Every recorded miss in this practice **failed open**: the hook ran, exited 0, and guarded nothing. A heredoc program ate the payload and the fail-open handler returned success. A `Stop` gate graded the previous reply while passing its own suite. A `grep` whose pattern did not parse returned exit 2, which the handler read as "no matches". A gate denied the one directory the operation deliberately was not in.
