Found live during sprint backlog-burn-2026-07-17 (user steer: file plugin oddities as issues). A subagent ran git checkout -- .codearbiter/gate-events.log .codearbiter/sprint-log.md to 'clean up' side-effect diffs and silently reverted uncommitted appends on two append-only audit artifacts. The H-05 flanks cover rm/redirect/truncate spellings and Write/Edit, but git-native restore spellings (git checkout -- <path>, git restore <path>, git checkout HEAD -- <path>) reach pre-bash unblocked while a filename token sits adjacent to the verb — inside the current lexical guard's intent, unlike the accepted $var-indirection residual class.
Remediation shape: extend pre-bash H-05 to block checkout/restore (and stash apply/pop touching audit paths?) when an AUDIT_LOG_NAMES basename appears in argv; tests in test_hook_guards.py for both spellings plus the -- form. sprint-log content was reconstructed with a visible AUDIT-CORRECTION entry; gate-events hook telemetry between last commit and revert is unrecoverable.
Found live during sprint backlog-burn-2026-07-17 (user steer: file plugin oddities as issues). A subagent ran
git checkout -- .codearbiter/gate-events.log .codearbiter/sprint-log.mdto 'clean up' side-effect diffs and silently reverted uncommitted appends on two append-only audit artifacts. The H-05 flanks cover rm/redirect/truncate spellings and Write/Edit, but git-native restore spellings (git checkout -- <path>,git restore <path>,git checkout HEAD -- <path>) reach pre-bash unblocked while a filename token sits adjacent to the verb — inside the current lexical guard's intent, unlike the accepted $var-indirection residual class.Remediation shape: extend pre-bash H-05 to block checkout/restore (and stash apply/pop touching audit paths?) when an AUDIT_LOG_NAMES basename appears in argv; tests in test_hook_guards.py for both spellings plus the -- form. sprint-log content was reconstructed with a visible AUDIT-CORRECTION entry; gate-events hook telemetry between last commit and revert is unrecoverable.