perf(claude-ops): hook-failure-audit Stop hook reads the whole transcript on every Stop (7 s at 10 MB) #4389

Parent: #4373

Measurement

Harness: melodic-software/dotfiles#873. 22 runs per size, no-op spawn floor S = 20 ms.

The first Stop of a session is fast (133–191 ms at every size), because that call takes the capped tail -c cold path. Every later Stop scales with transcript size. Weighted by 0.76 Stop fires per turn, this hook alone is 5.3 s per turn at 10 MB. Production OTEL agrees: Stop p50 3.0 s and p95 10.2 s over 7 days, rising from 2.4 s to 7.5 s by session position.

Cause

The per-session cursor stores a line count, and the warm path skips the already-audited lines with mapfile -s $((CURSOR - 1)) LINES <"$TRANSCRIPT". mapfile -s still reads and splits every skipped line in bash. Timed on the same 10 MB transcript on this host: mapfile -s took 11.6 s (10.7 s sys), and tail -c 2000 took 49 ms.

Fix direction

• Store a byte offset in the cursor and read only the new bytes (tail -c +$((OFFSET + 1)), or dd skip=). That makes the cost proportional to new content, not to the whole transcript.
• The hook only audits and reports, so async: true would take it off the blocking path entirely (lever 2 in perf(hooks): Stop and per-tool-call hook fan-out exceed budget on Windows (Stop p50 2.9 s, grows with session length) #4373).

Acceptance

• Harness median at 10 MB within k × S plus measured work. The target is agreed through /performance:goal before implementing.
• The process count does not rise.
• Output is byte-identical on real transcripts, both cold and warm.