The ledger gate stops running after any stopped rebase: drop the marker git leaves behind, and gate the hook on its own selftest

[rmsharp]

The gate stopped running, and nothing said so

.githooks/pre-commit skips replayed commits by testing five markers under the git dir:

for marker in MERGE_HEAD REBASE_HEAD CHERRY_PICK_HEAD rebase-merge rebase-apply; do

Git leaves REBASE_HEAD behind when a rebase that stopped — a conflict, or -i parked at
edit — runs to completion. It is not cleaned up at the end of the operation. From that moment the
hook exits 0 on every commit in that clone, for the life of the clone.

The marker loop runs before both gates the hook chains, so the casualty is not only the
failure-mode-#27 ledger gate but quality_ratchet.py --precommit, whose whole job is refusing a
loosened threshold. Both then read green — because neither one ran. A hook is the one gate nothing
else watches, and it fails open: its failure mode is silence, not red.

The shape was chosen by measuring git, not by weighing plausible fixes

Every operation in the marker list was run to completion on git 2.50.1 and its markers observed at
each stage. Two facts decided the patch:

1. REBASE_HEAD is the only marker that leaks. MERGE_HEAD, CHERRY_PICK_HEAD, rebase-merge
   and rebase-apply are all removed when their operation ends or is aborted — so none of them
   needs the same treatment, and the fix stays one line wide.
2. It is redundant. Every rebase in progress carries a directory too — rebase-merge on the
   merge backend, rebase-apply on --apply and git am. Dropping REBASE_HEAD therefore costs
   no in-progress coverage; the skip still fires for every state that is genuinely mid-operation.

A third measured fact explains how this survives review: a clean rebase leaks nothing. Only a
rebase that stopped arms the trap, which is why a hook can be correct-looking, enabled, and silently
dead for weeks.

What ships

• The fix: REBASE_HEAD dropped from the marker list, with the measurement recorded in a comment
  beside it so the next reader does not re-litigate it.
• .githooks/pre-commit --selftest — 10 checks, on the existing .githooks/commit-msg --selftest
  precedent: the gate refuses / passes / skips correctly, a stale REBASE_HEAD is still refused,
  and each genuinely in-progress state is still skipped.
• A pre-commit-selftest gate in .quality-gates.json, modelled on the commit-msg-selftest
  entry beside it. Adding a gate always passes the ratchet; no threshold moved, and
  bin/tests.sh is unchanged.

Evidence

• RED-first. The same ten checks against the unfixed marker list go red on exactly one and
  green on the other nine — the test isolates the defect rather than being vacuously red. 0 red after.

• 10 mutants, 10 killed: restore REBASE_HEAD; drop each of the four remaining markers; -e→-f
  (which stops matching the two directories); delete the loop; short-circuit the ledger gate; and two
  that break the selftest's own fixture builder.

• End-to-end against real git, not planted files. A real conflicted rebase was stopped, resolved
  and completed; REBASE_HEAD was confirmed on disk afterwards. With the fix, a commit with no ledger
  line is refused (exit 1, asserted bare — a pipe would clobber it), the same commit with the
  ledger co-staged passes, and a commit taken during a genuine in-progress rebase is still
  skipped. The control matters as much: in that identical scenario the unfixed hook lets the
  unledgered commit straight through.

• The selftest's own two hazards were closed before it was trusted. Each probe repo is built with
  git init --template=, so a user's init.templateDir cannot install its hooks into the probe and
  answer for the hook under test; and each fixture is asserted to have actually built — a probe
  against a repo that failed to build answers about nothing, and would do it in green.

• Measured in a --no-local clone with HEAD asserted by sha, before and after (the working tree
  is not the surface: one unit test there depends on local transcript data and fails in a working
  tree while skipping in every clone).
  Before, at 6b29d3d: bin/tests.sh 139 passed / 0 failed; gates
  10/10 pass · 0 fail · 0 unmeasured · results 6542e640a956 · manifest 97a7aab85b9a — which is the
  same results hash the newest receipt on main already cites, so the baseline is the one this
  repository last recorded.
  After: bin/tests.sh 139 passed / 0 failed, unchanged; gates
  11/11 pass · 0 fail · 0 unmeasured · results acddacb93988 · manifest ec617cec62ed, the eleventh
  being the new one.

Scope

.githooks/ is not in bin/_manifest.py, so no adopter is synced these files and nothing
distributed changes here. But SAFEGUARDS.md — which is distributed — points adopters at this file
as "the canonical reference implementation" and tells them to enable it, so an adopter who followed
that instruction copied this defect too. That is the argument for fixing it here rather than
locally: the reference implementation is what people copy.

🤖 Generated with Claude Code