fix(hooks): run the barrier on merges, where the markers come from

[gHashTag]

Closes #3318

Measured, git 2.50.1, marker hooks over five commit-creating events:

event	pre-commit	commit-msg
normal commit	yes	yes
--amend	yes	yes
--allow-empty	yes	yes
merge --no-ff	no	yes
cherry-pick	no	no

Every gate in tri hooks pre-commit — the conflict-marker refusal above all — was silent on the one commit type conflict markers actually come from.

git merge runs pre-merge-commit, and a non-zero exit stops the merge; verified, HEAD stayed on the pre-merge commit. The index at that moment holds the merge RESULT, which is exactly the operand the barrier reads since #3302 corrected it to --staged.

Controls, both sides. A merge whose result carries a marker exits 1, prints carries a conflict marker, and does not happen. A clean merge exits 0 and does.

cherry-pick runs neither hook and git offers none that could stop it. Stated as a known gap rather than papered over.

The class is the population of EVENTS — not the predicate, not the operand. Yesterday it was a push that could be a deletion (#3309); today a commit that could be a merge. Both found by asking "what else comes through here", neither by any control.

[github-actions]

📓 NotebookLM Notebook linked to this PR

• Notebook ID: b83263109fb055dc
• URL: https://notebooklm.google.com/notebook/b83263109fb055dc

This notebook contains session context, decisions, and artifacts for this work.

[github-actions]

PR Dashboard

Generated at: 2026-09-05 18:11:35 UTC

• fix(hooks): run the barrier on merges, where the markers come from #3319 fix(hooks): run the barrier on merges, where the markers come from | Created: 2026-09-05 | Updated: 2026-09-05 | 21 failing / 25 total
• compiler: two frozen tests get the anchor their region needed #3317 compiler: two frozen tests get the anchor their region needed | Created: 2026-09-05 | Updated: 2026-09-05 | 6 failing / 36 total
• ci: zero checks is not zero failures, on the path that merges #3314 ci: zero checks is not zero failures, on the path that merges | Created: 2026-09-05 | Updated: 2026-09-05 | 0 failing / 28 total
• chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 #3001 chore(ci)(deps): bump actions/attest-build-provenance from 1 to 4 | Created: 2026-09-01 | Updated: 2026-09-05 | 3 failing / 30 total
• chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 #3000 chore(ci)(deps): bump softprops/action-gh-release from 2 to 3 | Created: 2026-09-01 | Updated: 2026-09-05 | 3 failing / 30 total
• chore(ci)(deps): bump github/codeql-action from 3 to 4 #2999 chore(ci)(deps): bump github/codeql-action from 3 to 4 | Created: 2026-09-01 | Updated: 2026-09-05 | 3 failing / 30 total
• Land the formal verification harness on master (it has never run) #2727 Land the formal verification harness on master (it has never run) | Created: 2026-08-27 | Updated: 2026-09-05 | 5 failing / 24 total
• chore(deps)(deps): bump thiserror from 2.0.18 to 2.0.20 #2693 chore(deps)(deps): bump thiserror from 2.0.18 to 2.0.20 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• chore(deps)(deps): bump hyper from 1.10.1 to 1.11.0 #2692 chore(deps)(deps): bump hyper from 1.10.1 to 1.11.0 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 33 total
• chore(deps)(deps): bump base64 from 0.22.1 to 0.23.1 #2691 chore(deps)(deps): bump base64 from 0.22.1 to 0.23.1 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• chore(deps)(deps): bump serde from 1.0.228 to 1.0.229 #2690 chore(deps)(deps): bump serde from 1.0.228 to 1.0.229 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• chore(deps)(deps): bump uuid from 1.23.2 to 1.25.0 #2689 chore(deps)(deps): bump uuid from 1.23.2 to 1.25.0 | Created: 2026-08-24 | Updated: 2026-08-28 | 3 failing / 34 total
• Unbreak FPGA CI and correct two unbacked hardware claims #2081 Unbreak FPGA CI and correct two unbacked hardware claims | Created: 2026-08-11 | Updated: 2026-08-20 | 5 failing / 27 total

Summary

Status	Count
Total Open PRs	13
PRs with Failing Checks	10
PRs with All Checks Green	3
READY	1
FAILING	10
PENDING	0

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=ffccfa1a71cf != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).