perf(autonomy): cut lane-stop-gate process creations on every Stop

[kyle-sexton]

Closes #3515

Important

Which of #3515's acceptance criteria this PR meets, and which it does not.

Criterion	Status
No more than 2 external process spawns on the common path (own shell + at most one jq)	Met for the common path, which is every interactive Stop: the hook's shell plus one uname -s. The one spawn is uname, not jq; it is the managed-settings platform primitive the trust design rests on ($OSTYPE is a variable a repo env block can set) and was left alone on purpose. Not met for an enabled lane's stop: that path launches 5 programs (4 jq, 1 uname), down from 18. One of those jq is in the fenced shared library's hook::buffer_stdin (its payload validation pass); the other three read three different inputs (payload, settings file, block decision).
grep/sed/cut/tr/basename/dirname replaced with builtins on the hot path	Met. None launches on either traced path; the suite pins their absence. cksum remains on the marker-consumption path only (it keys the ledger, and changing the key would orphan existing ledger entries).
An early guard exits before any spawn for non-matching invocations	Partially met. The payload-free pre-filter exits before stdin and before jq, but it spawns uname to know which fixed managed-settings path to test. Removing it would mean testing all three platform paths, one of which is cwd-relative on Linux, so it stays.
Existing behavioural tests pass; the guard blocks what it blocked before	Met, with one disclosed divergence in the stricter direction (below).
Measured on a Windows host, a single run completes in under 2 s	Not measured. This runner is Linux; wall-clock is not the right proxy here and no figure is invented. The hook-budget convention's per-turn 500 ms bar (the corrected criterion from the issue comments) also still needs the Windows measurement.

Closes #3515 is kept because the pr-issue-linkage gate wants a native closing keyword. A reviewer may prefer to reopen #3515 on merge for the Windows measurement and the enabled-lane count, or split those into a follow-up.

Summary

hooks/lane-stop-gate.sh is the autonomy plugin's Stop hook. It fires on every turn of every session, gated or not, and #3515 recorded it at a 27.6 s average with 73 timeouts against its 15 s budget on the #3508 hosts. It carried the largest in-file fork signature of the campaign: about 12 redirections and 11 pipes written inside command substitutions, plus a $( ) capture around every lib helper that is nothing but parameter expansion.

Following #3779's diagnosis rather than #3508's original framing: the cost was redirection placement and per-helper subshells, not per-field jq needing a shared helper. lib/hook-utils.sh and all 17 plugins/*/hooks/hook-utils.sh copies are untouched (git diff origin/main --name-only shows only the six autonomy files). The one shared-library facility used, hook::jq_fields, already existed on main.

Fix

All in plugins/autonomy/hooks/lane-stop-gate.sh and lane-stop-gate-lib.sh:

Site	Before	After
Lib path helpers (gate_data_dir, gate_trusted_data_dir, gate_arm_record_path, gate_arm_claim_path, gate_user_settings_file)	v=$(gate_x): one fork each, for a function that only expands parameters	gate_x_to <var> forms via printf -v; print forms delegate, so lane-stop-gate-arm.sh and the lib-level tests read exactly what they read before
Pre-filter settings scan	grep -q lane_stop_gate "$f" 2>/dev/null per file	builtin NUL-chunk read + substring test (gate_file_mentions), with 2>/dev/null written before the input redirection so an existing-but-unreadable settings file stays as silent as grep was (bash applies redirections left to right; see case 51)
Managed-files list	done < <(gate_managed_settings_files) with $(uname -s 2>/dev/null) inside: 3 creations per call, called up to 4 times per stop	gate_managed_settings_files_load fills an array in-process; { platform=$(uname -s); } 2>/dev/null is 1 creation; loaded once per stop and reused by option resolution
Payload fields (EVENT, SESSION_ID, CWD, STOP_ACTIVE, LAST)	five printf | jq | tr pipelines, 3-4 creations each	one hook::jq_fields pass (3 creations: process substitution, printf writer, jq); values chomped of trailing newlines so each reads byte-for-byte as the old $( ) capture did
Settings options (3 keys x managed files + user file)	one $(jq … <file 2>/dev/null) per key per file, each behind two more captures (8 creations per key)	gate_settings_options_to <file> <key>...: one jq per file for every key, NUL-separated through a process substitution with the redirections on the enclosing group (1 creation per file); resolved once, answered from memory (gate_option_to)
Arm record	jq -ec . validation + printf | jq per field + printf | jq per option: 8 creations plus 6 on lookup	one jq pass over the record file yielding armed_at, session_id, sentinel, marker, compact json (1 creation); EPOCHSECONDS for the TTL clock with date as the pre-5.0 fallback
Sentinel escape and match	$(printf | sed …) then grep -qE … <<<"$LAST"	shell loop over the same fifteen metacharacters; [[ $LAST =~ (^|\n)[[:space:]]*TOKEN[[:space:]]*(\n|$) ]], which agrees with grep's per-line verdict on every message (argument in the code comment)
Telemetry data object	$(jq -nc --arg … 2>/dev/null) on every evaluated stop	assembled in the shell from the closed vocabulary: identical bytes
Marker ledger	$(printf | cksum | tr -cd '0-9'), $(stat … || stat … || printf ''), $(dirname …)	{ key=$(cksum); } < <(printf '%s' "$path") with a parameter-expansion digit filter (same key as before, verified), per-rung { …; } 2>/dev/null stat groups, ${ledger%/*}
Post-nudge branch read	$(git … 2>/dev/null | tr -d '\000-\037')	{ BRANCH=$(git …); } 2>/dev/null + ${BRANCH//[[:cntrl:]]/} (a superset strip; git refuses every such byte in a ref name, and lane::notify strips C0 again)
gate_resolve_plugin_name (unanchored installs)	$(jq … <"$manifest" 2>/dev/null)	group-hoisted redirections

Left alone on purpose: uname -s as the platform primitive; hook::buffer_stdin (shared library; its $( ) capture, read-slice probe and printf | jq -e validation are 4 of the enabled path's remaining 10 creations); the gate_arm_owned subshell (one fork, and the cleanest scope for umask/noclobber); the final jq -nc block decision.

Disclosed divergence (one degenerate config): a configured sentinel that itself holds a newline. grep -E read that newline as a pattern separator and authorized a stop on any line matching either half of the token. The shell match treats the token as one pattern, so only the whole token standing alone authorizes, which is what the block reason instructs the agent to emit. No shipped launcher writes such a token. Pinned by new case 50 and named in the 0.22.30 changelog entry.

Group redirections were checked for over-suppression: every { …; } 2>/dev/null here wraps exactly one command, and the two process-substitution loops wrap a read builtin (no stderr) plus the one jq whose stderr the old code already suppressed.

Verification

Before/after, measured here (strace -f -e trace=clone,clone3,fork,vfork,execve, staged plugins/cache/<m>/<n>/<v>/hooks install, hook launched by the harness so its own shell is not in the count):

Path	Creations before	After	Launches (execve) before	After
Default: no gate footprint anywhere (every interactive Stop)	4	1	2 (grep, uname)	1 (uname)
Enabled by user settings, first stop, no signal (block)	48	10	18	5 (jq, jq, uname, jq, jq)
Enabled, sentinel on its own line (allow)	44	9	16	4
Enabled, second stop after the nudge (allow, notify muted)	54	10	21	5
Enabled, marker present (allow, consume)	51	12	19	6
Env-only enable claim (once-per-session notice)	31	22	11	8 (remainder is hook::notice_once in the shared library)
Armed by the launcher, first stop (block)	60	11	20	5

Launches did not stay flat, and that is expected here: unlike #3779, this issue explicitly asks for the grep/sed/tr/dirname helpers to become builtins, so those launches are gone; every jq that reads a distinct input is still launched, and the payload/settings/arm-record jq calls that were batched read the same inputs once instead of several times.

Wall-clock is not measured and no figure is invented. A spawn is about 1 ms on this Linux runner; #3508 measures 180 to 2,841 ms per spawn (median 1,108 ms at 501 concurrent processes) on the affected Windows hosts. Process creations by trace are the drift-immune proxy #3508's corrected criteria ask for. The plugin README now carries the table above under a "Hook cost" heading, per hook-budget Rule 1, and says the Windows wall-clock share still needs measuring.

Proof the verdicts did not change.

• All 89 pre-existing assertions in lane-stop-gate.test.sh pass unmodified; the suite is now 103 with the additions below (102 where chmod 000 denies nothing and case 51 skips visibly).
• A black-box differential harness (scratch, not committed) ran the origin/main hook and this branch's hook over 95 scenarios from identical fresh staged installs, comparing rc, stdout, and marker/ledger side effects: every settings shape the reader distinguishes (boolean/string/number/null values, options as string/array, pluginConfigs as array/string, null entry, other marketplace, malformed, two documents), sentinel edge cases (CRLF, tabs, blank lines, inline mention, substring, trailing text, 120 KB messages with early and no sentinel, invalid UTF-8 around the token, metacharacter sentinels, empty sentinel), marker absolute/relative/consumed/stale-ledger/undeletable, env-only claims, and the arm record's every parse and claim path (null/false/number/string/empty/malformed, missing or non-numeric or float armed_at, expired, legacy session_id match/mismatch/numeric, taken/empty/directory claim files, missing session id). 93 identical; the 2 differences are the two halves of the disclosed newline-sentinel case.
• The ledger key derivation and the sentinel escape were also compared directly against the old pipelines on sample inputs: identical.

New regression tests, verified non-vacuous.

• Case 49: gate_settings_options_to answers three keys from one pass with the single-key verdicts (including the trailing-newline chomp and the all-or-nothing options-not-an-object case).
• Case 50: a newline-bearing sentinel authorizes only as a whole block (the disclosed divergence, pinned).
• Case 51: an existing-but-unreadable settings file produces no stderr and does not change the verdict. Pins the redirection order in gate_file_mentions (commit fd0e7578): the first draft wrote done <"$1" 2>/dev/null, which attempts the open before stderr is silenced and prints Permission denied per turn where grep -q … 2>/dev/null was silent. Run as an unprivileged user the case passes on the fixed tree and fails with that exact line on the old ordering; where chmod 000 denies nothing (root, or a filesystem without POSIX modes) it skips visibly rather than passing vacuously.
• Trace budget: exactly 1 creation and 1 launch (uname) on the default path; ceilings of 10 creations and 5 launches on the enabled block path (a ceiling so a shared-library saving in fix(hook-utils): a hook payload cut short at EOF is a loud allow; a stall stays a block #3740/perf(hooks): fuse stdin jq completeness with field extract #3838 lowers the count without failing here, while a regression in this plugin's files raises it and does); and no dirname, tr, sed, grep, cksum or date on either path. Skips where strace is unavailable; the CI Linux lane does not skip. Re-measured rather than assumed after the fd0e7578 redirection swap: both pins hold, and the enabled path's four jq are still jq -e . (hook::buffer_stdin), the jq -j payload pass, the jq -j settings pass and the jq -nc block decision, in that order with uname third.
• Mutation 1 (move the uname redirection back inside its substitution): FAIL: default path creates 2 processes, budget is 1 and FAIL: enabled block path creates 11 processes, ceiling is 10. Mutation 2 (put the sed escape pipeline back): 13 creations, 6 launches, and the named-helper check all fail. Both on scratch copies; the committed tree passes.

Commands run in the foreground on the pushed head fd0e7578, with actual results (the lane-notify / lane-launcher / check-shell-portability lines are from the 1ca98cbf run; the second commit touches neither those files nor their inputs, and the full affected-tests.sh --run below was re-run on fd0e7578):

bash plugins/autonomy/hooks/lane-stop-gate.test.sh              -> PASS=103 FAIL=0 (unprivileged)
                                                                -> PASS=102 FAIL=0 as root, case 51 skips visibly
bash plugins/autonomy/hooks/lane-notify.test.sh                 -> rc=0
bash plugins/claude-ops/skills/lanes/scripts/lane-launcher.test.sh -> rc=0  (calls lane-stop-gate-arm.sh)
bash plugins/claude-ops/skills/lanes/scripts/restart-consumer.test.sh -> rc=0

bash scripts/affected-tests.sh --explain
  -> the R4 transitive walk from lane-stop-gate.sh fans out to the whole shell corpus (170 suites);
     plugin.json, CHANGELOG.md, README.md recorded as no-suite (non-shell lanes)
bash scripts/affected-tests.sh --run   (foreground)
  -> rc=1: one failing suite, plugins/claude-ops/skills/plugins/scripts/cache-content-check.test.sh
     ("process budget: the trace probe actually counted something ... measured -1, the pid-stamped PS4
     did not reach the traced shell"). Reproduced identically on a pristine `git archive origin/main`
     export: pre-existing and environmental, not from this change. Every other selected shell suite passed.

shellcheck <3 changed .sh files>                          -> clean
shfmt -d   <3 changed .sh files>                          -> clean
bash scripts/check-shell-portability.sh origin/main       -> No unexcused GNU-only constructs in 3 shell file(s).
node_modules/.bin/markdownlint-cli2 README.md CHANGELOG.md -> 0 issues
typos <5 changed files>                                   -> clean
scripts/check-hook-exec-form.sh, check-killswitch-hoist.sh, check-silent-skips.sh,
  check-discriminating-test-skips.sh, check-hook-wiring-liveness.sh, check-purged-em-dashes.sh -> all rc=0

bash scripts/check-changelog-parity.sh --check                       -> rc=0
bash scripts/check-changelog-parity.sh --check-order                 -> rc=0
bash scripts/check-changelog-parity.sh --check-bump origin/main      -> rc=0
bash scripts/check-changelog-parity.sh --check-preserved origin/main -> rc=0 (78 headings compared)

Manifest bumped 0.22.29 to 0.22.30 with a matching changelog entry.

Not mine and pre-existing: test_save_point.py::test_new_origin_falls_back_to_directory_name (Python, in the NOT RUN ecosystem list) and the cache-content-check.test.sh trace-probe failure above.

Related

• Parent campaign: perf(hooks): Windows process-creation tax makes the hook set unusable - 1,778 timeouts / 20.6 hours blocked over 9 days #3508 (Windows process-creation tax). Its corrected criteria ask for spawn counts before and after by trace, and the hook-budget bar; both are reported above.
• Precedent for the in-file approach: perf(context-guard): cut the zone-crossing fire from 8 process creations to 3 #3779 (context-guard shard perf(context-guard): PostToolBatch: context-zone crossing averages 73.0s and timed out 10x - reduce process spawns #3520), which located the cost in redirection placement rather than per-field jq, and merged PR perf(hooks): cut leftover Bash parse and dirname tax on the hot path #3788, which applied it across 34 hooks without touching lib/hook-utils.sh.
• fix(hook-utils): a hook payload cut short at EOF is a loud allow; a stall stays a block #3740 and perf(hooks): fuse stdin jq completeness with field extract #3838 own lib/hook-utils.sh and its 17 synced copies; this PR does not touch them. The enabled path's remaining shared-library share (4 of 10 creations) is theirs; the trace test's ceiling leaves it room.
• Prior art guardrails: recover the PreToolUse spawn-reduction work from the closed #1385 #1403 / fix(guardrails): restore PreToolUse enforcement — guards were killed at their timeout #1385 (hook::jq_fields, strip_quoted_spans, the 65-spawn census). hook::jq_fields is used here as it already exists on main; nothing from fix(guardrails): restore PreToolUse enforcement — guards were killed at their timeout #1385 is revived.
• Budget authority: docs/conventions/hook-budget/README.md, surfaced by .claude/rules/hook-budget.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ViPsHkL3ng9xWt2GjEQJob

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T20:29:20.142095Z	fd0e757	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kyle-sexton]

Independent review and the fixes it produced — flipped to ready

Posted by the autonomous worker lane (vm-worker-202609050257). Commit fd0e7578. This flip is the lane's handoff; the merge lane owns it from here. This lane does not merge.

The behaviour change is a genuine fix, and the old code was the bug

The review built the case from staged old and new installs. With sentinel DONE\nOK, the old code allowed a stop on "DONE with step 1, continuing" and on "All tests pass.\nOK" — grep took the embedded newline as a pattern separator, so ^[[:space:]]*DONE OR OK[[:space:]]*$ matched, and any line starting with half the token or ending with the other half opened the gate. The new code blocks both and allows only the whole token on its own lines.

The old behaviour could not have been load-bearing: it authorized on half-tokens the block reason never asked for, a newline in a sentinel is malformed config, and no shipped launcher writes one. Every other class tried — default token, CR, tabs, blank lines, inline and substring and trailing forms, a metacharacter sentinel a.b*(c), invalid UTF-8 under C and C.UTF-8 — gave identical verdicts.

Fail-safe direction: the new code errs toward "fails to stop" (it blocks once, then the existing one-nudge-then-allow path releases it). The old code erred toward "stops when it should not", which is the direction the gate exists to prevent.

execve fell, and every launch is accounted for

18 → 5 on the enabled block path, each vanished launch named with the builtin that replaced it: grep → read -d '' substring scan; tr ×2 → ${v//$'\r'/}; four per-field jq → one jq -j pass; uname ×3 → 1 loaded and reused; three settings jq → one multi-key jq -j; sed → a shell case loop; grep -qE → [[ =~ ]]; jq -nc → a shell string. Armed path 20 → 5 likewise. Nothing vanished without a builtin doing the same job — which is what makes this a conversion rather than removed work, and the issue explicitly asked for it.

The interactive default path, which runs on every Stop, is 4 creations / 2 launches → 1 / 1.

Two fixes from review

A prose miscount: the body said two jq were inside hook::buffer_stdin; argv verification shows one (jq -e .), the other three being the hook's own. The sentence summed to five against a real four.

A new stderr leak, found and closed. done <"$1" 2>/dev/null applies redirections left to right, so an existing-but-unreadable settings file printed Permission denied before stderr was silenced — noise from a hook that runs on every Stop. Now done 2>/dev/null <"$1".

The test for it is worth noting: run as an unprivileged user via setpriv --reuid=1000 so chmod 000 actually denies. As root it would pass vacuously, so it reports a visible SKIP instead. Reverting the single line reproduces the failure.

Strace pins re-measured rather than assumed: default still exactly 1 creation / 1 launch, enabled block path still 10 / 5.

Left for the merge lane

#3740 also bumps plugins/autonomy/.claude-plugin/plugin.json (0.22.27 → 0.22.28) against a stale base; whichever lands second must rebump. Not this PR's defect. Also recorded, no action: [[ =~ ]] is linear, so 120 KB matches old timing and only a 1 MB message diverges, far outside realistic sizes.

Gates: autonomy suite 103/0 unprivileged and 102/0 as root, silent-skips, discriminating-test-skips, shellcheck, shfmt, markdownlint, typos, and all four parity modes including --check-order. Sole affected-tests.sh failure is the confirmed pre-existing cache-content-check.test.sh.

---

Generated by Claude Code

[claude]

Claude finished @kyle-sexton's task in 3m 28s —— View job

---

Security review (/review:security-review)

• Load /review:security-review instructions
• Check skip gate (PR state, security-relevant surface)
• Fetch PR diff (origin/main...HEAD) and read changed files
• Hunt for logic/trust-boundary/injection issues in the shell changes
• Adversarially validate any candidate findings
• Post final results

Scope reviewed: plugins/autonomy/hooks/lane-stop-gate.sh and lane-stop-gate-lib.sh (the only behavior-carrying files in this diff; plugin.json, CHANGELOG.md, README.md, and lane-stop-gate.test.sh are non-executable-surface or test-only). No GitHub Actions files changed, so there is nothing in zizmor's advisory lane here.

This PR is a performance-only refactor of the Stop hook's config-resolution trust boundary (managed settings ▷ arm record ▷ user settings ▷ default), converting several $( ) subshell captures and external-process pipelines (grep/sed/tr/dirname/multiple jq) into builtins and batched single-pass jq calls. I traced the diff line by line against the trust-boundary invariants the header comments assert, specifically:

• Precedence ordering (gate_option_to in lane-stop-gate.sh): the new memoized, batched resolution (gate_managed_options_to, arm-record fields, gate_settings_options_to) preserves the same "a file/scope only overrides a key it explicitly answers for" semantics as the old per-key gate_option/gate_managed_option. A managed drop-in that doesn't mention a key no longer clobbers a primary file's verdict for that key — matches the original behavior. No downgrade path found.
• Untrusted-input handling: EVENT/SESSION_ID/CWD/STOP_ACTIVE/LAST now come from one hook::jq_fields pass instead of five separate jq | tr -d '\r' pipelines. The shared helper still strips all CR bytes (not just trailing), and the new chomp_nl only trims trailing LF — together reproducing the old byte-for-byte value. No untrusted field reaches a shell metacharacter context unquoted.
• Sentinel matching: replacing grep -qE ... <<<"$LAST" with a bash [[ =~ ]] match against a hand-escaped SENTINEL_RE preserves the same 15-character escape set as the old sed expression, and the anchor rewrite ((^|\n)...( \n|$)) is a faithful per-line-anchor translation. The one behavioral divergence (a sentinel value that itself contains a newline) is explicitly disclosed in the PR body/changelog and moves in the stricter direction (harder to satisfy, not easier) — not a new bypass.
• emit_tel's telemetry JSON is now built by string interpolation ('{"outcome":"'"$2"'","signal":"'"$3"'"}') instead of jq -nc --arg. I checked every call site (lane-stop-gate.sh:639,665,675): all three pass only fixed literal strings from a closed vocabulary (completion-signaled/stopped-after-nudge/nudged, sentinel/marker/none), never a variable derived from the payload, sentinel, marker path, or cwd. There is no exploitable injection path in this diff. (Flagging for awareness only, not as a finding: this pattern is fragile if a future edit ever threads untrusted data through emit_tel's $2/$3, since it would then skip JSON escaping entirely.)
• Path/id validation (GATE_ARM_ID_RE, the managed-path absolute-path guard, the lane_stop_gate_* key regex in gate_settings_options_to) is unchanged and still gates every value before it reaches a filesystem path or a jq --argjson array literal.
• Arm-record parsing: the new single jq -j multi-field extraction (gate_load_arm_record) preserves the same fail-closed behavior as the old jq -ec . validation + per-field captures — a malformed/non-object record still yields fewer than 5 NUL-separated fields and is refused before any ownership/TTL check runs.

I did not find a security vulnerability (injection, authz/trust-boundary bypass, or unsafe secret handling) introduced by this diff. The PR body's own differential harness (95 scenarios, 93 identical / 2 disclosed-and-intentional) and the new regression tests (cases 49-51) corroborate this from the behavioral side.

No security issues found in this pull request.

[github-actions]

Last security-reviewed head: fd0e7578defdde61f21627e65250789192aa5d38. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fd0e7578de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 7m 2s —— View job

---

Code review complete

• Load /review:code-review instructions
• Gather context (diff, changed files, CLAUDE.md/AGENTS.md conventions)
• Review lane-stop-gate-lib.sh changes
• Review lane-stop-gate.sh changes
• Review test additions
• Check docs (README/CHANGELOG/plugin.json)
• Post findings

Summary

Reviewed the process-creation reduction in lane-stop-gate.sh / lane-stop-gate-lib.sh against origin/main. The refactor (in-process _to helpers, batched jq passes, builtin replacements for grep/sed/tr/dirname/date) is sound and the logic changes I traced by hand (sentinel escaping via the shell's own ERE engine, the NUL-separated multi-key jq batching, the arm-record single-pass read) preserve the documented pre-PR verdicts.

1 finding, posted as 3 inline comments (same root cause, three sites):

A redirection-order bug — <file 2>/dev/null instead of 2>/dev/null <file — leaks "Permission denied" to real stderr when the target file exists but is unreadable, because bash applies redirections left to right and the stderr silencing only takes effect after the failed open. This PR already knows about and fixes exactly this bug in one place (gate_file_mentions, via commit fd0e7578, pinned by test case 51), but three new call sites introduced by this same PR have the reversed, still-buggy order:

• lane-stop-gate-lib.sh:78 — gate_resolve_plugin_name, run on every hook invocation for unanchored --plugin-dir installs, before any early exit.
• lane-stop-gate-lib.sh:313 — gate_settings_options_to, read for every managed/user settings file during option resolution. This is the most reachable of the three: case 51 only unreadable-tests the pre-filter path (gate_file_mentions), which exits before option resolution ever runs; a session that reaches gate_option_to by another route (e.g. an arm id) with a locked-down managed-settings.json or user settings.json would leak per Stop, uncaught by the new suite.
• lane-stop-gate.sh:334 — gate_load_arm_record. Lower likelihood (the arm record lives under this plugin's own data directory) but the same bug class.

Functionally these still fail safe (no verdict change — I traced that a failed group redirection skips the enclosed jq entirely, leaving the result arrays at their zero-initialized "no verdict" state), so this is a stderr-noise regression rather than a gate-bypass, but it's the exact per-turn noise class this PR's own second commit was written to eliminate. Suggested fixes (swap the redirection order to match gate_file_mentions) are attached inline.

Minor, not filed as a finding: the README's new "Hook cost" table has 6 rows; the PR description's verification table has 7 (missing the "Env-only enable claim" row). Doc-only, no action needed unless you want the table to match.

Verification claims in the PR body (differential harness, strace ceilings, affected-tests.sh run) are author-reported and were not independently re-run here, per the review lane's scope.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.