diff --git a/docs/decisions/2026-10-04-codex-rtk-hook-qualified.md b/docs/decisions/2026-10-04-codex-rtk-hook-qualified.md
new file mode 100644
index 000000000..6f2986393
--- /dev/null
+++ b/docs/decisions/2026-10-04-codex-rtk-hook-qualified.md
@@ -0,0 +1,112 @@
+# Decision: RTK's Codex PreToolUse hook is qualified and becomes the upstream default for Codex hosts, installed with `rtk init -g --codex` and trusted through Codex's own config writer (2026-10-04)
+
+**Decided by:** the user's directive of 2026-10-04, as the command center (session `wsl-architecture-design`) and session
+native-agent-stack-5f relayed it. About 21:30Z, in 5f's session: "install cleanly with upstreamcommands, best sota practice natively, and e2e
+with upstream commands with new session launched e2e for our wsls". About 22:05Z, to the command center: "yes frictionless", which the
+command center reads as covering the authorization settings and the trust grant of a plan-installed, qualified upstream hook. The session
+that wrote this record heard neither quotation itself; both are relayed, and the grant below rests on that reading, which the user may
+withdraw. Evidence for the qualification and the proposal to flip came from session native-agent-stack-99; the command center said "go" on
+the flip the same evening, to be written on main after the install plan's rows (PR 684) land.
+
+**Status:** this record lands with the trust tool, its tests and the evidence (the first of two pull requests, which touch no file
+that PR 684 owns). The install plan's RTK row, the handbook and card text follow in a second pull request once PR 684 lands on
+main, because the plan rows are its; until then no host installs or trusts the hook, and the awareness block of the Codex
+`AGENTS.md` is reconciled with rtk 0.51.0 separately, by session native-agent-stack-5f, which owns the Codex roles that carry it.
+
+**Scope:**
+
+- the install plan's RTK row (`evidence/artifacts/new-wsl-install-plan-20261002/`): `rtk init -g --codex`, the trust grant and their acceptance (second pull request);
+- `tools/adoption/codex_hook_trust.py` (new) and its tests (first pull request);
+- the awareness block of `adoption/templates/codex.AGENTS.template.md` and its generated and scaffold copies (session native-agent-stack-5f's change, not this pair of pull requests);
+- the hold-out lines of `docs/token-session-handbook.md` and the `docs/token-efficiency-stack.json` card, and what is generated from them (second pull request);
+- the evidence in `evidence/artifacts/token-stack-fresh-session-e2e-20261004/` (first pull request).
+
+## Context
+
+At the RTK 0.50.0 pin this catalog ran no Codex hook: `rtk init --global --codex` had started to install a Codex PreToolUse hook that "this
+catalog has not qualified" (`docs/token-session-handbook.md`), where 0.49.0 had written instructions only, as an `@RTK.md` line that Codex
+does not expand. Codex homes got RTK's text from the stack's `AGENTS.md` block instead, and the model prefixed `rtk` itself. At 0.51.0 upstream
+documents the hook as the Codex integration (rtk-ai/rtk v0.51.0, commit e001f773f80b22b7dc4c7a79521b30e35aaef026, `README.md` L133 and L460:
+"**Codex** | `rtk init -g --codex` | PreToolUse hook (`updatedInput`) + AGENTS.md"), and the user's directive asks for the upstream install.
+
+## Decision
+
+1. A Codex host installs the hook with the upstream command `rtk init -g --codex` and trusts it with
+   `python3 tools/adoption/codex_hook_trust.py --command "rtk hook codex" --apply`. Codex skips a non-managed hook until its hash equals
+   `[hooks.state."<key>"].trusted_hash` (openai/codex rust-v0.159.3, commit 01fc69f4026735edfdf6789820549727a4867b11:
+   `codex-rs/hooks/src/engine/discovery.rs` hook_hash L775, hook_trust_status L794-L815), so the registration alone changes nothing. The
+   tool sends the edit the TUI's `/hooks` review sends, `config/batchWrite` of `hooks.state`, mergeStrategy upsert,
+   `{"<key>": {"trusted_hash": <currentHash>}}` (`codex-rs/tui/src/hooks_rpc.rs` write_hook_trusts L58-L91), for the user-layer hooks whose command
+   equals one named with `--command` and for no other hook; a dry run is the default, `--apply` backs up `config.toml` (mode 0600), refuses
+   while a codex process runs and reads every named hook back through `hooks/list` by key and hash (a hook that vanished, moved or
+   changed during the write, or a discovery error that was not there before it, is exit 3: `expectedVersion` guards `config.toml`, not the
+   hooks file). This grant is the trust decision for the hook that sees every Bash command; the user's "yes frictionless" above is its authority.
+   The upstream command is not hook-only: it also creates `RTK.md` and appends a pointer line `@<Codex home>/RTK.md` to `AGENTS.md`
+   (`rtk-init-codex-probe.json`; `--hook-only`, `--no-patch` and `--auto-patch` are refused with `--codex`). Codex expands no `@` reference,
+   so the pointer is inert text, and NativeStack's `AGENTS.md` already carries it; but it is an edit of the instruction file, which the
+   user's reply about authorization settings does not name, so the second pull request lists it among the points for the user to confirm.
+   `rtk init -g --codex --uninstall` removes the hook, `RTK.md` and the pointer together.
+2. The row's acceptance is `rtk init --show --codex` with every line `[ok]`, `codex_hook_trust.py --command "rtk hook codex"` reporting the
+   hook trusted, a fresh `codex exec --json --ephemeral` probe whose executed command carries the `rtk` prefix from each real launcher (the
+   hook is the bare command `rtk hook codex` and fails open and silent when `rtk` is not on the launcher's PATH), the fresh-session E2E
+   (`fresh_session_e2e.sh`) and the Codex arm of `codex_hook_qual.py`, with the five `exclude_commands` of
+   `fixtures/rtk-hook-exclusions.toml` in rtk's config file (`rtk rewrite "diff a b"` printing nothing shows them in place).
+3. The awareness block of the Codex `AGENTS.md` template stays (with the hook the model's own prefix is left alone: no `rtk rtk`) and its
+   exceptions are reconciled with rtk 0.51.0 as measured (`rtk_behaviour_probe.py`): the hook leaves `git show REV:path`, `diff`, `jq` and
+   `git branch` alone only under the five `exclude_commands` of `fixtures/rtk-hook-exclusions.toml`, which the bootstrap installs for the
+   Claude hook and the Codex hook reads from the same rtk config (with upstream defaults rtk rewrites all four); `find` on a missing path
+   exits 1 like find; bare `git log` caps at 10 commits without a notice and drops merge commits, `git log --stat` caps at 10 with the
+   notice, and `--oneline` or `--format` without a count default to 50 commits, again without merges or a notice
+   (`git_cmd.rs` L1819-L1825 at e001f773; measured on a 66-commit fixture).
+4. The hold-out in the handbook and in the token-efficiency card becomes this decision and its evidence.
+
+## Evidence (`evidence/artifacts/token-stack-fresh-session-e2e-20261004/`)
+
+| Claim | Evidence class | Source |
+| --- | --- | --- |
+| `rtk init -g --codex` appends one PreToolUse group after the existing ones, changes no other byte, is idempotent, reversible with `--uninstall`, and Codex's `hooks/list` loads it without error | `local_integration`: the upstream commands on a scratch copy of the host's hooks.json; the live file was hashed before and after | README, "Codex rtk hook qualification" |
+| With the hook trusted, 22 of the 23 commands of the four arms that exercise it (R1, R2, B2, R2b) ran with the `rtk` prefix (the 23rd, `diff`, is excluded by the host's `exclude_commands`, which the arms ran with), exit codes equal to the shell's in all seven arms (0 2 1 0 1 0 and 0 0 1 2 0), nothing blocked, a second PreToolUse hook ran in every trusted arm | `local_integration`: real codex-cli 0.159.3 and rtk 0.51.0 through the loopback gateway, one run per arm | `receipt.json`, `codex_hook_qual.py` |
+| An untrusted hook is skipped, in that arm together with the other hook; a hook with `rtk` off the PATH fails open; a model-prefixed command gets no second prefix | same | same |
+| The trust edit works through `codex_hook_trust.py` on the real binary: dry run, apply with backup, idempotent second run, exit 4 when no hook has the command | `local_integration`: a scratch home | the arms above ran with it; its fake-server tests are `synthetic` (22 tests) |
+| The trust tool's read-back, when the hook's definition changes right after the write, on the real binary: the tool at `c8613fe16` reported success (exit 0), the fixed tool exits 3 and names the hook | `local_integration`: real `codex app-server` 0.159.3, a scratch home, one run each | `trust_readback_race.py`; `receipt.json`, `trust_readback_race` |
+| rtk 0.51.0's rewrite table with upstream defaults and with the five `exclude_commands`, and its compact forms against the shell's (the log cap and its notice, dropped merges, the trailing newline, `/usr/bin/ls`, `find` exit 1) | `local_integration`: one run, one host, a scratch repository and scratch homes | `rtk_behaviour_probe.py`; `rtk-behaviour-probe.json` |
+| `rtk init -g --codex` also creates `RTK.md`, appends the `@<Codex home>/RTK.md` pointer to `AGENTS.md` (creating it when missing) and rtk's history database, honours `CODEX_HOME`, is idempotent, is undone whole by `--uninstall`, and refuses `--hook-only`, `--no-patch` and `--auto-patch` | `local_integration`: one run, one host, scratch homes | `rtk_init_codex_probe.py`; `rtk-init-codex-probe.json` |
+| `rtk-ai/rtk` v0.51.0 and `openai/codex` rust-v0.159.3 behave as the citations above say | `source_review` | the pinned README and source lines |
+| A fresh Claude and Codex session on NativeStack picks the token stack up with nothing per project, and rtk rewrites show in the hook events | `local_integration` | `nativestack-before-snapshot.summary.md` |
+
+## Alternatives considered
+
+- **Keep the hold-out** (the 0.50.0 state, instructions only). Rejected: the user's directive is the upstream install, the qualification passed,
+  and the hook handles four of the six exceptions of the awareness text itself.
+- **Copy the hook entry from a template** instead of running `rtk init -g --codex`. Rejected: it is not upstream's command, and the entry
+  would drift from what rtk writes (rtk owns the hooks.json patch, its idempotence and its `--uninstall`).
+- **Trust through the interactive `/hooks` review.** Not automatable on a fresh distribution; kept as the way a user reviews or revokes.
+- **`--dangerously-bypass-hook-trust`.** Present in 0.159.3 (`codex exec --help`; `codex-rs/utils/cli/src/shared_options.rs` L61-L64 and
+  `codex-rs/exec/src/cli.rs` L145 at `01fc69f4`): "Run enabled hooks without requiring persisted hook trust for this invocation.
+  DANGEROUS." Rejected as the install path: it persists nothing, so every launcher (the TUI, each `codex exec`, a wrapper) would have to
+  carry it, and it skips trust for every enabled hook, where the persisted grant is bound to one hook's hash and `/hooks` shows and revokes it.
+  An earlier draft of this record said the flag was absent; that came from a `head`-truncated filter of the help text (anti-pattern log).
+- **Trust every hook of the home.** Rejected: the tool names the command it trusts and ignores every other hook, a managed one and a project's.
+- **An absolute path in the hook command** to survive a launcher without `rtk` on its PATH. Rejected: it departs from upstream's command; the acceptance
+  probes each real launcher instead.
+
+## What would overturn it
+
+- The fold A/B of session native-agent-stack-5f (harbor-rtk-fold-20261004) measuring wrong-path actions that the Codex hook's folding of
+  `grep -l` output causes beyond the upstream-native `exclude_commands` remedy: the row then adds that exclusion, or holds the hook out again.
+- A Codex release that changes the trust model or the hook schema (`hooks.state`, `trusted_hash`, the hash), or an rtk release whose
+  `rtk hook codex` or `rtk init -g --codex` changes the hook's definition (its hash changes and the grant must be repeated).
+- The user withdrawing the reading of "yes frictionless" for this grant: the row then stops after `rtk init -g --codex` and leaves the review to `/hooks`.
+
+## Residuals
+
+The install edits the Codex instruction file (the inert pointer line) and creates `RTK.md`; whether the user accepts that edit with the rest of the
+install is open. One run per arm, one host, the loopback gateway route and not the host's ChatGPT sign-in; no claim about tokens saved. Native probes ran on
+codex-cli 0.159.3 only: no 0.160.0 binary was run, so 0.160.0 is checked from source only. The hook is skipped
+again whenever its definition or its group index changes (the key carries the index), so the acceptance probe is the check, not the grant. The
+2604 after snapshot, the PATH of each real launcher and the grant on a real host are later steps that this decision schedules and does not
+run. Cosmetic differences remain (a dropped trailing newline in `rtk git status --short`, `/usr/bin/ls` in an `rtk ls` error), and so do
+content differences in rtk's compact `git log` (merge commits dropped, a 10-commit cap, a 50-commit default for `--oneline` and `--format`), which the awareness reconcile carries. A dry run of
+the trust tool makes no trust or config edit but is not read-only: starting the app-server creates its own state files in the Codex home.
+The NativeStack counter delta of the snapshot (+33 commands, +297 saved tokens) spans other sessions' commands; the project-scoped block of
+its summary is the E2E's own.
diff --git a/docs/harness-defaults.md b/docs/harness-defaults.md
index 31ffbbda7..2ab5da73f 100644
--- a/docs/harness-defaults.md
+++ b/docs/harness-defaults.md
@@ -86,6 +86,9 @@ When a claim or action proves wrong, correct it where it was relayed and record
 
 | Date | Anti-pattern | What happened | Rule or check that prevents it | Where enforced |
 | --- | --- | --- | --- | --- |
+| 2026-10-04 | Concluding that a default limit does not exist from a fixture smaller than the limit | The #701 probe's fixture held 16 commits, and its README said rtk's compact log forms (`--oneline`, `--format`) have no cap. rtk 0.51.0 adds `-50` to them when no count is given ([git_cmd.rs L1819-L1825](https://github.com/rtk-ai/rtk/blob/e001f773f80b22b7dc4c7a79521b30e35aaef026/src/cmds/git/git_cmd.rs#L1819-L1825)), which a 16-commit run cannot reach. The cross-family read extended the fixture to 66 commits: 50 lines against git's 66. | Read the source's default before sizing a fixture, make the fixture larger than every limit the claim concerns, and record the counts that show the limit. | This log; `evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk_behaviour_probe.py` (a 66-commit fixture) and its `rtk-behaviour-probe.json` |
+| 2026-10-04 | Asserting that an upstream flag is absent from a truncated filter of its help text | The Codex hook qualification draft (#701) filtered `codex exec --help` through grep and `head -8`, read the eight lines it showed as the whole match set, and wrote that `codex exec` of 0.159.3 has no `--dangerously-bypass-hook-trust`. The flag is line 65 of that help text ([shared_options.rs L61-L64](https://github.com/openai/codex/blob/01fc69f4026735edfdf6789820549727a4867b11/codex-rs/utils/cli/src/shared_options.rs#L61-L64)), and the repository already held `evidence/artifacts/runtime-sdk-20261003/exec-help-0.159.3.txt`. The cross-family read of the head found it. | Back an absence claim with the whole output (`grep -c` or `grep -q` and its exit status, never `head`), look in the committed captures of the same version first, and cite the source line that defines the flag. | This log; verification path: `codex exec --help` at the installed version, line 65, and the committed capture above |
+| 2026-10-04 | Stating a tool's default behaviour from a run that carried the host's configuration | The #701 README and decision record said rtk's own table leaves `git show REV:path`, `diff`, `jq` and `git branch` alone, and arm B2's `diff` stayed unrewritten. The arms ran with the host's HOME, whose rtk config carries five `exclude_commands` (`fixtures/rtk-hook-exclusions.toml`); with a scratch HOME `rtk rewrite` rewrites all four. | Measure a default in a scratch HOME and XDG tree, name the configuration a run used, and measure each configuration a claim names. | This log; `evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk_behaviour_probe.py` and its `rtk-behaviour-probe.json` |
 | 2026-10-03 | Passing `-f` or `-F` to `gh api` for a read | Adding a parameter turned the read into a POST: `gh api --help` at the installed gh 2.102.0 (lines 20-27) says the method is `GET` normally and `POST` if any parameters were added. A read-only audit's listing sent `POST user/repos` and got HTTP 422; nothing was created. | Put read parameters in the URL query string, or pass `--method GET` with them. | This log; verification path: `gh api --help` at the installed version, lines 20-27 |
 | 2026-10-03 | Projecting allowance exhaustion from a partial snapshot | A "gone in 8-9 days" projection for the monthly Actions allowance that private repositories draw on rested on two days of a bursty series (daily job minutes ranged from 0 to 763). | Project from the full daily series, per repository and runner OS, and give a range of scenarios rather than one date. | This log; verification path: daily job minutes recomputed from the jobs API (`gh api --method GET`) per repository and runner OS |
 | 2026-10-03 | Reporting non-success runs as failures | A summary said about half of pull-request runs failed. Grouped by conclusion over 2026-09-25 to 2026-10-02, 6.5% and 7.3% of the pull-request runs of the two workflows that hold the required test jobs failed and 25-33% were cancelled (36-46% on 2026-10-01 and 10-02); 672 of all 712 cancelled runs in the window (701 of them pull-request runs of these two workflows) were superseded by a newer run. The day-wide list for 2026-10-01 had also reached the 1,000-result cap: the complete counts were 176 and 134 pull-request runs, not 160 and 120. | Report success, failure and cancelled separately (`gh run list --json conclusion`, grouped), and partition every query so that no slice's `total_count` reaches 1,000. | This log; [measurement receipt](../evidence/receipts/github-ci-measurements-20261003.json) |
diff --git a/evidence/artifacts/token-stack-fresh-session-e2e-20261004/README.md b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/README.md
new file mode 100644
index 000000000..eecba13fb
--- /dev/null
+++ b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/README.md
@@ -0,0 +1,111 @@
+# Token stack fresh-session E2E and the Codex rtk hook qualification (2026-10-04)
+
+Local monitoring and qualification with upstream commands only. It is not an A/B and not an upstream test: one run per arm, one
+host (NativeStack, WSL2), deterministic commands. It answers two questions the clean-install directive of 2026-10-04 asks of
+each WSL: does a brand-new session pick up the token stack with nothing registered per project, and may RTK's Codex hook, held
+out at the 0.50.0 pin because it was not qualified, be installed with `rtk init -g --codex`.
+
+| Part | Script | Reads |
+| --- | --- | --- |
+| Fresh-session E2E | `fresh_session_e2e.sh <label>` | `rtk --version`, `rtk init --show`, `rtk gain -f json` before and after, `claude mcp list`, `codex mcp list`, two fresh `claude -p --output-format stream-json --verbose --include-hook-events` sessions (git status, grep -rl), one fresh `codex exec --json --ephemeral` session, all in a new empty project directory, summarised with jq |
+| Codex hook qualification | `codex_hook_qual.py [outdir [arm ...]]` | `rtk init -g --codex`, `rtk init --show --codex`, Codex's own `hooks/list`, `tools/adoption/codex_hook_trust.py`, `codex exec --json --ephemeral` through the loopback OmniRoute gateway (no credential needed or copied), `rtk gain` |
+| rtk init probe | `rtk_init_codex_probe.py [outfile]` | what `rtk init -g --codex` writes, shows and undoes in scratch homes (no host file): `rtk-init-codex-probe.json` |
+| rtk behaviour probe | `rtk_behaviour_probe.py [outfile]` | `rtk rewrite` and rtk's compact forms against the shell, in a scratch repository and scratch homes (no host configuration, no host counter): `rtk-behaviour-probe.json` |
+| Read-back race | `trust_readback_race.py [tool file]` | `tools/adoption/codex_hook_trust.py` against the real `codex app-server` when the hook's definition changes right after the write |
+
+Run the first inside a distribution (about 30 s, about 8 cents of Haiku for two probes plus one low-effort Codex probe). Run the
+second from the repository (about 5 min for seven arms of one or two sessions each): it builds scratch Codex homes and a fixture
+repository under `~/.cache/native-agent-stack-e2e`, never writes the live `~/.codex` (it hashes the live hooks.json before and
+after), and deletes its work directory. Files here: `receipt.json` (the sanitized results below),
+`nativestack-before-snapshot.summary.md` (the E2E's own summary, home paths replaced), `rtk-behaviour-probe.json` and
+`rtk-init-codex-probe.json` (the probes' output).
+
+## NativeStack before snapshot (2026-10-04 21:44Z, before the NativeStack host steps of docs/decisions/2026-10-04-claude-template-holds-out-token-lane-carriers.md)
+
+- rtk 0.51.0 at the pin; `rtk init --show` reports the Claude hook, RTK.md (slim) and the settings.json hook `[ok]`.
+- A fresh Claude Code 2.1.289 session in an empty project connected 8 of 8 user-scope MCP servers (context-mode plugin, ai-memory,
+  serena, jcodemunch, codebase-memory, qmd, headroom, hindsight) and loaded 117 tools. Its PreToolUse:Bash hook rewrote `git status`
+  to `rtk git status` and `grep -rl needle .` to `rtk grep -rl needle .` ("RTK auto-rewrite", `updatedInput` in the hook response);
+  SessionStart ran 7 hook commands, UserPromptSubmit 2, PostToolUse 2, Stop 4, all with outcome success.
+- A fresh Codex 0.159.3 session ran `rtk git status` because the model followed the awareness text: Codex's hooks.json held no rtk
+  hook (ai-memory and hindsight only), so for Codex rtk was instruction-driven (`rtk init --show --codex`: hook `[--]`).
+- Gap found: SocratiCode is registered for Claude Code at local scope for one checkout (`claude mcp get socraticode`: "Local config"),
+  so a fresh project does not get it although `adoption/mcp/claude-user.json` carries it at user scope; Codex lacks jcodemunch until the
+  host step registers it.
+- `rtk gain -f json` moved by 33 commands and 297 saved tokens over the interval of the probes; the counter is host-wide and other
+  sessions ran, so that delta is not the probes' alone (the project-scoped `rtk gain -p` block of the summary is).
+
+## Codex rtk hook qualification (rtk 0.51.0, codex-cli 0.159.3)
+
+Static, on a scratch HOME and CODEX_HOME holding a copy of the host's hooks.json: `rtk init -g --codex` appends one PreToolUse
+group, `{"matcher":"Bash","hooks":[{"type":"command","command":"rtk hook codex"}]}`, after the existing group and changes no
+other byte, so the existing hooks keep their keys (`hooks.json:pre_tool_use:0:0`: a key carries the group index) and their
+trust; a second run is "already present"; `--uninstall` removes the entry (the JSON equals the original after normalising; rtk
+reserialises the file and leaves a `.bak`); Codex's own `hooks/list` loads it with no error or warning.
+
+The same command is not hook-only (`rtk-init-codex-probe.json`: scratch homes, rtk 0.51.0). It also creates `RTK.md` in the Codex
+home, appends the line `@<absolute Codex home>/RTK.md` to its `AGENTS.md` (creating the file when it is missing) and creates rtk's
+history database under its data directory; it prints the optional `writable_roots` grant for that database and applies none ("No
+Codex permission settings have been changed"), and it honours `CODEX_HOME`. A second run reports "already present".
+`--uninstall` removes the hook entry, `RTK.md` and the pointer line and leaves an emptied `AGENTS.md`. `--hook-only`, `--no-patch` and
+`--auto-patch` are refused with `--codex` (exit 1, "rtk: --codex cannot be combined with ..."), so there is no hook-only Codex
+install. `rtk init --show --codex` reports the Global lines (RTK.md, hook, AGENTS.md pointer) `[ok]` after the install and `[--]`
+after the uninstall; its Local lines concern the current directory's `.codex/`, so an acceptance reads the Global lines only. Codex
+expands no `@` reference in `AGENTS.md` (`docs/token-efficiency-stack.md`, citing `codex-rs/codex-home/src/instructions/mod.rs` at
+rust-v0.157.1), so the pointer is inert text; NativeStack's `~/.codex/AGENTS.md` already carries it from an earlier `rtk init`, and
+the stack's AGENTS block keeps it. Installing the hook is therefore also an edit of the Codex instruction file.
+
+Dynamic, seven arms over six commands (and five more in arm B2), a probe hook at group 0 standing for ai-memory. The arms ran with
+the host's HOME, so rtk read the host's own configuration, a `[hooks] exclude_commands` of the five entries of
+`fixtures/rtk-hook-exclusions.toml` (`git show REV:path`, `diff`, `git branch`, `jq`); the Codex hook honours it:
+
+| Arm | Hook | Trusted | Executed with `rtk` | Exit codes equal to the shell's |
+| --- | --- | --- | --- | --- |
+| R0 | none | n/a | 0 of 6 | yes |
+| R1 | rtk | yes (`codex_hook_trust.py`) | 6 of 6 (a compound only in its first segment) | yes |
+| R1u | rtk | no | 0 of 6; the probe, also untrusted, never ran | yes |
+| R2 | rtk, awareness text present, prompt forbids a prefix | yes | 6 of 6 | yes |
+| R2b | rtk, awareness text present, prompt silent | yes | 6 of 6, all prefixed by the model; no `rtk rtk` | yes |
+| B2 | rtk | yes | 4 of 5: `diff` is excluded by that configuration, `cat` becomes `rtk read` | yes |
+| R1p | rtk, `rtk` not on the launcher's PATH | yes | 0 of 6: the hook fails open, silently | yes |
+
+The six commands and their shell exit codes: `git status --short` 0, `ls /nonexistent` 2, `grep -rl nomatch .` 1, `grep -rl needle .`
+0, `git diff --exit-code` 1, `git status --short && echo done` 0; battery 2: `git log --oneline -3 | cat` 0, `grep -rn "needle two" a` 0,
+`find /nonexistent -name x` 1, `diff /nonexistent a/x/util.py` 2, `cat a/x/util.py` 0.
+
+Findings: the hook fires, preserves exit status, blocks nothing and coexists with another PreToolUse hook. Codex skips a hook until
+its current hash equals `[hooks.state."<key>"].trusted_hash` (upstream, rust-v0.159.3:
+codex-rs/hooks/src/engine/discovery.rs hook_hash L775 and hook_trust_status L794-L815), so `rtk init -g --codex` alone changes
+nothing; the TUI's `/hooks` review persists the grant with `config/batchWrite` of `hooks.state` (upsert) and
+`tools/adoption/codex_hook_trust.py` sends the same edit for the hooks named with `--command` only (codex-rs/tui/src/hooks_rpc.rs
+write_hook_trusts L58-L91). `codex exec --help` of 0.159.3 does list `--dangerously-bypass-hook-trust` ("Run enabled hooks without
+requiring persisted hook trust for this invocation. DANGEROUS."; openai/codex rust-v0.159.3, commit 01fc69f4,
+codex-rs/utils/cli/src/shared_options.rs L61-L64 and codex-rs/exec/src/cli.rs L145; this repository's capture
+`evidence/artifacts/runtime-sdk-20261003/exec-help-0.159.3.txt` L65). It persists nothing and skips trust for every enabled hook, so
+it is not the hash-bound grant this tool writes. (An earlier draft of this README said the flag was absent: it had filtered the help
+text through `head -8`; see the anti-pattern log in docs/harness-defaults.md.)
+
+What rtk does is in `rtk-behaviour-probe.json` (rtk 0.51.0, git 2.43.0; a scratch repository of 66 commits with one merge and
+scratch homes, so no host configuration applies). `rtk rewrite "<cmd>"` with upstream defaults rewrites `git status`, `git log`,
+`git diff`, `ls`, `cat` (to `rtk read`), `grep`, `find`, `git show REV:path`, `diff`, `jq`, `git branch` and the first segment of a
+pipe or `&&` chain, and leaves `echo` and `bash -c ...` alone (exit 1, no output); with the five `exclude_commands` of
+`fixtures/rtk-hook-exclusions.toml` as rtk's config file it also leaves `git show REV:path`, `diff`, `jq` and `git branch` alone.
+The compact forms differ from the shell's: `rtk git status --short` drops the trailing newline and `rtk ls /nonexistent` names
+`/usr/bin/ls` in its error. Exit codes are the shell's, `find` on a missing path included (1: the awareness text's "exits 0" does
+not hold at 0.51.0). Bare `rtk git log` prints at most 10 commits, one `<hash> <subject> (<age>) <author>` line each, drops the
+merge commit and prints no notice; `rtk git log --stat` caps at 10 commits, keeps the merge and prints `[rtk] capped at 10 commits;
+pass -n <count> for more` on stderr; with `--oneline`, `--format=%s` or `--graph --oneline` and no count it defaults to 50 commits,
+without merges, and prints no notice (50 lines against git's 66, 66 and 68; `src/cmds/git/git_cmd.rs` L1819-L1825 at e001f773:
+`--oneline`, `--format` and `--pretty` without a count add `-50`); an explicit count is respected and keeps merges (`-n 16`: 16
+lines; `--oneline -n 66`: 66). A fixture shorter than 50 commits cannot show that default, and an earlier draft of this README, run
+on 16 commits, called those forms uncapped.
+
+## What this does not show
+
+One run per arm: no variance, no cost comparison, no claim about tokens saved (the A/B of the folding of `grep -l` output is a separate
+measurement). The dynamic arms ran through the loopback gateway route `cx/gpt-6.1-sol-max`, not the host's own ChatGPT sign-in, and in scratch
+Codex homes (CODEX_HOME), with the host's HOME for rtk's configuration; the live `~/.codex` was neither written nor read for
+credentials. The native probes ran on codex-cli 0.159.3 only: no 0.160.0 binary was run here, so 0.160.0 is checked from source
+only. The trust tool's dry run makes no trust or config edit but is not read-only: starting the app-server creates its own state
+files in the Codex home. The 2604 after snapshot, the PATH of each real launcher and a hook trust grant on a real host are
+separate, later steps.
diff --git a/evidence/artifacts/token-stack-fresh-session-e2e-20261004/codex_hook_qual.py b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/codex_hook_qual.py
new file mode 100644
index 000000000..b89f14450
--- /dev/null
+++ b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/codex_hook_qual.py
@@ -0,0 +1,194 @@
+#!/usr/bin/env python3
+"""Qualify RTK's Codex PreToolUse hook (`rtk init -g --codex`, rtk 0.51.0) against the installed Codex, in scratch Codex homes.
+
+Upstream commands only: `rtk init -g --codex`, `rtk init --show --codex`, Codex's own `hooks/list`, the repository's
+tools/adoption/codex_hook_trust.py (the /hooks review's persisted edit: config/batchWrite of hooks.state, trusted_hash),
+`codex exec --json --ephemeral` through the loopback OmniRoute gateway the packaged worker uses (no credential needed, none
+copied), and `rtk gain`.
+Nothing under the live ~/.codex is written; the scratch homes and the fixture repository live under one directory that this
+script deletes at the end. The two hooks of the scratch homes are a probe (it logs the PreToolUse payload Codex sends, then
+allows) at group 0, standing for the host's ai-memory hook, and rtk's own group at 1, as `rtk init` appends it.
+
+    python3 evidence/artifacts/token-stack-fresh-session-e2e-20261004/codex_hook_qual.py [outdir [arm ...]]
+
+Arms: R0 probe only (no rtk hook); R1 probe + rtk hook, trusted, no AGENTS instruction; R1u the same but not trusted;
+R2 the same as R1 with the RTK awareness instruction present; B2 R1 over a second battery (pipe, quotes, rtk's known exit-code
+exceptions: find on a missing path, diff on a missing file, cat); R2b the awareness instruction present and the prompt not
+forbidding a prefix, so the model prefixes `rtk` itself and the hook must leave it alone (no `rtk rtk`).
+"""
+import json
+import os
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[3]
+sys.path.insert(0, str(ROOT / "tools" / "adoption"))
+import apply_codex_lane as lane  # noqa: E402
+
+TRUST_TOOL = ROOT / "tools" / "adoption" / "codex_hook_trust.py"
+
+OUT = Path(sys.argv[1] if len(sys.argv) > 1 and sys.argv[1] else os.environ.get("E2E_OUT") or
+           Path.home() / ".local/state/native-agent-stack/e2e") / f"codex-hook-qual-{time.strftime('%Y%m%dT%H%M%SZ', time.gmtime())}"
+WORK = Path.home() / ".cache/native-agent-stack-e2e/rtk-codex-dyn"
+ONLY = set(sys.argv[2:])  # run only these arm labels when given
+CODEX = shutil.which("codex")
+GATEWAY = ["model_provider=\"omniroute_runtime\"", "model=\"cx/gpt-6.1-sol-max\"", "model_reasoning_effort=\"low\"",
+           "features.plugins=false", "approval_policy=\"never\"", "sandbox_mode=\"danger-full-access\"",
+           "model_providers.omniroute_runtime.name=\"OmniRoute runtime workers\"",
+           "model_providers.omniroute_runtime.base_url=\"http://127.0.0.1:20128/v1\"",
+           "model_providers.omniroute_runtime.wire_api=\"responses\"",
+           "model_providers.omniroute_runtime.requires_openai_auth=false",
+           "model_providers.omniroute_runtime.supports_websockets=false"]
+COMMANDS = ["git status --short", "ls /nonexistent", "grep -rl nomatch .", "grep -rl needle .", "git diff --exit-code",
+            "git status --short && echo done"]
+COMMANDS2 = ["git log --oneline -3 | cat", "grep -rn \"needle two\" a", "find /nonexistent -name x",
+             "diff /nonexistent a/x/util.py", "cat a/x/util.py"]
+
+
+def prompt(commands, strict=True):
+    """strict: the commands exactly as written, no prefix (the model then runs them unprefixed, so the hook has work to do);
+    not strict: the model is left to its instructions (a Codex home with the RTK awareness text prefixes `rtk` itself)."""
+    lead = ("Run each of the following commands as its own separate shell tool call, exactly as written, with no prefix and no "
+            "extra flags." if strict else "Run each of the following commands as its own separate shell tool call.")
+    return (lead + " After all of them, reply with one line per command: \"<n> exit=<exit status>\".\n" +
+            "\n".join(f"{n}. {c}" for n, c in enumerate(commands, 1)))
+
+
+AWARENESS = ("# RTK\n\nPrefix every shell command with `rtk`: `rtk git status`, `rtk cargo test`, `rtk npm run build`, `rtk ls src/`."
+             " Keep the prefix inside chains: `rtk git add . && rtk git commit -m \"msg\"`. Commands RTK has no filter for run "
+             "as-is, so the prefix is always safe.\n")
+
+
+def sh(*argv, cwd=None, env=None, timeout=120, check=True):
+    done = subprocess.run(argv, cwd=cwd, env=env, capture_output=True, text=True, timeout=timeout, stdin=subprocess.DEVNULL)
+    if check and done.returncode != 0:
+        raise SystemExit(f"{argv[:3]} failed ({done.returncode}): {done.stderr[:300]}")
+    return done
+
+
+def fixture() -> Path:
+    project = WORK / "project"
+    for rel in ("a/x/util.py", "b/x/util.py", "c/util.py"):
+        (project / rel).parent.mkdir(parents=True, exist_ok=True)
+        (project / rel).write_text("needle\n", encoding="utf-8")
+    (project / "c/other.py").write_text("nothing\n", encoding="utf-8")
+    env = dict(os.environ, GIT_AUTHOR_NAME="e2e", GIT_AUTHOR_EMAIL="e2e@local", GIT_COMMITTER_NAME="e2e",
+               GIT_COMMITTER_EMAIL="e2e@local")
+    sh("git", "init", "-q", cwd=project)
+    sh("git", "add", ".", cwd=project)
+    sh("git", "commit", "-q", "-m", "fixture", cwd=project, env=env)
+    (project / "a/x/util.py").write_text("needle\nneedle two\n", encoding="utf-8")  # so that `git diff --exit-code` exits 1
+    return project
+
+
+def ground_truth(project: Path, commands) -> list[dict]:
+    rows = []
+    for command in commands:
+        done = sh("bash", "-c", command, cwd=project, check=False)
+        rows.append({"command": command, "exit": done.returncode, "output": (done.stdout + done.stderr)[:200]})
+    return rows
+
+
+def make_home(name: str, project: Path, rtk_hook: bool, agents: bool) -> Path:
+    home = WORK / name
+    codex_home = home / ".codex"
+    codex_home.mkdir(parents=True)
+    probe = home / "probe_hook.py"
+    probe.write_text("import json, sys\nopen(%r, 'a').write(sys.stdin.read().replace('\\n', ' ') + '\\n')\n" % str(home / "probe.log"),
+                     encoding="utf-8")
+    (codex_home / "hooks.json").write_text(json.dumps({"hooks": {"PreToolUse": [
+        {"matcher": "", "hooks": [{"type": "command", "command": f"python3 {probe}"}]}]}}, indent=2) + "\n", encoding="utf-8")
+    (codex_home / "config.toml").write_text("# scratch user layer\n", encoding="utf-8")
+    env = dict(os.environ, HOME=str(home), CODEX_HOME=str(codex_home))
+    if rtk_hook:
+        sh("rtk", "init", "-g", "--codex", cwd=home, env=env)
+    if not agents:
+        for leftover in ("AGENTS.md", "RTK.md"):
+            (codex_home / leftover).unlink(missing_ok=True)
+    else:
+        (codex_home / "AGENTS.md").write_text(AWARENESS, encoding="utf-8")
+    return codex_home
+
+
+def hooks_state(codex_home: Path, project: Path) -> list[dict]:
+    with lane.AppServer(CODEX, lane.codex_env(codex_home), project) as server:
+        return server.request("hooks/list", {"cwds": [str(project)]})["data"][0]["hooks"]
+
+
+def trust_all(codex_home: Path, project: Path) -> None:
+    """The repository's own tool, as a plan row runs it, for the two hooks of the scratch home: the probe and rtk's. The process
+    name is one no process has, because other codex sessions may run on the host and this home is scratch."""
+    probe = codex_home.parent / "probe_hook.py"
+    sh(sys.executable, str(TRUST_TOOL), "--codex-home", str(codex_home), "--cwd", str(project), "--command", "rtk hook codex",
+       "--command", f"python3 {probe}", "--codex-process-name", "no-such-codex-process", "--apply")
+
+
+def run_arm(label: str, codex_home: Path, project: Path, commands, strict: bool, path: str | None = None) -> dict:
+    log = codex_home.parent / "probe.log"
+    log.unlink(missing_ok=True)
+    argv = [CODEX, "exec", "--json", "--ephemeral", "--skip-git-repo-check", "-C", str(project)]
+    for override in GATEWAY:
+        argv += ["-c", override]
+    argv.append(prompt(commands, strict))
+    env = dict(os.environ, CODEX_HOME=str(codex_home))
+    if path is not None:
+        env["PATH"] = path  # a launcher whose PATH lacks rtk: the hook command is the bare `rtk hook codex`
+    started = time.time()
+    done = subprocess.run(argv, env=env, capture_output=True, text=True, timeout=900, stdin=subprocess.DEVNULL)
+    (OUT / f"{label}.jsonl").write_text(done.stdout, encoding="utf-8")
+    (OUT / f"{label}.err").write_text(done.stderr[-2000:], encoding="utf-8")
+    events = [json.loads(line) for line in done.stdout.splitlines() if line.startswith("{")]
+    commands = [e["item"] for e in events if e.get("type") == "item.completed" and e["item"].get("type") == "command_execution"]
+    payloads = [json.loads(line) for line in log.read_text().splitlines()] if log.exists() else []
+    (OUT / f"{label}.probe.jsonl").write_text("".join(json.dumps(p) + "\n" for p in payloads), encoding="utf-8")
+    usage = [e["usage"] for e in events if e.get("type") == "turn.completed"]
+    return {"label": label, "rc": done.returncode, "seconds": round(time.time() - started), "commands": commands,
+            "asked": [p.get("tool_input", {}).get("command") for p in payloads], "usage": usage[-1] if usage else None,
+            "stderr_head": done.stderr[:300]}
+
+
+def main() -> int:
+    OUT.mkdir(parents=True, exist_ok=True)
+    shutil.rmtree(WORK, ignore_errors=True)
+    WORK.mkdir(parents=True, mode=0o700)
+    live = Path.home() / ".codex/hooks.json"
+    live_before = live.read_bytes() if live.exists() else None
+    project = fixture()
+    truth = ground_truth(project, COMMANDS)
+    truth2 = ground_truth(project, COMMANDS2)
+    gain_before = json.loads(sh("rtk", "gain", "-f", "json").stdout)["summary"]
+    arms = {}
+    for label, rtk_hook, agents, trusted, commands, strict in (
+            ("R0-probe-only", False, False, True, COMMANDS, True), ("R1-hook-trusted", True, False, True, COMMANDS, True),
+            ("R1u-hook-untrusted", True, False, False, COMMANDS, True), ("R2-hook-and-prefix", True, True, True, COMMANDS, True),
+            ("B2-hook-battery2", True, False, True, COMMANDS2, True),
+            ("R2b-prefix-instruction-and-hook", True, True, True, COMMANDS, False),
+            ("R1p-hook-trusted-rtk-not-on-path", True, False, True, COMMANDS, True)):
+        if ONLY and label not in ONLY:
+            continue
+        codex_home = make_home(label, project, rtk_hook, agents)
+        listing = [{k: h.get(k) for k in ("key", "eventName", "matcher", "command", "trustStatus", "enabled")}
+                   for h in hooks_state(codex_home, project)]
+        if trusted:
+            trust_all(codex_home, project)
+        after = [{k: h.get(k) for k in ("key", "trustStatus")} for h in hooks_state(codex_home, project)]
+        arms[label] = run_arm(label, codex_home, project, commands, strict,
+                              "/usr/bin:/bin" if label.startswith("R1p") else None)
+        arms[label]["hooks_before_trust"] = listing
+        arms[label]["trust_after"] = after
+    gain_after = json.loads(sh("rtk", "gain", "-f", "json").stdout)["summary"]
+    live_after = live.read_bytes() if live.exists() else None
+    result = {"ground_truth": truth, "ground_truth_battery2": truth2, "arms": arms, "live_hooks_json_unchanged": live_before == live_after,
+              "gain": {"commands": [gain_before["total_commands"], gain_after["total_commands"]],
+                       "saved": [gain_before["total_saved"], gain_after["total_saved"]]}}
+    (OUT / "result.json").write_text(json.dumps(result, indent=1), encoding="utf-8")
+    shutil.rmtree(WORK, ignore_errors=True)
+    print(OUT)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/evidence/artifacts/token-stack-fresh-session-e2e-20261004/fresh_session_e2e.sh b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/fresh_session_e2e.sh
new file mode 100755
index 000000000..822d294ea
--- /dev/null
+++ b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/fresh_session_e2e.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# Fresh-session E2E of the token stack on one WSL, with upstream commands only (the user's directive of 2026-10-04 21:30Z:
+# "install cleanly with upstreamcommands, best sota practice natively, and e2e with upstream commands with new session
+# launched e2e for our wsls").
+#
+#   fresh_session_e2e.sh <label>      # nativestack | nativestack2604; run inside that distribution
+#
+# It sequences upstream commands in a brand-new project directory, so that nothing registered per project can help, and reads
+# their own output with jq: `rtk --version`, `rtk init --show`, `rtk gain -f json` (before and after), `claude mcp list`,
+# `codex mcp list`, a headless `claude -p --output-format stream-json --verbose --include-hook-events` session (hook
+# lifecycle events, the MCP servers of its init event, its result and usage) and a headless `codex exec --json --ephemeral`
+# session. Local monitoring of what this host does today, never an A/B. Costs two trivial sessions per run (one Haiku
+# probe pair, one Codex Sol low-effort probe).
+set -u
+label=${1:?usage: fresh_session_e2e.sh <label>}
+base=${E2E_OUT:-$HOME/.local/state/native-agent-stack/e2e}
+repo=${E2E_REPO:-$PWD}   # a checkout that may carry per-project MCP registrations
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+out=$base/fresh-$label-$stamp
+mkdir -p "$out"
+project=$(mktemp -d "$HOME/.cache/native-agent-stack-e2e-project-XXXXXX")
+cleanup() { case $project in "$HOME"/.cache/native-agent-stack-e2e-project-*) rm -rf "$project" ;; esac; }
+trap cleanup EXIT
+git -C "$project" init -q
+mkdir -p "$project/a/x" "$project/b/x" "$project/c"
+for f in a/x/util.py b/x/util.py c/util.py; do echo needle > "$project/$f"; done
+echo nothing > "$project/c/other.py"
+
+step() { name=$1; shift; "$@" > "$out/$name.out" 2> "$out/$name.err" < /dev/null; echo $? > "$out/$name.rc"; }
+names() { grep -E '^[A-Za-z:_-]+: .* - .*(Connected|Failed|authentication)' "$1" 2>/dev/null | sed 's/: .*//' | sort; }  # server lines of `claude mcp list`
+cd "$project" || exit 2
+
+step rtk-version rtk --version
+step rtk-init-show rtk init --show
+step claude-version claude --version
+step codex-version codex --version
+step gain-before rtk gain -f json
+step mcp-claude-fresh timeout 120 claude mcp list
+step mcp-codex-fresh timeout 60 codex mcp list
+( cd "$repo" && step mcp-claude-repo timeout 120 claude mcp list ) 2>/dev/null
+
+timeout 240 claude -p --model haiku --output-format stream-json --verbose --include-hook-events --max-turns 4 \
+  "With the Bash tool run exactly this command: git status then reply DONE." > "$out/claude-git.jsonl" 2> "$out/claude-git.err" < /dev/null
+echo $? > "$out/claude-git.rc"
+timeout 240 claude -p --model haiku --output-format stream-json --verbose --include-hook-events --max-turns 4 \
+  "With the Bash tool run exactly this command: grep -rl needle . then reply with how many files it listed." \
+  > "$out/claude-grep.jsonl" 2> "$out/claude-grep.err" < /dev/null
+echo $? > "$out/claude-grep.rc"
+timeout 300 codex exec --json --ephemeral --skip-git-repo-check -m gpt-6.1-sol -c model_reasoning_effort='"low"' \
+  "Run git status once with the shell tool, then reply with the single word DONE." \
+  > "$out/codex-git.jsonl" 2> "$out/codex-git.err" < /dev/null
+echo $? > "$out/codex-git.rc"
+step gain-after rtk gain -f json
+step gain-project rtk gain -p
+
+{
+  echo "# Fresh-session E2E: $label, $stamp (upstream commands only; local monitoring, not an A/B)"
+  echo
+  echo "## Versions"
+  echo "- $(cat "$out/rtk-version.out" | head -1); claude $(head -1 "$out/claude-version.out"); $(head -1 "$out/codex-version.out")"
+  echo "## rtk init --show"
+  sed -n '1,12p' "$out/rtk-init-show.out" | sed 's/^/    /'
+  echo "## MCP servers a fresh directory sees (claude mcp list / codex mcp list)"
+  echo "- claude, names: $(names "$out/mcp-claude-fresh.out" | tr '\n' ' ')"
+  echo "- claude, connected: $(grep -c 'Connected' "$out/mcp-claude-fresh.out") of $(names "$out/mcp-claude-fresh.out" | wc -l)"
+  echo "- claude, only in $repo (local or project scope, so a new project lacks it): $(comm -13 <(names "$out/mcp-claude-fresh.out") <(names "$out/mcp-claude-repo.out") | tr '\n' ' ')"
+  echo "- codex, names: $(awk 'NF && $1!="Name" && $1!="Url" && $1 !~ /^[-]/ {print $1}' "$out/mcp-codex-fresh.out" | sort -u | tr '\n' ' ')"
+  for session in claude-git claude-grep; do
+    echo "## Claude fresh session: $session"
+    jq -r 'select(.type=="system" and .subtype=="init") | "- init: claude_code_version \(.claude_code_version), model \(.model), permissionMode \(.permissionMode), tools \(.tools|length), plugins \(.plugins|length)\n- MCP servers in the init event: \([.mcp_servers[]? | "\(.name)=\(.status)"] | join(", "))"' "$out/$session.jsonl"
+    echo "- hook events (event, name, outcome, count):"
+    jq -r 'select(.type=="system" and .subtype=="hook_response") | "\(.hook_event)\t\(.hook_name)\t\(.outcome)"' "$out/$session.jsonl" | sort | uniq -c | sed 's/^ */    /'
+    echo "- asked for / rewritten to:"
+    jq -r 'select(.type=="assistant") | .message.content[]? | select(.type=="tool_use") | "    asked: \(.input.command)"' "$out/$session.jsonl"
+    jq -r 'select(.type=="system" and .subtype=="hook_response" and .hook_event=="PreToolUse") | select(.stdout|test("updatedInput")) | .stdout | fromjson | .hookSpecificOutput | "    \(.permissionDecisionReason): \(.updatedInput.command)"' "$out/$session.jsonl"
+    jq -r 'select(.type=="user") | .message.content[]? | select(.type=="tool_result") | "    result: \(.content|tostring|.[0:300])"' "$out/$session.jsonl"
+    jq -r 'select(.type=="result") | "- result: \(.subtype), turns \(.num_turns), cost $\(.total_cost_usd), tokens in \(.usage.input_tokens) out \(.usage.output_tokens) cache-read \(.usage.cache_read_input_tokens)"' "$out/$session.jsonl"
+  done
+  echo "## Codex fresh session: codex-git"
+  jq -r 'select(.type=="item.completed" and .item.type=="command_execution") | "- executed: \(.item.command) (exit \(.item.exit_code)): \(.item.aggregated_output|tostring|.[0:120])"' "$out/codex-git.jsonl"
+  jq -r 'select(.type=="turn.completed") | "- usage: input \(.usage.input_tokens), cached \(.usage.cached_input_tokens), output \(.usage.output_tokens)"' "$out/codex-git.jsonl"
+  echo "## rtk gain (upstream counter, whole host: the delta spans the E2E's interval and includes any other session's commands; the project-scoped block below is this E2E's own)"
+  jq -n --slurpfile b "$out/gain-before.out" --slurpfile a "$out/gain-after.out" \
+    '"- commands \($b[0].summary.total_commands) -> \($a[0].summary.total_commands) (+\($a[0].summary.total_commands - $b[0].summary.total_commands)); saved tokens \($b[0].summary.total_saved) -> \($a[0].summary.total_saved) (+\($a[0].summary.total_saved - $b[0].summary.total_saved)); average saving \($a[0].summary.avg_savings_pct)%"' -r
+  echo "- rtk gain -p (this fresh project only):"
+  sed -n '1,14p' "$out/gain-project.out" | sed 's/^/    /'
+} > "$out/summary.md" 2>&1
+echo "$out"
diff --git a/evidence/artifacts/token-stack-fresh-session-e2e-20261004/nativestack-before-snapshot.summary.md b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/nativestack-before-snapshot.summary.md
new file mode 100644
index 000000000..214c50396
--- /dev/null
+++ b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/nativestack-before-snapshot.summary.md
@@ -0,0 +1,81 @@
+# Fresh-session E2E: nativestack, 20261004T214402Z (upstream commands only; local monitoring, not an A/B)
+
+## Versions
+- rtk 0.51.0; claude 2.1.289 (Claude Code); codex-cli 0.159.3
+## rtk init --show
+    rtk Configuration:
+    
+    [ok] Hook: rtk hook claude (native binary command)
+    [ok] RTK.md: <home>/.claude/RTK.md (slim mode)
+    [ok] Global (~/.claude/CLAUDE.md): @RTK.md reference
+    [--] Local (./CLAUDE.md): not found
+    [ok] settings.json: RTK hook configured
+    [--] OpenCode: plugin not found
+    [--] Cursor hook: not found
+    
+    Usage:
+      rtk init              # Full injection into local CLAUDE.md
+## MCP servers a fresh directory sees (claude mcp list / codex mcp list)
+- claude, names: ai-memory codebase-memory headroom hindsight jcodemunch plugin:context-mode:context-mode qmd serena 
+- claude, connected: 8 of 8
+- claude, only in <home>/code/native-agent-stack (local or project scope, so a new project lacks it): socraticode 
+- codex, names: ai-memory codebase-memory context-mode headroom hindsight qmd serena socraticode 
+## Claude fresh session: claude-git
+- init: claude_code_version 2.1.289, model claude-haiku-4-5-20251001, permissionMode bypassPermissions, tools 117, plugins 7
+- MCP servers in the init event: plugin:context-mode:context-mode=connected, ai-memory=connected, serena=connected, jcodemunch=connected, codebase-memory=connected, qmd=connected, headroom=connected, hindsight=connected
+- hook events (event, name, outcome, count):
+    2 PostToolUse	PostToolUse:Bash	success
+    4 PreToolUse	PreToolUse:Bash	success
+    7 SessionStart	SessionStart:startup	success
+    4 Stop	Stop	success
+    2 UserPromptSubmit	UserPromptSubmit	success
+- asked for / rewritten to:
+    asked: git status
+    RTK auto-rewrite: rtk git status
+    result: * No commits yet on master
+?? .serena/
+?? a/
+?? b/
+?? c/
+- result: success, turns 2, cost $0.040714, tokens in 18 out 185 cache-read 46150
+## Claude fresh session: claude-grep
+- init: claude_code_version 2.1.289, model claude-haiku-4-5-20251001, permissionMode bypassPermissions, tools 117, plugins 7
+- MCP servers in the init event: plugin:context-mode:context-mode=connected, ai-memory=connected, serena=connected, jcodemunch=connected, codebase-memory=connected, qmd=connected, headroom=connected, hindsight=connected
+- hook events (event, name, outcome, count):
+    2 PostToolUse	PostToolUse:Bash	success
+    4 PreToolUse	PreToolUse:Bash	success
+    7 SessionStart	SessionStart:startup	success
+    4 Stop	Stop	success
+    2 UserPromptSubmit	UserPromptSubmit	success
+- asked for / rewritten to:
+    asked: grep -rl needle .
+    RTK auto-rewrite: rtk grep -rl needle .
+    result: ./b/x/util.py
+./a/x/util.py
+./c/util.py
+- result: success, turns 2, cost $0.0340301, tokens in 20 out 262 cache-read 50141
+## Codex fresh session: codex-git
+- executed: /bin/bash -lc 'rtk git status' (exit 0): * No commits yet on master
+?? .serena/
+?? a/
+?? b/
+?? c/
+
+- usage: input 39197, cached 19328, output 49
+## rtk gain (upstream counter, whole host: the delta spans the E2E's interval and includes any other session's commands; the project-scoped block below is this E2E's own)
+- commands 262568 -> 262601 (+33); saved tokens 124711599 -> 124711896 (+297); average saving 9.02291465765439%
+- rtk gain -p (this fresh project only):
+    RTK Token Savings (Project Scope)
+    ════════════════════════════════════════════════════════════
+    Scope: /.../.cache/e2e-fresh-project-OhobWt
+    
+    Total commands:    3
+    Input tokens:      108
+    Output tokens:     28
+    Tokens saved:      80 (74.1%)
+    Total exec time:   10ms (avg 3ms)
+    Efficiency meter: ██████████████████░░░░░░ 74.1%
+    
+    By Command
+    ───────────────────────────────────────────────────────────────────────
+      #  Command                   Count  Saved  Total%    Time  Impact    
diff --git a/evidence/artifacts/token-stack-fresh-session-e2e-20261004/receipt.json b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/receipt.json
new file mode 100644
index 000000000..d5a3ac1fd
--- /dev/null
+++ b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/receipt.json
@@ -0,0 +1,404 @@
+{
+ "schema": "token-stack-fresh-session-e2e/1",
+ "recorded_utc": "2026-10-04T22:20:00Z",
+ "evidence_class": "local_integration: native execution on one host, in a fresh project directory and in scratch Codex homes; not an A/B, not an upstream test; one run per arm",
+ "versions": {
+  "rtk": "0.51.0",
+  "claude_code": "2.1.289",
+  "codex_cli": "0.159.3"
+ },
+ "nativestack_before_snapshot": {
+  "recorded_utc": "2026-10-04T21:44Z",
+  "claude_git_status": {
+   "model": "claude-haiku-4-5-20251001",
+   "claude_code_version": "2.1.289",
+   "tools": 117,
+   "mcp_servers": {
+    "plugin:context-mode:context-mode": "connected",
+    "ai-memory": "connected",
+    "serena": "connected",
+    "jcodemunch": "connected",
+    "codebase-memory": "connected",
+    "qmd": "connected",
+    "headroom": "connected",
+    "hindsight": "connected"
+   },
+   "hook_events": {
+    "PostToolUse|PostToolUse:Bash|success": 2,
+    "PreToolUse|PreToolUse:Bash|success": 4,
+    "SessionStart|SessionStart:startup|success": 7,
+    "Stop|Stop|success": 4,
+    "UserPromptSubmit|UserPromptSubmit|success": 2
+   },
+   "asked": [
+    "git status"
+   ],
+   "rewritten_to": [
+    {
+     "reason": "RTK auto-rewrite",
+     "command": "rtk git status"
+    }
+   ],
+   "turns": 2,
+   "is_error": false,
+   "tokens": {
+    "input": 18,
+    "output": 185,
+    "cache_read": 46150
+   }
+  },
+  "claude_grep": {
+   "model": "claude-haiku-4-5-20251001",
+   "claude_code_version": "2.1.289",
+   "tools": 117,
+   "mcp_servers": {
+    "plugin:context-mode:context-mode": "connected",
+    "ai-memory": "connected",
+    "serena": "connected",
+    "jcodemunch": "connected",
+    "codebase-memory": "connected",
+    "qmd": "connected",
+    "headroom": "connected",
+    "hindsight": "connected"
+   },
+   "hook_events": {
+    "PostToolUse|PostToolUse:Bash|success": 2,
+    "PreToolUse|PreToolUse:Bash|success": 4,
+    "SessionStart|SessionStart:startup|success": 7,
+    "Stop|Stop|success": 4,
+    "UserPromptSubmit|UserPromptSubmit|success": 2
+   },
+   "asked": [
+    "grep -rl needle ."
+   ],
+   "rewritten_to": [
+    {
+     "reason": "RTK auto-rewrite",
+     "command": "rtk grep -rl needle ."
+    }
+   ],
+   "turns": 2,
+   "is_error": false,
+   "tokens": {
+    "input": 20,
+    "output": 262,
+    "cache_read": 50141
+   }
+  },
+  "codex_git_status": {
+   "executed": "/bin/bash -lc 'rtk git status'",
+   "exit_code": 0,
+   "usage": {
+    "input_tokens": 39197,
+    "cached_input_tokens": 19328,
+    "cache_write_input_tokens": 0,
+    "output_tokens": 49,
+    "reasoning_output_tokens": 0
+   }
+  },
+  "rtk_gain_json_summary": {
+   "commands_before": 262568,
+   "commands_after": 262601,
+   "saved_before": 124711599,
+   "saved_after": 124711896,
+   "note": "host-wide counters; other sessions ran during the probe"
+  },
+  "mcp_user_scope_gap": "SocratiCode registered at local scope only for Claude Code on this host (a fresh project lacks it)"
+ },
+ "codex_hook_qualification": {
+  "live_hooks_json_unchanged": true,
+  "rtk_configuration": "The arms ran with the host's HOME, so rtk read the host's own configuration: a [hooks] exclude_commands of the five entries of fixtures/rtk-hook-exclusions.toml (git show REV:path, diff, git branch, jq). That is why arm B2's diff was not rewritten; with upstream defaults rtk rewrite rewrites those four too (rtk-behaviour-probe.json, rewrite.upstream_defaults against rewrite.repository_exclusions).",
+  "arms": [
+   {
+    "arm": "R0-probe-only",
+    "trust_after": [
+     "trusted"
+    ],
+    "commands_executed": [
+     "/bin/bash -lc 'git status --short'",
+     "/bin/bash -lc 'ls /nonexistent'",
+     "/bin/bash -lc 'grep -rl nomatch .'",
+     "/bin/bash -lc 'grep -rl needle .'",
+     "/bin/bash -lc 'git diff --exit-code'",
+     "/bin/bash -lc 'git status --short && echo done'"
+    ],
+    "exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "shell_exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "exit_codes_match_shell": true,
+    "executed_with_rtk": 0,
+    "model_asked_with_rtk": 0,
+    "second_hook_saw_commands": 6,
+    "double_prefix": 0,
+    "input_tokens": 91649
+   },
+   {
+    "arm": "R1-hook-trusted",
+    "trust_after": [
+     "trusted",
+     "trusted"
+    ],
+    "commands_executed": [
+     "/bin/bash -lc 'rtk git status --short'",
+     "/bin/bash -lc 'rtk ls /nonexistent'",
+     "/bin/bash -lc 'rtk grep -rl nomatch .'",
+     "/bin/bash -lc 'rtk grep -rl needle .'",
+     "/bin/bash -lc 'rtk git diff --exit-code'",
+     "/bin/bash -lc 'rtk git status --short && echo done'"
+    ],
+    "exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "shell_exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "exit_codes_match_shell": true,
+    "executed_with_rtk": 6,
+    "model_asked_with_rtk": 0,
+    "second_hook_saw_commands": 6,
+    "double_prefix": 0,
+    "input_tokens": 91816
+   },
+   {
+    "arm": "R1u-hook-untrusted",
+    "trust_after": [
+     "untrusted",
+     "untrusted"
+    ],
+    "commands_executed": [
+     "/bin/bash -lc 'git status --short'",
+     "/bin/bash -lc 'ls /nonexistent'",
+     "/bin/bash -lc 'grep -rl nomatch .'",
+     "/bin/bash -lc 'grep -rl needle .'",
+     "/bin/bash -lc 'git diff --exit-code'",
+     "/bin/bash -lc 'git status --short && echo done'"
+    ],
+    "exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "shell_exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "exit_codes_match_shell": true,
+    "executed_with_rtk": 0,
+    "model_asked_with_rtk": 0,
+    "second_hook_saw_commands": 0,
+    "double_prefix": 0,
+    "input_tokens": 91479
+   },
+   {
+    "arm": "R2-hook-and-prefix",
+    "trust_after": [
+     "trusted",
+     "trusted"
+    ],
+    "commands_executed": [
+     "/bin/bash -lc 'rtk git status --short'",
+     "/bin/bash -lc 'rtk ls /nonexistent'",
+     "/bin/bash -lc 'rtk grep -rl nomatch .'",
+     "/bin/bash -lc 'rtk grep -rl needle .'",
+     "/bin/bash -lc 'rtk git diff --exit-code'",
+     "/bin/bash -lc 'rtk git status --short && echo done'"
+    ],
+    "exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "shell_exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "exit_codes_match_shell": true,
+    "executed_with_rtk": 6,
+    "model_asked_with_rtk": 0,
+    "second_hook_saw_commands": 6,
+    "double_prefix": 0,
+    "input_tokens": 92481
+   },
+   {
+    "arm": "B2-hook-battery2",
+    "trust_after": [
+     "trusted",
+     "trusted"
+    ],
+    "commands_executed": [
+     "/bin/bash -lc 'rtk git log --oneline -3 | cat'",
+     "/bin/bash -lc 'rtk grep -rn \"needle two\" a'",
+     "/bin/bash -lc 'rtk find /nonexistent -name x'",
+     "/bin/bash -lc 'diff /nonexistent a/x/util.py'",
+     "/bin/bash -lc 'rtk read a/x/util.py'"
+    ],
+    "exit_codes": [
+     0,
+     0,
+     1,
+     2,
+     0
+    ],
+    "shell_exit_codes": [
+     0,
+     0,
+     1,
+     2,
+     0
+    ],
+    "exit_codes_match_shell": true,
+    "executed_with_rtk": 4,
+    "model_asked_with_rtk": 0,
+    "second_hook_saw_commands": 5,
+    "double_prefix": 0,
+    "input_tokens": 78274
+   },
+   {
+    "arm": "R2b-prefix-instruction-and-hook",
+    "trust_after": [
+     "trusted",
+     "trusted"
+    ],
+    "commands_executed": [
+     "/bin/bash -lc 'rtk git status --short'",
+     "/bin/bash -lc 'rtk ls /nonexistent'",
+     "/bin/bash -lc 'rtk grep -rl nomatch .'",
+     "/bin/bash -lc 'rtk grep -rl needle .'",
+     "/bin/bash -lc 'rtk git diff --exit-code'",
+     "/bin/bash -lc 'rtk git status --short && rtk echo done'"
+    ],
+    "exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "shell_exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "exit_codes_match_shell": true,
+    "executed_with_rtk": 6,
+    "model_asked_with_rtk": 6,
+    "second_hook_saw_commands": 6,
+    "double_prefix": 0,
+    "input_tokens": 92965
+   },
+   {
+    "arm": "R1p-hook-trusted-rtk-not-on-path",
+    "trust_after": [
+     "trusted",
+     "trusted"
+    ],
+    "commands_executed": [
+     "/bin/bash -lc 'git status --short'",
+     "/bin/bash -lc 'ls /nonexistent'",
+     "/bin/bash -lc 'grep -rl nomatch .'",
+     "/bin/bash -lc 'grep -rl needle .'",
+     "/bin/bash -lc 'git diff --exit-code'",
+     "/bin/bash -lc 'git status --short && echo done'"
+    ],
+    "exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "shell_exit_codes": [
+     0,
+     2,
+     1,
+     0,
+     1,
+     0
+    ],
+    "exit_codes_match_shell": true,
+    "executed_with_rtk": 0,
+    "model_asked_with_rtk": 0,
+    "second_hook_saw_commands": 6,
+    "double_prefix": 0,
+    "input_tokens": 91674
+   }
+  ],
+  "ground_truth_exit_codes": {
+   "battery_1": [
+    0,
+    2,
+    1,
+    0,
+    1,
+    0
+   ],
+   "battery_2": [
+    0,
+    0,
+    1,
+    2,
+    0
+   ]
+  }
+ },
+ "trust_readback_race": {
+  "recorded_utc": "2026-10-04T23:25Z",
+  "script": "trust_readback_race.py",
+  "what": "the hooks file changes ('echo named-hook' to 'echo different-hook') as soon as config/batchWrite returns, against the real codex app-server in a scratch Codex home",
+  "codex": "codex-cli 0.159.3",
+  "before_the_fix": {
+   "tool": "tools/adoption/codex_hook_trust.py at c8613fe16",
+   "exit": 0,
+   "stdout": "hooks named in <scratch>/codex-home:\n  <scratch>/codex-home/hooks.json:pre_tool_use:0:0: preToolUse Bash 'echo named-hook' is untrusted\nbackup: <scratch>/codex-home/config.toml.bak.<stamp>\ntrusted 1 hook(s) in <scratch>/codex-home/config.toml; read back from hooks/list",
+   "stderr": ""
+  },
+  "after_the_fix": {
+   "tool": "tools/adoption/codex_hook_trust.py of this pull request",
+   "exit": 3,
+   "stdout": "hooks named in <scratch>/codex-home:\n  <scratch>/codex-home/hooks.json:pre_tool_use:0:0: preToolUse Bash 'echo named-hook' is untrusted\nbackup: <scratch>/codex-home/config.toml.bak.<stamp>",
+   "stderr": "failed: hooks/list after the write: <scratch>/codex-home/hooks.json:pre_tool_use:0:0: changed during the write ('echo different-hook' is modified); the backup is <scratch>/codex-home/config.toml.bak.<stamp>"
+  }
+ }
+}
diff --git a/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk-behaviour-probe.json b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk-behaviour-probe.json
new file mode 100644
index 000000000..54b95392e
--- /dev/null
+++ b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk-behaviour-probe.json
@@ -0,0 +1,463 @@
+{
+  "compared": [
+    {
+      "command": "git status --short",
+      "rtk": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": false,
+        "stdout_lines": 2
+      },
+      "shell": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 2
+      }
+    },
+    {
+      "command": "git log",
+      "rtk": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 10
+      },
+      "shell": {
+        "commit_lines": 66,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 396
+      }
+    },
+    {
+      "command": "git log --stat",
+      "rtk": {
+        "commit_lines": 10,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [
+          "[rtk] capped at 10 commits; pass -n <count> for more"
+        ],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 87
+      },
+      "shell": {
+        "commit_lines": 66,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 592
+      }
+    },
+    {
+      "command": "git log --oneline",
+      "rtk": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 50
+      },
+      "shell": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 66
+      }
+    },
+    {
+      "command": "git log --format=%s",
+      "rtk": {
+        "commit_lines": 49,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 50
+      },
+      "shell": {
+        "commit_lines": 64,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 66
+      }
+    },
+    {
+      "command": "git log --graph --oneline",
+      "rtk": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 50
+      },
+      "shell": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 68
+      }
+    },
+    {
+      "command": "git log -n 16",
+      "rtk": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 16
+      },
+      "shell": {
+        "commit_lines": 16,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 96
+      }
+    },
+    {
+      "command": "git log --oneline -n 66",
+      "rtk": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 66
+      },
+      "shell": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 66
+      }
+    },
+    {
+      "command": "git log --stat -n 16",
+      "rtk": {
+        "commit_lines": 16,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 141
+      },
+      "shell": {
+        "commit_lines": 16,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 1,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 141
+      }
+    },
+    {
+      "command": "ls /nonexistent",
+      "rtk": {
+        "commit_lines": 0,
+        "exit": 2,
+        "mentions_usr_bin_ls": true,
+        "merge_lines": 0,
+        "stderr_first_lines": [
+          "/usr/bin/ls: cannot access '/nonexistent': No such file or directory"
+        ],
+        "stdout_ends_with_newline": null,
+        "stdout_lines": 0
+      },
+      "shell": {
+        "commit_lines": 0,
+        "exit": 2,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [
+          "ls: cannot access '/nonexistent': No such file or directory"
+        ],
+        "stdout_ends_with_newline": null,
+        "stdout_lines": 0
+      }
+    },
+    {
+      "command": "find /nonexistent -name x",
+      "rtk": {
+        "commit_lines": 0,
+        "exit": 1,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [
+          "find: '/nonexistent': No such file or directory"
+        ],
+        "stdout_ends_with_newline": null,
+        "stdout_lines": 0
+      },
+      "shell": {
+        "commit_lines": 0,
+        "exit": 1,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [
+          "find: \u2018/nonexistent\u2019: No such file or directory"
+        ],
+        "stdout_ends_with_newline": null,
+        "stdout_lines": 0
+      }
+    },
+    {
+      "command": "grep -rl needle .",
+      "rtk": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 1
+      },
+      "shell": {
+        "commit_lines": 0,
+        "exit": 0,
+        "mentions_usr_bin_ls": false,
+        "merge_lines": 0,
+        "stderr_first_lines": [],
+        "stdout_ends_with_newline": true,
+        "stdout_lines": 1
+      }
+    }
+  ],
+  "evidence_class": "local_integration: one run, one host, a scratch repository",
+  "exclusions_fixture_sha256": "0e788d025386c9a97c0adcda270e3c0ce39c679a22b90462599a31805bd81edd",
+  "fixture": {
+    "commits": 66,
+    "merge_commits": 1
+  },
+  "rewrite": {
+    "repository_exclusions": [
+      {
+        "command": "git status",
+        "exit": 3,
+        "rewritten_to": "rtk git status"
+      },
+      {
+        "command": "git status --short",
+        "exit": 3,
+        "rewritten_to": "rtk git status --short"
+      },
+      {
+        "command": "git log",
+        "exit": 3,
+        "rewritten_to": "rtk git log"
+      },
+      {
+        "command": "git log --oneline -3",
+        "exit": 3,
+        "rewritten_to": "rtk git log --oneline -3"
+      },
+      {
+        "command": "git log --stat",
+        "exit": 3,
+        "rewritten_to": "rtk git log --stat"
+      },
+      {
+        "command": "git diff --exit-code",
+        "exit": 3,
+        "rewritten_to": "rtk git diff --exit-code"
+      },
+      {
+        "command": "ls /nonexistent",
+        "exit": 3,
+        "rewritten_to": "rtk ls /nonexistent"
+      },
+      {
+        "command": "cat a/x/util.py",
+        "exit": 3,
+        "rewritten_to": "rtk read a/x/util.py"
+      },
+      {
+        "command": "grep -rl needle .",
+        "exit": 3,
+        "rewritten_to": "rtk grep -rl needle ."
+      },
+      {
+        "command": "find /nonexistent -name x",
+        "exit": 3,
+        "rewritten_to": "rtk find /nonexistent -name x"
+      },
+      {
+        "command": "git status --short && echo done",
+        "exit": 3,
+        "rewritten_to": "rtk git status --short && echo done"
+      },
+      {
+        "command": "git log --oneline -3 | cat",
+        "exit": 3,
+        "rewritten_to": "rtk git log --oneline -3 | cat"
+      },
+      {
+        "command": "git show HEAD:a/x/util.py",
+        "exit": 1,
+        "rewritten_to": null
+      },
+      {
+        "command": "diff /nonexistent a/x/util.py",
+        "exit": 1,
+        "rewritten_to": null
+      },
+      {
+        "command": "jq . data.json",
+        "exit": 1,
+        "rewritten_to": null
+      },
+      {
+        "command": "git branch",
+        "exit": 1,
+        "rewritten_to": null
+      },
+      {
+        "command": "echo hi",
+        "exit": 1,
+        "rewritten_to": null
+      },
+      {
+        "command": "bash -c 'git status'",
+        "exit": 1,
+        "rewritten_to": null
+      }
+    ],
+    "upstream_defaults": [
+      {
+        "command": "git status",
+        "exit": 3,
+        "rewritten_to": "rtk git status"
+      },
+      {
+        "command": "git status --short",
+        "exit": 3,
+        "rewritten_to": "rtk git status --short"
+      },
+      {
+        "command": "git log",
+        "exit": 3,
+        "rewritten_to": "rtk git log"
+      },
+      {
+        "command": "git log --oneline -3",
+        "exit": 3,
+        "rewritten_to": "rtk git log --oneline -3"
+      },
+      {
+        "command": "git log --stat",
+        "exit": 3,
+        "rewritten_to": "rtk git log --stat"
+      },
+      {
+        "command": "git diff --exit-code",
+        "exit": 3,
+        "rewritten_to": "rtk git diff --exit-code"
+      },
+      {
+        "command": "ls /nonexistent",
+        "exit": 3,
+        "rewritten_to": "rtk ls /nonexistent"
+      },
+      {
+        "command": "cat a/x/util.py",
+        "exit": 3,
+        "rewritten_to": "rtk read a/x/util.py"
+      },
+      {
+        "command": "grep -rl needle .",
+        "exit": 3,
+        "rewritten_to": "rtk grep -rl needle ."
+      },
+      {
+        "command": "find /nonexistent -name x",
+        "exit": 3,
+        "rewritten_to": "rtk find /nonexistent -name x"
+      },
+      {
+        "command": "git status --short && echo done",
+        "exit": 3,
+        "rewritten_to": "rtk git status --short && echo done"
+      },
+      {
+        "command": "git log --oneline -3 | cat",
+        "exit": 3,
+        "rewritten_to": "rtk git log --oneline -3 | cat"
+      },
+      {
+        "command": "git show HEAD:a/x/util.py",
+        "exit": 3,
+        "rewritten_to": "rtk git show HEAD:a/x/util.py"
+      },
+      {
+        "command": "diff /nonexistent a/x/util.py",
+        "exit": 3,
+        "rewritten_to": "rtk diff /nonexistent a/x/util.py"
+      },
+      {
+        "command": "jq . data.json",
+        "exit": 3,
+        "rewritten_to": "rtk jq . data.json"
+      },
+      {
+        "command": "git branch",
+        "exit": 3,
+        "rewritten_to": "rtk git branch"
+      },
+      {
+        "command": "echo hi",
+        "exit": 1,
+        "rewritten_to": null
+      },
+      {
+        "command": "bash -c 'git status'",
+        "exit": 1,
+        "rewritten_to": null
+      }
+    ]
+  },
+  "schema": "rtk-behaviour-probe/1",
+  "versions": {
+    "git": "git version 2.43.0",
+    "rtk": "rtk 0.51.0"
+  }
+}
diff --git a/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk-init-codex-probe.json b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk-init-codex-probe.json
new file mode 100644
index 000000000..320fcdfcd
--- /dev/null
+++ b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk-init-codex-probe.json
@@ -0,0 +1,454 @@
+{
+  "evidence_class": "local_integration: one run, one host, scratch homes",
+  "rtk": "rtk 0.51.0",
+  "scenarios": [
+    {
+      "scenario": "a Codex home with its own AGENTS.md and a hooks.json",
+      "steps": [
+        {
+          "args": [
+            "init",
+            "--show",
+            "--codex"
+          ],
+          "exit": 0,
+          "files": [],
+          "history_db_created": false,
+          "show": [
+            "[--] Global RTK.md: not found",
+            "[--] Global hooks.json exists but RTK hook is not configured",
+            "[--] Global AGENTS.md: exists but rtk not configured",
+            "[--] Local RTK.md: not found",
+            "[--] Local hooks.json exists but RTK hook is not configured",
+            "[--] Local AGENTS.md: not found"
+          ],
+          "step": "show before"
+        },
+        {
+          "args": [
+            "init",
+            "-g",
+            "--codex",
+            "--dry-run"
+          ],
+          "exit": 0,
+          "files": [],
+          "history_db_created": false,
+          "stderr": [],
+          "stdout_first_lines": [
+            "[dry-run] would create RTK.md: <scratch>/fake-home/.codex/RTK.md",
+            "[dry-run] would add @<scratch>/fake-home/.codex/RTK.md reference to AGENTS.md: <scratch>/fake-home/.codex/AGENTS.md",
+            "[dry-run] would patch Codex hooks: <scratch>/fake-home/.codex/hooks.json",
+            "[dry-run] Nothing written."
+          ],
+          "step": "dry run"
+        },
+        {
+          "args": [
+            "init",
+            "-g",
+            "--codex"
+          ],
+          "exit": 0,
+          "files": [
+            {
+              "change": "changed",
+              "file": "fake-home/.codex/AGENTS.md",
+              "lines": [
+                "+",
+                "+@<scratch>/fake-home/.codex/RTK.md"
+              ]
+            },
+            {
+              "bytes": 546,
+              "change": "created",
+              "file": "fake-home/.codex/RTK.md"
+            },
+            {
+              "change": "changed",
+              "file": "fake-home/.codex/hooks.json",
+              "lines": [
+                "+      },",
+                "+      {",
+                "+        \"matcher\": \"Bash\",",
+                "+        \"hooks\": [",
+                "+          {",
+                "+            \"type\": \"command\",",
+                "+            \"command\": \"rtk hook codex\"",
+                "+          }",
+                "+        ]"
+              ]
+            },
+            {
+              "bytes": 227,
+              "change": "created",
+              "file": "fake-home/.codex/hooks.json.bak"
+            }
+          ],
+          "history_db_created": true,
+          "stderr": [],
+          "stdout_first_lines": [
+            "RTK configured for Codex CLI.",
+            "  RTK.md:    <scratch>/fake-home/.codex/RTK.md",
+            "  Hook:      <scratch>/fake-home/.codex/hooks.json (registered)",
+            "  AGENTS.md: @<scratch>/fake-home/.codex/RTK.md reference added",
+            "  Codex global instructions path: <scratch>/fake-home/.codex/AGENTS.md",
+            "  Restart Codex. For a project hook, approve it when Codex asks you to trust it.",
+            "  Optional: if history recording fails with SQLITE_CANTOPEN in the"
+          ],
+          "step": "init"
+        },
+        {
+          "args": [
+            "init",
+            "--show",
+            "--codex"
+          ],
+          "exit": 0,
+          "files": [],
+          "history_db_created": false,
+          "show": [
+            "[ok] Global RTK.md: <scratch>/fake-home/.codex/RTK.md",
+            "[ok] Global hook: <scratch>/fake-home/.codex/hooks.json",
+            "[ok] Global AGENTS.md: RTK.md reference",
+            "[--] Local RTK.md: not found",
+            "[ok] Local hook: .codex/hooks.json",
+            "[--] Local AGENTS.md: not found"
+          ],
+          "step": "show after"
+        },
+        {
+          "args": [
+            "init",
+            "-g",
+            "--codex"
+          ],
+          "exit": 0,
+          "files": [],
+          "history_db_created": false,
+          "stderr": [],
+          "stdout_first_lines": [
+            "RTK configured for Codex CLI.",
+            "  RTK.md:    <scratch>/fake-home/.codex/RTK.md",
+            "  Hook:      <scratch>/fake-home/.codex/hooks.json (already present)",
+            "  AGENTS.md: @<scratch>/fake-home/.codex/RTK.md reference already present",
+            "  Codex global instructions path: <scratch>/fake-home/.codex/AGENTS.md",
+            "  Restart Codex. For a project hook, approve it when Codex asks you to trust it.",
+            "  Optional: if history recording fails with SQLITE_CANTOPEN in the"
+          ],
+          "step": "init again"
+        },
+        {
+          "args": [
+            "init",
+            "-g",
+            "--codex",
+            "--uninstall"
+          ],
+          "exit": 0,
+          "files": [
+            {
+              "change": "changed",
+              "file": "fake-home/.codex/AGENTS.md",
+              "lines": [
+                "-",
+                "-@<scratch>/fake-home/.codex/RTK.md"
+              ]
+            },
+            {
+              "change": "removed",
+              "file": "fake-home/.codex/RTK.md"
+            },
+            {
+              "change": "changed",
+              "file": "fake-home/.codex/hooks.json",
+              "lines": [
+                "-      },",
+                "-      {",
+                "-        \"matcher\": \"Bash\",",
+                "-        \"hooks\": [",
+                "-          {",
+                "-            \"type\": \"command\",",
+                "-            \"command\": \"rtk hook codex\"",
+                "-          }",
+                "-        ]"
+              ]
+            },
+            {
+              "change": "changed",
+              "file": "fake-home/.codex/hooks.json.bak",
+              "lines": [
+                "+      },",
+                "+      {",
+                "+        \"matcher\": \"Bash\",",
+                "+        \"hooks\": [",
+                "+          {",
+                "+            \"type\": \"command\",",
+                "+            \"command\": \"rtk hook codex\"",
+                "+          }",
+                "+        ]"
+              ]
+            }
+          ],
+          "history_db_created": false,
+          "stderr": [],
+          "stdout_first_lines": [
+            "RTK uninstalled for Codex CLI:",
+            "  - hooks.json: removed rtk hook codex entry",
+            "  - RTK.md: <scratch>/fake-home/.codex/RTK.md",
+            "  - AGENTS.md: removed @RTK.md reference"
+          ],
+          "step": "uninstall"
+        },
+        {
+          "args": [
+            "init",
+            "--show",
+            "--codex"
+          ],
+          "exit": 0,
+          "files": [],
+          "history_db_created": false,
+          "show": [
+            "[--] Global RTK.md: not found",
+            "[--] Global hooks.json exists but RTK hook is not configured",
+            "[--] Global AGENTS.md: exists but rtk not configured",
+            "[--] Local RTK.md: not found",
+            "[--] Local hooks.json exists but RTK hook is not configured",
+            "[--] Local AGENTS.md: not found"
+          ],
+          "step": "show after uninstall"
+        }
+      ]
+    },
+    {
+      "scenario": "a Codex home with a hooks.json and no AGENTS.md",
+      "steps": [
+        {
+          "args": [
+            "init",
+            "-g",
+            "--codex"
+          ],
+          "exit": 0,
+          "files": [
+            {
+              "bytes": 48,
+              "change": "created",
+              "file": "fake-home/.codex/AGENTS.md"
+            },
+            {
+              "bytes": 546,
+              "change": "created",
+              "file": "fake-home/.codex/RTK.md"
+            },
+            {
+              "change": "changed",
+              "file": "fake-home/.codex/hooks.json",
+              "lines": [
+                "+      },",
+                "+      {",
+                "+        \"matcher\": \"Bash\",",
+                "+        \"hooks\": [",
+                "+          {",
+                "+            \"type\": \"command\",",
+                "+            \"command\": \"rtk hook codex\"",
+                "+          }",
+                "+        ]"
+              ]
+            },
+            {
+              "bytes": 227,
+              "change": "created",
+              "file": "fake-home/.codex/hooks.json.bak"
+            }
+          ],
+          "history_db_created": true,
+          "stderr": [],
+          "stdout_first_lines": [
+            "RTK configured for Codex CLI.",
+            "  RTK.md:    <scratch>/fake-home/.codex/RTK.md",
+            "  Hook:      <scratch>/fake-home/.codex/hooks.json (registered)",
+            "  AGENTS.md: @<scratch>/fake-home/.codex/RTK.md reference added",
+            "  Codex global instructions path: <scratch>/fake-home/.codex/AGENTS.md",
+            "  Restart Codex. For a project hook, approve it when Codex asks you to trust it.",
+            "  Optional: if history recording fails with SQLITE_CANTOPEN in the"
+          ],
+          "step": "init"
+        },
+        {
+          "args": [
+            "init",
+            "-g",
+            "--codex",
+            "--uninstall"
+          ],
+          "exit": 0,
+          "files": [
+            {
+              "change": "changed",
+              "file": "fake-home/.codex/AGENTS.md",
+              "lines": [
+                "-@<scratch>/fake-home/.codex/RTK.md"
+              ]
+            },
+            {
+              "change": "removed",
+              "file": "fake-home/.codex/RTK.md"
+            },
+            {
+              "change": "changed",
+              "file": "fake-home/.codex/hooks.json",
+              "lines": [
+                "-      },",
+                "-      {",
+                "-        \"matcher\": \"Bash\",",
+                "-        \"hooks\": [",
+                "-          {",
+                "-            \"type\": \"command\",",
+                "-            \"command\": \"rtk hook codex\"",
+                "-          }",
+                "-        ]"
+              ]
+            },
+            {
+              "change": "changed",
+              "file": "fake-home/.codex/hooks.json.bak",
+              "lines": [
+                "+      },",
+                "+      {",
+                "+        \"matcher\": \"Bash\",",
+                "+        \"hooks\": [",
+                "+          {",
+                "+            \"type\": \"command\",",
+                "+            \"command\": \"rtk hook codex\"",
+                "+          }",
+                "+        ]"
+              ]
+            }
+          ],
+          "history_db_created": false,
+          "stderr": [],
+          "stdout_first_lines": [
+            "RTK uninstalled for Codex CLI:",
+            "  - hooks.json: removed rtk hook codex entry",
+            "  - RTK.md: <scratch>/fake-home/.codex/RTK.md",
+            "  - AGENTS.md: removed @RTK.md reference"
+          ],
+          "step": "uninstall"
+        }
+      ]
+    },
+    {
+      "scenario": "flags combined with --codex",
+      "steps": [
+        {
+          "args": [
+            "init",
+            "-g",
+            "--codex",
+            "--hook-only"
+          ],
+          "exit": 1,
+          "files": [],
+          "history_db_created": false,
+          "stderr": [
+            "rtk: --codex cannot be combined with --hook-only"
+          ],
+          "stdout_first_lines": [],
+          "step": "--hook-only"
+        },
+        {
+          "args": [
+            "init",
+            "-g",
+            "--codex",
+            "--no-patch"
+          ],
+          "exit": 1,
+          "files": [],
+          "history_db_created": false,
+          "stderr": [
+            "rtk: --codex cannot be combined with --no-patch"
+          ],
+          "stdout_first_lines": [],
+          "step": "--no-patch"
+        },
+        {
+          "args": [
+            "init",
+            "-g",
+            "--codex",
+            "--auto-patch"
+          ],
+          "exit": 1,
+          "files": [],
+          "history_db_created": false,
+          "stderr": [
+            "rtk: --codex cannot be combined with --auto-patch"
+          ],
+          "stdout_first_lines": [],
+          "step": "--auto-patch"
+        }
+      ]
+    },
+    {
+      "scenario": "CODEX_HOME outside HOME",
+      "steps": [
+        {
+          "args": [
+            "init",
+            "-g",
+            "--codex"
+          ],
+          "exit": 0,
+          "files": [
+            {
+              "bytes": 47,
+              "change": "created",
+              "file": "codex-elsewhere/AGENTS.md"
+            },
+            {
+              "bytes": 546,
+              "change": "created",
+              "file": "codex-elsewhere/RTK.md"
+            },
+            {
+              "change": "changed",
+              "file": "codex-elsewhere/hooks.json",
+              "lines": [
+                "+      },",
+                "+      {",
+                "+        \"matcher\": \"Bash\",",
+                "+        \"hooks\": [",
+                "+          {",
+                "+            \"type\": \"command\",",
+                "+            \"command\": \"rtk hook codex\"",
+                "+          }",
+                "+        ]"
+              ]
+            },
+            {
+              "bytes": 227,
+              "change": "created",
+              "file": "codex-elsewhere/hooks.json.bak"
+            }
+          ],
+          "history_db_created": true,
+          "stderr": [],
+          "stdout_first_lines": [
+            "RTK configured for Codex CLI.",
+            "  RTK.md:    <scratch>/codex-elsewhere/RTK.md",
+            "  Hook:      <scratch>/codex-elsewhere/hooks.json (registered)",
+            "  AGENTS.md: @<scratch>/codex-elsewhere/RTK.md reference added",
+            "  Codex global instructions path: <scratch>/codex-elsewhere/AGENTS.md",
+            "  Restart Codex. For a project hook, approve it when Codex asks you to trust it.",
+            "  Optional: if history recording fails with SQLITE_CANTOPEN in the"
+          ],
+          "step": "init"
+        }
+      ]
+    }
+  ],
+  "schema": "rtk-init-codex-probe/1"
+}
diff --git a/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk_behaviour_probe.py b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk_behaviour_probe.py
new file mode 100644
index 000000000..26010cc41
--- /dev/null
+++ b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk_behaviour_probe.py
@@ -0,0 +1,146 @@
+#!/usr/bin/env python3
+"""Reproduce the rtk behaviours that the README of this directory states from a measurement: what `rtk rewrite` rewrites with
+rtk's upstream defaults and with this repository's hook exclusions, and how rtk's compact forms differ from the shell's (the log
+cap and its notice, dropped merge commits, a dropped trailing newline, an error text, exit codes).
+
+    python3 rtk_behaviour_probe.py [OUTFILE]    # default: ~/.local/state/native-agent-stack/e2e/rtk-behaviour-probe.json
+
+Needs rtk and git on PATH. No model, no network and no host file: it builds a scratch repository and two scratch homes in a
+temporary directory and removes them, so rtk runs with no configuration of the host's and the host's `rtk gain` counter is not
+touched. One scratch home has no rtk configuration (upstream defaults); the other holds fixtures/rtk-hook-exclusions.toml, the
+five `exclude_commands` that the bootstrap installs, as `$XDG_CONFIG_HOME/rtk/config.toml`. Every command runs through
+subprocess, so the host's own command rewriting does not touch the shell side of a comparison. One run on one host with the
+installed rtk and git; the file records what each command returned (exit status, line counts, the first stderr lines), with the
+temporary path replaced. It is local_integration evidence, not an upstream test.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+EXCLUSIONS = Path(__file__).resolve().parents[3] / "fixtures" / "rtk-hook-exclusions.toml"
+
+# `rtk rewrite "<command>"`: what the PreToolUse hook would turn the command into (exit 0 or 3 and the new command), or nothing.
+REWRITE_CASES = (
+    "git status", "git status --short", "git log", "git log --oneline -3", "git log --stat", "git diff --exit-code",
+    "ls /nonexistent", "cat a/x/util.py", "grep -rl needle .", "find /nonexistent -name x",
+    "git status --short && echo done", "git log --oneline -3 | cat",
+    "git show HEAD:a/x/util.py", "diff /nonexistent a/x/util.py", "jq . data.json", "git branch", "echo hi", "bash -c 'git status'",
+)
+
+# Commands run in the fixture repository, once as the shell runs them and once with the `rtk` prefix (rtk's own compact forms;
+# the hook's exclusions do not apply to a command typed with the prefix).
+COMPARE_CASES = (
+    "git status --short", "git log", "git log --stat", "git log --oneline", "git log --format=%s", "git log --graph --oneline",
+    "git log -n 16", "git log --oneline -n 66", "git log --stat -n 16", "ls /nonexistent", "find /nonexistent -name x", "grep -rl needle .",
+)
+
+
+def scratch_env(home: Path) -> dict:
+    """The environment of a command: a scratch HOME and XDG tree (rtk keeps its configuration and its usage database there)."""
+    env = {**os.environ, "HOME": str(home), "RTK_TELEMETRY_DISABLED": "1", "GIT_PAGER": "cat", "LC_ALL": "C.UTF-8"}
+    for name, sub in (("XDG_CONFIG_HOME", ".config"), ("XDG_DATA_HOME", ".local/share"), ("XDG_CACHE_HOME", ".cache"),
+                      ("XDG_STATE_HOME", ".local/state")):
+        env[name] = str(home / sub)
+    return env
+
+
+def run(args: list[str], cwd: Path, home: Path) -> dict:
+    done = subprocess.run(args, cwd=cwd, capture_output=True, text=True, timeout=60, check=False, env=scratch_env(home))
+    return {"exit": done.returncode, "stdout": done.stdout, "stderr": done.stderr}
+
+
+def git(repo: Path, home: Path, *args: str) -> None:
+    subprocess.run(["git", "-c", "user.name=probe", "-c", "user.email=probe@example.invalid", *args], cwd=repo, check=True,
+                   capture_output=True, text=True, timeout=60,
+                   env={**scratch_env(home), "GIT_AUTHOR_DATE": "2026-01-01T00:00:00Z", "GIT_COMMITTER_DATE": "2026-01-01T00:00:00Z"})
+
+
+def fixture(repo: Path, home: Path) -> None:
+    """Sixty-four linear commits, one feature commit merged with --no-ff (sixty-six commits, one merge: past rtk's default of 50 for
+    compact log forms), a modified and an untracked file."""
+    git(repo, home, "init", "-q", "-b", "main")
+    (repo / "a" / "x").mkdir(parents=True)
+    (repo / "a" / "x" / "util.py").write_text("needle\n", encoding="utf-8")
+    (repo / "data.json").write_text("{}\n", encoding="utf-8")
+    git(repo, home, "add", ".")
+    git(repo, home, "commit", "-q", "-m", "commit 1")
+    for number in range(2, 65):
+        (repo / "a" / "x" / "util.py").write_text(f"needle {number}\n", encoding="utf-8")
+        git(repo, home, "commit", "-q", "-am", f"commit {number}")
+    git(repo, home, "checkout", "-q", "-b", "feature")
+    (repo / "feature.txt").write_text("feature\n", encoding="utf-8")
+    git(repo, home, "add", ".")
+    git(repo, home, "commit", "-q", "-m", "feature work")
+    git(repo, home, "checkout", "-q", "main")
+    git(repo, home, "merge", "-q", "--no-ff", "-m", "Merge branch feature", "feature")
+    (repo / "a" / "x" / "util.py").write_text("needle changed\n", encoding="utf-8")
+    (repo / "untracked.txt").write_text("x\n", encoding="utf-8")
+
+
+def summarize(result: dict, scratch: str) -> dict:
+    out, err = result["stdout"], result["stderr"]
+    return {
+        "exit": result["exit"],
+        "stdout_lines": len(out.splitlines()),
+        "stdout_ends_with_newline": out.endswith("\n") if out else None,
+        "commit_lines": sum(1 for line in out.splitlines() if line.startswith("commit ")),
+        "merge_lines": sum(1 for line in out.splitlines() if "Merge branch" in line),
+        "stderr_first_lines": [line.replace(scratch, "<scratch>") for line in err.splitlines()[:2]],
+        "mentions_usr_bin_ls": "/usr/bin/ls" in err,
+    }
+
+
+def rewrites(repo: Path, home: Path) -> list[dict]:
+    table = []
+    for command in REWRITE_CASES:
+        result = run(["rtk", "rewrite", command], repo, home)
+        table.append({"command": command, "exit": result["exit"], "rewritten_to": result["stdout"].strip() or None})
+    return table
+
+
+def main() -> int:
+    if not shutil.which("rtk") or not shutil.which("git"):
+        print("needs rtk and git on PATH", file=sys.stderr)
+        return 2
+    if not EXCLUSIONS.is_file():
+        print(f"missing {EXCLUSIONS}: run it from a checkout of the repository", file=sys.stderr)
+        return 2
+    target = Path(sys.argv[1]).expanduser() if len(sys.argv) > 1 else \
+        Path.home() / ".local/state/native-agent-stack/e2e/rtk-behaviour-probe.json"
+    with tempfile.TemporaryDirectory(prefix="rtk-probe-") as scratch:
+        repo, plain, excluding = (Path(scratch) / name for name in ("repo", "home-defaults", "home-exclusions"))
+        for directory in (repo, plain, excluding):
+            directory.mkdir()
+        (excluding / ".config" / "rtk").mkdir(parents=True)
+        shutil.copyfile(EXCLUSIONS, excluding / ".config" / "rtk" / "config.toml")
+        fixture(repo, plain)
+        versions = {"rtk": run(["rtk", "--version"], repo, plain)["stdout"].strip(),
+                    "git": run(["git", "--version"], repo, plain)["stdout"].strip()}
+        rewrite = {"upstream_defaults": rewrites(repo, plain), "repository_exclusions": rewrites(repo, excluding)}
+        compared = []
+        for command in COMPARE_CASES:
+            argv = command.split()
+            compared.append({"command": command, "shell": summarize(run(argv, repo, plain), scratch),
+                             "rtk": summarize(run(["rtk", *argv], repo, plain), scratch)})
+        commits = len(run(["git", "log", "--format=%H"], repo, plain)["stdout"].splitlines())
+        merges = len(run(["git", "log", "--merges", "--format=%H"], repo, plain)["stdout"].splitlines())
+    record = {"schema": "rtk-behaviour-probe/1", "evidence_class": "local_integration: one run, one host, a scratch repository",
+              "versions": versions, "fixture": {"commits": commits, "merge_commits": merges},
+              "exclusions_fixture_sha256": hashlib.sha256(EXCLUSIONS.read_bytes()).hexdigest(),
+              "rewrite": rewrite, "compared": compared}
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(json.dumps(record, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    print(f"wrote {target}: {len(REWRITE_CASES)} rewrite cases under two configurations, {len(compared)} compared commands")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk_init_codex_probe.py b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk_init_codex_probe.py
new file mode 100644
index 000000000..a4ec5442a
--- /dev/null
+++ b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk_init_codex_probe.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+"""Reproduce what `rtk init -g --codex` (rtk 0.51.0) changes in a Codex home, and how it is shown and undone, in scratch homes only.
+
+    python3 rtk_init_codex_probe.py [OUTFILE]    # default: ~/.local/state/native-agent-stack/e2e/rtk-init-codex-probe.json
+
+Needs rtk on PATH. No model, no network, no host file: every run uses a scratch HOME, XDG tree and CODEX_HOME in a temporary
+directory that is removed, so the host's Codex home, rtk configuration and `rtk gain` counter are untouched. The file records, per
+step, the exit status, the files created, changed and removed (with the changed lines of text files) and the `--show` lines, with the
+temporary path replaced. One run, one host, the installed rtk: local_integration evidence, not an upstream test.
+"""
+
+from __future__ import annotations
+
+import difflib
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+MANAGED_AGENTS = "# Existing managed instructions\n\n<!-- managed block -->\nUse the stack's tools.\n<!-- /managed block -->\n"
+MEMORY_HOOKS = {"hooks": {"PreToolUse": [{"matcher": "", "hooks": [{"type": "command", "command": "python3 /fixture/memory_hook.py"}]}]}}
+
+
+def snapshot(root: Path) -> dict:
+    return {str(path.relative_to(root)): path.read_text(encoding="utf-8", errors="replace")
+            for path in sorted(root.rglob("*")) if path.is_file()}
+
+
+def environment(home: Path, codex_home: Path) -> dict:
+    return {**os.environ, "HOME": str(home), "CODEX_HOME": str(codex_home), "RTK_TELEMETRY_DISABLED": "1",
+            "XDG_CONFIG_HOME": str(home / ".config"), "XDG_DATA_HOME": str(home / ".local/share"),
+            "XDG_CACHE_HOME": str(home / ".cache"), "XDG_STATE_HOME": str(home / ".local/state")}
+
+
+def step(label: str, args: list[str], home: Path, codex_home: Path, scratch: str, state: dict) -> tuple[dict, dict]:
+    done = subprocess.run(["rtk", *args], cwd=home, env=environment(home, codex_home), capture_output=True, text=True, timeout=60,
+                          stdin=subprocess.DEVNULL, check=False)
+    after = snapshot(Path(scratch))
+    changes = []
+    for name in sorted(set(state) | set(after)):
+        if name not in state:
+            changes.append({"file": name, "change": "created", "bytes": len(after[name])})
+        elif name not in after:
+            changes.append({"file": name, "change": "removed"})
+        elif state[name] != after[name]:
+            lines = [line[:160].replace(scratch, "<scratch>") for line in difflib.unified_diff(
+                state[name].splitlines(), after[name].splitlines(), lineterm="", n=0) if not line.startswith(("---", "+++", "@@"))]
+            changes.append({"file": name, "change": "changed", "lines": lines})
+    clean = lambda text: [line.replace(scratch, "<scratch>")[:170] for line in text.splitlines()]  # noqa: E731
+    record = {"step": label, "args": args, "exit": done.returncode, "files": [c for c in changes if not c["file"].endswith("history.db")],
+              "history_db_created": any(c["file"].endswith("history.db") and c["change"] == "created" for c in changes)}
+    if "--show" in args:
+        record["show"] = [line for line in clean(done.stdout) if line.startswith(("[ok]", "[--]"))]
+    else:
+        record["stdout_first_lines"] = [line for line in clean(done.stdout) if line.strip()][:7]
+        record["stderr"] = clean(done.stderr)[:2]
+    return record, after
+
+
+def scenario(label: str, with_agents: bool, steps: list[tuple[str, list[str]]], codex_elsewhere: bool = False) -> dict:
+    """Each step's changes are listed relative to the scratch root, where the scratch HOME is `fake-home`."""
+    with tempfile.TemporaryDirectory(prefix="rtk-init-") as scratch:
+        home = Path(scratch) / "fake-home"
+        codex_home = Path(scratch) / "codex-elsewhere" if codex_elsewhere else home / ".codex"
+        home.mkdir(parents=True)
+        codex_home.mkdir(parents=True, exist_ok=True)
+        if with_agents:
+            (codex_home / "AGENTS.md").write_text(MANAGED_AGENTS, encoding="utf-8")
+        (codex_home / "hooks.json").write_text(json.dumps(MEMORY_HOOKS, indent=2) + "\n", encoding="utf-8")
+        (codex_home / "config.toml").write_text("# scratch user layer\n", encoding="utf-8")
+        state, records = snapshot(Path(scratch)), []
+        for name, args in steps:
+            record, state = step(name, args, home, codex_home, scratch, state)
+            records.append(record)
+        return {"scenario": label, "steps": records}
+
+
+def main() -> int:
+    if not shutil.which("rtk"):
+        print("needs rtk on PATH", file=sys.stderr)
+        return 2
+    target = Path(sys.argv[1]).expanduser() if len(sys.argv) > 1 else \
+        Path.home() / ".local/state/native-agent-stack/e2e/rtk-init-codex-probe.json"
+    full = [("show before", ["init", "--show", "--codex"]), ("dry run", ["init", "-g", "--codex", "--dry-run"]),
+            ("init", ["init", "-g", "--codex"]), ("show after", ["init", "--show", "--codex"]),
+            ("init again", ["init", "-g", "--codex"]), ("uninstall", ["init", "-g", "--codex", "--uninstall"]),
+            ("show after uninstall", ["init", "--show", "--codex"])]
+    scenarios = [
+        scenario("a Codex home with its own AGENTS.md and a hooks.json", True, full),
+        scenario("a Codex home with a hooks.json and no AGENTS.md", False, [("init", ["init", "-g", "--codex"]),
+                                                                           ("uninstall", ["init", "-g", "--codex", "--uninstall"])]),
+        scenario("flags combined with --codex", True, [(flag, ["init", "-g", "--codex", flag]) for flag in
+                                                       ("--hook-only", "--no-patch", "--auto-patch")]),
+        scenario("CODEX_HOME outside HOME", False, [("init", ["init", "-g", "--codex"])], codex_elsewhere=True),
+    ]
+    record = {"schema": "rtk-init-codex-probe/1", "evidence_class": "local_integration: one run, one host, scratch homes",
+              "rtk": subprocess.run(["rtk", "--version"], capture_output=True, text=True, timeout=30, check=False).stdout.strip(),
+              "scenarios": scenarios}
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_text(json.dumps(record, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+    print(f"wrote {target}: {sum(len(s['steps']) for s in scenarios)} steps in {len(scenarios)} scenarios")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/evidence/artifacts/token-stack-fresh-session-e2e-20261004/trust_readback_race.py b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/trust_readback_race.py
new file mode 100644
index 000000000..a9195f1ff
--- /dev/null
+++ b/evidence/artifacts/token-stack-fresh-session-e2e-20261004/trust_readback_race.py
@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""Reproduce, on the real codex app-server, a hook whose definition changes right after the trust write, and print what
+tools/adoption/codex_hook_trust.py reports (one JSON object).
+
+    python3 trust_readback_race.py [TOOL_FILE]   # default: tools/adoption/codex_hook_trust.py of this checkout
+
+expectedVersion guards config.toml, not the file a hook is defined in, so the hooks file can change between the listing and
+the write. Here the tool runs against the installed codex app-server in a scratch Codex home with one hook (`echo named-hook`),
+and the hooks file is rewritten to `echo different-hook` as soon as config/batchWrite has returned. A correct read-back reports
+the hook as changed (Codex lists it `modified`: trusted_hash was written for the old definition) and exits 3; a read-back that
+searches for the command again finds nothing to complain about and reports success. Pass the file of an earlier revision
+(`git show c8613fe16:tools/adoption/codex_hook_trust.py`) to see the second. Nothing outside the scratch home is written, and the
+live ~/.codex is not read.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import importlib.util
+import io
+import json
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[3]
+sys.path.insert(0, str(ROOT / "tools" / "adoption"))
+import apply_codex_lane as lane  # noqa: E402
+
+
+def main() -> int:
+    tool_file = Path(sys.argv[1]).resolve() if len(sys.argv) > 1 else ROOT / "tools" / "adoption" / "codex_hook_trust.py"
+    codex = shutil.which("codex")
+    if not codex:
+        print("needs codex on PATH", file=sys.stderr)
+        return 2
+    spec = importlib.util.spec_from_file_location("trust_under_test", tool_file)
+    trust = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(trust)
+    with tempfile.TemporaryDirectory(prefix="trust-race-") as scratch:
+        base = Path(scratch)
+        home, project = base / "codex-home", base / "project"
+        home.mkdir()
+        project.mkdir()
+        (home / "config.toml").write_text("# scratch user layer\n", encoding="utf-8")
+        hooks_file = home / "hooks.json"
+
+        def write_hooks(command: str) -> None:
+            hooks_file.write_text(json.dumps({"hooks": {"PreToolUse": [{"matcher": "Bash", "hooks": [
+                {"type": "command", "command": command}]}]}}), encoding="utf-8")
+
+        write_hooks("echo named-hook")
+
+        class Racing(lane.AppServer):
+            """The real app-server, with the hooks file changed as soon as config/batchWrite has returned."""
+
+            def request(self, method, params):
+                result = super().request(method, params)
+                if method == "config/batchWrite":
+                    write_hooks("echo different-hook")
+                return result
+
+        out, err = io.StringIO(), io.StringIO()
+        original, lane.AppServer = lane.AppServer, Racing
+        try:
+            with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err):
+                code = trust.main(["--codex", codex, "--codex-home", str(home), "--cwd", str(project), "--command", "echo named-hook",
+                                   "--apply", "--codex-process-name", "no-such-process-name"])
+        finally:
+            lane.AppServer = original
+        version = subprocess.run([codex, "--version"], capture_output=True, text=True, timeout=60, check=False).stdout.strip()
+
+    def clean(text: str) -> str:
+        text = text.replace(scratch, "<scratch>")
+        return re.sub(r"\.bak\.\d{8}T\d{6}Z(\.\d+)?", ".bak.<stamp>", text).strip()
+
+    print(json.dumps({"tool": tool_file.name, "codex": version, "exit": code, "stdout": clean(out.getvalue()),
+                      "stderr": clean(err.getvalue())}, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/manifests/evidence.json b/manifests/evidence.json
index 5e37e3b17..de5063288 100644
--- a/manifests/evidence.json
+++ b/manifests/evidence.json
@@ -16482,6 +16482,11 @@
       "sha256": "77cd924e5e347929fe38f7f19d4ff25d179da65981c17fca03743d6f14208e68",
       "bytes": 7862
     },
+    {
+      "path": "docs/decisions/2026-10-04-codex-rtk-hook-qualified.md",
+      "sha256": "fc93f4173ecd6e21c6b0b2c4fd58be79d24b506698b4441e65bb088c43f762b7",
+      "bytes": 13314
+    },
     {
       "path": "docs/decisions/2026-10-04-coordinator-dispatch-and-spend.md",
       "sha256": "d091a1021eff71b11bf409b7896577566713788ecbf33e8f8c629e4d45ad26e1",
@@ -16654,8 +16659,8 @@
     },
     {
       "path": "docs/harness-defaults.md",
-      "sha256": "c49dc1046c214ffd0367d1fedbb2fc08807d4f3602e9bfab6de46da5ecfcb2bc",
-      "bytes": 184906
+      "sha256": "ca1091c14b65605c72d7aa6fdeb429f80a49c26774c6899dc1d757d1c67f19f7",
+      "bytes": 187468
     },
     {
       "path": "docs/harness-rules-convergence-20260922.md",
@@ -48292,6 +48297,56 @@
       "sha256": "cb14cfb9297c8c5cfd83ae1a2b6b05755fe14b5dfbebb8035c1240fa67b06ad0",
       "bytes": 7562
     },
+    {
+      "path": "evidence/artifacts/token-stack-fresh-session-e2e-20261004/README.md",
+      "sha256": "7beb441d44383fb44b2c34937fcee17e92bc0000b845dbc77da3268fa9501e54",
+      "bytes": 11469
+    },
+    {
+      "path": "evidence/artifacts/token-stack-fresh-session-e2e-20261004/codex_hook_qual.py",
+      "sha256": "fb2a2426a6564567a8276c74c2d6ada73e95643017d9536e8c3dd85a6f7fbe4f",
+      "bytes": 11503
+    },
+    {
+      "path": "evidence/artifacts/token-stack-fresh-session-e2e-20261004/fresh_session_e2e.sh",
+      "sha256": "86d9c5d0447fdfaa1b7c91497b9ca87ba1978db5771b167bdd14aff912219bd0",
+      "bytes": 6964
+    },
+    {
+      "path": "evidence/artifacts/token-stack-fresh-session-e2e-20261004/nativestack-before-snapshot.summary.md",
+      "sha256": "304e49102446295fb9de9c58602b56b8799baa4042b9871283c3f91161a66bcc",
+      "bytes": 4148
+    },
+    {
+      "path": "evidence/artifacts/token-stack-fresh-session-e2e-20261004/receipt.json",
+      "sha256": "b59c4fbf9c320f00f41952c08fe796ff9349452e1eeb9b9f8a426d21d84d4571",
+      "bytes": 10065
+    },
+    {
+      "path": "evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk-behaviour-probe.json",
+      "sha256": "838b32e26270edfa137a8d825bc7430f3ed86e6054806c28deba33f3918b12dc",
+      "bytes": 11574
+    },
+    {
+      "path": "evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk-init-codex-probe.json",
+      "sha256": "2865151f7e015d23e1afba1750bbab445b22b33c000ff1acc082cfd8f4ae49a9",
+      "bytes": 14351
+    },
+    {
+      "path": "evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk_behaviour_probe.py",
+      "sha256": "ee46570dfc9960ed0f05e90c7c2df1fcdbb6a8b1874f8dc7a417f135ce43a694",
+      "bytes": 8313
+    },
+    {
+      "path": "evidence/artifacts/token-stack-fresh-session-e2e-20261004/rtk_init_codex_probe.py",
+      "sha256": "e509397908e89bcc901335044890f296526694fcb678495fc71ae9b691e67b3b",
+      "bytes": 6479
+    },
+    {
+      "path": "evidence/artifacts/token-stack-fresh-session-e2e-20261004/trust_readback_race.py",
+      "sha256": "e803d89311703c22c22b15bd14db3b6fcc2c77346ada3cf75085eba51c8138a6",
+      "bytes": 3895
+    },
     {
       "path": "evidence/artifacts/token-tool-currency-20260927/METHOD.md",
       "sha256": "16d8b2e78deffeabc6e2900cb00514087a0a1746ee083924f6d0af659e1e89b1",
diff --git a/tests/test_codex_hook_trust.py b/tests/test_codex_hook_trust.py
new file mode 100644
index 000000000..fb5f7001b
--- /dev/null
+++ b/tests/test_codex_hook_trust.py
@@ -0,0 +1,317 @@
+"""tools/adoption/codex_hook_trust.py: trust the named hooks of one Codex home through config/batchWrite and read it back.
+
+The app-server is a fake that answers hooks/list and config/batchWrite the way the released codex-cli 0.159.3 does (the field
+names are those of its hooks/list response; the write shape is the TUI's write_hook_trusts); no real Codex, no real home, no
+network: local integration checks, not upstream tests. The real client was run against scratch homes in
+evidence/artifacts/token-stack-fresh-session-e2e-20261004/.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import copy
+import io
+import os
+import stat
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "tools" / "adoption"))
+
+import apply_codex_lane as lane  # noqa: E402
+import codex_hook_trust as trust  # noqa: E402
+
+RTK = "rtk hook codex"
+KEY = "/home/example/.codex/hooks.json:pre_tool_use:1:0"
+MEMORY_KEY = "/home/example/.codex/hooks.json:pre_tool_use:0:0"
+
+
+def hook(key: str, command: str, status: str = "untrusted", **changes) -> dict:
+    row = {"key": key, "command": command, "trustStatus": status, "source": "user", "isManaged": False,
+           "eventName": "preToolUse", "matcher": "Bash", "currentHash": "sha256:" + "b" * 64, "handlerType": "command",
+           "enabled": True}
+    row.update(changes)
+    return row
+
+
+class FakeServer:
+    """hooks/list, config/batchWrite and the user layer of one in-memory Codex home."""
+
+    def __init__(self, hooks, *, fail_write: dict | None = None, ignore_write: bool = False, after_write=None,
+                 errors: list | None = None, errors_after_write: list | None = None):
+        self.hooks, self.version, self.requests = hooks, "v1", []
+        self.fail_write, self.ignore_write = fail_write, ignore_write
+        # after_write(server) runs once the write has been applied: a change of the hooks file that lands during it
+        # (expectedVersion guards config.toml, not the file a hook is defined in). errors are the discovery errors hooks/list
+        # reports, and errors_after_write the ones it reports once the write is done.
+        self.after_write, self.errors, self.errors_after_write, self.written = after_write, errors or [], errors_after_write, False
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+    def user_layer(self):
+        return self.version, {}
+
+    def request(self, method, params):
+        self.requests.append((method, copy.deepcopy(params)))
+        if method == "hooks/list":
+            errors = self.errors_after_write if self.written and self.errors_after_write is not None else self.errors
+            return {"data": [{"cwd": params["cwds"][0], "hooks": copy.deepcopy(self.hooks), "errors": copy.deepcopy(errors),
+                              "warnings": []}]}
+        if method == "config/batchWrite":
+            if self.fail_write:
+                raise lane.AppServerError(method, self.fail_write)
+            if not self.ignore_write:
+                for edit in params["edits"]:
+                    for key, state in edit["value"].items():
+                        for row in self.hooks:
+                            if row["key"] == key:
+                                row["trustStatus"] = "trusted" if state["trusted_hash"] == row["currentHash"] else "modified"
+            self.version, self.written = "v2", True
+            if self.after_write:
+                self.after_write(self)
+            return {"status": "ok", "version": self.version}
+        raise AssertionError(method)
+
+    def writes(self):
+        return [params for method, params in self.requests if method == "config/batchWrite"]
+
+
+class Case(unittest.TestCase):
+    def setUp(self):
+        self._scratch = tempfile.TemporaryDirectory()
+        self.addCleanup(self._scratch.cleanup)
+        self.dir = Path(self._scratch.name)
+        self.home = self.dir / "home"
+        self.home.mkdir()
+        self.config = self.home / "config.toml"
+        self.config.write_text('model = "x"\n', encoding="utf-8")
+        self.codex = self.dir / "codex"
+        self.codex.write_text("#!/bin/sh\nexit 9\n", encoding="utf-8")
+        self.codex.chmod(0o700)
+
+    def run_tool(self, server, *extra: str, running=()):
+        out, err = io.StringIO(), io.StringIO()
+        with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err), \
+                mock.patch.object(trust.lane, "AppServer", return_value=server), \
+                mock.patch.object(trust.lane, "codex_processes", return_value=list(running)):
+            code = trust.main(["--codex", str(self.codex), "--codex-home", str(self.home), "--command", RTK, *extra])
+        return code, out.getvalue(), err.getvalue()
+
+
+class DryRunTests(Case):
+    def test_a_dry_run_lists_the_match_and_makes_no_trust_or_config_edit(self):
+        server = FakeServer([hook(MEMORY_KEY, "ai-memory --data-dir x", "trusted"), hook(KEY, RTK)])
+        code, out, err = self.run_tool(server)
+        self.assertEqual(code, 0, err)
+        self.assertIn(f"{KEY}: preToolUse Bash 'rtk hook codex' is untrusted", out)
+        self.assertNotIn(MEMORY_KEY, out)  # a hook whose command was not named is not even listed
+        self.assertIn("1 hook(s) would be trusted", out)
+        self.assertEqual(server.writes(), [])
+        self.assertEqual([p.name for p in self.home.iterdir()], ["config.toml"])
+
+    def test_every_named_hook_already_trusted_is_nothing_to_do(self):
+        server = FakeServer([hook(KEY, RTK, "trusted")])
+        code, out, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 0, err)
+        self.assertIn("nothing to do", out)
+        self.assertEqual(server.writes(), [])
+        self.assertEqual([p.name for p in self.home.iterdir()], ["config.toml"])  # not even a backup
+
+    def test_no_hook_with_the_named_command_is_exit_4(self):
+        server = FakeServer([hook(MEMORY_KEY, "ai-memory --data-dir x", "trusted")])
+        code, _, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 4)
+        self.assertIn("register it first", err)
+        self.assertEqual(server.writes(), [])
+
+
+class ApplyTests(Case):
+    def test_apply_backs_up_writes_the_tuis_edit_and_reads_back(self):
+        server = FakeServer([hook(MEMORY_KEY, "ai-memory --data-dir x", "trusted"), hook(KEY, RTK)])
+        code, out, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 0, err)
+        (write,) = server.writes()
+        self.assertEqual(write["expectedVersion"], "v1")
+        self.assertEqual(write["edits"], [{"keyPath": "hooks.state", "mergeStrategy": "upsert",
+                                           "value": {KEY: {"trusted_hash": "sha256:" + "b" * 64}}}])
+        self.assertEqual([row["trustStatus"] for row in server.hooks], ["trusted", "trusted"])
+        self.assertIn("trusted 1 hook(s)", out)
+        (backup,) = [p for p in self.home.iterdir() if p.name.startswith("config.toml.bak.")]
+        self.assertEqual(backup.read_text(encoding="utf-8"), 'model = "x"\n')
+        self.assertEqual(stat.S_IMODE(backup.stat().st_mode), 0o600)
+
+    def test_only_the_named_hooks_are_trusted(self):
+        other = hook("/home/example/.codex/hooks.json:stop:0:0", "ai-memory --data-dir x", eventName="stop", matcher="")
+        server = FakeServer([other, hook(KEY, RTK)])
+        code, _, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 0, err)
+        (write,) = server.writes()
+        self.assertEqual(list(write["edits"][0]["value"]), [KEY])
+        self.assertEqual(server.hooks[0]["trustStatus"], "untrusted")
+
+    def test_a_modified_hook_is_trusted_again_at_its_current_hash(self):
+        server = FakeServer([hook(KEY, RTK, "modified", currentHash="sha256:" + "c" * 64)])
+        code, out, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 0, err)
+        self.assertEqual(server.writes()[0]["edits"][0]["value"][KEY]["trusted_hash"], "sha256:" + "c" * 64)
+        self.assertEqual(server.hooks[0]["trustStatus"], "trusted")
+
+    def test_a_project_hook_a_managed_hook_and_a_non_command_handler_are_never_trusted(self):
+        rows = [hook("/p/.codex/hooks.json:pre_tool_use:0:0", RTK, source="project"),
+                hook("managed:pre_tool_use:0:0", RTK, "managed", source="system", isManaged=True),
+                hook("/home/example/.codex/config.toml:pre_tool_use:0:0", RTK, handlerType="mcp_tool")]
+        server = FakeServer(rows)
+        code, _, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 4, err)
+        self.assertEqual(server.writes(), [])
+
+    def test_two_commands_may_be_named(self):
+        second = hook("/home/example/.codex/hooks.json:stop:1:0", "other-hook", eventName="stop", matcher="")
+        server = FakeServer([hook(KEY, RTK), second])
+        out, err = io.StringIO(), io.StringIO()
+        with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err), \
+                mock.patch.object(trust.lane, "AppServer", return_value=server), \
+                mock.patch.object(trust.lane, "codex_processes", return_value=[]):
+            code = trust.main(["--codex", str(self.codex), "--codex-home", str(self.home), "--command", RTK,
+                               "--command", "other-hook", "--apply"])
+        self.assertEqual(code, 0, err.getvalue())
+        self.assertEqual(sorted(server.writes()[0]["edits"][0]["value"]), sorted([KEY, second["key"]]))
+
+    def test_a_running_codex_refuses_before_any_write(self):
+        server = FakeServer([hook(KEY, RTK)])
+        code, _, err = self.run_tool(server, "--apply", running=["4242"])
+        self.assertEqual(code, 2)
+        self.assertIn("4242", err)
+        self.assertEqual(server.writes(), [])
+        self.assertEqual([p.name for p in self.home.iterdir()], ["config.toml"])
+
+    def test_a_running_codex_does_not_block_a_dry_run_or_a_no_op(self):
+        for hooks, extra in (([hook(KEY, RTK)], ()), ([hook(KEY, RTK, "trusted")], ("--apply",))):
+            with self.subTest(extra=extra):
+                code, _, err = self.run_tool(FakeServer(hooks), *extra, running=["4242"])
+                self.assertEqual(code, 0, err)
+
+    def test_a_failed_write_is_exit_3_and_names_the_backup(self):
+        server = FakeServer([hook(KEY, RTK)], fail_write={"message": "version conflict", "code": -32600})
+        code, _, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 3)
+        self.assertIn("version conflict", err)
+        self.assertIn("config.toml.bak.", err)
+        self.assertEqual(server.hooks[0]["trustStatus"], "untrusted")
+
+    def test_a_hook_the_writer_still_reports_untrusted_is_a_failure(self):
+        server = FakeServer([hook(KEY, RTK)], ignore_write=True)
+        code, _, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 3)
+        self.assertIn("still reports not trusted", err)
+        self.assertIn(KEY, err)
+
+    def test_a_hook_whose_definition_changed_during_the_write_is_a_failure(self):
+        # The second hooks/list is read by key and hash, not by command again: a hook that now has another command is `modified`
+        # (trusted_hash was written for the old definition) and must not drop out of the check.
+        def change(server):
+            server.hooks[0].update(command="rtk hook other", currentHash="sha256:" + "d" * 64, trustStatus="modified")
+
+        server = FakeServer([hook(KEY, RTK)], after_write=change)
+        code, out, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 3)
+        self.assertIn(KEY, err)
+        self.assertIn("changed during the write", err)
+        self.assertNotIn("trusted 1 hook", out)
+        self.assertIn("config.toml.bak.", err)
+
+    def test_a_hook_that_vanished_during_the_write_is_a_failure(self):
+        server = FakeServer([hook(KEY, RTK)], after_write=lambda s: s.hooks.clear())
+        code, out, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 3)
+        self.assertIn(KEY, err)
+        self.assertIn("no longer listed", err)
+        self.assertNotIn("trusted 1 hook", out)
+
+    def test_a_hook_that_left_the_user_layer_during_the_write_is_a_failure(self):
+        for change in ({"source": "project"}, {"isManaged": True}, {"handlerType": "prompt"}):
+            with self.subTest(change=change):
+                server = FakeServer([hook(KEY, RTK)], after_write=lambda s, c=change: s.hooks[0].update(c))
+                code, out, err = self.run_tool(server, "--apply")
+                self.assertEqual(code, 3)
+                self.assertIn("no longer a user-layer command hook", err)
+                self.assertNotIn("trusted 1 hook", out)
+
+    def test_an_already_trusted_hook_that_vanished_during_the_write_is_a_failure(self):
+        other = hook("/home/example/.codex/hooks.json:stop:0:0", "other-hook", "trusted", eventName="stop", matcher="")
+
+        def drop_other(server):
+            server.hooks[:] = [row for row in server.hooks if row["key"] == KEY]
+
+        server = FakeServer([hook(KEY, RTK), other], after_write=drop_other)
+        out, err = io.StringIO(), io.StringIO()
+        with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err), \
+                mock.patch.object(trust.lane, "AppServer", return_value=server), \
+                mock.patch.object(trust.lane, "codex_processes", return_value=[]):
+            code = trust.main(["--codex", str(self.codex), "--codex-home", str(self.home), "--command", RTK,
+                               "--command", "other-hook", "--apply"])
+        self.assertEqual(code, 3, out.getvalue())
+        self.assertIn(other["key"], err.getvalue())
+        self.assertIn("no longer listed", err.getvalue())
+
+    def test_a_discovery_error_that_appears_with_the_write_is_a_failure(self):
+        error = {"path": "/home/example/.codex/hooks.json", "message": "expected value at line 3 column 1"}
+        server = FakeServer([hook(KEY, RTK)], errors_after_write=[error])
+        code, out, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 3)
+        self.assertIn("expected value at line 3 column 1", err)
+        self.assertIn("/home/example/.codex/hooks.json", err)
+        self.assertNotIn("trusted 1 hook", out)
+
+    def test_a_discovery_error_that_was_already_there_is_reported_and_is_not_a_failure(self):
+        error = {"path": "/work/proj/.codex/hooks.json", "message": "unrelated parse error"}
+        server = FakeServer([hook(KEY, RTK)], errors=[error])
+        for extra in ((), ("--apply",)):
+            with self.subTest(extra=extra):
+                code, out, err = self.run_tool(server, *extra)
+                self.assertEqual(code, 0, err)
+                self.assertIn("unrelated parse error", out)
+                self.assertIn("/work/proj/.codex/hooks.json", out)
+
+    def test_the_read_back_names_the_hash_it_trusted(self):
+        server = FakeServer([hook(KEY, RTK)])
+        code, out, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 0, err)
+        self.assertIn("read back from hooks/list by key and hash", out)
+
+    def test_a_home_without_a_config_file_gets_no_backup(self):
+        self.config.unlink()
+        server = FakeServer([hook(KEY, RTK)])
+        code, out, err = self.run_tool(server, "--apply")
+        self.assertEqual(code, 0, err)
+        self.assertNotIn("backup:", out)
+        self.assertEqual(os.listdir(self.home), [])
+
+    def test_no_codex_executable_is_refused(self):
+        out, err = io.StringIO(), io.StringIO()
+        with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err), \
+                mock.patch.object(trust.shutil, "which", return_value=None):
+            code = trust.main(["--codex-home", str(self.home), "--command", RTK])
+        self.assertEqual(code, 2)
+        self.assertIn("no codex executable", err.getvalue())
+
+    def test_two_backups_in_one_second_do_not_overwrite_each_other(self):
+        with mock.patch.object(trust.lane, "utc_stamp", return_value="20261004T000000Z"):
+            first = trust.write_backup(self.config)
+            self.config.write_text('model = "y"\n', encoding="utf-8")
+            second = trust.write_backup(self.config)
+        self.assertNotEqual(first, second)
+        self.assertEqual(first.read_text(encoding="utf-8"), 'model = "x"\n')
+        self.assertEqual(second.read_text(encoding="utf-8"), 'model = "y"\n')
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/adoption/codex_hook_trust.py b/tools/adoption/codex_hook_trust.py
new file mode 100644
index 000000000..91f9d5a48
--- /dev/null
+++ b/tools/adoption/codex_hook_trust.py
@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+"""Trust named hooks of one Codex home the way Codex's own /hooks review persists a decision, and read the result back.
+
+Codex runs a non-managed hook only while its current hash equals `[hooks.state."<key>"].trusted_hash`; a hook with no entry is
+`untrusted` and one whose definition changed is `modified`, and both are skipped (openai/codex rust-v0.159.3, commit
+01fc69f4026735edfdf6789820549727a4867b11: codex-rs/hooks/src/engine/discovery.rs hook_hash L775 and hook_trust_status L794-L815;
+codex-rs/hooks/src/config_rules.rs hook_states_from_stack L15-L62 merges the state tables across config layers). `rtk init -g
+--codex` registers rtk's PreToolUse hook but cannot trust it. The TUI persists a trust decision with config/batchWrite of the key
+`hooks.state`, mergeStrategy upsert, `{"<key>": {"trusted_hash": <currentHash>}}` (codex-rs/tui/src/hooks_rpc.rs write_hook_trusts
+L58-L91), where key and currentHash are what hooks/list reports. This tool sends that edit through `codex app-server`, for only the
+hooks of the base user layer whose command equals one named with --command, never for any other hook, a managed hook or a project's.
+
+  python3 tools/adoption/codex_hook_trust.py --command "rtk hook codex"            # dry run: each match, its status, its hash
+  python3 tools/adoption/codex_hook_trust.py --command "rtk hook codex" --apply    # back up config.toml (0600), trust, read back
+
+A dry run makes no trust or config edit and no backup. It is not read-only: starting the app-server creates its own state files in
+the Codex home (SQLite databases, an installation id, the bundled skills; measured on a scratch home, 2026-10-04).
+
+The grant is a trust decision about a hook that sees every tool call it matches (rtk's sees each Bash command), so it belongs to
+the host's owner: a plan row runs it only under a recorded decision (docs/decisions/2026-10-04-codex-rtk-hook-qualified.md). A
+hook whose command changed is a different hook: this tool trusts the command it is told to, at its current definition, and a later
+change of the hook (a moved group index changes the key) returns it to `untrusted` until the tool runs again.
+
+--apply refuses while a codex process runs (as apply_codex_lane.py does), writes config.toml.bak.<UTC stamp> beside the config first
+(never overwriting one), sends the edit with the user layer's version as expectedVersion (a changed file is refused) and then
+asks hooks/list again. expectedVersion guards config.toml, not the file a hook is defined in, so the read-back does not search
+for the command again: every hook that was named must still be listed under its key as a user-layer command hook, at the hash
+it had, and `trusted`; a hook that vanished, moved or changed during the write, and a discovery error that was not there before
+the write, are failures. It is idempotent: with every match already trusted it makes no edit.
+Exit status: 0 done or nothing to do, 2 refused before any write, 3 a write or the read-back failed, 4 no hook of the user layer
+has a named command (register it first), 1 unexpected.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import shutil
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import apply_codex_lane as lane  # noqa: E402
+
+
+def inventory(server, cwd: Path) -> tuple[list[dict], list[tuple[str, str]]]:
+    """The hooks Codex loads for ``cwd`` (hooks/list), every config layer, and the discovery errors it reports for them as
+    (path, message) pairs."""
+    entries = server.request("hooks/list", {"cwds": [str(cwd)]}).get("data") or []
+    hooks = [hook for entry in entries for hook in entry.get("hooks") or []]
+    errors = [(error.get("path") or "", error.get("message") or "") for entry in entries for error in entry.get("errors") or []]
+    return hooks, errors
+
+
+def matches(hooks: list[dict], commands: set[str]) -> list[dict]:
+    """The hooks this tool may trust: a command handler of the user layer, not managed, whose command is exactly one named."""
+    chosen = [hook for hook in hooks if hook.get("handlerType") == "command" and hook.get("command") in commands
+              and hook.get("source") == "user" and not hook.get("isManaged")]
+    return sorted(chosen, key=lambda hook: hook.get("key") or "")
+
+
+def read_back_problems(named: list[dict], listed: list[dict]) -> list[str]:
+    """What the read-back finds wrong with the hooks that were named, each looked up by its key: it must still be listed, still a
+    user-layer command hook, at the hash it had (a changed definition has another hash and a trust written for the old one no
+    longer applies) and trusted."""
+    by_key = {hook.get("key"): hook for hook in listed}
+    problems = []
+    for before in named:
+        now = by_key.get(before.get("key"))
+        if now is None:
+            problems.append(f"{before.get('key')}: no longer listed")
+        elif now.get("handlerType") != "command" or now.get("source") != "user" or now.get("isManaged"):
+            problems.append(f"{before.get('key')}: no longer a user-layer command hook")
+        elif now.get("currentHash") != before.get("currentHash"):
+            problems.append(f"{before.get('key')}: changed during the write ({now.get('command')!r} is {now.get('trustStatus')})")
+        elif now.get("trustStatus") != "trusted":
+            problems.append(f"{before.get('key')}: still reports not trusted ({now.get('trustStatus')})")
+    return problems
+
+
+def describe(hook: dict) -> str:
+    where = hook.get("matcher") or "(any)"
+    return f"  {hook.get('key')}: {hook.get('eventName')} {where} {hook.get('command')!r} is {hook.get('trustStatus')}"
+
+
+def backup_path(config: Path) -> Path:
+    stamp = lane.utc_stamp()
+    candidate = config.with_name(f"{config.name}.bak.{stamp}")
+    suffix = 0
+    while candidate.exists():
+        suffix += 1
+        candidate = config.with_name(f"{config.name}.bak.{stamp}.{suffix}")
+    return candidate
+
+
+def write_backup(config: Path) -> Path:
+    target = backup_path(config)
+    fd = os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(fd, "wb") as handle:
+        handle.write(config.read_bytes())
+    return target
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--command", action="append", required=True, metavar="COMMAND",
+                        help="trust the user-layer hook whose command is exactly this (repeatable)")
+    parser.add_argument("--apply", action="store_true", help="write the trust (default: dry run)")
+    parser.add_argument("--codex-home", help="the Codex home (default: $CODEX_HOME, else ~/.codex)")
+    parser.add_argument("--codex", help="the codex executable (default: codex on PATH)")
+    parser.add_argument("--cwd", help="the working directory hooks/list is asked for (default: the Codex home)")
+    parser.add_argument("--codex-process-name", default="codex", help="the process name --apply refuses to run beside")
+    return parser
+
+
+def run(args: argparse.Namespace) -> int:
+    codex = args.codex or shutil.which("codex")
+    if not codex:
+        print("refused: no codex executable on PATH (or --codex)", file=sys.stderr)
+        return 2
+    home = Path(args.codex_home or os.environ.get("CODEX_HOME") or Path.home() / ".codex").expanduser()
+    config = home / "config.toml"
+    cwd = Path(args.cwd).expanduser() if args.cwd else home
+    commands = set(args.command)
+    # Before the app-server starts: that child is itself a codex process.
+    running = lane.codex_processes(args.codex_process_name) if args.apply else []
+    backup = None
+    try:
+        with lane.AppServer(codex, lane.codex_env(home), cwd) as server:
+            listed, errors_before = inventory(server, cwd)
+            found = matches(listed, commands)
+            if not found:
+                print(f"no user-layer hook of {home} has a command named ({', '.join(sorted(commands))}): register it first, "
+                      f"for rtk `rtk init -g --codex`", file=sys.stderr)
+                return 4
+            print(f"hooks named in {home}:")
+            for hook in found:
+                print(describe(hook))
+            for path, message in errors_before:
+                print(f"  note: hooks/list reports a discovery error before any write: {path}: {message}")
+            todo = [hook for hook in found if hook.get("trustStatus") != "trusted"]
+            if not todo:
+                print("nothing to do: every named hook is trusted")
+                return 0
+            if not args.apply:
+                print(f"dry run: {len(todo)} hook(s) would be trusted at their current hash through config/batchWrite "
+                      f"(hooks.state, upsert); run with --apply (no codex process running) to do it")
+                return 0
+            if running:
+                print(f"refused: {len(running)} codex processes running (pids {', '.join(running)})", file=sys.stderr)
+                return 2
+            if config.is_file():
+                backup = write_backup(config)
+                print(f"backup: {backup}")
+            version, _ = server.user_layer()
+            server.request("config/batchWrite", {
+                "edits": [{"keyPath": "hooks.state", "mergeStrategy": "upsert",
+                           "value": {hook["key"]: {"trusted_hash": hook["currentHash"]} for hook in todo}}],
+                "expectedVersion": version})
+            listed_after, errors_after = inventory(server, cwd)
+    except (lane.Failed, lane.AppServerError) as error:
+        print(f"failed: {error}" + (f"; the backup is {backup}" if backup else ""), file=sys.stderr)
+        return 3
+    problems = read_back_problems(found, listed_after)
+    problems += [f"discovery error after the write: {path}: {message}" for path, message in errors_after
+                 if (path, message) not in errors_before]
+    if problems:
+        print("failed: hooks/list after the write: " + "; ".join(problems) + (f"; the backup is {backup}" if backup else ""),
+              file=sys.stderr)
+        return 3
+    print(f"trusted {len(todo)} hook(s) in {config}; read back from hooks/list by key and hash")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    return run(build_parser().parse_args(argv))
+
+
+if __name__ == "__main__":
+    sys.exit(main())