diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
index de64939a..4a9944a8 100644
--- a/.github/workflows/build-linux.yml
+++ b/.github/workflows/build-linux.yml
@@ -484,7 +484,9 @@ jobs:
           # release leg is what the release resembles.
           # The libfiu fault points (dev/DECISIONS.md, 2026-09-30) are compiled
           # in on the same leg, for the same reason: their tests skip elsewhere.
-          ENABLE_TEST_HOOKS: ${{ matrix.debug && '--enable-tas-test-hooks --enable-fault-injection' || '' }}
+          # So are the `_http_*` hooks that 20 phpt need: the log sinks,
+          # reactor_pool/* and telemetry 001-003.
+          ENABLE_TEST_HOOKS: ${{ matrix.debug && '--enable-tas-test-hooks --enable-fault-injection --enable-http-server-test-hooks' || '' }}
         run: |
           set -eux
           if [ -n "$ENABLE_TEST_HOOKS" ]; then
diff --git a/dev/PLAN.md b/dev/PLAN.md
index a890e96c..dcd936fe 100644
--- a/dev/PLAN.md
+++ b/dev/PLAN.md
@@ -260,16 +260,22 @@ an item marked "reproduce" gets its failing run before any code.
     here; it also kills the mutant whose refused `start()` on a running server
     clears the flag of the run on the stack. The flag's reset on the bailout
     exit has no test.
-16. #348 — static passthrough on HTTP/1: a file under `on_missing: Next` that
-    fails the engine's `open()` (mode 0) started the handler twice on one ctx
-    and crashed, 3 of 3; PR 349 drops the HTTP/1 hook that spawned it.
+16. #348 — static passthrough on HTTP/1: done, PR 349 (09ab593). A file under
+    `on_missing: Next` that fails the engine's `open()` (mode 0) started the
+    handler twice on one ctx and crashed, 3 of 3; `static/025`.
 
 Added by the health check of 2026-09-30 (`dev/HEALTH.md`), in this order:
 
 17. The HTTP server test hooks run in CI: the debug leg passes
     `--enable-http-server-test-hooks`, and the 20 phpt gated on `_http_*`
     functions (reactor_pool, telemetry 001-003, eight in core) run and pass.
-    Run them locally with the flag first: nothing has run them in CI.
+    Locally, built with the flag: `core/030` crashed 3 of 3 in php-async's
+    `io_pipe_write_cb`, which cleared `io` on a write request its listener had
+    freed and reallocated (true-async/php-async#310, fix #311, asynctest case
+    true-async/php-src#39). With the fix the 20, with the four tas-hooks tests
+    and the rest of `reactor_pool/`, pass 35 of 35, 3 runs of 3. In CI the
+    first run of this change crashed `core/030` the same way, 544 others
+    passing; php-async #311 is merged.
 18. A failed `fflush` or `fclose` fails the upload: done (#380). A
     `tmp_path_generator` linking to `/dev/full` gives a 16-byte part
     `UPLOAD_ERR_OK` and a 64 KiB part CANT_WRITE with its partial temp file