the stub exists")
+        .permissions();
+    mode.set_mode(0o755);
+    std::fs::set_permissions(path, mode).expect("the stub is runnable");
+}
+
+/// One `[[hook.handler]]` row, reduced to the three fields this suite asks
+/// about.
+struct Row {
+    id: String,
+    on: String,
+    bounded: bool,
+}
+
+/// The committed `[[hook.handler]]` rows, in declaration order, read as TEXT.
+///
+/// **NOT `toml::from_str`, and the reason is measured rather than stylistic.**
+/// The committed `batten.toml` does not round-trip through the `toml` crate this
+/// workspace has in scope — it fails with `unexpected content, expected nothing`
+/// — while the engine reads it every run. Making this suite depend on a second
+/// parser agreeing with the engine's would be a second authority over what the
+/// config says, and it would fail for a reason having nothing to do with the
+/// property under test.
+///
+/// The scan is deliberately shallow and deliberately strict about its own
+/// premise: it takes each `[[hook.handler]]` header and reads the `key = value`
+/// lines up to the next table header. `every_handler_row_is_read` asserts the
+/// scan actually found rows, so a header this repository re-spells cannot turn
+/// every case below vacuous.
+fn handler_rows() -> Vec<Row> {
+    let text = std::fs::read_to_string(at_root("batten.toml"))
+        .expect("the committed authority is readable");
+
+    let mut rows = Vec::new();
+    for block in text.split("\n[[hook.handler]]\n").skip(1) {
+        let body = block.split("\n[").next().unwrap_or(block);
+        let field = |key: &str| -> Option<String> {
+            body.lines()
+                .find_map(|line| line.strip_prefix(&format!("{key} = ")))
+                .map(|value| value.trim().trim_matches('"').to_owned())
+        };
+        rows.push(Row {
+            id: field("id").unwrap_or_default(),
+            on: field("on").unwrap_or_default(),
+            bounded: field("timeout_ms").is_some(),
+        });
+    }
+    rows
+}
+
+/// The `session-start` rows, in declaration order.
+fn session_rows() -> Vec<Row> {
+    handler_rows()
+        .into_iter()
+        .filter(|row| row.on == "session-start")
+        .collect()
+}
+
+// ---------------------------------------------------------------------------
+// The engine's half: what the door does with what the declaration says.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn the_steps_run_in_declaration_order() {
+    // CARRIES `"doctor runs inside the synchronous window — after install, before
+    // the preflight"`, and it is a strictly better instrument than what it
+    // replaces. The retired case stubbed `mise`, ran the script, and grepped the
+    // stub's call log for line numbers — an observation about bash. Order is now
+    // a property of `dispatch`, which iterates the handler table as the config
+    // lists it, so this reads the thing that will actually run in a session.
+    //
+    // Three steps rather than two: with two, a dispatcher that reversed the list
+    // and one that preserved it are distinguishable, but a dispatcher that sorted
+    // by id is not — `first` and `second` happen to sort into the order they are
+    // declared in. The ids below are declared in an order that no sort produces.
+    let bench = bench(
+        "session-order",
+        &[("zulu", 5000), ("alpha", 5000), ("mike", 5000)],
+    );
+    let log = bench.repo.join("order.log");
+    for id in ["zulu", "alpha", "mike"] {
+        bench.step(
+            id,
+            &format!("printf '{id}\\n' >> \"$(dirname \"$0\")/../order.log\""),
+        );
+    }
+
+    let door = bench.session_start();
+    assert_eq!(door.code, Some(0), "session start allows: {}", door.err);
+
+    let ran = std::fs::read_to_string(&log).expect("every step ran");
+    assert_eq!(
+        ran.lines().collect::<Vec<_>>(),
+        ["zulu", "alpha", "mike"],
+        "the declaration order is the running order"
+    );
+}
+
+#[test]
+fn a_failed_step_is_reported_rather_than_silent() {
+    // CARRIES `"a failed step exits non-zero — absence must never be silent"`.
+    //
+    // The retired case asserted this by grepping the script for the string
+    // `exit 1`, which is a claim about its source rather than about what a
+    // session sees. Here a step actually fails and the reason has to arrive.
+    //
+    // `VIOLATION_EXIT` rather than `DENY_EXIT`: a provisioning failure is
+    // "the thing you asked about is wrong", not a refusal of the call. At
+    // `session-start` a deny would be demoted to advice anyway
+    // (`Event::carries_a_verdict`), so exiting 2 would prove nothing this does
+    // not — and it would misstate the step's own meaning in the exit table.
+    let bench = bench("session-loud", &[("failing", 5000)]);
+    bench.step(
+        "failing",
+        "echo '::error:: session-start: failing failed — see /tmp/x.log' >&2\nexit 1",
+    );
+
+    let door = bench.session_start();
+    assert_eq!(
+        door.code,
+        Some(0),
+        "a failed provisioning step never blocks the session"
+    );
+    let said = format!("{}{}", door.out, door.err);
+    assert!(
+        said.contains("session-start: failing failed"),
+        "the step's own reason reaches the session, not just its exit code: {said}"
+    );
+}
+
+#[test]
+fn a_step_that_passes_says_nothing() {
+    // CARRIES the silent half of `"the hook runs green on this checkout"`
+    // (CLOUD-891: silence is the pass). The end-to-end half is `changed:` above.
+    //
+    // Asserted over BOTH streams, because a success line on stderr is the same
+    // defect as one on stdout — the retired hook's `container-preflight` line
+    // was on stdout and the argument against it was about the reader, not the
+    // file descriptor.
+    let bench = bench("session-silent", &[("quiet", 5000)]);
+    bench.step("quiet", "exit 0");
+
+    let door = bench.session_start();
+    assert_eq!(door.code, Some(0));
+    assert!(
+        door.out.is_empty(),
+        "a passing step announces nothing on stdout: {}",
+        door.out
+    );
+    assert!(
+        !door.err.contains("quiet"),
+        "a passing step is not named on stderr either: {}",
+        door.err
+    );
+}
+
+#[test]
+fn a_step_that_hangs_is_killed_at_its_declared_bound() {
+    // SUBSUMES `"the hook is synchronous — async would restore the race it
+    // closes"`, and it is the half that was never testable before.
+    //
+    // The retired case asserted that the script does not print `{"async": true}`.
+    // That was the only spelling of the property available to it, and it is
+    // weaker in both directions: the script could have been synchronous and
+    // hung forever, which is what the absence of any bound made possible.
+    //
+    // Behind the door synchrony is structural — `run_one` waits for the child
+    // before `dispatch` returns and `batten hook` replies — so what is worth
+    // asserting is the thing that makes synchrony affordable: the bound. A step
+    // declaring 300ms and sleeping 30s must not hold the session for 30s.
+    //
+    // THE ASSERTION IS ON THE WALL CLOCK AND THAT IS DELIBERATE, against
+    // `.claude/rules/rust.md`'s standing preference for counters over timing:
+    // the property here IS elapsed time, and a counter cannot express "was
+    // killed early". The margin is two orders wide — 10s against a 30s sleep and
+    // a 300ms bound — so it discriminates a working bound from an absent one
+    // without discriminating a slow runner from a fast one.
+    let bench = bench("session-bound", &[("hanging", 300)]);
+    bench.step("hanging", "sleep 30");
+
+    let started = std::time::Instant::now();
+    let door = bench.session_start();
+    let took = started.elapsed();
+
+    assert_eq!(door.code, Some(0), "a timed-out step allows: {}", door.err);
+    assert!(
+        took < std::time::Duration::from_secs(10),
+        "the declared bound is imposed by the parent, not hoped for: took {took:?}"
+    );
+}
+
+#[test]
+fn a_steps_stdout_is_interpreted_never_forwarded() {
+    // SUBSUMES the other half of the async case, and it is why no handler can
+    // reintroduce the race whatever it writes.
+    //
+    // The retired script was registered directly, so anything it put on stdout
+    // went to the host verbatim — `{"async": true}` included, which is exactly
+    // the window the MCP handshake lost. Behind the door stdout is read into
+    // Batten's own types and re-rendered per harness, so a handler speaks to
+    // BATTEN and never to the host.
+    //
+    // Asserted as "the bytes do not appear verbatim", not as "nothing is said":
+    // the text is legitimately allowed to become advisory content, and a case
+    // demanding silence would be asserting the wrong property and would break
+    // the moment the advisory channel renders it.
+    let bench = bench("session-passthrough", &[("talkative", 5000)]);
+    bench.step("talkative", "printf '{\"async\": true}\\n'");
+
+    let door = bench.session_start();
+    assert_eq!(door.code, Some(0));
+    assert!(
+        !door.out.contains("{\"async\": true}"),
+        "a handler's stdout is never forwarded to the host verbatim: {}",
+        door.out
+    );
+}
+
+// ---------------------------------------------------------------------------
+// The declaration's half: what the committed authority actually says.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn the_committed_provisioning_declares_every_step_in_order() {
+    // CARRIES `"the hook is registered as a SessionStart hook"`. That case read
+    // `.claude/settings.json` and asserted a by-path command was present; the
+    // registration this change removes. The property it was protecting — that
+    // provisioning is actually wired to session start rather than merely written
+    // down — is now the handler roster, so this is where it is asserted.
+    let ids: Vec<String> = session_rows().into_iter().map(|row| row.id).collect();
+
+    assert_eq!(
+        ids, DECLARED,
+        "the provisioning steps are declared, in the order they must run"
+    );
+}
+
+#[test]
+fn every_handler_row_is_read() {
+    // THE ANTI-VACUITY CASE FOR THE SCAN ABOVE, and it is the reason the scan is
+    // allowed to be shallow. `handler_rows` matches a literal table header; if
+    // this repository ever spells one differently — an inline array, a rename —
+    // the scan returns nothing, every `session_rows()` case below passes over an
+    // empty list, and the suite reports green over a declaration it never read.
+    // That is the silent-empty-answer class `.claude/rules/scanning.md` records
+    // for a matcher pointed at an extensionless tree, one file over.
+    let rows = handler_rows();
+    assert!(
+        rows.len() > DECLARED.len(),
+        "the scan reads the handler table: the provisioning rows plus the \
+         user-prompt-submit and pre-tool rows that predate them, found {}",
+        rows.len()
+    );
+    assert!(
+        rows.iter().any(|row| row.on == "user-prompt-submit"),
+        "a row on another event is read too, so `session_rows` is filtering \
+         rather than being all there is"
+    );
+}
+
+#[test]
+fn every_provisioning_step_declares_its_own_bound() {
+    // NOT A CARRIED CASE — the retired suite had nothing like it, because the
+    // script it tested had no bound to assert. It is here because the bound is
+    // the one thing the door adds that the script could not have, and an
+    // undeclared `timeout_ms` silently falls back to `DEFAULT_TIMEOUT` — five
+    // seconds, chosen for handlers that read two `jq` documents. A cold
+    // `mise install` under a five-second bound is the fail-open absence this
+    // whole surface exists to close, arriving as a default nobody wrote.
+    for row in session_rows() {
+        assert!(
+            row.bounded,
+            "{} declares its own bound rather than inheriting the five-second default",
+            row.id
+        );
+    }
+}
+
+#[test]
+fn the_install_step_is_declared_lockfile_free() {
+    // CARRIES `"the install is lockfile-free — provisioning must not dirty the
+    // tracked lock"` (CLOUD-223), and `"mise install runs — the step whose
+    // absence was the defect"` with it: both were greps over the retired
+    // script's source, and the same fact now lives in the task the handler runs.
+    //
+    // READ FROM `mise.toml` RATHER THAN FROM THE HANDLER ROW, because that is
+    // where it is: the row names `mise run session:install`, and the environment
+    // assignment is inside that task's body. Asserting it on the row would be
+    // asserting a spelling this change did not choose.
+    let text = std::fs::read_to_string(at_root("mise.toml")).expect("mise.toml is readable");
+    let body = text
+        .split("[tasks.\"session:install\"]")
+        .nth(1)
+        .expect("the install step is a declared task")
+        .split("\n[tasks")
+        .next()
+        .expect("the task body ends at the next table");
+
+    assert!(
+        body.contains("MISE_LOCKFILE=false"),
+        "provisioning installs purely, so it cannot append a platform key `mise lock` \
+         cannot produce and `lock-complete` rejects"
+    );
+    assert!(
+        body.contains("mise install"),
+        "the step whose absence was CLOUD-196 is the one this task performs"
+    );
+}
+
+#[test]
+fn no_by_path_registration_survives_on_the_session_start_surface() {
+    // THE OTHER HALF OF THE RETIRED REGISTRATION CASE, in the direction that
+    // matters now. That case asserted a by-path command was PRESENT; the point
+    // of this change is that none is, so the assertion inverts rather than
+    // disappearing — and inverting it is what stops the registration coming back
+    // by hand while the handler rows sit unread beside it.
+    //
+    // `[hook] exclusive` is the capability that would decide this globally
+    // (CLOUD-893) and it stays undeclared while `run-shape-guard` is registered
+    // on `pre-tool` (CLOUD-856). This is that predicate for the one event this
+    // change clears, which is what makes the clearing durable.
+    let text = std::fs::read_to_string(at_root(".claude/settings.json"))
+        .expect("the wiring file is readable");
+    let settings: serde_json::Value = serde_json::from_str(&text).expect("the wiring file is JSON");
+
+    let commands: Vec<&str> = settings["hooks"]["SessionStart"]
+        .as_array()
+        .expect("SessionStart is registered")
+        .iter()
+        .flat_map(|group| {
+            group["hooks"]
+                .as_array()
+                .expect("a group carries hooks")
+                .iter()
+        })
+        .filter_map(|hook| hook["command"].as_str())
+        .collect();
+
+    assert_eq!(
+        commands,
+        ["batten hook --harness claude-code"],
+        "the engine is the only thing registered on session start; everything else \
+         is a `[[hook.handler]]` row it dispatches"
+    );
+}
diff --git a/mise-tasks/hooks-wiring-check.sh b/mise-tasks/hooks-wiring-check.sh
index 1c047f1f9..2596e5318 100755
--- a/mise-tasks/hooks-wiring-check.sh
+++ b/mise-tasks/hooks-wiring-check.sh
@@ -175,7 +175,6 @@ gemini-cli .gemini/settings.json}"
 # Their owners are not invented: CLOUD-312 is "the shell guards retire behind
 # it", whose scope CLOUD-777 widened from pre-tool to every point.
 DECLARED="${HOOKS_WIRING_DECLARED-
-.claude/hooks/session-start.sh CLOUD-312
 mise-tasks/run-shape-guard.sh CLOUD-821
 stop-hook-git-check.sh CLOUD-605
 session-start-git-identity.sh CLOUD-605}"
diff --git a/mise.toml b/mise.toml
index 5bee0e46b..f87e91aec 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1724,6 +1724,157 @@ run = "cargo run --quiet -p batten -- check --rule memory-graph"
 [tasks.rules-drift]
 description = "Gate: a value `.claude/rules/*.md` restates still agrees with the mechanism that owns it (CLOUD-506)"
 run = "cargo run --quiet -p batten -- check --rule rules-drift"
+# ---------------------------------------------------------------------------
+# The session-start provisioning steps, one task each (CLOUD-312 row 10).
+#
+# THESE ARE THE BODY OF `.claude/hooks/session-start.sh`, WHICH THIS CHANGE
+# DELETES. That script was 295 lines of bash registered by path on SessionStart,
+# and it did three separable things: it ORDERED a list of steps, it BOUNDED
+# nothing, and it wrapped each step in a `step` helper that logged to a file and
+# tailed five lines to stderr on failure. Two of those three now belong to
+# `[[hook.handler]]` — the order is the declaration order of the rows in
+# `batten.toml`, and the bound is `timeout_ms`, imposed by the parent. What the
+# door does NOT provide is the third, so it is what stayed, once per step.
+#
+# WHY A TASK PER STEP RATHER THAN ONE TASK RUNNING THEM ALL. One task would be
+# the same bash one layer down, invisible to the committed authority: a reader of
+# `batten.toml` would see one row and could not tell what runs, in what order, or
+# what happens when the fourth thing fails. It would also share one bound across
+# steps whose costs differ by two orders of magnitude. The row-per-step shape is
+# what makes `batten doctor hooks` and `batten config show` able to answer
+# "what does this repository do at session start" from the committed file.
+#
+# WHY THE REDIRECT IS HERE AND NOT IN THE HANDLER ROW. `handler.rs`'s contract
+# reads stdout on a passing exit as ADVISORY TEXT that joins the reply the host
+# sees. Several of these steps print on success — `install:local` echoes its
+# destination — so registered raw they would put a line in every session's
+# advisory saying nothing went wrong, which is exactly the announcement CLOUD-891
+# removed from this hook. `step` solved that by sending both streams to a log,
+# and these tasks solve it the same way: silence on the normal path, and on
+# failure the `::error::` line, the log pointer and the last five lines on
+# STDERR, which is where the door's contract puts a reason.
+#
+# The `|| { …; exit 1; }` is not belt-and-braces: a body declaring no `shell =`
+# runs under `sh -e`, so a bare failing call would abort the task before its own
+# report could run. That is measured — it cost a debugging cycle in #798 — and
+# the three corrected comments in `[tasks."test:bats"]` are the same fact said
+# where the next author reads it.
+
+[tasks."session:stamp"]
+description = "Session start: stamp the beginning of the session, before anything else runs (CLOUD-431)"
+# FIRST, AND THE ORDER IS THE PREDICATE. `claim-check`'s `refined-this-session`
+# rule compares an issue's tracker-minted `updatedAt` against this file's mtime:
+# refinement must PREDATE the session that implements it. A stamp written after
+# the provisioning steps would date the session to whenever provisioning finished,
+# which is exactly the ordering that rule exists to refuse.
+#
+# Silent and non-fatal by construction — `mkdir -p` and a truncation, both
+# idempotent. `claim-check` refuses on a MISSING stamp rather than passing, so a
+# failure here fails closed downstream instead of needing to halt the session.
+run = "mkdir -p \"$(git rev-parse --git-dir)/batten-receipts\" && : > \"$(git rev-parse --git-dir)/batten-receipts/session-start\""
+
+[tasks."session:install"]
+description = "Session start: provision the mise toolchain, purely — the step whose absence was CLOUD-196"
+# The load-bearing one. `.mcp.json` launches Serena with `mise exec --`, and
+# `mise exec` INSTALLS a missing tool on demand: on a cold container that install
+# ran inside the MCP client's startup window, measured 24s for `pipx:serena-agent`,
+# the handshake did not complete, and MCP servers are not retried mid-session.
+# This is what makes that `exec` a pure exec.
+#
+# `MISE_LOCKFILE=false` makes it a PURE install (CLOUD-223). A cold install of
+# `ubi:rust-cross/cargo-zigbuild` otherwise appends a platform key `mise lock`
+# cannot produce, which `lock-complete` rejects by name — so every session opened
+# with a dirty tree and a red gate no branch had caused. `[settings] lockfile =
+# false` is the authority; this is the belt to that suspenders, and it keeps the
+# install pure even under an ambient `MISE_LOCKFILE`.
+run = "env MISE_LOCKFILE=false mise install >/tmp/session-start-install.log 2>&1 || { echo '::error:: session-start: install failed — see /tmp/session-start-install.log' >&2; tail -5 /tmp/session-start-install.log >&2; exit 1; }"
+
+[tasks."session:submodules"]
+description = "Session start: check out the vendored submodules — bats lives in tests/bats"
+run = "git submodule update --init --recursive >/tmp/session-start-submodules.log 2>&1 || { echo '::error:: session-start: submodules failed — see /tmp/session-start-submodules.log' >&2; tail -5 /tmp/session-start-submodules.log >&2; exit 1; }"
+
+[tasks."session:doctor"]
+description = "Session start: provision what mise does not own — the rustup cross targets above all (CLOUD-218)"
+# AFTER `session:install` AND BEFORE THE PREFLIGHT, and both halves of that
+# ordering are load-bearing. Doctor's rustup half needs the mise-provisioned
+# toolchain, so it cannot go first; and left outside the provisioning window it
+# runs for the first time inside the first `mise run verify`, concurrently with
+# whatever else the sandbox is still laying down. Measured on a cold container
+# 2026-08-07: that first verify died in doctor with `detected conflict` on
+# `rust-std-aarch64-apple-darwin`, and a second doctor, nothing changed but time,
+# exited 0. The message names cross-compilation, so it costs the reader a
+# debugging session on a machine where nothing is broken.
+#
+# This is not a retry: it does not make the race survivable, it empties the
+# window the race needs.
+run = "mise run doctor >/tmp/session-start-doctor.log 2>&1 || { echo '::error:: session-start: doctor failed — see /tmp/session-start-doctor.log' >&2; tail -5 /tmp/session-start-doctor.log >&2; exit 1; }"
+
+[tasks."session:batten"]
+description = "Session start: build and install this checkout's own engine over the released one `deps-install` provisioned"
+# THE RELEASED BINARY IS ALREADY ON PATH BY THE TIME THIS RUNS, and that is what
+# makes this row possible at all. `deps-install` puts it there at provisioning
+# (CLOUD-1085, #798) — before Claude launches, so before any hook fires — which
+# is what dispatches the handler this task is registered as. This step then
+# REPLACES it with the working tree's build, because consumer #1 must judge the
+# engine it ships rather than the last release.
+#
+# The ordering consequence, stated because it inverts the old script's: a session
+# whose `deps-install` did not run has no binary to dispatch handlers with, so
+# nothing here runs and the advisory `contract::unmediated_session` reports it.
+# `mise run install:local` stays reachable by hand, which is the manual repair.
+run = "mise run install:local >/tmp/session-start-batten.log 2>&1 || { echo '::error:: session-start: install:local failed — see /tmp/session-start-batten.log' >&2; tail -5 /tmp/session-start-batten.log >&2; exit 1; }"
+
+[tasks."session:git-hooks"]
+description = "Session start: install the repo-owned git hooks, the per-clone step nothing performed for 24 commits (CLOUD-476)"
+# NOT `hk install`. The hook it generates is `exec hk run pre-commit`, calling
+# `hk` BARE, which resolves only where mise's shims are on PATH — in this
+# environment they are not, so that hook makes every `git commit` fail with
+# `hk: not found`. Measured, on the very commit that added the step. The body
+# installed here resolves `hk` through `mise exec --`, which is the form that
+# works, and refuses to re-enter a gate already running.
+#
+# A SYMLINK, NEVER A COPY: a copy is a second authority that goes stale silently
+# the moment the checked-in body changes, and `doctor` would keep passing over
+# it. `-f` so a clone carrying hk's generated hook is repaired rather than
+# skipped, which is the state every existing clone is in. Both hooks `hk.pkl`
+# defines, through one body that dispatches on the name it is invoked as —
+# commit-msg carries the Conventional Commits check release-plz's semver depends
+# on, so leaving it out would gate the expensive half and not the deciding one.
+run = "mkdir -p \"$(git rev-parse --git-path hooks)\" && ln -sfn \"$(git rev-parse --show-toplevel)/.claude/hooks/git-hook.sh\" \"$(git rev-parse --git-path hooks)/pre-commit\" && ln -sfn \"$(git rev-parse --show-toplevel)/.claude/hooks/git-hook.sh\" \"$(git rev-parse --git-path hooks)/commit-msg\""
+
+[tasks."session:identity"]
+description = "Session start: set this clone's repo-local git identity, quietly — the `step`-wrapped call from the retired hook"
+# WRAPPED RATHER THAN REGISTERED DIRECTLY, and the reason is measured. The retired
+# script ran `step attribution-identity mise run attribution-identity`, and `step`
+# sent both streams to a log — so the fixer's own line never reached a session.
+# Registering the bare task as a handler puts its stdout in the advisory instead,
+# which is the CLOUD-891 announcement this hook had already removed. This keeps
+# the old behaviour exactly: silent when it has nothing to repair, loud when it
+# fails.
+run = "mise run attribution-identity >/tmp/session-start-identity.log 2>&1 || { echo '::error:: session-start: attribution-identity failed — see /tmp/session-start-identity.log' >&2; tail -5 /tmp/session-start-identity.log >&2; exit 1; }"
+
+[tasks."session:signing"]
+description = "Session start: put the not-signing posture into force, quietly — the `step`-wrapped call from the retired hook"
+# The same wrapper for the same measured reason, and this is the one that caught
+# it: registered bare, `mise run signing-posture --repair` put
+# `signing-posture: signing disabled in this checkout …` into every session's
+# advisory. Measured 2026-09-01 by dispatching the real rows. The retired script
+# `step`-wrapped this call, so that line was never a session's to read.
+run = "mise run signing-posture --repair >/tmp/session-start-signing.log 2>&1 || { echo '::error:: session-start: signing-posture failed — see /tmp/session-start-signing.log' >&2; tail -5 /tmp/session-start-signing.log >&2; exit 1; }"
+
+[tasks."session:census"]
+description = "Session start: record this boot and read back what was running when the container we replaced went down (CLOUD-451)"
+# RECORD BEFORE READ, and the order is load-bearing: recording this boot after
+# reading would make it part of the evidence it is being compared against.
+#
+# NEVER FATAL, and that is why it is `|| true` rather than the `|| { …; exit 1; }`
+# every other step above carries: a verdict about a PAST container is not a
+# provisioning failure, and halting a session over one would be the sensor
+# deciding something it has no business deciding. Only the positive reading
+# speaks — the report's exit 1 (idle when replaced) and exit 2 (cannot look) are
+# silent, because a line every session start would be noise in the overwhelming
+# case where nothing happened.
+run = "mise run reclaim-census record-boot >/dev/null 2>&1 || true; mise run reclaim-census report 2>/dev/null || true"
 
 [tasks.batten-check]
 description = "Consumer #1: evaluate the committed batten.toml with batten's own engine against this repository"
diff --git a/tests/session-start.bats b/tests/session-start.bats
deleted file mode 100644
index 2ffdf3ee0..000000000
--- a/tests/session-start.bats
+++ /dev/null
@@ -1,205 +0,0 @@
-#!/usr/bin/env bats
-# subject: .claude/hooks/session-start.sh
-# The SessionStart hook's load-bearing properties (CLOUD-196). The hook's effect
-# — a provisioned toolchain — is not assertable in a unit test, so these pin the
-# two properties whose loss would silently restore the defect: that it is
-# synchronous, and that it fails loudly rather than exiting 0 on a broken setup.
-
-setup() {
-	HOOK="$BATS_TEST_DIRNAME/../.claude/hooks/session-start.sh"
-	SETTINGS="$BATS_TEST_DIRNAME/../.claude/settings.json"
-
-	# The hook now ends in `mise run container-preflight`, whose verdict is about
-	# the CONTAINER — its egress policy and its credential — not about this code
-	# (CLOUD-261). Letting that verdict decide these tests would make `mise run
-	# test:bats` a container-health check, and the fix for a broken container
-	# could then never be landed from one. So the preflight alone is neutralised
-	# here, and every other `mise` call — `mise install` above all — still runs
-	# for real, which is what keeps the lockfile assertion below non-vacuous.
-	#
-	# The preflight's own behaviour is asserted in tests/container-preflight.bats,
-	# where the GitHub half is stubbed and every verdict is reachable.
-	#
-	# `doctor` is neutralised for the same reason and one more (CLOUD-218). Its
-	# rustup half reaches the network to install cross targets, so an offline
-	# container would decide these tests; and `[tasks."test:bats"]` already
-	# `depends = ["doctor --no-targets"]`, so letting each hook-running test
-	# invoke a FULL doctor would hang a cross-target install off every one of
-	# them. Its own behaviour is asserted in tests/doctor-check.bats and
-	# tests/target-race.bats.
-	#
-	# The stub RECORDS every invocation, which is what makes the wiring assertion
-	# below a real observation of the hook's behaviour rather than a grep of its
-	# source.
-	#
-	# `install` IS INTERCEPTED TOO, and opted back in per case (CLOUD-406). It
-	# used to exec the real binary unconditionally, on the argument that this is
-	# what keeps the lockfile assertions non-vacuous — half true, and the half
-	# that was false cost a red required check on a branch that changed nothing.
-	# Measured on run 31538830648: Sigstore's TUF metadata endpoint was down,
-	# `mise install` failed, and two cases whose properties are ORDER and OUTPUT
-	# went red through their `[ "$status" -eq 0 ]` line. Neither was asserting
-	# anything about the install succeeding; the hook records the call either way,
-	# because `step` sets `fail=1` and CONTINUES rather than aborting.
-	#
-	# Of the two lockfile assertions the old rationale named, only one needs a
-	# real install: the `grep` over the hook's source text does not touch a
-	# toolchain. That one, and the two other genuinely end-to-end cases, set
-	# `SESSION_START_REAL_INSTALL` and establish the precondition first — so a
-	# container that cannot provision SKIPS with a reason instead of reporting a
-	# hook defect, which is the `lock-check` split applied one layer down.
-	STUB="$BATS_TEST_TMPDIR/bin"
-	CALLS="$BATS_TEST_TMPDIR/mise-calls"
-	mkdir -p "$STUB"
-	REAL_MISE="$(command -v mise)"
-	cat >"$STUB/mise" <<EOF
-#!/usr/bin/env bash
-printf '%s\n' "\$*" >>"$CALLS"
-if [ "\$1" = run ] && { [ "\$2" = container-preflight ] || [ "\$2" = doctor ]; }; then exit 0; fi
-if [ "\$1" = install ] && [ -z "\${SESSION_START_REAL_INSTALL:-}" ]; then exit 0; fi
-exec "$REAL_MISE" "\$@"
-EOF
-	chmod +x "$STUB/mise"
-	PATH="$STUB:$PATH"
-	export PATH
-}
-
-# ESTABLISH THE PRECONDITION, NEVER RETRY THE MEASUREMENT (CLOUD-406). A case
-# that needs a real install asks for one HERE, directly, before the hook runs. A
-# failure at this line is a statement about the container's egress, not about the
-# hook — so it skips with a reason rather than reddening a branch. It is also the
-# discriminator that makes the opt-in honest: past it, the hook's own install
-# cannot fail for a provisioning reason, so a red from the case that follows is a
-# real defect. Idempotent and warm, so the second install costs milliseconds.
-real_install_or_skip() {
-	env MISE_LOCKFILE=false "$REAL_MISE" install >/dev/null 2>&1 ||
-		skip "this container cannot provision — \`mise install\` failed, which is a verdict about egress and not about the hook (CLOUD-406)"
-	export SESSION_START_REAL_INSTALL=1
-}
-
-@test "the hook is executable" {
-	[ -x "$HOOK" ]
-}
-
-@test "the hook is synchronous — async would restore the race it closes" {
-	# `{"async": true}` on stdout tells the client to start the session while
-	# this still runs, which is exactly the window the MCP handshake lost. The
-	# property is what the hook EMITS, not whether the word appears — the
-	# rationale comment names async precisely to explain why it is absent, and
-	# an earlier version of this test failed on that comment.
-	run env CLAUDE_PROJECT_DIR="$BATS_TEST_DIRNAME/.." "$HOOK"
-	[ "$status" -eq 0 ]
-	[[ "$output" != *"async"* ]]
-
-	# Belt and braces: no executable (non-comment) line declares it either.
-	run bash -c "grep -v '^[[:space:]]*#' '$HOOK' | grep -c '\"async\"' || true"
-	[ "$output" -eq 0 ]
-}
-
-@test "mise install runs — the step whose absence was the defect" {
-	# `mise exec` in .mcp.json installs on demand; this is what makes that a
-	# pure exec instead of a 24-second install inside the MCP startup window.
-	run grep -q "mise install" "$HOOK"
-	[ "$status" -eq 0 ]
-}
-
-@test "doctor runs inside the synchronous window — after install, before the preflight" {
-	# CLOUD-218. `mise install` returning is not "the toolchain is settled": the
-	# rustup cross targets are doctor's to provision, and outside this window
-	# they land inside the first `mise run verify`, where a concurrent writer
-	# turns the install into a `detected conflict` rollback that names
-	# cross-compilation. Ordering is the whole property — after `mise install`
-	# because doctor's rustup half needs the provisioned toolchain, before the
-	# preflight because the preflight is a halt and provisioning must be done
-	# by then.
-	run env CLAUDE_PROJECT_DIR="$BATS_TEST_DIRNAME/.." "$HOOK"
-	[ "$status" -eq 0 ]
-
-	local install doctor preflight
-	install=$(grep -nx 'install' "$CALLS" | head -1 | cut -d: -f1)
-	doctor=$(grep -nx 'run doctor' "$CALLS" | head -1 | cut -d: -f1)
-	preflight=$(grep -n '^run container-preflight' "$CALLS" | head -1 | cut -d: -f1)
-	[ -n "$install" ]
-	[ -n "$doctor" ]
-	[ -n "$preflight" ]
-	[ "$install" -lt "$doctor" ]
-	[ "$doctor" -lt "$preflight" ]
-}
-
-@test "a failed step exits non-zero — absence must never be silent" {
-	run grep -q "exit 1" "$HOOK"
-	[ "$status" -eq 0 ]
-}
-
-@test "the hook is registered as a SessionStart hook" {
-	run python3 -c "
-import json
-d = json.load(open('$SETTINGS'))
-hooks = d['hooks']['SessionStart']
-cmds = [h['command'] for g in hooks for h in g['hooks']]
-assert any('session-start.sh' in c for c in cmds), cmds
-print('registered')
-"
-	[ "$status" -eq 0 ]
-	[[ "$output" == *"registered"* ]]
-}
-
-@test "the hook runs green on this checkout" {
-	# Idempotent by construction, so running it here is safe and is the only
-	# end-to-end assertion available: the steps are all already satisfied.
-	real_install_or_skip
-	run env CLAUDE_PROJECT_DIR="$BATS_TEST_DIRNAME/.." "$HOOK"
-	[ "$status" -eq 0 ]
-	# SILENCE IS THE PASS (CLOUD-891). This asserted a success line, which is what
-	# kept one there: the hook announced "nothing went wrong" once per session to
-	# a reader with no action to take. Exit 0 is the verdict; stdout is for things
-	# somebody must act on.
-	[ -z "$output" ]
-}
-
-@test "the install is lockfile-free — provisioning must not dirty the tracked lock" {
-	# CLOUD-223: `[settings] lockfile = true` plus a cold ubi install appends a
-	# platform key `mise lock` cannot produce and `lock-complete` rejects, so
-	# every session began dirty and the residue was committed twice. Currency is
-	# lock-currency.yml's job, on a schedule; provisioning is a pure install.
-	run grep -qE 'MISE_LOCKFILE=false[[:space:]]+mise install' "$HOOK"
-	[ "$status" -eq 0 ]
-}
-
-@test "running the hook leaves the tracked lockfile untouched" {
-	# The end-to-end version of the assertion above, and the one that would have
-	# caught the original defect: the suite itself runs this hook.
-	# The one case the real install is genuinely load-bearing for: a stubbed
-	# install writes no lockfile, so it could not observe the residue CLOUD-223
-	# was about.
-	real_install_or_skip
-	local before after
-	before=$(git -C "$BATS_TEST_DIRNAME/.." status --porcelain -- mise.lock)
-	run env CLAUDE_PROJECT_DIR="$BATS_TEST_DIRNAME/.." "$HOOK"
-	[ "$status" -eq 0 ]
-	after=$(git -C "$BATS_TEST_DIRNAME/.." status --porcelain -- mise.lock)
-	[ "$before" = "$after" ]
-}
-
-@test "the git hooks are installed — the per-clone step that was absent" {
-	# CLOUD-476: `hk install` was named in two prose files, performed by nothing
-	# and asserted by nothing, so 24 commits in one container went through no
-	# gate. This is the end-to-end half; `doctor` decides the same state on every
-	# later run, and tests/git-hook.bats owns what the installed body does.
-	#
-	# Idempotent, and it installs into THIS clone — which is the point: the suite
-	# that asserts the step is also the thing that performs it here.
-	run env CLAUDE_PROJECT_DIR="$BATS_TEST_DIRNAME/.." "$HOOK"
-	[ "$status" -eq 0 ]
-
-	local root hooks name
-	root=$(cd "$BATS_TEST_DIRNAME/.." && pwd)
-	hooks=$(git -C "$root" rev-parse --git-path hooks)
-	for name in pre-commit commit-msg; do
-		[ -x "$hooks/$name" ]
-		# A symlink, not a copy: a copy is a second authority that goes stale the
-		# moment the checked-in body changes, and doctor would keep passing over it.
-		[ -L "$hooks/$name" ]
-		[ "$(readlink "$hooks/$name")" = "$root/.claude/hooks/git-hook.sh" ]
-	done
-}

From 9174653bac5c2909e0cd73c8f9816dc5df1fe956 Mon Sep 17 00:00:00 2001
From: Alec Wenzowski <alec@wenzowski.com>
Date: Tue, 1 Sep 2026 11:42:02 +0000
Subject: [PATCH 3/5] feat(policy): read a bats suite's lines, and admit the
 case that dies with its subject
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CLOUD-1294, and the root cause is one line deeper than the row described.

`shell-retirement`'s `line_sources` was `["mise-tasks/*.sh",
"crates/batten/tests/**/*.rs"]` — no `.bats` entry. `governed_at_head` selects
every bats suite, but their lines were never a declared source, so
`only_drops_a_retired_reference` bound `base` from `base-lines`, came back
UNDEFINED, and arm B refused every edited `.bats` unconditionally, whatever the
edit was. The one admitted edit has been unreachable for half the governed
corpus since it was written, and the refusal was byte-identical to a real one.

Reading them costs `.claude/rules/rust.md`'s ~5.4 µs per declared document over
~137 suites — under a millisecond, on a 100 ms budget.

That alone does not finish it. The arm admits a removed LINE that names the
retired path, and a removed `@test` block's opener, assertions and closing brace
name nothing. So the removal term is factored into `admitted_removal` — mirroring
`admitted_addition`, which has had four shapes behind one name since CLOUD-1224 —
and gains a second: a line belongs to a case whose opener is absent at head AND
whose retired-path-naming line is itself among the removed.

That last conjunct is the one that matters. Without it, deleting only an opener
would pass, because an absent opener is what identifies a dead block — so a
half-deleted case could buy its own removal. `#MUTANT case-half-deleted` is over
exactly that conjunct, and `#MUTANT case-names-nothing-retired` over the term
that stops this becoming a licence to delete any case during any retirement.

The bound is stated at the rule rather than discovered later: `removed` is a set
of LINES, so a removed line whose text exactly matches one inside the dying case
is admitted even if it came from elsewhere in the file. Positional alignment
would close it and needs a diff algorithm the engine does not hand over.

`crates/batten/tests/it/shell_retirement.rs` carries the discriminating trio, a
byte-identical fixture differing only in which block the head drops: the retired
case is admitted, the live one is refused, the opener-only one is refused. Its
`row()` now mirrors the committed `line_sources`, without which every case would
have passed or failed for the wrong reason.

Spends it immediately: the three cases greping the retired
`.claude/hooks/session-start.sh` are dropped from `tests/commit-attribution.bats`
and `tests/container-preflight.bats`, whose `conserves` arms the previous commit
already carries.

TWO MORE COLLISIONS THE FIRST FIX EXPOSED, both measured on the same three cases.

`tests/container-preflight.bats` binds `HOOK` once in `setup()` and every case
greps `"$HOOK"`, so no line inside either case carries a path and the arm above
saw nothing. The one case it did admit was admitted because the retired
program's stem happened to appear in its title — an accident of wording, not a
predicate. So a case also earns its removal by SPENDING a variable whose binding
this delta removes, which is CLOUD-1283's bound-and-spent shape on the removal
side. `retired_path_vars` is deliberately not reused: it feeds the repointing
arms on the ADDITION side, where the byte-check is the safety property.

And `no-consumer-repo-name` bans a substring across `crates/**` while
`bats-tests-not-deleted` requires a ledger arm to quote the deleted case title
VERBATIM under `crates/batten/tests/**`. A governed case whose title carries that
word was therefore unrecordable and unretirable by construction — measured on
"the fixer is wired: session-start runs it, so a clone is compliant before it
commits". The exclude is anchored at the four ledger markers, so nothing but an
arm can reach it.
Weakens: rule-predicate-changed at rule[no-consumer-repo-name].exclude

Admits: 7ca6e8035a02da57c33a19d221be1af0e55e1fef1fea39c8ad9991841477f3d6
Admits-rule: protected-mutation
Admits-verdict: V-PROTECTED-MUTATION
Admits-subject: policy/shell-retirement.rego
Admits-head: 883e6fcc3f0f601a42c478f03569f592bd4d751e
Admits-epoch: 1850ecd0e20d51a13ee1bac68cf83478e646722efa856949dbd7ba94592bc22a
Admits-author: alec@wenzowski.com
Admits-prev: a170b2fd2ffba82e64605dec51e5b566546a4d9da4aa00baf16c7d20823698c3
Admits-answer-lost: CLOUD-312 row 10 cannot land at all. The gate refuses both of its own landable shapes for a retirement it mandates: editing the two suites that grep the retiring script is V-SHELL-RULE-EDITED, and deleting them is refused because their subjects survive. That is the structural dead end CLOUD-1051 already fixed once for a removed line, still unfixed for a removed case.
Admits-answer-precondition: policy/shell-retirement.rego is the owning surface for its own admission arms; no config key or CLI verb can add one. It is protected only because CLOUD-833 derives every policy row module into the protected set, and the class own remedy says to change it under review, which is what PR 804 is. The diff adds one admitted-removal shape and leaves every existing term byte-identical.
Admits-answer-rejected-route: R-USE-THE-OWNING-SURFACE does not apply: this module is the owning surface for shell-retirement admission arms. R-RESTORE-IT would restore a gate with no landable spelling for the change it demands.

Admits: c92d661175b162435c20a9c2a7e78f9e57c3e805f36049f1cac292dc42728f5c
Admits-rule: protected-mutation
Admits-verdict: V-PROTECTED-MUTATION
Admits-subject: batten.toml
Admits-head: 883e6fcc3f0f601a42c478f03569f592bd4d751e
Admits-epoch: 1850ecd0e20d51a13ee1bac68cf83478e646722efa856949dbd7ba94592bc22a
Admits-author: alec@wenzowski.com
Admits-prev: dddb39ae4779d81289438ea653f09f6610f0945146dd12f8dab939d528de807b
Admits-answer-lost: The one admitted edit is structurally unreachable for the half of the governed set that is bats suites, and has been since the arm was written. Every retirement whose cleanup touches a suite is refused with no landable spelling, and the refusal is indistinguishable from a genuine one because the finding is identical. CLOUD-1294 measured it on three cases in two suites.
Admits-answer-precondition: The shell-retirement row line_sources is ["mise-tasks/*.sh", "crates/batten/tests/**/*.rs"], so input.tree.lines and base-lines are undefined for every tests/**/*.bats path. only_drops_a_retired_reference binds base from base-lines, so it is UNDEFINED for a bats suite and arm B refuses every edited suite unconditionally, whatever the edit. A rule row line_sources exists only in batten.toml; no module or task can widen it.
Admits-answer-rejected-route: R-USE-THE-OWNING-SURFACE does not apply: batten.toml is the owning surface for a rule row declared source list. R-RESTORE-IT restores a gate that cannot read the files it governs.
Admits: 82401ea1725edb719c698e71a25f8697a8d14456174117cbe21e7be8ca95b815
Admits-rule: protected-mutation
Admits-verdict: V-PROTECTED-MUTATION
Admits-subject: policy/shell-retirement.rego
Admits-head: 883e6fcc3f0f601a42c478f03569f592bd4d751e
Admits-epoch: 9b32b04b38932b50d9c3b13da9cde22f4f92ef55951a0ac1517c2eb9743945d2
Admits-author: alec@wenzowski.com
Admits-prev: 7ca6e8035a02da57c33a19d221be1af0e55e1fef1fea39c8ad9991841477f3d6
Admits-answer-lost: Two of the three cases CLOUD-312 row 10 must drop stay refused, so the retirement still cannot land. The arm would admit only the case that happens to name the path in its title, which is an accident of wording rather than a predicate.
Admits-answer-precondition: The container-preflight cases reference the retired script only through the HOOK variable, whose binding this same delta removes, so no line inside either case names the retired path and the case arm cannot see them. Resolving that binding is a property of this module admission arms; there is no other surface for it.
Admits-answer-rejected-route: R-USE-THE-OWNING-SURFACE does not apply: this module owns its admission arms. R-RESTORE-IT leaves the gate refusing a cleanup it mandates.

Admits: 0d93e4b921f90a44889c603f2698d85c37d62c6ef5ef15fad2127fe103dd4804
Admits-rule: protected-mutation
Admits-verdict: V-PROTECTED-MUTATION
Admits-subject: batten.toml
Admits-head: 883e6fcc3f0f601a42c478f03569f592bd4d751e
Admits-epoch: 9b32b04b38932b50d9c3b13da9cde22f4f92ef55951a0ac1517c2eb9743945d2
Admits-author: alec@wenzowski.com
Admits-prev: c92d661175b162435c20a9c2a7e78f9e57c3e805f36049f1cac292dc42728f5c
Admits-answer-lost: CLOUD-312 row 10 cannot record the commit-attribution case it drops, so that case cannot be retired at all. More generally every governed bats case whose title carries the word is permanently unretirable, and the refusal reads as a rule 1 violation over what is actually a quoted historical string about a line being deleted.
Admits-answer-precondition: A retirement ledger arm must quote the deleted case title verbatim for bats-tests-not-deleted to match it, and declared_in puts every arm under crates/**, which is this row glob. A case whose title contains the banned word is therefore unrecordable and unretirable by construction. The exclude is the only surface that can say so; a rule row lives in batten.toml alone.
Admits-answer-rejected-route: R-USE-THE-OWNING-SURFACE does not apply: batten.toml owns a forbid row exclude. R-RESTORE-IT restores a rule that makes a class of retirement structurally impossible.

Refs: CLOUD-1294, CLOUD-312, CLOUD-1051
Weakens: rule-predicate-changed rule[shell-retirement].line_sources
Weakens: rule-predicate-changed rule[no-consumer-repo-name].exclude
---
 batten.toml                                   |  28 ++-
 .../batten/tests/it/session_provisioning.rs   |   2 +-
 crates/batten/tests/it/shell_retirement.rs    | 219 +++++++++++++++++-
 policy/shell-retirement.rego                  | 157 ++++++++++++-
 tests/commit-attribution.bats                 |   5 -
 tests/container-preflight.bats                |  13 --
 6 files changed, 396 insertions(+), 28 deletions(-)

diff --git a/batten.toml b/batten.toml
index 8ccbb05ca..9c2e6f4d7 100644
--- a/batten.toml
+++ b/batten.toml
@@ -2578,11 +2578,26 @@ severity = "deny"
 scope = "tree"
 no_fix_reason = "declare it as a `[[pattern]]` row and read it by id; a tracker's vocabulary in the core is rule 1's violation, and moving it is the fix rather than rewording it"
 
+# A RETIREMENT LEDGER ARM IS EXEMPT, and this is a structural collision rather
+# than a convenience (CLOUD-1294). `bats-tests-not-deleted` matches an arm by the
+# deleted case's title QUOTED VERBATIM, and its `declared_in` puts every arm under
+# `crates/batten/tests/**` — inside this row's glob. So a governed bats case whose
+# TITLE happens to carry this word can never be recorded, and therefore never
+# retired, however honest the retirement is.
+#
+# Measured on CLOUD-312 row 10: `"the fixer is wired: session-start runs it, so a
+# clone is compliant before it commits"`.
+#
+# It is not a weakening of what this row decides. The row bans a consumer's name
+# appearing in the core; an arm is DATA ABOUT A LINE THAT NO LONGER EXISTS, and
+# the four markers anchor it at the start of a line, so nothing but a ledger row
+# can reach the exemption.
 [[rule]]
 id = "no-consumer-repo-name"
 kind = "forbid"
 glob = "crates/**"
 regex = "(?i)complian"
+exclude = "^// (carried|subsumed|changed|withdrawn): "
 severity = "deny"
 scope = "tree"
 
@@ -4113,7 +4128,18 @@ base = "origin/main"
 # withdrawal as one over a live subject and refuses it. A false refusal, in the
 # direction that blocks correct work.
 delta_sources = ["**"]
-line_sources = ["mise-tasks/*.sh", "crates/batten/tests/**/*.rs"]
+# `tests/**/*.bats` IS HALF THE GOVERNED SET AND WAS NOT A DECLARED SOURCE
+# (CLOUD-1294). `governed_at_head` selects every bats suite, but the lines of one
+# were never read — so `only_drops_a_retired_reference` bound `base` from
+# `base-lines` and came back UNDEFINED for every suite, and arm B refused every
+# edited `.bats` unconditionally, whatever the edit was. The one admitted edit
+# has been unreachable for half the corpus since it was written, and the refusal
+# was indistinguishable from a real one because the finding is byte-identical.
+#
+# Measured on CLOUD-312 row 10: three cases in two suites, no landable spelling.
+# The cost of reading them is `.claude/rules/rust.md`'s ~5.4 µs per declared
+# document against ~137 suites — under a millisecond, on a 100 ms budget.
+line_sources = ["mise-tasks/*.sh", "crates/batten/tests/**/*.rs", "tests/**/*.bats"]
 module = "policy/shell-retirement.rego"
 severity = "deny"
 
diff --git a/crates/batten/tests/it/session_provisioning.rs b/crates/batten/tests/it/session_provisioning.rs
index d435de55a..7d5ebd037 100644
--- a/crates/batten/tests/it/session_provisioning.rs
+++ b/crates/batten/tests/it/session_provisioning.rs
@@ -97,7 +97,7 @@
 // changed: "the hook runs green on this checkout" crates/batten/tests/it/session_provisioning.rs the exit-0-and-silent half survives as `a_step_that_passes_says_nothing`, against stubs; the END-TO-END half is withdrawn, because dispatching the real rows provisions a container inside `test:cargo` — 141s measured cold — which is the cost CLOUD-1268 exists to stop moving between lanes. What covers it instead is the session itself: a failed step reports on the advisory channel at the moment it fails
 // changed: "running the hook leaves the tracked lockfile untouched" crates/batten/tests/it/session_provisioning.rs narrowed from the EFFECT to the DECLARATION: `the_install_step_is_declared_lockfile_free` asserts `session:install` carries MISE_LOCKFILE=false, where the retired case ran the hook and diffed `git status -- mise.lock`. `[settings] lockfile = false` in mise.toml is the standing authority and `lock-complete` the standing gate; what is lost is the observation that this particular path honours it
 // changed: "the session-start hook calls it — the whole point is WHEN it runs" crates/batten/tests/it/session_provisioning.rs from `tests/container-preflight.bats`, whose own subject survives. The case grepped the retired script for `container-preflight`; the property — that a preflight nothing runs at startup is worthless — is now the `session-container-preflight` row, and its POSITION is asserted too, which the grep could not say
-// withdrawn: "the hook passes --degraded when provisioning failed" the capability is gone rather than moved, and this is the one real loss in this retirement. `--degraded` told the preflight not to trust toolchain-dependent probes when an earlier step had failed, and it worked because the script carried a `fail` variable across its steps. Handlers share no state — each is its own process with its own outcome — so nothing can compute the flag. The consequence is bounded: a container whose install failed now gets the full probe set, so it may report a second symptom of one cause, and both refusals arrive in the same reply. Recovering it needs a fact the door does not carry; filed rather than papered over
+// changed: "the hook passes --degraded when provisioning failed" batten.toml the capability is gone rather than moved, and this is the one real loss in this retirement. `--degraded` told the preflight not to trust toolchain-dependent probes when an earlier step had failed, and it worked because the script carried a `fail` variable across its steps. Handlers share no state — each is its own process with its own outcome — so nothing can compute the flag. The consequence is bounded: a container whose install failed now gets the full probe set, so it may report a second symptom of one cause, and both refusals arrive in the same reply. Recovering it needs a fact the door does not carry; filed rather than papered over
 // changed: "the fixer is wired: session-start runs it, so a clone is compliant before it commits" crates/batten/tests/it/session_provisioning.rs from `tests/commit-attribution.bats`, whose own subject (hk.pkl, mise.toml) survives. The case grepped the retired script for its `step attribution-identity` line; the property — that the identity fixer runs before a clone commits — is now the `session-attribution-identity` row, asserted by `the_committed_provisioning_declares_every_step_in_order`. It is CHANGED rather than CARRIED because the retired case pinned the invocation's exact spelling inside a program and this pins a row's presence and position in a list
 // changed: "the git hooks are installed — the per-clone step that was absent" mise-tasks/doctor.sh narrowed from perform-and-assert in one case to assert-only: `doctor` decides that same state on every later run, which the retired case's own comment already named as its backstop, and `tests/git-hook.bats` owns what the installed body does. What is lost is the pairing of the step with its effect inside one case
 //!
diff --git a/crates/batten/tests/it/shell_retirement.rs b/crates/batten/tests/it/shell_retirement.rs
index 94e62219d..e513bf1a6 100644
--- a/crates/batten/tests/it/shell_retirement.rs
+++ b/crates/batten/tests/it/shell_retirement.rs
@@ -43,7 +43,11 @@ fn row() -> Rule {
         // declared subject is routinely under neither governed prefix, and a
         // narrow delta hides its death rather than reporting it.
         "delta_sources": ["**"],
-        "line_sources": ["mise-tasks/*.sh", "crates/batten/tests/*.rs"],
+        // MIRRORS THE COMMITTED ROW, including `tests/**/*.bats` (CLOUD-1294).
+        // Without that entry a suite's lines are never read, `base-lines` has no
+        // entry for it, and every case below would pass or fail for the wrong
+        // reason — which is the state the committed row was in.
+        "line_sources": ["mise-tasks/*.sh", "crates/batten/tests/*.rs", "tests/**/*.bats"],
         "module": "policy/shell-retirement.rego",
         "severity": "deny",
     }))
@@ -1366,3 +1370,216 @@ fn an_invocation_field_does_not_satisfy_the_successor_obligations() {
         findings(&root)
     );
 }
+
+/// A bats suite whose two cases differ only in what they name, so the pair below
+/// is byte-identical apart from which one the head drops (CLOUD-1294).
+///
+/// The first case greps the path the delta retires; the second names nothing
+/// this change touches. Both close with `}` at column 0 and both carry the same
+/// assertion line, which is deliberate: `removed` is a set of LINES, so the
+/// shared lines are still present at head and never enter it. What the arm has
+/// to admit is the opener and the naming line, and nothing else.
+const CASE_SUITE: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+@test \"the gate is wired\" {\n\
+\trun grep -q mise-tasks/old-gate.sh wiring\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+/// The retired case dropped, the unrelated one kept.
+const CASE_SUITE_RETIRED_DROPPED: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+/// The unrelated case dropped, the retired one kept. The anti-vacuity mirror.
+const CASE_SUITE_LIVE_DROPPED: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+@test \"the gate is wired\" {\n\
+\trun grep -q mise-tasks/old-gate.sh wiring\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+/// Only the retired case's OPENER dropped; its body, naming line included, stays.
+const CASE_SUITE_OPENER_ONLY: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+\trun grep -q mise-tasks/old-gate.sh wiring\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+fn suite_repo(name: &str, head_suite: &str) -> PathBuf {
+    repo(
+        name,
+        &[
+            ("mise-tasks/old-gate.sh", GATE),
+            ("mise-tasks/other.sh", GATE),
+            ("tests/suite.bats", CASE_SUITE),
+        ],
+        &Head {
+            written: &[
+                ("tests/suite.bats", head_suite),
+                (
+                    "crates/batten/tests/old_gate.rs",
+                    &ledger("mise-tasks/old-gate.sh"),
+                ),
+            ],
+            removed: &["mise-tasks/old-gate.sh"],
+        },
+    )
+}
+
+/// CLOUD-1294. Retiring a program leaves the suites that TESTED it greping a file
+/// that is gone, and dropping those cases is the cleanup the campaign mandates.
+///
+/// The arm above it admits only a removed LINE that names the retired path; a
+/// case's opener, its assertions and its closing brace name nothing. Measured on
+/// CLOUD-312 row 10 — three cases in two suites, and neither landable shape
+/// reached them, because both suites declare subjects that survive.
+#[test]
+fn a_bats_case_testing_a_retired_path_may_be_dropped_with_it() {
+    let root = suite_repo("bats-case-retired", CASE_SUITE_RETIRED_DROPPED);
+    assert!(
+        findings(&root).is_empty(),
+        "a case that tested the retired path goes with it, exactly as the line that \
+         named it does: {:?}",
+        findings(&root)
+    );
+}
+
+/// ANTI-VACUITY, and without it this arm is a licence to delete any case during
+/// any retirement — the maintaining-in-place arm B exists to refuse.
+///
+/// Byte-identical to the case above apart from WHICH block the head drops.
+#[test]
+fn a_bats_case_testing_a_live_path_is_still_refused() {
+    let root = suite_repo("bats-case-live", CASE_SUITE_LIVE_DROPPED);
+    assert_eq!(
+        findings(&root),
+        vec![String::from("shell-rule-retired")],
+        "the surviving case names nothing this delta retires, so dropping it is an \
+         ordinary edit to a governed suite"
+    );
+}
+
+/// A case is admitted when it DIES, never when it is merely opened up.
+///
+/// Deleting the opener and keeping the body would otherwise pass: the opener is
+/// absent from the head, which is what identifies a dead block. The clause that
+/// refuses it is `body in removed` — the line that named the retired path has to
+/// have gone too.
+#[test]
+fn a_half_deleted_bats_case_is_still_refused() {
+    let root = suite_repo("bats-case-half", CASE_SUITE_OPENER_ONLY);
+    assert_eq!(
+        findings(&root),
+        vec![String::from("shell-rule-retired")],
+        "a case whose naming line survives was edited, not retired"
+    );
+}
+
+/// CLOUD-1283's bound-and-spent shape, one arm over. `container-preflight.bats`
+/// binds its program once in `setup()` and every case greps `"$HOOK"`, so no line
+/// inside a case carries a path at all and the first arm cannot reach it.
+const BIND_SUITE: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+setup() {\n\
+\tHOOK=mise-tasks/old-gate.sh\n\
+}\n\
+\n\
+@test \"the gate is wired\" {\n\
+\trun grep -q \"$HOOK\" wiring\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+/// The binding goes with the case that spent it.
+const BIND_SUITE_DROPPED: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+setup() {\n\
+}\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+/// The case goes, the binding stays. The anti-vacuity mirror for the same arm.
+const BIND_SUITE_BINDING_KEPT: &str = "#!/usr/bin/env bats\n\
+# subject: mise-tasks/other.sh\n\
+\n\
+setup() {\n\
+\tHOOK=mise-tasks/old-gate.sh\n\
+}\n\
+\n\
+@test \"something unrelated\" {\n\
+\trun true\n\
+\t[ \"$status\" -eq 0 ]\n\
+}\n";
+
+fn bind_repo(name: &str, head_suite: &str) -> PathBuf {
+    repo(
+        name,
+        &[
+            ("mise-tasks/old-gate.sh", GATE),
+            ("mise-tasks/other.sh", GATE),
+            ("tests/binding.bats", BIND_SUITE),
+        ],
+        &Head {
+            written: &[
+                ("tests/binding.bats", head_suite),
+                (
+                    "crates/batten/tests/old_gate.rs",
+                    &ledger("mise-tasks/old-gate.sh"),
+                ),
+            ],
+            removed: &["mise-tasks/old-gate.sh"],
+        },
+    )
+}
+
+/// A case naming the retired path only through a variable dies with it, provided
+/// the binding dies too.
+#[test]
+fn a_bats_case_spending_a_retired_binding_may_be_dropped_with_it() {
+    let root = bind_repo("bats-bind-retired", BIND_SUITE_DROPPED);
+    assert!(
+        findings(&root).is_empty(),
+        "the case spent a binding this delta retires, and the binding went with \
+         it: {:?}",
+        findings(&root)
+    );
+}
+
+/// ANTI-VACUITY for the binding arm: a variable that survives buys nothing, so
+/// dropping a case that spends it is an ordinary edit to a governed suite.
+#[test]
+fn a_bats_case_spending_a_surviving_binding_is_refused() {
+    let root = bind_repo("bats-bind-kept", BIND_SUITE_BINDING_KEPT);
+    assert_eq!(
+        findings(&root),
+        vec![String::from("shell-rule-retired")],
+        "the binding is still there, so nothing about this case is going away"
+    );
+}
diff --git a/policy/shell-retirement.rego b/policy/shell-retirement.rego
index 49d0a4eca..ec79e38d5 100644
--- a/policy/shell-retirement.rego
+++ b/policy/shell-retirement.rego
@@ -93,6 +93,14 @@
 # character, so the pattern could never match the line it names. Nothing caught
 # it because nothing could reach a module to run it (CLOUD-1267).
 #MUTANT list-drop-not-exact|s@line == concat("", \[before, after\])@startswith(line, before)@|dropping_the_name_while_also_changing_the_line_is_refused
+# CLOUD-1294's three arms, and the case fields name the cases that observe them
+# — the exemption withdrawn above binds these too. The first keeps a half-deleted
+# case from buying its own removal; the second keeps a case whose binding
+# survives from doing the same; the third keeps the arm from becoming a licence
+# to delete any case during any retirement.
+#MUTANT case-half-deleted|s@body in removed@true@|a_half_deleted_bats_case_is_still_refused
+#MUTANT case-binding-survives|s@binding in removed@true@|a_bats_case_spending_a_surviving_binding_is_refused
+#MUTANT case-names-nothing-retired|s@mentions_retired(path, body, gone)@true@|a_bats_case_testing_a_live_path_is_still_refused
 #
 #MUTANT-SUITE crates/batten/tests/it/shell_retirement.rs
 
@@ -225,15 +233,14 @@ only_drops_a_retired_reference(path) if {
 	# neither is a retirement's cleanup.
 	count(removed) > 0
 
-	# Every removed line names a path this change retires.
-	#
-	# `mentions_retired` rather than a bare `contains` since CLOUD-1149: bash does
-	# not spell a sibling as a repo-relative path, so `$(dirname "$0")/x.sh` named
-	# nothing this clause could see and every such cleanup was refused.
+	# EVERY REMOVED LINE IS ADMITTED, by one of the two shapes below. Factored out
+	# of this body since CLOUD-1294, mirroring `admitted_addition` — the addition
+	# side has had four shapes behind one name since CLOUD-1224, and the removal
+	# side reading as a single inline predicate is what made its second shape look
+	# like a change to this clause rather than a sibling of it.
 	count({line |
 		some line in removed
-		some gone in delta.deleted
-		mentions_retired(path, line, gone)
+		admitted_removal(path, line, removed)
 	}) == count(removed)
 
 	# AND NOTHING WAS ADDED THAT IS NOT A TRUNCATION OF A REMOVED LINE. Without a
@@ -260,6 +267,51 @@ only_drops_a_retired_reference(path) if {
 	}) == count(added)
 }
 
+# A removed line names a path this change retires.
+#
+# `mentions_retired` rather than a bare `contains` since CLOUD-1149: bash does
+# not spell a sibling as a repo-relative path, so `$(dirname "$0")/x.sh` named
+# nothing this clause could see and every such cleanup was refused.
+admitted_removal(path, line, _) if {
+	some gone in delta.deleted
+	mentions_retired(path, line, gone)
+}
+
+# OR IT IS ONE OF THE LINES OF A `@test` CASE THAT DIES WITH THE PATH IT TESTED
+# (CLOUD-1294), and this is the second shape the campaign could not complete
+# without.
+#
+# THE MEASURED INSTANCE. Retiring `.claude/hooks/session-start.sh` (CLOUD-312 row
+# 10) leaves three cases in two suites greping a file that is gone —
+# `tests/commit-attribution.bats` and `tests/container-preflight.bats`. Neither
+# landable shape reaches them: deleting a suite whole is refused because both
+# declare subjects that SURVIVE (`hk.pkl`, `mise.toml`,
+# `mise-tasks/container-preflight.sh`), and the arm above admits only a removed
+# LINE that names the retired path — a removed case's opener, its assertions and
+# its closing brace name nothing. So the campaign again mandated a retirement it
+# could not land, which is CLOUD-1051's own words for why the arm above exists.
+#
+# THE CASE MUST BE GONE, NOT MERELY EDITED. `@test` titles are unique within a
+# suite, so an opener absent from the head identifies a block that died. Deleting
+# only the opener and keeping the body is NOT that, and it is refused by the
+# clause below rather than by taste: the line that names the retired path must
+# itself be among the removed, so a half-deleted case buys nothing.
+#
+# AND THE CASE MUST HAVE EARNED ITS OWN REMOVAL, by naming a path this delta
+# retires. Without that term this is a licence to delete any case during any
+# retirement — precisely the maintaining-in-place that arm B exists to refuse —
+# and `a_bats_case_testing_a_live_path_is_still_refused` is the mirror that fails
+# if it is ever dropped.
+#
+# THE BOUND, STATED RATHER THAN DISCOVERED: `removed` is a set of LINES, so a
+# removed line whose text exactly matches one inside the dying case is admitted
+# even if it came from elsewhere in the same file. Positional alignment would
+# close that, and Rego cannot compute one without a diff algorithm the engine
+# does not hand over. It is narrow — the match must be exact, nothing may be
+# ADDED under the clause below, and a stray identical line removed elsewhere
+# breaks the case it was taken from.
+admitted_removal(path, line, removed) if line_of_a_retired_case(path, line, removed)
+
 # An added line is admitted three ways, and all three are shapes rather than
 # judgements.
 admitted_addition(_, line, removed) if truncates_a_retired_reference(line, removed)
@@ -270,6 +322,97 @@ admitted_addition(path, line, removed) if repoints_at_the_declared_invocation(pa
 
 admitted_addition(_, line, removed) if drops_a_retired_name(line, removed)
 
+# ---------------------------------------------------------------------------
+# A `@test` case that goes with the path it tested (CLOUD-1294).
+# ---------------------------------------------------------------------------
+
+# A BOOLEAN RULE, NEVER A FUNCTION RETURNING A SET, and the distinction is
+# load-bearing rather than stylistic. A function whose body cannot bind — a path
+# with no `base-lines`, a caller that is not a bats suite at all — is UNDEFINED,
+# and an undefined term inside `only_drops_a_retired_reference` would make that
+# whole admission undefined and refuse the `mise-tasks/` cleanups that work
+# today. A rule that simply does not hold is false, which is the only safe shape
+# for an additive arm.
+line_of_a_retired_case(path, line, removed) if {
+	base := delta["base-lines"][path]
+	head := {l | some l in input.tree.lines[path]}
+
+	# A case whose opener the head no longer carries.
+	some start, opener in base
+	startswith(opener, "@test ")
+	not opener in head
+	stop := case_end(base, start)
+
+	case_earns_removal(path, base, start, stop, removed)
+
+	# `line` is one of that case's own lines.
+	some at, own in base
+	at >= start
+	at <= stop
+	own == line
+}
+
+# HOW A CASE EARNS ITS OWN REMOVAL. Two spellings, because a suite references the
+# program it tests in two ways and only one of them is a path.
+
+# It NAMES the retired path, and that line is going away too.
+#
+# The second conjunct is what refuses a half-deleted case: an absent opener is
+# what identifies a dead block, so without it, deleting only the opener and
+# keeping the body would pass.
+case_earns_removal(path, base, start, stop, removed) if {
+	some named, body in base
+	named >= start
+	named <= stop
+	body in removed
+	some gone in delta.deleted
+	mentions_retired(path, body, gone)
+}
+
+# Or it SPENDS a variable this file bound to the retired path, and the BINDING is
+# going away in the same delta.
+#
+# THE MEASURED INSTANCE, and it is why the arm above is not enough on its own.
+# `tests/container-preflight.bats` binds `HOOK` once in `setup()` and every case
+# then greps `"$HOOK"`. No line inside either case carries a path at all, so
+# `mentions_retired` sees nothing — and the one case that WAS admitted by the arm
+# above was admitted because the retired program's stem happened to appear in its
+# title, which is an accident of wording rather than a predicate.
+#
+# `retired_path_vars` is not reused here, deliberately: it reads
+# `is_retired_reference_by_text`, which requires the bound value to BE the path or
+# to resolve through a script-directory marker, and a suite spells it relative to
+# its own directory (`$BATS_TEST_DIRNAME/../.claude/hooks/…`). Loosening that
+# function would loosen the repointing arms on the ADDITION side with it, where
+# nothing is going away and the byte-check is the whole safety property. This
+# reads the same binding through `mentions_retired`, which is already the looser
+# going-away test, and requires the binding line itself to be removed — so a
+# variable that survives buys nothing.
+case_earns_removal(path, base, start, stop, removed) if {
+	some binding in base
+	binding in removed
+	some gone in delta.deleted
+	mentions_retired(path, binding, gone)
+	variable := assigned_name(binding)
+
+	some spent, body in base
+	spent >= start
+	spent <= stop
+	some spelling in {concat("", ["$", variable]), concat("", ["${", variable, "}"])}
+	contains(body, spelling)
+}
+
+# The `}` closing the case opened at `start`.
+#
+# Column 0 is the whole test: bats closes an `@test` there and every nested
+# closer inside one is indented. An unterminated case yields an empty set, `min`
+# is undefined over it, and the arm does not hold — the safe direction for a rule
+# whose failure mode is a silent licence.
+case_end(base, start) := stop if {
+	closers := {i | some i, l in base; i > start; l == "}"}
+	stop := min(closers)
+}
+
 # ---------------------------------------------------------------------------
 # How a caller SPELLS the program it is losing (CLOUD-1149).
 # ---------------------------------------------------------------------------
diff --git a/tests/commit-attribution.bats b/tests/commit-attribution.bats
index 07edd3196..8ee9bd1fa 100644
--- a/tests/commit-attribution.bats
+++ b/tests/commit-attribution.bats
@@ -38,11 +38,6 @@ setup() {
 	[ "$output" = "wired" ]
 }
 
-@test "the fixer is wired: session-start runs it, so a clone is compliant before it commits" {
-	run grep -c 'step attribution-identity mise run attribution-identity' .claude/hooks/session-start.sh
-	[ "$output" = "1" ]
-}
-
 @test "both tasks resolve to the engine, not to a second implementation" {
 	# The policy has exactly one evaluator. A shell task that re-implemented any
 	# part of the predicate would be the second authority this issue moved the
diff --git a/tests/container-preflight.bats b/tests/container-preflight.bats
index 21bd2dea7..02b0a29f9 100644
--- a/tests/container-preflight.bats
+++ b/tests/container-preflight.bats
@@ -12,7 +12,6 @@
 
 setup() {
 	PREFLIGHT="$BATS_TEST_DIRNAME/../mise-tasks/container-preflight.sh"
-	HOOK="$BATS_TEST_DIRNAME/../.claude/hooks/session-start.sh"
 	STUB="$BATS_TEST_TMPDIR/bin"
 	mkdir -p "$STUB"
 	# A fenced environment by default, so a test that is not about egress does
@@ -127,15 +126,3 @@ EOF
 	[[ "$output" == *"a defect in this repository"* ]]
 	[[ "$output" == *"memories"* ]]
 }
-
-@test "the session-start hook calls it — the whole point is WHEN it runs" {
-	# A preflight nothing runs at startup is the state this issue found: the
-	# diagnosis existed (gh-preflight) and no session ever consulted it.
-	run grep -q "container-preflight" "$HOOK"
-	[ "$status" -eq 0 ]
-}
-
-@test "the hook passes --degraded when provisioning failed" {
-	run grep -q -- "container-preflight -- --degraded" "$HOOK"
-	[ "$status" -eq 0 ]
-}

From ed549b019a7d5db38cc111ab113e593736cee3cd Mon Sep 17 00:00:00 2001
From: Alec Wenzowski <alec@wenzowski.com>
Date: Tue, 1 Sep 2026 12:09:25 +0000
Subject: [PATCH 4/5] fix(test): write the fixture config through fmt::Write
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`format_push_string` and then `items_after_statements` — the workspace lints
refuse the extra allocation and then refuse the import that avoids it if it
sits after the first statement. The earlier auto-fix was lost when main's
CLOUD-1210 restructure moved this file into the `it` group during the rebase.

Refs: CLOUD-1294, CLOUD-1210
---
 crates/batten/tests/it/session_provisioning.rs | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/crates/batten/tests/it/session_provisioning.rs b/crates/batten/tests/it/session_provisioning.rs
index 7d5ebd037..2e443bd90 100644
--- a/crates/batten/tests/it/session_provisioning.rs
+++ b/crates/batten/tests/it/session_provisioning.rs
@@ -203,15 +203,24 @@ impl Bench {
 
 /// Build a fixture whose `batten.toml` declares `rows`, in order.
 fn bench(name: &str, rows: &[(&str, u64)]) -> Bench {
+    // `fmt::Write` rather than `push_str(&format!(..))`, which the workspace
+    // lints refuse as `format_push_string` — the same aliased import
+    // `admission.rs` uses, for the same reason: the extra `String` is pure
+    // allocation. Writing to a `String` is infallible, so the `Result` carries
+    // nothing to handle. Before the first statement, or `items_after_statements`
+    // refuses it in turn.
+    use std::fmt::Write as _;
+
     let dir = scratch(name);
     let repo = dir.join("repo");
     std::fs::create_dir_all(repo.join("steps")).expect("the fixture repo");
 
     let mut config = String::from("version = 1\n");
     for (id, timeout_ms) in rows {
-        config.push_str(&format!(
+        let _ = write!(
+            config,
             "\n[[hook.handler]]\nid = \"{id}\"\non = \"session-start\"\nrun = [\"steps/{id}\"]\ntimeout_ms = {timeout_ms}\nowner = \"CLOUD-312\"\nexpires = \"2027-02-28\"\n"
-        ));
+        );
     }
     write(&repo, "batten.toml", &config);
     git_in(&repo, &["init", "-q", "-b", "main", "."]);

From 606304936fbd9a3ee6fe50b7938f7b39c4f02fce Mon Sep 17 00:00:00 2001
From: Alec Wenzowski <alec@wenzowski.com>
Date: Tue, 1 Sep 2026 14:47:12 +0000
Subject: [PATCH 5/5] test(policy): bind the case fixture the way a suite
 actually binds it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`a_bats_case_spending_a_surviving_binding_is_refused` failed, and for a real
reason rather than a harness one: the fixture bound `HOOK` to the literal
repo-relative path, so `retired_path_vars` resolved it, `mentions_retired`'s
variable arm saw the spelling inside the case body, and the FIRST
`case_earns_removal` arm admitted the case whether or not the binding died.
The anti-vacuity mirror could not hold, and the binding arm was untested.

Rebound through `$BATS_TEST_DIRNAME/../…`, which is what
`tests/container-preflight.bats` writes and what the arm was added for: it
matches neither `shell-script-directory` nor the marker pattern, so
`retired_path_vars` is empty and the case body names nothing. The pair now
discriminates — binding removed is admitted, binding kept is refused.

The suite cost table is regenerated in the same commit because the rebase took
main's copy, which still records the suite this branch retires.

Refs: CLOUD-1294, CLOUD-1283
---
 bench/suites/RESULTS.md                    | 223 ++++++++++-----------
 crates/batten/tests/it/shell_retirement.rs |   4 +-
 2 files changed, 113 insertions(+), 114 deletions(-)

diff --git a/bench/suites/RESULTS.md b/bench/suites/RESULTS.md
index 81cf164df..e6c196998 100644
--- a/bench/suites/RESULTS.md
+++ b/bench/suites/RESULTS.md
@@ -6,136 +6,135 @@ runner measured it; the suite runs `--no-parallelize-within-files`, so a
 file's number is its own serial cost and is what an author adding a case
 to it pays.
 
-- suites: 130
-- serial total: 660.5s
+- suites: 127
+- serial total: 689.2s
 
 | seconds | share | suite |
 | ---: | ---: | --- |
-| 147.0 | 22.3% | `tests/land-lock.bats` |
-| 82.9 | 12.6% | `tests/land.bats` |
-| 48.1 | 7.3% | `tests/hooks-wiring-check.bats` |
-| 34.7 | 5.3% | `tests/main-watch.bats` |
-| 27.1 | 4.1% | `tests/sbom-check.bats` |
-| 24.4 | 3.7% | `tests/hook-latency-drift.bats` |
-| 21.5 | 3.3% | `tests/graph-check.bats` |
-| 17.0 | 2.6% | `tests/config-lint.bats` |
-| 14.8 | 2.2% | `tests/board-diff-overlap.bats` |
-| 11.4 | 1.7% | `tests/run-shape-guard.bats` |
-| 9.8 | 1.5% | `tests/sbom.bats` |
-| 8.9 | 1.3% | `tests/target-race.bats` |
-| 8.0 | 1.2% | `tests/token-bench.bats` |
-| 7.8 | 1.2% | `tests/ready-lint.bats` |
-| 7.6 | 1.2% | `tests/board-sweep.bats` |
-| 7.4 | 1.1% | `tests/ready-guard.bats` |
-| 6.8 | 1.0% | `tests/session-start.bats` |
-| 6.6 | 1.0% | `tests/released.bats` |
-| 6.5 | 1.0% | `tests/replay.bats` |
-| 5.4 | 0.8% | `tests/lock-complete.bats` |
-| 5.3 | 0.8% | `tests/in-progress-drain.bats` |
-| 5.2 | 0.8% | `tests/release-tracking-check.bats` |
-| 5.0 | 0.8% | `tests/lint-deno.bats` |
-| 5.0 | 0.8% | `tests/singleton.bats` |
-| 4.9 | 0.7% | `tests/release-assets-check.bats` |
-| 4.9 | 0.7% | `tests/mcp-allow-check.bats` |
-| 4.7 | 0.7% | `tests/step-receipt.bats` |
-| 4.3 | 0.7% | `tests/ready-cites-check.bats` |
-| 3.9 | 0.6% | `tests/land-divergence.bats` |
-| 3.9 | 0.6% | `tests/task-registry.bats` |
-| 3.8 | 0.6% | `tests/hk-selection.bats` |
-| 3.7 | 0.6% | `tests/doctor-race.bats` |
-| 3.5 | 0.5% | `tests/with-lock.bats` |
-| 3.3 | 0.5% | `tests/ntia-check.bats` |
-| 3.2 | 0.5% | `tests/target-ensure.bats` |
-| 2.9 | 0.4% | `tests/finding-sink-check.bats` |
-| 2.9 | 0.4% | `tests/closing-key-check.bats` |
+| 154.0 | 22.4% | `tests/land-lock.bats` |
+| 94.9 | 13.8% | `tests/land.bats` |
+| 52.4 | 7.6% | `tests/hooks-wiring-check.bats` |
+| 34.6 | 5.0% | `tests/main-watch.bats` |
+| 24.4 | 3.5% | `tests/graph-check.bats` |
+| 24.4 | 3.5% | `tests/hook-latency-drift.bats` |
+| 22.8 | 3.3% | `tests/sbom-check.bats` |
+| 20.6 | 3.0% | `tests/config-lint.bats` |
+| 15.8 | 2.3% | `tests/board-diff-overlap.bats` |
+| 14.9 | 2.2% | `tests/run-shape-guard.bats` |
+| 10.1 | 1.5% | `tests/token-bench.bats` |
+| 9.8 | 1.4% | `tests/ready-lint.bats` |
+| 9.1 | 1.3% | `tests/ready-guard.bats` |
+| 8.2 | 1.2% | `tests/released.bats` |
+| 7.8 | 1.1% | `tests/board-sweep.bats` |
+| 7.6 | 1.1% | `tests/target-race.bats` |
+| 7.0 | 1.0% | `tests/lock-complete.bats` |
+| 6.8 | 1.0% | `tests/replay.bats` |
+| 6.4 | 0.9% | `tests/step-receipt.bats` |
+| 6.3 | 0.9% | `tests/release-tracking-check.bats` |
+| 6.3 | 0.9% | `tests/sbom.bats` |
+| 6.2 | 0.9% | `tests/release-assets-check.bats` |
+| 5.9 | 0.9% | `tests/in-progress-drain.bats` |
+| 5.9 | 0.9% | `tests/mcp-allow-check.bats` |
+| 4.8 | 0.7% | `tests/ready-cites-check.bats` |
+| 4.6 | 0.7% | `tests/ntia-check.bats` |
+| 4.5 | 0.7% | `tests/singleton.bats` |
+| 4.3 | 0.6% | `tests/land-divergence.bats` |
+| 4.2 | 0.6% | `tests/task-registry.bats` |
+| 4.0 | 0.6% | `tests/hk-selection.bats` |
+| 3.8 | 0.5% | `tests/doctor-race.bats` |
+| 2.9 | 0.4% | `tests/target-ensure.bats` |
+| 2.8 | 0.4% | `tests/landed-check.bats` |
+| 2.8 | 0.4% | `tests/with-lock.bats` |
 | 2.7 | 0.4% | `tests/claim-race-check.bats` |
-| 2.7 | 0.4% | `tests/lint-rego.bats` |
-| 2.5 | 0.4% | `tests/landed-check.bats` |
-| 2.2 | 0.3% | `tests/spawn-census.bats` |
-| 2.1 | 0.3% | `tests/install.bats` |
-| 2.1 | 0.3% | `tests/ci-slow-needed.bats` |
-| 2.0 | 0.3% | `tests/suite-select.bats` |
-| 2.0 | 0.3% | `tests/bot-issue.bats` |
+| 2.6 | 0.4% | `tests/spec-ref-check.bats` |
+| 2.6 | 0.4% | `tests/closing-key-check.bats` |
+| 2.6 | 0.4% | `tests/suite-select.bats` |
+| 2.5 | 0.4% | `tests/finding-sink-check.bats` |
+| 2.4 | 0.4% | `tests/perf-record.bats` |
+| 2.4 | 0.3% | `tests/install.bats` |
+| 2.3 | 0.3% | `tests/unlanded-check.bats` |
+| 2.0 | 0.3% | `tests/tree-clean.bats` |
+| 2.0 | 0.3% | `tests/ci-slow-needed.bats` |
 | 2.0 | 0.3% | `tests/claimed-keys.bats` |
-| 1.8 | 0.3% | `tests/spec-ref-check.bats` |
-| 1.8 | 0.3% | `tests/alive.bats` |
-| 1.8 | 0.3% | `tests/ci-tools-check.bats` |
-| 1.7 | 0.3% | `tests/unlanded-check.bats` |
+| 2.0 | 0.3% | `tests/bot-issue.bats` |
+| 1.9 | 0.3% | `tests/signing-posture.bats` |
+| 1.9 | 0.3% | `tests/ci-tools-check.bats` |
+| 1.8 | 0.3% | `tests/ready-lint-deferral.bats` |
 | 1.7 | 0.3% | `tests/reclaim-census.bats` |
-| 1.7 | 0.3% | `tests/evaluator-closure-check.bats` |
-| 1.6 | 0.2% | `tests/signing-posture.bats` |
-| 1.5 | 0.2% | `tests/install-check.bats` |
-| 1.5 | 0.2% | `tests/deferral-check.bats` |
-| 1.5 | 0.2% | `tests/ready-lint-deferral.bats` |
-| 1.4 | 0.2% | `tests/ci-lease-precondition.bats` |
-| 1.4 | 0.2% | `tests/tree-clean.bats` |
-| 1.3 | 0.2% | `tests/done-check.bats` |
-| 1.3 | 0.2% | `tests/verify.bats` |
+| 1.7 | 0.2% | `tests/alive.bats` |
+| 1.5 | 0.2% | `tests/verify.bats` |
+| 1.5 | 0.2% | `tests/ci-lease-precondition.bats` |
+| 1.4 | 0.2% | `tests/done-check.bats` |
+| 1.4 | 0.2% | `tests/spawn-census.bats` |
+| 1.4 | 0.2% | `tests/deferral-check.bats` |
+| 1.3 | 0.2% | `tests/install-check.bats` |
 | 1.3 | 0.2% | `tests/awk-regex-check.bats` |
-| 1.2 | 0.2% | `tests/fact-record-keying.bats` |
-| 1.2 | 0.2% | `tests/perf-record.bats` |
+| 1.3 | 0.2% | `tests/linear-check.bats` |
+| 1.3 | 0.2% | `tests/nonverdict-scan.bats` |
+| 1.2 | 0.2% | `tests/land-divergence-assert.bats` |
+| 1.2 | 0.2% | `tests/perf-assert.bats` |
 | 1.1 | 0.2% | `tests/done-pr-check.bats` |
-| 1.1 | 0.2% | `tests/land-divergence-assert.bats` |
-| 1.1 | 0.2% | `tests/linear-check.bats` |
+| 1.1 | 0.2% | `tests/fact-record-keying.bats` |
+| 1.1 | 0.2% | `tests/release-backfill.bats` |
+| 1.1 | 0.2% | `tests/module-map-check.bats` |
+| 1.1 | 0.2% | `tests/duplicate-close-check.bats` |
+| 1.0 | 0.1% | `tests/doctor.bats` |
+| 1.0 | 0.1% | `tests/timeout-drift.bats` |
+| 1.0 | 0.1% | `tests/render-cli.bats` |
+| 1.0 | 0.1% | `tests/pr-unsubscribed.bats` |
 | 1.0 | 0.1% | `tests/attestation-check.bats` |
-| 1.0 | 0.1% | `tests/duplicate-close-check.bats` |
-| 0.9 | 0.1% | `tests/nonverdict-scan.bats` |
-| 0.9 | 0.1% | `tests/doctor.bats` |
-| 0.9 | 0.1% | `tests/module-map-check.bats` |
-| 0.9 | 0.1% | `tests/perf-assert.bats` |
-| 0.9 | 0.1% | `tests/release-backfill.bats` |
-| 0.8 | 0.1% | `tests/render-cli.bats` |
-| 0.8 | 0.1% | `tests/pr-unsubscribed.bats` |
-| 0.8 | 0.1% | `tests/hook-matcher-check.bats` |
-| 0.7 | 0.1% | `tests/commit-attribution.bats` |
-| 0.7 | 0.1% | `tests/timeout-drift.bats` |
+| 0.9 | 0.1% | `tests/evaluator-closure-check.bats` |
+| 0.9 | 0.1% | `tests/hook-matcher-check.bats` |
+| 0.9 | 0.1% | `tests/lint-rego.bats` |
+| 0.8 | 0.1% | `tests/sbom-binary.bats` |
+| 0.8 | 0.1% | `tests/lint-deno.bats` |
+| 0.8 | 0.1% | `tests/perf-compare.bats` |
+| 0.8 | 0.1% | `tests/verified.bats` |
+| 0.8 | 0.1% | `tests/suite-bench-check.bats` |
+| 0.7 | 0.1% | `tests/mcp-timeout-budget.bats` |
+| 0.7 | 0.1% | `tests/merged-pr-keys.bats` |
+| 0.7 | 0.1% | `tests/mcp-attach-check.bats` |
 | 0.7 | 0.1% | `tests/macos-link-check.bats` |
-| 0.6 | 0.1% | `tests/perf-compare.bats` |
-| 0.6 | 0.1% | `tests/merged-pr-keys.bats` |
+| 0.7 | 0.1% | `tests/stop-posture-check.bats` |
+| 0.7 | 0.1% | `tests/publish-credential-check.bats` |
 | 0.6 | 0.1% | `tests/checksums.bats` |
-| 0.6 | 0.1% | `tests/mcp-timeout-budget.bats` |
-| 0.6 | 0.1% | `tests/sbom-binary.bats` |
-| 0.6 | 0.1% | `tests/connector-allow-guard.bats` |
-| 0.6 | 0.1% | `tests/suite-bench-check.bats` |
-| 0.6 | 0.1% | `tests/stop-posture-check.bats` |
-| 0.6 | 0.1% | `tests/mcp-attach-check.bats` |
-| 0.6 | 0.1% | `tests/digest-major-agreement.bats` |
-| 0.6 | 0.1% | `tests/verified.bats` |
+| 0.6 | 0.1% | `tests/pipefail-grep-check.bats` |
+| 0.6 | 0.1% | `tests/commit-attribution.bats` |
+| 0.6 | 0.1% | `tests/hook-pin-check.bats` |
+| 0.6 | 0.1% | `tests/land-lock-check.bats` |
+| 0.5 | 0.1% | `tests/digest-major-agreement.bats` |
 | 0.5 | 0.1% | `tests/board-payloads.bats` |
+| 0.5 | 0.1% | `tests/connector-allow-guard.bats` |
+| 0.5 | 0.1% | `tests/run-shape-guard-quoting.bats` |
+| 0.5 | 0.1% | `tests/sonar-gate.bats` |
+| 0.5 | 0.1% | `tests/abandon-matrix.bats` |
 | 0.5 | 0.1% | `tests/branch-age-check.bats` |
-| 0.5 | 0.1% | `tests/commit-convention.bats` |
-| 0.5 | 0.1% | `tests/hook-pin-check.bats` |
-| 0.5 | 0.1% | `tests/land-lock-check.bats` |
-| 0.5 | 0.1% | `tests/publish-credential-check.bats` |
-| 0.4 | 0.1% | `tests/container-preflight.bats` |
-| 0.4 | 0.1% | `tests/pipefail-grep-check.bats` |
-| 0.4 | 0.1% | `tests/abandon-matrix.bats` |
-| 0.4 | 0.1% | `tests/sonar-gate.bats` |
-| 0.4 | 0.1% | `tests/msrv-pin-agreement.bats` |
-| 0.4 | 0.1% | `tests/connector-allow-resolve.bats` |
-| 0.4 | 0.1% | `tests/license-table-check.bats` |
-| 0.4 | 0.1% | `tests/timeout-check.bats` |
-| 0.4 | 0.1% | `tests/cap-drift.bats` |
+| 0.5 | 0.1% | `tests/msrv-pin-agreement.bats` |
+| 0.5 | 0.1% | `tests/timeout-check.bats` |
+| 0.5 | 0.1% | `tests/transcript-corpus-check.bats` |
+| 0.5 | 0.1% | `tests/license-table-check.bats` |
+| 0.4 | 0.1% | `tests/serena-mcp.bats` |
+| 0.4 | 0.1% | `tests/report-only-check.bats` |
+| 0.4 | 0.1% | `tests/no-doctests.bats` |
+| 0.4 | 0.1% | `tests/commit-convention.bats` |
 | 0.4 | 0.1% | `tests/release-due.bats` |
-| 0.4 | 0.1% | `tests/run-shape-guard-quoting.bats` |
-| 0.4 | 0.1% | `tests/transcript-corpus-check.bats` |
-| 0.4 | 0.1% | `tests/coderabbit-config-check.bats` |
-| 0.4 | 0.1% | `tests/batten-glob-check.bats` |
-| 0.3 | 0.1% | `tests/no-doctests.bats` |
-| 0.3 | 0.1% | `tests/serena-mcp.bats` |
-| 0.3 | 0.0% | `tests/nonverdict-assert.bats` |
-| 0.3 | 0.0% | `tests/report-only-check.bats` |
+| 0.4 | 0.1% | `tests/nonverdict-assert.bats` |
+| 0.3 | 0.1% | `tests/connector-allow-resolve.bats` |
+| 0.3 | 0.1% | `tests/batten-glob-check.bats` |
+| 0.3 | 0.0% | `tests/cap-drift.bats` |
+| 0.3 | 0.0% | `tests/container-preflight.bats` |
 | 0.3 | 0.0% | `tests/ci-drift.bats` |
+| 0.3 | 0.0% | `tests/coderabbit-config-check.bats` |
+| 0.3 | 0.0% | `tests/rust-paths-check.bats` |
 | 0.3 | 0.0% | `tests/git-hook.bats` |
-| 0.2 | 0.0% | `tests/rust-paths-check.bats` |
-| 0.2 | 0.0% | `tests/mise-action-floor.bats` |
-| 0.2 | 0.0% | `tests/dist.bats` |
 | 0.2 | 0.0% | `tests/token-bench-check.bats` |
-| 0.2 | 0.0% | `tests/remedy-payload-source.bats` |
+| 0.2 | 0.0% | `tests/mise-action-floor.bats` |
 | 0.2 | 0.0% | `tests/perf-gate.bats` |
-| 0.1 | 0.0% | `tests/task-fail-closed.bats` |
-| 0.1 | 0.0% | `tests/egress-check.bats` |
-| 0.1 | 0.0% | `tests/evaluator-io-check.bats` |
+| 0.2 | 0.0% | `tests/remedy-payload-source.bats` |
+| 0.2 | 0.0% | `tests/evaluator-io-check.bats` |
+| 0.2 | 0.0% | `tests/dist.bats` |
+| 0.2 | 0.0% | `tests/task-fail-closed.bats` |
+| 0.2 | 0.0% | `tests/egress-check.bats` |
 | 0.1 | 0.0% | `tests/darwin-link.bats` |
 | 0.1 | 0.0% | `tests/cross-check.bats` |
 | 0.0 | 0.0% | `tests/zizmor-split.bats` |
diff --git a/crates/batten/tests/it/shell_retirement.rs b/crates/batten/tests/it/shell_retirement.rs
index e513bf1a6..acea3a6cc 100644
--- a/crates/batten/tests/it/shell_retirement.rs
+++ b/crates/batten/tests/it/shell_retirement.rs
@@ -1500,7 +1500,7 @@ const BIND_SUITE: &str = "#!/usr/bin/env bats\n\
 # subject: mise-tasks/other.sh\n\
 \n\
 setup() {\n\
-\tHOOK=mise-tasks/old-gate.sh\n\
+\tHOOK=\"$BATS_TEST_DIRNAME/../mise-tasks/old-gate.sh\"\n\
 }\n\
 \n\
 @test \"the gate is wired\" {\n\
@@ -1530,7 +1530,7 @@ const BIND_SUITE_BINDING_KEPT: &str = "#!/usr/bin/env bats\n\
 # subject: mise-tasks/other.sh\n\
 \n\
 setup() {\n\
-\tHOOK=mise-tasks/old-gate.sh\n\
+\tHOOK=\"$BATS_TEST_DIRNAME/../mise-tasks/old-gate.sh\"\n\
 }\n\
 \n\
 @test \"something unrelated\" {\n\